Make sure the module "tun" is loaded on the host.
vzctl set 2000 --devnodes net/tun:rw --save
*Note what's below is what OpenVZ says you need (but I've never had to do it)
vzctl exec 2000 mkdir -p /dev/net
vzctl exec 2000 mknod /dev/net/tun c 10 200
vzctl exec 2000 chmod 600 /dev/net/tun
On the container test the device:
when Something is wrong:
cat: /dev/net/tun: Permission denied
It's right and ready to use:
cat: /dev/net/tun: File descriptor in bad state
*remember again to make sure the "tun" module is loaded or it won't work and to add it to something like /etc/rc.local so it loads at boot time.