In this example, we need to set up a tunnel between router A & router B & hide our internal network from the service provider. The routers will statically route all traffic destined to private networks via the GRE next hop address. This will allow the private networks to be encapsulated with a GRE header that will essentially hide our internal source / destination addresses. The first thing we will need to do on both routers is create the tunnel interfaces, the tunnel source, and destination addresses.

The tunnel source & destination addresses must be reachable through the service provider’s network in order for the tunnel to be established. However, the tunnel interface IPs do not need to be (probably better they are not) reachable directly from the service provider's internal routers.

Next, we will need to add the appropriate static routes to allow for the GRE tunnel to be established. Also, we will add an additional route to get to the remote router’s LAN segments: