VLANs and TUN/TAP: Two More Linux Networking Primitives
Throughout this part of the book, we've focused on three fundamental Linux networking primitives: network namespaces, veth pairs, and Linux bridges. Together, they allow us to build complete virtual Ethernet networks. However, Linux provides additional networking primitives that solve different problems. In this chapter, we'll explore two of the most important: VLAN interfaces and TUN/TAP devices.
Learning Objectives
By the end of this chapter, you will be able to:
- Understand why VLANs exist
- Understand what TUN and TAP devices are
- Create and experiment with TUN/TAP interfaces
- Recognize where VLANs and TUN/TAP are used in real-world systems
Not Every Network Needs More Hardware
Suppose a company has three departments:
- Engineering
- Finance
- Operations
Initially, every computer is connected to the same Ethernet switch.
Ethernet Switch
+------+------+------+
Eng1 Fin1 Ops1
Everyone shares the same broadcast domain.
Every ARP request reaches every device.
Every unknown unicast is flooded everywhere.
As the network grows, this becomes inefficient.
More importantly, different departments may need to be isolated from one another.
Buying three physical switches works, but it is expensive and difficult to manage.
Instead, we can divide one physical switch into multiple logical switches.
This is the purpose of VLANs.
What Is a VLAN?
A Virtual Local Area Network (VLAN) divides one physical Ethernet network into multiple independent Layer 2 networks.
Consider a switch with eight ports.
Without VLANs:
+--------------------+
| Switch |
+--------------------+
Every port belongs to the
same Ethernet network.
With VLANs:
+--------------------+
| Switch |
+--------------------+
Ports 1-4 → VLAN 10
Ports 5-8 → VLAN 20
Even though every device is connected to the same physical switch, devices in different VLANs cannot communicate directly.
From the devices' perspective, they appear to be connected to different switches.
VLANs Are Layer 2 Isolation
A VLAN does not create a new IP network.
It creates a new Ethernet broadcast domain.
Typically, each VLAN is assigned its own IP subnet.
For example:
| VLAN | Subnet |
|---|---|
| 10 | 192.168.10.0/24 |
| 20 | 192.168.20.0/24 |
| 30 | 192.168.30.0/24 |
The separation happens at Layer 2.
Routing between VLANs requires a router.
How VLANs Work
The IEEE 802.1Q standard introduces a VLAN tag inside an Ethernet frame.
A normal Ethernet frame looks like this:
Destination MAC
Source MAC
EtherType
Payload
A VLAN-tagged frame inserts an additional header.
Destination MAC
Source MAC
802.1Q VLAN Tag
EtherType
Payload
The tag contains a VLAN Identifier (VID).
For example:
VLAN 10
or
VLAN 20
Switches use this tag to decide which logical network the frame belongs to.
VLANs and Linux Bridges
A bridge can contain VLAN interfaces.
For example:
br0
+-----+------+
eth0.10 veth1
Only VLAN 10 traffic reaches that bridge.
Similarly:
br1
+-----+------+
eth0.20 veth2
Linux virtualization platforms frequently use this design to connect virtual machines or containers to different VLANs.
What Is TUN/TAP?
Unlike VLANs, TUN and TAP do not divide Ethernet networks.
Instead, they create virtual network devices that exchange packets with user-space applications.
This makes them ideal for VPN software, emulators, virtual machines, and networking tools.
TUN vs TAP
Although they are often mentioned together, they operate at different layers.
| Device | Layer | Carries |
|---|---|---|
| TUN | Layer 3 | IP packets |
| TAP | Layer 2 | Ethernet frames |
Remember this simple rule:
TUN works with IP packets. TAP works with Ethernet frames.
Understanding TUN
A TUN interface behaves like a point-to-point IP interface.
Application
↓
IP Packet
↓
tun0
↓
User Space Program
Notice what is missing.
There is no Ethernet header.
The application reads and writes raw IP packets.
Understanding TAP
A TAP interface behaves like an Ethernet interface.
Application
↓
Ethernet Frame
↓
tap0
↓
User Space Program
Applications receive complete Ethernet frames, including:
- destination MAC
- source MAC
- EtherType
- payload
To Linux, a TAP interface looks almost identical to a physical Ethernet device.
Why User Space?
Unlike veth pairs, packets entering a TUN or TAP device are delivered to a user-space program.
That application decides what happens next.
For example, it may:
- encrypt the packet
- compress it
- forward it over TCP
- encapsulate it inside UDP
- inspect or modify it
- discard it
This flexibility is why VPN software uses TUN/TAP devices.
Where TAP Is Used
Many virtualization platforms connect guest operating systems using TAP devices.
Guest VM
↓
tap0
↓
Linux Bridge
↓
Physical Network
From the guest's perspective, it owns a normal Ethernet adapter.
The guest never knows the interface is virtual.
Where TUN Is Used
TUN devices are common in VPN software.
Examples include:
- WireGuard
- OpenVPN (TUN mode)
- Tailscale
- ZeroTier
- Cloudflare WARP
Applications exchange IP packets through the TUN interface and encapsulate them for transport across another network.
Comparing Linux Networking Primitives
At this point, we've covered six major Linux networking primitives.
| Primitive | Purpose |
|---|---|
| Namespace | Network isolation |
| veth | Point-to-point Ethernet cable |
| Bridge | Layer 2 software switch |
| Router | Layer 3 packet forwarding |
| VLAN | Multiple logical Layer 2 networks |
| TUN/TAP | Virtual interfaces connected to user-space |
These primitives can be combined to build almost any Linux networking architecture.
Common Mistakes
Expecting VLANs to Route Traffic
VLANs provide Layer 2 isolation.
Communication between VLANs still requires a router.
Confusing TUN and TAP
If an application expects Ethernet frames, use TAP.
If it expects IP packets, use TUN.
Choosing the wrong device type usually prevents communication.
Forgetting User-Space Ownership
A TUN or TAP interface by itself does not forward packets.
A user-space application must open the device and read or write packets.
Summary of Part 3
In this part of the book, we've built a complete virtual networking environment using only Linux kernel features.
We learned how:
- Network namespaces isolate networking resources.
- veth pairs create virtual Ethernet cables.
- Linux bridges implement Layer 2 switching.
- Linux routes packets between different IP networks.
- VLANs divide one physical network into multiple logical Ethernet networks.
- TUN and TAP devices connect the kernel networking stack to user-space applications.
These are the same building blocks used by container runtimes, hypervisors, VPN software, cloud platforms, and Kubernetes networking.
Understanding these primitives is far more valuable than memorizing the commands of a specific platform because the platforms themselves are built on top of these concepts.
Key Takeaways
- VLANs provide Layer 2 isolation by inserting an IEEE 802.1Q tag into Ethernet frames.
- Communication between VLANs requires Layer 3 routing.
- A TUN device carries IP packets, while a TAP device carries complete Ethernet frames.
- TUN/TAP devices connect the kernel networking stack with user-space applications, enabling VPNs, virtualization, and network emulation.
- Modern networking platforms combine namespaces, veth pairs, bridges, routing, VLANs, and TUN/TAP devices to create flexible virtual networks.
Coming Next
So far, we've explored Linux networking from the perspective of network devices and topology. We know how packets move between namespaces, bridges, routers, and virtual interfaces.
In the next part of the book, we'll shift our focus inside the Linux kernel and follow a packet through its entire processing path. We'll examine where routing decisions occur, how Netfilter intercepts traffic, how connection tracking maintains state, and how Linux implements firewalling and Network Address Translation (NAT).