WireGuard, GRE or EOIP tunnel: which one to choose?

What is an IP tunnel for?

An IP tunnel carries traffic from one network through another, like a pipe. It is used for two main things:

• Connecting sites: two datacenters, an office and a server, several routers, as if they were on the same network.
• Exposing protected IP addresses: your server stays at home or with another host, but the public reaches it through IP addresses that sit behind a DDoS-filtered network.

The right protocol depends on three questions: do you need encryption, which network layer are we talking about, and what hardware is on the other side?

WireGuard: the default choice

WireGuard is a modern VPN, built into the Linux kernel since version 5.6. It works at layer 3 (it carries IP packets) and encrypts all traffic with modern algorithms: ChaCha20, Poly1305 and Curve25519.

Its strengths:

• a short configuration, with a key pair on each side;
• good performance, even on modest hardware;
• clients for Linux, Windows and macOS.

Pick WireGuard if you want an encrypted tunnel without overthinking it, to connect servers or give a team secure access.

GRE: simple and universal

GRE (Generic Routing Encapsulation) wraps IP packets inside other IP packets. It is also layer 3, but without encryption. In return, it is the most widespread protocol: almost every router and system can set it up.

Pick GRE for classic network interconnection, over trusted infrastructure, or when the equipment on the other side only speaks GRE. If the data is sensitive, add application-level encryption (HTTPS, TLS, SSH).

EOIP: connecting MikroTik networks at the Ethernet level

EOIP (Ethernet over IP) is a MikroTik protocol. It carries Ethernet frames, meaning layer 2: your two remote networks behave as if they were plugged into the same switch.

EOIP does not encrypt on its own, but it can be combined with IPsec to encrypt traffic end to end.

Pick EOIP if you have MikroTik routers on both sides and need a real shared Ethernet network (VLANs, layer 2 protocols).

The comparison in short

• WireGuard: layer 3, encrypted, Linux / Windows / macOS. For secure access between sites and teams.
• GRE: layer 3, unencrypted, most network equipment. For classic IP interconnection.
• EOIP: layer 2, optional IPsec encryption, MikroTik routers. To extend an Ethernet network.

What about DDoS protection?

The protocol alone does not protect you from attacks. What matters is where public traffic lands. With an IP tunnel, attacks hit the tunnel provider's IP addresses, which are filtered upstream, and only legitimate traffic goes down the tunnel to your server.

At VexCloud, tunnels land at Equinix PA6 in Paris, behind two-layer filtering: our three IP transit providers (Gcore, Netrix and EASIO-COM) for volumetric attacks, then an in-house XDP script at the Linux kernel level.

How much does it cost?

The VexCloud IP tunnel is built in a configurator:

• bandwidth: €0.50 per Mbps, billed at the 95th percentile (see our 95th percentile explainer);
• IPv4: €1 per address per month;
• IPv6: free, up to 254;
• IPsec for EOIP: optional and free.

The first tier, 5 Mbps with one IPv4, costs €3.50 per month.