Building TUN based virtual networks with socat


Some operating systems allow the generation of virtual network interfaces that do not connect to a wire but to a process that simulates the network. Often these devices are called TUN or TAP.

socat provides an address type that creates a TUN device on Linux; the other socat address can be any type; it transfers the "wire" data as desired.

This document shows how a simple virtual network can be created between two hosts that may be far (many network hops) apart. On both hosts a socat instance is started that connects to the other host using UDP and creates a TUN device.
Note:UDP is preferred because TCP might not keep packet boundaries, or try TCP with option nodelay.
Note:You may replace UDP by DTLS to add transfer security

The following IP addresses are used in the example; replace them in the following commands with the requirements of your situation:

physical "server" address1.2.3.4n/a
physical "client" addressn/an/a
TUN on "server"
TUN on "client"

The UDP connection uses port 11443.

On "default" Linux installations, creating TUN/TAP devices might require root privilege.

Generate TUN devices with socat

In this section two instances of socat are used to generate TUN devices on different hosts and connect the "wire" sides, providing a simple virtual network.

We distinguish server and client only with respect to the connection between the two socat instances; the TUN interfaces both have the same quality.

TUN Server

socat -d -d UDP-LISTEN:11443,reuseaddr TUN:,up

After starting this command, socat will wait for a connection and then create a TUN pseudo network device with address; the bit number specifies the mask of the network that is pretended to be connected on this interface.

TUN Client

socat UDP: TUN:,up

This command should establish a connection to the server and create the TUN device on the client.

Seeing it work

After successful connection both TUN interfaces should be active and transfer date between each other using the UDP connection. Try this by pinging from the client and from the server.

UDP/IP version 6

IPv6 as transport should work just like any UDP/IPv6 connection.

Creation of an IPv6 virtual interface is not directly possible, but you can generate an IPv4 interface as described above, and add IPv6 addresses using the ifconfig command.


Test TUN integration

If you get error messages like this:

... E unknown device/address "tun"

your socat executable probably does not provide TUN/TAP support. Potential reasons: you are not on Linux or are using an older version of socat.

Missing kernel support

An error message like:

... E open("/dev/net/tun", 02, 0666): No such file or directory

indicates that your kernel does not have TUN/TAP support compiled in. Rebuild your kernel with the appropriate configuration (probably under Device driver / Network device support / Network device / Universal TUN/TAP).

TUN cloning device permissions

An error message like:

... E open("/dev/net/tun", 02, 0666): Permission denied

indicates that you do not have permission to read or write the TUN cloning device. Check its permission and ownership.

Interface down

If no error occurs but the pings do not work check if the network devices have been created:

ifconfig tun0

The output should look like:

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:  P-t-P:  Mask:
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

Check the "UP" keyword; you forget the "up" option in the socat command if it is missing.

Check if the correct IP address and network mask are displayed.


netstat -an |fgrep 192.168.255

The output should look like:   U         0 0          0 tun0

Other problems

Another reason for failure might be iptables.

Run socat with options -d -d -d, this will show every data transfer between the two processes. Each ping probe should cause a forth and a back transfer.


Linux TUN/TAP support was added to socat in version 1.6.0.

This document was last modified in April 2009.

More info about socat TUN/TAP support

Links regarding this tutorial

socat address tun

socat options for TUN/TAP addresses

TUN/TAP options


socat home page
socat man page
OpenVPN home page
TUN/TAP on Wikipedia

Copyright: Gerhard Rieger 2007-2009
License: GNU Free Documentation License (FDL)