What is TUN?

A TUN device is a virtual network interface on Linux (and other systems) whose packets are passed to and from a program, instead of being sent down a cable.

To the rest of the system, an interface such as tun0 looks like any other: it has an address, routes can point at it, and the firewall sees traffic on it. But when the kernel sends an IP packet out of tun0, nothing is transmitted; the packet is handed to whichever program opened the device. That program, such as a VPN, can encrypt it and send it across the internet. In the other direction, the program writes packets into the device and the kernel receives them as if they had arrived on a network. A TUN device carries IP packets (layer 3); its sibling, the TAP device, carries whole Ethernet frames (layer 2), which is what virtual machines usually use.

OpenVPN in its usual routed mode creates tun0, gives the server and each user an address on it, and from then on it's ordinary Linux routing: routes into tun0, IP forwarding, and firewall rules naming tun0. Containers need access to /dev/net/tun to create one. The OpenVPN on Debian lesson routes between tun0 and two LANs.