TUNTAP

TUN/TAP are virtual network kernel devices that provide user-space programs with access to the kernel’s network stack. TUN stands for network TUNnel device and TAP stands for Ethernet TAP. A TUN device operates at the IP layer (layer 3), delivering IP packets to and from user space, while a TAP device emulates an Ethernet device and passes raw Ethernet frames (layer 2). This separation allows software to perform tunneling, routing, or bridging without dedicated hardware.

In Linux and other Unix-like systems, the functionality is implemented by the tun/tap driver. The devices appear as interfaces such as /dev/net/tun and are configured by user-space programs using the TUNSETIFF ioctl to select the mode (tun or tap) and the interface name (for example tun0 or tap0). The interface is brought up with standard networking tools, and, for TUN, IP addresses are assigned; for TAP, bridging with a bridge device is common.

Common uses include virtual private networks (VPNs), where a TUN device carries IP traffic between endpoints (OpenVPN and WireGuard typically use a TUN device). TAP is used when a full Ethernet bridge is required, such as preserving MAC addresses or integrating virtual networks with physical LANs. TUN/TAP are also employed in virtualization and container networking to provide flexible, software-defined networking without specialized hardware.

Security and performance considerations include the need for privileged access to create devices, potential risks from misconfiguration, and the overhead of kernel–user-space context switches depending on the implementation. TUN/TAP remain a core building block for user-space networking in many Linux and BSD environments.