How to Create and Manage TUN and TAP Virtual Network Devices in Linux Using ip tuntap

Virtual network interfaces are fundamental building blocks in Linux for hypervisors, container networking, VPN daemons, and software-defined test harnesses. The Linux kernel Universal TUN/TAP driver provides userspace software with access to virtual network adapters that receive and transmit raw packets directly from and to user-space memory buffers. While legacy systems historically relied on the obsolete tunctl utility, modern Linux distributions manage virtual devices directly through ip tuntap from the standard iproute2 suite.

In this guide, you will learn how to create persistent TUN (Layer 3) and TAP (Layer 2) network interfaces, configure user and group ownership permissions, assign IP addresses, and manage virtual interfaces using ip tuntap.

Understanding TUN vs. TAP Devices

Although both types of virtual interfaces communicate with user applications through the /dev/net/tun character device, they operate at different OSI network layers:

• TUN (Network TUNnel – Layer 3): Operates strictly at the IP packet level. It processes raw IPv4 and IPv6 datagrams without Ethernet frame headers. TUN interfaces do not have MAC addresses, cannot participate in layer-2 network bridging, and are the standard choice for point-to-point IP VPNs (such as OpenVPN in routed mode or WireGuard).
• TAP (Network TAP – Layer 2): Operates as a virtual Ethernet adapter at the link layer. It captures and injects full Ethernet frames, complete with 48-bit MAC addresses and VLAN tags. TAP devices can be bound into Linux software bridges (e.g., br0 or Open vSwitch), making them ideal for virtual machine hypervisors (QEMU/KVM) and bridge-mode VPNs.

Verifying Kernel Driver Support

Modern Linux kernels compile the TUN/TAP driver as a module or built-in subsystem. Before creating devices, verify that the character device node is present:

ls -la /dev/net/tun

If the device is missing, load the kernel driver manually:

sudo modprobe tun

Confirm the module status using lsmod:

lsmod | grep tun

Creating a Persistent TUN Interface (Layer 3)

When an application opens /dev/net/tun, the interface disappears as soon as the process terminates unless it is configured as persistent. Creating a persistent interface ensures the network stack retains routing rules, firewall policies, and IP addresses even when your daemon restarts.

To create a persistent TUN device named tun0:

sudo ip tuntap add mode tun dev tun0

Grant an unprivileged user (such as vpnuser or your active account) ownership of the interface so applications do not require root privileges to read and write packets:

sudo ip tuntap add mode tun user $USER dev tun1

Verify that the interface is recognized by the Linux kernel:

ip link show dev tun0

Assign an IP address and bring the interface link state UP:

sudo ip addr add 10.8.0.1/24 dev tun0
sudo ip link set dev tun0 up

Confirm interface attributes using ip addr:

ip -details addr show dev tun0

Notice the flags POINTOPOINT,MULTICAST,NOARP,UP. Because TUN interfaces operate at Layer 3, ARP resolution is suppressed.

Creating a Persistent TAP Interface (Layer 2)

To provide virtual machines or container network namespaces with full Ethernet connectivity, create a Layer 2 TAP interface using mode tap:

sudo ip tuntap add mode tap user $USER group kvm dev tap0

Inspect the new TAP interface:

ip -details link show dev tap0

Observe that unlike tun0, tap0 possesses a hardware link address (Ethernet MAC address, such as link/ether 52:54:00:12:34:56) and supports ARP.

To connect the TAP interface to a virtual machine bridge:

# Create a bridge if one does not already exist
sudo ip link add name br0 type bridge
sudo ip link set dev br0 up

# Enslave the TAP device to the bridge
sudo ip link set dev tap0 master br0
sudo ip link set dev tap0 up

Now, QEMU or KVM can attach directly to tap0 without root privileges by running under the specified user and group.

Listing All Configured TUN/TAP Interfaces

To audit all active persistent TUN and TAP devices across the operating system:

ip tuntap list

The command outputs each device along with its configured mode and ownership permissions:

tun0: tun
tun1: tun user ubuntu
tap0: tap user ubuntu group kvm

Configuring Advanced Multi-Queue (MQ) Support

On high-throughput server systems handling hundreds of thousands of packets per second, a single network queue bound to one CPU core can become an I/O bottleneck. Modern Linux kernels allow multi-queue TUN/TAP devices that permit multiple parallel threads or processes to read and write to the same virtual interface concurrently.

To enable multi-queue support on a TAP interface, pass the multi_queue flag:

sudo ip tuntap add mode tap multi_queue dev tap-mq0

Verify that multi-queue is active:

ip tuntap list | grep tap-mq0

The output will display the multi_queue attribute flag, enabling hypervisors to attach multiple vhost-net worker threads.

Deleting TUN and TAP Interfaces

When testing is complete or virtual network topologies are dismantled, delete the virtual devices using the del verb:

sudo ip tuntap del mode tun dev tun0
sudo ip tuntap del mode tap dev tap0

Confirm deletion across the kernel network stack:

ip tuntap list

The interfaces and their associated routes and IP addresses are immediately removed from the operating system.