Skip to main content

tun

tun:
disabled: false
dev: nebula1
drop_local_broadcast: false
drop_multicast: false
tx_queue: 500
mtu: 1300
routes:
- mtu: 8800
route: 10.0.0.0/16
unsafe_routes:
- route: 172.16.1.0/24
via: 192.168.100.99
mtu: 1300 # mtu will default to tun mtu if this option is not specified
install: true # controls whether this route is installed in the systems routing table.

tun.disabled

Default: False

Allows the nebula interface (tun) to be disabled, which lets you run a lighthouse without a nebula interface (and therefore without root). You will not be able to communiate over IP with a nebula node that uses this setting.

tun.dev

dev sets the interface name for your nebula interface. If not set, a default will be chosen by the OS. For macOS: Not required. If set, must be in the form utun[0-9]+. For FreeBSD: Required to be set, must be in the form tun[0-9]+.

tun.drop_local_broadcast

Default: False

Toggles forwarding of local broadcast packets, the address of which depends on the ip/mask encoded in pki.cert

tun.drop_multicast

Default: False

Toggles forwarding of multicast packets

tun.tx_queue

Default: 500

Sets the transmit queue length, if you notice lots of transmit drops on the tun it may help to raise this number. Default is 500.

tun.mtu

Default: 1300 Reloadable: Linux

Default MTU for every packet, safe setting is (and the default) 1300 for internet routed packets.

tun.routes

Reloadable

Route based MTU overrides. If you have known VPN IP paths that can support larger MTUs you can increase/decrease them here.

tun:
routes:
- mtu: 8800
route: 10.0.0.0/16

tun.unsafe_routes

Reloadable
warning

The nebula certificate of the via node MUST have the route defined in the subnets list in its certificate or it will silently refuse to route traffic.

Unsafe routes allows you to route traffic over nebula to non-nebula nodes. Unsafe routes should be avoided unless you have hosts/services that cannot run nebula.

tun:
unsafe_routes:
- route: 172.16.1.0/24
via: 192.168.100.99
mtu: 1300
metric: 100
install: true # controls whether this route is installed in the systems routing table.

For more information, see the Extend network access beyond overlay hosts guide.

tun.use_system_route_table

Default: False

On Linux only, set to true to manage unsafe routes directly on the system route table with gateway routes instead of in nebula configuration files.