2

Apparently NetworkManager recently gained support for macvlan interfaces. I notice it also supports macvtap, and the patch shows it already had some support for tun/tap devices.

I thought tap interfaces are normally created by VM software. Then the interface can be joined to a bridge. Or either of tun/tap can have an IP address assigned, again often done by VM software like virt-manager/libvirt. For macvtap, there isn't even anything that NetworkManager could configure!

Alternatively, tun/tap devices are used for userspace network tunnels such as OpenVPN. But I don't understand why you would configure a raw tun/tap device using NetworkManager. You still need to run something like OpenVPN to drive data through the tun/tap device.

I just can't make sense of it.

Question: Can anyone think of a reason to create tun/tap/macvtap devices using NetworkManager?

Glossary

macvlan is an alternative to bridging for networking Virtual Machines. Apparently it avoids some overhead. I haven't worked out the corresponding limitations.

tun/tap network interfaces provide a corresponding character device, which allows virtual machine implementations to read/write network packets from the interface. tap works at layer 2 (ethernet); tun only works at layer 3 (IP).

macvtap provides the same character device, but packets either come out a physical device the macvtap was bound to, or are bridged to a different macvtap/macvlan device on the same physical interface.

It is sometimes useful to create a macvlan interface for the host as well.

Improve this question
  • I don't care about NetworkManager, but I don't like your contention that tun/tap is "normally" only used for vm networking or, worse for the straight-jacketing libvirt kind of it. You can do anything you want with a tun/tap device, including implementing any tunneling protocol you want. But even then, using a vm as a virtual router has uses -- I've used such a setup in the past out of expediency, because configuring non-trivial ipv6 networking is such a PITA on a standard linux distro, and easy on OpenWRT. – mosvy Jan 27 '19 at 19:56
  • @mosvy I've added OpenVPN as a second example, hope you find this more likable. – sourcejedi Jan 27 '19 at 20:23
1

The idea is to allow otherwise unprivileged software such as a VM or tunnel manager to use a preconfigured tun/tap device so as to avoid the need of a setuid security hole or a special binary with specific capabilities which can be (mis-)used to raise privileges.

Improve this answer
  • So this included a configuration for NM to enable IP forwarding? Otherwise the VM would only get to talk to the host. Tunnelling sounds plausible though. – sourcejedi Nov 5 '17 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.