IP Tunnel
16 articles

WireGuard Tunnel Configuration on Windows and Linux
This guide provides step-by-step instructions to install, configure, and secure a WireGuard VPN tunnel between a Linux server and a client (Windows or Linux)

Install a WireGuard VPN on a Debian VPS
Set up your own modern VPN server with WireGuard in under 15 minutes. Fast, secure protocol, kernel-integrated on Linux, and compatible with all clients (Linux, Windows, macOS, iOS, Android).

Cloudflare Tunnel: expose without opening a port
Cloudflare Tunnel (formerly Argo Tunnel) creates an encrypted outbound connection between your server and Cloudflare. No port opening, no public IP, no VPN. Ideal for homelabs, or to hide a production server's origin IP.

rotect a remote server with a GRE tunnel and VeryCloud Remote Transit IP
Route traffic from a server hosted anywhere in the world through a GRE tunnel to VeryCloud, and benefit from Netrix Anti-DDoS on your public IP. Ideal for protecting an OVH, AWS, Hetzner server, or even a business residential connection.

Reverse SSH tunnel: reach a server behind NAT
Access a server, Raspberry Pi or client machine behind NAT, a firewall, or a residential router, without configuring port forwarding. The server initiates the connection to a bastion VPS, and you connect through the bastion.

Postfix + Dovecot: complete mail server
Build your own mail server from A to Z with Postfix (SMTP) and Dovecot (IMAP/POP3). Secure auth, TLS, SPF/DKIM/DMARC, anti-spam. The reference combo for self-hosted mail.

WireGuard as a transit IP transport: encrypted alternative to GRE
Use WireGuard (UDP, encrypted) as transport for your VeryCloud Remote Transit IP when GRE is blocked (IP proto 47 filtered by residential ISPs). Linux client setup, MTU, systemd persistence, BGP best practices over WG.

Build a GRE tunnel from a Linux client for Remote Transit IP
Configure a GRE tunnel between your Linux server and the VeryCloud backbone (AS198825): `ip tunnel` commands, systemd-networkd or Netplan persistence, MTU, troubleshooting IP proto 47 blocked by residential ISPs.

VeryCloud Remote Transit IP: architecture, tunnels, and implementation choices
Overview of VeryCloud Remote Transit IP (AS198825): what it does, how it works, which tunnel to pick (GRE / VXLAN / EoIP / WireGuard), and what to prepare client-side before opening your first BGP session.

BGP troubleshooting: session state, MTU, debug, looking glass
Toolbox to diagnose a transit BGP session that's not working: FSM states (Idle/Active/OpenSent/Established), MTU issues, debugging, using VeryCloud Looking Glass, and concrete failure cases.

Build a VXLAN tunnel from a Linux client for Remote Transit IP
Configure a VXLAN tunnel (UDP/4789) between your Linux server and the VeryCloud backbone (AS198825): `ip link` commands, VNI, static FDB, MTU, persistence, troubleshooting.

Arista EOS: eBGP with VeryCloud (AS198825) over GRE tunnel
Complete Arista EOS configuration: GRE tunnel to VeryCloud, dual-stack eBGP IPv4 + IPv6 with peer-groups, prefix-lists, route-maps, MD5. For 7050X, 7280R, vEOS, and cEOS.

BIRD 2: BGPv4 + BGPv6 sessions to VeryCloud (AS198825)
Complete BIRD 2.x configuration to establish a dual-stack BGP session toward the VeryCloud backbone, announce your prefixes, receive a default route (or full table), with clean filters and structured logging.

FRRouting (FRR): BGPv4 + BGPv6 sessions to VeryCloud (AS198825)
Configure FRR (modern Quagga fork) to establish a dual-stack BGP session toward the VeryCloud backbone, with Cisco-like syntax. Ideal if you come from the Cisco IOS world and want familiar CLI on Linux.

Securing a BGP session: RPKI, MD5, max-prefix, GTSM, prefix-list
The 5 essential mechanisms to harden a transit IP BGP session: RPKI ROAs, TCP-MD5 authentication, prefix limit, GTSM (TTL security), and bogon prefix-list. With concrete examples for BIRD, FRR, Cisco, Arista.

Cisco IOS / IOS-XE: eBGP with VeryCloud (AS198825) over GRE tunnel
Complete Cisco IOS / IOS-XE configuration: GRE tunnel to VeryCloud PoP, dual-stack eBGP IPv4 + IPv6 sessions, prefix-list, route-map, MD5 security. For ISR, CSR1000v, Catalyst 8000.

















