This is a discussion paper. It may be possible that the concepts explained here are not going to work. Feel free to distribute this document as it is and send comments to the autor. The copyrights remain by the autor itself and reproduction in any way requires written approval. Generic Routing Encapsulation Introduction Many companies today implement VPNs over the Internet to reduce leased line costs.
Some carrier already offer VPNs as a product.
One of these reasons meight be the market leadership of Cisco, another the promise that GRE is open and can be used with every vendor. A One of the most used designs is to have the branch office only connected to the HQ and cut off communication to the public Internet. This is done via access lists. The branch office systems use the router as default gateway and the router sends everything into the tunnel. Therefore, a packet from a system in one of the branch offices is first send to their router, then forwarded to the HQ router where it meight pass through access lists to prevent users from surfing the web without using the companies proxy server and then is NATed and send out to the public Internet.