L2 Tunneling Protocols Explained: GRE, L2TP, VXLAN and When to Use Each
A practical guide to Layer 2 tunneling — how GRE, L2TP, and VXLAN work, their differences, real configuration examples on Linux and Cisco, and which to use for different network scenarios.
What is Layer 2 Tunneling?
When you connect two network sites over the internet or a WAN link, you're typically dealing with Layer 3 — IP routing between sites. But sometimes you need to extend a Layer 2 network across that routed boundary: you want devices at both sites to be on the same broadcast domain, the same VLAN, as if they were plugged into the same switch.
This is what L2 tunneling solves. You encapsulate Ethernet frames inside IP packets, send them across the routed network, and the receiving end strips the encapsulation and delivers the original frame to the local network.
Real-world scenarios where L2 tunneling is essential:
- Extending a VLAN between two factory buildings connected via fiber
- Connecting a remote railway relay room to the control centre on the same management VLAN
- Live migrating VMs between data centres (VXLAN)
- Providing a "transparent" WAN circuit to a customer who needs their own IP scheme
The Three Main L2 Tunneling Protocols
| Protocol | Standard | Overhead | Encryption | Best For | |----------|----------|----------|------------|----------| | GRE | RFC 2784 | 24 bytes | None (use with IPsec) | Point-to-point L3/L2 tunnels | | L2TP | RFC 2661 | 12–20 bytes | Optional (via IPsec) | ISP dial/PPP aggregation, site L2 | | VXLAN | RFC 7348 | 50 bytes | Optional | Data centre overlay, VM mobility |
Each has a different origin and sweet spot. Let's go through them properly.
GRE — Generic Routing Encapsulation
GRE is the simplest and most widely supported tunneling protocol. It wraps any Layer 3 protocol (or Ethernet frames with GRETAP) inside IP packets.
How GRE Works
Original Frame: [ Ethernet Hdr ][ IP Hdr ][ Data ]
After GRE wrap: [ Outer IP Hdr ][ GRE Hdr ][ Original Frame ]
There are two variants:
- GRE (IP-over-IP) — carries IP packets. Creates a virtual point-to-point IP link.
- GRETAP (Ethernet-over-IP) — carries full Ethernet frames. This is true L2 tunneling — creates a virtual Ethernet interface.
Configuring a GRETAP Tunnel on Linux
This example extends VLAN 10 between two sites over the internet:
Site A (Linux server — public IP 203.0.113.1)
# Create GRETAP interface
ip link add gretap0 type gretap \
local 203.0.113.1 \
remote 203.0.113.2 \
ttl 64
# Bring it up
ip link set gretap0 up
# Bridge it to your local VLAN interface
ip link add br-vlan10 type bridge
ip link set gretap0 master br-vlan10
ip link set eth0.10 master br-vlan10 # your local VLAN 10 interface
ip link set br-vlan10 up
# Verify
ip link show gretap0
bridge link showSite B (Linux server — public IP 203.0.113.2)
# Mirror configuration with IPs swapped
ip link add gretap0 type gretap \
local 203.0.113.2 \
remote 203.0.113.1 \
ttl 64
ip link set gretap0 up
ip link add br-vlan10 type bridge
ip link set gretap0 master br-vlan10
ip link set eth0.10 master br-vlan10
ip link set br-vlan10 upNow devices on VLAN 10 at both sites are on the same broadcast domain — they can ARP and communicate as if locally connected.
Make it Persistent (systemd-networkd)
# /etc/systemd/network/10-gretap0.netdev
[NetDev]
Name=gretap0
Kind=gretap
[Tunnel]
Local=203.0.113.1
Remote=203.0.113.2
TTL=64# /etc/systemd/network/20-bridge-vlan10.netdev
[NetDev]
Name=br-vlan10
Kind=bridge# /etc/systemd/network/30-bridge-vlan10.network
[Match]
Name=br-vlan10
[Network]
# No IP on bridge — it's a pure L2 bridge
ConfigureWithoutCarrier=yessystemctl restart systemd-networkdGRE on Cisco IOS
! Site A router
interface Tunnel0
description GRE-to-SiteB
ip unnumbered Loopback0
tunnel source GigabitEthernet0/0/0 ! WAN interface
tunnel destination 203.0.113.2
tunnel mode gre ip
! For L2 (GRETAP equivalent on Cisco): use xconnect or EoMPLS
! GRE on Cisco carries IP by default — for Ethernet you need:
interface Tunnel0
tunnel mode gre multipoint ! for DMVPN/multi-point scenariosAdding IPsec Encryption to GRE
GRE has no encryption. In production, always pair it with IPsec:
# /etc/ipsec.conf (strongSwan)
conn gre-site-b
left=203.0.113.1
right=203.0.113.2
leftprotoport=gre
rightprotoport=gre
authby=secret
keyexchange=ikev2
auto=start
type=transport # transport mode encrypts just the GRE payload
# /etc/ipsec.secrets
203.0.113.1 203.0.113.2 : PSK "YourStrongPreSharedKey"sudo ipsec restart
sudo ipsec statusL2TP — Layer 2 Tunneling Protocol
L2TP was originally designed for ISPs to aggregate dial-up and DSL connections. It creates a tunnel (the "L2TP tunnel") and then establishes sessions inside it. Unlike GRE, L2TP has its own session management and is commonly paired with IPsec for secure VPNs (L2TP/IPsec).
L2TP Architecture
Client ──L2TP──► LAC (L2TP Access Concentrator) ──L2TP──► LNS (L2TP Network Server)
(usually at ISP edge) (at corporate network)
- LAC — initiates the L2TP tunnel, typically an ISP router or VPN client
- LNS — terminates the tunnel, assigns IP addresses
L2TP/IPsec Server on Linux (xl2tpd + strongSwan)
sudo apt install -y xl2tpd strongswan
# /etc/ipsec.conf
conn L2TP-PSK
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=%defaultroute
leftprotoport=udp/l2tp
right=%any
rightprotoport=udp/%any
dpddelay=40
dpdtimeout=130
dpdaction=clear
# /etc/ipsec.secrets
%any %any : PSK "YourVPNPresharedKey"
# /etc/xl2tpd/xl2tpd.conf
[global]
ipsec saref = yes
[lns default]
ip range = 10.20.0.100-10.20.0.200
local ip = 10.20.0.1
require chap = yes
refuse pap = yes
require authentication = yes
name = L2TP-VPN-Server
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
# /etc/ppp/options.xl2tpd
ipcp-accept-local
ipcp-accept-remote
ms-dns 8.8.8.8
ms-dns 8.8.4.4
noccp
auth
mtu 1280
mru 1280
nodefaultroute
lock
proxyarp# Add VPN user
echo "vpnuser l2tpd vpnpassword *" >> /etc/ppp/chap-secrets
sudo systemctl restart strongswan xl2tpdWhen to Use L2TP
- Road warrior VPN for Windows/iOS/Android clients (built-in L2TP/IPsec support)
- ISP access aggregation — connecting DSL/PPPoE sessions to a central LNS
- When you need PPP features (per-user authentication, IP assignment, compression)
For site-to-site tunnels, GRE+IPsec or WireGuard is simpler and more efficient.
VXLAN — Virtual Extensible LAN
VXLAN is the modern L2 tunneling protocol designed for data centre environments. It solves a specific problem: standard VLANs support only 4094 IDs. In a large cloud environment with thousands of tenants, you need more. VXLAN uses a 24-bit VNI (VXLAN Network Identifier), giving 16 million possible overlay networks.
How VXLAN Works
VM1 (VLAN 10) VM2 (VLAN 10 — different physical host)
│ │
VTEP 1 VTEP 2
(192.168.1.10) (192.168.1.20)
│ │
└──────── UDP port 4789 (VXLAN) ──────────────┘
Underlay IP network
- VTEP (VXLAN Tunnel Endpoint) — encapsulates and decapsulates VXLAN frames, one per host
- VNI (VXLAN Network Identifier) — 24-bit segment ID, equivalent to VLAN ID but with 16M range
- Underlay — the physical IP network carrying VXLAN UDP packets
- Overlay — the virtual L2 network presented to VMs
Setting Up VXLAN on Linux
# Create VXLAN interface — VNI 100, multicast group for flood/learn
ip link add vxlan100 type vxlan \
id 100 \
dev eth0 \
group 239.1.1.1 \
dstport 4789 \
ttl 10
ip link set vxlan100 up
# Bridge it with local VMs/containers
ip link add br-vxlan100 type bridge
ip link set vxlan100 master br-vxlan100
ip link set veth-vm1 master br-vxlan100 # VM1's veth interface
ip link set br-vxlan100 upVXLAN Without Multicast (Unicast Mode — Production)
In most production environments, multicast is not available. Use static FDB entries or a controller:
# Point-to-point VXLAN (unicast)
ip link add vxlan100 type vxlan \
id 100 \
dev eth0 \
remote 192.168.1.20 \ # remote VTEP IP
dstport 4789 \
nolearning # disable MAC learning (use static FDB)
ip link set vxlan100 up
# Add static FDB entries for remote MACs
bridge fdb add 52:54:00:ab:cd:ef dev vxlan100 dst 192.168.1.20For large deployments, use a BGP EVPN controller (FRRouting) to distribute MAC/IP information automatically — this is how production OpenStack and Kubernetes networking works.
VXLAN on Open vSwitch (OVS)
# Create OVS bridge
ovs-vsctl add-br br-overlay
# Add VXLAN port
ovs-vsctl add-port br-overlay vxlan0 \
-- set interface vxlan0 type=vxlan \
options:remote_ip=192.168.1.20 \
options:key=100
# Add VM interface
ovs-vsctl add-port br-overlay vm1-eth0GRE vs L2TP vs VXLAN — Decision Guide
| Scenario | Recommended | |----------|-------------| | Extend a single VLAN between two sites | GRETAP + IPsec | | Road warrior VPN (Windows/mobile clients) | L2TP/IPsec | | Data centre VM overlay networking | VXLAN | | Point-to-point IP tunnel (L3) | GRE | | Multi-site mesh tunnel network | VXLAN with BGP EVPN or WireGuard | | ISP PPP/DSL aggregation | L2TP | | Kubernetes/container networking | VXLAN (Flannel, Calico, Cilium all use it) |
Troubleshooting L2 Tunnels
GRETAP: Hosts Not Seeing Each Other
# Check tunnel is up
ip link show gretap0
# Capture on the tunnel interface
tcpdump -i gretap0 -e # -e shows Ethernet headers
# Check bridge forwarding
bridge fdb show dev gretap0
# Ping the remote end's tunnel local address
ping -I gretap0 <remote-ip>VXLAN: No Traffic Flowing
# Check VXLAN interface
ip -d link show vxlan100 # -d shows VXLAN VNI and remote IP
# Verify UDP 4789 is not blocked
nmap -sU -p 4789 <remote-vtep-ip>
# Capture raw VXLAN traffic on underlay
tcpdump -i eth0 udp port 4789 -w /tmp/vxlan.pcap
# Check FDB table
bridge fdb show dev vxlan100MTU Issues
L2 tunnels add overhead. GRE adds 24 bytes, VXLAN adds 50 bytes. If your underlay MTU is 1500, your overlay MTU should be:
- GRETAP: 1500 - 24 = 1476 bytes
- VXLAN: 1500 - 50 = 1450 bytes
Set this on VM/container interfaces or enable jumbo frames on the underlay (MTU 9000) to avoid fragmentation.
Frequently Asked Questions
What is the difference between GRE and L2TP?
GRE is a simple encapsulation protocol with minimal overhead — it just wraps packets in an IP header. It has no built-in session management, authentication, or encryption. L2TP adds session management, supports multiple sessions per tunnel, and includes optional PPP authentication. GRE is better for static site-to-site tunnels; L2TP is better when you need per-user authentication or are building a client VPN service. Both need IPsec added separately for encryption.
Does VXLAN work across the public internet?
Technically yes, but it's unusual. VXLAN uses UDP port 4789 which many ISPs rate-limit or block. The overhead (50 bytes per frame) is significant on low-bandwidth links. For WAN extension, GRETAP+IPsec or a WireGuard tunnel is more practical. VXLAN is most efficient on controlled underlay networks (within a data centre or between data centres over dedicated links).
Can I run VXLAN on a Raspberry Pi?
Yes. The Linux kernel VXLAN driver works on ARM. Performance will be limited by the Pi's CPU for encryption, but for a home lab or testing environment it works fine. Use ip link add vxlan0 type vxlan id 100 remote <ip> dstport 4789 dev eth0 — same commands as on x86.
What is the MTU issue with tunnels and how do I fix it?
Every tunnel adds header bytes to each packet. If a packet is already at the MTU limit (usually 1500 bytes on Ethernet), adding tunnel headers makes it too large and it gets fragmented or dropped. Solutions: (1) Enable jumbo frames (MTU 9000) on the underlay network so there's room for overhead. (2) Lower the MTU on the tunnel or VM interface to account for overhead. (3) Enable TCP MSS clamping at the tunnel endpoints to prevent oversized TCP segments.
Conclusion
Layer 2 tunneling fills a critical gap in network design — when you need hosts at different physical sites to share a broadcast domain without complex routing. GRETAP is the most practical for small to medium site-to-site extensions. VXLAN is the standard for data centre and cloud environments. L2TP is the workhorse for PPP-based access aggregation and client VPN.
In our railway and factory deployments, GRETAP over IPsec has been the most reliable choice for extending management VLANs between sites — simple, well-understood, and supported across Linux and Cisco equipment.
Related: VPN L2 Site-to-Site Connectivity Guide | VLAN vs Subnet Difference | SSH Tunneling and Port Forwarding