diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 0000000..408c0f3
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,4 @@
+[env]
+# Each interface needs 1 IP allocated to the WireGuard peer IP.
+# "8" = 7 tunnels per protocol.
+SMOLTCP_IFACE_MAX_ADDR_COUNT = "8"
diff --git a/.github/ci/macos-install-packages b/.github/ci/macos-install-packages
index afb1102..a4ece81 100755
--- a/.github/ci/macos-install-packages
+++ b/.github/ci/macos-install-packages
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-brew install asciidoctor
+# brew install asciidoctor
 
-brew install openssl@1.1
-cp /usr/local/opt/openssl@1.1/lib/pkgconfig/*.pc /usr/local/lib/pkgconfig/
+# brew install openssl@1.1
+# cp /usr/local/opt/openssl@1.1/lib/pkgconfig/*.pc /usr/local/lib/pkgconfig/
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..382be60
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "disabled"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fb404a0..e216219 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,7 +10,7 @@ jobs:
       matrix:
         rust:
           - stable
-          - 1.55.0
+          - 1.80.0
     steps:
       - name: Checkout sources
         uses: actions/checkout@v2
@@ -26,6 +26,12 @@ jobs:
         with:
           command: check
 
+      - name: Run cargo check without default features
+        uses: actions-rs/cargo@v1
+        with:
+          command: check
+          args: --no-default-features
+
   test:
     name: Test Suite
     runs-on: ubuntu-latest
@@ -33,7 +39,7 @@ jobs:
       matrix:
         rust:
           - stable
-          - 1.55.0
+          - 1.80.0
     steps:
       - name: Checkout sources
         uses: actions/checkout@v2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b3917b6..39b9be6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -61,7 +61,7 @@ jobs:
         run: echo "${{ env.VERSION }}" > artifacts/release-version
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@v4
         with:
           name: artifacts
           path: artifacts
@@ -75,20 +75,28 @@ jobs:
       RUST_BACKTRACE: 1
     strategy:
       matrix:
-        build: [ linux-amd64, macos-intel, windows ]
+        build: [ linux-amd64, linux-aarch64, macos-aarch64, windows ]
         include:
           - build: linux-amd64
-            os: ubuntu-18.04
+            os: ubuntu-latest
             rust: stable
             target: x86_64-unknown-linux-musl
-          - build: macos-intel
+            cross: true
+          - build: linux-aarch64
+            os: ubuntu-latest
+            rust: stable
+            target: aarch64-unknown-linux-musl
+            cross: true
+          - build: macos-aarch64
             os: macos-latest
             rust: stable
-            target: x86_64-apple-darwin
+            target: aarch64-apple-darwin
+            cross: false
           - build: windows
             os: windows-2019
             rust: stable
             target: x86_64-pc-windows-msvc
+            cross: false
 
     steps:
       - name: Checkout repository
@@ -97,7 +105,7 @@ jobs:
           fetch-depth: 1
 
       - name: Install packages (Ubuntu)
-        if: matrix.os == 'ubuntu-18.04'
+        if: matrix.os == 'ubuntu-latest'
         run: |
           .github/ci/ubuntu-install-packages
       - name: Install packages (macOS)
@@ -113,7 +121,7 @@ jobs:
           target: ${{ matrix.target }}
 
       - name: Get release download URL
-        uses: actions/download-artifact@v1
+        uses: actions/download-artifact@v4
         with:
           name: artifacts
           path: artifacts
@@ -126,17 +134,24 @@ jobs:
           echo "release upload url: $release_upload_url"
 
       - name: Build onetun binary
-        run: cargo build --release
+        shell: bash
+        run: |
+          if [ "${{ matrix.cross }}" = "true" ]; then
+            cargo install cross
+            cross build --release --target ${{ matrix.target }}
+          else
+            cargo build --release --target ${{ matrix.target }}
+          fi
 
       - name: Prepare onetun binary
         shell: bash
         run: |
           mkdir -p ci/assets
           if [ "${{ matrix.build }}" = "windows" ]; then
-            cp "target/release/onetun.exe" "ci/assets/onetun.exe"
+            cp "target/${{ matrix.target }}/release/onetun.exe" "ci/assets/onetun.exe"
             echo "ASSET=onetun.exe" >> $GITHUB_ENV
           else
-            cp "target/release/onetun" "ci/assets/onetun-${{ matrix.build }}"
+            cp "target/${{ matrix.target }}/release/onetun" "ci/assets/onetun-${{ matrix.build }}"
             echo "ASSET=onetun-${{ matrix.build }}" >> $GITHUB_ENV
           fi
 
diff --git a/.gitignore b/.gitignore
index 0333ac1..7a1777c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
 .envrc
 *.log
 *.pcap
+.DS_Store
diff --git a/Cargo.lock b/Cargo.lock
index b148531..f8e12f2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1,27 +1,58 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
+
+[[package]]
+name = "addr2line"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler2"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
+
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
 
 [[package]]
 name = "aho-corasick"
-version = "0.7.18"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
-name = "anyhow"
-version = "1.0.51"
+name = "anstyle"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b26702f315f53b6071259e15dd9d64528213b44d61de1ec926eca7715d62203"
+checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
 
 [[package]]
-name = "async-trait"
-version = "0.1.52"
+name = "anyhow"
+version = "1.0.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "061a7acccaa286c011ddc30970520b98fa40e00c9d644633fb26b5fc63a265e3"
+checksum = "dcfed56ad506cb2c684a14971b8861fdc3baaaae314b9e5f9bb532cbe3ba7a4f"
+
+[[package]]
+name = "async-recursion"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -29,27 +60,42 @@ dependencies = [
 ]
 
 [[package]]
-name = "atty"
-version = "0.2.14"
+name = "async-trait"
+version = "0.1.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+checksum = "d556ec1359574147ec0c4fc5eb525f3f23263a592b1a9c07e0a75b427de55c97"
 dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
 name = "autocfg"
-version = "1.0.1"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+
+[[package]]
+name = "backtrace"
+version = "0.3.74"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
+dependencies = [
+ "addr2line",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+ "windows-targets",
+]
 
 [[package]]
 name = "base64"
-version = "0.13.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "904dfeac50f3cdaba28fc6f57fdcddb75f49ed61346676a78c4ffe55877802fd"
+checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
 [[package]]
 name = "bitflags"
@@ -58,52 +104,79 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
-name = "boringtun"
-version = "0.4.0"
+name = "bitflags"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcaf3e6d388237249ec234ec6890bfc68634043f9b048011de8d0fc0025c3698"
+checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
 dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "boringtun"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "751787b019c674b9ac353f4eaa285e6711c21badb421cd8c199bf2c83b727f29"
+dependencies = [
+ "aead",
  "base64",
+ "blake2",
+ "chacha20poly1305",
  "hex",
+ "hmac",
  "ip_network",
  "ip_network_table",
- "jni",
  "libc",
- "parking_lot 0.12.0",
+ "nix",
+ "parking_lot",
+ "rand_core",
  "ring",
  "tracing",
  "untrusted 0.9.0",
+ "x25519-dalek",
 ]
 
 [[package]]
 name = "bumpalo"
-version = "3.8.0"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f1e260c3a9040a7c19a12468758f4c16f31a81a1fe087482be9570ec864bb6c"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "byteorder"
-version = "1.4.3"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.1.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4872d67bab6358e59559027aa3b9157c53d9358c51423c17554809a8858e0f8"
+checksum = "325918d6fe32f23b19878fe4b34794ae41fc19ddbe53b10571a4874d44ffd39b"
 
 [[package]]
 name = "cc"
-version = "1.0.72"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22a9137b95ea06864e018375b72adfb7db6e6f68cfc8df5a04d00288050485ee"
-
-[[package]]
-name = "cesu8"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+checksum = "f34d93e62b03caf570cccc334cbc6c2fceca82f39211051345108adcba3eebdc"
+dependencies = [
+ "shlex",
+]
 
 [[package]]
 name = "cfg-if"
@@ -112,45 +185,197 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
-name = "clap"
-version = "2.34.0"
+name = "chacha20"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
 dependencies = [
- "bitflags",
- "strsim",
- "textwrap",
- "unicode-width",
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
 ]
 
 [[package]]
-name = "combine"
-version = "4.6.3"
+name = "chacha20poly1305"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50b727aacc797f9fc28e355d21f34709ac4fc9adecfe470ad07b8f4464f53062"
+checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
 dependencies = [
- "bytes",
- "memchr",
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+ "zeroize",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+ "zeroize",
+]
+
+[[package]]
+name = "clap"
+version = "4.5.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb3b4b9e5a7c7514dfa52869339ee98b3156b0bfb4e8a77c4ff4babb64b1604f"
+dependencies = [
+ "clap_builder",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b17a95aa67cc7b5ebd32aa5370189aa0d79069ef1c64ce893bd30fb24bff20ec"
+dependencies = [
+ "anstyle",
+ "clap_lex",
+ "strsim",
+ "terminal_size",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "afb84c814227b90d6895e01398aee0d8033c00e7466aca416fb6a8e0eb19d8a7"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16b80225097f2e5ae4e7179dd2266824648f3e2f49d9134d584b76389d31c4c3"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "rand_core",
+ "typenum",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.0.0-rc.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "436ace70fc06e06f7f689d2624dc4e2f0ea666efb5aa704215f7249ae6e047a7"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "fiat-crypto",
+ "platforms",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "defmt"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86f6162c53f659f65d00619fe31f14556a6e9f8752ccc4a41bd177ffcf3d6130"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d135dd939bad62d7490b0002602d35b358dce5fd9233a709d3c1ef467d4bde6"
+dependencies = [
+ "defmt-parser",
+ "proc-macro-error2",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3983b127f13995e68c1e29071e5d115cd96f215ccb5e6812e3728cd6f92653b3"
+dependencies = [
+ "thiserror",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+ "subtle",
 ]
 
 [[package]]
 name = "env_logger"
-version = "0.7.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
+checksum = "4cd405aab171cb85d6735e5c8d9db038c17d3ca007a4d2c25f337935c3d90580"
 dependencies = [
- "atty",
  "humantime",
+ "is-terminal",
  "log",
  "regex",
  "termcolor",
 ]
 
 [[package]]
-name = "futures"
-version = "0.3.19"
+name = "equivalent"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28560757fe2bb34e79f907794bb6b22ae8b0e5c669b638a1132f2592b19035b4"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "errno"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33d852cb9b869c2a9b3df2f71a3074817f01e1844f839a144f5fcef059a4eb5d"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "fiat-crypto"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e825f6987101665dea6ec934c09ec6d721de7bc1bf92248e1d5810c8cd636b77"
+
+[[package]]
+name = "futures"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -163,9 +388,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.19"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba3dda0b6588335f360afc675d0564c17a77a2bda81ca178a4b6081bd86c7f0b"
+checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -173,15 +398,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.19"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0c8ff0461b82559810cdccfde3215c3f373807f5e5232b71479bff7bb2583d7"
+checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.19"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29d6d2ff5bb10fb95c85b8ce46538a2e5f5e7fdc755623a7d4529ab8a4ed9d2a"
+checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -190,15 +415,15 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.19"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f9d34af5a1aac6fb380f735fe510746c38067c5bf16c7fd250280503c971b2"
+checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.19"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dbd947adfffb0efc70599b3ddcf7b5597bb5fa9e245eb99f62b3a5f7bb8bd3c"
+checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -207,21 +432,21 @@ dependencies = [
 
 [[package]]
 name = "futures-sink"
-version = "0.3.19"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3055baccb68d74ff6480350f8d6eb8fcfa3aa11bdc1a1ae3afdd0514617d508"
+checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
 
 [[package]]
 name = "futures-task"
-version = "0.3.19"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ee7c6485c30167ce4dfb83ac568a849fe53274c831081476ee13e0dce1aad72"
+checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
 
 [[package]]
 name = "futures-util"
-version = "0.3.19"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b5cf40b47a271f77a8b1bec03ca09044d99d2372c0de244e66430761127164"
+checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -236,10 +461,20 @@ dependencies = [
 ]
 
 [[package]]
-name = "getrandom"
-version = "0.2.3"
+name = "generic-array"
+version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
  "libc",
@@ -247,19 +482,41 @@ dependencies = [
 ]
 
 [[package]]
-name = "hashbrown"
-version = "0.11.2"
+name = "gimli"
+version = "0.31.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab5ef0d4909ef3724cc8cce6ccc8572c5c817592e9285f5464f8e86f8bd3726e"
+checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+
+[[package]]
+name = "hash32"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d60b12902ba28e2730cd37e95b8c9223af2808df9e902d4df49588d1470606"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+
+[[package]]
+name = "heapless"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad"
+dependencies = [
+ "hash32",
+ "stable_deref_trait",
+]
 
 [[package]]
 name = "hermit-abi"
-version = "0.1.19"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
+checksum = "fbf6a919d6cf397374f7dfeeea91d974c7c0a7221d0d0f4f20d859d329e53fcc"
 
 [[package]]
 name = "hex"
@@ -268,31 +525,37 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
-name = "humantime"
-version = "1.3.0"
+name = "hmac"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "quick-error",
+ "digest",
 ]
 
 [[package]]
-name = "indexmap"
-version = "1.7.0"
+name = "humantime"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc633605454125dec4b66843673f01c7df2b89479b32e0ed634e43a91cff62a5"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+
+[[package]]
+name = "indexmap"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62f822373a4fe84d4bb149bf54e584a7f4abec90e072ed49cda0edea5b95471f"
 dependencies = [
- "autocfg",
+ "equivalent",
  "hashbrown",
 ]
 
 [[package]]
-name = "instant"
-version = "0.1.12"
+name = "inout"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
 dependencies = [
- "cfg-if",
+ "generic-array",
 ]
 
 [[package]]
@@ -318,63 +581,53 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e537132deb99c0eb4b752f0346b6a836200eaaa3516dd7e5514b63930a09e5d"
 
 [[package]]
-name = "jni"
-version = "0.19.0"
+name = "is-terminal"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6df18c2e3db7e453d3c6ac5b3e9d5182664d28788126d39b91f2d1e22b017ec"
+checksum = "261f68e344040fbd0edea105bef17c66edf46f984ddb1115b775ce31be948f4b"
 dependencies = [
- "cesu8",
- "combine",
- "jni-sys",
- "log",
- "thiserror",
- "walkdir",
+ "hermit-abi",
+ "libc",
+ "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "jni-sys"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
-
 [[package]]
 name = "js-sys"
-version = "0.3.55"
+version = "0.3.74"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cc9ffccd38c451a86bf13657df244e9c3f37493cce8e5e21e940963777acc84"
+checksum = "a865e038f7f6ed956f788f0d7d60c541fff74c7bd74272c5d4cf15c63743e705"
 dependencies = [
+ "once_cell",
  "wasm-bindgen",
 ]
 
 [[package]]
-name = "lazy_static"
-version = "1.4.0"
+name = "libc"
+version = "0.2.170"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+checksum = "875b3680cb2f8f71bdcf9a30f38d48282f5d3c95cbf9b3fa57269bb5d5c06828"
 
 [[package]]
-name = "libc"
-version = "0.2.112"
+name = "linux-raw-sys"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b03d17f364a3a042d5e5d46b053bbbf82c92c9430c592dd4c064dc6ee997125"
+checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
 
 [[package]]
 name = "lock_api"
-version = "0.4.6"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88943dd7ef4a2e5a4bfa2753aaab3013e34ce2533d1996fb18ef591e315e2b3b"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
 dependencies = [
+ "autocfg",
  "scopeguard",
 ]
 
 [[package]]
 name = "log"
-version = "0.4.14"
+version = "0.4.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
-dependencies = [
- "cfg-if",
-]
+checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
 
 [[package]]
 name = "managed"
@@ -384,9 +637,9 @@ checksum = "0ca88d725a0a943b096803bd34e73a4437208b6077654cc4ecb2947a5f91618d"
 
 [[package]]
 name = "memchr"
-version = "2.4.1"
+version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
 
 [[package]]
 name = "minimal-lexical"
@@ -395,70 +648,72 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
-name = "mio"
-version = "0.7.14"
+name = "miniz_oxide"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8067b404fe97c70829f082dec8bcf4f71225d7eaea1d8645349cb76fa06205cc"
+checksum = "e2d80299ef12ff69b16a84bb182e3b9df68b5a91574d3d4fa6e41b65deec4df1"
 dependencies = [
- "libc",
- "log",
- "miow",
- "ntapi",
- "winapi",
+ "adler2",
 ]
 
 [[package]]
-name = "miow"
-version = "0.3.7"
+name = "mio"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9f1c5b025cda876f66ef43a113f91ebc9f4ccef34843000e0adf6ebbab84e21"
+checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
 dependencies = [
- "winapi",
+ "libc",
+ "wasi",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "nix"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f346ff70e7dbfd675fe90590b92d59ef2de15a8779ae305ebcbfd3f0caf59be4"
+dependencies = [
+ "autocfg",
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
 ]
 
 [[package]]
 name = "nom"
-version = "7.1.0"
+version = "7.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b1d11e1ef389c76fe5b81bcaf2ea32cf88b62bc494e19f493d0b30e7a930109"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
 dependencies = [
  "memchr",
  "minimal-lexical",
- "version_check",
 ]
 
 [[package]]
-name = "ntapi"
-version = "0.3.6"
+name = "object"
+version = "0.36.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f6bb902e437b6d86e03cce10a7e2af662292c5dfef23b65899ea3ac9354ad44"
+checksum = "aedf0a2d09c573ed1d8d85b30c119153926a2b36dce0ab28322c09a117a4683e"
 dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "num_cpus"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05499f3756671c15885fee9034446956fff3f243d6077b91e5767df161f766b3"
-dependencies = [
- "hermit-abi",
- "libc",
+ "memchr",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.9.0"
+version = "1.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da32515d9f6e6e489d7bc9d84c71b060db7247dc035bbe44eac88cf87486d8d5"
+checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
 
 [[package]]
 name = "onetun"
-version = "0.3.0"
+version = "0.3.10"
 dependencies = [
  "anyhow",
+ "async-recursion",
  "async-trait",
+ "base64",
  "boringtun",
+ "bytes",
  "clap",
  "futures",
  "log",
@@ -468,61 +723,43 @@ dependencies = [
  "rand",
  "smoltcp",
  "tokio",
+ "tracing",
 ]
 
 [[package]]
-name = "parking_lot"
-version = "0.11.2"
+name = "opaque-debug"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core 0.8.5",
-]
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "parking_lot"
-version = "0.12.0"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87f5ec2493a61ac0506c0f4199f99070cbe83857b0337006a30f3e6719b8ef58"
+checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
 dependencies = [
  "lock_api",
- "parking_lot_core 0.9.1",
+ "parking_lot_core",
 ]
 
 [[package]]
 name = "parking_lot_core"
-version = "0.8.5"
+version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall",
- "smallvec",
- "winapi",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28141e0cc4143da2443301914478dc976a61ffdb3f043058310c70df2fed8954"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
 dependencies = [
  "cfg-if",
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-sys",
+ "windows-targets",
 ]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.7"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d31d11c69a6b52a174b42bdc0c30e5e11670f90788b2c471c31c1d17d449443"
+checksum = "915a1e146535de9163f3987b8944ed8cf49a18bb0056bcebcdcece385cece4ff"
 
 [[package]]
 name = "pin-utils"
@@ -531,16 +768,36 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
-name = "ppv-lite86"
-version = "0.2.15"
+name = "platforms"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed0cfbc8191465bed66e1718596ee0b0b35d5ee1f41c5df2189d0fe8bde535ba"
+checksum = "d43467300237085a4f9e864b937cf0bc012cef7740be12be1a48b10d2c8a3701"
+
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+dependencies = [
+ "zerocopy",
+]
 
 [[package]]
 name = "pretty_env_logger"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "926d36b9553851b8b0005f1275891b392ee4d2d833852c417ed025477350fb9d"
+checksum = "865724d4dbe39d9f3dd3b52b88d859d66bcb2d6a0acfd5ea68a65fb66d4bdc1c"
 dependencies = [
  "env_logger",
  "log",
@@ -548,48 +805,64 @@ dependencies = [
 
 [[package]]
 name = "priority-queue"
-version = "1.2.1"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00ba480ac08d3cfc40dea10fd466fd2c14dee3ea6fc7873bc4079eda2727caf0"
+checksum = "714c75db297bc88a63783ffc6ab9f830698a6705aa0201416931759ef4c8183d"
 dependencies = [
  "autocfg",
+ "equivalent",
  "indexmap",
 ]
 
 [[package]]
-name = "proc-macro2"
-version = "1.0.34"
+name = "proc-macro-error-attr2"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f84e92c0f7c9d58328b85a78557813e4bd845130db68d7184635344399423b1"
+checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
 dependencies = [
- "unicode-xid",
+ "proc-macro2",
+ "quote",
 ]
 
 [[package]]
-name = "quick-error"
-version = "1.2.3"
+name = "proc-macro-error2"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
+dependencies = [
+ "proc-macro-error-attr2",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
+dependencies = [
+ "unicode-ident",
+]
 
 [[package]]
 name = "quote"
-version = "1.0.10"
+version = "1.0.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
 dependencies = [
  "proc-macro2",
 ]
 
 [[package]]
 name = "rand"
-version = "0.8.4"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e7573632e6454cf6b99d7aac4ccca54be06da05aca2ef7423d22d27d4d4bcd8"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
  "rand_chacha",
  "rand_core",
- "rand_hc",
 ]
 
 [[package]]
@@ -604,36 +877,39 @@ dependencies = [
 
 [[package]]
 name = "rand_core"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d34f1408f55294453790c48b2f1ebbb1c5b4b7563eb1f418bcfcfdbb06ebb4e7"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
  "getrandom",
 ]
 
-[[package]]
-name = "rand_hc"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d51e9f596de227fda2ea6c84607f5558e196eeaf43c986b724ba4fb8fdf497e7"
-dependencies = [
- "rand_core",
-]
-
 [[package]]
 name = "redox_syscall"
-version = "0.2.10"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
+checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
 dependencies = [
- "bitflags",
+ "bitflags 2.6.0",
 ]
 
 [[package]]
 name = "regex"
-version = "1.5.4"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -642,9 +918,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.6.25"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
 
 [[package]]
 name = "ring"
@@ -662,52 +938,109 @@ dependencies = [
 ]
 
 [[package]]
-name = "same-file"
-version = "1.0.6"
+name = "rustc-demangle"
+version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
 dependencies = [
- "winapi-util",
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7f649912bc1495e167a6edee79151c84b1bad49748cb4f1f1167f459f6224f6"
+dependencies = [
+ "bitflags 2.6.0",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "scopeguard"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
-name = "signal-hook-registry"
-version = "1.4.0"
+name = "semver"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51e73328dc4ac0c7ccbda3a494dfa03df1de2f46018127f60c693f2648455b0"
+checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
+
+[[package]]
+name = "serde"
+version = "1.0.215"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f"
 dependencies = [
- "libc",
+ "serde_derive",
 ]
 
 [[package]]
-name = "slab"
-version = "0.4.5"
+name = "serde_derive"
+version = "1.0.215"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9def91fd1e018fe007022791f865d0ccc9b3a0d5001e01aabb8b40e46000afb5"
+checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "slab"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
+dependencies = [
+ "autocfg",
+]
 
 [[package]]
 name = "smallvec"
-version = "1.7.0"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ecab6c735a6bb4139c0caafd0cc3635748bbb3acf4550e8138122099251f309"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "smoltcp"
-version = "0.8.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2308a1657c8db1f5b4993bab4e620bdbe5623bd81f254cf60326767bb243237"
+checksum = "dad095989c1533c1c266d9b1e8d70a1329dd3723c3edac6d03bbd67e7bf6f4bb"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "byteorder",
+ "cfg-if",
+ "defmt",
+ "heapless",
  "log",
  "managed",
- "rand_core",
+]
+
+[[package]]
+name = "socket2"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c970269d99b64e60ec3bd6ad27270092a5394c4e309314b18ae3fe575695fbe8"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -717,54 +1050,67 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
 
 [[package]]
-name = "strsim"
-version = "0.8.0"
+name = "stable_deref_trait"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "1.0.82"
+version = "2.0.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8daf5dd0bb60cbd4137b1b587d2fc0ae729bc07cf01cd70b36a1ed5ade3b9d59"
+checksum = "919d3b74a5dd0ccd15aeb8f93e7006bd9e14c295087c9896a110f490752bcf31"
 dependencies = [
  "proc-macro2",
  "quote",
- "unicode-xid",
+ "unicode-ident",
 ]
 
 [[package]]
 name = "termcolor"
-version = "1.1.2"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dfed899f0eb03f32ee8c6a0aabdb8a7949659e3466561fc0adf54e26d88c5f4"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
 dependencies = [
  "winapi-util",
 ]
 
 [[package]]
-name = "textwrap"
-version = "0.11.0"
+name = "terminal_size"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+checksum = "5352447f921fda68cf61b4101566c0bdb5104eff6804d0678e5227580ab6a4e9"
 dependencies = [
- "unicode-width",
+ "rustix",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "thiserror"
-version = "1.0.30"
+version = "2.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
+checksum = "c006c85c7651b3cf2ada4584faa36773bd07bac24acfb39f3c431b36d7e667aa"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.30"
+version = "2.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
+checksum = "f077553d607adc1caf65430528a576c757a71ed73944b66ebb58ef2bbd243568"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -773,28 +1119,25 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.15.0"
+version = "1.44.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbbf1c778ec206785635ce8ad57fe52b3009ae9e0c9f574a728f3049d3e55838"
+checksum = "9975ea0f48b5aa3972bf2d888c238182458437cc2a19374b81b25cdf1023fb3a"
 dependencies = [
+ "backtrace",
  "bytes",
  "libc",
- "memchr",
  "mio",
- "num_cpus",
- "once_cell",
- "parking_lot 0.11.2",
  "pin-project-lite",
- "signal-hook-registry",
+ "socket2",
  "tokio-macros",
- "winapi",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "1.7.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b557f72f448c511a979e2564e55d74e6c4432fc96ff4f6241bc6bded342643b7"
+checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -803,11 +1146,11 @@ dependencies = [
 
 [[package]]
 name = "tracing"
-version = "0.1.30"
+version = "0.1.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d8d93354fe2a8e50d5953f5ae2e47a3fc2ef03292e7ea46e3cc38f549525fb9"
+checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
 dependencies = [
- "cfg-if",
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -815,9 +1158,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.19"
+version = "0.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8276d9a4a3a558d7b7ad5303ad50b53d58264641b82914b7ada36bd762e7a716"
+checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -826,24 +1169,34 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.22"
+version = "0.1.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03cfcb51380632a72d3111cb8d3447a8d908e577d31beeac006f836383d29a23"
+checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
 dependencies = [
- "lazy_static",
+ "once_cell",
 ]
 
 [[package]]
-name = "unicode-width"
-version = "0.1.9"
+name = "typenum"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
-name = "unicode-xid"
-version = "0.2.2"
+name = "unicode-ident"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
 
 [[package]]
 name = "untrusted"
@@ -859,46 +1212,36 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "version_check"
-version = "0.9.3"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fecdca9a5291cc2b8dcf7dc02453fee791a280f3743cb0905f8822ae463b3fe"
-
-[[package]]
-name = "walkdir"
-version = "2.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "808cf2735cd4b6866113f648b791c6adc5714537bc222d9347bb203386ffda56"
-dependencies = [
- "same-file",
- "winapi",
- "winapi-util",
-]
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
 name = "wasi"
-version = "0.10.2+wasi-snapshot-preview1"
+version = "0.11.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.78"
+version = "0.2.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "632f73e236b219150ea279196e54e610f5dbafa5d61786303d4da54f84e47fce"
+checksum = "d15e63b4482863c109d70a7b8706c1e364eb6ea449b201a76c5b89cedcec2d5c"
 dependencies = [
  "cfg-if",
+ "once_cell",
  "wasm-bindgen-macro",
 ]
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.78"
+version = "0.2.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a317bf8f9fba2476b4b2c85ef4c4af8ff39c3c7f0cdfeed4f82c34a880aa837b"
+checksum = "8d36ef12e3aaca16ddd3f67922bc63e48e953f126de60bd33ccc0101ef9998cd"
 dependencies = [
  "bumpalo",
- "lazy_static",
  "log",
+ "once_cell",
  "proc-macro2",
  "quote",
  "syn",
@@ -907,9 +1250,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.78"
+version = "0.2.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d56146e7c495528bf6587663bea13a8eb588d39b36b679d83972e1a2dbbdacf9"
+checksum = "705440e08b42d3e4b36de7d66c944be628d579796b8090bfa3471478a2260051"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -917,9 +1260,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.78"
+version = "0.2.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7803e0eea25835f8abdc585cd3021b3deb11543c6fe226dcd30b228857c5c5ab"
+checksum = "98c9ae5a76e46f4deecd0f0255cc223cfa18dc9b261213b8aa0c7b36f61b3f1d"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -930,15 +1273,15 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.78"
+version = "0.2.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0237232789cf037d5480773fe568aac745bfe2afbc11a863e97901780a6b47cc"
+checksum = "6ee99da9c5ba11bd675621338ef6fa52296b76b83305e9b6e5c77d4c286d6d49"
 
 [[package]]
 name = "web-sys"
-version = "0.3.55"
+version = "0.3.74"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38eb105f1c59d9eaa6b5cdc92b859d85b926e82cb2e0945cd0c9259faa6fe9fb"
+checksum = "a98bc3c33f0fe7e59ad7cd041b89034fa82a7c2d4365ca538dda6cdaf513863c"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -962,11 +1305,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.5"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "winapi",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -977,43 +1320,135 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows-sys"
-version = "0.32.0"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3df6e476185f92a12c072be4a189a0210dcdcf512a1891d6dff9edb874deadc6"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
  "windows_aarch64_msvc",
  "windows_i686_gnu",
+ "windows_i686_gnullvm",
  "windows_i686_msvc",
  "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
  "windows_x86_64_msvc",
 ]
 
 [[package]]
-name = "windows_aarch64_msvc"
-version = "0.32.0"
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8e92753b1c443191654ec532f14c199742964a061be25d77d7a96f09db20bf5"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.32.0"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a711c68811799e017b6038e0922cb27a5e2f43a2ddb609fe0b6f3eeda9de615"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.32.0"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "146c11bb1a02615db74680b32a68e2d61f553cc24c4eb5b4ca10311740e44172"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.32.0"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c912b12f7454c6620635bbff3450962753834be2a594819bd5e945af18ec64bc"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.32.0"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "504a2476202769977a040c6364301a3f65d0cc9e3fb08600b2bda150a0488316"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "x25519-dalek"
+version = "2.0.0-rc.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec7fae07da688e17059d5886712c933bb0520f15eff2e09cfa18e30968f4e63a"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core",
+ "serde",
+ "zeroize",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+dependencies = [
+ "byteorder",
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
diff --git a/Cargo.toml b/Cargo.toml
index aeeb8fc..ffb8a64 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "onetun"
-version = "0.3.0"
-edition = "2018"
+version = "0.3.10"
+edition = "2021"
 license = "MIT"
 description = "A cross-platform, user-space WireGuard port-forwarder that requires no system network configurations."
 authors = ["Aram Peres <aram.peres@gmail.com>"]
@@ -10,15 +10,39 @@ repository = "https://github.com/aramperes/onetun"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-boringtun = { version = "0.4.0", default-features = false }
-clap = { version = "2.33", default-features = false, features = ["suggestions"] }
+# Required dependencies (bin and lib)
+boringtun = { version = "0.6.0", default-features = false }
 log = "0.4"
-pretty_env_logger = "0.4"
 anyhow = "1"
-smoltcp = { version = "0.8.0", default-features = false, features = ["std", "log", "medium-ip", "proto-ipv4", "proto-ipv6", "socket-udp", "socket-tcp"] }
-tokio = { version = "1", features = ["full"] }
-futures = "0.3.17"
-rand = "0.8.4"
+tokio = { version = "1", features = [ "rt", "sync", "io-util", "net", "time", "fs", "macros" ] }
+futures = "0.3"
+rand = "0.8"
 nom = "7"
-async-trait = "0.1.51"
-priority-queue = "1.2.0"
+async-trait = "0.1"
+priority-queue = "2.1"
+smoltcp = { version = "0.12", default-features = false, features = [
+    "std",
+    "log",
+    "medium-ip",
+    "proto-ipv4",
+    "proto-ipv6",
+    "socket-udp",
+    "socket-tcp",
+] }
+bytes = "1"
+base64 = "0.13"
+
+# forward boringtuns tracing events to log
+tracing = { version = "0.1", default-features = false, features = ["log"] }
+
+# bin-only dependencies
+clap = { version = "4.4.11", default-features = false, features = ["suggestions", "std", "env", "help", "wrap_help"], optional = true }
+pretty_env_logger = { version = "0.5", optional = true }
+async-recursion = "1.0"
+
+[features]
+pcap = []
+default = [ "bin" ]
+bin = [ "clap", "pretty_env_logger", "pcap", "tokio/rt-multi-thread" ]
+
+[lib]
diff --git a/Dockerfile b/Dockerfile
index 9edc22a..90f851d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,11 @@
-FROM rust:1.55 as cargo-build
+FROM rust:1.82.0 as cargo-build
 
 WORKDIR /usr/src/onetun
 COPY Cargo.toml Cargo.toml
 
 # Placeholder to download dependencies and cache them using layering
 RUN mkdir src/
+RUN touch src/lib.rs
 RUN echo "fn main() {println!(\"if you see this, the build broke\")}" > src/main.rs
 RUN cargo build --release
 RUN rm -f target/x86_64-unknown-linux-musl/release/deps/myapp*
@@ -14,8 +15,9 @@ COPY . .
 RUN cargo build --release
 
 FROM debian:11-slim
-RUN apt-get update
-RUN apt-get install dumb-init -y
+RUN apt-get update \
+    && apt-get install dumb-init -y \
+    && rm -rf /var/lib/apt/lists/*
 
 COPY --from=cargo-build /usr/src/onetun/target/release/onetun /usr/local/bin/onetun
 
diff --git a/LICENSE b/LICENSE
index 7479b85..d57c948 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021 Aram Peres
+Copyright (c) 2025 Aram Peres
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/README.md b/README.md
index 676091d..58204f6 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 # onetun
 
-A cross-platform, user-space WireGuard port-forwarder that requires no system network configurations.
+A cross-platform, user-space WireGuard port-forwarder that requires **no root-access or system network configurations**.
 
 [![crates.io](https://img.shields.io/crates/v/onetun.svg)](https://crates.io/crates/onetun)
 [![MIT licensed](https://img.shields.io/crates/l/onetun.svg)](./LICENSE)
@@ -11,38 +11,38 @@ A cross-platform, user-space WireGuard port-forwarder that requires no system ne
 
 ## Use-case
 
-- You have an existing WireGuard endpoint (router), accessible using its UDP endpoint (typically port 51820); and
-- You have a peer on the WireGuard network, running a TCP or UDP service on a port accessible to the WireGuard network; and
-- You want to access this TCP or UDP service from a second computer, on which you can't install WireGuard because you
-  can't (no root access) or don't want to (polluting OS configs).
+Access TCP or UDP services running on your WireGuard network, from devices that don't have WireGuard installed.
 
-For example, this can be useful to forward a port from a Kubernetes cluster to a server behind WireGuard,
-without needing to install WireGuard in a Pod.
+For example,
+
+- Personal or shared computers where you can't install WireGuard (root)
+- IoT and mobile devices
+- Root-less containers
 
 ## Download
 
-onetun is available to install from [crates.io](https://crates.io/crates/onetun) with Rust ≥1.55:
+onetun is available to install from [crates.io](https://crates.io/crates/onetun) with Rust ≥1.80.0:
 
 ```shell
-$ cargo install onetun
+cargo install onetun
 ```
 
-You can also download the binary for Windows, macOS (Intel), and Linux (amd64) from
+You can also download the binary for Windows, macOS (Apple Silicon), and Linux (amd64, arm64) from
 the [Releases](https://github.com/aramperes/onetun/releases) page.
 
 You can also run onetun using [Docker](https://hub.docker.com/r/aramperes/onetun):
 
 ```shell
 docker run --rm --name onetun --user 1000 -p 8080:8080 aramperes/onetun \
-       0.0.0.0:8080:192.168.4.2:8080 [...options...]
+    0.0.0.0:8080:192.168.4.2:8080 [...options...]
 ```
 
-You can also build onetun locally, using Rust ≥1.55:
+You can also build onetun locally, using Rust ≥1.80.0:
 
 ```shell
-$ git clone https://github.com/aramperes/onetun && cd onetun
-$ cargo build --release
-$ ./target/release/onetun
+git clone https://github.com/aramperes/onetun && cd onetun
+cargo build --release
+./target/release/onetun
 ```
 
 ## Usage
@@ -54,14 +54,14 @@ access, or install any WireGuard tool on your local system for it to work.
 The only prerequisite is to register a peer IP and public key on the remote WireGuard endpoint; those are necessary for
 the WireGuard endpoint to trust the onetun peer and for packets to be routed.
 
-```
+```shell
 onetun [src_host:]<src_port>:<dst_host>:<dst_port>[:TCP,UDP,...] [...]    \
     --endpoint-addr <public WireGuard endpoint address>                   \
     --endpoint-public-key <the public key of the peer on the endpoint>    \
     --private-key <private key assigned to onetun>                        \
     --source-peer-ip <IP assigned to onetun>                              \
     --keep-alive <optional persistent keep-alive in seconds>              \
-    --log <optional log level, defaults to "info"
+    --log <optional log level, defaults to "info">
 ```
 
 > Note: you can use environment variables for all of these flags. Use `onetun --help` for details.
@@ -70,7 +70,7 @@ onetun [src_host:]<src_port>:<dst_host>:<dst_port>[:TCP,UDP,...] [...]    \
 
 Suppose your WireGuard endpoint has the following configuration, and is accessible from `140.30.3.182:51820`:
 
-```
+```shell
 # /etc/wireguard/wg0.conf
 
 [Interface]
@@ -103,14 +103,14 @@ onetun 127.0.0.1:8080:192.168.4.2:8080                                    \
 
 You'll then see this log:
 
-```
+```shell
 INFO  onetun > Tunneling TCP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
 ```
 
 Which means you can now access the port locally!
 
-```
-$ curl 127.0.0.1:8080
+```shell
+curl 127.0.0.1:8080
 Hello world!
 ```
 
@@ -118,24 +118,32 @@ Hello world!
 
 **onetun** supports running multiple tunnels in parallel. For example:
 
-```
-$ onetun 127.0.0.1:8080:192.168.4.2:8080 127.0.0.1:8081:192.168.4.4:8081
+```shell
+onetun 127.0.0.1:8080:192.168.4.2:8080 127.0.0.1:8081:192.168.4.4:8081
 INFO  onetun::tunnel > Tunneling TCP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
 INFO  onetun::tunnel > Tunneling TCP [127.0.0.1:8081]->[192.168.4.4:8081] (via [140.30.3.182:51820] as peer 192.168.4.3)
 ```
 
 ... would open TCP ports 8080 and 8081 locally, which forward to their respective ports on the different peers.
 
+#### Maximum number of tunnels
+
+`smoltcp` imposes a compile-time limit on the number of IP addresses assigned to an interface. **onetun** increases
+the default value to support most use-cases. In effect, the default limit on the number of **onetun** peers
+is **7 per protocol** (TCP and UDP).
+
+Should you need more unique IP addresses to forward ports to, you can increase the limit in `.cargo/config.toml` and recompile **onetun**.
+
 ### UDP Support
 
 **onetun** supports UDP forwarding. You can add `:UDP` at the end of the port-forward configuration, or `UDP,TCP` to support
 both protocols on the same port (note that this opens 2 separate tunnels, just on the same port)
 
-```
-$ onetun 127.0.0.1:8080:192.168.4.2:8080:UDP
+```shell
+onetun 127.0.0.1:8080:192.168.4.2:8080:UDP
 INFO  onetun::tunnel > Tunneling UDP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
 
-$ onetun 127.0.0.1:8080:192.168.4.2:8080:UDP,TCP
+onetun 127.0.0.1:8080:192.168.4.2:8080:UDP,TCP
 INFO  onetun::tunnel > Tunneling UDP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
 INFO  onetun::tunnel > Tunneling TCP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
 ```
@@ -147,16 +155,16 @@ it in any production capacity.
 
 **onetun** supports both IPv4 and IPv6. In fact, you can use onetun to forward some IP version to another, e.g. 6-to-4:
 
-```
-$ onetun [::1]:8080:192.168.4.2:8080
+```shell
+onetun [::1]:8080:192.168.4.2:8080
 INFO  onetun::tunnel > Tunneling TCP [[::1]:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
 ```
 
 Note that each tunnel can only support one "source" IP version and one "destination" IP version. If you want to support
 both IPv4 and IPv6 on the same port, you should create a second port-forward:
 
-```
-$ onetun [::1]:8080:192.168.4.2:8080 127.0.0.1:8080:192.168.4.2:8080
+```shell
+onetun [::1]:8080:192.168.4.2:8080 127.0.0.1:8080:192.168.4.2:8080
 INFO  onetun::tunnel > Tunneling TCP [[::1]:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
 INFO  onetun::tunnel > Tunneling TCP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
 ```
@@ -166,16 +174,33 @@ INFO  onetun::tunnel > Tunneling TCP [127.0.0.1:8080]->[192.168.4.2:8080] (via [
 For debugging purposes, you can enable the capture of IP packets sent between onetun and the WireGuard peer.
 The output is a libpcap capture file that can be viewed with Wireshark.
 
-```
-$ onetun --pcap wg.pcap 127.0.0.1:8080:192.168.4.2:8080
+```shell
+onetun --pcap wg.pcap 127.0.0.1:8080:192.168.4.2:8080
 INFO  onetun::pcap > Capturing WireGuard IP packets to wg.pcap
 INFO  onetun::tunnel > Tunneling TCP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
 ```
 
 To capture packets sent to and from the onetun local port, you must use an external tool like `tcpdump` with root access:
 
+```shell
+sudo tcpdump -i lo -w local.pcap 'dst 127.0.0.1 && port 8080'
 ```
-$ sudo tcpdump -i lo -w local.pcap 'dst 127.0.0.1 && port 8443'
+
+### WireGuard Options
+
+By default, onetun will create the UDP socket to communicate with the WireGuard endpoint on all interfaces and on a dynamic port,
+i.e. `0.0.0.0:0` for IPv4 endpoints, or `[::]:0` for IPv6.
+You can bind to a static address instead using `--endpoint-bind-addr`:
+
+```shell
+onetun --endpoint-bind-addr 0.0.0.0:51820 --endpoint-addr 140.30.3.182:51820 [...]
+```
+
+The security of the WireGuard connection can be further enhanced with a **pre-shared key** (PSK). You can generate such a key with the `wg genpsk` command, and provide it using `--preshared-key`.
+The peer must also have this key configured using the `PresharedKey` option.
+
+```shell
+onetun --preshared-key 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' [...]
 ```
 
 ## Architecture
@@ -197,7 +222,7 @@ created in a [smoltcp](https://github.com/smoltcp-rs/smoltcp) "virtual" TCP/IP i
 process. An ephemeral "virtual port" is assigned to the "virtual client", which maps back to the local client.
 
 When the real client opens the connection, the virtual client socket opens a TCP connection to the virtual server
-(a dummy socket bound to the remote host/port).  The virtual interface in turn crafts the `SYN` segment and wraps it in an IP packet.
+(a dummy socket bound to the remote host/port). The virtual interface in turn crafts the `SYN` segment and wraps it in an IP packet.
 Because of how the virtual client and server are configured, the IP packet is crafted with a source address
 being the configured `source-peer-ip` (`192.168.4.3` in the example above),
 and the destination address matches the port-forward's configured destination (`192.168.4.2`).
@@ -242,6 +267,56 @@ if the least recently used port hasn't been used for a certain amount of time. I
 
 All in all, I would not recommend using UDP forwarding for public services, since it's most likely prone to simple DoS or DDoS.
 
+## HTTP/SOCKS Proxy
+
+**onetun** is a Transport-layer proxy (also known as port forwarding); it is not in scope to provide
+a HTTP/SOCKS proxy server. However, you can easily chain **onetun** with a proxy server on a remote
+that is locked down to your WireGuard network.
+
+For example, you could run [dante-server](https://www.inet.no/dante/) on a peer (ex. `192.168.4.2`) with the following configuration:
+
+```
+# /etc/danted.conf
+
+logoutput: syslog
+user.privileged: root
+user.unprivileged: nobody
+
+internal: 192.168.4.2 port=1080
+external: eth0
+
+socksmethod: none
+clientmethod: none
+
+# Locks down proxy use to WireGuard peers (192.168.4.x)
+client pass {
+    from: 192.168.4.0/24 to: 0.0.0.0/0
+}
+socks pass {
+    from: 192.168.4.0/24 to: 0.0.0.0/0
+}
+```
+
+Then use **onetun** to expose the SOCKS5 proxy locally:
+
+```shell
+onetun 127.0.0.1:1080:192.168.4.2:1080
+INFO  onetun::tunnel > Tunneling TCP [127.0.0.1:1080]->[192.168.4.2:1080] (via [140.30.3.182:51820] as peer 192.168.4.3)
+```
+
+Test with `curl` (or configure your browser):
+
+```shell
+curl -x socks5://127.0.0.1:1080 https://ifconfig.me
+```
+
+## Contributing and Maintenance
+
+I will gladly accept contributions to onetun, and set aside time to review all pull-requests.
+Please consider opening a GitHub issue if you are unsure if your contribution is within the scope of the project.
+
+**Disclaimer**: I do not have enough personal time to actively maintain onetun besides open-source contributions.
+
 ## License
 
-MIT. See `LICENSE` for details.
+MIT License. See `LICENSE` for details. Copyright &copy; 2025 Aram Peres.
diff --git a/src/config.rs b/src/config.rs
index e4ea700..411efa3 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -5,36 +5,43 @@ use std::fs::read_to_string;
 use std::net::{IpAddr, SocketAddr, ToSocketAddrs};
 use std::sync::Arc;
 
-use anyhow::Context;
-use boringtun::crypto::{X25519PublicKey, X25519SecretKey};
-use clap::{App, Arg};
+use anyhow::{bail, Context};
+pub use boringtun::x25519::{PublicKey, StaticSecret};
 
-#[derive(Clone, Debug)]
+const DEFAULT_PORT_FORWARD_SOURCE: &str = "127.0.0.1";
+
+#[derive(Clone)]
 pub struct Config {
-    pub(crate) port_forwards: Vec<PortForwardConfig>,
-    pub(crate) private_key: Arc<X25519SecretKey>,
-    pub(crate) endpoint_public_key: Arc<X25519PublicKey>,
-    pub(crate) endpoint_addr: SocketAddr,
-    pub(crate) source_peer_ip: IpAddr,
-    pub(crate) keepalive_seconds: Option<u16>,
-    pub(crate) max_transmission_unit: usize,
-    pub(crate) log: String,
-    pub(crate) warnings: Vec<String>,
-    pub(crate) pcap_file: Option<String>,
+    pub port_forwards: Vec<PortForwardConfig>,
+    #[allow(dead_code)]
+    pub remote_port_forwards: Vec<PortForwardConfig>,
+    pub private_key: Arc<StaticSecret>,
+    pub endpoint_public_key: Arc<PublicKey>,
+    pub preshared_key: Option<[u8; 32]>,
+    pub endpoint_addr: SocketAddr,
+    pub endpoint_bind_addr: SocketAddr,
+    pub source_peer_ip: IpAddr,
+    pub keepalive_seconds: Option<u16>,
+    pub max_transmission_unit: usize,
+    pub log: String,
+    pub warnings: Vec<String>,
+    pub pcap_file: Option<String>,
 }
 
 impl Config {
+    #[cfg(feature = "bin")]
     pub fn from_args() -> anyhow::Result<Self> {
+        use clap::{Arg, Command};
+
         let mut warnings = vec![];
 
-        let matches = App::new("onetun")
+        let matches = Command::new("onetun")
             .author("Aram Peres <aram.peres@gmail.com>")
             .version(env!("CARGO_PKG_VERSION"))
             .args(&[
-                Arg::with_name("PORT_FORWARD")
+                Arg::new("PORT_FORWARD")
                     .required(false)
-                    .multiple(true)
-                    .takes_value(true)
+                    .num_args(1..)
                     .help("Port forward configurations. The format of each argument is [src_host:]<src_port>:<dst_host>:<dst_port>[:TCP,UDP,...], \
                     where [src_host] is the local IP to listen on, <src_port> is the local port to listen on, <dst_host> is the remote peer IP to forward to, and <dst_port> is the remote port to forward to. \
                     Environment variables of the form 'ONETUN_PORT_FORWARD_[#]' are also accepted, where [#] starts at 1.\n\
@@ -48,67 +55,94 @@ impl Config {
                     \tlocalhost:8080:192.168.4.1:8081:TCP\n\
                     \tlocalhost:8080:peer.intranet:8081:TCP\
                     "),
-                Arg::with_name("private-key")
-                    .required_unless("private-key-file")
-                    .takes_value(true)
+                Arg::new("private-key")
+                    .conflicts_with("private-key-file")
+                    .num_args(1)
                     .long("private-key")
                     .env("ONETUN_PRIVATE_KEY")
                     .help("The private key of this peer. The corresponding public key should be registered in the WireGuard endpoint. \
                     You can also use '--private-key-file' to specify a file containing the key instead."),
-                Arg::with_name("private-key-file")
-                    .takes_value(true)
+                Arg::new("private-key-file")
+                    .num_args(1)
                     .long("private-key-file")
                     .env("ONETUN_PRIVATE_KEY_FILE")
                     .help("The path to a file containing the private key of this peer. The corresponding public key should be registered in the WireGuard endpoint."),
-                Arg::with_name("endpoint-public-key")
+                Arg::new("endpoint-public-key")
                     .required(true)
-                    .takes_value(true)
+                    .num_args(1)
                     .long("endpoint-public-key")
                     .env("ONETUN_ENDPOINT_PUBLIC_KEY")
                     .help("The public key of the WireGuard endpoint (remote)."),
-                Arg::with_name("endpoint-addr")
+                Arg::new("preshared-key")
+                    .required(false)
+                    .num_args(1)
+                    .long("preshared-key")
+                    .env("ONETUN_PRESHARED_KEY")
+                    .help("The pre-shared key (PSK) as configured with the peer."),
+                Arg::new("endpoint-addr")
                     .required(true)
-                    .takes_value(true)
+                    .num_args(1)
                     .long("endpoint-addr")
                     .env("ONETUN_ENDPOINT_ADDR")
                     .help("The address (IP + port) of the WireGuard endpoint (remote). Example: 1.2.3.4:51820"),
-                Arg::with_name("source-peer-ip")
+                Arg::new("endpoint-bind-addr")
+                    .required(false)
+                    .num_args(1)
+                    .long("endpoint-bind-addr")
+                    .env("ONETUN_ENDPOINT_BIND_ADDR")
+                    .help("The address (IP + port) used to bind the local UDP socket for the WireGuard tunnel. Example: 1.2.3.4:30000. Defaults to 0.0.0.0:0 for IPv4 endpoints, or [::]:0 for IPv6 endpoints."),
+                Arg::new("source-peer-ip")
                     .required(true)
-                    .takes_value(true)
+                    .num_args(1)
                     .long("source-peer-ip")
                     .env("ONETUN_SOURCE_PEER_IP")
                     .help("The source IP to identify this peer as (local). Example: 192.168.4.3"),
-                Arg::with_name("keep-alive")
+                Arg::new("keep-alive")
                     .required(false)
-                    .takes_value(true)
+                    .num_args(1)
                     .long("keep-alive")
                     .env("ONETUN_KEEP_ALIVE")
                     .help("Configures a persistent keep-alive for the WireGuard tunnel, in seconds."),
-                Arg::with_name("max-transmission-unit")
+                Arg::new("max-transmission-unit")
                     .required(false)
-                    .takes_value(true)
+                    .num_args(1)
                     .long("max-transmission-unit")
                     .env("ONETUN_MTU")
                     .default_value("1420")
                     .help("Configures the max-transmission-unit (MTU) of the WireGuard tunnel."),
-                Arg::with_name("log")
+                Arg::new("log")
                     .required(false)
-                    .takes_value(true)
+                    .num_args(1)
                     .long("log")
                     .env("ONETUN_LOG")
                     .default_value("info")
                     .help("Configures the log level and format."),
-                Arg::with_name("pcap")
+                Arg::new("pcap")
                     .required(false)
-                    .takes_value(true)
+                    .num_args(1)
                     .long("pcap")
                     .env("ONETUN_PCAP")
-                    .help("Decrypts and captures IP packets on the WireGuard tunnel to a given output file.")
+                    .help("Decrypts and captures IP packets on the WireGuard tunnel to a given output file."),
+                Arg::new("remote")
+                    .required(false)
+                    .num_args(1..)
+                    .long("remote")
+                    .short('r')
+                    .help("Remote port forward configurations. The format of each argument is <src_port>:<dst_host>:<dst_port>[:TCP,UDP,...], \
+                    where <src_port> is the port the other peers will reach the server with, <dst_host> is the IP to forward to, and <dst_port> is the port to forward to. \
+                    The <src_port> will be bound on onetun's peer IP, as specified by --source-peer-ip. If you pass a different value for <src_host> here, it will be rejected.\n\
+                    Note: <dst_host>:<dst_port> must be reachable by onetun. If referring to another WireGuard peer, use --bridge instead (not supported yet).\n\
+                    Environment variables of the form 'ONETUN_REMOTE_PORT_FORWARD_[#]' are also accepted, where [#] starts at 1.\n\
+                    Examples:\n\
+                    \t--remote 8080:localhost:8081:TCP,UDP\n\
+                    \t--remote 8080:[::1]:8081:TCP\n\
+                    \t--remote 8080:google.com:80\
+                    "),
             ]).get_matches();
 
         // Combine `PORT_FORWARD` arg and `ONETUN_PORT_FORWARD_#` envs
         let mut port_forward_strings = HashSet::new();
-        if let Some(values) = matches.values_of("PORT_FORWARD") {
+        if let Some(values) = matches.get_many::<String>("PORT_FORWARD") {
             for value in values {
                 port_forward_strings.insert(value.to_owned());
             }
@@ -120,26 +154,68 @@ impl Config {
                 break;
             }
         }
-        if port_forward_strings.is_empty() {
-            return Err(anyhow::anyhow!("No port forward configurations given."));
-        }
 
         // Parse `PORT_FORWARD` strings into `PortForwardConfig`
         let port_forwards: anyhow::Result<Vec<Vec<PortForwardConfig>>> = port_forward_strings
             .into_iter()
-            .map(|s| PortForwardConfig::from_notation(&s))
+            .map(|s| PortForwardConfig::from_notation(&s, DEFAULT_PORT_FORWARD_SOURCE))
             .collect();
         let port_forwards: Vec<PortForwardConfig> = port_forwards
-            .with_context(|| "Failed to parse port forward config")?
+            .context("Failed to parse port forward config")?
             .into_iter()
             .flatten()
             .collect();
 
+        // Read source-peer-ip
+        let source_peer_ip = parse_ip(matches.get_one::<String>("source-peer-ip"))
+            .context("Invalid source peer IP")?;
+
+        // Combined `remote` arg and `ONETUN_REMOTE_PORT_FORWARD_#` envs
+        let mut port_forward_strings = HashSet::new();
+        if let Some(values) = matches.get_many::<String>("remote") {
+            for value in values {
+                port_forward_strings.insert(value.to_owned());
+            }
+        }
+        for n in 1.. {
+            if let Ok(env) = std::env::var(format!("ONETUN_REMOTE_PORT_FORWARD_{}", n)) {
+                port_forward_strings.insert(env);
+            } else {
+                break;
+            }
+        }
+        // Parse `PORT_FORWARD` strings into `PortForwardConfig`
+        let remote_port_forwards: anyhow::Result<Vec<Vec<PortForwardConfig>>> =
+            port_forward_strings
+                .into_iter()
+                .map(|s| {
+                    PortForwardConfig::from_notation(
+                        &s,
+                        matches.get_one::<String>("source-peer-ip").unwrap(),
+                    )
+                })
+                .collect();
+        let mut remote_port_forwards: Vec<PortForwardConfig> = remote_port_forwards
+            .context("Failed to parse remote port forward config")?
+            .into_iter()
+            .flatten()
+            .collect();
+        for port_forward in remote_port_forwards.iter_mut() {
+            if port_forward.source.ip() != source_peer_ip {
+                bail!("Remote port forward config <src_host> must match --source-peer-ip ({}), or be omitted.", source_peer_ip);
+            }
+            port_forward.source = SocketAddr::from((source_peer_ip, port_forward.source.port()));
+            port_forward.remote = true;
+        }
+
+        if port_forwards.is_empty() && remote_port_forwards.is_empty() {
+            bail!("No port forward configurations given.");
+        }
+
         // Read private key from file or CLI argument
         let (group_readable, world_readable) = matches
-            .value_of("private-key-file")
-            .map(is_file_insecurely_readable)
-            .flatten()
+            .get_one::<String>("private-key-file")
+            .and_then(is_file_insecurely_readable)
             .unwrap_or_default();
         if group_readable {
             warnings.push("Private key file is group-readable. This is insecure.".into());
@@ -148,72 +224,116 @@ impl Config {
             warnings.push("Private key file is world-readable. This is insecure.".into());
         }
 
-        let private_key = if let Some(private_key_file) = matches.value_of("private-key-file") {
+        let private_key = if let Some(private_key_file) =
+            matches.get_one::<String>("private-key-file")
+        {
             read_to_string(private_key_file)
                 .map(|s| s.trim().to_string())
-                .with_context(|| "Failed to read private key file")
+                .context("Failed to read private key file")
         } else {
             if std::env::var("ONETUN_PRIVATE_KEY").is_err() {
                 warnings.push("Private key was passed using CLI. This is insecure. \
                 Use \"--private-key-file <file containing private key>\", or the \"ONETUN_PRIVATE_KEY\" env variable instead.".into());
             }
             matches
-                .value_of("private-key")
-                .map(String::from)
-                .with_context(|| "Missing private key")
+                .get_one::<String>("private-key")
+                .cloned()
+                .context("Missing private key")
         }?;
 
+        let endpoint_addr = parse_addr(matches.get_one::<String>("endpoint-addr"))
+            .context("Invalid endpoint address")?;
+
+        let endpoint_bind_addr = if let Some(addr) = matches.get_one::<String>("endpoint-bind-addr")
+        {
+            let addr = parse_addr(Some(addr)).context("Invalid bind address")?;
+            // Make sure the bind address and endpoint address are the same IP version
+            if addr.ip().is_ipv4() != endpoint_addr.ip().is_ipv4() {
+                bail!("Endpoint and bind addresses must be the same IP version");
+            }
+            addr
+        } else {
+            // Return the IP version of the endpoint address
+            match endpoint_addr {
+                SocketAddr::V4(_) => parse_addr(Some("0.0.0.0:0"))?,
+                SocketAddr::V6(_) => parse_addr(Some("[::]:0"))?,
+            }
+        };
+
         Ok(Self {
             port_forwards,
-            private_key: Arc::new(
-                parse_private_key(&private_key).with_context(|| "Invalid private key")?,
-            ),
+            remote_port_forwards,
+            private_key: Arc::new(parse_private_key(&private_key).context("Invalid private key")?),
             endpoint_public_key: Arc::new(
-                parse_public_key(matches.value_of("endpoint-public-key"))
-                    .with_context(|| "Invalid endpoint public key")?,
+                parse_public_key(matches.get_one::<String>("endpoint-public-key"))
+                    .context("Invalid endpoint public key")?,
             ),
-            endpoint_addr: parse_addr(matches.value_of("endpoint-addr"))
-                .with_context(|| "Invalid endpoint address")?,
-            source_peer_ip: parse_ip(matches.value_of("source-peer-ip"))
-                .with_context(|| "Invalid source peer IP")?,
-            keepalive_seconds: parse_keep_alive(matches.value_of("keep-alive"))
-                .with_context(|| "Invalid keep-alive value")?,
-            max_transmission_unit: parse_mtu(matches.value_of("max-transmission-unit"))
-                .with_context(|| "Invalid max-transmission-unit value")?,
-            log: matches.value_of("log").unwrap_or_default().into(),
-            pcap_file: matches.value_of("pcap").map(String::from),
+            preshared_key: parse_preshared_key(matches.get_one::<String>("preshared-key"))?,
+            endpoint_addr,
+            endpoint_bind_addr,
+            source_peer_ip,
+            keepalive_seconds: parse_keep_alive(matches.get_one::<String>("keep-alive"))
+                .context("Invalid keep-alive value")?,
+            max_transmission_unit: parse_mtu(matches.get_one::<String>("max-transmission-unit"))
+                .context("Invalid max-transmission-unit value")?,
+            log: matches
+                .get_one::<String>("log")
+                .cloned()
+                .unwrap_or_default(),
+            pcap_file: matches.get_one::<String>("pcap").cloned(),
             warnings,
         })
     }
 }
 
-fn parse_addr(s: Option<&str>) -> anyhow::Result<SocketAddr> {
-    s.with_context(|| "Missing address")?
+fn parse_addr<T: AsRef<str>>(s: Option<T>) -> anyhow::Result<SocketAddr> {
+    s.context("Missing address")?
+        .as_ref()
         .to_socket_addrs()
-        .with_context(|| "Invalid address")?
+        .context("Invalid address")?
         .next()
-        .with_context(|| "Could not lookup address")
+        .context("Could not lookup address")
 }
 
-fn parse_ip(s: Option<&str>) -> anyhow::Result<IpAddr> {
-    s.with_context(|| "Missing IP")?
+fn parse_ip(s: Option<&String>) -> anyhow::Result<IpAddr> {
+    s.context("Missing IP address")?
         .parse::<IpAddr>()
-        .with_context(|| "Invalid IP address")
+        .context("Invalid IP address")
 }
 
-fn parse_private_key(s: &str) -> anyhow::Result<X25519SecretKey> {
-    s.parse::<X25519SecretKey>()
-        .map_err(|e| anyhow::anyhow!("{}", e))
+fn parse_private_key(s: &str) -> anyhow::Result<StaticSecret> {
+    let decoded = base64::decode(s).context("Failed to decode private key")?;
+    if let Ok::<[u8; 32], _>(bytes) = decoded.try_into() {
+        Ok(StaticSecret::from(bytes))
+    } else {
+        bail!("Invalid private key")
+    }
 }
 
-fn parse_public_key(s: Option<&str>) -> anyhow::Result<X25519PublicKey> {
-    s.with_context(|| "Missing public key")?
-        .parse::<X25519PublicKey>()
-        .map_err(|e| anyhow::anyhow!("{}", e))
-        .with_context(|| "Invalid public key")
+fn parse_public_key(s: Option<&String>) -> anyhow::Result<PublicKey> {
+    let encoded = s.context("Missing public key")?;
+    let decoded = base64::decode(encoded).context("Failed to decode public key")?;
+    if let Ok::<[u8; 32], _>(bytes) = decoded.try_into() {
+        Ok(PublicKey::from(bytes))
+    } else {
+        bail!("Invalid public key")
+    }
 }
 
-fn parse_keep_alive(s: Option<&str>) -> anyhow::Result<Option<u16>> {
+fn parse_preshared_key(s: Option<&String>) -> anyhow::Result<Option<[u8; 32]>> {
+    if let Some(s) = s {
+        let decoded = base64::decode(s).context("Failed to decode preshared key")?;
+        if let Ok::<[u8; 32], _>(bytes) = decoded.try_into() {
+            Ok(Some(bytes))
+        } else {
+            bail!("Invalid preshared key")
+        }
+    } else {
+        Ok(None)
+    }
+}
+
+fn parse_keep_alive(s: Option<&String>) -> anyhow::Result<Option<u16>> {
     if let Some(s) = s {
         let parsed: u16 = s.parse().with_context(|| {
             format!(
@@ -227,23 +347,21 @@ fn parse_keep_alive(s: Option<&str>) -> anyhow::Result<Option<u16>> {
     }
 }
 
-fn parse_mtu(s: Option<&str>) -> anyhow::Result<usize> {
-    s.with_context(|| "Missing MTU")?
-        .parse()
-        .with_context(|| "Invalid MTU")
+fn parse_mtu(s: Option<&String>) -> anyhow::Result<usize> {
+    s.context("Missing MTU")?.parse().context("Invalid MTU")
 }
 
 #[cfg(unix)]
-fn is_file_insecurely_readable(path: &str) -> Option<(bool, bool)> {
+fn is_file_insecurely_readable(path: &String) -> Option<(bool, bool)> {
     use std::fs::File;
     use std::os::unix::fs::MetadataExt;
 
-    let mode = File::open(&path).ok()?.metadata().ok()?.mode();
+    let mode = File::open(path).ok()?.metadata().ok()?.mode();
     Some((mode & 0o40 > 0, mode & 0o4 > 0))
 }
 
 #[cfg(not(unix))]
-fn is_file_insecurely_readable(_path: &str) -> Option<(bool, bool)> {
+fn is_file_insecurely_readable(_path: &String) -> Option<(bool, bool)> {
     // No good way to determine permissions on non-Unix target
     None
 }
@@ -256,6 +374,8 @@ pub struct PortForwardConfig {
     pub destination: SocketAddr,
     /// The transport protocol to use for the port (Layer 4).
     pub protocol: PortProtocol,
+    /// Whether this is a remote port forward.
+    pub remote: bool,
 }
 
 impl PortForwardConfig {
@@ -278,7 +398,7 @@ impl PortForwardConfig {
     ///  - IPv6 addresses must be prefixed with `[` and suffixed with `]`. Example: `[::1]`.
     ///  - Any `u16` is accepted as `src_port` and `dst_port`
     ///  - Specifying protocols (`PROTO1,PROTO2,...`) is optional and defaults to `TCP`. Values must be separated by commas.
-    pub fn from_notation(s: &str) -> anyhow::Result<Vec<PortForwardConfig>> {
+    pub fn from_notation(s: &str, default_source: &str) -> anyhow::Result<Vec<PortForwardConfig>> {
         mod parsers {
             use nom::branch::alt;
             use nom::bytes::complete::is_not;
@@ -356,28 +476,22 @@ impl PortForwardConfig {
             .1;
 
         let source = (
-            src_addr.0.unwrap_or("127.0.0.1"),
-            src_addr
-                .1
-                .parse::<u16>()
-                .with_context(|| "Invalid source port")?,
+            src_addr.0.unwrap_or(default_source),
+            src_addr.1.parse::<u16>().context("Invalid source port")?,
         )
             .to_socket_addrs()
-            .with_context(|| "Invalid source address")?
+            .context("Invalid source address")?
             .next()
-            .with_context(|| "Could not resolve source address")?;
+            .context("Could not resolve source address")?;
 
         let destination = (
             dst_addr.0,
-            dst_addr
-                .1
-                .parse::<u16>()
-                .with_context(|| "Invalid source port")?,
+            dst_addr.1.parse::<u16>().context("Invalid source port")?,
         )
             .to_socket_addrs() // TODO: Pass this as given and use DNS config instead (issue #15)
-            .with_context(|| "Invalid destination address")?
+            .context("Invalid destination address")?
             .next()
-            .with_context(|| "Could not resolve destination address")?;
+            .context("Could not resolve destination address")?;
 
         // Parse protocols
         let protocols = if let Some(protocols) = protocols {
@@ -387,7 +501,7 @@ impl PortForwardConfig {
         } else {
             Ok(vec![PortProtocol::Tcp])
         }
-        .with_context(|| "Failed to parse protocols")?;
+        .context("Failed to parse protocols")?;
 
         // Returns an config for each protocol
         Ok(protocols
@@ -396,6 +510,7 @@ impl PortForwardConfig {
                 source,
                 destination,
                 protocol,
+                remote: false,
             })
             .collect())
     }
@@ -403,7 +518,15 @@ impl PortForwardConfig {
 
 impl Display for PortForwardConfig {
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-        write!(f, "{}:{}:{}", self.source, self.destination, self.protocol)
+        if self.remote {
+            write!(
+                f,
+                "(remote){}:{}:{}",
+                self.source, self.destination, self.protocol
+            )
+        } else {
+            write!(f, "{}:{}:{}", self.source, self.destination, self.protocol)
+        }
     }
 }
 
@@ -451,18 +574,23 @@ mod tests {
     #[test]
     fn test_parse_port_forward_config_1() {
         assert_eq!(
-            PortForwardConfig::from_notation("192.168.0.1:8080:192.168.4.1:8081:TCP,UDP")
-                .expect("Failed to parse"),
+            PortForwardConfig::from_notation(
+                "192.168.0.1:8080:192.168.4.1:8081:TCP,UDP",
+                DEFAULT_PORT_FORWARD_SOURCE
+            )
+            .expect("Failed to parse"),
             vec![
                 PortForwardConfig {
                     source: SocketAddr::from_str("192.168.0.1:8080").unwrap(),
                     destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
-                    protocol: PortProtocol::Tcp
+                    protocol: PortProtocol::Tcp,
+                    remote: false,
                 },
                 PortForwardConfig {
                     source: SocketAddr::from_str("192.168.0.1:8080").unwrap(),
                     destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
-                    protocol: PortProtocol::Udp
+                    protocol: PortProtocol::Udp,
+                    remote: false,
                 }
             ]
         );
@@ -471,12 +599,16 @@ mod tests {
     #[test]
     fn test_parse_port_forward_config_2() {
         assert_eq!(
-            PortForwardConfig::from_notation("192.168.0.1:8080:192.168.4.1:8081:TCP")
-                .expect("Failed to parse"),
+            PortForwardConfig::from_notation(
+                "192.168.0.1:8080:192.168.4.1:8081:TCP",
+                DEFAULT_PORT_FORWARD_SOURCE
+            )
+            .expect("Failed to parse"),
             vec![PortForwardConfig {
                 source: SocketAddr::from_str("192.168.0.1:8080").unwrap(),
                 destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
-                protocol: PortProtocol::Tcp
+                protocol: PortProtocol::Tcp,
+                remote: false,
             }]
         );
     }
@@ -484,12 +616,16 @@ mod tests {
     #[test]
     fn test_parse_port_forward_config_3() {
         assert_eq!(
-            PortForwardConfig::from_notation("0.0.0.0:8080:192.168.4.1:8081")
-                .expect("Failed to parse"),
+            PortForwardConfig::from_notation(
+                "0.0.0.0:8080:192.168.4.1:8081",
+                DEFAULT_PORT_FORWARD_SOURCE
+            )
+            .expect("Failed to parse"),
             vec![PortForwardConfig {
                 source: SocketAddr::from_str("0.0.0.0:8080").unwrap(),
                 destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
-                protocol: PortProtocol::Tcp
+                protocol: PortProtocol::Tcp,
+                remote: false,
             }]
         );
     }
@@ -497,12 +633,16 @@ mod tests {
     #[test]
     fn test_parse_port_forward_config_4() {
         assert_eq!(
-            PortForwardConfig::from_notation("[::1]:8080:192.168.4.1:8081")
-                .expect("Failed to parse"),
+            PortForwardConfig::from_notation(
+                "[::1]:8080:192.168.4.1:8081",
+                DEFAULT_PORT_FORWARD_SOURCE
+            )
+            .expect("Failed to parse"),
             vec![PortForwardConfig {
                 source: SocketAddr::from_str("[::1]:8080").unwrap(),
                 destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
-                protocol: PortProtocol::Tcp
+                protocol: PortProtocol::Tcp,
+                remote: false,
             }]
         );
     }
@@ -510,11 +650,13 @@ mod tests {
     #[test]
     fn test_parse_port_forward_config_5() {
         assert_eq!(
-            PortForwardConfig::from_notation("8080:192.168.4.1:8081").expect("Failed to parse"),
+            PortForwardConfig::from_notation("8080:192.168.4.1:8081", DEFAULT_PORT_FORWARD_SOURCE)
+                .expect("Failed to parse"),
             vec![PortForwardConfig {
                 source: SocketAddr::from_str("127.0.0.1:8080").unwrap(),
                 destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
-                protocol: PortProtocol::Tcp
+                protocol: PortProtocol::Tcp,
+                remote: false,
             }]
         );
     }
@@ -522,11 +664,16 @@ mod tests {
     #[test]
     fn test_parse_port_forward_config_6() {
         assert_eq!(
-            PortForwardConfig::from_notation("8080:192.168.4.1:8081:TCP").expect("Failed to parse"),
+            PortForwardConfig::from_notation(
+                "8080:192.168.4.1:8081:TCP",
+                DEFAULT_PORT_FORWARD_SOURCE
+            )
+            .expect("Failed to parse"),
             vec![PortForwardConfig {
                 source: SocketAddr::from_str("127.0.0.1:8080").unwrap(),
                 destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
-                protocol: PortProtocol::Tcp
+                protocol: PortProtocol::Tcp,
+                remote: false,
             }]
         );
     }
@@ -534,12 +681,16 @@ mod tests {
     #[test]
     fn test_parse_port_forward_config_7() {
         assert_eq!(
-            PortForwardConfig::from_notation("localhost:8080:192.168.4.1:8081")
-                .expect("Failed to parse"),
+            PortForwardConfig::from_notation(
+                "localhost:8080:192.168.4.1:8081",
+                DEFAULT_PORT_FORWARD_SOURCE
+            )
+            .expect("Failed to parse"),
             vec![PortForwardConfig {
                 source: "localhost:8080".to_socket_addrs().unwrap().next().unwrap(),
                 destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
-                protocol: PortProtocol::Tcp
+                protocol: PortProtocol::Tcp,
+                remote: false,
             }]
         );
     }
@@ -547,12 +698,16 @@ mod tests {
     #[test]
     fn test_parse_port_forward_config_8() {
         assert_eq!(
-            PortForwardConfig::from_notation("localhost:8080:localhost:8081:TCP")
-                .expect("Failed to parse"),
+            PortForwardConfig::from_notation(
+                "localhost:8080:localhost:8081:TCP",
+                DEFAULT_PORT_FORWARD_SOURCE
+            )
+            .expect("Failed to parse"),
             vec![PortForwardConfig {
                 source: "localhost:8080".to_socket_addrs().unwrap().next().unwrap(),
                 destination: "localhost:8081".to_socket_addrs().unwrap().next().unwrap(),
-                protocol: PortProtocol::Tcp
+                protocol: PortProtocol::Tcp,
+                remote: false,
             }]
         );
     }
diff --git a/src/events.rs b/src/events.rs
index cd76a49..d6582ce 100644
--- a/src/events.rs
+++ b/src/events.rs
@@ -1,3 +1,4 @@
+use bytes::Bytes;
 use std::fmt::{Display, Formatter};
 use std::sync::atomic::{AtomicU32, Ordering};
 use std::sync::Arc;
@@ -16,13 +17,13 @@ pub enum Event {
     /// A connection was dropped from the pool and should be closed in all interfaces.
     ClientConnectionDropped(VirtualPort),
     /// Data received by the local server that should be sent to the virtual server.
-    LocalData(PortForwardConfig, VirtualPort, Vec<u8>),
+    LocalData(PortForwardConfig, VirtualPort, Bytes),
     /// Data received by the remote server that should be sent to the local client.
-    RemoteData(VirtualPort, Vec<u8>),
+    RemoteData(VirtualPort, Bytes),
     /// IP packet received from the WireGuard tunnel that should be passed through the corresponding virtual device.
-    InboundInternetPacket(PortProtocol, Vec<u8>),
+    InboundInternetPacket(PortProtocol, Bytes),
     /// IP packet to be sent through the WireGuard tunnel as crafted by the virtual device.
-    OutboundInternetPacket(Vec<u8>),
+    OutboundInternetPacket(Bytes),
     /// Notifies that a virtual device read an IP packet.
     VirtualDeviceFed(PortProtocol),
 }
diff --git a/src/lib.rs b/src/lib.rs
new file mode 100644
index 0000000..a76fa18
--- /dev/null
+++ b/src/lib.rs
@@ -0,0 +1,122 @@
+#[macro_use]
+extern crate log;
+
+use std::sync::Arc;
+
+use anyhow::Context;
+
+use crate::config::{Config, PortProtocol};
+use crate::events::Bus;
+use crate::tunnel::tcp::TcpPortPool;
+use crate::tunnel::udp::UdpPortPool;
+use crate::virtual_device::VirtualIpDevice;
+use crate::virtual_iface::tcp::TcpVirtualInterface;
+use crate::virtual_iface::udp::UdpVirtualInterface;
+use crate::virtual_iface::VirtualInterfacePoll;
+use crate::wg::WireGuardTunnel;
+
+pub mod config;
+pub mod events;
+#[cfg(feature = "pcap")]
+pub mod pcap;
+pub mod tunnel;
+pub mod virtual_device;
+pub mod virtual_iface;
+pub mod wg;
+
+/// Starts the onetun tunnels in separate tokio tasks.
+///
+/// Note: This future completes immediately.
+pub async fn start_tunnels(config: Config, bus: Bus) -> anyhow::Result<()> {
+    // Initialize the port pool for each protocol
+    let tcp_port_pool = TcpPortPool::new();
+    let udp_port_pool = UdpPortPool::new();
+
+    #[cfg(feature = "pcap")]
+    if let Some(pcap_file) = config.pcap_file.clone() {
+        // Start packet capture
+        let bus = bus.clone();
+        tokio::spawn(async move { pcap::capture(pcap_file, bus).await });
+    }
+
+    let wg = WireGuardTunnel::new(&config, bus.clone())
+        .await
+        .context("Failed to initialize WireGuard tunnel")?;
+    let wg = Arc::new(wg);
+
+    {
+        // Start routine task for WireGuard
+        let wg = wg.clone();
+        tokio::spawn(async move { wg.routine_task().await });
+    }
+
+    {
+        // Start consumption task for WireGuard
+        let wg = wg.clone();
+        tokio::spawn(Box::pin(async move { wg.consume_task().await }));
+    }
+
+    {
+        // Start production task for WireGuard
+        let wg = wg.clone();
+        tokio::spawn(async move { wg.produce_task().await });
+    }
+
+    if config
+        .port_forwards
+        .iter()
+        .any(|pf| pf.protocol == PortProtocol::Tcp)
+    {
+        // TCP device
+        let bus = bus.clone();
+        let device =
+            VirtualIpDevice::new(PortProtocol::Tcp, bus.clone(), config.max_transmission_unit);
+
+        // Start TCP Virtual Interface
+        let port_forwards = config.port_forwards.clone();
+        let iface = TcpVirtualInterface::new(port_forwards, bus, config.source_peer_ip);
+        tokio::spawn(async move { iface.poll_loop(device).await });
+    }
+
+    if config
+        .port_forwards
+        .iter()
+        .any(|pf| pf.protocol == PortProtocol::Udp)
+    {
+        // UDP device
+        let bus = bus.clone();
+        let device =
+            VirtualIpDevice::new(PortProtocol::Udp, bus.clone(), config.max_transmission_unit);
+
+        // Start UDP Virtual Interface
+        let port_forwards = config.port_forwards.clone();
+        let iface = UdpVirtualInterface::new(port_forwards, bus, config.source_peer_ip);
+        tokio::spawn(async move { iface.poll_loop(device).await });
+    }
+
+    {
+        let port_forwards = config.port_forwards;
+        let source_peer_ip = config.source_peer_ip;
+
+        port_forwards
+            .into_iter()
+            .map(|pf| {
+                (
+                    pf,
+                    wg.clone(),
+                    tcp_port_pool.clone(),
+                    udp_port_pool.clone(),
+                    bus.clone(),
+                )
+            })
+            .for_each(move |(pf, wg, tcp_port_pool, udp_port_pool, bus)| {
+                tokio::spawn(async move {
+                    tunnel::port_forward(pf, source_peer_ip, tcp_port_pool, udp_port_pool, wg, bus)
+                        .await
+                        .unwrap_or_else(|e| error!("Port-forward failed for {} : {}", pf, e))
+                });
+            });
+    }
+
+    Ok(())
+}
diff --git a/src/main.rs b/src/main.rs
index 879b45e..4ff2954 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,135 +1,36 @@
+#[cfg(feature = "bin")]
 #[macro_use]
 extern crate log;
 
-use std::sync::Arc;
-
-use anyhow::Context;
-
-use crate::config::{Config, PortProtocol};
-use crate::events::Bus;
-use crate::tunnel::tcp::TcpPortPool;
-use crate::tunnel::udp::UdpPortPool;
-use crate::virtual_device::VirtualIpDevice;
-use crate::virtual_iface::tcp::TcpVirtualInterface;
-use crate::virtual_iface::udp::UdpVirtualInterface;
-use crate::virtual_iface::VirtualInterfacePoll;
-use crate::wg::WireGuardTunnel;
-
-pub mod config;
-pub mod events;
-pub mod pcap;
-pub mod tunnel;
-pub mod virtual_device;
-pub mod virtual_iface;
-pub mod wg;
-
+#[cfg(feature = "bin")]
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
-    let config = Config::from_args().with_context(|| "Failed to read config")?;
+    use anyhow::Context;
+    use onetun::{config::Config, events::Bus};
+
+    let config = Config::from_args().context("Configuration has errors")?;
     init_logger(&config)?;
 
     for warning in &config.warnings {
         warn!("{}", warning);
     }
 
-    // Initialize the port pool for each protocol
-    let tcp_port_pool = TcpPortPool::new();
-    let udp_port_pool = UdpPortPool::new();
-
     let bus = Bus::default();
-
-    if let Some(pcap_file) = config.pcap_file.clone() {
-        // Start packet capture
-        let bus = bus.clone();
-        tokio::spawn(async move { pcap::capture(pcap_file, bus).await });
-    }
-
-    let wg = WireGuardTunnel::new(&config, bus.clone())
-        .await
-        .with_context(|| "Failed to initialize WireGuard tunnel")?;
-    let wg = Arc::new(wg);
-
-    {
-        // Start routine task for WireGuard
-        let wg = wg.clone();
-        tokio::spawn(async move { wg.routine_task().await });
-    }
-
-    {
-        // Start consumption task for WireGuard
-        let wg = wg.clone();
-        tokio::spawn(async move { wg.consume_task().await });
-    }
-
-    {
-        // Start production task for WireGuard
-        let wg = wg.clone();
-        tokio::spawn(async move { wg.produce_task().await });
-    }
-
-    if config
-        .port_forwards
-        .iter()
-        .any(|pf| pf.protocol == PortProtocol::Tcp)
-    {
-        // TCP device
-        let bus = bus.clone();
-        let device =
-            VirtualIpDevice::new(PortProtocol::Tcp, bus.clone(), config.max_transmission_unit);
-
-        // Start TCP Virtual Interface
-        let port_forwards = config.port_forwards.clone();
-        let iface = TcpVirtualInterface::new(port_forwards, bus, config.source_peer_ip);
-        tokio::spawn(async move { iface.poll_loop(device).await });
-    }
-
-    if config
-        .port_forwards
-        .iter()
-        .any(|pf| pf.protocol == PortProtocol::Udp)
-    {
-        // UDP device
-        let bus = bus.clone();
-        let device =
-            VirtualIpDevice::new(PortProtocol::Udp, bus.clone(), config.max_transmission_unit);
-
-        // Start UDP Virtual Interface
-        let port_forwards = config.port_forwards.clone();
-        let iface = UdpVirtualInterface::new(port_forwards, bus, config.source_peer_ip);
-        tokio::spawn(async move { iface.poll_loop(device).await });
-    }
-
-    {
-        let port_forwards = config.port_forwards;
-        let source_peer_ip = config.source_peer_ip;
-
-        port_forwards
-            .into_iter()
-            .map(|pf| {
-                (
-                    pf,
-                    wg.clone(),
-                    tcp_port_pool.clone(),
-                    udp_port_pool.clone(),
-                    bus.clone(),
-                )
-            })
-            .for_each(move |(pf, wg, tcp_port_pool, udp_port_pool, bus)| {
-                tokio::spawn(async move {
-                    tunnel::port_forward(pf, source_peer_ip, tcp_port_pool, udp_port_pool, wg, bus)
-                        .await
-                        .unwrap_or_else(|e| error!("Port-forward failed for {} : {}", pf, e))
-                });
-            });
-    }
+    onetun::start_tunnels(config, bus).await?;
 
     futures::future::pending().await
 }
 
-fn init_logger(config: &Config) -> anyhow::Result<()> {
+#[cfg(not(feature = "bin"))]
+fn main() -> anyhow::Result<()> {
+    Err(anyhow::anyhow!("Binary compiled without 'bin' feature"))
+}
+
+#[cfg(feature = "bin")]
+fn init_logger(config: &onetun::config::Config) -> anyhow::Result<()> {
+    use anyhow::Context;
+
     let mut builder = pretty_env_logger::formatted_timed_builder();
     builder.parse_filters(&config.log);
-    builder
-        .try_init()
-        .with_context(|| "Failed to initialize logger")
+    builder.try_init().context("Failed to initialize logger")
 }
diff --git a/src/pcap.rs b/src/pcap.rs
index 1771a33..487fbe0 100644
--- a/src/pcap.rs
+++ b/src/pcap.rs
@@ -16,7 +16,7 @@ impl Pcap {
         self.writer
             .flush()
             .await
-            .with_context(|| "Failed to flush pcap writer")
+            .context("Failed to flush pcap writer")
     }
 
     async fn write(&mut self, data: &[u8]) -> anyhow::Result<usize> {
@@ -30,14 +30,14 @@ impl Pcap {
         self.writer
             .write_u16(value)
             .await
-            .with_context(|| "Failed to write u16 to pcap writer")
+            .context("Failed to write u16 to pcap writer")
     }
 
     async fn write_u32(&mut self, value: u32) -> anyhow::Result<()> {
         self.writer
             .write_u32(value)
             .await
-            .with_context(|| "Failed to write u32 to pcap writer")
+            .context("Failed to write u32 to pcap writer")
     }
 
     async fn global_header(&mut self) -> anyhow::Result<()> {
@@ -64,14 +64,14 @@ impl Pcap {
     async fn packet(&mut self, timestamp: Instant, packet: &[u8]) -> anyhow::Result<()> {
         self.packet_header(timestamp, packet.len())
             .await
-            .with_context(|| "Failed to write packet header to pcap writer")?;
+            .context("Failed to write packet header to pcap writer")?;
         self.write(packet)
             .await
-            .with_context(|| "Failed to write packet to pcap writer")?;
+            .context("Failed to write packet to pcap writer")?;
         self.writer
             .flush()
             .await
-            .with_context(|| "Failed to flush pcap writer")?;
+            .context("Failed to flush pcap writer")?;
         self.flush().await
     }
 }
@@ -81,14 +81,14 @@ pub async fn capture(pcap_file: String, bus: Bus) -> anyhow::Result<()> {
     let mut endpoint = bus.new_endpoint();
     let file = File::create(&pcap_file)
         .await
-        .with_context(|| "Failed to create pcap file")?;
+        .context("Failed to create pcap file")?;
     let writer = BufWriter::new(file);
 
     let mut writer = Pcap { writer };
     writer
         .global_header()
         .await
-        .with_context(|| "Failed to write global header to pcap writer")?;
+        .context("Failed to write global header to pcap writer")?;
 
     info!("Capturing WireGuard IP packets to {}", &pcap_file);
     loop {
@@ -98,14 +98,14 @@ pub async fn capture(pcap_file: String, bus: Bus) -> anyhow::Result<()> {
                 writer
                     .packet(instant, &ip)
                     .await
-                    .with_context(|| "Failed to write inbound IP packet to pcap writer")?;
+                    .context("Failed to write inbound IP packet to pcap writer")?;
             }
             Event::OutboundInternetPacket(ip) => {
                 let instant = Instant::now();
                 writer
                     .packet(instant, &ip)
                     .await
-                    .with_context(|| "Failed to write output IP packet to pcap writer")?;
+                    .context("Failed to write output IP packet to pcap writer")?;
             }
             _ => {}
         }
diff --git a/src/tunnel/tcp.rs b/src/tunnel/tcp.rs
index e9644b9..47b0197 100644
--- a/src/tunnel/tcp.rs
+++ b/src/tunnel/tcp.rs
@@ -1,17 +1,18 @@
-use crate::config::{PortForwardConfig, PortProtocol};
-use crate::virtual_iface::VirtualPort;
-use anyhow::Context;
 use std::collections::VecDeque;
-use std::sync::Arc;
-use tokio::net::{TcpListener, TcpStream};
-
 use std::ops::Range;
+use std::sync::Arc;
 use std::time::Duration;
 
-use crate::events::{Bus, Event};
+use anyhow::Context;
+use bytes::BytesMut;
 use rand::seq::SliceRandom;
 use rand::thread_rng;
 use tokio::io::AsyncWriteExt;
+use tokio::net::{TcpListener, TcpStream};
+
+use crate::config::{PortForwardConfig, PortProtocol};
+use crate::events::{Bus, Event};
+use crate::virtual_iface::VirtualPort;
 
 const MAX_PACKET: usize = 65536;
 const MIN_PORT: u16 = 1000;
@@ -26,14 +27,14 @@ pub async fn tcp_proxy_server(
 ) -> anyhow::Result<()> {
     let listener = TcpListener::bind(port_forward.source)
         .await
-        .with_context(|| "Failed to listen on TCP proxy server")?;
+        .context("Failed to listen on TCP proxy server")?;
 
     loop {
         let port_pool = port_pool.clone();
         let (socket, peer_addr) = listener
             .accept()
             .await
-            .with_context(|| "Failed to accept connection on TCP proxy server")?;
+            .context("Failed to accept connection on TCP proxy server")?;
 
         // Assign a 'virtual port': this is a unique port number used to route IP packets
         // received from the WireGuard tunnel. It is the port number that the virtual client will
@@ -81,7 +82,7 @@ async fn handle_tcp_proxy_connection(
     let mut endpoint = bus.new_endpoint();
     endpoint.send(Event::ClientConnectionInitiated(port_forward, virtual_port));
 
-    let mut buffer = Vec::with_capacity(MAX_PACKET);
+    let mut buffer = BytesMut::with_capacity(MAX_PACKET);
     loop {
         tokio::select! {
             readable_result = socket.readable() => {
@@ -90,7 +91,7 @@ async fn handle_tcp_proxy_connection(
                         match socket.try_read_buf(&mut buffer) {
                             Ok(size) if size > 0 => {
                                 let data = Vec::from(&buffer[..size]);
-                                endpoint.send(Event::LocalData(port_forward, virtual_port, data));
+                                endpoint.send(Event::LocalData(port_forward, virtual_port, data.into()));
                                 // Reset buffer
                                 buffer.clear();
                             }
@@ -185,13 +186,13 @@ impl TcpPortPool {
         }
     }
 
-    /// Requests a free port from the pool. An error is returned if none is available (exhaused max capacity).
+    /// Requests a free port from the pool. An error is returned if none is available (exhausted max capacity).
     pub async fn next(&self) -> anyhow::Result<VirtualPort> {
         let mut inner = self.inner.write().await;
         let port = inner
             .queue
             .pop_front()
-            .with_context(|| "TCP virtual port pool is exhausted")?;
+            .context("TCP virtual port pool is exhausted")?;
         Ok(VirtualPort::new(port, PortProtocol::Tcp))
     }
 
diff --git a/src/tunnel/udp.rs b/src/tunnel/udp.rs
index 1d25914..ab52dc7 100644
--- a/src/tunnel/udp.rs
+++ b/src/tunnel/udp.rs
@@ -4,14 +4,15 @@ use std::ops::Range;
 use std::sync::Arc;
 use std::time::Instant;
 
-use crate::events::{Bus, Event};
 use anyhow::Context;
+use bytes::Bytes;
 use priority_queue::double_priority_queue::DoublePriorityQueue;
 use rand::seq::SliceRandom;
 use rand::thread_rng;
 use tokio::net::UdpSocket;
 
 use crate::config::{PortForwardConfig, PortProtocol};
+use crate::events::{Bus, Event};
 use crate::virtual_iface::VirtualPort;
 
 const MAX_PACKET: usize = 65536;
@@ -36,7 +37,7 @@ pub async fn udp_proxy_server(
     let mut endpoint = bus.new_endpoint();
     let socket = UdpSocket::bind(port_forward.source)
         .await
-        .with_context(|| "Failed to bind on UDP proxy address")?;
+        .context("Failed to bind on UDP proxy address")?;
 
     let mut buffer = [0u8; MAX_PACKET];
     loop {
@@ -98,11 +99,11 @@ async fn next_udp_datagram(
     socket: &UdpSocket,
     buffer: &mut [u8],
     port_pool: UdpPortPool,
-) -> anyhow::Result<Option<(VirtualPort, Vec<u8>)>> {
+) -> anyhow::Result<Option<(VirtualPort, Bytes)>> {
     let (size, peer_addr) = socket
         .recv_from(buffer)
         .await
-        .with_context(|| "Failed to accept incoming UDP datagram")?;
+        .context("Failed to accept incoming UDP datagram")?;
 
     // Assign a 'virtual port': this is a unique port number used to route IP packets
     // received from the WireGuard tunnel. It is the port number that the virtual client will
@@ -126,7 +127,7 @@ async fn next_udp_datagram(
     port_pool.update_last_transmit(port).await;
 
     let data = buffer[..size].to_vec();
-    Ok(Some((port, data)))
+    Ok(Some((port, data.into())))
 }
 
 /// A pool of virtual ports available for TCP connections.
@@ -211,7 +212,7 @@ impl UdpPortPool {
                     None
                 }
             })
-            .with_context(|| "virtual port pool is exhausted")?;
+            .context("Virtual port pool is exhausted")?;
 
         inner.port_by_peer_addr.insert(peer_addr, port);
         inner.peer_addr_by_port.insert(port, peer_addr);
diff --git a/src/virtual_device.rs b/src/virtual_device.rs
index e0e7e4d..28d8751 100644
--- a/src/virtual_device.rs
+++ b/src/virtual_device.rs
@@ -1,10 +1,15 @@
 use crate::config::PortProtocol;
 use crate::events::{BusSender, Event};
 use crate::Bus;
-use smoltcp::phy::{Device, DeviceCapabilities, Medium};
-use smoltcp::time::Instant;
-use std::collections::VecDeque;
-use std::sync::{Arc, Mutex};
+use bytes::{BufMut, Bytes, BytesMut};
+use smoltcp::{
+    phy::{DeviceCapabilities, Medium},
+    time::Instant,
+};
+use std::{
+    collections::VecDeque,
+    sync::{Arc, Mutex},
+};
 
 /// A virtual device that processes IP packets through smoltcp and WireGuard.
 pub struct VirtualIpDevice {
@@ -13,7 +18,7 @@ pub struct VirtualIpDevice {
     /// Channel receiver for received IP packets.
     bus_sender: BusSender,
     /// Local queue for packets received from the bus that need to go through the smoltcp interface.
-    process_queue: Arc<Mutex<VecDeque<Vec<u8>>>>,
+    process_queue: Arc<Mutex<VecDeque<Bytes>>>,
 }
 
 impl VirtualIpDevice {
@@ -49,11 +54,17 @@ impl VirtualIpDevice {
     }
 }
 
-impl<'a> Device<'a> for VirtualIpDevice {
-    type RxToken = RxToken;
-    type TxToken = TxToken;
+impl smoltcp::phy::Device for VirtualIpDevice {
+    type RxToken<'a>
+        = RxToken
+    where
+        Self: 'a;
+    type TxToken<'a>
+        = TxToken
+    where
+        Self: 'a;
 
-    fn receive(&'a mut self) -> Option<(Self::RxToken, Self::TxToken)> {
+    fn receive(&mut self, _timestamp: Instant) -> Option<(Self::RxToken<'_>, Self::TxToken<'_>)> {
         let next = {
             let mut queue = self
                 .process_queue
@@ -63,7 +74,13 @@ impl<'a> Device<'a> for VirtualIpDevice {
         };
         match next {
             Some(buffer) => Some((
-                Self::RxToken { buffer },
+                Self::RxToken {
+                    buffer: {
+                        let mut buf = BytesMut::new();
+                        buf.put(buffer);
+                        buf
+                    },
+                },
                 Self::TxToken {
                     sender: self.bus_sender.clone(),
                 },
@@ -72,7 +89,7 @@ impl<'a> Device<'a> for VirtualIpDevice {
         }
     }
 
-    fn transmit(&'a mut self) -> Option<Self::TxToken> {
+    fn transmit(&mut self, _timestamp: Instant) -> Option<Self::TxToken<'_>> {
         Some(TxToken {
             sender: self.bus_sender.clone(),
         })
@@ -88,15 +105,15 @@ impl<'a> Device<'a> for VirtualIpDevice {
 
 #[doc(hidden)]
 pub struct RxToken {
-    buffer: Vec<u8>,
+    buffer: BytesMut,
 }
 
 impl smoltcp::phy::RxToken for RxToken {
-    fn consume<R, F>(mut self, _timestamp: Instant, f: F) -> smoltcp::Result<R>
+    fn consume<R, F>(self, f: F) -> R
     where
-        F: FnOnce(&mut [u8]) -> smoltcp::Result<R>,
+        F: FnOnce(&[u8]) -> R,
     {
-        f(&mut self.buffer)
+        f(&self.buffer)
     }
 }
 
@@ -106,14 +123,14 @@ pub struct TxToken {
 }
 
 impl smoltcp::phy::TxToken for TxToken {
-    fn consume<R, F>(self, _timestamp: Instant, len: usize, f: F) -> smoltcp::Result<R>
+    fn consume<R, F>(self, len: usize, f: F) -> R
     where
-        F: FnOnce(&mut [u8]) -> smoltcp::Result<R>,
+        F: FnOnce(&mut [u8]) -> R,
     {
-        let mut buffer = Vec::new();
-        buffer.resize(len, 0);
+        let mut buffer = vec![0; len];
         let result = f(&mut buffer);
-        self.sender.send(Event::OutboundInternetPacket(buffer));
+        self.sender
+            .send(Event::OutboundInternetPacket(buffer.into()));
         result
     }
 }
diff --git a/src/virtual_iface/tcp.rs b/src/virtual_iface/tcp.rs
index 28eacac..3a3fd8d 100644
--- a/src/virtual_iface/tcp.rs
+++ b/src/virtual_iface/tcp.rs
@@ -5,12 +5,19 @@ use crate::virtual_iface::{VirtualInterfacePoll, VirtualPort};
 use crate::Bus;
 use anyhow::Context;
 use async_trait::async_trait;
-use smoltcp::iface::{InterfaceBuilder, SocketHandle};
-use smoltcp::socket::{TcpSocket, TcpSocketBuffer, TcpState};
-use smoltcp::wire::{IpAddress, IpCidr};
-use std::collections::{HashMap, HashSet, VecDeque};
-use std::net::IpAddr;
-use std::time::Duration;
+use bytes::Bytes;
+use smoltcp::iface::PollResult;
+use smoltcp::{
+    iface::{Config, Interface, SocketHandle, SocketSet},
+    socket::tcp,
+    time::Instant,
+    wire::{HardwareAddress, IpAddress, IpCidr, IpVersion},
+};
+use std::{
+    collections::{HashMap, HashSet, VecDeque},
+    net::IpAddr,
+    time::Duration,
+};
 
 const MAX_PACKET: usize = 65536;
 
@@ -19,6 +26,7 @@ pub struct TcpVirtualInterface {
     source_peer_ip: IpAddr,
     port_forwards: Vec<PortForwardConfig>,
     bus: Bus,
+    sockets: SocketSet<'static>,
 }
 
 impl TcpVirtualInterface {
@@ -32,33 +40,34 @@ impl TcpVirtualInterface {
                 .collect(),
             source_peer_ip,
             bus,
+            sockets: SocketSet::new([]),
         }
     }
 
-    fn new_server_socket(port_forward: PortForwardConfig) -> anyhow::Result<TcpSocket<'static>> {
+    fn new_server_socket(port_forward: PortForwardConfig) -> anyhow::Result<tcp::Socket<'static>> {
         static mut TCP_SERVER_RX_DATA: [u8; 0] = [];
         static mut TCP_SERVER_TX_DATA: [u8; 0] = [];
 
-        let tcp_rx_buffer = TcpSocketBuffer::new(unsafe { &mut TCP_SERVER_RX_DATA[..] });
-        let tcp_tx_buffer = TcpSocketBuffer::new(unsafe { &mut TCP_SERVER_TX_DATA[..] });
-        let mut socket = TcpSocket::new(tcp_rx_buffer, tcp_tx_buffer);
+        let tcp_rx_buffer = tcp::SocketBuffer::new(unsafe { &mut TCP_SERVER_RX_DATA[..] });
+        let tcp_tx_buffer = tcp::SocketBuffer::new(unsafe { &mut TCP_SERVER_TX_DATA[..] });
+        let mut socket = tcp::Socket::new(tcp_rx_buffer, tcp_tx_buffer);
 
         socket
             .listen((
                 IpAddress::from(port_forward.destination.ip()),
                 port_forward.destination.port(),
             ))
-            .with_context(|| "Virtual server socket failed to listen")?;
+            .context("Virtual server socket failed to listen")?;
 
         Ok(socket)
     }
 
-    fn new_client_socket() -> anyhow::Result<TcpSocket<'static>> {
+    fn new_client_socket() -> anyhow::Result<tcp::Socket<'static>> {
         let rx_data = vec![0u8; MAX_PACKET];
         let tx_data = vec![0u8; MAX_PACKET];
-        let tcp_rx_buffer = TcpSocketBuffer::new(rx_data);
-        let tcp_tx_buffer = TcpSocketBuffer::new(tx_data);
-        let socket = TcpSocket::new(tcp_rx_buffer, tcp_tx_buffer);
+        let tcp_rx_buffer = tcp::SocketBuffer::new(rx_data);
+        let tcp_tx_buffer = tcp::SocketBuffer::new(tx_data);
+        let socket = tcp::Socket::new(tcp_rx_buffer, tcp_tx_buffer);
         Ok(socket)
     }
 
@@ -70,26 +79,32 @@ impl TcpVirtualInterface {
         }
         addresses
             .into_iter()
-            .map(|addr| IpCidr::new(addr, 32))
+            .map(|addr| IpCidr::new(addr, addr_length(&addr)))
             .collect()
     }
 }
 
 #[async_trait]
 impl VirtualInterfacePoll for TcpVirtualInterface {
-    async fn poll_loop(self, device: VirtualIpDevice) -> anyhow::Result<()> {
+    async fn poll_loop(mut self, mut device: VirtualIpDevice) -> anyhow::Result<()> {
         // Create CIDR block for source peer IP + each port forward IP
         let addresses = self.addresses();
+        let config = Config::new(HardwareAddress::Ip);
 
         // Create virtual interface (contains smoltcp state machine)
-        let mut iface = InterfaceBuilder::new(device, vec![])
-            .ip_addrs(addresses)
-            .finalize();
+        let mut iface = Interface::new(config, &mut device, Instant::now());
+        iface.update_ip_addrs(|ip_addrs| {
+            addresses.into_iter().for_each(|addr| {
+                ip_addrs
+                    .push(addr)
+                    .expect("maximum number of IPs in TCP interface reached");
+            });
+        });
 
         // Create virtual server for each port forward
         for port_forward in self.port_forwards.iter() {
             let server_socket = TcpVirtualInterface::new_server_socket(*port_forward)?;
-            iface.add_socket(server_socket);
+            self.sockets.add(server_socket);
         }
 
         // The next time to poll the interface. Can be None for instant poll.
@@ -102,7 +117,7 @@ impl VirtualInterfacePoll for TcpVirtualInterface {
         let mut port_client_handle_map: HashMap<VirtualPort, SocketHandle> = HashMap::new();
 
         // Data packets to send from a virtual client
-        let mut send_queue: HashMap<VirtualPort, VecDeque<Vec<u8>>> = HashMap::new();
+        let mut send_queue: HashMap<VirtualPort, VecDeque<Bytes>> = HashMap::new();
 
         loop {
             tokio::select! {
@@ -115,11 +130,11 @@ impl VirtualInterfacePoll for TcpVirtualInterface {
 
                     // Find closed sockets
                     port_client_handle_map.retain(|virtual_port, client_handle| {
-                        let client_socket = iface.get_socket::<TcpSocket>(*client_handle);
-                        if client_socket.state() == TcpState::Closed {
+                        let client_socket = self.sockets.get_mut::<tcp::Socket>(*client_handle);
+                        if client_socket.state() == tcp::State::Closed {
                             endpoint.send(Event::ClientConnectionDropped(*virtual_port));
                             send_queue.remove(virtual_port);
-                            iface.remove_socket(*client_handle);
+                            self.sockets.remove(*client_handle);
                             false
                         } else {
                             // Not closed, retain
@@ -127,16 +142,12 @@ impl VirtualInterfacePoll for TcpVirtualInterface {
                         }
                     });
 
-                    match iface.poll(loop_start) {
-                        Ok(processed) if processed => {
-                            trace!("TCP virtual interface polled some packets to be processed");
-                        }
-                        Err(e) => error!("TCP virtual interface poll error: {:?}", e),
-                        _ => {}
+                    if iface.poll(loop_start, &mut device, &mut self.sockets) == PollResult::SocketStateChanged {
+                        log::trace!("TCP virtual interface polled some packets to be processed");
                     }
 
                     for (virtual_port, client_handle) in port_client_handle_map.iter() {
-                        let client_socket = iface.get_socket::<TcpSocket>(*client_handle);
+                        let client_socket = self.sockets.get_mut::<tcp::Socket>(*client_handle);
                         if client_socket.can_send() {
                             if let Some(send_queue) = send_queue.get_mut(virtual_port) {
                                 let to_transfer = send_queue.pop_front();
@@ -147,7 +158,7 @@ impl VirtualInterfacePoll for TcpVirtualInterface {
                                             if sent < total {
                                                 // Sometimes only a subset is sent, so the rest needs to be sent on the next poll
                                                 let tx_extra = Vec::from(&to_transfer_slice[sent..total]);
-                                                send_queue.push_front(tx_extra);
+                                                send_queue.push_front(tx_extra.into());
                                             }
                                         }
                                         Err(e) => {
@@ -156,13 +167,13 @@ impl VirtualInterfacePoll for TcpVirtualInterface {
                                             );
                                         }
                                     }
-                                } else if client_socket.state() == TcpState::CloseWait {
+                                } else if client_socket.state() == tcp::State::CloseWait {
                                     client_socket.close();
                                 }
                             }
                         }
                         if client_socket.can_recv() {
-                            match client_socket.recv(|buffer| (buffer.len(), buffer.to_vec())) {
+                            match client_socket.recv(|buffer| (buffer.len(), Bytes::from(buffer.to_vec()))) {
                                 Ok(data) => {
                                     debug!("[{}] Received {} bytes from virtual server", virtual_port, data.len());
                                     if !data.is_empty() {
@@ -179,7 +190,7 @@ impl VirtualInterfacePoll for TcpVirtualInterface {
                     }
 
                     // The virtual interface determines the next time to poll (this is to reduce unnecessary polls)
-                    next_poll = match iface.poll_delay(loop_start) {
+                    next_poll = match iface.poll_delay(loop_start, &self.sockets) {
                         Some(smoltcp::time::Duration::ZERO) => None,
                         Some(delay) => {
                             trace!("TCP Virtual interface delayed next poll by {}", delay);
@@ -192,13 +203,14 @@ impl VirtualInterfacePoll for TcpVirtualInterface {
                     match event {
                         Event::ClientConnectionInitiated(port_forward, virtual_port) => {
                             let client_socket = TcpVirtualInterface::new_client_socket()?;
-                            let client_handle = iface.add_socket(client_socket);
+                            let client_handle = self.sockets.add(client_socket);
 
                             // Add handle to map
                             port_client_handle_map.insert(virtual_port, client_handle);
                             send_queue.insert(virtual_port, VecDeque::new());
 
-                            let (client_socket, context) = iface.get_socket_and_context::<TcpSocket>(client_handle);
+                            let client_socket = self.sockets.get_mut::<tcp::Socket>(client_handle);
+                            let context = iface.context();
 
                             client_socket
                                 .connect(
@@ -209,13 +221,13 @@ impl VirtualInterfacePoll for TcpVirtualInterface {
                                     ),
                                     (IpAddress::from(self.source_peer_ip), virtual_port.num()),
                                 )
-                                .with_context(|| "Virtual server socket failed to listen")?;
+                                .context("Virtual server socket failed to listen")?;
 
                             next_poll = None;
                         }
                         Event::ClientConnectionDropped(virtual_port) => {
                             if let Some(client_handle) = port_client_handle_map.get(&virtual_port) {
-                                let client_socket = iface.get_socket::<TcpSocket>(*client_handle);
+                                let client_socket = self.sockets.get_mut::<tcp::Socket>(*client_handle);
                                 client_socket.close();
                                 next_poll = None;
                             }
@@ -226,7 +238,7 @@ impl VirtualInterfacePoll for TcpVirtualInterface {
                                 next_poll = None;
                             }
                         }
-                        Event::VirtualDeviceFed(protocol) if protocol == PortProtocol::Tcp => {
+                        Event::VirtualDeviceFed(PortProtocol::Tcp) => {
                             next_poll = None;
                         }
                         _ => {}
@@ -236,3 +248,10 @@ impl VirtualInterfacePoll for TcpVirtualInterface {
         }
     }
 }
+
+const fn addr_length(addr: &IpAddress) -> u8 {
+    match addr.version() {
+        IpVersion::Ipv4 => 32,
+        IpVersion::Ipv6 => 128,
+    }
+}
diff --git a/src/virtual_iface/udp.rs b/src/virtual_iface/udp.rs
index d939132..cb643c9 100644
--- a/src/virtual_iface/udp.rs
+++ b/src/virtual_iface/udp.rs
@@ -1,18 +1,23 @@
-use anyhow::Context;
-use std::collections::{HashMap, HashSet, VecDeque};
-use std::net::IpAddr;
-
-use crate::events::Event;
-use crate::{Bus, PortProtocol};
-use async_trait::async_trait;
-use smoltcp::iface::{InterfaceBuilder, SocketHandle};
-use smoltcp::socket::{UdpPacketMetadata, UdpSocket, UdpSocketBuffer};
-use smoltcp::wire::{IpAddress, IpCidr};
-use std::time::Duration;
-
 use crate::config::PortForwardConfig;
+use crate::events::Event;
 use crate::virtual_device::VirtualIpDevice;
 use crate::virtual_iface::{VirtualInterfacePoll, VirtualPort};
+use crate::{Bus, PortProtocol};
+use anyhow::Context;
+use async_trait::async_trait;
+use bytes::Bytes;
+use smoltcp::iface::PollResult;
+use smoltcp::{
+    iface::{Config, Interface, SocketHandle, SocketSet},
+    socket::udp::{self, UdpMetadata},
+    time::Instant,
+    wire::{HardwareAddress, IpAddress, IpCidr, IpVersion},
+};
+use std::{
+    collections::{HashMap, HashSet, VecDeque},
+    net::IpAddr,
+    time::Duration,
+};
 
 const MAX_PACKET: usize = 65536;
 
@@ -20,6 +25,7 @@ pub struct UdpVirtualInterface {
     source_peer_ip: IpAddr,
     port_forwards: Vec<PortForwardConfig>,
     bus: Bus,
+    sockets: SocketSet<'static>,
 }
 
 impl UdpVirtualInterface {
@@ -33,44 +39,47 @@ impl UdpVirtualInterface {
                 .collect(),
             source_peer_ip,
             bus,
+            sockets: SocketSet::new([]),
         }
     }
 
-    fn new_server_socket(port_forward: PortForwardConfig) -> anyhow::Result<UdpSocket<'static>> {
-        static mut UDP_SERVER_RX_META: [UdpPacketMetadata; 0] = [];
+    fn new_server_socket(port_forward: PortForwardConfig) -> anyhow::Result<udp::Socket<'static>> {
+        static mut UDP_SERVER_RX_META: [udp::PacketMetadata; 0] = [];
         static mut UDP_SERVER_RX_DATA: [u8; 0] = [];
-        static mut UDP_SERVER_TX_META: [UdpPacketMetadata; 0] = [];
+        static mut UDP_SERVER_TX_META: [udp::PacketMetadata; 0] = [];
         static mut UDP_SERVER_TX_DATA: [u8; 0] = [];
-        let udp_rx_buffer = UdpSocketBuffer::new(unsafe { &mut UDP_SERVER_RX_META[..] }, unsafe {
-            &mut UDP_SERVER_RX_DATA[..]
-        });
-        let udp_tx_buffer = UdpSocketBuffer::new(unsafe { &mut UDP_SERVER_TX_META[..] }, unsafe {
-            &mut UDP_SERVER_TX_DATA[..]
-        });
-        let mut socket = UdpSocket::new(udp_rx_buffer, udp_tx_buffer);
+        let udp_rx_buffer =
+            udp::PacketBuffer::new(unsafe { &mut UDP_SERVER_RX_META[..] }, unsafe {
+                &mut UDP_SERVER_RX_DATA[..]
+            });
+        let udp_tx_buffer =
+            udp::PacketBuffer::new(unsafe { &mut UDP_SERVER_TX_META[..] }, unsafe {
+                &mut UDP_SERVER_TX_DATA[..]
+            });
+        let mut socket = udp::Socket::new(udp_rx_buffer, udp_tx_buffer);
         socket
             .bind((
                 IpAddress::from(port_forward.destination.ip()),
                 port_forward.destination.port(),
             ))
-            .with_context(|| "UDP virtual server socket failed to bind")?;
+            .context("UDP virtual server socket failed to bind")?;
         Ok(socket)
     }
 
     fn new_client_socket(
         source_peer_ip: IpAddr,
         client_port: VirtualPort,
-    ) -> anyhow::Result<UdpSocket<'static>> {
-        let rx_meta = vec![UdpPacketMetadata::EMPTY; 10];
-        let tx_meta = vec![UdpPacketMetadata::EMPTY; 10];
+    ) -> anyhow::Result<udp::Socket<'static>> {
+        let rx_meta = vec![udp::PacketMetadata::EMPTY; 10];
+        let tx_meta = vec![udp::PacketMetadata::EMPTY; 10];
         let rx_data = vec![0u8; MAX_PACKET];
         let tx_data = vec![0u8; MAX_PACKET];
-        let udp_rx_buffer = UdpSocketBuffer::new(rx_meta, rx_data);
-        let udp_tx_buffer = UdpSocketBuffer::new(tx_meta, tx_data);
-        let mut socket = UdpSocket::new(udp_rx_buffer, udp_tx_buffer);
+        let udp_rx_buffer = udp::PacketBuffer::new(rx_meta, rx_data);
+        let udp_tx_buffer = udp::PacketBuffer::new(tx_meta, tx_data);
+        let mut socket = udp::Socket::new(udp_rx_buffer, udp_tx_buffer);
         socket
             .bind((IpAddress::from(source_peer_ip), client_port.num()))
-            .with_context(|| "UDP virtual client failed to bind")?;
+            .context("UDP virtual client failed to bind")?;
         Ok(socket)
     }
 
@@ -82,26 +91,32 @@ impl UdpVirtualInterface {
         }
         addresses
             .into_iter()
-            .map(|addr| IpCidr::new(addr, 32))
+            .map(|addr| IpCidr::new(addr, addr_length(&addr)))
             .collect()
     }
 }
 
 #[async_trait]
 impl VirtualInterfacePoll for UdpVirtualInterface {
-    async fn poll_loop(self, device: VirtualIpDevice) -> anyhow::Result<()> {
+    async fn poll_loop(mut self, mut device: VirtualIpDevice) -> anyhow::Result<()> {
         // Create CIDR block for source peer IP + each port forward IP
         let addresses = self.addresses();
+        let config = Config::new(HardwareAddress::Ip);
 
         // Create virtual interface (contains smoltcp state machine)
-        let mut iface = InterfaceBuilder::new(device, vec![])
-            .ip_addrs(addresses)
-            .finalize();
+        let mut iface = Interface::new(config, &mut device, Instant::now());
+        iface.update_ip_addrs(|ip_addrs| {
+            addresses.into_iter().for_each(|addr| {
+                ip_addrs
+                    .push(addr)
+                    .expect("maximum number of IPs in UDP interface reached");
+            });
+        });
 
         // Create virtual server for each port forward
         for port_forward in self.port_forwards.iter() {
             let server_socket = UdpVirtualInterface::new_server_socket(*port_forward)?;
-            iface.add_socket(server_socket);
+            self.sockets.add(server_socket);
         }
 
         // The next time to poll the interface. Can be None for instant poll.
@@ -114,7 +129,7 @@ impl VirtualInterfacePoll for UdpVirtualInterface {
         let mut port_client_handle_map: HashMap<VirtualPort, SocketHandle> = HashMap::new();
 
         // Data packets to send from a virtual client
-        let mut send_queue: HashMap<VirtualPort, VecDeque<(PortForwardConfig, Vec<u8>)>> =
+        let mut send_queue: HashMap<VirtualPort, VecDeque<(PortForwardConfig, Bytes)>> =
             HashMap::new();
 
         loop {
@@ -126,16 +141,12 @@ impl VirtualInterfacePoll for UdpVirtualInterface {
                 } => {
                     let loop_start = smoltcp::time::Instant::now();
 
-                    match iface.poll(loop_start) {
-                        Ok(processed) if processed => {
-                            trace!("UDP virtual interface polled some packets to be processed");
-                        }
-                        Err(e) => error!("UDP virtual interface poll error: {:?}", e),
-                        _ => {}
+                    if iface.poll(loop_start, &mut device, &mut self.sockets) == PollResult::SocketStateChanged {
+                        log::trace!("UDP virtual interface polled some packets to be processed");
                     }
 
                     for (virtual_port, client_handle) in port_client_handle_map.iter() {
-                        let client_socket = iface.get_socket::<UdpSocket>(*client_handle);
+                        let client_socket = self.sockets.get_mut::<udp::Socket>(*client_handle);
                         if client_socket.can_send() {
                             if let Some(send_queue) = send_queue.get_mut(virtual_port) {
                                 let to_transfer = send_queue.pop_front();
@@ -143,7 +154,7 @@ impl VirtualInterfacePoll for UdpVirtualInterface {
                                     client_socket
                                         .send_slice(
                                             &data,
-                                            (IpAddress::from(port_forward.destination.ip()), port_forward.destination.port()).into(),
+                                            UdpMetadata::from(port_forward.destination),
                                         )
                                         .unwrap_or_else(|e| {
                                             error!(
@@ -158,7 +169,7 @@ impl VirtualInterfacePoll for UdpVirtualInterface {
                             match client_socket.recv() {
                                 Ok((data, _peer)) => {
                                     if !data.is_empty() {
-                                        endpoint.send(Event::RemoteData(*virtual_port, data.to_vec()));
+                                        endpoint.send(Event::RemoteData(*virtual_port, data.to_vec().into()));
                                     }
                                 }
                                 Err(e) => {
@@ -171,7 +182,7 @@ impl VirtualInterfacePoll for UdpVirtualInterface {
                     }
 
                     // The virtual interface determines the next time to poll (this is to reduce unnecessary polls)
-                    next_poll = match iface.poll_delay(loop_start) {
+                    next_poll = match iface.poll_delay(loop_start, &self.sockets) {
                         Some(smoltcp::time::Duration::ZERO) => None,
                         Some(delay) => {
                             trace!("UDP Virtual interface delayed next poll by {}", delay);
@@ -189,7 +200,7 @@ impl VirtualInterfacePoll for UdpVirtualInterface {
                             } else {
                                 // Client socket does not exist
                                 let client_socket = UdpVirtualInterface::new_client_socket(self.source_peer_ip, virtual_port)?;
-                                let client_handle = iface.add_socket(client_socket);
+                                let client_handle = self.sockets.add(client_socket);
 
                                 // Add handle to map
                                 port_client_handle_map.insert(virtual_port, client_handle);
@@ -197,7 +208,7 @@ impl VirtualInterfacePoll for UdpVirtualInterface {
                             }
                             next_poll = None;
                         }
-                        Event::VirtualDeviceFed(protocol) if protocol == PortProtocol::Udp => {
+                        Event::VirtualDeviceFed(PortProtocol::Udp) => {
                             next_poll = None;
                         }
                         _ => {}
@@ -207,3 +218,10 @@ impl VirtualInterfacePoll for UdpVirtualInterface {
         }
     }
 }
+
+const fn addr_length(addr: &IpAddress) -> u8 {
+    match addr.version() {
+        IpVersion::Ipv4 => 32,
+        IpVersion::Ipv6 => 128,
+    }
+}
diff --git a/src/wg.rs b/src/wg.rs
index 60767e3..f114c43 100644
--- a/src/wg.rs
+++ b/src/wg.rs
@@ -1,12 +1,15 @@
-use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
+use std::net::{IpAddr, SocketAddr};
 use std::time::Duration;
 
 use crate::Bus;
 use anyhow::Context;
+use async_recursion::async_recursion;
+use boringtun::noise::errors::WireGuardError;
 use boringtun::noise::{Tunn, TunnResult};
 use log::Level;
 use smoltcp::wire::{IpProtocol, IpVersion, Ipv4Packet, Ipv6Packet};
 use tokio::net::UdpSocket;
+use tokio::sync::Mutex;
 
 use crate::config::{Config, PortProtocol};
 use crate::events::Event;
@@ -21,7 +24,7 @@ const MAX_PACKET: usize = 65536;
 pub struct WireGuardTunnel {
     pub(crate) source_peer_ip: IpAddr,
     /// `boringtun` peer/tunnel implementation, used for crypto & WG protocol.
-    peer: Box<Tunn>,
+    peer: Mutex<Box<Tunn>>,
     /// The UDP socket for the public WireGuard endpoint to connect to.
     udp: UdpSocket,
     /// The address of the public WireGuard endpoint (UDP).
@@ -34,14 +37,11 @@ impl WireGuardTunnel {
     /// Initialize a new WireGuard tunnel.
     pub async fn new(config: &Config, bus: Bus) -> anyhow::Result<Self> {
         let source_peer_ip = config.source_peer_ip;
-        let peer = Self::create_tunnel(config)?;
+        let peer = Mutex::new(Box::new(Self::create_tunnel(config)?));
         let endpoint = config.endpoint_addr;
-        let udp = UdpSocket::bind(match endpoint {
-            SocketAddr::V4(_) => "0.0.0.0:0",
-            SocketAddr::V6(_) => "[::]:0",
-        })
-        .await
-        .with_context(|| "Failed to create UDP socket for WireGuard connection")?;
+        let udp = UdpSocket::bind(config.endpoint_bind_addr)
+            .await
+            .context("Failed to create UDP socket for WireGuard connection")?;
 
         Ok(Self {
             source_peer_ip,
@@ -56,12 +56,16 @@ impl WireGuardTunnel {
     pub async fn send_ip_packet(&self, packet: &[u8]) -> anyhow::Result<()> {
         trace_ip_packet("Sending IP packet", packet);
         let mut send_buf = [0u8; MAX_PACKET];
-        match self.peer.encapsulate(packet, &mut send_buf) {
+        let encapsulate_result = {
+            let mut peer = self.peer.lock().await;
+            peer.encapsulate(packet, &mut send_buf)
+        };
+        match encapsulate_result {
             TunnResult::WriteToNetwork(packet) => {
                 self.udp
                     .send_to(packet, self.endpoint)
                     .await
-                    .with_context(|| "Failed to send encrypted IP packet to WireGuard endpoint.")?;
+                    .context("Failed to send encrypted IP packet to WireGuard endpoint.")?;
                 debug!(
                     "Sent {} bytes to WireGuard endpoint (encrypted IP packet)",
                     packet.len()
@@ -105,39 +109,57 @@ impl WireGuardTunnel {
 
         loop {
             let mut send_buf = [0u8; MAX_PACKET];
-            match self.peer.update_timers(&mut send_buf) {
-                TunnResult::WriteToNetwork(packet) => {
-                    debug!(
-                        "Sending routine packet of {} bytes to WireGuard endpoint",
-                        packet.len()
-                    );
-                    match self.udp.send_to(packet, self.endpoint).await {
-                        Ok(_) => {}
-                        Err(e) => {
-                            error!(
-                                "Failed to send routine packet to WireGuard endpoint: {:?}",
-                                e
-                            );
-                        }
-                    };
-                }
-                TunnResult::Err(e) => {
-                    error!(
-                        "Failed to prepare routine packet for WireGuard endpoint: {:?}",
-                        e
-                    );
-                }
-                TunnResult::Done => {
-                    // Sleep for a bit
-                    tokio::time::sleep(Duration::from_millis(1)).await;
-                }
-                other => {
-                    warn!("Unexpected WireGuard routine task state: {:?}", other);
-                }
-            }
+            let tun_result = { self.peer.lock().await.update_timers(&mut send_buf) };
+            self.handle_routine_tun_result(tun_result).await;
         }
     }
 
+    #[async_recursion]
+    async fn handle_routine_tun_result<'a: 'async_recursion>(&self, result: TunnResult<'a>) -> () {
+        match result {
+            TunnResult::WriteToNetwork(packet) => {
+                debug!(
+                    "Sending routine packet of {} bytes to WireGuard endpoint",
+                    packet.len()
+                );
+                match self.udp.send_to(packet, self.endpoint).await {
+                    Ok(_) => {}
+                    Err(e) => {
+                        error!(
+                            "Failed to send routine packet to WireGuard endpoint: {:?}",
+                            e
+                        );
+                    }
+                };
+            }
+            TunnResult::Err(WireGuardError::ConnectionExpired) => {
+                warn!("Wireguard handshake has expired!");
+
+                let mut buf = vec![0u8; MAX_PACKET];
+                let result = self
+                    .peer
+                    .lock()
+                    .await
+                    .format_handshake_initiation(&mut buf[..], false);
+
+                self.handle_routine_tun_result(result).await
+            }
+            TunnResult::Err(e) => {
+                error!(
+                    "Failed to prepare routine packet for WireGuard endpoint: {:?}",
+                    e
+                );
+            }
+            TunnResult::Done => {
+                // Sleep for a bit
+                tokio::time::sleep(Duration::from_millis(1)).await;
+            }
+            other => {
+                warn!("Unexpected WireGuard routine task state: {:?}", other);
+            }
+        };
+    }
+
     /// WireGuard consumption task. Receives encrypted packets from the WireGuard endpoint,
     /// decapsulates them, and dispatches newly received IP packets.
     pub async fn consume_task(&self) -> ! {
@@ -159,7 +181,11 @@ impl WireGuardTunnel {
             };
 
             let data = &recv_buf[..size];
-            match self.peer.decapsulate(None, data, &mut send_buf) {
+            let decapsulate_result = {
+                let mut peer = self.peer.lock().await;
+                peer.decapsulate(None, data, &mut send_buf)
+            };
+            match decapsulate_result {
                 TunnResult::WriteToNetwork(packet) => {
                     match self.udp.send_to(packet, self.endpoint).await {
                         Ok(_) => {}
@@ -168,9 +194,10 @@ impl WireGuardTunnel {
                             continue;
                         }
                     };
+                    let mut peer = self.peer.lock().await;
                     loop {
                         let mut send_buf = [0u8; MAX_PACKET];
-                        match self.peer.decapsulate(None, &[], &mut send_buf) {
+                        match peer.decapsulate(None, &[], &mut send_buf) {
                             TunnResult::WriteToNetwork(packet) => {
                                 match self.udp.send_to(packet, self.endpoint).await {
                                     Ok(_) => {}
@@ -196,7 +223,7 @@ impl WireGuardTunnel {
                     trace_ip_packet("Received IP packet", packet);
 
                     if let Some(proto) = self.route_protocol(packet) {
-                        endpoint.send(Event::InboundInternetPacket(proto, packet.into()));
+                        endpoint.send(Event::InboundInternetPacket(proto, packet.to_vec().into()));
                     }
                 }
                 _ => {}
@@ -204,17 +231,20 @@ impl WireGuardTunnel {
         }
     }
 
-    fn create_tunnel(config: &Config) -> anyhow::Result<Box<Tunn>> {
+    fn create_tunnel(config: &Config) -> anyhow::Result<Tunn> {
+        let private = config.private_key.as_ref().clone();
+        let public = *config.endpoint_public_key.as_ref();
+
         Tunn::new(
-            config.private_key.clone(),
-            config.endpoint_public_key.clone(),
-            None,
+            private,
+            public,
+            config.preshared_key,
             config.keepalive_seconds,
             0,
             None,
         )
         .map_err(|s| anyhow::anyhow!("{}", s))
-        .with_context(|| "Failed to initialize boringtun Tunn")
+        .context("Failed to initialize boringtun Tunn")
     }
 
     /// Determine the inner protocol of the incoming IP packet (TCP/UDP).
@@ -223,25 +253,23 @@ impl WireGuardTunnel {
             Ok(IpVersion::Ipv4) => Ipv4Packet::new_checked(&packet)
                 .ok()
                 // Only care if the packet is destined for this tunnel
-                .filter(|packet| Ipv4Addr::from(packet.dst_addr()) == self.source_peer_ip)
-                .map(|packet| match packet.protocol() {
+                .filter(|packet| packet.dst_addr() == self.source_peer_ip)
+                .and_then(|packet| match packet.next_header() {
                     IpProtocol::Tcp => Some(PortProtocol::Tcp),
                     IpProtocol::Udp => Some(PortProtocol::Udp),
                     // Unrecognized protocol, so we cannot determine where to route
                     _ => None,
-                })
-                .flatten(),
+                }),
             Ok(IpVersion::Ipv6) => Ipv6Packet::new_checked(&packet)
                 .ok()
                 // Only care if the packet is destined for this tunnel
-                .filter(|packet| Ipv6Addr::from(packet.dst_addr()) == self.source_peer_ip)
-                .map(|packet| match packet.next_header() {
+                .filter(|packet| packet.dst_addr() == self.source_peer_ip)
+                .and_then(|packet| match packet.next_header() {
                     IpProtocol::Tcp => Some(PortProtocol::Tcp),
                     IpProtocol::Udp => Some(PortProtocol::Udp),
                     // Unrecognized protocol, so we cannot determine where to route
                     _ => None,
-                })
-                .flatten(),
+                }),
             _ => None,
         }
     }