在计算机网络中，TUN与TAP是操作系统内核中的虚拟网络设备。不同于普通靠硬件网路板卡实现的设备，这些虚拟的网络设备全部用软件实现，并向运行于操作系统上的软件提供与硬件的网络设备完全相同的功能。
TAP 等同于一个以太网设备，它操作第二层数据包如以太网数据帧。TUN模拟了网络层设备，操作第三层数据包比如IP数据封包。
操作系统通过TUN/TAP设备向绑定该设备的用户空间的程序发送数据，反之，用户空间的程序也可以像操作硬件网络设备那样，通过TUN/TAP设备发送数据。在后种情况下，TUN/TAP设备向操作系统的网络栈投递（或“注入”）数据包，从而模拟从外部接受数据的过程。
服务器如果拥有TUN/TAP模块，就可以开启VPN代理功能。
虚拟网卡TUN/TAP 驱动程序设计原理：
虚拟网卡TUN/TAP 驱动程序设计原理
一个是让它工作在二层上。一个是工作在三层上。
http://vtun.sourceforge.net/tun/faq.html
Universal TUN/TAP device driver Frequently Asked Question.
1. General questions.
1. General questions.
The TUN is Virtual Point-to-Point network device.
TUN driver was designed as low level kernel support for
IP tunneling. It provides to userland application
two interfaces:
- /dev/tunX - character device;
- tunX - virtual Point-to-Point interface.
Userland application can write IP frame to /dev/tunX
and kernel will receive this frame from tunX interface.
In the same time every frame that kernel writes to tunX
interface can be read by userland application from /dev/tunX
device.
The TAP is a Virtual Ethernet network device.
TAP driver was designed as low level kernel support for
Ethernet tunneling. It provides to userland application
two interfaces:
- /dev/tapX - character device;
- tapX - virtual Ethernet interface.
Userland application can write Ethernet frame to /dev/tapX
and kernel will receive this frame from tapX interface.
In the same time every frame that kernel writes to tapX
interface can be read by userland application from /dev/tapX
device.
Currently driver has been written for 3 Unices:
Linux kernels 2.2.x, 2.4.x
FreeBSD 3.x, 4.x, 5.x
Solaris 2.6, 7.0, 8.0
As mentioned above, main purpose of TUN/TAP driver is tunneling.
It used by VTun (http://vtun.info).
Virtual network device can be viewed as a simple Point-to-Point or
Ethernet device, which instead of receiving packets from a physical
media, receives them from user space program and instead of sending
packets via physical media sends them to the user space program.
Let's say that you configured IPX on the tap0, then whenever
kernel sends any IPX packet to tap0, it is passed to the application
(VTun for example). Application encrypts, compresses and sends it to
the other side over TCP or UDP. Application on other side decompress
and decrypts them and write packet to the TAP device, kernel handles
the packet like it came from real physical device.
TUN works with IP frames. TAP works with Ethernet frames.
BFP is a advanced packet filter. It can be attached to existing
network interface. It does not provide virtual network interface.
TUN/TAP driver does provide virtual network interface and it is possible
to attach BPF to this interface.
Yes. Linux and FreeBSD drivers support Ethernet bridging.