What Tunnel 2 Actually Is
Tunnel 2 is a dual-channel VPN tunneling protocol that routes traffic through two separate paths simultaneously for redundancy and bandwidth aggregation. It was originally designed for environments where connection stability matters more than raw speed. The idea is simple: if one link drops, the other keeps going. In practice, it's nowhere near that clean. You'll need two distinct network interfaces or VPN endpoints that your system can reach independently. Most people try to run this over a single WAN connection with dual ISP failover, which partially works but defeats half the purpose. Here's how I set mine up after burning three days troubleshooting the wrong configuration. First, you install the Tunnel 2 client on the device. The package is typically pulled from the official repository at tunnel2.io/download, though I've seen mirror sites offering outdated builds that crash on newer Linux kernels. Stick to the main site. During installation, you'll define two tunnel profiles — one per upstream. The config file uses a simple YAML structure. You assign each profile a priority weight and a latency threshold. The system monitors both tunnels in real time and shifts traffic based on current conditions.
The tricky part is the bonding agent. Tunnel 2 doesn't actually bond in the traditional LACP sense. It does flow-level failover with packet resequencing on the receiving end. That means your applications need to handle out-of-order packets, which most modern stacks do, but some embedded systems and older game servers don't. I ran into this specifically with a VoIP pipeline I was using for a client. Calls were dropping every 40 seconds because the resequencing buffer wasn't large enough for the codec's jitter tolerance. The fix was setting the reorder_buffer_size parameter to 512 in the config, which I found buried in the documentation footnotes rather than the main README.
Performance Reality Check
Tunnel 2 typically gives you about 60 to 70 percent of the theoretical combined throughput of both links. The overhead comes from the resequencing layer and the constant health-check pings between nodes. If you're aggregating a 100 Mbps primary and a 50 Mbps backup, expect roughly 90 to 105 Mbps under normal conditions, not 150. The aggregation math doesn't work the way most people assume. The real win isn't speed. It's failover time. With both tunnels active, a link failure triggers re in under 200 milliseconds on a properly configured setup. For streaming, this is invisible. For database replication or live trading systems, it's the difference between a blip and a catastrophic disconnect.
Get the Full Details
Where It Breaks Down
Tunnel 2 struggles with asymmetric route scenarios. If your two upstreams have wildly different latencies — say one is a fiber link at 15ms and the other is a cellular backup at 120ms — the bonding agent will either bottleneck everything on the slow link or constantly shuffle flows back and forth, causing instability. I've seen people run this over satellite backups and complain it performs worse than a single connection. That's not a protocol issue. That's a use-case mismatch. It also doesn't play well with protocols that require strict packet ordering at the application level. Some proprietary protocols embed sequence numbers that break when packets arrive out of order, regardless of resequencing. I encountered this with a custom SCADA system that would silently corrupt data if packet timestamps diverged by more than 50ms across the two tunnels. The workaround was disabling flow aggregation for that specific application's traffic and letting it run on a single tunnel while other traffic used both. Another limitation worth noting: Tunnel 2 requires both endpoints to support the protocol. You can't bridge a Tunnel 2 client to a standard VPN server. If your remote site only has a basic OpenVPN or WireGuard setup, you're limited to failover mode, not aggregation. The documentation mentions this in passing, but it's easy to miss if you're skimming.
Configuration Tips That Actually Matter
Don't set both tunnels to equal priority unless your links are genuinely similar. I usually weight the primary at 70 and the backup at 30, even when both are active. This reduces unnecessary flow switching and keeps the bonding agent from oscillating between links during minor latency fluctuations. Enable TCP pacing on the bonding interface. Without it, sudden traffic shifts between tunnels cause bursty TCP windows that can trigger congestion on the newly favored path. The default settings leave this off, and the performance difference is noticeable within the first hour of heavy use. Monitor the tunnel_state metric, not just throughput. I've lost count of how many times I've been told a tunnel is "working fine" when the health-check pings were succeeding at 1-second intervals while actual data was piling up at the bonding layer due to a misconfigured MTU. Set the health-check interval to 200ms minimum and watch for latency spikes between checks, not just check failures.
When to Use Something Else
If you need pure throughput aggregation across links of very different speeds, consider multipath TCP instead. It's built into the kernel on most modern systems and handles asymmetric links better. Tunnel 2 is better suited for reliability-focused deployments where consistent uptime matters more than peak bandwidth. If you're just trying to combine two home internet connections for gaming, you're probably better off with a simple load balancer or just accepting the backup link as standby. The download is at tunnel2.io/download. Make sure you verify the GPG signature before installing anything. There have been a couple of compromised mirror incidents this year, and the community hasn't been great about alerting people quickly enough.
