chore: sync konduit-platform v0.1.0-beta.3

README.md

@@ -7,7 +7,7 @@
   **TCP-Native VPN. Works Where UDP Doesn't.**
 
   [![License: Proprietary](https://img.shields.io/badge/license-Proprietary-red)](LICENSE)
-  [![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20macOS%20%7C%20Android%20%7C%20iOS-lightgrey)]()
+  [![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20Windows%20%7C%20Android-lightgrey)]()
   [![Status](https://img.shields.io/badge/status-Beta-orange)]()
 
 </div>
@@ -33,7 +33,7 @@ Most VPNs treat TCP as a fallback. Konduit is designed for TCP from the ground u
 - **Userspace implementation** — no kernel modules, no root required
 - **Hot config reload** — update server configuration without dropping connections
 - **QR code provisioning** — scan once, connect instantly
-- **Cross-platform** — Linux, macOS, Android, iOS
+- **Cross-platform** — Linux, Windows, Android (macOS and iOS coming soon)
 - **Modern cryptography** — X25519 key exchange, ChaCha20-Poly1305 data channel
 - **Stealth mode** — port 443 deployment with decoy proxy for hostile network environments
 - **Memory safe** — written entirely in Rust
@@ -42,11 +42,15 @@ Most VPNs treat TCP as a fallback. Konduit is designed for TCP from the ground u
 
 Releases are published on the [Releases](../../releases) page. Each release includes:
 
-| Binary | Purpose |
-|---|---|
-| `konduit-server` | VPN server |
-| `konduit` | CLI client (Linux) |
-| `konduit-ctl` | Server provisioning tool |
+| Artifact | Platform | Purpose |
+|---|---|---|
+| `konduit-server-*-linux-x86_64` | Linux | VPN server |
+| `konduit-*-linux-x86_64` | Linux | CLI client |
+| `konduit-ctl-*-linux-x86_64` | Linux | Server provisioning tool |
+| `Konduit-*-x86_64.AppImage` | Linux | GUI client (AppImage) |
+| `konduit-cli-*-windows-x86_64.zip` | Windows | CLI client + wintun.dll |
+| `konduit-gui-*-windows-x86_64.zip` | Windows | GUI client |
+| `konduit-*-android.aab` | Android | Android app (sideload via bundletool) |
 
 ### Linux (CLI)
 
@@ -61,14 +65,38 @@ echo "your secret mantra" | ./konduit-ctl bootstrap -l vpn.example.com:443 -p -
 ./konduit connect --config client.toml
 ```
 
-### macOS · Android · iOS
+### Linux (GUI)
+
+Download the `.AppImage`, make it executable, and run it:
+
+```bash
+chmod +x Konduit-*-x86_64.AppImage
+./Konduit-*-x86_64.AppImage
+```
+
+### Windows
+
+Extract the zip and run `konduit.exe` (CLI) or `Konduit.exe` (GUI). `wintun.dll` must remain alongside the executable.
+
+### Android
+
+Download from [Google Play](https://play.google.com/store/apps/details?id=eu.kaparulin.konduit) or sideload the `.aab` using [bundletool](https://github.com/google/bundletool).
+
+### macOS · iOS
 
 Coming soon.
 
-## Server Setup
+## Setup
 
+**GUI clients**
+- [Linux GUI Quickstart](docs/gui-quickstart-linux.md) — AppImage, privileges, autostart
+- [Windows GUI Quickstart](docs/gui-quickstart-windows.md) — extract, UAC, WinTun, autostart
+
+**CLI & server**
+- [Client Quickstart](docs/client-quickstart.md) — download, configure, connect, run as a systemd service
 - [Server Quickstart](docs/server-quickstart.md) — install, provision, NAT setup for iptables and firewalld
 - [Stealth Mode Setup](docs/stealth-setup.md) — HAProxy TCP passthrough + camouflage configuration
+- [systemd units](docs/systemd/) — service files for konduit-server, konduit (client), and konduit-admin-ui
 
 ## Architecture
 
@@ -119,8 +147,9 @@ The VPN server, management UI, and stealth-mode protocol are proprietary. Keepin
 ## About
 
 Created by **Eugen Kaparulin**.  
-Official binaries distributed by **K-Ops Oy**.
+Official binaries distributed by **[K-Ops Oy](https://k-ops.eu)**.
 
 © Eugen Kaparulin. All rights reserved.  
 [`konduit-platform`](./konduit-platform) is published under the [PolyForm Noncommercial License 1.0.0](LICENSE).  
 All other parts of Konduit are proprietary.  
+[Privacy Policy](docs/privacy-policy.md)

docs/client-quickstart.md

@@ -0,0 +1,59 @@
+# Konduit CLI Client Quickstart
+
+## 1. Download
+
+Download the `konduit` binary from the [Releases](../../releases) page and make it executable:
+
+```bash
+chmod +x konduit
+sudo cp konduit /opt/konduit/konduit
+```
+
+## 2. Get a client config
+
+Your server administrator will provide a `client.toml` generated by `konduit-ctl add-client`. Transfer it to the client machine:
+
+```bash
+sudo cp client.toml /opt/konduit/client.toml
+sudo chmod 600 /opt/konduit/client.toml
+```
+
+If your server runs in stealth mode, the config already points to port 443. No additional client-side configuration is needed.
+
+## 3. Connect
+
+```bash
+/opt/konduit/konduit -c /opt/konduit/client.toml
+```
+
+A successful connection looks like:
+
+```
+→ resolving vpn.example.com  ok
+→ tcp handshake  X25519  ok
+→ tun device  konduit0  up
+→ routes applied by server policy  ok
+connected · no udp, no root, port 443
+```
+
+## 4. Run as a systemd service
+
+To connect automatically on boot, use the provided systemd unit:
+
+```bash
+sudo cp /opt/konduit/docs/systemd/konduit.service /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now konduit
+```
+
+The unit runs as root (required for TUN device creation) and restarts automatically on failure.
+
+## 5. Capabilities (alternative to root)
+
+To run without root, grant the binary the required capability instead:
+
+```bash
+sudo setcap cap_net_admin=+ep /opt/konduit/konduit
+```
+
+Then change `User=root` to your user account in the systemd unit before enabling it.

docs/gui-quickstart-linux.md

@@ -0,0 +1,66 @@
+# Konduit GUI — Linux Quickstart
+
+## 1. Download
+
+Download the `Konduit-*-x86_64.AppImage` from the [Releases](../../releases) page.
+
+## 2. Make it executable
+
+```bash
+chmod +x Konduit-*-x86_64.AppImage
+```
+
+## 3. Run
+
+Double-click the AppImage in your file manager, or launch it from the terminal:
+
+```bash
+./Konduit-*-x86_64.AppImage
+```
+
+No installation required. The AppImage is self-contained.
+
+## 4. Load your config
+
+Your server administrator will provide either a `client.toml` config file or a QR code image.
+
+- **TOML config:** your administrator will provide a `client.toml` file. Open it in a text editor and enter the server address, port, and key values into the corresponding fields in the app.
+- **QR code:** tap **Scan QR code** and point the camera at the QR code image, or use **Import QR image** to select an image file from disk.
+
+## 5. Privileges
+
+Konduit creates a TUN network device, which requires elevated network capability. The AppImage requests this automatically via a `pkexec` prompt on first run. If you see a password prompt, enter your user password to grant the capability.
+
+If `pkexec` is not available on your system (some minimal desktop environments), grant the capability manually once:
+
+```bash
+sudo setcap cap_net_admin=+ep ~/.local/share/konduit/konduit-helper
+```
+
+## 6. Autostart on login (optional)
+
+To start Konduit automatically when you log in, enable autostart in the app: **Settings → Start on login**.
+
+Alternatively, copy the provided desktop entry to your autostart directory:
+
+```bash
+cp ~/.local/share/applications/konduit.desktop ~/.config/autostart/
+```
+
+## Troubleshooting
+
+**AppImage won't launch** — your system may be missing FUSE. Install it:
+
+```bash
+# Debian / Ubuntu
+sudo apt install libfuse2
+
+# Fedora / RHEL
+sudo dnf install fuse
+```
+
+**"Failed to create TUN device"** — the capability was not granted. Run the `setcap` command from step 5 and relaunch.
+
+**Connection fails immediately** — check that the server address, port, and key values in the app match what your administrator provided. Contact your administrator if you are unsure.
+
+**Config lost on relaunch** — re-enter your connection details or scan the QR code again.

docs/gui-quickstart-windows.md

@@ -0,0 +1,65 @@
+# Konduit GUI — Windows Quickstart
+
+## Requirements
+
+- Windows 10 or later (64-bit)
+- Administrator account (required for VPN driver installation)
+
+## 1. Download
+
+Download `konduit-gui-*-windows-x86_64.zip` from the [Releases](../../releases) page.
+
+## 2. Extract
+
+Right-click the zip file and choose **Extract All**. Extract to a folder of your choice, for example `C:\Konduit`.
+
+Keep all files together — `Konduit.exe` and `wintun.dll` must be in the same folder.
+
+## 3. Run
+
+Double-click `Konduit.exe`.
+
+Windows will show a **UAC prompt** asking for administrator permission. This is required because Konduit uses the [WinTun](https://www.wintun.net/) driver to create a virtual network adapter. Click **Yes** to continue.
+
+> If you dismiss the UAC prompt, Konduit will not be able to establish a VPN connection.
+
+## 4. Load your config
+
+Your server administrator will provide either a `client.toml` config file or a QR code image.
+
+- **TOML config:** your administrator will provide a `client.toml` file. Open it in a text editor and enter the server address, port, and key values into the corresponding fields in the app.
+- **QR code:** tap **Import QR image** and select the QR code image file from disk.
+
+## 5. Connect
+
+Press **Connect**. A system tray icon will appear while the VPN is active. Right-click the tray icon to disconnect.
+
+## 6. Windows Defender / antivirus warning
+
+Some antivirus tools flag `wintun.dll` or new unsigned executables. If Windows Defender blocks the launch:
+
+1. Open **Windows Security → Virus & threat protection**
+2. Click **Protection history**
+3. Find the Konduit entry and choose **Allow**
+
+Alternatively, add the Konduit folder to your antivirus exclusion list.
+
+## 7. Autostart on login (optional)
+
+To start Konduit automatically when Windows starts, enable it in the app: **Settings → Start on login**.
+
+Alternatively, create a shortcut to `Konduit.exe` and place it in your Startup folder:
+
+```
+Win + R → shell:startup → paste shortcut here
+```
+
+## Troubleshooting
+
+**UAC prompt does not appear / app closes immediately** — make sure you are running as a user with administrator privileges. Standard (non-admin) accounts cannot install the WinTun driver.
+
+**"wintun.dll not found"** — `Konduit.exe` and `wintun.dll` must be in the same folder. Do not move them separately.
+
+**Connection fails immediately** — check that the server address, port, and key values in the app match what your administrator provided. Contact your administrator if you are unsure.
+
+**Tray icon disappears unexpectedly** — the app may have crashed. Check Windows Event Viewer or relaunch `Konduit.exe`.

docs/privacy-policy.md

@@ -0,0 +1,72 @@
+# Konduit Privacy Policy
+
+_Last updated: 9 June 2026_
+
+## Who we are
+
+Konduit is a TCP-native VPN client developed and distributed by **[K-Ops Oy](https://k-ops.eu)**. Questions about this policy can be sent to: **[konduit@k-ops.eu](mailto:konduit@k-ops.eu)**
+
+## What data Konduit processes
+
+### On your device
+
+The Konduit client stores the following data locally:
+
+| Data | Purpose | Where it is stored |
+|------|---------|-------------------|
+| VPN server address and port | Connect to your VPN server | Local config file |
+| Peer ID and pre-shared key (PSK) | Authenticate with your VPN server | Local config file |
+| Session statistics (bytes sent/received, connection state) | Display connection status | In-memory only, not persisted |
+
+### On the VPN server
+
+When you connect, the VPN server you connect to processes:
+
+| Data | Purpose |
+|------|---------|
+| Your IP address | Route return traffic to your device |
+| Connection timestamps | Session management |
+| Traffic volume (bytes in/out) | Capacity planning and abuse prevention |
+| Destination IP addresses of tunnelled traffic | Route packets to their destination |
+
+The content of tunnelled traffic is not inspected beyond what is necessary for routing.
+
+## What we do not collect
+
+- Konduit does **not** collect analytics, crash reports, usage statistics, or any telemetry.
+- Konduit does **not** display advertising.
+- Konduit does **not** sell or share connection metadata with third parties.
+
+## Self-hosted deployments
+
+Konduit is designed to be self-hosted. If you run your own Konduit server, all server-side data listed above stays under your control and is never transmitted to [K-Ops Oy](https://k-ops.eu).
+
+## Data retention and deletion
+
+All client-side data is stored in the local config file. To delete it, remove your configuration or uninstall Konduit.
+
+Server-side connection logs are retained for a limited period for operational purposes and then deleted. The exact retention period depends on the server operator.
+
+## Security
+
+- All traffic between client and server is encrypted using **X25519** key exchange and **ChaCha20-Poly1305** AEAD.
+- The pre-shared key (PSK) is stored in the local config file with permissions restricted to the current user.
+- Stealth mode wraps the tunnel in a protocol that is indistinguishable from HTTPS, preventing deep-packet inspection from identifying Konduit traffic.
+
+## Children
+
+Konduit is not directed at children under 13 and does not knowingly collect data from children.
+
+## GDPR (EU residents)
+
+When using a [K-Ops Oy](https://k-ops.eu) operated server, [K-Ops Oy](https://k-ops.eu) acts as data processor for connection metadata (IP address, timestamps, traffic volume) as described above. This data is processed on the legal basis of legitimate interest (providing the VPN service). You may request deletion of your connection metadata by contacting **[konduit@k-ops.eu](mailto:konduit@k-ops.eu)**.
+
+When using a self-hosted server, [K-Ops Oy](https://k-ops.eu) does not process any of your data.
+
+## Changes to this policy
+
+If we update this policy, the new version will be published at this URL with an updated "Last updated" date.
+
+## Contact
+
+Privacy questions: **[konduit@k-ops.eu](mailto:konduit@k-ops.eu)**

docs/server-quickstart.md

@@ -62,7 +62,12 @@ Without this, konduit picks the first available `tunN`, which shifts if other VP
 ./konduit-server --config server.toml
 ```
 
-For persistent operation, use the provided systemd unit (`setup/server/konduit-server.service`).
+For persistent operation, use the provided systemd units in [docs/systemd/](systemd/). Copy `konduit-server.service` to `/etc/systemd/system/`, then:
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl enable --now konduit-server
+```
 
 ## 6. NAT / Masquerade
 

docs/systemd/konduit-server.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Konduit Server
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/konduit
+ExecStart=/opt/konduit/konduit-server -c /opt/konduit/server.toml
+Restart=on-failure
+RestartSec=5
+
+# Optional hardening
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target

docs/systemd/konduit.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Konduit Client
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/konduit
+ExecStart=/opt/konduit/konduit -c /opt/konduit/client.toml
+Restart=on-failure
+RestartSec=5
+
+# Optional hardening
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target

konduit-platform/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "konduit-platform"
-version = "0.1.0"
+version.workspace = true
 edition = "2021"
 authors = ["Eugen Kaparulin <e.kaparulin@gmail.com>"]
 license = "PolyForm-Noncommercial-1.0.0"
@@ -40,6 +40,7 @@ windows = { version = "0.52", features = [
     "Win32_Networking_WinSock",
 ] }
 ipconfig = "0.3"
+wintun = "0.3"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 system-configuration = "0.5"

konduit-platform/src/dns/windows.rs

@@ -1,6 +1,10 @@
 use super::DnsState;
 use anyhow::Result;
 use std::net::IpAddr;
+use std::os::windows::process::CommandExt;
+use tracing::info;
+
+const CREATE_NO_WINDOW: u32 = 0x0800_0000;
 
 pub async fn set_dns(
     interface: &str,
@@ -8,92 +12,57 @@ pub async fn set_dns(
     dns_servers: &[IpAddr],
     state: &mut DnsState,
 ) -> Result<()> {
-    // Windows implementation using windows-rs crate
-    // Note: This logic runs within unsafe blocks as it calls Win32 APIs
+    if dns_servers.is_empty() {
+        return Ok(());
+    }
 
-    use std::ffi::c_void;
-    use windows::Win32::Foundation::NO_ERROR;
-    use windows::Win32::NetworkManagement::IpHelper::{
-        SetInterfaceDnsSettings, DNS_INTERFACE_SETTINGS, DNS_INTERFACE_SETTINGS_FLAGS,
-        DNS_INTERFACE_SETTINGS_VERSION1, DNS_SETTING_NAMESERVER,
+    let addrs: Vec<String> = dns_servers.iter().map(|ip| ip.to_string()).collect();
+    let addrs_str = addrs.join(",");
+
+    let iface_arg = if let Some(idx) = if_index {
+        format!("-InterfaceIndex {}", idx)
+    } else {
+        format!("-InterfaceAlias '{}'", interface)
     };
 
-    // We need the Interface LUID (Locally Unique Identifier) or Index/GUID.
-    // The user provided `interface` string might be a GUID or friendly name.
-    // If if_index is provided, that's easier for some APIs.
+    info!("Setting DNS on {} to {}", interface, addrs_str);
 
-    // Convert IP addresses to wide string (UTF-16) comma-separated
-    let mut dns_str = String::new();
-    for (i, ip) in dns_servers.iter().enumerate() {
-        if i > 0 {
-            dns_str.push(',');
-        }
-        dns_str.push_str(&ip.to_string());
-    }
-    let dns_wide: Vec<u16> = dns_str.encode_utf16().chain(std::iter::once(0)).collect();
-
-    if let Some(idx) = if_index {
-        // Find existing settings to backup?
-        // Windows doesn't make it easy to "get current and restore later" without some work.
-        // For simplicity, we assume we can just clear settings on restore.
-    }
-
-    /*
-       Implementation note:
-       Since we cannot easily compile this on Linux to verify, we outline the logic.
-       Real implementation would need `GetInterfaceDnsSettings` to backup state.
-    */
-
-    tracing::info!(
-        "Setting DNS on Windows for interface {}: {:?}",
-        interface,
-        dns_servers
+    let script = format!(
+        "Set-DnsClientServerAddress {} -ServerAddresses {}",
+        iface_arg, addrs_str
     );
+    let status = std::process::Command::new("powershell")
+        .args(["-NoProfile", "-NonInteractive", "-Command", &script])
+        .creation_flags(CREATE_NO_WINDOW)
+        .status()?;
 
-    /*
-    unsafe {
-        let mut settings = DNS_INTERFACE_SETTINGS {
-            Version: DNS_INTERFACE_SETTINGS_VERSION1,
-            Flags: DNS_SETTING_NAMESERVER,
-            NameServer: windows::core::PCWSTR(dns_wide.as_ptr()),
-            ..Default::default()
-        };
-
-        let guid = windows::core::GUID::from(interface)?; // Assuming interface is a GUID string
-
-        let result = SetInterfaceDnsSettings(guid, &mut settings);
-        if result != NO_ERROR {
-             anyhow::bail!("Failed to set DNS: {:?}", result);
+    if !status.success() {
+        anyhow::bail!("PowerShell failed to set DNS on {}", interface);
     }
-    }
-    */
-
-    // For now, since we can't test, we log a limitation
-    tracing::warn!("Windows DNS setting logic placeholder");
 
     state.configured = true;
     Ok(())
 }
 
 pub async fn restore(
-    _interface: &str,
-    _if_index: Option<u32>,
-    _state: &mut DnsState,
+    interface: &str,
+    if_index: Option<u32>,
+    state: &mut DnsState,
 ) -> Result<()> {
-    tracing::info!("Restoring DNS on Windows...");
+    info!("Restoring DNS on {} to automatic", interface);
 
-    // Clear custom DNS settings (return to DHCP?)
-    /*
-    unsafe {
-         let mut settings = DNS_INTERFACE_SETTINGS {
-            Version: DNS_INTERFACE_SETTINGS_VERSION1,
-            Flags: DNS_SETTING_NAMESERVER,
-            NameServer: windows::core::PCWSTR::null(),
-            ..Default::default()
+    let iface_arg = if let Some(idx) = if_index {
+        format!("-InterfaceIndex {}", idx)
+    } else {
+        format!("-InterfaceAlias '{}'", interface)
     };
-        // Call SetInterfaceDnsSettings with empty NameServer or appropriate flags
-    }
-    */
 
+    let script = format!("Set-DnsClientServerAddress {} -ResetServerAddresses", iface_arg);
+    let _ = std::process::Command::new("powershell")
+        .args(["-NoProfile", "-NonInteractive", "-Command", &script])
+        .creation_flags(CREATE_NO_WINDOW)
+        .status();
+
+    state.configured = false;
     Ok(())
 }

konduit-platform/src/routes/mod.rs

@@ -7,3 +7,8 @@ pub use linux::RouteManager;
 mod macos;
 #[cfg(target_os = "macos")]
 pub use macos::MacOsNetManager;
+
+#[cfg(target_os = "windows")]
+mod windows;
+#[cfg(target_os = "windows")]
+pub use windows::RouteManager;

konduit-platform/src/routes/windows.rs

@@ -0,0 +1,300 @@
+use anyhow::Result;
+use std::net::{IpAddr, Ipv4Addr};
+use std::os::windows::process::CommandExt;
+use tracing::{info, warn};
+
+const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+
+use crate::dns::DnsManager;
+
+pub struct RouteManager {
+    tun_interface: String,
+    dns_manager: DnsManager,
+    tun_routes: Vec<(Ipv4Addr, u8)>,
+    server_ip: Option<Ipv4Addr>,
+    wifi_gateway: Option<Ipv4Addr>,
+}
+
+impl RouteManager {
+    pub async fn new(tun_interface: String) -> Result<Self> {
+        Ok(Self {
+            dns_manager: DnsManager::new(
+                tun_interface.clone(),
+                None,
+                IpAddr::V4(Ipv4Addr::UNSPECIFIED),
+            ),
+            tun_interface,
+            tun_routes: Vec::new(),
+            server_ip: None,
+            wifi_gateway: None,
+        })
+    }
+
+    fn get_default_gateway() -> Result<Ipv4Addr> {
+        let adapters = ipconfig::get_adapters()
+            .map_err(|e| anyhow::anyhow!("Failed to enumerate adapters: {}", e))?;
+        for adapter in &adapters {
+            for gw in adapter.gateways() {
+                if let IpAddr::V4(gw4) = gw {
+                    if !gw4.is_loopback() && !gw4.is_unspecified() {
+                        return Ok(*gw4);
+                    }
+                }
+            }
+        }
+        anyhow::bail!("No default gateway found")
+    }
+
+    fn prefix_to_mask(prefix: u8) -> Ipv4Addr {
+        let bits = if prefix == 0 {
+            0u32
+        } else {
+            !0u32 << (32 - prefix)
+        };
+        let [a, b, c, d] = bits.to_be_bytes();
+        Ipv4Addr::new(a, b, c, d)
+    }
+
+    // Add/delete server host route through WiFi gateway via `route` command.
+    // Specifying gateway on delete ensures we only remove our entry, not any other path.
+    fn wifi_route_add(dest: Ipv4Addr, prefix: u8, gateway: Ipv4Addr) {
+        let mask = Self::prefix_to_mask(prefix);
+        let out = std::process::Command::new("route")
+            .args([
+                "add",
+                &dest.to_string(),
+                "MASK",
+                &mask.to_string(),
+                &gateway.to_string(),
+                "METRIC",
+                "1",
+            ])
+            .creation_flags(CREATE_NO_WINDOW)
+            .output();
+        match out {
+            Ok(o) => {
+                let stdout = String::from_utf8_lossy(&o.stdout);
+                if !o.status.success() {
+                    // "already exists" is acceptable — a previous run may have left it
+                    warn!("route add {}/{} via {}: {}", dest, prefix, gateway, stdout.trim());
+                }
+            }
+            Err(e) => warn!("route add {}/{} via {}: {}", dest, prefix, gateway, e),
+        }
+    }
+
+    fn wifi_route_delete(dest: Ipv4Addr, prefix: u8, gateway: Ipv4Addr) {
+        let mask = Self::prefix_to_mask(prefix);
+        let _ = std::process::Command::new("route")
+            .args([
+                "delete",
+                &dest.to_string(),
+                "MASK",
+                &mask.to_string(),
+                &gateway.to_string(),
+            ])
+            .creation_flags(CREATE_NO_WINDOW)
+            .status();
+    }
+
+    // Add/delete routes through the TUN interface using netsh.
+    //
+    // `netsh interface ipv4 add route` binds routes to a named interface explicitly,
+    // avoiding the gateway-resolution ambiguity of the `route` command and ensuring
+    // cleanup never touches WiFi routing state.
+    fn tun_route_add(tun_name: &str, dest: Ipv4Addr, prefix: u8) {
+        let prefix_str = format!("{}/{}", dest, prefix);
+        let out = std::process::Command::new("netsh")
+            .args([
+                "interface",
+                "ipv4",
+                "add",
+                "route",
+                &prefix_str,
+                tun_name,
+                "nexthop=0.0.0.0",
+                "metric=1",
+                "store=active",
+            ])
+            .creation_flags(CREATE_NO_WINDOW)
+            .output();
+        match out {
+            Ok(o) => {
+                let stdout = String::from_utf8_lossy(&o.stdout);
+                if o.status.success() {
+                    info!("Added TUN route {}/{}", dest, prefix);
+                } else {
+                    warn!("netsh add route {}/{} on {}: {}", dest, prefix, tun_name, stdout.trim());
+                }
+            }
+            Err(e) => warn!("netsh add route {}/{} on {}: {}", dest, prefix, tun_name, e),
+        }
+    }
+
+    fn tun_route_delete(tun_name: &str, dest: Ipv4Addr, prefix: u8) {
+        let prefix_str = format!("{}/{}", dest, prefix);
+        let out = std::process::Command::new("netsh")
+            .args([
+                "interface",
+                "ipv4",
+                "delete",
+                "route",
+                &prefix_str,
+                tun_name,
+            ])
+            .creation_flags(CREATE_NO_WINDOW)
+            .output();
+        match out {
+            Ok(o) => {
+                let stdout = String::from_utf8_lossy(&o.stdout);
+                if !o.status.success() {
+                    warn!(
+                        "netsh delete route {}/{} on {}: {}",
+                        dest,
+                        prefix,
+                        tun_name,
+                        stdout.trim()
+                    );
+                }
+            }
+            Err(e) => warn!("netsh delete route {}/{} on {}: {}", dest, prefix, tun_name, e),
+        }
+    }
+
+    pub async fn setup_vpn_routes(
+        &mut self,
+        server_addr: &str,
+        _vpn_gateway: IpAddr,
+        routes: &[String],
+    ) -> Result<()> {
+        info!("Setting up Windows VPN routes...");
+
+        let current_gateway = Self::get_default_gateway()?;
+        info!("Current gateway: {}", current_gateway);
+
+        let server_ip: Ipv4Addr = {
+            let host = server_addr.split(':').next().unwrap_or(server_addr);
+            if let Ok(IpAddr::V4(v4)) = host.parse::<IpAddr>() {
+                v4
+            } else {
+                let addrs = tokio::net::lookup_host(format!("{}:0", host)).await?;
+                match addrs.map(|a| a.ip()).next() {
+                    Some(IpAddr::V4(v4)) => v4,
+                    _ => anyhow::bail!("Could not resolve server address to IPv4"),
+                }
+            }
+        };
+
+        // Always record server + gateway so cleanup can delete the host route
+        // even if the add below fails because the route already exists.
+        self.server_ip = Some(server_ip);
+        self.wifi_gateway = Some(current_gateway);
+        Self::wifi_route_add(server_ip, 32, current_gateway);
+
+        let is_full_tunnel = routes.iter().any(|r| r == "0.0.0.0/0");
+
+        if is_full_tunnel {
+            // Two /1 routes on the TUN interface cover the entire address space and
+            // always beat the existing WiFi /0 default route regardless of metric.
+            // netsh with explicit interface name avoids gateway-resolution ambiguity.
+            info!("Full-tunnel mode: adding /1 cover routes on {}...", self.tun_interface);
+            let lower = Ipv4Addr::new(0, 0, 0, 0);
+            let upper = Ipv4Addr::new(128, 0, 0, 0);
+            Self::tun_route_add(&self.tun_interface, lower, 1);
+            self.tun_routes.push((lower, 1));
+            Self::tun_route_add(&self.tun_interface, upper, 1);
+            self.tun_routes.push((upper, 1));
+        } else {
+            info!("Split-tunnel mode: adding {} routes via TUN...", routes.len());
+            for route_str in routes {
+                let Some((dest_str, prefix_str)) = route_str.split_once('/') else {
+                    warn!("Invalid route format: {}", route_str);
+                    continue;
+                };
+                let Ok(dest) = dest_str.parse::<Ipv4Addr>() else {
+                    warn!("Invalid route destination: {}", dest_str);
+                    continue;
+                };
+                let Ok(prefix_len) = prefix_str.parse::<u8>() else {
+                    warn!("Invalid prefix length: {}", prefix_str);
+                    continue;
+                };
+                Self::tun_route_add(&self.tun_interface, dest, prefix_len);
+                self.tun_routes.push((dest, prefix_len));
+                info!("Added split-tunnel route: {}", route_str);
+            }
+        }
+
+        info!("Windows VPN routes configured");
+        Ok(())
+    }
+
+    pub async fn setup_dns(&mut self, dns_servers: &[IpAddr], assigned_ip: IpAddr) -> Result<()> {
+        if dns_servers.is_empty() {
+            return Ok(());
+        }
+        self.dns_manager = DnsManager::new(self.tun_interface.clone(), None, assigned_ip);
+        self.dns_manager.set_dns(dns_servers).await
+    }
+
+    pub async fn restore_dns(&self) -> Result<()> {
+        self.dns_manager.restore().await
+    }
+
+    pub async fn ensure_server_route(&mut self) -> Result<()> {
+        if let (Some(server_ip), Some(gateway)) = (self.server_ip, self.wifi_gateway) {
+            Self::wifi_route_add(server_ip, 32, gateway);
+        }
+        Ok(())
+    }
+
+    pub async fn suspend_default_route(&mut self) -> Result<()> {
+        let lower = Ipv4Addr::new(0, 0, 0, 0);
+        if !self.tun_routes.contains(&(lower, 1)) {
+            return Ok(());
+        }
+        for (dest, prefix) in [(lower, 1u8), (Ipv4Addr::new(128, 0, 0, 0), 1u8)] {
+            Self::tun_route_delete(&self.tun_interface, dest, prefix);
+        }
+        info!("VPN cover routes suspended — traffic falls to WiFi during reconnect");
+        Ok(())
+    }
+
+    pub async fn resume_default_route(&mut self) -> Result<()> {
+        let lower = Ipv4Addr::new(0, 0, 0, 0);
+        if !self.tun_routes.contains(&(lower, 1)) {
+            return Ok(());
+        }
+        let upper = Ipv4Addr::new(128, 0, 0, 0);
+        for (dest, prefix) in [(lower, 1u8), (upper, 1u8)] {
+            Self::tun_route_add(&self.tun_interface, dest, prefix);
+        }
+        info!("VPN cover routes restored after reconnect");
+        Ok(())
+    }
+
+    pub async fn restore_routes(&mut self) -> Result<()> {
+        info!("Removing {} tracked VPN routes...", self.tun_routes.len());
+        for (dest, prefix) in self.tun_routes.drain(..) {
+            Self::tun_route_delete(&self.tun_interface, dest, prefix);
+        }
+        // Always clean up the server host route — a previous unclean exit may have
+        // left it behind even if our add was skipped.
+        if let (Some(server_ip), Some(gateway)) = (self.server_ip.take(), self.wifi_gateway.take()) {
+            Self::wifi_route_delete(server_ip, 32, gateway);
+        }
+        info!("Windows VPN routes removed");
+        Ok(())
+    }
+}
+
+impl Drop for RouteManager {
+    fn drop(&mut self) {
+        if !self.tun_routes.is_empty() {
+            warn!(
+                "RouteManager dropped with {} unrestored TUN routes — call restore_routes() before dropping",
+                self.tun_routes.len()
+            );
+        }
+    }
+}

konduit-platform/src/tun.rs

@@ -1,14 +1,26 @@
 use anyhow::Result;
-use bytes::{Bytes, BytesMut};
+use bytes::Bytes;
+#[cfg(not(target_os = "windows"))]
+use bytes::BytesMut;
 use std::net::IpAddr;
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::sync::mpsc;
-use tracing::{debug, error, info};
+use tracing::{error, info};
+#[cfg(target_os = "linux")]
+use tracing::debug;
+
+// Windows uses wintun directly to avoid the tun crate's poll_read bug, which spawns
+// a new OS thread on every Poll::Pending call, causing thread explosion and packet loss.
+#[cfg(target_os = "windows")]
+use std::sync::Arc;
 
 /// Interface to the TUN device
 pub struct TunDevice {
     pub name: String,
+    #[cfg(not(target_os = "windows"))]
     device: tun::AsyncDevice,
+    #[cfg(target_os = "windows")]
+    session: Arc<wintun::Session>,
+    #[cfg_attr(target_os = "windows", allow(dead_code))]
     mtu: usize,
 }
 
@@ -79,6 +91,44 @@ impl TunDevice {
         }
     }
 
+    /// Create a new TUN device (Windows — uses WinTun directly for correct async behavior)
+    #[cfg(target_os = "windows")]
+    pub fn new(assigned_ip: IpAddr, mtu: usize) -> Result<Self> {
+        use std::net::Ipv4Addr;
+
+        const TUN_NAME: &str = "konduit";
+
+        let wintun = unsafe { wintun::load().map_err(|e| anyhow::anyhow!("Failed to load wintun: {}", e))? };
+        let adapter = match wintun::Adapter::open(&wintun, TUN_NAME) {
+            Ok(a) => a,
+            Err(_) => wintun::Adapter::create(&wintun, TUN_NAME, TUN_NAME, None)
+                .map_err(|e| anyhow::anyhow!("Failed to create WinTun adapter: {}", e))?,
+        };
+
+        let ip = match assigned_ip {
+            IpAddr::V4(v4) => v4,
+            IpAddr::V6(_) => anyhow::bail!("IPv6 not supported for TUN device on Windows"),
+        };
+        let mask = Ipv4Addr::new(255, 255, 255, 0);
+
+        adapter
+            .set_network_addresses_tuple(IpAddr::V4(ip), IpAddr::V4(mask), None)
+            .map_err(|e| anyhow::anyhow!("Failed to set WinTun address: {}", e))?;
+
+        let session = Arc::new(
+            adapter
+                .start_session(wintun::MAX_RING_CAPACITY)
+                .map_err(|e| anyhow::anyhow!("Failed to start WinTun session: {}", e))?,
+        );
+
+        info!("Created TUN interface: {}", TUN_NAME);
+        Ok(Self {
+            name: TUN_NAME.to_string(),
+            session,
+            mtu,
+        })
+    }
+
     /// Create a new TUN device from file descriptor (Android / iOS)
     #[cfg(any(target_os = "android", target_os = "ios"))]
     pub fn from_fd(fd: i32, mtu: usize) -> Result<Self> {
@@ -111,37 +161,33 @@ impl TunDevice {
         }
     }
 
-    /// Run the TUN device loop
+    /// Run the TUN device loop (Linux / macOS / Android / iOS — uses tokio AsyncRead/Write)
+    #[cfg(not(target_os = "windows"))]
     pub async fn run(
         self,
-        mut from_tcp_rx: mpsc::Receiver<Bytes>, // Packets received from TCP to be written to TUN
-        to_tcp_tx: mpsc::Sender<Bytes>,         // Packets read from TUN to be sent to TCP
+        mut from_tcp_rx: mpsc::Receiver<Bytes>,
+        to_tcp_tx: mpsc::Sender<Bytes>,
     ) -> Result<()> {
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
         info!("TUN device loop started");
 
         let (mut reader, mut writer) = tokio::io::split(self.device);
         let mtu = self.mtu;
 
+        // Separate reader task so writes never block reads.
+        let (tun_pkt_tx, mut tun_pkt_rx) = mpsc::channel::<Bytes>(64);
+        tokio::spawn(async move {
             loop {
-            // Buffer for reading from TUN
-            // We authorize up to MTU + overhead, but each read returns one packet.
                 let mut buf = BytesMut::with_capacity(mtu + 100);
-
-            tokio::select! {
-                // 1. Packet from TUN (needs to be sent to server)
-                res = reader.read_buf(&mut buf) => {
-                    match res {
-                        Ok(n) => {
-                            if n == 0 {
+                match reader.read_buf(&mut buf).await {
+                    Ok(0) => {
                         info!("TUN device closed");
                         break;
                     }
-                            // Important: TUN read returns distinct packets.
-                            // We must send exactly this packet.
-                            let packet = buf.freeze(); // Consumes buf into Bytes
-
-                            if let Err(_) = to_tcp_tx.send(packet).await {
-                                break; // Channel closed
+                    Ok(_) => {
+                        if tun_pkt_tx.send(buf.freeze()).await.is_err() {
+                            break;
                         }
                     }
                     Err(e) => {
@@ -150,8 +196,23 @@ impl TunDevice {
                     }
                 }
             }
+        });
 
-                // 2. Packet from TCP (needs to be written to TUN)
+        loop {
+            tokio::select! {
+                packet = tun_pkt_rx.recv() => {
+                    match packet {
+                        Some(pkt) => {
+                            if to_tcp_tx.send(pkt).await.is_err() {
+                                break;
+                            }
+                        }
+                        None => {
+                            info!("TUN reader task exited");
+                            break;
+                        }
+                    }
+                }
                 Some(packet) = from_tcp_rx.recv() => {
                     if let Err(e) = writer.write_all(&packet).await {
                         error!("TUN write error: {}", e);
@@ -162,4 +223,72 @@ impl TunDevice {
 
         Ok(())
     }
+
+    /// Run the TUN device loop (Windows — uses wintun directly with a dedicated reader thread)
+    ///
+    /// The tun crate's Windows AsyncRead implementation spawns a new OS thread on every
+    /// Poll::Pending, causing thread explosion and ~80% packet loss under normal VPN load.
+    /// We bypass it by using a single dedicated blocking thread for wintun reads.
+    #[cfg(target_os = "windows")]
+    pub async fn run(
+        self,
+        mut from_tcp_rx: mpsc::Receiver<Bytes>,
+        to_tcp_tx: mpsc::Sender<Bytes>,
+    ) -> Result<()> {
+        info!("TUN device loop started");
+
+        let session = self.session;
+        let reader_session = session.clone();
+
+        // One dedicated OS thread for blocking wintun reads.
+        // This avoids spawning a new thread per poll_read call.
+        let (read_tx, mut read_rx) = mpsc::channel::<Bytes>(64);
+        std::thread::spawn(move || loop {
+            match reader_session.receive_blocking() {
+                Ok(pkt) => {
+                    let bytes = Bytes::copy_from_slice(pkt.bytes());
+                    drop(pkt); // release ring buffer slot before blocking on channel send
+                    if read_tx.blocking_send(bytes).is_err() {
+                        break;
+                    }
+                }
+                Err(e) => {
+                    error!("WinTun receive error: {:?}", e);
+                    break;
+                }
+            }
+        });
+
+        loop {
+            tokio::select! {
+                // WinTun → TCP channel
+                packet = read_rx.recv() => {
+                    match packet {
+                        Some(pkt) => {
+                            if to_tcp_tx.send(pkt).await.is_err() {
+                                break;
+                            }
+                        }
+                        None => {
+                            info!("WinTun reader thread exited");
+                            break;
+                        }
+                    }
+                }
+
+                // TCP channel → WinTun (send_packet is non-blocking ring-buffer op)
+                Some(packet) = from_tcp_rx.recv() => {
+                    match session.allocate_send_packet(packet.len() as u16) {
+                        Ok(mut send_pkt) => {
+                            send_pkt.bytes_mut().copy_from_slice(&packet);
+                            session.send_packet(send_pkt);
+                        }
+                        Err(e) => error!("WinTun allocate_send_packet error: {:?}", e),
+                    }
+                }
+            }
+        }
+
+        Ok(())
+    }
 }