Can I run a VPN that needs TUN or TAP on my VPS?
A VPN using TUN or TAP needs the relevant guest device and networking permissions. Full virtual machines and container-based services can expose these capabilities differently. Confirm the supported VPN design and service policy before changing routes or firewall rules.
Instructions
1. Check the platform’s permissions
Ask whether the selected VPS supports the required VPN software, TUN/TAP access and routing functions. A container administrator may lack capabilities controlled by the host even when the account is called root.
2. Inspect the existing Linux device
Use a read-only check before changing anything.
systemd-detect-virt
ls -l /dev/net/tunA present device is one prerequisite for TUN/TAP software; it does not prove the account has every required networking capability. Absence needs investigation, not a blind permission change.
3. Review the network design before deployment
Define authorised peers, address ranges, routing, DNS and firewall scope. Keep the management path reachable and account for tunnel MTU overhead. Different VPN technologies may use other kernel interfaces, so follow the chosen software’s official requirements.
Check the result
- The required device and capabilities are supported by the exact VPS platform.
- Authorised peers connect through the intended routes without disrupting server management access.
Troubleshooting
- Opening the device is not permitted
- Check the platform’s capability and device policy; do not grant broad permissions to bypass it.
- The VPN connects but traffic fails
- Inspect routing, allowed peer networks, firewall rules and MTU separately from tunnel authentication.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.