GRE Tunneling for Remote DDoS Protection — Full Guide

Introduction

GRE (Generic Routing Encapsulation) tunneling is a method of encapsulating traffic by creating a virtual tunnel between two network points. DDoS protection providers use GRE tunnels to offer remote protection services.

GRE Tunneling Status

REXE Technology supports GRE tunneling as part of its remote protection service.

Prohibited Use: Tunnels or Proxies You Set Up Yourself

Using a server rented from REXE as an entry point to carry protection to a system outside REXE is prohibited. This covers:

• Setting up a GRE, IPIP, WireGuard or similar tunnel on the server to carry traffic to a machine outside REXE
• Forwarding traffic to a destination outside REXE via reverse proxy, NAT or port forwarding
• Offering or reselling REXE DDoS protection to third parties without a reseller agreement with REXE

The restriction is not arbitrary: filter rules and protection capacity are allocated per IP. Moving traffic outside REXE invalidates attack reports, null-route decisions and SLA measurement; once an attack targets the far end of your tunnel rather than your server, there is nothing left for REXE to see or act on.

How Does GRE Tunneling Work?

If your server is located outside the REXE data center, the REXE team configures a GRE tunnel as part of the remote protection service:

Internet Traffic
    ↓
Path.net Global POP (Traffic Scrubbing)
    ↓
GRE Tunnel (Configured by REXE)
    ↓
Customer Server (External Location)

Key points:

• Setup is done by REXE: GRE tunnels are set up exclusively by the REXE team via the Path panel
• Customer setup is not possible: Customers do not have the ability to set up GRE tunnels on their own servers
• Part of remote protection: If your server is at an external location, the REXE team configures the GRE tunnel for you
• Path.net integration: All traffic is scrubbed through Path.net and then routed to your server via the GRE tunnel

Servers in the REXE Data Center

If your server is hosted in the REXE data center, GRE tunneling is not needed. Your server is directly connected to the Path.net infrastructure via an L2 (Layer 2) circuit:

Internet Traffic
    ↓
Path.net Global POP (Traffic Scrubbing)
    ↓
L2 Circuit Connection (Low Latency)
    ↓
REXE Data Center (Your Server)

Benefits:

• No extra latency: No GRE encapsulation/decapsulation overhead
• No MTU issues: No MTU reduction caused by GRE tunnel
• Simple configuration: No tunnel configuration needed on the server
• Full protection: All Path.net filtering features available directly

GRE Tunneling Technical Details

GRE (Generic Routing Encapsulation), defined in RFC 2784, works as follows in the DDoS protection context:

Traffic Flow

1. Incoming traffic: All traffic from the internet first reaches Path.net's global POP points
2. Scrubbing: Path.net filters attack traffic and passes only legitimate traffic
3. GRE encapsulation: Clean traffic is encapsulated with GRE protocol and passed through the tunnel
4. Delivery: Encapsulated traffic reaches the customer's server and is decapsulated

MTU Considerations

When using a GRE tunnel, the MTU value decreases:

Standard Ethernet MTU: 1500 bytes
GRE Header: 24 bytes
GRE Tunnel MTU: 1476 bytes

This can cause issues with some applications. The REXE team optimizes MTU settings during GRE tunnel setup.

Remote Protection Service

If your server is hosted at a location other than the REXE data center:

1. Remote protection via GRE tunnel: The REXE team sets up a GRE tunnel via the Path panel to provide remote DDoS protection for your server
2. Move your server to REXE: For the best performance and protection, we recommend moving your server to the REXE data center

Alternative Solutions

Server Migration

By migrating your existing server to the REXE data center, you can benefit directly from Path.net protection:

• VDS or physical server options available
• Our technical team provides support during the migration process
• Your data is securely transferred

Colocation

You can host your own hardware in the REXE data center:

• Path.net DDoS protection is automatically applied
• Physical security and power redundancy provided
• 24/7 NOC support available

GRE vs L2 Circuit Comparison

Remote Protection Application Process

Steps to follow to get remote protection with a GRE tunnel:

1. Create a support ticket: Contact our support team via customer panel or email
2. Share technical details: Provide server IP address, location, and network configuration
3. REXE team evaluates: Our technical team collects the necessary information for GRE tunnel setup
4. Tunnel is configured: REXE team sets up the GRE tunnel via the Path panel
5. Testing and verification: Connection is tested after tunnel setup is complete
6. Protection active: Your server starts receiving DDoS protection through Path.net