I am trying to set up an openvpn server inside a lxc guest. However, it seams there is no tun device available in the container.

Starting openvpn inside the container gives me this error:

Tue Sep 18 13:04:18 2012 Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
Tue Sep 18 13:04:18 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Sep 18 13:04:18 2012 /sbin/ifconfig pointopoint mtu 1500
SIOCSIFADDR: No such device
: ERROR while getting interface flags: No such device
SIOCSIFDSTADDR: No such device
: ERROR while getting interface flags: No such device
SIOCSIFMTU: No such device
Tue Sep 18 13:04:18 2012 Linux ifconfig failed: external program exited with error status: 1
Tue Sep 18 13:04:18 2012 Exiting

In my containers config, I see the following:

lxc.cgroup.devices.allow = c 10:200 rwm

I'd assume this enabled tun devices for the container, but modprobe tun gives me another error:

FATAL: Could not load /lib/modules/3.2.0-30-generic/modules.dep: No such file or directory

I'm assuming I am missing some permission or something in my container. Can someone tell me what it is?


I'm not familiar with lxc, but try the following commands:

# mkdir /dev/net 
# mknod /dev/net/tun c 10 200 
# chmod 666 /dev/net/tun
  • 3
    and in lxc config the following line: lxc.cgroup.devices.allow = c 10:200 rwm – apagr Jun 20 '13 at 16:04
  • @apagr Doesn't work anymore on Ubuntu 14.04... – Adam Ryczkowski Apr 6 '15 at 9:42
  • 1
    Works with lxc turnkey openvpn on proxmox 4.3 – embedded Dec 2 '16 at 11:36

The answers above don't actually work now with current versions of lxc. Manually creating a character device with mknod has no effect - the device is not visible inside the container. Use of the autodev functionality in lxc is required.

lxc.cgroup.devices.deny = a

lxc.cgroup.devices.allow = c 10:200 rwm

lxc.hook.autodev = sh -c "modprobe tun; cd ${LXC_ROOTFS_MOUNT}/dev; mkdir net; mknod net/tun c 10 200; chmod 0666 net/tun"

The order is important - the deny must be first.

  • Actually on a Debian 10 unprivileged LXC container and an Ubuntu 19.10 host, the only thing I needed to to is to add lxc.mount.entry = /dev/net dev/net none bind,create=dir in the container config file, mentioned in your link and with a similar solution here: superuser.com/questions/1202749/… – baptx May 20 '20 at 17:41

In addition to quanta's answer. Also make sure you have this line in the lxc config:

mknod /dev/net/tun c 10 200

This is the right syntax:

lxc.cgroup.devices.allow = c 10:200 rwm

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.