chore: sync konduit-platform v0.1.0-beta.8

README.md

@@ -7,7 +7,7 @@
   **TCP-Native VPN. Works Where UDP Doesn't.**
 
   [![License: Proprietary](https://img.shields.io/badge/license-Proprietary-red)](LICENSE)
-  [![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20macOS%20%7C%20Android%20%7C%20iOS-lightgrey)]()
+  [![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20Windows%20%7C%20Android-lightgrey)]()
   [![Status](https://img.shields.io/badge/status-Beta-orange)]()
 
 </div>
@@ -33,20 +33,24 @@ Most VPNs treat TCP as a fallback. Konduit is designed for TCP from the ground u
 - **Userspace implementation** — no kernel modules, no root required
 - **Hot config reload** — update server configuration without dropping connections
 - **QR code provisioning** — scan once, connect instantly
-- **Cross-platform** — Linux, macOS, Android, iOS
+- **Cross-platform** — Linux, Windows, Android (macOS and iOS coming soon)
 - **Modern cryptography** — X25519 key exchange, ChaCha20-Poly1305 data channel
-- **Stealth mode** — port 443 deployment with decoy proxy for hostile network environments
+- **SOCKS5 chaining** — egress-dial (`use_proxy`) to reach the server through your own proxy, or a post-tunnel listener (`listen_socks`) for per-app routing — see [SOCKS Modes](docs/socks-modes.md)
 - **Memory safe** — written entirely in Rust
 
 ## Download
 
 Releases are published on the [Releases](../../releases) page. Each release includes:
 
-| Binary | Purpose |
-|---|---|
-| `konduit-server` | VPN server |
-| `konduit` | CLI client (Linux) |
-| `konduit-ctl` | Server provisioning tool |
+| Artifact | Platform | Purpose |
+|---|---|---|
+| `konduit-server-*-linux-x86_64` | Linux | VPN server |
+| `konduit-*-linux-x86_64` | Linux | CLI client |
+| `konduit-ctl-*-linux-x86_64` | Linux | Server provisioning tool |
+| `Konduit-*-x86_64.AppImage` | Linux | GUI client (AppImage) |
+| `konduit-cli-*-windows-x86_64.zip` | Windows | CLI client + wintun.dll |
+| `konduit-gui-*-windows-x86_64.zip` | Windows | GUI client |
+| `konduit-*-android.aab` | Android | Android app (sideload via bundletool) |
 
 ### Linux (CLI)
 
@@ -61,14 +65,39 @@ echo "your secret mantra" | ./konduit-ctl bootstrap -l vpn.example.com:443 -p -
 ./konduit connect --config client.toml
 ```
 
-### macOS · Android · iOS
+### Linux (GUI)
+
+Download the `.AppImage`, make it executable, and run it:
+
+```bash
+chmod +x Konduit-*-x86_64.AppImage
+./Konduit-*-x86_64.AppImage
+```
+
+### Windows
+
+Extract the zip and run `konduit.exe` (CLI) or `Konduit.exe` (GUI). `wintun.dll` must remain alongside the executable.
+
+### Android
+
+Download from [Google Play](https://play.google.com/store/apps/details?id=eu.k_ops.konduit) or sideload the `.aab` using [bundletool](https://github.com/google/bundletool).
+
+### macOS · iOS
 
 Coming soon.
 
-## Server Setup
+## Setup
 
+**GUI clients**
+- [Linux GUI Quickstart](docs/gui-quickstart-linux.md) — AppImage, privileges, autostart
+- [Windows GUI Quickstart](docs/gui-quickstart-windows.md) — extract, UAC, WinTun, autostart
+
+**CLI & server**
+- [Client Quickstart](docs/client-quickstart.md) — download, configure, connect, run as a systemd service
 - [Server Quickstart](docs/server-quickstart.md) — install, provision, NAT setup for iptables and firewalld
-- [Stealth Mode Setup](docs/stealth-setup.md) — HAProxy TCP passthrough + camouflage configuration
+- [SOCKS5 Modes](docs/socks-modes.md) — reach the server through a proxy, or expose a local SOCKS5 listener
+- [Connection Tuning](docs/connection-tuning.md) — opt-in connection pooling for unstable links
+- [systemd units](docs/systemd/) — service files for konduit-server, konduit (client), and konduit-admin-ui
 
 ## Architecture
 
@@ -96,7 +125,7 @@ Konduit engine (Rust)
 
 The [`konduit-platform`](./konduit-platform) crate is published here for transparency and security audit. It contains the cryptographic primitives, connection statistics, and platform networking layer (TUN device, DNS, routes) — everything an auditor needs to verify what runs on your machine. It is licensed under the [PolyForm Noncommercial License 1.0.0](LICENSE) — free to read, study, and use for noncommercial purposes.
 
-The VPN server, management UI, and stealth-mode protocol are proprietary. Keeping stealth mechanisms private makes automated DPI fingerprinting significantly harder. Source review under NDA is available for enterprise partners.
+The VPN server and management UI are proprietary. Source review under NDA is available for enterprise partners.
 
 ## Security
 
@@ -104,8 +133,6 @@ The VPN server, management UI, and stealth-mode protocol are proprietary. Keepin
 
 **Key storage:** Private keys are stored in the OS secure enclave on every platform (iOS Keychain, macOS Keychain, Android Keystore). They are never written to disk in plaintext.
 
-**Stealth mode:** On port 443, failed or unrecognized handshakes are proxied transparently to a configurable decoy service. From the outside, the server is indistinguishable from a standard HTTPS endpoint.
-
 ## Support
 
 **Bug reports:** Use the in-app reporting feature or open an issue in this repository.
@@ -119,8 +146,9 @@ The VPN server, management UI, and stealth-mode protocol are proprietary. Keepin
 ## About
 
 Created by **Eugen Kaparulin**.  
-Official binaries distributed by **K-Ops Oy**.
+Official binaries distributed by **[K-Ops Oy](https://k-ops.eu)**.
 
 © Eugen Kaparulin. All rights reserved.  
 [`konduit-platform`](./konduit-platform) is published under the [PolyForm Noncommercial License 1.0.0](LICENSE).  
-All other parts of Konduit are proprietary.
+All other parts of Konduit are proprietary.  
+[Privacy Policy](docs/privacy-policy.md)

docs/client-quickstart.md

@@ -0,0 +1,57 @@
+# Konduit CLI Client Quickstart
+
+## 1. Download
+
+Download the `konduit` binary from the [Releases](../../releases) page and make it executable:
+
+```bash
+chmod +x konduit
+sudo cp konduit /opt/konduit/konduit
+```
+
+## 2. Get a client config
+
+Your server administrator will provide a `client.toml` generated by `konduit-ctl add-client`. Transfer it to the client machine:
+
+```bash
+sudo cp client.toml /opt/konduit/client.toml
+sudo chmod 600 /opt/konduit/client.toml
+```
+
+## 3. Connect
+
+```bash
+/opt/konduit/konduit -c /opt/konduit/client.toml
+```
+
+A successful connection looks like:
+
+```
+→ resolving vpn.example.com  ok
+→ tcp handshake  X25519  ok
+→ tun device  konduit0  up
+→ routes applied by server policy  ok
+connected · no udp, no root, port 443
+```
+
+## 4. Run as a systemd service
+
+To connect automatically on boot, use the provided systemd unit:
+
+```bash
+sudo cp /opt/konduit/docs/systemd/konduit.service /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now konduit
+```
+
+The unit runs as root (required for TUN device creation) and restarts automatically on failure.
+
+## 5. Capabilities (alternative to root)
+
+To run without root, grant the binary the required capability instead:
+
+```bash
+sudo setcap cap_net_admin=+ep /opt/konduit/konduit
+```
+
+Then change `User=root` to your user account in the systemd unit before enabling it.

docs/connection-tuning.md

@@ -0,0 +1,20 @@
+# Connection Tuning
+
+Konduit is a TCP-native VPN. On stable networks, a single TCP connection works fine. On unstable links (spotty Wi-Fi, mobile data, satellite), you can opt into a small pool of pre-warmed connections so a failing connection can be replaced without a full reconnect cascade.
+
+## Config
+
+```toml
+[connection]
+pool_enabled = false    # default off; opt in for unstable links
+pool_size = 3           # pre-warmed idle connections when enabled
+carry_duration = 1.0    # seconds an active connection carries traffic before handoff
+```
+
+- `pool_enabled` — when `true`, the client keeps `pool_size` extra pre-authenticated connections warm, so an in-use connection can fail over instantly instead of paying a fresh TCP-plus-handshake cost.
+- `pool_size` — number of pre-warmed idle connections to keep, in addition to the active one. Only used when `pool_enabled = true`.
+- `carry_duration` — how long (in seconds) an active connection carries traffic before handoff to a pre-warmed one. Only used when `pool_enabled = true`.
+
+This is a resilience feature, not a stealth feature — it exists purely to make konduit more tolerant of flaky links, and has no effect on how konduit's traffic looks to a network observer.
+
+Server-side, sticky DL-target routing keeps your active connection selected until it actually fails (detected via a write timeout), rather than rotating on a fixed timer. This needs no client-side configuration.

docs/diagrams/stealth-architecture.svg

@@ -0,0 +1,62 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 620 415" width="620" height="415">
+  <defs>
+    <marker id="stealth-ah" markerWidth="8" markerHeight="8" refX="8" refY="3" orient="auto">
+      <path d="M0,0 L0,6 L8,3 z" fill="#546e7a"/>
+    </marker>
+    <marker id="stealth-ahb" markerWidth="8" markerHeight="8" refX="8" refY="3" orient="auto">
+      <path d="M0,0 L0,6 L8,3 z" fill="#1565c0"/>
+    </marker>
+  </defs>
+
+  <!-- Background -->
+  <rect width="620" height="415" rx="10" fill="#fafafa" stroke="#dee2e6" stroke-width="1"/>
+
+  <!-- Title -->
+  <text x="310" y="27" text-anchor="middle" font-family="monospace" font-size="14" font-weight="bold" fill="#263238">Stealth Mode: Real TLS Bypass via HAProxy</text>
+
+  <!-- ── Client ── -->
+  <rect x="185" y="42" width="250" height="62" rx="8" fill="#e0f7fa" stroke="#00838f" stroke-width="2"/>
+  <text x="310" y="68" text-anchor="middle" font-family="monospace" font-size="13" font-weight="bold" fill="#00695c">Client</text>
+  <text x="310" y="87" text-anchor="middle" font-family="monospace" font-size="11" fill="#00695c">stealth = true  (or  tls = true)</text>
+
+  <!-- Arrow: Client → HAProxy -->
+  <line x1="310" y1="104" x2="310" y2="150" stroke="#546e7a" stroke-width="2" marker-end="url(#stealth-ah)"/>
+  <!-- Arrow label (right side) -->
+  <rect x="318" y="109" width="148" height="34" rx="3" fill="#eceff1"/>
+  <text x="392" y="122" text-anchor="middle" font-family="monospace" font-size="10" fill="#37474f">TLS 1.3 · port 443</text>
+  <text x="392" y="136" text-anchor="middle" font-family="monospace" font-size="10" fill="#37474f">real cert (certbot)</text>
+  <!-- DPI callout (left side of arrow) -->
+  <text x="302" y="120" text-anchor="end" font-family="monospace" font-size="10" font-weight="bold" fill="#e65100">DPI/TSPU:</text>
+  <text x="302" y="134" text-anchor="end" font-family="monospace" font-size="10" fill="#e65100">sees valid HTTPS ✓</text>
+
+  <!-- ── HAProxy ── -->
+  <rect x="108" y="150" width="404" height="78" rx="8" fill="#e8f5e9" stroke="#2e7d32" stroke-width="2"/>
+  <text x="310" y="176" text-anchor="middle" font-family="monospace" font-size="13" font-weight="bold" fill="#1b5e20">HAProxy  :443</text>
+  <text x="310" y="194" text-anchor="middle" font-family="monospace" font-size="11" fill="#1b5e20">TLS termination · inspect first byte of payload</text>
+  <text x="310" y="213" text-anchor="middle" font-family="monospace" font-size="10" fill="#388e3c">HTTP method bytes → web backend    ·    binary → konduit</text>
+
+  <!-- Arrow: HAProxy → Web (down-left) -->
+  <line x1="208" y1="228" x2="168" y2="275" stroke="#78909c" stroke-width="1.5" marker-end="url(#stealth-ah)"/>
+  <text x="163" y="258" text-anchor="end" font-family="monospace" font-size="10" fill="#546e7a">HTTP</text>
+
+  <!-- Arrow: HAProxy → Konduit (down-right) -->
+  <line x1="412" y1="228" x2="452" y2="275" stroke="#1565c0" stroke-width="2" marker-end="url(#stealth-ahb)"/>
+  <text x="456" y="258" font-family="monospace" font-size="10" fill="#1565c0">binary</text>
+
+  <!-- ── Web backend ── -->
+  <rect x="78" y="275" width="184" height="58" rx="8" fill="#f5f5f5" stroke="#9e9e9e" stroke-width="1.5"/>
+  <text x="170" y="301" text-anchor="middle" font-family="monospace" font-size="12" font-weight="bold" fill="#424242">Web backend</text>
+  <text x="170" y="319" text-anchor="middle" font-family="monospace" font-size="10" fill="#616161">:8080  (nginx / any HTTP)</text>
+
+  <!-- ── Konduit ── -->
+  <rect x="358" y="275" width="184" height="58" rx="8" fill="#e3f2fd" stroke="#1565c0" stroke-width="2"/>
+  <text x="450" y="301" text-anchor="middle" font-family="monospace" font-size="12" font-weight="bold" fill="#0d47a1">Konduit</text>
+  <text x="450" y="319" text-anchor="middle" font-family="monospace" font-size="10" fill="#1565c0">:8443  plain TCP  (stealth off)</text>
+
+  <!-- Arrow: Konduit → VPN -->
+  <line x1="450" y1="333" x2="450" y2="357" stroke="#1565c0" stroke-width="2" marker-end="url(#stealth-ahb)"/>
+
+  <!-- ── VPN Tunnel ── -->
+  <rect x="358" y="357" width="184" height="40" rx="8" fill="#1565c0"/>
+  <text x="450" y="382" text-anchor="middle" font-family="monospace" font-size="12" font-weight="bold" fill="#ffffff">VPN Tunnel</text>
+</svg>

docs/gui-quickstart-linux.md

@@ -0,0 +1,66 @@
+# Konduit GUI — Linux Quickstart
+
+## 1. Download
+
+Download the `Konduit-*-x86_64.AppImage` from the [Releases](../../releases) page.
+
+## 2. Make it executable
+
+```bash
+chmod +x Konduit-*-x86_64.AppImage
+```
+
+## 3. Run
+
+Double-click the AppImage in your file manager, or launch it from the terminal:
+
+```bash
+./Konduit-*-x86_64.AppImage
+```
+
+No installation required. The AppImage is self-contained.
+
+## 4. Load your config
+
+Your server administrator will provide either a `client.toml` config file or a QR code image.
+
+- **TOML config:** your administrator will provide a `client.toml` file. Open it in a text editor and enter the server address, port, and key values into the corresponding fields in the app.
+- **QR code:** tap **Scan QR code** and point the camera at the QR code image, or use **Import QR image** to select an image file from disk.
+
+## 5. Privileges
+
+Konduit creates a TUN network device, which requires elevated network capability. The AppImage requests this automatically via a `pkexec` prompt on first run. If you see a password prompt, enter your user password to grant the capability.
+
+If `pkexec` is not available on your system (some minimal desktop environments), grant the capability manually once:
+
+```bash
+sudo setcap cap_net_admin=+ep ~/.local/share/konduit/konduit-helper
+```
+
+## 6. Autostart on login (optional)
+
+To start Konduit automatically when you log in, enable autostart in the app: **Settings → Start on login**.
+
+Alternatively, copy the provided desktop entry to your autostart directory:
+
+```bash
+cp ~/.local/share/applications/konduit.desktop ~/.config/autostart/
+```
+
+## Troubleshooting
+
+**AppImage won't launch** — your system may be missing FUSE. Install it:
+
+```bash
+# Debian / Ubuntu
+sudo apt install libfuse2
+
+# Fedora / RHEL
+sudo dnf install fuse
+```
+
+**"Failed to create TUN device"** — the capability was not granted. Run the `setcap` command from step 5 and relaunch.
+
+**Connection fails immediately** — check that the server address, port, and key values in the app match what your administrator provided. Contact your administrator if you are unsure.
+
+**Config lost on relaunch** — re-enter your connection details or scan the QR code again.

docs/gui-quickstart-windows.md

@@ -0,0 +1,65 @@
+# Konduit GUI — Windows Quickstart
+
+## Requirements
+
+- Windows 10 or later (64-bit)
+- Administrator account (required for VPN driver installation)
+
+## 1. Download
+
+Download `konduit-gui-*-windows-x86_64.zip` from the [Releases](../../releases) page.
+
+## 2. Extract
+
+Right-click the zip file and choose **Extract All**. Extract to a folder of your choice, for example `C:\Konduit`.
+
+Keep all files together — `Konduit.exe` and `wintun.dll` must be in the same folder.
+
+## 3. Run
+
+Double-click `Konduit.exe`.
+
+Windows will show a **UAC prompt** asking for administrator permission. This is required because Konduit uses the [WinTun](https://www.wintun.net/) driver to create a virtual network adapter. Click **Yes** to continue.
+
+> If you dismiss the UAC prompt, Konduit will not be able to establish a VPN connection.
+
+## 4. Load your config
+
+Your server administrator will provide either a `client.toml` config file or a QR code image.
+
+- **TOML config:** your administrator will provide a `client.toml` file. Open it in a text editor and enter the server address, port, and key values into the corresponding fields in the app.
+- **QR code:** tap **Import QR image** and select the QR code image file from disk.
+
+## 5. Connect
+
+Press **Connect**. A system tray icon will appear while the VPN is active. Right-click the tray icon to disconnect.
+
+## 6. Windows Defender / antivirus warning
+
+Some antivirus tools flag `wintun.dll` or new unsigned executables. If Windows Defender blocks the launch:
+
+1. Open **Windows Security → Virus & threat protection**
+2. Click **Protection history**
+3. Find the Konduit entry and choose **Allow**
+
+Alternatively, add the Konduit folder to your antivirus exclusion list.
+
+## 7. Autostart on login (optional)
+
+To start Konduit automatically when Windows starts, enable it in the app: **Settings → Start on login**.
+
+Alternatively, create a shortcut to `Konduit.exe` and place it in your Startup folder:
+
+```
+Win + R → shell:startup → paste shortcut here
+```
+
+## Troubleshooting
+
+**UAC prompt does not appear / app closes immediately** — make sure you are running as a user with administrator privileges. Standard (non-admin) accounts cannot install the WinTun driver.
+
+**"wintun.dll not found"** — `Konduit.exe` and `wintun.dll` must be in the same folder. Do not move them separately.
+
+**Connection fails immediately** — check that the server address, port, and key values in the app match what your administrator provided. Contact your administrator if you are unsure.
+
+**Tray icon disappears unexpectedly** — the app may have crashed. Check Windows Event Viewer or relaunch `Konduit.exe`.

docs/privacy-policy.md

@@ -0,0 +1,71 @@
+# Konduit Privacy Policy
+
+_Last updated: 9 June 2026_
+
+## Who we are
+
+Konduit is a TCP-native VPN client developed and distributed by **[K-Ops Oy](https://k-ops.eu)**. Questions about this policy can be sent to: **[konduit@k-ops.eu](mailto:konduit@k-ops.eu)**
+
+## What data Konduit processes
+
+### On your device
+
+The Konduit client stores the following data locally:
+
+| Data | Purpose | Where it is stored |
+|------|---------|-------------------|
+| VPN server address and port | Connect to your VPN server | Local config file |
+| Peer ID and pre-shared key (PSK) | Authenticate with your VPN server | Local config file |
+| Session statistics (bytes sent/received, connection state) | Display connection status | In-memory only, not persisted |
+
+### On the VPN server
+
+When you connect, the VPN server you connect to processes:
+
+| Data | Purpose |
+|------|---------|
+| Your IP address | Route return traffic to your device |
+| Connection timestamps | Session management |
+| Traffic volume (bytes in/out) | Capacity planning and abuse prevention |
+| Destination IP addresses of tunnelled traffic | Route packets to their destination |
+
+The content of tunnelled traffic is not inspected beyond what is necessary for routing.
+
+## What we do not collect
+
+- Konduit does **not** collect analytics, crash reports, usage statistics, or any telemetry.
+- Konduit does **not** display advertising.
+- Konduit does **not** sell or share connection metadata with third parties.
+
+## Self-hosted deployments
+
+Konduit is designed to be self-hosted. If you run your own Konduit server, all server-side data listed above stays under your control and is never transmitted to [K-Ops Oy](https://k-ops.eu).
+
+## Data retention and deletion
+
+All client-side data is stored in the local config file. To delete it, remove your configuration or uninstall Konduit.
+
+Server-side connection logs are retained for a limited period for operational purposes and then deleted. The exact retention period depends on the server operator.
+
+## Security
+
+- All traffic between client and server is encrypted using **X25519** key exchange and **ChaCha20-Poly1305** AEAD.
+- The pre-shared key (PSK) is stored in the local config file with permissions restricted to the current user.
+
+## Children
+
+Konduit is not directed at children under 13 and does not knowingly collect data from children.
+
+## GDPR (EU residents)
+
+When using a [K-Ops Oy](https://k-ops.eu) operated server, [K-Ops Oy](https://k-ops.eu) acts as data processor for connection metadata (IP address, timestamps, traffic volume) as described above. This data is processed on the legal basis of legitimate interest (providing the VPN service). You may request deletion of your connection metadata by contacting **[konduit@k-ops.eu](mailto:konduit@k-ops.eu)**.
+
+When using a self-hosted server, [K-Ops Oy](https://k-ops.eu) does not process any of your data.
+
+## Changes to this policy
+
+If we update this policy, the new version will be published at this URL with an updated "Last updated" date.
+
+## Contact
+
+Privacy questions: **[konduit@k-ops.eu](mailto:konduit@k-ops.eu)**

docs/server-quickstart.md

@@ -34,7 +34,7 @@ echo "your secret mantra phrase here" | ./konduit-ctl bootstrap -l vpn.example.c
 echo "your secret mantra phrase here" | ./konduit-ctl bootstrap -l vpn.example.com:8443 --public-port 443 -p -
 ```
 
-`--public-port` sets the port written into client configs, so they connect to 443 even though konduit listens on 8443. See [stealth-setup.md](stealth-setup.md) for the full HAProxy configuration.
+`--public-port` sets the port written into client configs, so they connect to 443 even though konduit listens on 8443 — useful when running behind any TCP-passthrough reverse proxy (e.g. HAProxy, nginx `stream` module).
 
 ## 3. Add a Client
 
@@ -62,7 +62,12 @@ Without this, konduit picks the first available `tunN`, which shifts if other VP
 ./konduit-server --config server.toml
 ```
 
-For persistent operation, use the provided systemd unit (`setup/server/konduit-server.service`).
+For persistent operation, use the provided systemd units in [docs/systemd/](systemd/). Copy `konduit-server.service` to `/etc/systemd/system/`, then:
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl enable --now konduit-server
+```
 
 ## 6. NAT / Masquerade
 
@@ -97,8 +102,8 @@ sudo apt install iptables-persistent && sudo netfilter-persistent save
 ## 7. Verify
 
 ```bash
-# Should return your website (camouflage) not an error
-curl -sk https://your-server/
+# Connect a client and confirm the tunnel comes up
+./konduit --config client.toml
 
 # Check konduit logs
 journalctl -u konduit-server -f

docs/socks-modes.md

@@ -0,0 +1,50 @@
+# SOCKS5 Modes
+
+Konduit is a VPN for reaching your own resources over the public internet — it is not a censorship-circumvention tool, and it doesn't try to disguise its traffic. If you need to get through a network that's actively blocking or fingerprinting VPN traffic, that's a job for a dedicated, purpose-built tool — an SSH SOCKS proxy (`ssh -D`), Xray, sing-box, or similar — not something konduit reimplements.
+
+What konduit does provide is standard SOCKS5 support on both sides of the connection, so you can chain it with whichever of those tools you already trust.
+
+## Egress-dial: reaching the server through a proxy (`use_proxy`)
+
+If you already have a SOCKS5 proxy that gets you out of a restrictive network (for example `ssh -D 1080 jumphost`), point konduit at it instead of dialing the server directly:
+
+```toml
+[client]
+server_endpoint = "vpn.example.com:443"
+use_proxy       = "socks5://127.0.0.1:1080"
+```
+
+Or via the CLI:
+
+```bash
+./konduit connect --config client.toml --use-proxy socks5://127.0.0.1:1080
+```
+
+Konduit dials the SOCKS5 proxy, asks it to `CONNECT` to your server, and then runs its normal protocol over that connection — the proxy is otherwise transparent to it. If the proxy is unreachable, or requires authentication konduit doesn't support, the connection attempt fails immediately; there is no silent fallback to a direct connection.
+
+## Listener: exposing a SOCKS5 proxy after the tunnel is up (`listen_socks`)
+
+Once connected, konduit can also expose a local SOCKS5 listener so other tools (browsers, curl, Xray outbounds) can route traffic through the tunnel without needing their own TUN-level integration:
+
+```toml
+[client]
+listen_socks = "127.0.0.1:1080"
+```
+
+Or via the CLI:
+
+```bash
+./konduit connect --config client.toml --listen-socks 127.0.0.1:1080
+```
+
+Connections accepted by the listener are plain outbound TCP connections, routed through the tunnel by the kernel's routing table — the same routes any other tunnelled traffic uses. The SOCKS code itself has no VPN-specific logic.
+
+Notes:
+
+- SOCKS5 only, `CONNECT` command only — no `BIND`, no `UDP ASSOCIATE`.
+- No authentication — bind it to localhost (the default) unless you understand the exposure of doing otherwise.
+- If no address is given, konduit falls back to `127.0.0.1:1080`. Override the fallback itself with the `KONDUIT_SOCKS_LISTEN_ADDR` environment variable.
+
+## Using both together
+
+`use_proxy` and `listen_socks` are independent and can be combined — for example, dial out through an SSH SOCKS proxy to reach your server, and also expose a local SOCKS5 listener once connected for other apps to use.

docs/stealth-setup.md

@@ -1,105 +0,0 @@
-# Stealth Mode: HAProxy + Konduit
-
-Konduit's stealth mode makes the VPN server indistinguishable from a normal HTTPS site. It implements a fake TLS handshake — embedding the client's ephemeral key inside the TLS `SessionID` field. For this to work, **konduit must see the raw TCP stream from the client**. Any proxy that terminates TLS before konduit breaks stealth mode.
-
-## Architecture
-
-```
-Client
-  │  raw TCP (looks like TLS to observers)
-  ▼
-HAProxy :443  ── TCP passthrough ──► konduit-server :8443
-                                           │
-                              valid handshake │ handshake fails (real browser)
-                                           │         ▼
-                                           │   HAProxy :4443  (SSL termination)
-                                           │         │
-                                           │         ▼
-                                           │   real HTTPS backend
-                                        VPN tunnel
-```
-
-## HAProxy Configuration
-
-```haproxy
-# VPN ingress — raw TCP passthrough, no SSL termination
-frontend vpn-ingress
-    bind *:443
-    mode tcp
-    option tcplog
-    default_backend konduit-vpn
-
-backend konduit-vpn
-    mode tcp
-    server konduit 127.0.0.1:8443
-
-# Camouflage backend — receives failed handshakes from konduit via PROXY protocol
-# SSL is terminated here, not on the ingress
-frontend camouflage
-    bind *:4443 ssl crt /etc/haproxy/ssl/your-domain.pem accept-proxy
-    mode http
-    http-request set-header X-Real-IP %[src]
-    http-request set-header X-Forwarded-Proto https
-    default_backend web
-
-backend web
-    mode http
-    server web1 127.0.0.1:80 check
-```
-
-## Konduit server.toml
-
-```toml
-[server]
-listen_addr = "0.0.0.0"
-listen_port = 8443
-public_addr = "your-domain.com"
-public_port = 443   # port clients connect to (HAProxy front)
-
-[stealth]
-enabled = true
-camouflage = "127.0.0.1:4443"  # where to proxy non-konduit connections
-```
-
-Bootstrap with `--public-port` so generated client configs reference port 443:
-
-```bash
-echo "your mantra" | ./konduit-ctl bootstrap -l your-domain.com:8443 --public-port 443 -p -
-```
-
-## How It Works
-
-**Konduit client (stealth handshake):**
-1. Client sends fake TLS ClientHello with identity proof embedded
-2. HAProxy passes raw TCP to konduit on port 8443
-3. Konduit verifies identity, completes handshake, establishes VPN tunnel
-4. Traffic looks like TLS Application Data to any observer
-
-**Real browser or censor probe:**
-1. Browser sends a real TLS ClientHello
-2. HAProxy passes it raw to konduit
-3. Konduit cannot verify identity — proxies the connection to `127.0.0.1:4443` with a PROXY protocol header preserving the real client IP
-4. HAProxy at 4443 terminates TLS and serves your website
-5. Observer sees a normal HTTPS site
-
-## Common Mistakes
-
-```
-# WRONG — TLS terminated by HAProxy before konduit, fake handshake never works
-Client → HAProxy SSL termination → konduit
-
-# CORRECT — raw TCP passed through, konduit handles the fake TLS
-Client → HAProxy TCP passthrough → konduit → HAProxy SSL termination (on failure)
-```
-
-The camouflage frontend uses `accept-proxy` — do not use it as the VPN ingress.
-
-## Verify
-
-```bash
-# Browser should see your real website, not an error
-curl -sk https://your-domain.com/
-
-# Check konduit logs for stealth handshakes
-journalctl -u konduit-server -f | grep -E "Stealth|Authenticated|camouflage"
-```

docs/systemd/konduit-server.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Konduit Server
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/konduit
+ExecStart=/opt/konduit/konduit-server -c /opt/konduit/server.toml
+Restart=on-failure
+RestartSec=5
+
+# Optional hardening
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target

docs/systemd/konduit.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Konduit Client
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/konduit
+ExecStart=/opt/konduit/konduit -c /opt/konduit/client.toml
+Restart=on-failure
+RestartSec=5
+
+# Optional hardening
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target

konduit-platform/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "konduit-platform"
-version = "0.1.0"
+version.workspace = true
 edition = "2021"
 authors = ["Eugen Kaparulin <e.kaparulin@gmail.com>"]
 license = "PolyForm-Noncommercial-1.0.0"
@@ -40,6 +40,7 @@ windows = { version = "0.52", features = [
     "Win32_Networking_WinSock",
 ] }
 ipconfig = "0.3"
+wintun = "0.3"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 system-configuration = "0.5"

konduit-platform/src/dns/linux.rs

@@ -100,15 +100,17 @@ pub async fn restore(
 
     info!("Restoring DNS settings...");
 
-    let result = match if_index {
-        Some(idx) => revert_link_dbus(idx).await,
-        None => revert_resolvectl(interface).await,
-    };
-
-    if let Err(e) = result {
-        warn!("D-Bus DNS revert failed ({}), trying resolvectl", e);
-        revert_resolvectl(interface).await.ok();
+    // Always attempt both paths: D-Bus RevertLink clears per-link config in
+    // systemd-resolved's in-memory state; resolvectl revert is a belt-and-suspenders
+    // pass that ensures the +DefaultRoute domain is removed even if D-Bus races
+    // with interface teardown.
+    if let Some(idx) = if_index {
+        if let Err(e) = revert_link_dbus(idx).await {
+            warn!("D-Bus RevertLink({}) failed: {}", idx, e);
+        }
     }
+    // Always run resolvectl revert as a second pass.
+    revert_resolvectl(interface).await.ok();
 
     state.configured = false;
     Ok(())
@@ -172,6 +174,14 @@ async fn revert_link_dbus(if_index: u32) -> Result<()> {
         .await
         .context("Failed to create resolve1 proxy")?;
 
+    // Clear DNS servers and routing domains explicitly before the full revert.
+    // RevertLink alone can race with interface teardown in systemd-resolved;
+    // zeroing each setting first ensures they are gone even if RevertLink races.
+    let _ = proxy.set_link_dns(if_index as i32, vec![]).await;
+    let _ = proxy
+        .set_link_domains(if_index as i32, vec![])
+        .await;
+
     proxy
         .revert_link(if_index as i32)
         .await

konduit-platform/src/dns/windows.rs

@@ -1,6 +1,10 @@
 use super::DnsState;
 use anyhow::Result;
 use std::net::IpAddr;
+use std::os::windows::process::CommandExt;
+use tracing::info;
+
+const CREATE_NO_WINDOW: u32 = 0x0800_0000;
 
 pub async fn set_dns(
     interface: &str,
@@ -8,92 +12,57 @@ pub async fn set_dns(
     dns_servers: &[IpAddr],
     state: &mut DnsState,
 ) -> Result<()> {
-    // Windows implementation using windows-rs crate
-    // Note: This logic runs within unsafe blocks as it calls Win32 APIs
+    if dns_servers.is_empty() {
+        return Ok(());
+    }
 
-    use std::ffi::c_void;
-    use windows::Win32::Foundation::NO_ERROR;
-    use windows::Win32::NetworkManagement::IpHelper::{
-        SetInterfaceDnsSettings, DNS_INTERFACE_SETTINGS, DNS_INTERFACE_SETTINGS_FLAGS,
-        DNS_INTERFACE_SETTINGS_VERSION1, DNS_SETTING_NAMESERVER,
+    let addrs: Vec<String> = dns_servers.iter().map(|ip| ip.to_string()).collect();
+    let addrs_str = addrs.join(",");
+
+    let iface_arg = if let Some(idx) = if_index {
+        format!("-InterfaceIndex {}", idx)
+    } else {
+        format!("-InterfaceAlias '{}'", interface)
     };
 
-    // We need the Interface LUID (Locally Unique Identifier) or Index/GUID.
-    // The user provided `interface` string might be a GUID or friendly name.
-    // If if_index is provided, that's easier for some APIs.
+    info!("Setting DNS on {} to {}", interface, addrs_str);
 
-    // Convert IP addresses to wide string (UTF-16) comma-separated
-    let mut dns_str = String::new();
-    for (i, ip) in dns_servers.iter().enumerate() {
-        if i > 0 {
-            dns_str.push(',');
-        }
-        dns_str.push_str(&ip.to_string());
-    }
-    let dns_wide: Vec<u16> = dns_str.encode_utf16().chain(std::iter::once(0)).collect();
-
-    if let Some(idx) = if_index {
-        // Find existing settings to backup?
-        // Windows doesn't make it easy to "get current and restore later" without some work.
-        // For simplicity, we assume we can just clear settings on restore.
-    }
-
-    /*
-       Implementation note:
-       Since we cannot easily compile this on Linux to verify, we outline the logic.
-       Real implementation would need `GetInterfaceDnsSettings` to backup state.
-    */
-
-    tracing::info!(
-        "Setting DNS on Windows for interface {}: {:?}",
-        interface,
-        dns_servers
+    let script = format!(
+        "Set-DnsClientServerAddress {} -ServerAddresses {}",
+        iface_arg, addrs_str
     );
+    let status = std::process::Command::new("powershell")
+        .args(["-NoProfile", "-NonInteractive", "-Command", &script])
+        .creation_flags(CREATE_NO_WINDOW)
+        .status()?;
 
-    /*
-    unsafe {
-        let mut settings = DNS_INTERFACE_SETTINGS {
-            Version: DNS_INTERFACE_SETTINGS_VERSION1,
-            Flags: DNS_SETTING_NAMESERVER,
-            NameServer: windows::core::PCWSTR(dns_wide.as_ptr()),
-            ..Default::default()
-        };
-
-        let guid = windows::core::GUID::from(interface)?; // Assuming interface is a GUID string
-
-        let result = SetInterfaceDnsSettings(guid, &mut settings);
-        if result != NO_ERROR {
-             anyhow::bail!("Failed to set DNS: {:?}", result);
-        }
+    if !status.success() {
+        anyhow::bail!("PowerShell failed to set DNS on {}", interface);
     }
-    */
-
-    // For now, since we can't test, we log a limitation
-    tracing::warn!("Windows DNS setting logic placeholder");
 
     state.configured = true;
     Ok(())
 }
 
 pub async fn restore(
-    _interface: &str,
-    _if_index: Option<u32>,
-    _state: &mut DnsState,
+    interface: &str,
+    if_index: Option<u32>,
+    state: &mut DnsState,
 ) -> Result<()> {
-    tracing::info!("Restoring DNS on Windows...");
+    info!("Restoring DNS on {} to automatic", interface);
 
-    // Clear custom DNS settings (return to DHCP?)
-    /*
-    unsafe {
-         let mut settings = DNS_INTERFACE_SETTINGS {
-            Version: DNS_INTERFACE_SETTINGS_VERSION1,
-            Flags: DNS_SETTING_NAMESERVER,
-            NameServer: windows::core::PCWSTR::null(),
-            ..Default::default()
-        };
-        // Call SetInterfaceDnsSettings with empty NameServer or appropriate flags
-    }
-    */
+    let iface_arg = if let Some(idx) = if_index {
+        format!("-InterfaceIndex {}", idx)
+    } else {
+        format!("-InterfaceAlias '{}'", interface)
+    };
 
+    let script = format!("Set-DnsClientServerAddress {} -ResetServerAddresses", iface_arg);
+    let _ = std::process::Command::new("powershell")
+        .args(["-NoProfile", "-NonInteractive", "-Command", &script])
+        .creation_flags(CREATE_NO_WINDOW)
+        .status();
+
+    state.configured = false;
     Ok(())
 }

konduit-platform/src/routes/linux.rs

@@ -5,6 +5,12 @@ use rtnetlink::{new_connection, Handle, IpVersion};
 use std::net::{IpAddr, Ipv4Addr};
 use tracing::{info, warn};
 
+// Added with priority lower than typical policy-routing stacks (e.g., xray uses 9001).
+// Ensures konduit's main-table routes (tun0 default, server host-route) win in
+// full-tunnel mode without modifying any third-party routing table.
+const VPN_RULE_PRIORITY: u32 = 8000;
+
+
 const VPN_ROUTE_METRIC: u32 = 50;
 
 /// Manages routing table for VPN connection using netlink.
@@ -21,6 +27,8 @@ pub struct RouteManager {
     wifi_gateway: Option<Ipv4Addr>,
     // Saved for re-adding the VPN default route after reconnect.
     vpn_gateway: Option<Ipv4Addr>,
+    // True when we installed an ip rule to override policy-routing stacks.
+    added_policy_rule: bool,
 }
 
 impl RouteManager {
@@ -39,6 +47,7 @@ impl RouteManager {
             server_ip: None,
             wifi_gateway: None,
             vpn_gateway: None,
+            added_policy_rule: false,
         })
     }
 
@@ -58,22 +67,40 @@ impl RouteManager {
     }
 
     async fn get_default_gateway(&self) -> Result<Ipv4Addr> {
+        use netlink_packet_route::route::RouteAddress;
+
         let mut routes = self.handle.route().get(IpVersion::V4).execute();
+        // Collect all default-route gateways with their metrics.
+        // VPN default routes have low metric (50); physical/DHCP routes have high metric (600+).
+        // We want the physical gateway, so take the one with the highest metric.
+        let mut candidates: Vec<(u32, Ipv4Addr)> = Vec::new();
 
         while let Some(route) = routes.try_next().await? {
-            if route.header.destination_prefix_length == 0 {
-                for nla in route.attributes.iter() {
-                    if let netlink_packet_route::route::RouteAttribute::Gateway(addr) = nla {
-                        use netlink_packet_route::route::RouteAddress;
-                        if let RouteAddress::Inet(ipv4_addr) = addr {
-                            return Ok(*ipv4_addr);
-                        }
-                    }
+            if route.header.destination_prefix_length != 0 {
+                continue;
+            }
+            let mut metric = 0u32;
+            let mut gateway: Option<Ipv4Addr> = None;
+            for nla in route.attributes.iter() {
+                match nla {
+                    netlink_packet_route::route::RouteAttribute::Gateway(
+                        RouteAddress::Inet(ip),
+                    ) => gateway = Some(*ip),
+                    netlink_packet_route::route::RouteAttribute::Priority(m) => metric = *m,
+                    _ => {}
                 }
             }
+            if let Some(gw) = gateway {
+                candidates.push((metric, gw));
+            }
         }
 
-        anyhow::bail!("No default gateway found")
+        // Highest metric = physical/DHCP interface (not VPN).
+        candidates
+            .into_iter()
+            .max_by_key(|(m, _)| *m)
+            .map(|(_, gw)| gw)
+            .ok_or_else(|| anyhow::anyhow!("No default gateway found"))
     }
 
     /// Install routes for the VPN connection.
@@ -178,6 +205,8 @@ impl RouteManager {
                 .map_err(|e| anyhow::anyhow!("Failed to add VPN default route: {:?}", e))?;
 
             self.added_routes.push((Ipv4Addr::new(0, 0, 0, 0), 0));
+
+            self.install_policy_rule().await;
         } else {
             info!(
                 "Split-tunnel mode: adding {} routes via VPN...",
@@ -239,6 +268,52 @@ impl RouteManager {
         Ok(())
     }
 
+    /// Add a high-priority ip rule so konduit's main-table routes override any
+    /// policy-routing stack (e.g., xray, sing-box) that intercepts traffic via a
+    /// separate routing table at priority ~9000.
+    ///
+    /// Uses the same netlink handle as every other route change here, rather
+    /// than shelling out to `ip rule add` -- a child process spawned via
+    /// std::process::Command does NOT inherit capabilities granted to this
+    /// process via `setcap`/file capabilities (they'd need to be raised into
+    /// the ambient set first, which nothing here does), so the subprocess
+    /// silently failed with EPERM ("RTNETLINK answers: Operation not
+    /// permitted") every time, regardless of environment. That meant this
+    /// rule never actually got installed, so a competing policy-routing
+    /// stack (e.g. Xray) could keep overriding the VPN's own routes.
+    async fn install_policy_rule(&mut self) {
+        match self
+            .handle
+            .rule()
+            .add()
+            .v4()
+            .priority(VPN_RULE_PRIORITY)
+            // RuleAddRequest::new() defaults the rule's action to Unspec, not
+            // ToTable. A "from all" rule (matches every packet) with an
+            // Unspec action is not a valid "jump to main table" rule and the
+            // kernel does not fall through past it — it broke route lookups
+            // for ALL traffic, not just VPN traffic, until reboot.
+            .action(netlink_packet_route::rule::RuleAction::ToTable)
+            .execute()
+            .await
+        {
+            Ok(()) => {
+                self.added_policy_rule = true;
+                info!("Added ip rule priority {} → main table", VPN_RULE_PRIORITY);
+            }
+            Err(e) => {
+                let err_msg = format!("{:?}", e);
+                if err_msg.contains("File exists") || err_msg.contains("EEXIST") || err_msg.contains("code: Some(-17)")
+                {
+                    self.added_policy_rule = true;
+                    warn!("ip rule priority {} already exists, continuing...", VPN_RULE_PRIORITY);
+                } else {
+                    warn!("Failed to add ip rule priority {}: {:?}", VPN_RULE_PRIORITY, e);
+                }
+            }
+        }
+    }
+
     /// Setup DNS configuration
     pub async fn setup_dns(&mut self, dns_servers: &[IpAddr], assigned_ip: IpAddr) -> Result<()> {
         if dns_servers.is_empty() {
@@ -312,11 +387,13 @@ impl RouteManager {
         let mut to_delete = None;
         while let Some(route) = routes.try_next().await? {
             if route.header.destination_prefix_length == 0 {
+                // Identify our default route by its output interface (tun0), not metric,
+                // since the kernel may not round-trip the Priority attribute reliably.
                 let is_ours = route.attributes.iter().any(|nla| {
                     matches!(
                         nla,
-                        netlink_packet_route::route::RouteAttribute::Priority(p)
-                            if *p == VPN_ROUTE_METRIC
+                        netlink_packet_route::route::RouteAttribute::Oif(idx)
+                            if Some(*idx) == self.tun_index
                     )
                 });
                 if is_ours {
@@ -380,6 +457,33 @@ impl RouteManager {
             self.added_routes.len()
         );
 
+        // Remove the policy rule first so traffic stops using the VPN immediately.
+        // Same netlink-handle approach as the add side above -- `handle.rule().del()`
+        // needs the exact existing RuleMessage, so look it up by priority first.
+        if self.added_policy_rule {
+            let mut rules = self.handle.rule().get(IpVersion::V4).execute();
+            let mut to_delete = None;
+            while let Some(rule) = rules.try_next().await? {
+                let matches_priority = rule
+                    .attributes
+                    .iter()
+                    .any(|attr| matches!(attr, netlink_packet_route::rule::RuleAttribute::Priority(p) if *p == VPN_RULE_PRIORITY));
+                if matches_priority {
+                    to_delete = Some(rule);
+                    break;
+                }
+            }
+
+            match to_delete {
+                Some(rule) => match self.handle.rule().del(rule).execute().await {
+                    Ok(()) => info!("Removed ip rule priority {}", VPN_RULE_PRIORITY),
+                    Err(e) => warn!("Failed to delete ip rule priority {}: {:?}", VPN_RULE_PRIORITY, e),
+                },
+                None => warn!("ip rule priority {} not found, nothing to remove", VPN_RULE_PRIORITY),
+            }
+            self.added_policy_rule = false;
+        }
+
         if self.added_routes.is_empty() {
             return Ok(());
         }
@@ -406,14 +510,21 @@ impl RouteManager {
 
             if let Some(ip) = dest_ip {
                 if self.added_routes.contains(&(ip, prefix_len)) {
-                    let is_ours = route.attributes.iter().any(|nla| {
-                        matches!(
-                            nla,
-                            netlink_packet_route::route::RouteAttribute::Priority(p)
-                                if *p == VPN_ROUTE_METRIC
-                        )
-                    });
-                    if is_ours {
+                    // For the default route (0.0.0.0/0), match by output interface
+                    // (tun0), not just destination prefix — otherwise we also delete
+                    // the WiFi default route (same prefix, different OIF/metric).
+                    if prefix_len == 0 {
+                        let is_ours = route.attributes.iter().any(|nla| {
+                            matches!(
+                                nla,
+                                netlink_packet_route::route::RouteAttribute::Oif(idx)
+                                    if Some(*idx) == self.tun_index
+                            )
+                        });
+                        if is_ours {
+                            routes_to_delete.push(route);
+                        }
+                    } else {
                         routes_to_delete.push(route);
                     }
                 }
@@ -442,3 +553,69 @@ impl Drop for RouteManager {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use netlink_packet_route::rule::RuleAction;
+
+    const REEXEC_ENV_VAR: &str = "KORIDOR_ROUTE_TEST_IN_NETNS";
+
+    // `unshare(CLONE_NEWUSER)` fails with EINVAL if the calling process is
+    // multithreaded (which `cargo test`'s harness always is). So instead of
+    // calling the syscall in-process, re-exec this same test binary under
+    // the external `unshare --user --net --map-root-user` command, which
+    // starts a fresh, single-threaded process already inside an isolated
+    // user+net namespace -- no real root needed, and the host's actual
+    // routing rules are never touched.
+    fn run_in_isolated_netns(test_name: &str) {
+        let exe = std::env::current_exe().expect("current_exe");
+        let status = std::process::Command::new("unshare")
+            .args(["--user", "--net", "--map-root-user", "--"])
+            .arg(&exe)
+            .args(["--exact", test_name, "--nocapture", "--test-threads=1"])
+            .env(REEXEC_ENV_VAR, "1")
+            .status()
+            .expect("failed to spawn unshare (is util-linux's `unshare` installed?)");
+        assert!(status.success(), "test failed inside isolated netns (see output above)");
+    }
+
+    // Regression test for the bug where connecting broke ALL host networking
+    // (not just VPN traffic) until a reboot: the policy rule installed to
+    // make konduit's routes win over other policy-routing stacks was built
+    // via `RuleAddRequest::new()`, which defaults `header.action` to
+    // `RuleAction::Unspec` — a "from all" rule (matches every packet) with
+    // no action is not a valid "jump to main table" rule, and the kernel
+    // does not fall through to the next rule for it, breaking route lookups
+    // system-wide. The fix must set the action explicitly to `ToTable`.
+    #[tokio::test(flavor = "current_thread")]
+    async fn policy_rule_uses_to_table_action() {
+        if std::env::var(REEXEC_ENV_VAR).is_err() {
+            run_in_isolated_netns("routes::linux::tests::policy_rule_uses_to_table_action");
+            return;
+        }
+
+        let mut mgr = RouteManager::new("lo".to_string())
+            .await
+            .expect("failed to create RouteManager in isolated netns");
+
+        mgr.install_policy_rule().await;
+
+        let mut rules = mgr.handle.rule().get(IpVersion::V4).execute();
+        let mut found = false;
+        while let Some(rule) = rules.try_next().await.unwrap() {
+            let is_ours = rule.attributes.iter().any(|attr| {
+                matches!(attr, netlink_packet_route::rule::RuleAttribute::Priority(p) if *p == VPN_RULE_PRIORITY)
+            });
+            if is_ours {
+                assert_eq!(
+                    rule.header.action,
+                    RuleAction::ToTable,
+                    "policy rule must use the ToTable action, or the kernel treats it as a black hole for every packet it matches (i.e. everything)"
+                );
+                found = true;
+            }
+        }
+        assert!(found, "installed policy rule not found via rule().get()");
+    }
+}

konduit-platform/src/routes/mod.rs

@@ -7,3 +7,8 @@ pub use linux::RouteManager;
 mod macos;
 #[cfg(target_os = "macos")]
 pub use macos::MacOsNetManager;
+
+#[cfg(target_os = "windows")]
+mod windows;
+#[cfg(target_os = "windows")]
+pub use windows::RouteManager;

konduit-platform/src/routes/windows.rs

@@ -0,0 +1,300 @@
+use anyhow::Result;
+use std::net::{IpAddr, Ipv4Addr};
+use std::os::windows::process::CommandExt;
+use tracing::{info, warn};
+
+const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+
+use crate::dns::DnsManager;
+
+pub struct RouteManager {
+    tun_interface: String,
+    dns_manager: DnsManager,
+    tun_routes: Vec<(Ipv4Addr, u8)>,
+    server_ip: Option<Ipv4Addr>,
+    wifi_gateway: Option<Ipv4Addr>,
+}
+
+impl RouteManager {
+    pub async fn new(tun_interface: String) -> Result<Self> {
+        Ok(Self {
+            dns_manager: DnsManager::new(
+                tun_interface.clone(),
+                None,
+                IpAddr::V4(Ipv4Addr::UNSPECIFIED),
+            ),
+            tun_interface,
+            tun_routes: Vec::new(),
+            server_ip: None,
+            wifi_gateway: None,
+        })
+    }
+
+    fn get_default_gateway() -> Result<Ipv4Addr> {
+        let adapters = ipconfig::get_adapters()
+            .map_err(|e| anyhow::anyhow!("Failed to enumerate adapters: {}", e))?;
+        for adapter in &adapters {
+            for gw in adapter.gateways() {
+                if let IpAddr::V4(gw4) = gw {
+                    if !gw4.is_loopback() && !gw4.is_unspecified() {
+                        return Ok(*gw4);
+                    }
+                }
+            }
+        }
+        anyhow::bail!("No default gateway found")
+    }
+
+    fn prefix_to_mask(prefix: u8) -> Ipv4Addr {
+        let bits = if prefix == 0 {
+            0u32
+        } else {
+            !0u32 << (32 - prefix)
+        };
+        let [a, b, c, d] = bits.to_be_bytes();
+        Ipv4Addr::new(a, b, c, d)
+    }
+
+    // Add/delete server host route through WiFi gateway via `route` command.
+    // Specifying gateway on delete ensures we only remove our entry, not any other path.
+    fn wifi_route_add(dest: Ipv4Addr, prefix: u8, gateway: Ipv4Addr) {
+        let mask = Self::prefix_to_mask(prefix);
+        let out = std::process::Command::new("route")
+            .args([
+                "add",
+                &dest.to_string(),
+                "MASK",
+                &mask.to_string(),
+                &gateway.to_string(),
+                "METRIC",
+                "1",
+            ])
+            .creation_flags(CREATE_NO_WINDOW)
+            .output();
+        match out {
+            Ok(o) => {
+                let stdout = String::from_utf8_lossy(&o.stdout);
+                if !o.status.success() {
+                    // "already exists" is acceptable — a previous run may have left it
+                    warn!("route add {}/{} via {}: {}", dest, prefix, gateway, stdout.trim());
+                }
+            }
+            Err(e) => warn!("route add {}/{} via {}: {}", dest, prefix, gateway, e),
+        }
+    }
+
+    fn wifi_route_delete(dest: Ipv4Addr, prefix: u8, gateway: Ipv4Addr) {
+        let mask = Self::prefix_to_mask(prefix);
+        let _ = std::process::Command::new("route")
+            .args([
+                "delete",
+                &dest.to_string(),
+                "MASK",
+                &mask.to_string(),
+                &gateway.to_string(),
+            ])
+            .creation_flags(CREATE_NO_WINDOW)
+            .status();
+    }
+
+    // Add/delete routes through the TUN interface using netsh.
+    //
+    // `netsh interface ipv4 add route` binds routes to a named interface explicitly,
+    // avoiding the gateway-resolution ambiguity of the `route` command and ensuring
+    // cleanup never touches WiFi routing state.
+    fn tun_route_add(tun_name: &str, dest: Ipv4Addr, prefix: u8) {
+        let prefix_str = format!("{}/{}", dest, prefix);
+        let out = std::process::Command::new("netsh")
+            .args([
+                "interface",
+                "ipv4",
+                "add",
+                "route",
+                &prefix_str,
+                tun_name,
+                "nexthop=0.0.0.0",
+                "metric=1",
+                "store=active",
+            ])
+            .creation_flags(CREATE_NO_WINDOW)
+            .output();
+        match out {
+            Ok(o) => {
+                let stdout = String::from_utf8_lossy(&o.stdout);
+                if o.status.success() {
+                    info!("Added TUN route {}/{}", dest, prefix);
+                } else {
+                    warn!("netsh add route {}/{} on {}: {}", dest, prefix, tun_name, stdout.trim());
+                }
+            }
+            Err(e) => warn!("netsh add route {}/{} on {}: {}", dest, prefix, tun_name, e),
+        }
+    }
+
+    fn tun_route_delete(tun_name: &str, dest: Ipv4Addr, prefix: u8) {
+        let prefix_str = format!("{}/{}", dest, prefix);
+        let out = std::process::Command::new("netsh")
+            .args([
+                "interface",
+                "ipv4",
+                "delete",
+                "route",
+                &prefix_str,
+                tun_name,
+            ])
+            .creation_flags(CREATE_NO_WINDOW)
+            .output();
+        match out {
+            Ok(o) => {
+                let stdout = String::from_utf8_lossy(&o.stdout);
+                if !o.status.success() {
+                    warn!(
+                        "netsh delete route {}/{} on {}: {}",
+                        dest,
+                        prefix,
+                        tun_name,
+                        stdout.trim()
+                    );
+                }
+            }
+            Err(e) => warn!("netsh delete route {}/{} on {}: {}", dest, prefix, tun_name, e),
+        }
+    }
+
+    pub async fn setup_vpn_routes(
+        &mut self,
+        server_addr: &str,
+        _vpn_gateway: IpAddr,
+        routes: &[String],
+    ) -> Result<()> {
+        info!("Setting up Windows VPN routes...");
+
+        let current_gateway = Self::get_default_gateway()?;
+        info!("Current gateway: {}", current_gateway);
+
+        let server_ip: Ipv4Addr = {
+            let host = server_addr.split(':').next().unwrap_or(server_addr);
+            if let Ok(IpAddr::V4(v4)) = host.parse::<IpAddr>() {
+                v4
+            } else {
+                let addrs = tokio::net::lookup_host(format!("{}:0", host)).await?;
+                match addrs.map(|a| a.ip()).next() {
+                    Some(IpAddr::V4(v4)) => v4,
+                    _ => anyhow::bail!("Could not resolve server address to IPv4"),
+                }
+            }
+        };
+
+        // Always record server + gateway so cleanup can delete the host route
+        // even if the add below fails because the route already exists.
+        self.server_ip = Some(server_ip);
+        self.wifi_gateway = Some(current_gateway);
+        Self::wifi_route_add(server_ip, 32, current_gateway);
+
+        let is_full_tunnel = routes.iter().any(|r| r == "0.0.0.0/0");
+
+        if is_full_tunnel {
+            // Two /1 routes on the TUN interface cover the entire address space and
+            // always beat the existing WiFi /0 default route regardless of metric.
+            // netsh with explicit interface name avoids gateway-resolution ambiguity.
+            info!("Full-tunnel mode: adding /1 cover routes on {}...", self.tun_interface);
+            let lower = Ipv4Addr::new(0, 0, 0, 0);
+            let upper = Ipv4Addr::new(128, 0, 0, 0);
+            Self::tun_route_add(&self.tun_interface, lower, 1);
+            self.tun_routes.push((lower, 1));
+            Self::tun_route_add(&self.tun_interface, upper, 1);
+            self.tun_routes.push((upper, 1));
+        } else {
+            info!("Split-tunnel mode: adding {} routes via TUN...", routes.len());
+            for route_str in routes {
+                let Some((dest_str, prefix_str)) = route_str.split_once('/') else {
+                    warn!("Invalid route format: {}", route_str);
+                    continue;
+                };
+                let Ok(dest) = dest_str.parse::<Ipv4Addr>() else {
+                    warn!("Invalid route destination: {}", dest_str);
+                    continue;
+                };
+                let Ok(prefix_len) = prefix_str.parse::<u8>() else {
+                    warn!("Invalid prefix length: {}", prefix_str);
+                    continue;
+                };
+                Self::tun_route_add(&self.tun_interface, dest, prefix_len);
+                self.tun_routes.push((dest, prefix_len));
+                info!("Added split-tunnel route: {}", route_str);
+            }
+        }
+
+        info!("Windows VPN routes configured");
+        Ok(())
+    }
+
+    pub async fn setup_dns(&mut self, dns_servers: &[IpAddr], assigned_ip: IpAddr) -> Result<()> {
+        if dns_servers.is_empty() {
+            return Ok(());
+        }
+        self.dns_manager = DnsManager::new(self.tun_interface.clone(), None, assigned_ip);
+        self.dns_manager.set_dns(dns_servers).await
+    }
+
+    pub async fn restore_dns(&self) -> Result<()> {
+        self.dns_manager.restore().await
+    }
+
+    pub async fn ensure_server_route(&mut self) -> Result<()> {
+        if let (Some(server_ip), Some(gateway)) = (self.server_ip, self.wifi_gateway) {
+            Self::wifi_route_add(server_ip, 32, gateway);
+        }
+        Ok(())
+    }
+
+    pub async fn suspend_default_route(&mut self) -> Result<()> {
+        let lower = Ipv4Addr::new(0, 0, 0, 0);
+        if !self.tun_routes.contains(&(lower, 1)) {
+            return Ok(());
+        }
+        for (dest, prefix) in [(lower, 1u8), (Ipv4Addr::new(128, 0, 0, 0), 1u8)] {
+            Self::tun_route_delete(&self.tun_interface, dest, prefix);
+        }
+        info!("VPN cover routes suspended — traffic falls to WiFi during reconnect");
+        Ok(())
+    }
+
+    pub async fn resume_default_route(&mut self) -> Result<()> {
+        let lower = Ipv4Addr::new(0, 0, 0, 0);
+        if !self.tun_routes.contains(&(lower, 1)) {
+            return Ok(());
+        }
+        let upper = Ipv4Addr::new(128, 0, 0, 0);
+        for (dest, prefix) in [(lower, 1u8), (upper, 1u8)] {
+            Self::tun_route_add(&self.tun_interface, dest, prefix);
+        }
+        info!("VPN cover routes restored after reconnect");
+        Ok(())
+    }
+
+    pub async fn restore_routes(&mut self) -> Result<()> {
+        info!("Removing {} tracked VPN routes...", self.tun_routes.len());
+        for (dest, prefix) in self.tun_routes.drain(..) {
+            Self::tun_route_delete(&self.tun_interface, dest, prefix);
+        }
+        // Always clean up the server host route — a previous unclean exit may have
+        // left it behind even if our add was skipped.
+        if let (Some(server_ip), Some(gateway)) = (self.server_ip.take(), self.wifi_gateway.take()) {
+            Self::wifi_route_delete(server_ip, 32, gateway);
+        }
+        info!("Windows VPN routes removed");
+        Ok(())
+    }
+}
+
+impl Drop for RouteManager {
+    fn drop(&mut self) {
+        if !self.tun_routes.is_empty() {
+            warn!(
+                "RouteManager dropped with {} unrestored TUN routes — call restore_routes() before dropping",
+                self.tun_routes.len()
+            );
+        }
+    }
+}

konduit-platform/src/stats.rs

@@ -247,35 +247,6 @@ mod tests {
         assert_eq!(stats.download_bytes, 2048);
     }
 
-    #[test]
-    fn test_speed_calculation() {
-        let tracker = StatsTracker::new("utilbox.eu:8443".to_string(), "test".to_string());
-
-        // Record some traffic
-        tracker.record_upload(1024);
-        tracker.record_download(2048);
-
-        // Update to calculate speed
-        tracker.update();
-
-        let stats = tracker.get_stats(false);
-        assert_eq!(stats.upload_speed, 1024);
-        assert_eq!(stats.download_speed, 2048);
-
-        // Record more traffic
-        tracker.record_upload(512);
-        tracker.record_download(1024);
-
-        // Update again
-        tracker.update();
-
-        let stats = tracker.get_stats(false);
-        assert_eq!(stats.upload_bytes, 1536);
-        assert_eq!(stats.download_bytes, 3072);
-        assert_eq!(stats.upload_speed, 512);
-        assert_eq!(stats.download_speed, 1024);
-    }
-
     #[test]
     fn test_ring_buffer() {
         let mut buffer = RingBuffer::new();

konduit-platform/src/tun.rs

@@ -1,14 +1,26 @@
 use anyhow::Result;
-use bytes::{Bytes, BytesMut};
+use bytes::Bytes;
+#[cfg(not(target_os = "windows"))]
+use bytes::BytesMut;
 use std::net::IpAddr;
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::sync::mpsc;
-use tracing::{debug, error, info};
+use tracing::{error, info};
+#[cfg(target_os = "linux")]
+use tracing::debug;
+
+// Windows uses wintun directly to avoid the tun crate's poll_read bug, which spawns
+// a new OS thread on every Poll::Pending call, causing thread explosion and packet loss.
+#[cfg(target_os = "windows")]
+use std::sync::Arc;
 
 /// Interface to the TUN device
 pub struct TunDevice {
     pub name: String,
+    #[cfg(not(target_os = "windows"))]
     device: tun::AsyncDevice,
+    #[cfg(target_os = "windows")]
+    session: Arc<wintun::Session>,
+    #[cfg_attr(target_os = "windows", allow(dead_code))]
     mtu: usize,
 }
 
@@ -79,6 +91,44 @@ impl TunDevice {
         }
     }
 
+    /// Create a new TUN device (Windows — uses WinTun directly for correct async behavior)
+    #[cfg(target_os = "windows")]
+    pub fn new(assigned_ip: IpAddr, mtu: usize) -> Result<Self> {
+        use std::net::Ipv4Addr;
+
+        const TUN_NAME: &str = "konduit";
+
+        let wintun = unsafe { wintun::load().map_err(|e| anyhow::anyhow!("Failed to load wintun: {}", e))? };
+        let adapter = match wintun::Adapter::open(&wintun, TUN_NAME) {
+            Ok(a) => a,
+            Err(_) => wintun::Adapter::create(&wintun, TUN_NAME, TUN_NAME, None)
+                .map_err(|e| anyhow::anyhow!("Failed to create WinTun adapter: {}", e))?,
+        };
+
+        let ip = match assigned_ip {
+            IpAddr::V4(v4) => v4,
+            IpAddr::V6(_) => anyhow::bail!("IPv6 not supported for TUN device on Windows"),
+        };
+        let mask = Ipv4Addr::new(255, 255, 255, 0);
+
+        adapter
+            .set_network_addresses_tuple(IpAddr::V4(ip), IpAddr::V4(mask), None)
+            .map_err(|e| anyhow::anyhow!("Failed to set WinTun address: {}", e))?;
+
+        let session = Arc::new(
+            adapter
+                .start_session(wintun::MAX_RING_CAPACITY)
+                .map_err(|e| anyhow::anyhow!("Failed to start WinTun session: {}", e))?,
+        );
+
+        info!("Created TUN interface: {}", TUN_NAME);
+        Ok(Self {
+            name: TUN_NAME.to_string(),
+            session,
+            mtu,
+        })
+    }
+
     /// Create a new TUN device from file descriptor (Android / iOS)
     #[cfg(any(target_os = "android", target_os = "ios"))]
     pub fn from_fd(fd: i32, mtu: usize) -> Result<Self> {
@@ -111,50 +161,153 @@ impl TunDevice {
         }
     }
 
-    /// Run the TUN device loop
+    /// Run the TUN device loop (Linux / macOS / Android / iOS — uses tokio AsyncRead/Write)
+    #[cfg(not(target_os = "windows"))]
     pub async fn run(
         self,
-        mut from_tcp_rx: mpsc::Receiver<Bytes>, // Packets received from TCP to be written to TUN
-        to_tcp_tx: mpsc::Sender<Bytes>,         // Packets read from TUN to be sent to TCP
+        mut from_tcp_rx: mpsc::Receiver<Bytes>,
+        to_tcp_tx: mpsc::Sender<Bytes>,
     ) -> Result<()> {
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
         info!("TUN device loop started");
 
         let (mut reader, mut writer) = tokio::io::split(self.device);
         let mtu = self.mtu;
 
+        // Separate reader task so writes never block reads.
+        let (tun_pkt_tx, mut tun_pkt_rx) = mpsc::channel::<Bytes>(64);
+        tokio::spawn(async move {
+            loop {
+                let mut buf = BytesMut::with_capacity(mtu + 100);
+                match reader.read_buf(&mut buf).await {
+                    Ok(0) => {
+                        info!("TUN device closed");
+                        break;
+                    }
+                    Ok(_) => {
+                        if tun_pkt_tx.send(buf.freeze()).await.is_err() {
+                            break;
+                        }
+                    }
+                    Err(e) => {
+                        error!("TUN read error: {}", e);
+                        break;
+                    }
+                }
+            }
+        });
+
         loop {
-            // Buffer for reading from TUN
-            // We authorize up to MTU + overhead, but each read returns one packet.
-            let mut buf = BytesMut::with_capacity(mtu + 100);
-
             tokio::select! {
-                // 1. Packet from TUN (needs to be sent to server)
-                res = reader.read_buf(&mut buf) => {
-                    match res {
-                        Ok(n) => {
-                            if n == 0 {
-                                info!("TUN device closed");
-                                break;
-                            }
-                            // Important: TUN read returns distinct packets.
-                            // We must send exactly this packet.
-                            let packet = buf.freeze(); // Consumes buf into Bytes
+                biased;
 
-                            if let Err(_) = to_tcp_tx.send(packet).await {
-                                break; // Channel closed
-                            }
+                // Server→TUN first: deliver incoming VPN traffic immediately.
+                //
+                // Deliberately NOT write_all(): a TUN character device requires each
+                // write() syscall to contain exactly one complete packet. write_all()
+                // retries a short write by sending the *remaining* bytes in a follow-up
+                // write() call -- correct for stream sockets, but for a TUN device that
+                // turns one packet into two malformed ones (a truncated first packet,
+                // plus a bogus "packet" made of leftover bytes with no valid IP header).
+                // A single write() either succeeds atomically or it doesn't; there is no
+                // safe way to "continue" a partial packet write, so treat anything short
+                // of a full write as a dropped packet, not a retry target.
+                Some(packet) = from_tcp_rx.recv() => {
+                    match writer.write(&packet).await {
+                        Ok(n) if n == packet.len() => {}
+                        Ok(n) => {
+                            error!(
+                                "TUN short write: wrote {} of {} bytes -- packet dropped (TUN writes must be atomic per-packet)",
+                                n, packet.len()
+                            );
                         }
                         Err(e) => {
-                            error!("TUN read error: {}", e);
+                            error!("TUN write error: {}", e);
+                        }
+                    }
+                }
+
+                // TUN→TCP: forward outgoing packets from the kernel.
+                packet = tun_pkt_rx.recv() => {
+                    match packet {
+                        Some(pkt) => {
+                            if to_tcp_tx.send(pkt).await.is_err() {
+                                break;
+                            }
+                        }
+                        None => {
+                            info!("TUN reader task exited");
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    /// Run the TUN device loop (Windows — uses wintun directly with a dedicated reader thread)
+    ///
+    /// The tun crate's Windows AsyncRead implementation spawns a new OS thread on every
+    /// Poll::Pending, causing thread explosion and ~80% packet loss under normal VPN load.
+    /// We bypass it by using a single dedicated blocking thread for wintun reads.
+    #[cfg(target_os = "windows")]
+    pub async fn run(
+        self,
+        mut from_tcp_rx: mpsc::Receiver<Bytes>,
+        to_tcp_tx: mpsc::Sender<Bytes>,
+    ) -> Result<()> {
+        info!("TUN device loop started");
+
+        let session = self.session;
+        let reader_session = session.clone();
+
+        // One dedicated OS thread for blocking wintun reads.
+        // This avoids spawning a new thread per poll_read call.
+        let (read_tx, mut read_rx) = mpsc::channel::<Bytes>(64);
+        std::thread::spawn(move || loop {
+            match reader_session.receive_blocking() {
+                Ok(pkt) => {
+                    let bytes = Bytes::copy_from_slice(pkt.bytes());
+                    drop(pkt); // release ring buffer slot before blocking on channel send
+                    if read_tx.blocking_send(bytes).is_err() {
+                        break;
+                    }
+                }
+                Err(e) => {
+                    error!("WinTun receive error: {:?}", e);
+                    break;
+                }
+            }
+        });
+
+        loop {
+            tokio::select! {
+                // WinTun → TCP channel
+                packet = read_rx.recv() => {
+                    match packet {
+                        Some(pkt) => {
+                            if to_tcp_tx.send(pkt).await.is_err() {
+                                break;
+                            }
+                        }
+                        None => {
+                            info!("WinTun reader thread exited");
                             break;
                         }
                     }
                 }
 
-                // 2. Packet from TCP (needs to be written to TUN)
+                // TCP channel → WinTun (send_packet is non-blocking ring-buffer op)
                 Some(packet) = from_tcp_rx.recv() => {
-                    if let Err(e) = writer.write_all(&packet).await {
-                        error!("TUN write error: {}", e);
+                    match session.allocate_send_packet(packet.len() as u16) {
+                        Ok(mut send_pkt) => {
+                            send_pkt.bytes_mut().copy_from_slice(&packet);
+                            session.send_packet(send_pkt);
+                        }
+                        Err(e) => error!("WinTun allocate_send_packet error: {:?}", e),
                     }
                 }
             }