I noticed when running ifconfig that there is a network interface called tun0 and it has an ipv4 address. A bit of research shows that it is a tunneling device, but I don't really know how it's used, what's using it, and why it has an IP address.

I do have iptables enabled, and there seems to be some link between iptables and tun, if that helps.


It's for tunneling software. See the wikipedia article titled: TUN/TAP for full details.

excerpt from FreeBSD tun man page

The tun interface is a software loopback mechanism that can be loosely described as the network interface analog of the pty(4), that is, tun does for network interfaces what the pty(4) driver does for terminals.

This socat documentation page does a good job of showing how they could be used.

excerpt from socat doc

Some operating systems allow the generation of virtual network interfaces that do not connect to a wire but to a process that simulates the network. Often these devices are called TUN or TAP.


| improve this answer | |
  • Okay, thanks. The application list on the wikipedia page is basically what I wanted. – smcg Jul 11 '13 at 18:22

As @slm has already written, a TUN interface is a software loopback that emulates a network interface the same as a TAP interface. In practical terms, a TUN interface is the emulation of a layer 3 interface. That is, it is a network layer emulation device that can tunnel data packets of varied nature, be it raw TCP, UDP, SCTP or encapsulated packets such as PPP, PPTP, AH/IPSEC, whatever. On the other hand, a TAP interface is the emulation of a layer 2 interface, that is it is a data link emulation device that can work as a raw ethernet, arcnet, token ring, etc.

This has different practical implications. For example when designing a firewall, if you want to create a NATed internal network with non-routable addresses, you would use TUN interfaces to create your filtering bridge. If you have a set of public IP addresses that you can assign to internal hosts but still want to firewall all traffic you would use TAP interfaces to emulate an ethernet bridge on which to filter the data packets. This, btw, is basis of what is called a "transparent firewall".

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.