ip-tuntap

Show all existing TUN/TAP devices

$ ip [[tunt|tuntap]]

$ sudo ip [[tunt|tuntap]] [[a|add]] [[d|dev]] [tun0] [[m|mode]] [[t|tun]]

$ sudo ip [[tunt|tuntap]] [[a|add]] [[d|dev]] [tap0] [[m|mode]] [[ta|tap]]

$ sudo ip [[tunt|tuntap]] [[d|delete]] [[d|dev]] [tun0|tap0] [[m|mode]] [tun|tap]

$ sudo ip [[tunt|tuntap]] [[a|add]] [[d|dev]] [tun0|tap0] [[m|mode]] [tun|tap] [[u|user]] [username]

$ sudo ip [[tunt|tuntap]] [[a|add]] [[d|dev]] [tun0|tap0] [[m|mode]] [tun|tap] [[u|user]] [username] [[g|group]] [group_name]

ip tuntap add dev NAME mode { tun | tap } [user UID] [group GID] [pi|nopi] [vnet_hdr|novnet_hdr] [multi_queue [N]] [persist]
ip tuntap del dev NAME mode { tun | tap }
ip tuntap show [[dev] NAME]

add
    Create a new TUN/TAP device

del
    Delete a TUN/TAP device

show
    Display TUN/TAP devices

dev NAME
    Interface name (required for add/del)

mode { tun | tap }
    Device mode: tun for L3 IP, tap for L2 Ethernet (required for add/del)

user UID
    Set owning user ID

group GID
    Set owning group ID

pi
    Include protocol info header (default)

nopi
    Exclude protocol info header

vnet_hdr
    Enable virtio net header

novnet_hdr
    Disable virtio net header (default)

multi_queue [N]
    Enable multi-queue with optional queue count

persist
    Keep device after last close

ip tuntap is a subcommand of the ip utility from the iproute2 package, used to create, delete, and display TUN/TAP devices. These are virtual network kernel devices that enable user-space programs to communicate with the kernel's networking stack as if connected to a physical network interface.

TUN mode handles layer 3 IP packets, while TAP mode handles layer 2 Ethernet frames. Common uses include VPN implementations (e.g., OpenVPN, Tinc), virtual machine networking, and network namespaces bridging.

Key features include setting ownership for non-root access, adding protocol info (PI) headers, virtio net headers for performance, multi-queue support, and persistence. After creation, use ip link set dev NAME up to activate, then configure IP with ip addr. Requires CAP_NET_ADMIN privileges.

Requires root or CAP_NET_ADMIN. Device not up by default; use ip link set up. Cannot reuse name immediately after del.

ip tuntap add dev tun0 mode tun user 1000
ip link set tun0 up
ip addr add 10.0.0.1/24 dev tun0

ip tuntap add dev tap0 mode tap group 100 persist
Device survives program close.

Added to iproute2 in Linux 2.6.23 (2007) to support enhanced TUN/TAP driver features like multi-queue and vnet_hdr.

ip-link(8), ip(8), tun(4)