# Protect infrastructure outside Avenlith (GRE)

> Route traffic for your own data center through Shield and receive clean traffic over a GRE tunnel.

Source: https://docs.avenlith.com/en/remote-protection-gre  
Category: DDoS protection  
Last updated: 2026-09-22

## How it works

1. We announce your /24 prefix from all Avenlith scrubbing centres.
2. Attack traffic is filtered at our edge — 18 Tbps of capacity.
3. Clean traffic is delivered to your router through a GRE tunnel.
4. Return traffic leaves directly from your network (asymmetric routing).

## Configure the tunnel

```bash
# On your router (Linux example)
ip tunnel add avn0 mode gre local 192.0.2.10 remote 185.7.240.1 ttl 255
ip addr add 169.254.30.2/30 dev avn0
ip link set avn0 up mtu 1476
ip route add default via 169.254.30.1 table 100
ip rule add from 198.51.100.0/24 table 100
```

> **Warning:** > GRE adds 24 bytes of overhead. Lower the MTU to 1476 or enable MSS clamping, otherwise large TCP packets are dropped.

## Always-on or on-demand

| Mode | Latency | Reaction time |
| --- | --- | --- |
| Always-on | +1–3 ms | Instant |
| On-demand (BGP swing) | none until attack | 30–90 seconds |

On-demand mode can be triggered automatically by flow data (sFlow/NetFlow) you export to us.