In recent versions of OpenSSH it is even allowed to create layer 2 or layer 3 tunnels if both ends have enabled such tunneling capabilities. This creates codice_1 (layer 3, default) or codice_2 (layer 2) virtual interfaces on both ends of the connection. This allows normal network management and routing to be used, and when used on routers, the traffic for an entire subnetwork can be tunneled. A pair of codice_2 virtual interfaces function like an Ethernet cable connecting both ends of the connection and can join kernel bridges.