What are TUN and TAP adapters?

TUN and TAP adapters are virtual networking devices that facilitate communication between a device’s operating system and software. They’re often used by VPNs but also allow for bridged networking on virtual machines. This post is for anyone looking to understand what TUN/TAP adapters are and how they work. I’ll explain the differences between TUN and TAP, provide practical troubleshooting advice, and reveal when to use one over the other.

What are TUN and TAP adapters for?

TUN and TAP adapters both allow applications to communicate with your device’s networking stack. For instance, your operating system might use TUN/TAP to pass traffic to a VPN app so it can be encrypted. However, while they’re used for similar purposes, these technologies differ in a few key ways.

TUN operates on the third layer of the OSI Model (“Network”) and only cares about what data is going where. It’s primarily used for point-to-point connections like Virtual Private Networks (VPNs) and proxies. TUN adapters are fairly easy to understand as they simply send and receive IPv4 and IPv6 packets.

TAP operates on the second layer (“Data Link”), meaning it handles connections between devices on the local network. It effectively simulates an Ethernet card, making it helpful for bridging connections between real devices and virtual machines. TAP adapters see everything TUN does, plus all other Ethernet frame information (including destination MAC addresses).

If you can’t decide which to use, ask yourself the following questions:

• Does the app I’m using support both TUN and TAP?
• Am I willing to accept slightly slower speeds?
• Do I have a complex network with lots of shared devices?
• Do I use virtual machines?
• Am I specifically interested in Ethernet frame info that TUN can’t access?

If you answered “yes” to most of these questions, I’d suggest using TAP. It’s not as quick as TUN but offers greater flexibility and interoperability. If you answered mostly “no”, TUN will likely meet your needs perfectly well. You can always switch later if you run into problems.

How are TUN/TAP adapters related to VPNs?

VPNs have to be able to send and receive data packets in order to encrypt them. To access these packets, they often set up their own TAP and TUN adapters during installation. This effectively lets them emulate physical networking hardware, while being entirely software-based.

TUN adapters are generally more efficient since they have less overhead. This is because they only process IP packets containing data, source and destination IP addresses, and various other routing information. TAP adapters, on the other hand, process Ethernet frames. These include entire IP packets as well as MAC address info, error-correcting code, and more.

Many consumer VPNs set up their own TUN and TAP adapters during the installation process. The reason they need both is that not every connection protocol supports TAP and TUN. These adapters aren’t even always necessary – if you connect exclusively via IPSec-based protocols like IKEv2, you can safely disable them. Most modern operating systems support IPSec as standard, with no virtual networking devices required.

Here’s a cheat sheet showing which protocols support TUN and TAP:

How to check, repair, and remove installed TAP/TUN adapters

Unless you’re working with a complex network, relying on virtualization, or actively trying to fix a problem, you shouldn’t have to think about your TUN/TAP adapters very much. That said, it’s beneficial to know how to change network adapter settings in case anything ever goes wrong.

If you can’t stay connected to a VPN, if you lose internet access once connected, or if you’re connected but constantly timing out, the adapters may be to blame. You’ll find step-by-step guides to restarting and removing TUN/TAP adapters on Windows, macOS, and Linux below.

Changing adapter settings on Windows

There are actually two ways to manage TAP/TUN adapters on Windows: via the Device Manager and Control Panel. I’ll provide instructions for both, but would recommend using Device Manager since it’s faster and offers greater control.

Device Manager: Press the Windows key and X simultaneously. Click Device Manager, then expand the Network adapters option.

From here, simply right-click your adapter, and you can quickly disable, enable, or uninstall it. In my professional experience, restarting the appropriate adapter is often enough to solve VPN connectivity issues.

Control Panel: Press the Windows key and type View network connections, then hit Enter.

Right-clicking an adapter brings up a context menu that allows you to troubleshoot your connection. You can also enable, disable, or delete specific adapters. If the Delete option is greyed out, you may need to uninstall the VPN first or remove it via the Device Manager.

Changing TUN adapter settings on macOS

macOS never officially supported TAP adapters, but there were unofficial ways to create them, such as the open-source app Tunnelblick. Unfortunately, Apple stopped letting system extensions use deprecated kernel programming interfaces in 2020, eliminating this workaround. As such, it’s no longer possible to install TAP adapters on MacOS.

Here’s how to edit TUN adapter settings on macOS:

1. Open a terminal.
2. Type “ifconfig” (without quotes) into the terminal and hit Enter.
3. Your TUN adapters will be listed as “utun1”, “utun2”, and so on. Find the one you’d like to change and note its name.
4. Enter one of the commands from the list below, replacing “UTUN#” with your adapter’s actual name.

Changing adapter settings on Linux

To change the TUN/TAP adapter settings in Linux distributions like Ubuntu and Mint, just open the terminal. From here, type “ifconfig” and press Enter.

Find the adapter you’re looking for and make a note of its name. We’ll substitute this into the commands below to enable, disable, or delete the adapter as needed.

Wrapping up

TUN and TAP might seem intimidating, but conceptually, they’re easy enough to understand. TUN is the mailman delivering letters, whereas TAP is the post office, handling hundreds of letters, with processes in place in case an envelope is damaged. Now you know the difference, you’re better equipped to choose one for your VPN implementation. If anything goes wrong, restarting an adapter is often enough to fix the issue, though sometimes a full reinstall is needed.