Network Tunneling Technologies: GRE, VXLAN, IPsec & WireGuard Explained
Byte-for-byte overhead and measured 10 Gbps throughput for all four protocols, so you pick the right one before you provision.
Tunneling underlays our connectivity services for multi-site networking, SD-WAN and data center interconnect.
Complete Comparison Table
Side-by-side technical comparison of all four protocols
| Feature | GRE | VXLAN | IPsec | WireGuard |
|---|---|---|---|---|
| RFC/Standard | RFC 2784 | RFC 7348 | RFC 4301 | RFC 9180 draft |
| OSI Layer | Layer 3 | Layer 2 over L3 | Layer 3 | Layer 3 |
| Encryption | None | None | AES-256-GCM | ChaCha20 |
| Authentication | None | None | PSK/Certificates | Public key |
| MTU Overhead | 24 bytes | 50 bytes | 60-90 bytes | 60 bytes |
| Performance | 5/5 stars | 4/5 stars | 3/5 stars | 5/5 stars |
| Configuration | Simple | Complex | Very complex | Very simple |
| Multicast Support | Yes | Yes | No | No |
| NAT Traversal | Poor | Good | Needs NAT-T | Excellent |
| Security Level | None | None | Excellent | Excellent |
| Primary Use Case | MPLS, internal | Data center | Enterprise VPN | Modern VPN |
| CPU Impact | Very low | Low | High | Very low |
| Maturity | 30 years | 12 years | 25 years | 5 years |
Virtuasys Tunneling Solutions
Every protocol below, deployed and supported on our network
What We Offer
- GRE Tunnels: internal datacenter connectivity over private networks
- VXLAN: data center network virtualization and Layer 2 DCI
- IPsec VPN: enterprise site-to-site connectivity with AES-256-GCM
- WireGuard: modern VPN for performance-critical applications
Our Approach
- Protocol selection guidance from our network engineering team
- 24/7 monitoring and support for tunnel health, latency and packet loss
- Hardware crypto acceleration for IPsec (Intel QAT, AES-NI)
- Integrated with our SD-WAN solutions for intelligent multi-path routing
- Part of comprehensive multi-site connectivity packages
The 4 Protocols
One line each; full specs in the comparison table above
GRE (Generic Routing Encapsulation)
RFC 2784, unencrypted IP-in-IP tunnel from 1994, 24 bytes of overhead, still the simplest way to carry multicast routing protocols over a private link.
VXLAN (Virtual Extensible LAN)
RFC 7348, Layer 2 over Layer 3 overlay with 16 million VNIs, 50 bytes of overhead, the standard for data center and Kubernetes networking.
IPsec (Internet Protocol Security)
IETF standard suite (RFC 4301), AES-256-GCM encryption with certificate or PSK authentication, 60-90 bytes of overhead, the default for compliance-driven enterprise VPNs.
WireGuard
In the Linux kernel since 5.6 (2020), ChaCha20 encryption, 60 bytes of overhead, 3-4x the throughput of software IPsec with a fraction of the configuration.
Performance Benchmarks
Real-world performance data from 10 Gbps link testing
Throughput Test (10 Gbps link, single stream)
- Baseline
- 9.8 Gbps
- GRE
- 9.5 Gbps (97%)
- VXLAN
- 8.9 Gbps (91%)
- IPsec
- 4.2 Gbps (43%)
- WireGuard
- 8.8 Gbps (90%)
Note: IPsec with hardware crypto acceleration (Intel QAT) reaches 9.2 Gbps (94% efficiency)
Latency Test (idle ping, 1ms baseline fiber link)
- Baseline
- 0.8ms
- GRE
- +0.1ms (0.9ms)
- VXLAN
- +0.3ms (1.1ms)
- IPsec
- +1.5ms (2.3ms)
- WireGuard
- +0.5ms (1.3ms)
Latency increase primarily from encryption overhead (IPsec) and additional header processing
CPU Usage (1 Gbps sustained throughput)
- GRE
- 5% CPU
- VXLAN
- 8% CPU
- IPsec
- 45% CPU
- WireGuard
- 12% CPU
Hardware crypto acceleration significantly improves IPsec (reduces to 10% CPU)
Which Protocol
One line per protocol
- GRE: private links that need multicast and minimal overhead.
- VXLAN: data center overlays and Kubernetes networking at scale.
- IPsec: compliance-driven enterprise VPNs and multi-vendor interop.
- WireGuard: new deployments where performance and simple config matter most.
Hybrid Approaches
Combining protocols for the gaps each one leaves alone
- GRE over IPsec
- IPsec encrypts, GRE carries the multicast routing protocols IPsec alone cannot. Common in enterprise MPLS networks that need OSPF or EIGRP across a public link.
- VXLAN with IPsec
- VXLAN extends Layer 2 between data centers, IPsec encrypts the link. Used for VM mobility between sites where compliance requires encryption in transit.
For hub-and-spoke or mesh topologies across more than two sites, see multi-site connectivity.
Frequently Asked Questions
Yes, it's common to run GRE inside IPsec (multicast + security), or have multiple tunnel types for different use cases (VXLAN for internal datacenter, IPsec for external site-to-site). Protocols can coexist on the same router/firewall.
Each protocol adds overhead: GRE 24B, VXLAN 50B, IPsec 60-90B, WireGuard 60B. Best practice: Enable Path MTU Discovery and set tunnel MTU = Physical MTU - Overhead. Typical: 1500B physical → 1476B GRE, 1450B VXLAN, 1410B IPsec. For VXLAN, use jumbo frames (9000B MTU) when possible.
Yes, WireGuard has been in the Linux kernel since 5.6 (2020) and has growing enterprise adoption. It's used in production by Cloudflare, Mullvad VPN, and Tailscale. However, IPsec still dominates for vendor interoperability and compliance reasons (many security frameworks specifically require IPsec).
GRE has no encryption. Options: (1) Only use over private networks (MPLS, dark fiber), (2) Wrap with IPsec (GRE over IPsec for multicast + security), (3) Use WireGuard instead (if multicast not needed). Never run raw GRE over public internet.
Modern SD-WAN solutions primarily use IPsec (vendor interoperability, compliance, maturity) or WireGuard (performance, simplicity, mobile support). Many vendors support both. Choose IPsec for multi-vendor environments, WireGuard for performance-critical or greenfield deployments.
For 10 Gbps link: GRE ≈ 97%, WireGuard ≈ 90%, VXLAN ≈ 91%, IPsec software ≈ 43%. IPsec with hardware crypto acceleration (Intel QAT, AES-NI) approaches GRE performance (94%). WireGuard is 3-4x faster than IPsec software encryption.
Ready to Deploy Secure Network Tunnels?
Our network engineering team will help you design and implement the optimal tunneling solution for your infrastructure.