What exactly happens to packets written to a TUN/TAP device?

Question

I'm trying to send packets to an application listening on eth0 from machine's user-space as if they were coming from a remote machine.

What I can't seem to find good documentation for is the exact way a TUN/TAP device interacts with the rest of the network stack? Are packets forwarded to eth0 if they are bound for a remote host? Will packets addressed for the localhost be forwarded to the userspace application by default? At what stages do the packets appear in the kernel relative to the Netfilter stack?

The behaviour doesn't appear well documented (http://openvpn.net/archive/openvpn-users/2005-05/msg00224.html, https://www.kernel.org/doc/Documentation/networking/tuntap.txt)).

Solution

The tun tap device appears the same to the kernel in that it can't tell whether the data comes from a wire connected to an ethernet interfaces or from a userland application. When data is written it is forwarded to the userland application rather than a physical interface device eg. eth0

The interface a packet is forwarded to will be based on the routing table as usual which you can view with ip route or netstat -r. This will apply to packets addressed for the localhost also.

Additionally, TUN/TAP interface can also be used as the interface for a route which appears in the routing table.

Comments

[Martin]

If the userland app writes to the tuntap, if there is a matching route for the remote address it will be forwarded to the interface associated with that route, which may be eth0 or if there is no matching route (or default route) it will be discarded. The kernel treats it the same as a physical interface in this regard, if it is written to the tuntap device with a UDP wrapper, it will be read from the device by the userland app with the same UDP wrapper.

[user3467349]

So if I understand correctly - a packet destined to a remote machine written to tap will be the same as one written to eth0? Likewise a packet destined for the local machine written to tap will be treated the same as one received over the wire? Can I distinguish them at all in Netfilter rules?

[Martin]

Correct. Yes, you can use the same criteria as you would if there were no tun/tap interfaces.