Apparently NetworkManager recently gained support for macvlan interfaces. I notice it also supports macvtap, and the patch shows it already had some support for tun/tap devices.

I thought tap interfaces are normally created by VM software. Then the interface can be joined to a bridge. Or either of tun/tap can have an IP address assigned, again often done by VM software like virt-manager/libvirt. For macvtap, there isn't even anything that NetworkManager could configure!

Alternatively, tun/tap devices are used for userspace network tunnels such as OpenVPN. But I don't understand why you would configure a raw tun/tap device using NetworkManager. You still need to run something like OpenVPN to drive data through the tun/tap device.

I just can't make sense of it.

Question: Can anyone think of a reason to create tun/tap/macvtap devices using NetworkManager?


macvlan is an alternative to bridging for networking Virtual Machines. Apparently it avoids some overhead. I haven't worked out the corresponding limitations.

tun/tap network interfaces provide a corresponding character device, which allows virtual machine implementations to read/write network packets from the interface. tap works at layer 2 (ethernet); tun only works at layer 3 (IP).

macvtap provides the same character device, but packets either come out a physical device the macvtap was bound to, or are bridged to a different macvtap/macvlan device on the same physical interface.

It is sometimes useful to create a macvlan interface for the host as well.

  • I don't care about NetworkManager, but I don't like your contention that tun/tap is "normally" only used for vm networking or, worse for the straight-jacketing libvirt kind of it. You can do anything you want with a tun/tap device, including implementing any tunneling protocol you want. But even then, using a vm as a virtual router has uses -- I've used such a setup in the past out of expediency, because configuring non-trivial ipv6 networking is such a PITA on a standard linux distro, and easy on OpenWRT.
    – user313992
    Jan 27, 2019 at 19:56
  • @mosvy I've added OpenVPN as a second example, hope you find this more likable.
    – sourcejedi
    Jan 27, 2019 at 20:23

1 Answer 1


The idea is to allow otherwise unprivileged software such as a VM or tunnel manager to use a preconfigured tun/tap device so as to avoid the need of a setuid security hole or a special binary with specific capabilities which can be (mis-)used to raise privileges.

  • So this included a configuration for NM to enable IP forwarding? Otherwise the VM would only get to talk to the host. Tunnelling sounds plausible though.
    – sourcejedi
    Nov 5, 2017 at 16:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .