Forward IPv4 carefully after removing the wrapper
04Decapsulation is followed by ordinary IPv4 forwarding, with loop, size and filtering limits that a tunnel wrapper does not remove.
Separate filtering view: looking only at outer IP addresses and Protocol47 does not apply an inner-packet policy. Inspect the encapsulated packet or filter at the tunnel endpoint.
Source for this drawing: RFC 2784 · Read RFC section 3.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Use the inner destination and decrement inner TTL when forwarding the decapsulated IPv4 packet.
- RFC 2784 section3.1 says the payload destination MUST be used for forwarding and the payload Time To Live (TTL) MUST be decremented.
- If the payload destination is the encapsulator at the other end of the tunnel, looping can occur; in this case the packet MUST be discarded.
- With a chosen 1500-byte inner packet, four-byte GRE header and20-byte outer IPv4 header, the delivery packet is1524bytes. A1500-byte underlay path does not fit it without further handling.
- RFC 2784 section9 records incomplete PMTU/ICMP interaction and outer fragmentation in deployed implementations. It does not require PMTU-feedback relay or give a universal no-fragment rule. PMTU means Path Maximum Transmission Unit; ICMP means Internet Control Message Protocol.
- RFC 2784 section6 explains that packet filtering must inspect inside GRE or happen at tunnel endpoints. A valid GRE wrapper supplies no automatic encrypted or authenticated channel.
The TTL example is64→63 for forwarding; this is not a complete IPv4 forwarding implementation. The size case is an arithmetic budget, not a mandatory MTU or delivery guarantee. Outer-fragmentation, feedback, routing policy and IPsec require their own handling.
Read the RFC section ↗