31

I noticed when running ifconfig that there is a network interface called tun0 and it has an ipv4 address. A bit of research shows that it is a tunneling device, but I don't really know how it's used, what's using it, and why it has an IP address.

I do have iptables enabled, and there seems to be some link between iptables and tun, if that helps.

4 Answers 4

29

It's for tunneling software. See the wikipedia article titled: TUN/TAP for full details.

excerpt from FreeBSD tun man page

The tun interface is a software loopback mechanism that can be loosely described as the network interface analog of the pty(4), that is, tun does for network interfaces what the pty(4) driver does for terminals.

This socat documentation page does a good job of showing how they could be used.

excerpt from socat doc

Some operating systems allow the generation of virtual network interfaces that do not connect to a wire but to a process that simulates the network. Often these devices are called TUN or TAP.

References

1
  • Okay, thanks. The application list on the wikipedia page is basically what I wanted.
    – smcg
    Commented Jul 11, 2013 at 18:22
16

As @slm has already written, a TUN interface is a software loopback that emulates a network interface the same as a TAP interface. In practical terms, a TUN interface is the emulation of a layer 3 interface. That is, it is a network layer emulation device that can tunnel data packets of varied nature, be it raw TCP, UDP, SCTP or encapsulated packets such as PPP, PPTP, AH/IPSEC, whatever. On the other hand, a TAP interface is the emulation of a layer 2 interface, that is it is a data link emulation device that can work as a raw ethernet, arcnet, token ring, etc.

This has different practical implications. For example when designing a firewall, if you want to create a NATed internal network with non-routable addresses, you would use TUN interfaces to create your filtering bridge. If you have a set of public IP addresses that you can assign to internal hosts but still want to firewall all traffic you would use TAP interfaces to emulate an ethernet bridge on which to filter the data packets. This, btw, is basis of what is called a "transparent firewall".

0

To understand, your need to logically imagine the difference between tun/tap: in tap mode, you need a br0 bridge, working --for addresses of bare iron, and with tun it is on the contrary, it is traffic from VPN server 'Work VPN', as you can see here in the picture:

https://rockhopper.osdn.jp/index_files/tuntap_rockhopper2.jpg

And in order to have a tun, you need to create it first, you can use systemd-networkd:

VPN over SSH (Wikipedia):

  • tun will create a routed IP tunnel,
  • tap will create an ethernet tunnel.

Use tap0 if you are ethernet bridging and have precreated a tap0 virtual interface and bridged it with your ethernet interface.

If you want to control access policies over the VPN, you must create firewall rules for the the tun/tap interface.

On non-Windows systems, you can give an explicit unit number, such as tun0. On most systems, the VPN will not function unless you partially or fully disable the firewall for the tun/tap interface.

0

I know you asked about tun but since they're related, (the interface is called tun/tap) I though I'd share this Cloudflare blog post about tap and how they use it in their virtual machines.

They say:

Historically tap devices were mostly used to implement VPN clients.

And then goes on to say:

More recently tap devices started to be used by virtual machines to enable networking.

The article also included this little AI-generated diddy to aid in remembering, which I though was funny:

Tap is like a switch,

Ethernet headers it'll hitch.

Tun is like a tunnel,

VPN connections it'll funnel.

Ethernet headers it won't hold,

Tap uses, tun does not, we're told.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .