I'm trying to figure out what that + sign means in a rule such as this:

-A FORWARD -i tun0+ -j ACCEPT

I'm pretty positive it relates to vpn. I noticed a /dev/net/tun interface and a tun0 in ifconfig, but for the sake of thoroughness, I want to know about that + sign. Anyone know anything?

  • Ok, so it seems that the + is a wildcard that is mentioned under the spec of the -i flag. hmmm now to figure out why. – Realn0whereman Apr 12 '11 at 21:33
  • Is that really tun0+, and not tun+? As far as I know tun0+ would only match tun0 anyway, whereas tun+ would match tun0, tun1, tun2, … – Gilles Apr 12 '11 at 22:03
  • Yes it is, that's why I'm stumped. In the server config for openvpn, it is "dev tun0", so would openvpn create tun01 tun02 etc... for concurrent vpn connections? – Realn0whereman Apr 12 '11 at 22:37
  • dev tun0 will force creation of tun0 device. If you want to dynamically create tun devices and don't care which server uses which device, then use dev tun so tun0, tun1, tun2, ... be created subsequently and tun+ in iptables rules will match all of them. – forcefsck Apr 13 '11 at 13:12
  • @Realn0whereman: Where did you find this rule anyway? – Gilles Apr 13 '11 at 19:57

From here: To match all interfaces of a type, use the plus sign such as eth+.

And yes, the "+" sign means here just as "*" in pattern matching or ".*" in regexps.

This rule is false, the + is unneeded, although it don't even harms (because a tunnel named tun01 or tun05 are very unlikely). The developer of this script wanted to write probably only tun+.


Actually it does work for all ip blocks in that interface. It means, if you have tun0, tun0:0, and tun0:1 and you need to manage all, you will probably want to write tun0+ there.


Using "tun+" instead of just "tun0" makes perfect sense if you are running several instances of, for example, OpenVPN on the same server. The multiple instances will create multiple devices called tun0, tun1, tun2, etc. and all of their traffic has to pass through the firewall (and has to be properly forwarded).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.