Two buildings have to talk to each other. There are two ways, and they look alike on the board but not in daily use. Routing means each location has a network of its own with a route between them. Stretching means one network that happens to sit in two buildings.
The tool offers both under Tunnel to on the network board. WireGuard, GRE and IPIP route. EoIP and VXLAN stretch: they go into the bridge of both routers and carry the VLANs you tick.
The difference in one table
| Subject | Routing (WireGuard, GRE, IPIP) | Stretching (EoIP, VXLAN) |
|---|---|---|
| Addresses | Own subnet per location | One subnet across both |
| Broadcast | Stops at the router | Travels along, both ways |
| A loop in building A | Stays in building A | Takes down both buildings |
| MTU | 1420 on WireGuard, fits | The path has to carry around 1550 |
| Tunnel goes down | Routes disappear, a clear failure | Half the subnet vanishes, hosts keep ARPing |
| DHCP | One server per location | One server for both, or a fight |
| Adding a location | A new range | Renumbering or another tunnel |
What routing costs you
- Two address ranges. Each location gets its own. In the tool you draw two locations with their own range, and the VLAN numbers stay the same everywhere.
- No discovery by broadcast. A printer, a Chromecast, a NAS announcing itself over mDNS or SSDP is invisible on the far side. Fixed addresses or a DNS name solve that; automatic discovery does not come back.
- Software that assumes one subnet. Older licence servers, some industrial controllers, a handful of backup agents. Those are the cases the request to stretch comes from.
- DNS is yours to arrange. Names from the other side do not work by themselves; add a forward for them.
In exchange you get a failure you can read. When the tunnel drops, the routes disappear, the other network becomes unreachable and everything inside your own building keeps working.
What stretching costs you
- All broadcast and multicast traffic crosses the line. ARP, NetBIOS, mDNS, DHCP requests, everything. With five hundred hosts that is a constant stream over a link that was not designed for it.
- One failure domain. A loop in building B now runs through building A as well. A spanning tree reconverging in A does the same in B. See Switches in a ring for what that does.
- A DHCP server someone plugs in at B now serves A too. Switch DHCP snooping on, in the Bridge & ports section, if you do this.
- The hosts do not know the far side is far away. Two machines in the same subnet behave as if they stand next to each other, even with 30 ms between them.
- When the tunnel drops there is no clear failure. The subnet still exists, half the devices are gone. Nothing can fail over, because there is no route to withdraw.
MTU, where this breaks
A layer 2 tunnel carries whole Ethernet frames, so a full header lands on top of your 1500 bytes. The tool warns about this for VXLAN: it carries 1500-byte frames with 50 bytes on top, so the path to the far side has to carry 1550 bytes. Over ordinary internet that is 1500, so large packets are fragmented or, with the don't-fragment flag set, dropped.
Two ways out:
- Make the path bigger. Only possible when you own it: your own fibre with jumbo frames on the ports. See MTU and jumbo frames.
- Make the inside smaller. Set the MTU of everything behind the tunnel to 1450 or lower. That works, but you have to keep it up everywhere.
The tool's MTU checks look at the cables you draw, not at the tunnels. A tunnel with the wrong MTU does not come back as a site check, with the exception of the VXLAN warning above. Test it yourself with a ping that may not be fragmented: /ping 10.1.10.20 size=1472 do-not-fragment=yes.
Encryption
For EoIP, GRE and IPIP the tool fills in an IPsec secret straight away; clear it and it tells you the tunnel is unencrypted. For VXLAN there is no encryption: it is plain UDP on port 4789 and the tool offers no secret for it. Over your own fibre that is fine. Over the internet, VXLAN belongs inside a WireGuard tunnel, not on its own.
When stretching really is the answer
- A device with a pinned address that has to move. A machine, a payment terminal, a control cabinet with the address burned into its firmware.
- A move in stages. You shift a server rack to the new building, keep the subnet stretched for a while, and renumber later. Temporary is a real word here: put a date on it.
- A cluster that needs layer 2 for its heartbeat or a shared address.
- An extension over your own fibre, where routing would mean renumbering a working network, and the fibre is as reliable as the copper indoors.
The middle road the tool offers
On a layer 2 tunnel there is a list, VLANs over the tunnel, set by default to "every VLAN both routers carry". Untick that and pick one. That is nearly always the right answer: stretch the single VLAN that needs it and route everything else over an ordinary WireGuard tunnel alongside. You are allowed both kinds of tunnel between the same two routers.
Your workstations, guests and management then stay neatly routed with their own address range per location, while only the one VLAN holding the stubborn machine spans both buildings. When that machine is replaced in two years, you remove that one tunnel and nothing else changes.
Further reading: Tunnels between locations, MTU and jumbo frames and A numbering plan that survives growth.