gre...

generic route encapsulation...

2 routers directly connected, 2 hosts connected to each, 3 subnets and no routing protocols, well, ip...

i1#sh ip proto
*** IP Routing is NSF aware ***

i1 connects to i2 with 1.1.1.1/24 and 1.1.1.2/24

i2#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/12 ms

we can tunnel between the two successfully by setting up tunnel interfaces on both sides...

i1#sh run int tun 0
Building configuration...

Current configuration : 113 bytes
!
interface Tunnel0
 ip address 172.16.1.1 255.255.255.0
 tunnel source 1.1.1.1
 tunnel destination 1.1.1.2

i2#sh run int tun 0
Building configuration...

Current configuration : 113 bytes
!
interface Tunnel0
 ip address 172.16.1.2 255.255.255.0
 tunnel source 1.1.1.2
 tunnel destination 1.1.1.1

we note that the tunnels are on a completely different subnet and are not being routed...

i2#ping 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/12 ms

sheer trickery...

i believe that it is being tunneled because wireshark tells me so...

i1#sh ip route | excl L | incl Loop

      omitted

Gateway of last resort is not set

      1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        1.1.1.0/24 is directly connected, FastEthernet0/1

      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks

C        172.16.1.0/24 is directly connected, Tunnel0

      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks

C        192.168.1.0/24 is directly connected, FastEthernet0/0

lets use the tunnel to get from one host all the way to the other...

i1(config)#ip route 192.168.2.0 255.255.255.0 172.16.1.2
i1(config)#end

i2(config)#ip route 192.168.1.0 255.255.255.0 172.16.1.1
i2(config)#end
i2#
*Aug 17 19:16:15: %SYS-5-CONFIG_I: Configured from console by console
i2#ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/12/28 ms
i2#ping 192.168.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/9/12 ms

a static route for the hosts uses the tunnel to transit...

host1>ping 192.168.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
host1>

i1#sh ip route | excl L | incl Loop
omitted     

Gateway of last resort is not set

      1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        1.1.1.0/24 is directly connected, FastEthernet0/1
      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.16.1.0/24 is directly connected, Tunnel0
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, FastEthernet0/0
S     192.168.2.0/24 [1/0] via 172.16.1.2

we love wireshark...