Skip to main content

tun

tun:
disabled: false
dev: nebula1
drop_local_broadcast: false
drop_multicast: false
tx_queue: 500
mtu: 1300
routes:
- mtu: 8800
route: 10.0.0.0/16
unsafe_routes:
- route: 172.16.1.0/24
via: 192.168.100.99
mtu: 1300 #mtu will default to tun mtu if this option is not specified

tun.disabled

Default: False

Allows the nebula interface (tun) to be disabled, which lets you run a lighthouse without a nebula interface (and therefore without root). You will not be able to communiate over IP with a nebula node that uses this setting.

tun.dev

dev sets the interface name for your nebula interface. If not set, a default will be chosen by the OS. For macOS: Not required. If set, must be in the form utun[0-9]+. For FreeBSD: Required to be set, must be in the form tun[0-9]+.

tun.drop_local_broadcast

Default: False

Toggles forwarding of local broadcast packets, the address of which depends on the ip/mask encoded in pki.cert

tun.drop_multicast

Default: False

Toggles forwarding of multicast packets

tun.tx_queue

Default: 500

Sets the transmit queue length, if you notice lots of transmit drops on the tun it may help to raise this number. Default is 500.

tun.mtu

Default: 1300

Default MTU for every packet, safe setting is (and the default) 1300 for internet routed packets.

tun.routes

Route based MTU overrides. If you have known VPN IP paths that can support larger MTUs you can increase/decrease them here.

tun:
routes:
- mtu: 8800
route: 10.0.0.0/16

tun.unsafe_routes

danger

The nebula certificate of the via node MUST have the route defined as a subnet in its certificate.

Unsafe routes allows you to route traffic over nebula to non-nebula nodes. Unsafe routes should be avoided unless you have hosts/services that cannot run nebula.

tun:
unsafe_routes:
- route: 172.16.1.0/24
via: 192.168.100.99
mtu: 1300
metric: 100