Synology: Load the TUN module automatically

On some Synology models the tun kernel module is not loaded automatically at boot, so /dev/net/tun is missing and the GateControl gateway container (or another TUN/VPN container) no longer starts after a reboot. This script loads the module on every system start via the DSM Task Scheduler.

For the background and full diagnosis, see the knowledge base article „GateControl Gateway no longer starts (/dev/net/tun missing)". Short answers to common questions are in the FAQ about the /dev/net/tun issue.

Setup (one-time)

1. Open Control Panel → Task Scheduler.
2. Create → Triggered Task → User-defined script.
3. General tab:
   • Task: Load TUN at boot
   • User: root
   • Event: Boot-up
4. Task Settings tab → User-defined script field: paste the complete content of the script below.
5. Save with OK (DSM may ask for your password to confirm — normal for root tasks).
6. Select the task and click Run to load the module immediately without a reboot.

Why not a package? DSM 7 does not allow unsigned packages to run as root. The Task Scheduler is the only path provided by Synology to run a root command at boot.

The script

#!/bin/sh
# ---------------------------------------------------------------------------
# load-tun.sh
#
# Provides /dev/net/tun on Synology DSM 7 by loading the TUN/TAP kernel
# module at system start. Required for TUN-based Docker containers such as
# the GateControl Gateway, WireGuard or OpenVPN.
#
# SETUP (one-time):
#   Control Panel -> Task Scheduler -> Create -> Triggered Task
#   -> User-defined script
#     - Event : Boot-up
#     - User  : root
#     - Script: paste the content of this file
#   Then select the task and "Run" it once to activate it immediately
#   without a reboot.
#
# Why not a package? DSM 7 does not allow unsigned packages to run as root.
# The Task Scheduler is the only path provided by Synology to run a root
# command at boot.
# ---------------------------------------------------------------------------

# 1. Load the TUN module. 'modprobe' first (it determines the correct module
#    path itself); if that fails, locate and load the module directly.
modprobe tun 2>/dev/null \
  || insmod "$(find /lib/modules -name 'tun.ko*' 2>/dev/null | head -1)" 2>/dev/null

# 2. Abort if the module could not be loaded (no dead device node, clear
#    error message in the system log).
if ! grep -q '^tun ' /proc/modules; then
    logger -t load-tun "ERROR: TUN module could not be loaded"
    exit 1
fi

# 3. Ensure the device node /dev/net/tun exists (usually created
#    automatically when the module loads; forced here as a safeguard).
[ -d /dev/net ]     || mkdir -p /dev/net
[ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200
chmod 0666 /dev/net/tun
logger -t load-tun "/dev/net/tun is ready"

# 4. (OPTIONAL – GateControl Gateway only) Start the gateway container after
#    loading. Remove the leading '#' if this task should also start the
#    container. Adjust the container name if needed.
# /usr/local/bin/docker start gatecontrol-gateway-gateway-1

exit 0

Verify the result

After running the task (or after the next reboot):

ls -l /dev/net/tun
# expected: crw-rw-rw- 1 root root 10, 200 ... /dev/net/tun

lsmod | grep -iw tun
# expected: a line starting with "tun"

Then start the GateControl gateway container — it should run as "Up / healthy" again.

⚠️ Important: Do not disable or delete the task. Otherwise /dev/net/tun will be missing again after the next reboot.