What Is a GRE Tunnel?
GRE (Generic Routing Encapsulation) is a tunneling protocol that encapsulates one IP packet inside another. In the context of DDoS protection, it works like this:
- Your server sends traffic out its normal interface
- A local GRE tunnel endpoint captures traffic destined for your protected IP
- Traffic is encapsulated and sent to the DDoS protection provider's scrubbing center
- The protection provider filters the traffic and sends clean packets back through the tunnel
- Your server receives clean traffic and processes it normally
Why GRE Is Perfect for Game Servers
No DNS changes: Your game's IP stays the same. Players don't need to reconnect.
No reverse proxy: Traffic goes directly to your hardware, not through a proxy.
Works from anywhere: GRE works over any internet connection. You don't need to be in the same data center as the protection provider.
Simple configuration: No BGP expertise required. Linux or Windows - just configure the tunnel interface.
Minimal latency: Encapsulation adds negligible overhead. You get the benefits of always-on filtering without routing complexity.
How GRE Tunnels Route Traffic
Your server has:
- Real IP: 203.0.113.50 (what players connect to)
- GRE tunnel endpoint pointing to protection provider
Attack traffic:
- Arrives at 203.0.113.50
- Gets encapsulated in a GRE packet
- Travels to protection provider
- Gets filtered
- Sent back through tunnel
- Decapsulated and processed by your server
Legitimate traffic:
- Arrives at 203.0.113.50
- Filtered on ingress (always-on)
- Clean packets delivered to your server
Configuring a GRE Tunnel (Linux Example)
Assuming:
- Your server IP: 203.0.113.50
- Protection provider GRE endpoint: 198.51.100.1
- GRE tunnel IP space: 10.0.0.1 (your end) – 10.0.0.2 (provider end)
Create the tunnel:
- ip tunnel add gre0 mode gre remote 198.51.100.1 local 203.0.113.50
- ip addr add 10.0.0.1/31 dev gre0
- ip link set gre0 up
- ip route add 203.0.113.50/32 dev gre0
- ip route add default via 10.0.0.2
Verify:
- ip route show
- ip tunnel show
The provider gives you their GRE endpoint IP and tunnel IP assignment. Configuration is straightforward.
The provider gives you their GRE endpoint IP and tunnel IP assignment. Configuration is straightforward.
Deployment Best Practices
1. Test the tunnel before production
Set up the GRE tunnel on a test system first. Verify tunnel comes up cleanly, packets encapsulate and decapsulate correctly, and latency is as expected.
2. Monitor tunnel status
Create a health check that monitors the tunnel interface. Use "ip link show gre0" to check tunnel status and "ip route show" to verify routing.
Alert if the tunnel goes down. A failed tunnel means traffic can't reach the protection provider.
3. Have a failover plan
If the GRE tunnel fails:
- Do you have a backup internet connection?
- Can you quickly reroute through an alternative path?
- What's your RPO/RTO?
Plan this in advance.
4. Capacity planning
GRE encapsulation adds ~20–24 bytes per packet. This is typically < 1% overhead but verify your upstream connection can handle it.
Common Issues and Fixes
Tunnel doesn't come up
Check if firewall allows GRE protocol (IP protocol 47), local IP is correct, and remote IP is reachable.
High latency through tunnel
- Check if the protection provider is nearby (same region preferred)
- Verify no packet loss (use ping or mtr)
- Check if your ISP is rate-limiting the tunnel
Packets being dropped
- MTU mismatch: GRE reduces MTU by ~20 bytes. Set ip link set mtu 1480 on tunnel interface
- Provider might be rate-limiting; contact support
Summary
GRE tunnels make always-on DDoS filtering accessible to any game server operator, regardless of infrastructure complexity. No BGP, no IP changes, no proxy. Just a clean tunnel carrying filtered traffic.
For game servers prioritizing low latency and operational simplicity, GRE is the right choice.