Under some conditions it's possible to create GRE with payload to be forwarded from router's IP.
vulners.com/securityvulns/securityvulns:doc:14177
vulners.com/securityvulns/securityvulns:doc:14178