--- title: "GRE Tunnel via IPsec Connection - icom OS Routers" slug: "gre-tunnel-via-ipsec-connection-en" updated: 2026-08-06T14:00:46Z published: 2026-08-06T14:00:46Z canonical: "docs.insys-icom.com/gre-tunnel-via-ipsec-connection-en" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.insys-icom.com/llms.txt > Use this file to discover all available pages before exploring further. # GRE Tunnel via IPsec Connection - icom OS Routers This Configuration Guide shows how to configure a GRE tunnel within an IPsec connection. ## Situation A remote router has several local subnets that need to be addressed from the INSYS router. An IPsec connection only allows to address one subnet. A GRE connection can be established to more than one subnet, but cannot be encrypted. To be able to establish encrypted connections to more than one subnet, it is possible to route a GRE tunnel through an encrypted IPsec connection. ## Solution It is prerequisite that you have access to the web interface of the router and the router is configured for a WAN connection using the startup wizard from default settings. It is also prerequisite that the remote router supports GRE via IPsec. The following figure shows the network topology that is used for this example: ![cg m3 gre via ipsec](https://docs.insys-icom.de/assets/cg_m3_gre_via_ipsec.png) > [!WARNING] > Keep your router up to date! > > Update your router to **iom OS 7.3** or later first! All encryption algorithms that are no longer considered sufficiently secure have been removed starting with this version, which eliminates the possibility of such algorithms being used inadvertently. > [!NOTE] > Please note for possible differences in the naming of the cellular interface! > > The cellular interfaces have been renamed from `lteX` to `cellularX` with version **icom OS 10.0**. Depending on the version, the following description may therefore differ from your router. For security reasons, we recommend that [you regularly update your router](/kb/docs/updating-a-router-manually-en) to the latest version anyway. See [FAQ](/kb/docs/how-does-the-renaming-of-the-cellular-interface-from-ltex-to-cellularx-affect-my) for more information. 1. Open the user interface of the router: [https://insys.icom](https://insys.icom) 2. Click on on the *Network* → *Interfaces* page under *IPsec* to add a new IPsec tunnel and configure this accordingly: - *Description*: IPsec tunnel to remote-domain.com - *VPN server address*: remote-domain.com - *Local tunnel address*: 192.168.2.0 / 24 - *Local subnet*: 192.168.2.0 / 24 - *Remote subnet*: 192.168.200.0 / 24 - Configure authentication and encryption according to the settings of the remote router. > [!NOTE] > This adds an interface for an IPsec tunnel from the local LAN to the remote router > > All addresses are exemplary for the present example and must be adjusted to your application. ![cg en m3 gre via ipsec v2 01](https://docs.insys-icom.de/assets/cg_en_m3_gre_via_ipsec_v2_01.png) 3. Click on SUBMIT. 4. Click on on the *Network* → *Interfaces* page under *GRE* to add a new GRE tunnel and configure this accordingly: - *Description*: GRE tunnel to remote router - *IP address or domain name of remote site*: 192.168.200.1 - *Own IP address*: **static** 192.168.2.1 - *Local tunnel address*: 10.10.10.10 / 30 - *GRE key*: Enter a GRE key only if the remote router requires this. > [!NOTE] > This adds an interface for an GRE tunnel from the local LAN to the remote router > > All addresses are exemplary for the present example and must be adjusted to your application. The *local tunnel address* can be selected freely, but must be in the same virtual network than the one of the remote terminal. In rare cases, it may be necessary to adjust the MTU (maximum permissible number of bytes in a packet to be transmitted). The TTL (time to live) of the packet will be decremented by one by every router that it passes on its way. If the value has fallen to 0, the packet will not be forwarded any more. This helps to avoid endless loops for example. By default, the TTL value from the tunnelled packet is used for the GRE packet. ![cg en m3 gre via ipsec v2 02](https://docs.insys-icom.de/assets/cg_en_m3_gre_via_ipsec_v2_02.png) 5. Click on SUBMIT. 6. Click on on the *Network* → *Routing* page under *Static routes* to add a new static route through the GRE tunnel to the remote subnet behind the remote router and configure this accordingly: - *Description*: IPsec route to 192.168.200.0 - *Creation after start of Interface*: ipsec1 - *Type of the route*: **Network** 192.168.200.0 / 24 - *Gateway*: **interface** ipsec1 ![cg en m3 gre via ipsec v2 03](https://docs.insys-icom.de/assets/cg_en_m3_gre_via_ipsec_v2_03.png) 7. Click on SUBMIT. 8. Click on on the *Network* → *Routing* page under *Static routes* to add a new static route through the GRE tunnel to the remote subnet behind the remote router and configure this accordingly: - *Description*: GRE route to 192.168.201.0 - *Creation after start of interface*: gre1 - *Type of the route*: **Network** 192.168.201.0 / 24 - *Gateway*: **interface** gre1 9. Click on *Save settings*. ![cg en m3 gre via ipsec v2 04](https://docs.insys-icom.de/assets/cg_en_m3_gre_via_ipsec_v2_04.png) 10. Click on SUBMIT. 11. Add the next two routes to the remote subnets 192.168.202.0 and 192.168.203.0 accordingly. ![cg en m3 gre via ipsec v2 05](https://docs.insys-icom.de/assets/cg_en_m3_gre_via_ipsec_v2_05.png) 12. Click on in the WAN chain added by the Startup wizard on the *Network* → *WAN / Internet* page to add another interface to the WAN chain. 13. Select for the interface on *Starting position* **2** the *Interface* **ipsec1**. 14. Click on again to add another interface to the WAN chain. 15. Select for the interface on *Starting position* **3** the *Interface* **gre1**. > [!NOTE] > Please note! > > Above two settings add the IPsec and GRE interfaces (in this order) to the WAN chain. A WAN chain is the sequential arrangement of interfaces that defines the establishment of a WAN connection ![cg en m3 gre via ipsec v2 06](https://docs.insys-icom.de/assets/cg_en_m3_gre_via_ipsec_v2_06.png) 16. Click on SUBMIT. 17. Click on on the *Network* → *Firewall / NAT* page under *IP filter* to add an IP filter rule that rule enables to establish IPsec connections and key exchange and configure this accordingly: - *Description*: IPsec (tunnel establishment) - *Packet direction*: OUTPUT - *IP version*: All - *Protocol*: UDP - *Output interface*: Check the WAN interface used, i.e. **lte2 *or* net3**. - *Destination port*: 500 ![cg en m3 gre via ipsec v2 07](https://docs.insys-icom.de/assets/cg_en_m3_gre_via_ipsec_v2_07.png) 18. Click on SUBMIT. 19. Click on on the *Network* → *Firewall / NAT* page under *IP filter* to add an IP filter rule that enables to establish the IPsec tunnel and configure this accordingly: - *Description*: IPsec protocol ESP - *Packet direction*: OUTPUT - *IP version*: All - *Protocol*: ESP - *Output interface*: Check the WAN interface used, i.e. **lte2 *or* net3**. 20. Click on SUBMIT. 21. Click on on the *Network* → *Firewall / NAT* page under *IP filter* to add an IP filter rule that enables to establish IPsec connections and key exchange when using NAT traversal and configure this accordingly: - *Description*: IPsec UDP Port 4500 (NAT traversal) - *Packet direction*: OUTPUT - *IP version*: All - *Protocol*: UDP - *Output interface*: Check the WAN interface used, i.e. **lte2 *or* net3**. - *Destination port*: 4500 22. Click on SUBMIT. 23. Click on on the *Network* → *Firewall / NAT* page under *IP filter* to add an IP filter rule that rule enables to establish IPsec connections and key exchange and configure this accordingly: - *Description*: IPsec (tunnel establishment) - *Packet direction*: INPUT - *IP version*: All - *Protocol*: UDP - *Input interface*: Check the WAN interface used, i.e. **lte2 *or* net3**. - *Destination port*: 500 24. Click on SUBMIT. 25. Click on on the *Network* → *Firewall / NAT* page under *IP filter* to add an IP filter rule that enables to establish the IPsec tunnel and configure this accordingly: - *Description*: IPsec protocol ESP - *Packet direction*: INPUT - *IP version*: All - *Protocol*: ESP - *Input interface*: Check the WAN interface used, i.e. **lte2 *or* net3**. 26. Click on SUBMIT. 27. Click on on the *Network* → *Firewall / NAT* page under *IP filter* to add an IP filter rule that enables to establish IPsec connections and key exchange and configure this accordingly: - *Description*: IPsec UDP Port 4500 (NAT traversal) - *Packet direction*: INPUT - *IP version*: All - *Protocol*: UDP - *Input interface*: Check the WAN interface used, i.e. **lte2 *or* net3**. - *Destination port*: 4500 28. Click on SUBMIT. 29. Click on on the *Network* → *Firewall / NAT* page under *IP filter* to add an IP filter rule that enables to send all data through the IPsec tunnel and configure this accordingly: - *Description*: Traffic through the IPsec tunnel sent by the router - *Packet direction*: OUTPUT - *IP version*: All - *Protocol*: All - *Output interface*: ipsec1 30. Click on SUBMIT. 31. Click on on the *Network* → *Firewall / NAT* page under *IP filter* to add an IP filter rule enables to receive all data through the IPsec tunnel and configure this accordingly: - *Description*: Traffic through the IPsec tunnel sent to the router - *Packet direction*: INPUT - *IP version*: All - *Protocol*: All - *Input interface*: ipsec1 32. Click on SUBMIT. 33. Click on on the *Network* → *Firewall / NAT* page under *IP filter* to add an IP filter rule that enables to establish the GRE tunnel and configure this accordingly: - *Description*: GRE (tunnel establishment) - *Packet direction*: OUTPUT - *IP version*: All - *Protocol*: GRE - *Output interface*: Check the WAN interface used, i.e. **lte2 *or* net3**. 34. Click on SUBMIT. 35. Click on on the *Network* → *Firewall / NAT* page under *IP filter* to add an IP filter rule that enables to establish the GRE tunnel and configure this accordingly: - *Description*: GRE (tunnel establishment) - *Packet direction*: INPUT - *IP version*: All - *Protocol*: GRE - *Input interface*: Check the WAN interface used, i.e. **lte2 *or* net3**. 36. Click on SUBMIT. 37. Click on on the *Network* → *Firewall / NAT* page under *IP filter* to add an IP filter rule tenables to route all data from the local networks through the GRE tunnel. and configure this accordingly: - *Description*: Traffic from the local net through the GRE tunnel - *Packet direction*: FORWARD - *IP version*: All - *Protocol*: All - *Input interface*: net1, net2 - *Output interface*: gre1 38. Click on SUBMIT. 39. Click on on the *Network* → *Firewall / NAT* page under *IP filter* to add an IP filter rule that enables to route all data through the GRE tunnel to the local networks and configure this accordingly: - *Description*: Traffic through the GRE tunnel to the local net - *Packet direction*: FORWARD - *IP version*: All - *Protocol*: All - *Input interface*: gre1 - *Output interface*: net1, net2 40. Click on SUBMIT. 41. Activate the profile with a click on ACTIVATE PROFILE . 42. Observe the establishment of the WAN chain containing the tunnels on the ![view dashboard outline](https://docs.insys-icom.de/assets/icons/view-dashboard-outline.png) *Status* → *Dashboard* page in the *WAN chain* section. 43. Click on the *Administration* → *Debugging* page on OPEN DEBUG TOOLS , select the *Tool* **Ping**, enter available IP addresses of the remote subnets under *Parameter* and click on SEND to verify the connectivity. We’ve prepared the following ASCII configuration file for adding the filter rules in one go instead of entering them one by one as described in detail above. Copy and paste it to your text editor or download it using the link below. Don’t forget to adjust it to your application if required. The ASCII configuration file will add all filters as above with both possible WAN interfaces that can be created by the Startup wizard, i.e. **lte2** and **net3**. Refer to [Adding a List Parameter to a Profile Using Lua](/kb/docs/en/adding-a-list-parameter-to-a-profile-using-lua-en) to see how to apply an ASCII configuration file to a profile. ASCII configuration file ```plaintext netfilter.ip_filter.rule.add netfilter.ip_filter.rule[last].rule_active=1 netfilter.ip_filter.rule[last].rule_description=IPsec (tunnel establishment) netfilter.ip_filter.rule[last].rule_direction=output netfilter.ip_filter.rule[last].rule_protocol=udp netfilter.ip_filter.rule[last].rule_output_if=lte2,net3 netfilter.ip_filter.rule[last].rule_dport=500 netfilter.ip_filter.rule[last].rule_ipversion=all netfilter.ip_filter.rule.add netfilter.ip_filter.rule[last].rule_active=1 netfilter.ip_filter.rule[last].rule_description=IPsec protocol ESP netfilter.ip_filter.rule[last].rule_direction=output netfilter.ip_filter.rule[last].rule_protocol=esp netfilter.ip_filter.rule[last].rule_output_if=lte2,net3 netfilter.ip_filter.rule[last].rule_ipversion=all netfilter.ip_filter.rule.add netfilter.ip_filter.rule[last].rule_active=1 netfilter.ip_filter.rule[last].rule_description=IPsec UDP Port 4500 (NAT traversal) netfilter.ip_filter.rule[last].rule_direction=output netfilter.ip_filter.rule[last].rule_protocol=udp netfilter.ip_filter.rule[last].rule_output_if=lte2,net3 netfilter.ip_filter.rule[last].rule_dport=4500 netfilter.ip_filter.rule[last].rule_ipversion=all netfilter.ip_filter.rule.add netfilter.ip_filter.rule[last].rule_active=1 netfilter.ip_filter.rule[last].rule_description=IPsec (tunnel establishment) netfilter.ip_filter.rule[last].rule_direction=input netfilter.ip_filter.rule[last].rule_protocol=udp netfilter.ip_filter.rule[last].rule_input_if=lte2,net3 netfilter.ip_filter.rule[last].rule_dport=500 netfilter.ip_filter.rule[last].rule_ipversion=all netfilter.ip_filter.rule.add netfilter.ip_filter.rule[last].rule_active=1 netfilter.ip_filter.rule[last].rule_description=IPsec protocol ESP netfilter.ip_filter.rule[last].rule_direction=input netfilter.ip_filter.rule[last].rule_protocol=esp netfilter.ip_filter.rule[last].rule_input_if=lte2,net3 netfilter.ip_filter.rule[last].rule_ipversion=all netfilter.ip_filter.rule.add netfilter.ip_filter.rule[last].rule_active=1 netfilter.ip_filter.rule[last].rule_description=IPsec UDP Port 4500 (NAT traversal) netfilter.ip_filter.rule[last].rule_direction=input netfilter.ip_filter.rule[last].rule_protocol=udp netfilter.ip_filter.rule[last].rule_input_if=lte2,net3 netfilter.ip_filter.rule[last].rule_dport=4500 netfilter.ip_filter.rule[last].rule_ipversion=all netfilter.ip_filter.rule.add netfilter.ip_filter.rule[last].rule_active=1 netfilter.ip_filter.rule[last].rule_description=Traffic through the IPsec tunnel sent by the router netfilter.ip_filter.rule[last].rule_direction=output netfilter.ip_filter.rule[last].rule_protocol=all netfilter.ip_filter.rule[last].rule_output_if=ipsec1 netfilter.ip_filter.rule[last].rule_ipversion=all netfilter.ip_filter.rule.add netfilter.ip_filter.rule[last].rule_active=1 netfilter.ip_filter.rule[last].rule_description=Traffic through the IPsec tunnel sent to the router netfilter.ip_filter.rule[last].rule_direction=input netfilter.ip_filter.rule[last].rule_protocol=all netfilter.ip_filter.rule[last].rule_input_if=ipsec1 netfilter.ip_filter.rule[last].rule_ipversion=all netfilter.ip_filter.rule.add netfilter.ip_filter.rule[last].rule_active=1 netfilter.ip_filter.rule[last].rule_description=GRE (tunnel establishment) netfilter.ip_filter.rule[last].rule_direction=output netfilter.ip_filter.rule[last].rule_protocol=gre netfilter.ip_filter.rule[last].rule_output_if=lte2,net3 netfilter.ip_filter.rule[last].rule_ipversion=all netfilter.ip_filter.rule.add netfilter.ip_filter.rule[last].rule_active=1 netfilter.ip_filter.rule[last].rule_description=GRE (tunnel establishment) netfilter.ip_filter.rule[last].rule_direction=input netfilter.ip_filter.rule[last].rule_protocol=gre netfilter.ip_filter.rule[last].rule_input_if=lte2,net3 netfilter.ip_filter.rule[last].rule_ipversion=all netfilter.ip_filter.rule.add netfilter.ip_filter.rule[last].rule_active=1 netfilter.ip_filter.rule[last].rule_description=Traffic from the local net through the GRE tunnel netfilter.ip_filter.rule[last].rule_direction=forward netfilter.ip_filter.rule[last].rule_protocol=all netfilter.ip_filter.rule[last].rule_input_if=net1,net2 netfilter.ip_filter.rule[last].rule_output_if=gre1 netfilter.ip_filter.rule[last].rule_ipversion=all netfilter.ip_filter.rule.add netfilter.ip_filter.rule[last].rule_active=1 netfilter.ip_filter.rule[last].rule_description=Traffic through the GRE tunnel to the local net netfilter.ip_filter.rule[last].rule_direction=forward netfilter.ip_filter.rule[last].rule_protocol=all netfilter.ip_filter.rule[last].rule_input_if=gre1 netfilter.ip_filter.rule[last].rule_output_if=net1,net2 netfilter.ip_filter.rule[last].rule_ipversion=all ``` [ASCII configuration file download (right-click and save as)](https://docs.insys-icom.de/assets/configs/cg_m3_gre_via_ipsec_filters.txt) ## Troubleshooting - Disable the IP filters for IPv4 in the *Network* → *Firewall / NAT* menu under *Settings IP filter* to check whether incorrect filter settings are the reason for connection problems. Standard IP address: https://192.168.1.1; login depending on configuration; default for earlier firmware versions: *User name*: **insys**, *Password*: **icom** Applying an ASCII configuration file means that the opened profile will be amended or modified by the configurations contained. The opened profile will not be activated by this unless it contains the command `administration.profiles.activate`.