How to Set Up Your GRE Tunnel With the Installer

To protect a server with Sterile, you connect it to our network with a GRE tunnel, and the installer script sets that tunnel up for you in a few commands.

New to GRE? GRE tunnel DDoS protection: how it works explains why your traffic goes through a tunnel. This guide is the hands-on part.

Before you start

• A Linux server you can log in to as root, or with sudo.
• systemd or OpenRC, so the tunnel starts again after a reboot. On other systems the installer starts the tunnel once, and you need to add a boot service yourself.
• GRE support in the kernel (the ip_gre module). Most KVM VPS and dedicated servers have it. Container-based VPS (OpenVZ, LXC) often do not.
• A service in your dashboard that has been set up: open Services, choose Setup tunnel, enter a name and your server's public IPv4 address (the origin IP), and turn on IPv6 if you want it protected too.

When you save, the dashboard shows your protected address. That is the IP your players or users connect to from now on.

1. Download the installer

Open your service, go to the Installer tab and click Download installer.sh. Right after setup, the setup page offers the same file as Download setup script. The script is made for that one service: it already contains your tunnel endpoints and your protected addresses, so there is nothing to fill in.

2. Upload it and make it executable

Copy installer.sh to your server (for example with scp), then run:

chmod +x ./installer.sh
./installer.sh --help

3. Pause your firewall for the install

A local firewall can block the tunnel's GRE traffic, and then the tunnel never comes up. Pause it while you install, with the command for your firewall. The second command turns it back on. The Installer tab shows the same commands for the firewall you pick.

• UFW: sudo ufw disable, then sudo ufw enable
• firewalld: sudo systemctl stop firewalld, then sudo systemctl start firewalld
• nftables: sudo systemctl stop nftables, then sudo systemctl start nftables
• iptables: sudo iptables -F && sudo iptables -P INPUT ACCEPT && sudo iptables -P FORWARD ACCEPT && sudo iptables -P OUTPUT ACCEPT, then sudo netfilter-persistent reload
• CSF: sudo csf -x, then sudo csf -e
• Shorewall: sudo systemctl stop shorewall, then sudo systemctl start shorewall

These commands switch your firewall off completely, so turn it back on as soon as the tunnel is up (step 5).

4. Install the tunnel

sudo ./installer.sh --install

The installer loads the GRE kernel modules, creates the tunnel, adds your protected addresses to it, and routes the replies from those addresses back through the tunnel. It also installs a service called sterile_tunnel_<id> so the tunnel comes back after a reboot. Everything it does is logged to /var/log/sterile_tunnel_<id>.log.

5. Check that it is up

sudo ./installer.sh --status

This shows the service name, the log file and the state of the tunnel. Once it is up, turn your firewall back on, and add a rule that allows GRE (IP protocol 47) from Sterile's tunnel endpoint so the tunnel keeps working with the firewall on.

Make your service listen on the protected address

Your game server or application has to accept connections on the protected IP. If it listens on all addresses (0.0.0.0), there is nothing to change. If it is bound to your server's original IP, change it to the protected IP, then point your DNS records or server listing at the protected IP.

Removing the tunnel

sudo ./installer.sh --uninstall

This removes the service, the tunnel and the routing the installer added.

Something not working?

• "Existing tunnel ... has different endpoints. Refusing to install": a tunnel from an earlier script is still there. Run --uninstall with the script you installed it with, then install again.
• Check the log file shown by --status; it records every step the installer took.
• Still stuck? Open a ticket and include the output of --status, or reach us by chat, email or phone on the support page.