Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the differences between using dev tap and dev tun for openvpn? I know the different modes cannot inter-operate. What is the technical differences, other then just layer 2 vs 3 operation. Are there different performance characteristics, or different levels of overhead. Which mode is better. What functionality is exclusively available in each mode.

share|improve this question
Please explain the difference? whats ethernet bridging and why is it bad? – Thomaschaaf Jun 7 '09 at 16:13
up vote 49 down vote accepted

if it's ok to create vpn on layer 3 (one more hop between subnets) - go for tun.

if you need to bridge two ethernet segments in two different locations - then use tap. in such setup you can have computers in the same ip subnet (eg on both ends of vpn, and they'll be able to 'talk' to each other directly without any changes in their routing tables. vpn will act like ethernet switch. this might sound cool and is useful in some cases but i would advice not to go for it unless you really need it. if you choose such layer 2 bridging setup - there will be a bit of 'garbage' (that is broadcast packets) going across your vpn.

using tap you'll have slightly more overhead - besides ip headers also 38B or more of ethernet headers are going to be sent via the tunnel (depending on the type of your traffic - it'll possibly introduce more fragmentation).

share|improve this answer

I always set up tun. Tap is used by ethernet bridging in OpenVPN and introduces an unprecendented level of complexity that is simply not worth bothering with. Usually when a VPN needs to be installed, its needed now, and complex deployments don't come fast.

The OpenVPN FAQ and the Ethernet Bridging HOWTO are excellent resources on this topic.

share|improve this answer
In my experience, tun is easier to setup but doesn't handle as many network configurations, so you run into a lot more weird networking problems. In contrast, tap is a bit more complicated to setup, but once you do, it typically "just works" for everyone. – Cerin Mar 28 '13 at 21:36

I started out using tun, but switched to tap since I didn't like the use of a /30 subnet for each PC (I need to support Windows). I found that to be wasteful and confusing.

Then I discovered the "topology subnet" option on the server. Works with the 2.1 RCs (not 2.0), but it gives me all the advantages of tun (no bridging, performance, routing, etc) with the convenience of one (sequential) IP address per (windows) machine.

share|improve this answer

I chose "tap" when setting up a VPN for a friend who owned a small business because his office uses a tangle of Windows machines, commercial printers, and a Samba file server. Some of them use pure TCP/IP, some seem to only use NetBIOS (and thus need Ethernet broadcast packets) to communicate, and some I'm not even sure of.

If I had chosen "tun", I would probably have faced lots of broken services — lots of things that worked while you are in the office physically, but then would break when you went off-site and your laptop couldn't "see" the devices on the Ethernet subnet anymore.

But by choosing "tap", I tell the VPN to make remote machines feel exactly like they're on the LAN, with broadcast Ethernet packets and raw Ethernet protocols available for communicating with printers and file servers and for powering their Network Neighborhood display. It works great, and I never get reports of things that don't work offsite!

share|improve this answer

If then, why what, how much have you got? I would utilize TAP, explicitly for the reason that the layering of the packets proceeds with much less latency and loss of transmission which is abated with this method. However only with layer 3 does this affect any apparent effect on the operation of the VPN, notably the tunneling aspect and which IPs are allowed through and assignable addresses. The use of UDP possibly introduces another situation where you would need to decide which is the best route to take for you. Each network is different and requires a unique set of parameters. Hope this helps.

share|improve this answer
Quite confusing. Please consider cleaing it up, explaining the differences that matter and keying off them. – vonbrand Jun 25 '14 at 20:03

If you plan to connect mobile ( iOS or Android ) devices using OpenVPN, then you should use TUN as currently TAP is not supported by OpenVPN on them.

share|improve this answer

I had this same question years ago and attempted to explain it in straightforward terms (which I personally found lacking in other resources) on my blog: An OpenVPN Primer

Hope it helps someone

share|improve this answer
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Mark Henderson Apr 8 '15 at 19:28
Great post! I rarely read a whole post like this but this one I did. I agree with Mark Henderson though, you should write a small summary and put the link after. – Pierre-Luc Bertrand Jul 7 '15 at 1:46
The post was excellent. Thank you! – Compeek Oct 19 '15 at 16:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.