17

I am trying to set up an openvpn server inside a lxc guest. However, it seams there is no tun device available in the container.

Starting openvpn inside the container gives me this error:

Tue Sep 18 13:04:18 2012 Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
Tue Sep 18 13:04:18 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Sep 18 13:04:18 2012 /sbin/ifconfig  10.6.0.1 pointopoint 10.6.0.2 mtu 1500
SIOCSIFADDR: No such device
: ERROR while getting interface flags: No such device
SIOCSIFDSTADDR: No such device
: ERROR while getting interface flags: No such device
SIOCSIFMTU: No such device
Tue Sep 18 13:04:18 2012 Linux ifconfig failed: external program exited with error status: 1
Tue Sep 18 13:04:18 2012 Exiting

In my containers config, I see the following:

#tun
lxc.cgroup.devices.allow = c 10:200 rwm

I'd assume this enabled tun devices for the container, but modprobe tun gives me another error:

FATAL: Could not load /lib/modules/3.2.0-30-generic/modules.dep: No such file or directory

I'm assuming I am missing some permission or something in my container. Can someone tell me what it is?

3

4 Answers 4

20

I'm not familiar with lxc, but try the following commands:

# mkdir /dev/net 
# mknod /dev/net/tun c 10 200 
# chmod 666 /dev/net/tun
4
  • 3
    and in lxc config the following line: lxc.cgroup.devices.allow = c 10:200 rwm
    – apagr
    Commented Jun 20, 2013 at 16:04
  • @apagr Doesn't work anymore on Ubuntu 14.04... Commented Apr 6, 2015 at 9:42
  • 1
    Works with lxc turnkey openvpn on proxmox 4.3
    – embedded
    Commented Dec 2, 2016 at 11:36
  • works for proxmox7, no need to modify the config file for the lxc.
    – manit
    Commented Dec 10, 2021 at 20:32
8

The answers above don't actually work now with current versions of lxc. Manually creating a character device with mknod has no effect - the device is not visible inside the container. Use of the autodev functionality in lxc is required.

lxc.mount.entry = /dev/net dev/net none bind,create=dir

lxc.cgroup2.devices.allow = c 10:200 rwm

  • In an Alpine Linux container (without systemd) I use:

lxc.cgroup.devices.deny = a

lxc.cgroup.devices.allow = c 10:200 rwm

lxc.hook.autodev = sh -c "modprobe tun; cd ${LXC_ROOTFS_MOUNT}/dev; mkdir net; mknod net/tun c 10 200; chmod 0666 net/tun"

The order is important - the deny must be first.

2
  • Actually on a Debian 10 unprivileged LXC container and an Ubuntu 19.10 host, the only thing I needed to to is to add lxc.mount.entry = /dev/net dev/net none bind,create=dir in the container config file, mentioned in your link and with a similar solution here: superuser.com/questions/1202749/…
    – baptx
    Commented May 20, 2020 at 17:41
  • For information, when using a Kali Linux LXC container on a Debian 11 host, it only worked when using the full solution of your link: lxc.mount.entry = /dev/net dev/net none bind,create=dir lxc.cgroup2.devices.allow = c 10:200 rwm
    – baptx
    Commented Feb 4, 2023 at 0:27
3

In addition to quanta's answer. Also make sure you have this line in the lxc config:

mknod /dev/net/tun c 10 200

This is the right syntax:

#tun
lxc.cgroup.devices.allow = c 10:200 rwm
0

As suggested by our hosting provider EURO-SPACE, these are steps how to enable TUN/TAP on Proxmox LXC containers:

  1. Make sure your container is PRIVILEGED, if not, then make a backup of the container, then restore it and check "Privileged Container".

  2. Shutdown container and edit its configuration file located under /etc/pve/lxc/CTID.conf (CTID is the ID of your container)

  3. Add following lines at the end of file:

    lxc.cgroup.devices.allow: c 10:200 rwm

    lxc.hook.autodev: sh -c "modprobe tun; cd ${LXC_ROOTFS_MOUNT}/dev; mkdir net; mknod net/tun c 10 200; chmod 0666 net/tun"

  4. Save configuration file and start the container.

  5. Make sure TUN is enabled by running following command:

    cat /dev/net/tun

This should output the following:

cat: /dev/net/tun: File descriptor in bad state

Now you can run VPN.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .