What could I or the VPS provider be doing wrong? (TUN/TAP on OpenVZ)

openvz

I'm trying to setup OpenVPN on a CentOS VPS (OpenVZ). But the problem I am having has to do with enabling the TUN/TAP interface. When I purchased the VPS service, I left a note to have the TUN/TAP device enabled. But it seems it wasn't enabled when I went to verify and use it. I contacted my provider and I was told that it was enabled when the VPS was setup. However, I feel it was most likely done incorrectly. I have had a service ticket opened since and the problem still exists.

I have given my provider the steps at the top of this webpage: http://vpsnoc.com/blog/how-to-setup-a-vpn-server-on-a-centos-vps-instantly/

I was told that they have done as I asked, but the TUN/TAP device is still not set up correctly.

I use this command to verify if TUN/TAP is enabled: cat /dev/net/tun

I am told that if it is enabled properly, I should see "File descriptor is in bad state."

However, I always see "No such device."

What am I or my VPS provider missing or not doing correctly?

Best Answer

Well, in the case of OpenVZ the guest is a bit closer tied to the host system than when more conventional virtualization is used. They actually run off the same kernel. As long as you keep to userspace you might not notice it, but as soon as you want to do interact with the system on a lower level, such as creating devices, the guest will depend on settings made on the host, aka the hardware node.

The following is the relevant part from the VPN via the TUN/TAP device page in the OpenVZ wiki.

OpenVZ supports VPN inside a container via kernel TUN/TAP module and device. To allow container #101 to use the TUN/TAP device the following should be done:

Make sure the tun module has been already loaded on the hardware node:

lsmod | grep tun

If it is not there, use the following command to load tun module:

modprobe tun

To make sure that tun module will be automatically loaded on every reboot you can also add it or into /etc/modules.conf (on RHEL see /etc/sysconfig/modules/ directory).

Allow your container to use the tun/tap device by running the following commands on the host node:

vzctl set 101 --devnodes net/tun:rw --save

So yeah, you will need to talk to your VPS provider.

Related Topic