How to enable tun/tap in a LXC container?

[martinmp]

Hi! I need to enable the tun device to run a tinc VPN but I can't create the tun device.
I have tested several solution from internet but all fails.
Any help?

Thanks.
Sorry for my english.

 

[windinternet]

Hello @martinmp,

I just did some quick testing. You can make a tap device in the following way:

Set this in your Proxmox LXC config file /etc/pve/lxc/<nnn>.conf (Don't do this directly in /var/lib/lxc/<nnn>/config because it will be overwritten on next start of the container.)

lxc.cgroup.devices.allow: c 10:200 rwm

Then start your container, enter it's shell and do:

mkdir /dev/net
mknod /dev/net/tun c 10 200
ip tuntap add mode tap
--show it
ip link

I haven't done any testing yet if it is usable though. So succes.
Maybe here you can find usable scripts:
https://www.stgraber.org/2014/09/26/vpn-in-containers/

 

[djdonnerwolke]

I did it a little differently.
I made the settings directly in the configuration and did not have to do anything more in the LXC container.

nano /etc/pve/lxc/<nnn>.conf

lxc.cgroup.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net dev/net none bind,create=dir

This then looked like this:


I was able to run my Wireguard installer directly.

I took this one, by the way:

wget git.io/wireguard -O wireguard-install.sh && bash wireguard-install.sh

 

[paulie420]

I wanted to post a reply because there wasn't info on the web for MY search and I want to make sure someone else can find it. You always have to ask the RIGHT questions, don't you?

I was/am trying to get tailscale setup on an Ubuntu Server 22.04 - tailscaled.service was failing because /dev/net/tun wasn't present... so I went searching for tailscale, tailscaled.service, /dev/net/tun fails, etc etc etc. The correct question would have been Tailscaled.service fails on a Proxmox LXC container.

Last, the solution above that worked for me was adding the TWO lines of text to xxx.conf in the /etc/pve/lxc directory on my PVE system... the two lines were:
```
lxc.cgroup.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net dev/net none bind,create=dir
```
Once added to my xxx.conf file, and the lxc container rebooted, /dev/net/tun was present - tailscale installed and went up perfectly.

Hope this helps someone else searching in the future.

 

[rar1871]

I wanted to post a reply because there wasn't info on the web for MY search and I want to make sure someone else can find it. You always have to ask the RIGHT questions, don't you?

I was/am trying to get tailscale setup on an Ubuntu Server 22.04 - tailscaled.service was failing because /dev/net/tun wasn't present... so I went searching for tailscale, tailscaled.service, /dev/net/tun fails, etc etc etc. The correct question would have been Tailscaled.service fails on a Proxmox LXC container.

Last, the solution above that worked for me was adding the TWO lines of text to xxx.conf in the /etc/pve/lxc directory on my PVE system... the two lines were:
```
lxc.cgroup.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net dev/net none bind,create=dir
```
Once added to my xxx.conf file, and the lxc container rebooted, /dev/net/tun was present - tailscale installed and went up perfectly.

Hope this helps someone else searching in the future.

This put me in the right direction but didn't work. I had to make a small change to the first line:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net dev/net none bind,create=dir

Reboot container and voila!

 

[UnsoberDev]

@rar1871:
Interesting that this did the trick for you, great to see it helped you out.

If I see it right, you only changed 'cgroup' into 'cgroup2'.
As I'm fairly new to this (and also try to make TUN/TAP working for my OpenVPN server CT), I'd be curious to know why this change worked for you.

What exactly did it affect?

Update:
Found the answer here:
Add the following lines at the end (if you're using PVE < 7.0, change `cgroup2` with `cgroup`)

 

[Phobes]

@rar1871:
Interesting that this did the trick for you, great to see it helped you out.

If I see it right, you only changed 'cgroup' into 'cgroup2'.
As I'm fairly new to this (and also try to make TUN/TAP working for my OpenVPN server CT), I'd be curious to know why this change worked for you.

What exactly did it affect?

Update:
Found the answer here:
Add the following lines at the end (if you're using PVE < 7.0, change `cgroup2` with `cgroup`)

Thanks for this, I was struggling to get a VPN working and hadn't realized that cgroup was changed to cgroup2 for 7.0 and above!

 

[hyu]

@rar1871:
Interesting that this did the trick for you, great to see it helped you out.

If I see it right, you only changed 'cgroup' into 'cgroup2'.
As I'm fairly new to this (and also try to make TUN/TAP working for my OpenVPN server CT), I'd be curious to know why this change worked for you.

What exactly did it affect?

Update:
Found the answer here:
Add the following lines at the end (if you're using PVE < 7.0, change `cgroup2` with `cgroup`)

The same solution also happens to work when trying to run rootless podman in an LXC (NixOs in my case):

podman run hello-world
✔ docker.io/library/hello-world:latest
Trying to pull docker.io/library/hello-world:latest...
Getting image source signatures
Copying blob c1ec31eb5944 done   |
Copying config d2c94e258d done   |
Writing manifest to image destination
Error: /nix/store/s7fjjj2sydyrilgbl7h0vf7zgzriqw8n-podman-4.7.2/libexec/podman/slirp4netns failed: "open(\"/dev/net/tun\"): No such file or directory\nWARNING: Support for seccomp is experimental\nWARNING: Support for IPv6 is experimental\nchild failed(1)\nWARNING: Support for seccomp is experimental\nWARNING: Support for IPv6 is experimental\n"

 

[romayojr]

Thanks for this, I was struggling to get a VPN working and hadn't realized that cgroup was changed to cgroup2 for 7.0 and above!

this solution also worked for me by changing cgroup to cgroup2. now the tun device is enabled for my lxc container to be able to run gluetun VPN successfully. thanks!