mknod /dev/net/tun c 10 200
Set permissions:
- e.g. chmod 0666 /dev/net/tun
- There's no harm in allowing the device to be accessible by non-root users,
- since CAP_NET_ADMIN is required for creating network devices or for
- connecting to network devices which aren't owned by the user in question.
- If you want to create persistent devices and give ownership of them to
- unprivileged users, then you need the /dev/net/tun device to be usable by
- those users.
+ e.g. chmod 0700 /dev/net/tun
+ if you want the device only accessible by root. Giving regular users the
+ right to assign network devices is NOT a good idea. Users could assign
+ bogus network interfaces to trick firewalls or administrators.
Driver module autoloading
ethernet frames when using tap.
5. What is the difference between BPF and TUN/TAP driver?
-BPF is an advanced packet filter. It can be attached to existing
+BFP is an advanced packet filter. It can be attached to existing
network interface. It does not provide a virtual network interface.
A TUN/TAP driver does provide a virtual network interface and it is possible
to attach BPF to this interface.