Tunneling

Normally, network packets are sent directly between two devices.

Client  ----------------------->  Server
           Original Packet

However, there are situations where the original packet cannot be transmitted directly, for example:

• The server is behind a firewall or NAT.
• The server has no public IP address.
• The network protocol is not allowed by the intermediate network.
• Traffic should be encrypted before leaving the local network.

A network tunnel solves this problem by encapsulating one network connection inside another.

Instead of sending the original packet directly,

Client                                   Tunnel Server
  |                                           |
  | Original Packet                           |
  |------------------------------------------>|   (logical communication)
  |                                           |

becomes

Tunnel Client                              Tunnel Server
  |                                           |
  | Encapsulate + Encrypt                     |
  |                                           |
  |  Outer IP Header                          |
  | +---------------------------+             |
  | | Encrypted Original Packet |============>|
  | +------------------------- -+             |
  |                                           |
  |                           Decrypt + Decapsulate
  |                                           |
  |<------------------------------------------|

The intermediate network only sees the outer packet, while the destination endpoint removes the outer layer and recovers the original packet. The tunnel itself does not define what the original traffic is. It can carry:

• IP packets
• TCP connections
• HTTP requests
• Ethernet frames
• Other protocols

The only requirement is that both tunnel endpoints understand how to encapsulate and decapsulate the traffic.

Note that tunneling is a networking mechanism in which one protocol or communication channel is encapsulated within another. It is a general mechanism implemented by many protocols (e.g., WireGuard, IPsec, GRE, SSH, and Cloudflare Tunnel), each optimized for different use cases such as VPNs, reverse proxies, or network virtualization.

Common Tunneling Protocols

Protocol	Encrypted	Carries	Typical Use
GRE	❌	IP	Site-to-site routing
WireGuard	✅	IP	Modern VPN
OpenVPN	✅	IP	Remote access VPN
SSH Tunnel	✅	TCP	Secure port forwarding
Cloudflare Tunnel	✅	HTTP, TCP	Publish local services
VXLAN	Usually within trusted networks	Ethernet	Data center virtualization

Common Use Cases

• Traversing NAT or firewalls
• Encrypting traffic
• Connecting private networks
• Publishing local services
• Carrying unsupported protocols across another network

Tunneling vs Forwarding

A tunnel does not change the application protocol. For example, HTTP remains HTTP inside the tunnel. Instead, the HTTP connection is encapsulated inside another transport:

HTTP
   |
Tunnel
   |
TLS
   |
TCP
   |
Internet

The destination removes the tunnel layer before forwarding the original request.

Reverse Tunnel

A common use of tunneling is exposing a local service without opening inbound firewall ports.

Normally,

Internet
     |
Firewall
     |
Local Server

cannot accept incoming connections.

Instead, the local machine initiates an outbound tunnel.

Local Server
      |
Outbound Tunnel
      |
Tunnel Provider
      |
      v
Internet Users

Because the connection is initiated from inside the network, most firewalls allow it.

Incoming requests arrive at the tunnel provider, which forwards them through the existing tunnel.

---

Typical Reverse Tunnel Flow

User
   |
HTTPS
   |
Tunnel Provider
   |
Existing Tunnel
   |
Local Server

The origin server never needs a public IP address.

---

Common Use Cases

• Development environments
• Self-hosted applications
• Temporary demos
• Remote administration

---

VPN (Virtual Private Network)

A Virtual Private Network (VPN) uses tunneling to create a private network over a public network.

Instead of exposing every device directly to the Internet,

Computer ------ Internet ------ Server

the devices first establish encrypted tunnels.

Computer
     |
Encrypted Tunnel
     |
VPN Gateway
     |
Private Network

The devices now behave as though they are connected to the same local network.

---

Typical VPN Architecture

Laptop
    |
Encrypted Tunnel
    |
VPN Gateway
    |
Private Network
    |
+---------+---------+
|         |         |
Server   NAS    Printer

Applications simply communicate using private IP addresses.

10.0.0.5  ------->  10.0.0.20

The VPN software transparently encrypts and transports the packets over the Internet.

---

Benefits of VPN

• Encrypts network traffic
• Connects remote users to private networks
• Allows access to internal services
• Hides internal network topology from the public Internet

---

Common Use Cases

• Remote work
• Site-to-site networking
• Secure Wi-Fi access
• Connecting cloud and on-premise infrastructure

---

Mesh VPN

Traditional VPNs usually rely on a central VPN server.

         VPN Server
        /    |    \
       /     |     \
    PC1     PC2    PC3

Every connection passes through the VPN server.

A mesh VPN removes this central bottleneck by allowing participating devices to establish peer-to-peer encrypted tunnels whenever possible.

PC1  <--------->  PC2
  \                |
   \               |
    \              |
      ----------> PC3

Each device becomes a node in the virtual network.

---

Mesh Architecture

+---------+
| Laptop  |
+---------+
    |   \
    |    \
    |     \
+---------+      +---------+
| Desktop |------| Server  |
+---------+      +---------+
      \             /
       \           /
        +---------+
        | NAS     |
        +---------+

Every device receives a virtual IP address.

Laptop   100.64.0.1
Desktop  100.64.0.2
Server   100.64.0.3
NAS      100.64.0.4

Applications communicate using these private addresses regardless of where the devices are physically located.

NAT Traversal

Many devices are behind routers performing Network Address Translation (NAT).

Internet
    |
Home Router
    |
Laptop

Since incoming connections are normally blocked, mesh VPN software attempts to establish direct peer-to-peer connections using NAT traversal techniques.

Laptop  <------------->  Server
        Direct Tunnel

If a direct connection cannot be established, traffic is relayed through an intermediate server.

Laptop
    |
Relay Server
    |
Server

The relay only forwards encrypted packets and typically cannot read their contents.

---

Benefits of Mesh VPN

• No dedicated VPN gateway required
• Peer-to-peer communication
• Automatic NAT traversal
• End-to-end encryption
• Scales naturally as devices are added