Tunnels routing using a loopback interface?

Networking Solutions Discussion
1

Hello,

I was reading another thread which made me thinking that when building tunnels (tailscale in that case) is bound to any external interface interference is expected to cause tunnel connectivity. And which leads to tunnel monitoring need to be built to make recover quick interface switching.

That made me wondering why would this be a nice way to accomplish tunnel setup?

Because tunnel restart should be avoidable if tunnel was bound to an interface that basically never goes down when router is running.

Good for that are loopback interfaces as the external interfaces whatever available are then from tunnel viewpoint just another internet router between tunnel endpoints which doesn’t matter as long as both endpoints still are reachable. Which happens to be one of the major things that made IP & Internet using it so successful.

The external route priority is then just another usual routing setup preferences matter or managing up and down interfaces at will no need worrying tunnel staying up as it’s end to end and external interfaces are just routes between local and remote tunnel endpoints.

Incase using globally routable (PI ie. provider independent) IP’s the tunnel loopback address usually used from such prefix, which is advertised (BGP usually) upstream. But otherwise private blocks IP’s loopback for interface is usually set from any site used prefix, tunnel starts outbound and traffic NAT’ed on any external interface.

Just to clarify a bit:

Loopback I write here is not the same *nix commonly well known lo0 loopback-interface and it’s 127.0.0.1/32 & ::1/128 addresses. No, that is there and not to be touched. Other loopback interfaces with different number can be added for outbound and inbound traffic to other subnets from any external interface or used by a tunnel.

I have no experience yet tunnelling yet with Teltonika devices (I have no real current use for it at the moment), but otherwise have done enterprise & ISP gear same and this is how I know things are usually built when good redundancy is also a priority.

So I’m not sure yet, if what I wrote would be even (yet) configurable with RutOS devices. But what I wrote would be natural way how we did those in my career and would first try to build things if I had to do it now. I know it can be done std Linux box routing too, but don’t know if not yet implemented RutOS CLI and WebUI management. Which is valid point not trying it sure anyone not willing to live with self built hacks and prepared to fix things after upgrades.

So I thought It would be nice to hear from others here think. Have you used loopback as an endpoint for your tunnel and how did it work with RutOS? I’d be glad to know if this is fully supported and doable from WebUI management, which apparently most use.

Cheers,

:slight_smile: riku

e: typo

2

Now thinking it bit more, it depends. About how the protocol used and especially remote end works. If it supports and accepts connecting clients/peers roaming or not. Because local external address will change anyway and that is what remote end sees, when NAT is in use. When using globally routed PI IP prefix where loopback address is from, then remote end doesn’t see any changes and tunnel can be opened both directions also.

So it cannot be thought providing benefits if a) protocol is L4 connection oriented like top of TCP stuff. b) But connectionless L4 UDP and L3 plain IP it’s possible, provided no intentionally not allowed or unintentional perhaps poor implementation.

IPSec (over UDP), DTLS (TLS/UDP) and perhaps Wireguard (Tailscale) I think should work, if roaming is allowed.

I know IPSec over UDP, anything inside GRE works as we did it may times over and over years. Even MPLS over GRE over IPSec works with loopback connected tunnels and behind NAT, though it was an and very tedious to manage ugly hack my colleague managed to get done so that MPLS could be used over DMVPN <eh>

4

Greetings,

Apologies for the delayed response.

At the moment, this is not supported as a standard configuration through the WebUI. However, it should be possible to configure via the CLI: Command Line Interfaces - Teltonika Networks Wiki

Thank you for your feedback. I have forwarded your suggestion regarding loopback-bound tunnels to our R&D team for consideration in future design discussions and potential WebUI improvements.

Best Regards,
Justinas

5

@Justinas Thanks for your reply. I think we can make your reply solved answer. Then perhaps we read at some later version if or when this became implemented feature.

Cheers,

:slight_smile: riku