When connecting distinct subnets across an intermediate IPv4 network or building high-performance load balancing topologies, network administrators require lightweight encapsulation mechanisms with minimal protocol overhead. While GRE (Generic Routing Encapsulation) and VXLAN offer versatile multi-protocol and Layer 2 capabilities, they introduce larger header footprints that can lead to packet fragmentation. For pure IPv4-over-IPv4 routing, IP-in-IP (IPIP) remains one of the simplest, most efficient encapsulation protocols in the networking landscape.
Defined by RFC 2003, IP-in-IP encapsulates an inner IPv4 datagram directly inside an outer IPv4 packet, incurring an overhead of only 20 bytes (the standard IPv4 header size) with zero additional protocol layers. Linux has supported native kernel-level IPIP encapsulation since the 2.2 series through the ipip driver. This guide explains how to create, configure, route, and test IPIP tunnels using the ip tunnel and ip route utilities.
Why Use IP-in-IP (IPIP) Tunnels?
IPIP tunneling is widely adopted across production enterprise architectures due to several key operational advantages:
- Minimal Protocol Overhead: Unlike GRE (24–28 bytes) or VXLAN (50+ bytes), IPIP adds exactly 20 bytes of IPv4 header overhead, maximising the usable Maximum Transmission Unit (MTU) for payloads.
- Direct Server Return (DSR) Load Balancing: IPIP is the foundational encapsulation mode used by high-throughput load balancers such as Linux Virtual Server (IPVS) and Keepalived. The load balancer encapsulates client requests to backend real servers via IPIP, and the real servers reply directly to the client, eliminating return traffic bottlenecks.
- Transparent Kernel Forwarding: Because IPIP processing is implemented directly within the core Linux networking stack, packet encapsulation and decapsulation execute at near line-rate speeds with negligible CPU overhead.
- Broad Hardware and Cloud Support: Most hardware routers, cloud VPCs, and bare-metal environments natively route IP Protocol 4 (IPv4 encapsulation) without requiring specialised overlay software.
Step 1: Verify and Load the Kernel IPIP Module
To use IPIP encapsulation, the Linux kernel module ipip must be loaded on both the local host and the remote endpoint.
Check if the module is currently loaded:
lsmod | grep ipipIf the module is not listed, load it into the active kernel using modprobe:
sudo modprobe ipipTo ensure the driver loads automatically across system reboots, add it to your kernel configuration:
echo "ipip" | sudo tee -a /etc/modules-load.d/ipip.confStep 2: Create the IPIP Tunnel Interface
Suppose you have two Linux hosts connected over an existing public or private underlay network:
- Host A (Local): Underlay IP
198.51.100.10, Tunnel IP10.0.0.1/30 - Host B (Remote): Underlay IP
203.0.113.20, Tunnel IP10.0.0.2/30
Create the Interface on Host A
On Host A, execute the following command to create a virtual tunnel interface named tun-ipip0 in ipip mode:
sudo ip tunnel add tun-ipip0 mode ipip \
remote 203.0.113.20 \
local 198.51.100.10 \
ttl 64Parameter Breakdown:
tun-ipip0: The name of the virtual network interface created in the host operating system.mode ipip: Specifies RFC 2003 IPv4-in-IPv4 encapsulation (IP protocol number 4).remote 203.0.113.20: The public or reachable underlay IPv4 address of the remote peer.local 198.51.100.10: The local network interface address that will transmit encapsulated packets.ttl 64: Sets the Time-To-Live counter for outer encapsulation headers to prevent routing loops.
Step 3: Assign IP Addresses and Activate the Tunnel
Once the interface is defined, assign a private point-to-point overlay IP address and bring the link up:
sudo ip addr add 10.0.0.1/30 peer 10.0.0.2 dev tun-ipip0
sudo ip link set dev tun-ipip0 upConfigure the matching tunnel on Host B (203.0.113.20):
sudo ip tunnel add tun-ipip0 mode ipip remote 198.51.100.10 local 203.0.113.20 ttl 64
sudo ip addr add 10.0.0.2/30 peer 10.0.0.1 dev tun-ipip0
sudo ip link set dev tun-ipip0 upStep 4: Verify Tunnel Status and Test End-to-End Connectivity
Inspect the newly created tunnel device and its routing attributes:
ip tunnel show tun-ipip0Check the link status and MTU configuration:
ip link show dev tun-ipip0Test bidirectional communication through the encapsulated tunnel using ping:
ping -c 4 10.0.0.2Step 5: Route Subnets and Traffic Across the IPIP Tunnel
To route entire private subnets (for example, routing 172.16.50.0/24 behind Host B through the tunnel), add a static route on Host A:
sudo ip route add 172.16.50.0/24 via 10.0.0.2 dev tun-ipip0To verify which interface the kernel selects for the destination subnet, query the routing table:
ip route get 172.16.50.15Step 6: How to Delete an IPIP Tunnel
When the tunnel is no longer needed, you can cleanly tear down and remove the virtual interface:
sudo ip link set dev tun-ipip0 down
sudo ip tunnel del tun-ipip0Troubleshooting Common IPIP Tunnel Issues
MTU and Path Packet Fragmentation
Because IPIP encapsulation adds 20 bytes to every packet, an underlay network with a standard MTU of 1500 bytes can only carry an inner payload of 1480 bytes. If packets fragment or TCP connections stall during SSL/TLS handshakes, explicitly set the tunnel interface MTU to 1480:
sudo ip link set dev tun-ipip0 mtu 1480Additionally, apply TCP Maximum Segment Size (MSS) clamping via iptables or nftables to prevent path MTU discovery issues:
sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtuFirewall Dropping IP Protocol 4 (ipencap)
IPIP does not use UDP or TCP; it uses raw IP Protocol 4 (ipencap). If ping between tunnel endpoints fails, check whether your host firewall or cloud security group blocks IP protocol 4. On Ubuntu using UFW, allow protocol 4 traffic from your peer:
sudo ufw allow from 203.0.113.20 proto 4 to 198.51.100.10Frequently Asked Questions
What is the difference between IPIP and GRE?
IPIP (IP protocol 4) is strictly designed to encapsulate IPv4 packets inside IPv4, carrying an overhead of only 20 bytes. GRE (IP protocol 47) is a generic multi-protocol encapsulation standard that can carry IPv6, broadcast, and multicast traffic (such as OSPF and RIP packets) across an IPv4 network, but requires additional header overhead (24 to 28 bytes).
Can I use IPIP for multicast traffic?
No. Standard IPIP does not support multicast or broadcast forwarding across the tunnel. If your network architecture requires routing multicast protocols or dynamic link-state routing protocols, use a GRE tunnel or VXLAN overlay instead.
Is IPIP traffic encrypted?
No. IPIP performs plain packet encapsulation without cryptographic encryption or integrity validation. If you require confidentiality across public internet routes, pair IPIP with IPsec transport mode or deploy a WireGuard / OpenVPN solution.