On this page
Tunnel Technology Comparison
"Tunneling" encapsulates one protocol within another for transmission—GRE is the simplest IP-in-IP, VXLAN is a multi-tenant overlay L2, rathole/frp expose intranet services via relays, and WireGuard/IPsec provide end-to-end encryption. Selection depends on encapsulation overhead, encryption requirements, and NAT compatibility.
Overview
"Tunneling" is a general concept in network engineering—encapsulating one protocol within another for transmission. Different tunnels solve different problems: GRE is the simplest IP-in-IP encapsulation, VXLAN overlays L2 on L3 networks for multi-tenant use, rathole and frp expose intranet services via relays, and WireGuard/IPsec provide end-to-end encryption. The core considerations for selection are encapsulation overhead, encryption requirements, connection model (on-demand vs. persistent), and NAT compatibility.
Tunnel Classification
L2 overlay: VXLAN, GENEVE — data center virtual networks, 24-bit VNI
L3 tunnel: GRE, IPIP, WireGuard — site interconnection, encrypted or not
Port forward: rathole, frp, ngrok — intranet service exposure
Full VPN: WireGuard, IPsec, OpenVPN — device-level encrypted access
rathole vs frp
| rathole | frp | |
|---|---|---|
| Architecture | Symmetric (server ↔ client) | Centralized (frps ↔ frpc) |
| Connection Model | Pre-established TCP connection pool | On-demand TCP creation |
| Multi-service | per-service tunnel | per-service proxy |
| Encryption | Depends on upper layer (TLS by Caddy) | Built-in (optional) |
| Protocol Support | TCP only | TCP/UDP/HTTP |
| Docker | server + client | server + client |
| Resource Usage | Very low (~5MB RAM) | Medium (~20MB) |
Advantage of pre-established connection pool: The server and client pre-establish multiple idle TCP connections upon startup. When a client request arrives at the server → the server retrieves an already-established connection from the pool → forwards data → eliminating the TCP three-way handshake latency for each request.
Cost of pre-established connection pool: NAT or conntrack may clear idle connections → early eof errors → the client needs to set keepalive (TCP keepalive interval < conntrack timeout).
GRE vs VXLAN
GRE (IP protocol 47):
Encapsulation: [Outer IP | GRE hdr(4-16B) | Inner IP | Payload]
Design: Generic Routing Encapsulation — can encapsulate any protocol
Identifier: Optional Key (4B) — multiple GRE tunnels share the same IP
VXLAN (UDP):
Encapsulation: [Outer Eth | Outer IP | UDP(port 4789) | VXLAN(8B) | Inner Eth | Inner L2+]
Identifier: VNI (24-bit) — 16M virtual networks
ECMP: UDP source port used as entropy → multipath routing
MTU: 50B overhead → requires jumbo frames (9000 MTU) or fragmentation
Selection Guide
| Requirement | Choice |
|---|---|
| Expose intranet HTTP service | rathole + Caddy (auto TLS, connection pool) |
| Multi-protocol intranet penetration | frp (TCP/UDP/HTTP, dashboard) |
| Low-latency mesh VPN | WireGuard (kernel, ~4K lines of code) |
| Automatic NAT traversal | Tailscale (STUN+DERP+UPnP) |
| Enterprise VPN gateway | IPsec/IKEv2 (hardware offload) |
| Data center overlay | VXLAN + EVPN (BGP control plane) |
| Simple IP tunnel | GRE (lightweight, no encryption) |
References
- rathole: github.com/rapiz1/rathole
- frp: github.com/fatedier/frp
- RFC: 2784 (GRE), 7348 (VXLAN)
Keywords: tunnel, rathole, frp, GRE, VXLAN, WireGuard, connection pool, overlay, port forwarding