In short: TUN and TAP are two types of virtual network adapter created by a VPN client on your device. TUN operates at OSI layer 3 (IP packets, point-to-point routing) and covers 99% of VPN use cases. TAP operates at layer 2 (Ethernet frames, including broadcast and non-IP traffic) and is only needed when bridging two separate LAN segments into one Ethernet domain. WireGuard uses only TUN by design; OpenVPN supports both, with TUN as the default. Learn about the protocols behind these adapters: VPN protocols: WireGuard, OpenVPN, IKEv2.
What are TUN and TAP in a VPN?
TUN and TAP are virtual network adapters that a VPN client creates on your device on top of the physical interface (Wi-Fi or Ethernet). The operating system treats them as regular network cards and routes traffic through them into the encrypted tunnel. They are software-only interfaces: the VPN process intercepts packets and encrypts them before sending over the wire.
An analogy: think of the physical network as a highway. The VPN client builds a virtual toll gate (TUN or TAP) on the outbound lane. The difference between TUN and TAP is what that gate handles — only IP-addressed packets, or all traffic including non-standard Ethernet payloads like ARP and broadcast frames.
TUN vs TAP: layer 3 vs layer 2
The core difference is the OSI layer each adapter operates at: TUN at layer 3 (network, IP), TAP at layer 2 (data link, Ethernet). This determines what crosses the tunnel and which scenarios each supports.
| Parameter | TUN | TAP |
|---|---|---|
| OSI layer | Layer 3 (network, IP) | Layer 2 (data link, Ethernet) |
| Data unit | IP packet | Ethernet frame |
| Interface type | Point-to-point | Virtual Ethernet with broadcast domain |
| Bridging | Not supported | Supported |
| Non-IP traffic (ARP, IPX) | Not carried | Carried |
| Overhead | Lower (no L2 headers) | Higher (14-byte Ethernet header per frame) |
| Typical use | Standard VPN, remote access, mobile clients | LAN-to-LAN bridging, legacy networks |
Why TAP supports bridging and TUN does not
TAP supports bridging because it sees Ethernet frames — the same units that travel in a physical LAN. A virtual TAP interface can be added to a Linux bridge or a Windows network bridge, making two geographically separate network segments behave as one: ARP requests, DHCP broadcasts, device-discovery protocols — all pass through the tunnel.
TUN cannot do this: it only sees IP packets at layer 3. Broadcast frames, ARP requests, and non-IP traffic do not enter a TUN tunnel. Joining networks over TUN requires static routes or dynamic routing protocols — more complex to configure than a TAP bridge.
Which adapter do WireGuard, OpenVPN, and other protocols use?
WireGuard uses only TUN — an architectural decision, not a user setting. OpenVPN supports both modes, with TUN as the default and recommended option. IKEv2/IPsec and L2TP use their own tunneling mechanisms without an exposed TUN/TAP interface.
WireGuard is TUN-only on every platform. On Linux it creates a wg0 interface in the kernel; on Windows it uses Wintun, a high-performance TUN driver built by the WireGuard team; on macOS it uses utun. There is no TAP mode in WireGuard.
OpenVPN lets you choose via a config directive: --dev tun (default) or --dev tap. Use TUN for remote access and standard VPN tunnels; use TAP only when you need to bridge two LAN segments into one Ethernet domain.
IKEv2/IPsec and L2TP/IPsec create their own virtual interface, hidden from the user. No TUN/TAP selection is exposed — the tunnel type is determined by the protocol itself.
When to use TAP, and when TUN
TUN is the right choice in 99% of cases — internet privacy, remote corporate access, mobile VPN apps, and anything based on WireGuard. TAP is a specialist tool for specific enterprise network scenarios.
Use TUN when:
- You need privacy and encrypted traffic — any consumer VPN scenario;
- Remote access to corporate resources (servers, web apps, APIs);
- You are using WireGuard — it only supports TUN;
- iOS or Android device — TAP is not available on mobile platforms.
Use TAP only when:
- You need to bridge two office LAN segments into a single Ethernet broadcast domain (LAN-to-LAN bridging);
- Applications rely on broadcast discovery (DHCP broadcast, NetBIOS, Bonjour);
- LAN-based games or legacy applications require Ethernet-level addressing;
- You must carry non-IP layer-2 protocols (old IPX/SPX or AppleTalk) across the tunnel.
TUN and TAP on Windows, macOS, Linux, and mobile
The implementation differs per platform, but the concept is the same: the VPN client installs a virtual network interface driver through which the OS routes encrypted traffic.
Windows: OpenVPN historically used TAP-Windows Adapter V9, an NDIS layer-2 Ethernet driver. Since OpenVPN 2.5+, and in the official WireGuard client, Wintun — a kernel-level TUN driver — is preferred. To inspect installed adapters: Win + R → ncpa.cpl — look for «TAP-Windows Adapter V9» or «WireGuard Tunnel».
macOS: uses the built-in utun mechanism (user-space TUN interface). Most VPN clients on macOS work through it without additional drivers.
Linux: TUN/TAP is implemented in the kernel via /dev/net/tun. A VPN process opens this device and creates a tunN or tapN interface. WireGuard on Linux 5.6+ is built directly into the kernel and creates a wg0 interface.
iOS and Android: mobile OSes expose a system VPN API that creates a TUN interface for apps. Installing a TAP driver on a smartphone is not possible — mobile kernels do not provide the required layer-2 access.
Wintun vs the classic TAP-Windows Adapter V9
Wintun outperforms TAP-Windows Adapter V9 on throughput, installation cleanliness, and code size. TAP-Windows V9 is a mature NDIS 6 layer-2 driver from the early 2000s — it works, but installation sometimes requires manual driver-signing confirmation and can conflict with certain antivirus configurations.
Wintun is a minimalist kernel-level TUN driver from the WireGuard team. It ships with the official WireGuard client for Windows and is supported in OpenVPN 2.5+. Advantages: higher throughput (fewer kernel/user-space context switches), installs without a reboot, and the codebase is far smaller and easier to security-audit. To enable Wintun in OpenVPN 2.5+, add windows-driver wintun to your .ovpn config.
Does the adapter choice affect speed or security?
Security is not affected by the adapter type — encryption strength depends on the protocol and cipher, not on whether you use TUN or TAP. Throughput and latency, however, do differ: TUN is generally faster than TAP.
Why TUN is faster:
- No L2 overhead: TAP adds a 14-byte Ethernet header to every frame and processes broadcast traffic that TUN simply never sees;
- Less fragmentation: TAP reduces the effective tunnel MTU, increasing packet fragmentation frequency and reassembly cost;
- Simpler MTU/MSS tuning: without Ethernet headers, the correct MTU for a TUN tunnel is easier to calculate and keeps reassembly low.
On typical consumer links (50–300 Mbps) the gap is minimal. On gigabit and enterprise-grade connections it becomes more noticeable. Explore LiMP VPN capabilities: LiMP VPN features. Choose a plan: LiMP VPN pricing.
How to fix common TAP adapter errors on Windows
The two most common TAP errors on Windows are «All TAP-Windows adapters are currently in use» and «An error occurred installing the TAP device driver». Both are fixable in five steps.
Step 1. Inspect adapters. Close the VPN client and open Network Connections with Win + R → ncpa.cpl. Count how many TAP-Windows Adapter V9 entries appear.
Step 2. «All TAP adapters are in use». Open the Add a new TAP virtual ethernet adapter utility from the OpenVPN install folder. Remove extra unused adapters, or add a new one if the existing adapter is held by another process.
Step 3. Driver installation error. Right-click the OpenVPN installer and choose Run as administrator. In the Windows security prompt, allow the driver to be installed.
Step 4. Switch to Wintun. In OpenVPN 2.5+, add windows-driver wintun to your .ovpn configuration file. Wintun installs cleanly without manual confirmation prompts and runs more stably than TAP-Windows V9.
Step 5. Restart your PC and reconnect. A full reboot guarantees that any process holding the adapter lock is terminated.
Do ordinary users need to choose between TUN and TAP?
No. In LiMP VPN and any other modern VPN app the adapter is selected automatically. WireGuard always creates a TUN interface — there is no user-facing choice. Manual TUN/TAP selection is only relevant when self-hosting an OpenVPN server for LAN-to-LAN bridging, which is a network administrator task.
If you use a ready-made VPN app, you never need to think about adapters — the interface type, protocol, and MTU are already optimized. Explore LiMP VPN: features and capabilities. Choose a plan: LiMP VPN pricing.
Frequently asked questions
What is the difference between TUN and TAP?
TUN operates at OSI layer 3 and carries IP packets (routing, point-to-point). TAP operates at OSI layer 2 and carries Ethernet frames, including non-IP traffic and broadcast packets. TUN is for standard VPN use; TAP is for bridging two LAN segments into one Ethernet domain.
Which adapter is better — TUN or TAP?
TUN for most cases: lower overhead, simpler routing, and supported on all platforms including mobile. TAP is only needed to bridge two LAN segments into a single Ethernet broadcast domain or to carry non-IP layer-2 protocols through the tunnel.
What is the TAP-Windows Adapter V9?
A virtual network driver shipped with OpenVPN for Windows that creates a layer-2 Ethernet interface visible in Network Connections. Since OpenVPN 2.5+ it can be replaced by Wintun — a faster kernel-level TUN driver from the WireGuard team.
Does WireGuard use TAP?
No. WireGuard is architecturally TUN-only across all platforms — Linux, Windows (via Wintun), macOS (utun), iOS, and Android. There is no TAP mode in WireGuard by design.