How to Create and Configure IPv6 GRE (ip6gre) Tunnels in Linux Using ip -6 tunnel

As modern internet service providers, cloud infrastructure providers, and corporate data centres adopt IPv6-only backbones, network engineers frequently face the challenge of transporting legacy IPv4 packets, non-routable private subnets, or dynamic routing multicast across native IPv6 networks. Generic Routing Encapsulation over IPv6 (ip6gre), standardized under RFC 2473 and RFC 7676, provides an elegant, hardware-efficient solution. It encapsulates diverse Layer 3 payload packets inside standard GRE headers transported across an underlying IPv6 routed transit.

In Linux, the native iproute2 toolkit provides direct, kernel-space support for establishing and managing IPv6 GRE tunnels without relying on complex external routing suites. Whether you are interconnecting disparate branch networks across an IPv6 carrier network or building private overlays between cloud virtual machines, ip -6 tunnel offers full control over encapsulation parameters. In this guide, we walk through loading kernel modules, building ip6gre endpoints, configuring dual-stack tunnel addressing, and optimising MTU parameters.

Understanding IPv6 GRE (ip6gre) Encapsulation

Unlike standard IPv4 GRE tunnels that use 20-byte IPv4 outer headers, ip6gre utilizes a 40-byte IPv6 outer header followed by a GRE header (IP protocol 47). This architecture delivers several key advantages:

• Protocol Agnostic Transport: Encapsulates IPv4, IPv6, and multicast traffic (such as OSPFv3 or BGP hello packets) across IPv6-only transit nodes.
• Kernel-Level Performance: The Linux kernel handles packet encapsulation and decapsulation directly in the networking datapath via the ip6_gre driver, eliminating userspace context-switch overhead.
• Full Routing Compatibility: Instantiates a virtual network interface (e.g., gre6-tun0) that can be assigned static IP addresses or plugged directly into dynamic routing engines like FRRouting (FRR) or BIRD.

Step 1: Loading the ip6_gre Kernel Module

Support for IPv6 GRE tunneling is modularised in modern Linux distributions. Before issuing tunnel commands, ensure the ip6_gre driver is active in the running kernel:

sudo modprobe ip6_gre

Verify that the module has initialised correctly:

lsmod | grep gre

To persist this configuration across system reboots, add the module name to your kernel modules configuration directory:

echo "ip6_gre" | sudo tee -a /etc/modules-load.d/ip6_gre.conf

Step 2: Creating the IPv6 GRE Tunnel Endpoint

To establish an ip6gre tunnel, both endpoints must possess publicly or privately routable IPv6 addresses. In this scenario, consider two Linux routers:

• Router A (Local): Native IPv6: 2001:db8:100::1
• Router B (Remote): Native IPv6: 2001:db8:200::2

Execute the following command on Router A to establish the tunnel interface named gre6-tun0:

sudo ip -6 tunnel add gre6-tun0 \
    mode ip6gre \
    local 2001:db8:100::1 \
    remote 2001:db8:200::2 \
    hoplimit 64

Key parameters explained:

• ip -6 tunnel add: Invokes the IPv6 tunneling subsystem in iproute2.
• mode ip6gre: Specifies Generic Routing Encapsulation over IPv6 transport.
• local 2001:db8:100::1: The source IPv6 address bound on Router A.
• remote 2001:db8:200::2: The destination IPv6 address of Router B.
• hoplimit 64: Sets the IPv6 Hop Limit field (equivalent to IPv4 TTL) in the outer IPv6 encapsulation header.

Next, log into Router B and configure the reciprocal tunnel:

sudo ip -6 tunnel add gre6-tun0 \
    mode ip6gre \
    local 2001:db8:200::2 \
    remote 2001:db8:100::1 \
    hoplimit 64

Step 3: Assigning Overlay IP Addresses and Activating the Interface

Once the tunnel endpoint is defined, bring the network link up and assign overlay IP addresses. An ip6gre tunnel supports dual-stack payloads, allowing you to assign private IPv4 and private IPv6 addresses simultaneously.

On Router A, assign an IPv4 subnet address and bring the link online:

sudo ip addr add 10.200.0.1/30 dev gre6-tun0
sudo ip -6 addr add fd00:cafe::1/64 dev gre6-tun0
sudo ip link set gre6-tun0 up

On Router B, assign the opposing host addresses and bring the link online:

sudo ip addr add 10.200.0.2/30 dev gre6-tun0
sudo ip -6 addr add fd00:cafe::2/64 dev gre6-tun0
sudo ip link set gre6-tun0 up

Step 4: Testing and Validating Tunnel Connectivity

Verify that packets are successfully traversing the IPv6 encapsulation channel by pinging across both IPv4 and IPv6 overlay addresses from Router A:

# Test IPv4 payload over IPv6 GRE
ping -c 4 10.200.0.2

# Test IPv6 payload over IPv6 GRE
ping6 -c 4 fd00:cafe::2

To inspect active tunnel configurations and verify packet counters:

ip -6 tunnel show gre6-tun0
ip -s link show dev gre6-tun0

Configuring Routing Across the Tunnel

To route entire subnets across your new pseudowire link, configure static route entries directing target traffic through the tunnel interface.

For example, to route traffic destined for 192.168.50.0/24 behind Router B via Router A:

sudo ip route add 192.168.50.0/24 via 10.200.0.2 dev gre6-tun0

MTU Tuning and Packet Fragmentation

Because IPv6 encapsulation adds substantial header overhead (40 bytes for IPv6 + 4 bytes minimum for GRE), packet sizing requires careful management:

Header Layer	Size (Bytes)	Impact on Maximum Transmission Unit (MTU)
IPv6 Outer Transport Header	40 bytes	Required for routing across the underlying IPv6 network.
GRE Encapsulation Header	4 to 16 bytes	Contains protocol identification and optional checksum/key fields.
Recommended Tunnel MTU	1436 to 1440 bytes	Standard 1500-byte parent MTU minus 44 to 64 bytes of encapsulation headers.

To prevent outer packet fragmentation or ICMP Packet Too Big issues, clamp the tunnel interface MTU to 1440:

sudo ip link set gre6-tun0 mtu 1440

Tearing Down the Tunnel Cleanly

When you no longer need the tunnel, delete it using the ip -6 tunnel del command. Removing the tunnel automatically deregisters the network interface and tears down associated routing table entries:

sudo ip -6 tunnel del gre6-tun0