3

I'm trying to send packets to an application listening on eth0 from machine's user-space as if they were coming from a remote machine.

What I can't seem to find good documentation for is the exact way a TUN/TAP device interacts with the rest of the network stack? Are packets forwarded to eth0 if they are bound for a remote host? Will packets addressed for the localhost be forwarded to the userspace application by default? At what stages do the packets appear in the kernel relative to the Netfilter stack?

The behaviour doesn't appear well documented (http://openvpn.net/archive/openvpn-users/2005-05/msg00224.html, https://www.kernel.org/doc/Documentation/networking/tuntap.txt)).

user3467349
  • 131
  • 1
  • 4

1 Answers1

3

The tun tap device appears the same to the kernel in that it can't tell whether the data comes from a wire connected to an ethernet interfaces or from a userland application. When data is written it is forwarded to the userland application rather than a physical interface device eg. eth0

The interface a packet is forwarded to will be based on the routing table as usual which you can view with ip route or netstat -r. This will apply to packets addressed for the localhost also.

Additionally, TUN/TAP interface can also be used as the interface for a route which appears in the routing table.

Martin
  • 501
  • 2
  • 5
  • Thanks for the feedback. So what does a Tun/Tap device do when it gets a packet with a remote address? Does it pass it on to eth0 or does the packet die? Also for forwarding to userland - is it correct to understand that a userland application will receive data as if it came from eth0? (Suppose I strip the UDP wrapper on a complete TCP packet (bound for a local application) and send it to the tun/tap device? Where should netfilter hooks go in order to handle packets written to tap/tun?) – user3467349 Feb 26 '15 at 08:02
  • If the userland app writes to the tuntap, if there is a matching route for the remote address it will be forwarded to the interface associated with that route, which may be eth0 or if there is no matching route (or default route) it will be discarded. The kernel treats it the same as a physical interface in this regard, if it is written to the tuntap device with a UDP wrapper, it will be read from the device by the userland app with the same UDP wrapper. – Martin Feb 26 '15 at 08:05
  • So if I understand correctly - a packet destined to a remote machine written to tap will be the same as one written to eth0? Likewise a packet destined for the local machine written to tap will be treated the same as one received over the wire? Can I distinguish them at all in Netfilter rules? – user3467349 Feb 26 '15 at 08:09
  • Correct. Yes, you can use the same criteria as you would if there were no tun/tap interfaces. – Martin Feb 26 '15 at 08:30