Tap interface using netplan

linux-networkingubuntu-18.04

How does one set up tun and tap interfaces on systems that use netplan?

Normally you'd use pre-up in /etc/network/interfaces to call ip tuntap for creating the interface, but I haven't found anything in the netplan docs to do this.

Best Answer

I ran into this problem when upgrading to 18.04 broke my tap based OpenVPN server. It is quite annoying when a headless server just stops working because Ubuntu dropped support for defining bridges in /etc/network/interfaces. There are a few examples already but pretty much you need to create a .yaml file in /etc/netplan that looks something like one of the configs below. Note that you will need the bridge-utils package installed.

Replace eth0 with the name of your ethernet device. You can find this using ifconfig -a.

Additionally you can set the MAC address of the bridge using the macaddress: xx:xx:xx:xx:xx:xx option where xx:xx:xx:xx:xx:xx is replaced with the address you want to use.

/etc/netplan/00-bridge.yaml

For DHCP:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
     dhcp4: no
     dhcp6: no
  bridges:
    br0:
      interfaces: [eth0]
      dhcp4: true 
      dhcp6: no

For a static IP:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      dhcp4: no
      dhcp6: no
  bridges:
    br0:
      interfaces: [eth0]
      dhcp4: no
      addresses: [10.0.0.5/24]
      gateway4: 10.0.0.1
      nameservers:
        addresses: [8.8.8.8]
      dhcp6: no

Related Solutions

Check packet vlan tag using Tap virtual interface

It's certainly possible to do this, and it's actually possible to do this with existing kernel modules today:

LAN -> (nic module) -> (dot1q module) -> (bridge module) -> (dot1q module) -> (nic module) -> WAN

Or:

eth0 -> eth0.10 -> br0 -> eth1.20 -> eth1

(takes anything tagged as vlan 10 off eth0, re-tags it as vlan 20 and pushes it out eth1, and visa-versa. Additional access control can be done using ebtables.)

If you don't need to change tags, you can simplify down to:

eth0 -> br0 -> eth1

And apply ebtables to br0.

That said, if your application can do the "eth0.10 -> br0 -> eth1.20" piece internally, though it would not require tap devices to do it, since you can read frames off one interface, filter, and write to the other.

Linux Networking – Add IPv6 /64 Block to Server Using Netplan

Found a solution, but maybe someone knows a better one?

cat <<EOF > /usr/lib/networkd-dispatcher/routable.d/50-ipv6-block
#!/bin/sh
ip -6 route add local 2001:db8:1:10::/64 dev lo
exit 0
EOF

chmod 755 /usr/lib/networkd-dispatcher/routable.d/50-ipv6-block

To check if it works:

ip -6 route del local 2001:db8:1:10::/64
netplan apply
systemctl --no-pager status networkd-dispatcher.service
route -6 | grep 2001:db8:1:10::/64
ping6 -c2 2001:db8:1:10::1234

If you see a RTNETLINK answers: File exists this is because a route is added which already existed because of an earlier netplan apply