L4 Tunnel
Hide a backend behind a GRE tunnel — through shared platform L4 edge nodes, or between two of your own fleet servers — with the real client IP preserved.
Last updated
On this page
L4 Tunnel hides a backend server behind a GRE tunnel so attackers only ever see the front IP. GRE carries the traffic with the real client IP untouched — no proxy protocol, no header rewriting. The product page offers two modes on a toggle: Tunnel With Us (TWU), which fronts you through a shared platform edge node, and Bring Your Own Servers (BYOS), which pairs two servers you own.
Tunnel With Us (shared edge nodes)
TWU puts a platform-operated L4 edge node in front of one of your fleet servers. Choose New tunnel and the wizard walks through:
- Name — a short label; it names the tunnel interface on both ends.
- Node — pick an edge node, or leave placement automatic (a random eligible node with capacity). The step is skipped when no node is user-selectable.
- Ports — what the node forwards to you. On a full-IP node you get the whole node address 1 (every TCP and UDP port, 1–65535; one live tunnel per node). On a port-range node the free-ports picker shows the first ten free ports inside the node's window with a tcp/udp/both toggle, search and load-more; you can also type explicit ranges. A tunnel allows up to 32 port entries (2048 expanded ports) that don't overlap another tenant on the node.
- Destination — one of your online fleet servers. The daemon installs the
gretundagent on it automatically when missing. - Rate limits — node-side caps, see below.
- Return mode — tunnel return or DSR, see below.
- Review — create, then watch live progress as both ends install and configure.
Bring Your Own Servers
BYOS pairs two of your own fleet servers: a public origin (the front that takes
the traffic) and a hidden destination (the backend that does the work). Both need
the fleet daemon; gretund installs on both with one click when you create the
tunnel, then the platform pushes the config to each side. The wizard asks for the
origin, the destination (must be a different server), ports, return mode and
origin-side rate limits.
Rate limits
Both modes share the same editor, with presets to start from:
- High-traffic safe — per-source 100 conn/s and 2,000 pps (with bursts), a tunnel-wide 100,000 pps ceiling, and SSH bypassed — real traffic, including SFTP, is untouched.
- Strict — the safe preset plus a tunnel-wide 2,000 conn/s cap and a 900 Mbps bandwidth cap.
- Custom — edit every field yourself.
- Off — no rate limiting.
Per-source limits meter each visitor IP individually, so one flooding source can't
consume the tunnel-wide budget. Bypass ports (for example tcp:22) are never
rate-limited — use them for SSH and management access so you can't lock yourself
out.
Return mode
- Tunnel return (default) — replies flow back through the front end. Works everywhere.
- DSR (direct server return) — the destination replies straight to the client,
so return traffic never touches the front. It requires the destination's provider
to forward packets with a spoofed source IP; AWS, GCP, Azure and DigitalOcean
filter these, and
gretundfalls back to tunnel return when it detects a filtering provider.
The tunnel detail page
Click a tunnel to open its detail page. Three tabs:
- Overview — status with actions (push the config again, delete), a per-end card for each side (online state, gretund state, last install/config job), the forwarded ports, rate-limit chips, the return mode, and a timeline built from the job results.
- Analytics — throughput (rx/tx bits per second), packets and drops per minute over 1h, 24h or 48h, from per-minute rollups the agents piggyback on heartbeats (48h retention). A Bandwidth card below charts hourly byte totals over 48h, 7 or 30 days.
- Control — edit the rate limits and return mode; saving re-pushes the config to both ends. Ports are read-only — delete and recreate the tunnel to change them.
Deleting a tunnel
Delete offers two modes:
- Graceful (default) — queues teardown jobs on both ends; each daemon removes the tunnel device, routes and rules on its next heartbeat. The row disappears immediately.
- Force delete — removes the row and its metrics right now with no teardown. Use it when an end is offline or the tunnel is stuck; stale config may linger on the boxes.