Peering via Layer 3 Tunnel

Configure Layer 3 tunnel peering with AS203314 using WireGuard, GRE, or SIT/ip6gre protocols. Encrypted BGP sessions over WireGuard with no physical presence required at any of our 16+ PoPs.

Layer 3 tunnels encapsulate IP packets at the network layer. This is the recommended approach for most peering scenarios due to lower overhead and better performance compared to Layer 2 tunneling.

Layer 3 Tunnel Overview

In all examples below, replace placeholder values with your actual configuration:

{name} - Tunnel interface name
{yourside ip} - Your public IP address
{ourside ip} - Our endpoint IP address
{yourside port} - Your source port (WireGuard)
{ourside port} - Our destination port (WireGuard)
{your tunnel ip cidr} - Your tunnel IP/subnet
{our public key} - Our WireGuard public key
{your private key} - Your WireGuard private key

Tunnel Profile Selection

WireGuard

WireGuard is a modern, lightweight VPN protocol that provides encrypted Layer 3 tunneling. It's our recommended choice for secure peering due to its simplicity and performance.

Create a WireGuard configuration file:

/etc/wireguard/{name}.conf

[Interface]
Address    = {your tunnel ip cidr}
ListenPort = {yourside port}
PrivateKey = {your private key}
# Disable WireGuard's built-in routing table management when using
# an external routing daemon (e.g. BIRD, FRR)
Table = off

[Peer]
PublicKey           = {our public key}
AllowedIPs          = 0.0.0.0/0, ::/0
Endpoint            = {ourside ip}:{ourside port}
PersistentKeepalive = 25

GRE Tunnel

GRE (Generic Routing Encapsulation) operates at Layer 3 and is suitable for routing IPv4/IPv6 traffic over an IPv4 underlay. It's simple, widely-supported, and has minimal overhead.

ip tunnel add {name} mode gre local {yourside ip} remote {ourside ip} ttl 255
ip addr add {your tunnel ip cidr} dev {name}
ip link set dev {name} up

SIT / ip6gre (IPv6 Tunneling)

SIT (Simple Internet Transition) tunnels IPv6 traffic over an IPv4 underlay and is commonly used for 6in4 connectivity.

ip6gre provides full GRE encapsulation for IPv6 and is preferred when you need GRE key support or multi-protocol capability.

# SIT: IPv6-in-IPv4
ip tunnel add {name} mode sit local {yourside ipv4} remote {ourside ipv4} ttl 255
ip addr add {your tunnel ipv6 cidr} dev {name}
ip link set dev {name} up

Protocol Comparison

Protocol	Encryption	IPv4	IPv6	Overhead	NAT Traversal
WireGuard	Yes	✓	✓	32 bytes	Good (UDP)
GRE	No	✓	✓	28 bytes	Limited
SIT	No	N/A	✓	20 bytes	Limited
ip6gre	No	N/A	✓	28 bytes	Limited

Protocol Selection Guide

WireGuard: Best for secure peering, supports both IPv4 and IPv6
GRE: Simple, widely-supported, good for IPv4 peering
SIT/ip6gre: Use when you only need IPv6 transport over IPv4

MTU Considerations

Layer 3 tunnels add overhead to each packet. Adjust your MTU accordingly:

Protocol	Overhead	Recommended MTU
WireGuard	32 bytes	1468
GRE	28 bytes	1472
SIT	20 bytes	1480
ip6gre	28 bytes	1472

Example for WireGuard:

ip link set dev {name} mtu 1468

Next Steps

Once you have configured the tunnel:

Verify connectivity using ping or traceroute
Configure your BGP daemon (BIRD, FRR, etc.) to use the tunnel interface
Contact us to finalize the peering session

After successfully setting up the tunnel, contact us to finalize the peering session with AS203314.