Services
GRE and WireGuard tunnels
Route your leased IPv4 address space through dedicated tunnels, delivered over GRE or WireGuard. Connect to any infrastructure worldwide.
Features
Tunnel features
Low latency
Optimized tunnel endpoints in major data center hubs across Europe, US, and Asia for minimal latency overhead.
Global endpoints
Choose tunnel endpoints in 20+ locations. Route your leased IPs through the nearest point of presence.
GRE or WireGuard
We support both GRE and WireGuard as tunnel delivery protocols. Choose the option that best fits your network setup and environment.
WireGuard support
Choose between standard GRE and modern WireGuard tunnels. WireGuard works through NAT and CGNAT, making it ideal for locations without a public IP.
Custom configuration
Tailored MTU settings, keepalive timers, and routing policies. We configure everything to your specifications.
Redundant tunnels
Set up primary and failover tunnels for high availability. Automatic failover with sub-second convergence.
Specifications
Technical specifications
Our tunnel infrastructure is built on enterprise-grade hardware with redundant uplinks.
| Protocol | GRE (RFC 2784) / WireGuard |
| Bandwidth | 250 Mbit/s |
| MTU | Configurable, default 1476 |
| Uptime target | 99% target |
| DDoS protection | Optional |
tunnel-config-example.txt
# GRE Tunnel Configuration Example interface Tunnel0 ip address 10.0.0.2 255.255.255.252 tunnel source 203.0.113.1 tunnel destination 198.51.100.1 tunnel mode gre ip ip mtu 1476 # WireGuard Alternative [Interface] Address = 10.0.0.2/30 PrivateKey = <your-private-key> Table = off [Peer] PublicKey = <rtm-public-key> Endpoint = 198.51.100.1:51820 AllowedIPs = 0.0.0.0/0
Use cases
Common use cases
Host servers without ISP IPs
Run servers from your office or on-premise location using your leased IPv4 space via a tunnel, without depending on your ISP's address allocation.
Bypass port 25 restrictions
Most residential and business ISPs block outbound port 25. Route your mail traffic through a tunnel to send email from your leased IPv4 addresses.
Remote data center connectivity
Connect leased IPv4 blocks to your infrastructure in remote data centers without requiring direct peering or transit.
Rent less than a /24
A /24 is the smallest self-routable block, but you don't always need 256 IPs. Rent exactly what you need.
Background
What a tunnel actually does
Leased or owned IPv4 space is registered in one place, but you usually want to use it somewhere else: a server in another country, a provider that will not accept a Letter of Authorization, or infrastructure with no BGP session of its own. A tunnel bridges that gap.
We terminate the address space on our own routers and build an encapsulated point-to-point link to your endpoint. Traffic for your block arrives at our edge, travels through the tunnel, and emerges on your machine as though the addresses were configured locally. Return traffic takes the same path. Your server needs no BGP session and no relationship with a registry.
Because encapsulation adds header overhead, the usable MTU inside the tunnel is lower than on a plain interface. We supply the correct MTU and MSS clamping settings alongside the configuration, so this never surfaces as the classic symptom where small requests succeed but large transfers stall. If your setup needs other values, we change them on request.
Compare
GRE or WireGuard
We deliver tunnels over either. Which one fits depends on what your endpoint supports and whether you need the traffic encrypted.
GRE
Lightweight encapsulation with no encryption and very little CPU cost. Supported natively by effectively every router and by the Linux kernel. The better choice when the path between us is already trusted, or when raw throughput matters more than confidentiality.
WireGuard
Modern encrypted tunneling with a small, auditable codebase and strong performance. The better choice when traffic crosses networks you do not control, or when your endpoint sits behind NAT, where plain GRE becomes awkward.
If you are not sure, tell us what the endpoint is and we will recommend one.
Contact
Need your IPv4 space routed?
Tell us where your endpoints are and whether GRE or WireGuard suits your setup. We usually reply in 1-3 business hours.
FAQ
Tunneling questions
Do I need my own ASN?
No, and that is the main reason to use a tunnel. We announce the space and hand it to you over the link, so your endpoint needs nothing more than the ability to bring up a tunnel interface.
What does a tunnel do to latency?
It adds the round trip to our nearest endpoint, so siting matters more than the protocol. Pick an endpoint close to your server and the overhead is typically small. We will tell you which endpoint suits your location before you commit.
Will it work behind NAT?
WireGuard handles NAT well. Plain GRE does not traverse NAT reliably, so if your endpoint has no public address of its own, WireGuard is the option to take.
What MTU should I use?
Lower than the standard 1500, to leave room for the encapsulation headers. We supply the exact value with your configuration along with MSS clamping, which is what prevents small packets working while large transfers hang. Both can be changed on request.
Can I run BGP over the tunnel?
Yes, if you have an ASN and want to manage the announcement yourself. Most customers do not need this and take the simpler static setup instead.
Can I tunnel space I bought elsewhere?
Yes. We can route address space you already hold, provided you can issue a Letter of Authorization showing you are entitled to announce it.
Services
Related services
Other ways we help with IPv4 address space.
Buy IPv4
Purchase IPv4 address blocks outright
Lease IPv4
Rent IPv4 addresses on flexible terms
Blacklist monitoring
RBL checks & abuse mailbox forwarding
Further reading
GRE tunnels for IPv4: when you need one and how to set it up
A tunnel brings IP addresses to a server that cannot announce them: no BYOIP at your provider, no ASN, or fewer than 256 addresses. GRE or WireGuard, and MTU.
Read more