47), often serves to carry IP packets, with RFC 1918 private addresses, over the Internet using delivery packets with public IP addresses. In this case, the delivery and payload protocols are the same, but the payload addresses are incompatible with those of the delivery network. It is also possible to establish a connection using the data link layer. The Layer 2 Tunneling Protocol (L2TP) allows the transmission of frames between two nodes. A tunnel is not encrypted by default: the TCP/IP protocol chosen determines the level of security. SSH uses port 22 to enable data encryption of payloads being transmitted over a public network (such as the Internet) connection, thereby providing VPN functionality. IPsec has an end-to-end Transport Mode, but can also operate in a tunneling mode through a trusted security gateway. To understand a particular protocol stack imposed by tunneling, network engineers must understand both the payload and delivery protocol sets. Common tunneling protocols IP in IP (Protocol 4): IP in IPv4/IPv6 SIT/IPv6 (Protocol 41): IPv6 in IPv4/IPv6 GRE (Protocol 47): Generic Routing Encapsulation OpenVPN (UDP port 1194) SSTP (TCP port 443): Secure Socket Tunneling Protocol IPSec (Protocol 50 and 51): Internet Protocol Security L2TP (Protocol 115): Layer 2 Tunneling Protocol VXLAN (UDP port 4789): Virtual Extensible Local Area Network. GENEVE WireGuard Secure Shell tunneling A Secure Shell (SSH) tunnel consists of an encrypted tunnel created through an SSH protocol connection. Users may set up SSH tunnels to transfer unencrypted traffic over a network through an encrypted channel. It is a software-based approach to network security and the result is transparent encryption. For example, Microsoft Windows machines can share files using the Server Message Block (SMB) protocol, a non-encrypted protocol. If one were to mount a Microsoft Windows file-system remotely through the Internet, someone snooping on the connection could see transferred files. To mount the Windows file-system securely, one can establish a SSH tunnel that routes all SMB traffic to the remote fileserver through an encrypted channel. Even though the SMB protocol itself contains no encryption, the encrypted SSH channel through which it travels offers security. Once an SSH connection has been established, the tunnel starts with SSH listening to a port on the remote or local host. Any connections to it are forwarded to the specified address and port originating from the opposing (remote or local, as previously) host. Tunneling a TCP-encapsulating payload (such as PPP) over a