---
title: Tunnel Technology Comparison
url: https://doc.liz6.com/en/networking/08-vpn-and-tunnels/04-tunnel-technology-comparison
locale: en
area: networking
tags:
- networking
- vpn-and-tunnels
date: 2026-06-30
modified: 2026-07-16
description: '"Tunneling" encapsulates one protocol within another for transmission—GRE is the simplest IP-in-IP, VXLAN is a multi-tenant overlay L2, rathole/frp expose intranet services via relays, and WireGuard/IPsec provide end-to-end encryption. Selection depends on encapsulation overhead, encryption requirements, and NAT compatibility.'
---

# Tunnel Technology Comparison

> "Tunneling" encapsulates one protocol within another for transmission—GRE is the simplest IP-in-IP, VXLAN is a multi-tenant overlay L2, rathole/frp expose intranet services via relays, and WireGuard/IPsec provide end-to-end encryption. Selection depends on encapsulation overhead, encryption requirements, and NAT compatibility.

## Overview

"Tunneling" is a general concept in network engineering—encapsulating one protocol within another for transmission. Different tunnels solve different problems: GRE is the simplest IP-in-IP encapsulation, VXLAN overlays L2 on L3 networks for multi-tenant use, rathole and frp expose intranet services via relays, and WireGuard/IPsec provide end-to-end encryption. The core considerations for selection are encapsulation overhead, encryption requirements, connection model (on-demand vs. persistent), and NAT compatibility.

## Tunnel Classification

```
L2 overlay: VXLAN, GENEVE — data center virtual networks, 24-bit VNI
L3 tunnel:  GRE, IPIP, WireGuard — site interconnection, encrypted or not
Port forward: rathole, frp, ngrok — intranet service exposure
Full VPN:    WireGuard, IPsec, OpenVPN — device-level encrypted access
```

## rathole vs frp

| | rathole | frp |
|---|---|---|
| Architecture | Symmetric (server ↔ client) | Centralized (frps ↔ frpc) |
| Connection Model | Pre-established TCP connection pool | On-demand TCP creation |
| Multi-service | per-service tunnel | per-service proxy |
| Encryption | Depends on upper layer (TLS by Caddy) | Built-in (optional) |
| Protocol Support | TCP only | TCP/UDP/HTTP |
| Docker | server + client | server + client |
| Resource Usage | Very low (~5MB RAM) | Medium (~20MB) |

**Advantage of pre-established connection pool:** The server and client pre-establish multiple idle TCP connections upon startup. When a client request arrives at the server → the server retrieves an already-established connection from the pool → forwards data → eliminating the TCP three-way handshake latency for each request.

**Cost of pre-established connection pool:** NAT or conntrack may clear idle connections → `early eof` errors → the client needs to set keepalive (TCP keepalive interval < conntrack timeout).

## GRE vs VXLAN

```
GRE (IP protocol 47):
  Encapsulation: [Outer IP | GRE hdr(4-16B) | Inner IP | Payload]
  Design: Generic Routing Encapsulation — can encapsulate any protocol
  Identifier: Optional Key (4B) — multiple GRE tunnels share the same IP

VXLAN (UDP):
  Encapsulation: [Outer Eth | Outer IP | UDP(port 4789) | VXLAN(8B) | Inner Eth | Inner L2+]
  Identifier: VNI (24-bit) — 16M virtual networks
  ECMP: UDP source port used as entropy → multipath routing
  MTU: 50B overhead → requires jumbo frames (9000 MTU) or fragmentation
```

## Selection Guide

| Requirement | Choice |
|------|------|
| Expose intranet HTTP service | rathole + Caddy (auto TLS, connection pool) |
| Multi-protocol intranet penetration | frp (TCP/UDP/HTTP, dashboard) |
| Low-latency mesh VPN | WireGuard (kernel, ~4K lines of code) |
| Automatic NAT traversal | Tailscale (STUN+DERP+UPnP) |
| Enterprise VPN gateway | IPsec/IKEv2 (hardware offload) |
| Data center overlay | VXLAN + EVPN (BGP control plane) |
| Simple IP tunnel | GRE (lightweight, no encryption) |

## References

- **rathole**: github.com/rapiz1/rathole
- **frp**: github.com/fatedier/frp
- **RFC**: 2784 (GRE), 7348 (VXLAN)

*Keywords: tunnel, rathole, frp, GRE, VXLAN, WireGuard, connection pool, overlay, port forwarding*