Gre tunnel to protect IP.

[stephenw10]

Sorry I mean hit the 'wrench' icon and update the graphs for traffic on the GRE interface. Like:

[s_serra]

It's a little different on one site it's using 6 mb/s on another 60 mb/s.

Thanks

[stephenw10]

Hmm, I assume the 6Mbps side is local, where the servers are?

There is almost no outbound traffic there which seems odd. I would expect games servers to send more than they receive.

The traffic across the tunnel should show as reversed also. I could believe that's shown in the outbound at the remote side. Hard to say because the graph is swamped by the inbound. You can disable that by clicking the dot there.

I wonder if you just have a lot of inbound GRE traffic that's being incorrectly passed?

Check the state table for all GRE states at the remote site. If there is any GRE traffic from anywhere but your own local site then make sure the WAN firewall rules are not passing that.

Steve

[s_serra]

Yes, the 6 mbps is the local side where the server is.

Local Side

Remote Side

@stephenw10 said in Gre tunnel to protect IP.:

I wonder if you just have a lot of inbound GRE traffic that's being incorrectly passed?

Yeah probably, I'm not very expert yet.

GRE States on remote side: https://pastebin.com/2ZyHg09V

Thanks

[stephenw10]

There are no GRE states shows there, only TCP/UDP states on the GRE interface.

You need to look for gre states on WAN like:

[s_serra]

@stephenw10

[stephenw10]

Mmm, that looks OK then. The end end show similar states? Data ratios the same?

[s_serra]

@stephenw10

I guess so

Thanks

[stephenw10]

Ok that looks good.

Are you still seeing the extra traffic on the remote WAN? It could be there is simply no traffic right now.

Make sure the rules allowing GRE on WAN there only allow it from the local site.

Steve

[s_serra]

@stephenw10

On the local site I have the following rules.

[stephenw10]

Ok, so in that case the local site always has to establish the tunnel since it is not allowing gre in at all. That's fine.
What rules do you have at the remote site?

[s_serra]

@stephenw10

On the remote side it looks like this.

[stephenw10]

Ok, great so there are no rules explicitly allowing the GRE traffic. That means both sides have to open an outbound state to allow traffic back in. And that nothing else can connect using gre.

So whatever you're seeing it's not that.

Possibly just double counting on the WAN?

[s_serra]

@stephenw10

Well, I don't know what it could be. Thank you for your help.