IPinIP

IPinIP, short for IP-in-IP, is a simple tunneling mechanism that encapsulates an IP packet inside another IP packet to transport it between two endpoints across a network that may not provide a direct path. It is defined for IPv4 in RFC 2003 and uses the IP protocol number 4 to signal that the payload is a further IP datagram. The technique is commonly used to create virtual point-to-point links and to connect separate networks through intermediate routes, such as in some VPN and overlay networking scenarios.

How it works: a tunnel endpoint constructs an outer IP header with new source and destination addresses corresponding to the tunnel endpoints, and places the original IP packet as the payload. The inner header is the original IP datagram. The outer header is subject to standard IP processing, including TTL decrementing, while the inner header is preserved for the final destination. The payload length increases due to encapsulation, so MTU considerations and potential fragmentation can arise if Path MTU Discovery is not properly managed. Security is not provided by IPinIP itself; encryption and integrity protection are typically added via IPsec or other security layers.

Usage and limitations: IP-in-IP is a lightweight option for building rudimentary tunnels between networks, often used in early VPN deployments and some router configurations. It is easy to implement in many operating systems, but lacks inherent authentication, integrity protection, and multicast support. It is generally superseded in new deployments by more feature-rich tunneling or secure encapsulation methods such as GRE, L2TP, OpenVPN, or IPsec-enabled tunnels.