Network tunneling encapsulates packets within an additional Layer 3 header so traffic can traverse networks that would otherwise block or expose it. Common use cases include routing protocols across ISP infrastructure and securing wireless guest traffic through encrypted tunnels to a wireless LAN controller.
Network Tunneling
Tunneling is just getting traffic from one location to another, but by encapsulating it with some sort of other header so that way this information can be routed. We might do this for several different reasons, one of which might be that the information normally wouldn't be passed across the network, and so we encapsulate it to send it over to the other location. Or perhaps this is an insecure network and we want to secure our communication, so we use some sort of VPN in order to secure that communication.
Let's take a look at regular IP routing. Here we have a packet. The packet has some sort of payload to it, some sort of information that it's carrying, as well as the layer three header. Within the layer three header we have a source and destination IP address, so that way when a router receives that packet it can take a look at the destination IP address and figure out where it needs to send it next, the next hop, and then that router sends it to the next hop along its way.
Meanwhile, what's happening in this layer three header is the time to live is decrementing. That time to live prevents any kind of routing loops or problems. If there is a routing loop, then that gets decremented to know when to discard this packet.
Here's what we just talked about with the IP header, with the layer three header — we're just going to represent this as a pipe going across here. Now, what does a tunnel look like? A tunnel is where we're going to add an extra layer three header. When it comes into wherever the tunnel is going to start, then this gets added to it, with its own time to live and its own source and destination IP address, and that's going to be of where the tunnel is going to end.
So what will happen is now every hop along the way is going to take a look at this layer three header along the way, and it's going to ignore this packet right here. The time to live here gets decremented, and it looks at this source and destination IP address to do all of its routing. Once it gets to its final destination, it's going to remove that and then treat this as just a regular packet for the rest of the route.
Let's take a look at a little different example of what tunneling looks like. Let's say we have a letter that we want to deliver — that's the payload right here. We're going to put it inside an envelope which has addressing on it; that's this layer three header right here. But let's say we want to traverse across some other network here. What we can do is encapsulate it, or add it to another envelope with its own source and destination IP address that's going to be addressed to the end of the tunnel. Then what will happen is it'll use that information of the second envelope to route it along its way. Once it gets to the end of the tunnel, it will get rid of that extra envelope and then deliver the rest of the letter wherever it's supposed to go, using the source and destination IP address of that second, or the original, layer 3 header.
Let's take a look at an example of where we might use tunneling. An example might be if we were using OSPF and we had it running on router 1 and router 3, but perhaps we don't have control over router 2, nor do we want it really to participate in our OSPF process here. Perhaps the reason why is because maybe it's owned by the internet service provider, or perhaps it's a whole network of routers — maybe this is representing a whole network of routers.
What we want to do is still run OSPF on router 1 and router 3 and any other routers we have for our whole corporate network, however we need to interconnect these two. Well, this is going to be a problem: that OSPF, if it can't talk to this in-between router and transfer the data between router 1 and router 3, that's going to be problematic.
So in this case right here we would want to set up a tunnel. We would set up a tunnel from this router over to this router, and then the OSPF communication is going to get encapsulated with this extra layer three header, sent across the ISP's network, and make it to router 3. Router 3 is the end of the tunnel, and so then it will take that extra layer off of it and then it will process those OSPF hello timers or whatever communication is going across this network.
Another example might be a wireless LAN controller and access points. There's a tunnel that happens between an access point and this wireless LAN controller. Let's say we have a guest network, and this laptop is part of the guest network and is accessing it through this wireless access point. You wouldn't want to dump that traffic on your regular network right here, because that would be insecure. So what happens is that traffic gets encrypted and tunneled back to the wireless LAN controller, and maybe that wireless LAN controller has a direct connection to the internet, or some sort of firewall, or whatever the case, however we have it set up. But it lands this client to the public network without ever compromising anything internally.
So this is an example of where we might want to tunnel our traffic. There are lots of examples that we can use with tunneling.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →