# https://tunnels.io/learn/what-is-tunneling

[Home](https://tunnels.io/) / [Learn](https://tunnels.io/learn) / What is tunneling?

Networking basics

# What is tunneling?

Tunneling is wrapping one network protocol inside another so that traffic can cross a network that would not otherwise carry it. The original packet becomes the payload of a new packet, travels to the far end of the tunnel, and is unwrapped there. The intermediate network only ever sees the outer wrapper.

## What does a tunnel actually do to your traffic?

A tunnel takes a packet that could not travel across a given network on its own and hides it inside a packet that can. The two ends of the tunnel agree on the format, and everything in between forwards the outer packet like ordinary traffic. Nothing along the path has to understand, or even be aware of, the protocol being carried. Every tunneling technology, from a VPN to an SSH port forward, is a variation on that one idea.

## How does encapsulation work?

Encapsulation means the original packet, headers and all, is treated as pure data by the tunnel. The sending end prepends a new header addressed to the far end of the tunnel and puts the whole original packet in the payload. The receiving end strips the outer header and releases the inner packet onto its local network, a step usually called decapsulation.

Because those extra headers are added to packets that may already be close to the maximum size the link allows, tunnels reduce the usable MTU. That is why a misconfigured tunnel often passes small requests happily and then stalls on large ones.

## Why would you tunnel traffic at all?

Four reasons cover nearly every real case. To cross a network that does not speak your protocol, such as carrying IPv6 over an IPv4-only link. To reach a machine that has no public address of its own, which is true of anything behind NAT or a home router. To protect traffic in transit, when the outer protocol encrypts. And to make two separate networks behave as one, which is what a site-to-site VPN is for.

## Reverse tunnels, briefly

In an ordinary tunnel, a client reaches out to something it wants to use. In a reverse tunnel, the client reaches out in order to be used: it opens an outbound connection to a publicly reachable server, and that server forwards inbound traffic back down the connection that is already open.

This matters because outbound connections almost always work, while inbound ones are blocked by NAT, by a firewall, or simply by the fact that you do not control the router. It is the mechanism behind every service that gives a laptop a public URL. There is a longer explanation in [what is a reverse tunnel](https://tunnels.io/learn/what-is-a-reverse-tunnel).

| | Forward tunnel | Reverse tunnel | VPN tunnel |
| --- | --- | --- | --- |
| Who opens the connection | The machine that wants access | The machine that wants to be reached | The machine joining the network |
| What becomes reachable | A remote service, from your machine | A local service, from the internet | The whole remote network |
| Typical use | Reach a database that only listens inside a remote network | Share a local site, receive webhooks on a laptop | Work remotely as though you were in the office |
| Common tools | ssh -L, HTTP CONNECT proxies | ssh -R, hosted tunnel services | WireGuard, IPsec, OpenVPN |

## SSH port forwarding in one paragraph

SSH tunneling, more precisely called port forwarding, carries arbitrary TCP connections inside an existing SSH session. The `-L` flag binds a port on your machine and forwards it to a host the SSH server can reach. The `-R` flag does the opposite, binding a port on the server and forwarding connections back to a host your machine can reach. The `-D` flag turns the session into a SOCKS proxy. The flags, and the limits you hit with them, are covered in [what is SSH tunneling](https://tunnels.io/learn/what-is-ssh-tunneling).

## How VPNs differ

A VPN tunnel encapsulates and encrypts traffic between two endpoints so the networks in between cannot read or alter it. What makes it a VPN rather than just an encrypted tunnel is addressing: your machine is given an address inside the remote network and routes traffic as though it were physically attached to it. That is exactly what you want for access to many internal services at once, and far more than you need to show one local port to one person. See [what is a VPN tunnel](https://tunnels.io/learn/what-is-a-vpn-tunnel) and [what is split tunneling](https://tunnels.io/learn/what-is-split-tunneling).

## What other tunneling protocols are there?

GRE is the plain one: it wraps almost any protocol inside IP and adds no encryption whatsoever. IPsec adds authentication and encryption and carries most site-to-site VPNs. WireGuard and OpenVPN are the common client VPN choices, and L2TP is usually paired with IPsec because it provides no confidentiality on its own.

Beyond VPNs, VXLAN carries Ethernet frames over UDP inside data centres, 6in4 and similar mechanisms carry IPv6 across IPv4-only networks, and HTTP CONNECT tunnels a raw TCP connection through a web proxy, which is how HTTPS gets through a corporate proxy at all.

## Is tunneling secure?

Tunneling and encryption are separate ideas, and treating them as one is the most common mistake in this area. GRE, IP-in-IP and VXLAN encapsulate without protecting anything; SSH, IPsec and WireGuard encrypt because their carrier protocol does. A tunnel is only as private as the protocol wrapped around it.

The second consideration is direction of trust. A tunnel is a hole through a boundary that somebody drew on purpose, so a tunnel opened outward from a corporate network can carry traffic straight past the egress filtering that network depends on. Judge any tunnel by what the outer protocol guarantees and by who is permitted to open one, never by the word itself.

## Related reading

Each of these takes one part of the topic further.

[What people build with this Nine jobs the same mechanism does, from webhook delivery to a Minecraft server.](https://tunnels.io/use-cases) [What is a reverse tunnel? Why an outbound connection is the only kind that reliably works from behind NAT.](https://tunnels.io/learn/what-is-a-reverse-tunnel) [What is SSH tunneling? Local, remote and dynamic forwarding, the exact commands, and where SSH runs out.](https://tunnels.io/learn/what-is-ssh-tunneling) [What is a VPN tunnel? How a VPN encapsulates traffic, and why it solves a different problem from a public URL.](https://tunnels.io/learn/what-is-a-vpn-tunnel) [What is split tunneling? Sending part of your traffic through the tunnel and the rest around it, with the trade-offs.](https://tunnels.io/learn/what-is-split-tunneling) [HTTP vs HTTPS tunnels Where TLS is terminated, and what that means for what the tunnel operator can see.](https://tunnels.io/learn/http-vs-https-tunnels) [How to expose localhost Four approaches compared, including the ones that do not involve a tunnel at all.](https://tunnels.io/learn/how-to-expose-localhost) [localhost vs 127.0.0.1 A hostname and an address are not the same thing, and the difference decides what can reach you.](https://tunnels.io/learn/localhost-vs-127-0-0-1) [What is a reserved subdomain? Why a tunnel URL that changes on every restart quietly breaks whatever you registered it with.](https://tunnels.io/learn/what-is-a-reserved-subdomain) [How to test webhooks locally The most common reason developers reach for a tunnel in the first place.](https://tunnels.io/learn/how-to-test-webhooks-locally) [How to share a local site with a client Showing work in progress without deploying it to a staging server first.](https://tunnels.io/learn/how-to-share-a-local-site-with-a-client) [Testing a mobile app against localhost Why a phone cannot see your laptop's loopback, and the three ways around it.](https://tunnels.io/learn/how-to-test-a-mobile-app-against-localhost)

Or browse the whole [Learn library](https://tunnels.io/learn).

## Frequently asked questions

### Is tunneling the same thing as a VPN?

No. A VPN is one kind of tunnel. Tunneling is the general technique of carrying one protocol inside another, while a VPN adds encryption and gives your machine an address inside the remote network so it behaves as a member of that network. Plenty of tunnels, such as a GRE tunnel or a plain SSH port forward, are not VPNs.

### Does tunneling encrypt my traffic?

Only if the outer protocol does. GRE, IP-in-IP and VXLAN provide no confidentiality at all, whereas IPsec, WireGuard and SSH encrypt everything they carry. If what you send inside the tunnel is already HTTPS, it stays encrypted end to end regardless of what the tunnel itself does.

### Does a tunnel slow traffic down?

Slightly. Encapsulation adds header bytes to every packet, encryption costs some CPU, and the traffic takes a longer path because it travels through the tunnel endpoint instead of going direct. In practice the added latency is dominated by the physical distance to that endpoint, and for bulk transfers the reduced MTU usually matters more than the encryption.

### Do I need to open a port on my router to use a tunnel?

Not for a reverse tunnel. The connection is opened from your machine outwards, and inbound traffic rides back down that already established connection, so NAT and your firewall are never asked to accept anything new. Router port forwarding is the alternative approach, and that one does require opening a port and holding a stable public address.

## How does tunnels.io use tunneling?

tunnels.io is a reverse tunnel service. You run a small client next to your application and it opens an outbound TLS connection to our edge, so nothing has to be opened on your router or firewall. The edge terminates public HTTPS on your URL, passes each request down that existing connection to your local port, and sends the response back the same way. The engine carries HTTP, HTTPS and raw TCP; it does not carry UDP.

The free Basic plan costs nothing, includes 4 GB of transfer a month, one tunnel and a sustained rate of 1,024 requests per second, and issues a random URL each time you start. There is no interstitial page on any plan, so browsers and webhook senders reach your application directly. Paid plans add reserved subdomains, TCP tunnels, custom domains and higher request rates.

[Get started free →](https://tunnels.io/get-started) [Back to Learn](https://tunnels.io/learn)