Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I noticed when running ifconfig that there is a network interface called tun0 and it has an ipv4 address. A bit of research shows that it is a tunneling device, but I don't really know how it's used, what's using it, and why it has an IP address.
I do have iptables enabled, and there seems to be some link between iptables and tun, if that helps.
It's for tunneling software. See the wikipedia article titled: TUN/TAP for full details.
excerpt from FreeBSD tun man page
The tun interface is a software loopback mechanism that can be loosely described as the network interface analog of the pty(4), that is, tun does for network interfaces what the pty(4) driver does for terminals.
This socat documentation page does a good job of showing how they could be used.
excerpt from socat doc
Some operating systems allow the generation of virtual network interfaces that do not connect to a wire but to a process that simulates the network. Often these devices are called TUN or TAP.
As @slm has already written, a TUN interface is a software loopback that emulates a network interface the same as a TAP interface. In practical terms, a TUN interface is the emulation of a layer 3 interface. That is, it is a network layer emulation device that can tunnel data packets of varied nature, be it raw TCP, UDP, SCTP or encapsulated packets such as PPP, PPTP, AH/IPSEC, whatever. On the other hand, a TAP interface is the emulation of a layer 2 interface, that is it is a data link emulation device that can work as a raw ethernet, arcnet, token ring, etc.
This has different practical implications. For example when designing a firewall, if you want to create a NATed internal network with non-routable addresses, you would use TUN interfaces to create your filtering bridge. If you have a set of public IP addresses that you can assign to internal hosts but still want to firewall all traffic you would use TAP interfaces to emulate an ethernet bridge on which to filter the data packets. This, btw, is basis of what is called a "transparent firewall".
To understand, your need to logically imagine the difference between tun/tap: in tap mode, you need a br0 bridge, working --for addresses of bare iron, and with tun it is on the contrary, it is traffic from VPN server 'Work VPN', as you can see here in the picture:
And in order to have a tun, you need to create it first, you can use systemd-networkd:
VPN over SSH (Wikipedia):
tun will create a routed IP tunnel,tap will create an ethernet tunnel.Use tap0 if you are ethernet bridging and have precreated a tap0 virtual interface and bridged it with your ethernet interface.
If you want to control access policies over the VPN, you must create firewall rules for the the tun/tap interface.
On non-Windows systems, you can give an explicit unit number, such as tun0. On most systems, the VPN will not function unless you partially or fully disable the firewall for the tun/tap interface.
