Architecture

 User

 +-------------+       tap0, tun0, ...
 | Application | <------------------+
 +-------------+                    |
                                    v
-------------------------------- /dev/net/tun --------------
 Kernel                               A
  .                                   |
  .                                   |
  |   TCP   |                         V
  +---------+                    +----------+
  |   IP    |  <--Inject/Pull--> |   TUN    |
  +---------+                    +----------+
  |   L2    |  <--Inject/Pull--> |   TAP    |
  +---------+                    +----------+
  .   L1    .
------------------------------------------------------------
 Hardware
  .         .
  |   NIC   |
  -----------

Installing kvm

  • Check if the hardware supports kvm

    cat /proc/cpuinfo | grep vmx  # the result should not be empty

  • Install kvm

    sudo apt-get install qemu-kvm libvirt-bin bridge-utils

  • Change /dev/kvm’s group to kvm (requires a restart, or at least a re-insertion of the kvm kernel mod)

    sudo chown root:kvm /dev/kvm  # allows a non-root user to access kvm

  • Add the user-name of the required user to the kvm, and libvirtd groups

    sudo adduser <uid> kvm
sudo adduser <uid> libvirtd

Creating tap/tun interfaces

  • Creating the interface:

    # Ensure that the owner is set to the required user
sudo tunct -u <uid> -t tap0  # tunctl apparently only creates tap devices

  • Alternate command:

    ip tuntap add dev tun0 mode <tun|tap> user <uid> group <gid>

  • Bring up the link:

    ip link set tap0 up

Creating bridges

  • Creating a bridge:

    sudo brctl addbr br0

  • Bridging interfaces:

    # bridge eth0 <-> tap0 (which was created earlier)
sudo brctl addif br0 tap0
sudo brctl addif br0 eth0  # bridges cannot be created for wlans
sudo ip addr flush dev eth0 # flush the dhcp lease for eth0
sudo dhclient br0 # acquire new dhcp lease for br0

    This can be added to the start-up scripts, or else the same steps, for creating and bring up the bridge, will have to be repeated each time the host is rebooted.

References: