On the morning mail route sat a dozen little villages, strung together by a few dirt roads the county had built. Those roads were public—anyone could use them—but they understood only gate-to-gate addresses: “North gate, Village Three” to “South gate, Village Seven,” and nothing finer than that.

Here was the snag: inside each village, every household went by an old local nickname of its own making. Village Three had a house called “Second-by-the-Well.” So did Village Seven. The locals used these nicknames every day and never thought to change them. But drop a letter addressed to “Second-by-the-Well” straight onto the public road, and the road hadn’t the faintest idea which village to carry it to—nicknames mean nothing outside the village walls.

So at each village gate sat a gatekeeper in an apron. When a villager wanted to write to another village, they handed over the inner letter, nickname and all. The gatekeeper never opened it, never changed a word. He did three things: he slipped the whole inner letter into a big outer envelope; on that envelope he wrote the village-to-village address the road understood; and finally he pressed a blob of colored wax—red wax for the rice guild’s mail, blue for the cloth guild’s, green for the fishers’ guild.

The couriers on the road read only the village name on the outer envelope, and hauled their bundles of wax-sealed envelopes to the destination village. The road never once saw the inner nickname, and didn’t care—its only job was carrying things between villages.

At the far gate, that village’s gatekeeper took the outer envelope, tore off the outer layer, and first checked the color of the wax: red went to the rice guild’s sorting room, blue to the cloth guild’s. This way the “Second-by-the-Well” that existed in both villages never got confused—the red-wax “Second-by-the-Well” and the blue-wax one traveled the very same road, yet stood as though a wall ran between them. Only once the color checked out did the gatekeeper hand the inner letter, untouched, to the right household in his own village.

—By now you’ve probably recognized him: this aproned gatekeeper, who only ever wraps one more layer around a letter, is the VXLAN tunnel endpoint (VTEP) of an overlay network.

What it is

VXLAN (Virtual eXtensible LAN) is an overlay network encapsulation technique. The physical network (the underlay, that dirt road) only moves packets between hosts, and it only knows host IPs. Meanwhile the “residents”—Pods, VMs—use their own virtual addresses, which aren’t routable on the physical network and may even collide with each other.

A VTEP (VXLAN Tunnel Endpoint, the gatekeeper) sits on every host. It stuffs the original layer-2 frame whole into a new UDP packet (MAC-in-UDP), writes host-to-host addresses on the outside, and stamps it with a 24-bit VNI (VXLAN Network Identifier, the wax color). With sixteen million possible VNI values, tens of thousands of isolated virtual networks can share one physical fabric without ever seeing one another. The receiving VTEP strips the outer layer and delivers by VNI to the correct virtual segment.

Why it matters: this is the underlying magic that lets Pods in OpenShift/Kubernetes talk to each other on one flat network across nodes. The underlay never needs to know what the Pod subnets look like; communication crosses nodes, racks, even availability zones just fine, and tenants are isolated by VNI for free. The cost is that every packet carries an extra encapsulation header (~50 bytes of overhead), so you must mind your MTU—when the outer packet won’t fit, you get fragmentation or drops, the single most common trap in overlay networking. OpenShift’s default OVN-Kubernetes uses the close cousin Geneve, which works the same way with a more flexible outer header.

The metaphor, mapped

• The public dirt road (knows only village-to-village addresses) → the underlay physical network, routing only host IPs
• The colliding nickname “Second-by-the-Well” in each village → a Pod’s virtual IP: not routable on the underlay, possibly duplicated
• The aproned gatekeeper → the VTEP (VXLAN tunnel endpoint, running on every host)
• The inner letter (nickname on it, never opened) → the original layer-2 frame / packet the Pod sent
• The big outer envelope (village-to-village address) → the VXLAN outer encapsulation (MAC-in-UDP, host-to-host)
• The colored wax (red/blue/green per guild) → the 24-bit VNI, tagging and isolating virtual segments
• Couriers reading only the outer envelope → the physical network forwarding by outer address, blind to the inner frame
• The far gatekeeper tearing the outer layer and sorting by wax color → the receiving VTEP decapsulating and delivering by VNI
• The bulk of the outer envelope itself → encapsulation overhead / the MTU problem