Windows installer: agent service, Wintun, tray and PATH in one setup program

Running on Windows needed wintun.dll by hand, an elevated console and a manually started agent; without the DLL the agent silently ran with no interface (and so no exit node or routing at all). `tsng service` (hidden) runs the same `up` under the Windows service manager: src/winservice.rs registers with the SCM through the windows-service crate, reports Running/StopPending/Stopped, and maps a stop request onto the existing shutdown path (stop_signal). The only unsafe is the extern "system" entry point that define_windows_service! expands to, allowed in that module alone. A service has no console, so it logs to %ProgramData%\Tsunagi\logs\tsng.log (one older file kept past 8 MiB). Its state defaults to %ProgramData%\Tsunagi\{data,cache} and its control socket to the system-wide default every client already uses, so an unelevated `tsng status` and the tray find it. dist/windows/tsunagi.iss (Inno Setup) installs tsng.exe, the tray and Wintun 0.14.1 (pinned by SHA-256 in CI, licence text shipped), registers the "Tsunagi" service as LocalSystem with auto start and restart-on-failure, locks the data/cache/log directories to SYSTEM and Administrators by SID, and by tasks adds tsng to the PATH, an inbound firewall rule for the agent and a tray autostart. It stops the service, the tray and any hand-started agent before replacing files; uninstall removes the service, rule and PATH entry and asks before deleting the data (never on a silent uninstall). The release workflows (GitHub and Gitea) build it on the Windows job and publish tsunagi-setup-<version>-x86_64.exe. .cargo/config.toml links the MSVC C runtime statically so nothing needs a Visual C++ redistributable on a clean machine. Compatibility: an agent run by hand keeps its data in the user profile; the service has its own, so networks must be joined again once. Checks: cargo fmt --check, clippy -D warnings, cargo test --workspace passed on macOS (one unrelated wireguard restart test failed once under load and passed on three reruns). winservice.rs was cargo-checked for x86_64-pc-windows-msvc in a scratch crate; the whole tsunagi crate cannot be built for Windows from macOS (aws-lc needs the Windows SDK). The .iss script and the CI step were NOT compiled or run: no Inno Setup or Windows here. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Exit nodes on Windows: use a member as exit node via destination bypass routes
2026-10-03 14:16:05 +01:00 · 2026-10-03 13:43:01 +01:00 · 2026-10-03 12:33:22 +01:00 · 2026-10-03 12:29:40 +01:00 · 2026-10-03 03:30:47 +01:00 · 2026-10-03 02:25:43 +01:00
135 changed files with 4199 additions and 788 deletions
@@ -0,0 +1,5 @@
+# Windows: link the C runtime statically, so the agent and the tray start on a
+# machine that has no Visual C++ redistributable installed. The installer ships
+# nothing but our own files and Wintun.
+[target.x86_64-pc-windows-msvc]
+rustflags = ["-C", "target-feature=+crt-static"]
@@ -45,6 +45,16 @@ jobs:
            deb: true
            deb_arch: arm64
            pkg_arch: aarch64
+          # 32-bit ARM with hardware float (ARMv7, `v7l`): single-board and edge
+          # devices. Statically linked like the others.
+          - os: ubuntu-latest
+            target: armv7-unknown-linux-musleabihf
+            asset: tsunagi-linux-armv7
+            archive: tar.gz
+            zig: true
+            deb: true
+            deb_arch: armhf
+            pkg_arch: armv7h
          - os: macos-latest
            target: aarch64-apple-darwin
            asset: tsunagi-macos-aarch64
@@ -98,9 +108,9 @@ jobs:
            # one lint to keep the musl build log clean. A real link error still
            # fails the build.
            export RUSTFLAGS="${RUSTFLAGS:-} -A linker_messages"
-            cargo zigbuild --release --locked --target "${{ matrix.target }}" --bin tsunagi
+            cargo zigbuild --release --locked --target "${{ matrix.target }}" --bin tsng
          else
-            cargo build --release --locked --target "${{ matrix.target }}" --bin tsunagi
+            cargo build --release --locked --target "${{ matrix.target }}" --bin tsng
          fi

      # The tray GUI. On Linux it is built against glibc (an old baseline for
@@ -136,8 +146,8 @@ jobs:
          stage="dist/pkg/${{ matrix.asset }}"
          mkdir -p "$stage"

-          bin="tsunagi"
-          [[ "${{ runner.os }}" == "Windows" ]] && bin="tsunagi.exe"
+          bin="tsng"
+          [[ "${{ runner.os }}" == "Windows" ]] && bin="tsng.exe"
          cp "target/${{ matrix.target }}/release/${bin}" "$stage/"

          # The tray GUI alongside it, where it was built (Linux: x86_64 only).
@@ -163,6 +173,10 @@ jobs:
            macOS)
              cp dist/macos/cy.hexor.tsunagi.plist "$stage/"
              cp dist/macos/README.md "$stage/INSTALL.md"
+              # The tray as an application bundle, for the Homebrew cask.
+              bash dist/macos/build-app.sh \
+                "target/${{ matrix.target }}/release/tsunagi-tray" \
+                "$version" "$stage/Tsunagi.app"
              ;;
            Windows)
              cp dist/windows/README.md "$stage/INSTALL.md"
@@ -176,6 +190,29 @@ jobs:
            tar -C dist/pkg -czf "${archive}" "${{ matrix.asset }}"
          fi

+      # The Windows installer: the agent as a service, Wintun, the tray and the
+      # PATH entry in one setup program. Wintun is the signed library from
+      # wintun.net, pinned by hash so a changed download fails the build.
+      - name: Build the Windows installer
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $version = $env:GITHUB_REF_NAME.TrimStart('v')
+          Invoke-WebRequest -Uri https://www.wintun.net/builds/wintun-0.14.1.zip -OutFile wintun.zip
+          $hash = (Get-FileHash wintun.zip -Algorithm SHA256).Hash
+          if ($hash -ne '07C256185D6EE3652E09FA55C0B673E2624B565E02C4B9091C79CA7D2F24EF51') {
+            throw "wintun.zip has an unexpected hash: $hash"
+          }
+          Expand-Archive wintun.zip -DestinationPath wintun-dl
+          choco install innosetup -y --no-progress
+          $iscc = Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'
+          $stage = Join-Path $PWD 'dist/pkg/${{ matrix.asset }}'
+          & $iscc "/DAppVersion=$version" "/DSourceDir=$stage" `
+            "/DWintunDir=$(Join-Path $PWD 'wintun-dl/wintun/bin/amd64')" `
+            "/O$PWD" dist/windows/tsunagi.iss
+          if ($LASTEXITCODE -ne 0) { throw "ISCC failed with $LASTEXITCODE" }
+
      # A dependency-free .deb for the x86_64 and aarch64 Linux builds: it drops
      # the static binary, the systemd service and the polkit rule. Built with
      # dpkg-deb (present on the runner); see dist/deb/build-deb.sh.
@@ -186,7 +223,7 @@ jobs:
          set -euo pipefail
          version="${GITHUB_REF_NAME#v}"
          bash dist/deb/build-deb.sh \
-            "target/${{ matrix.target }}/release/tsunagi" \
+            "target/${{ matrix.target }}/release/tsng" \
            "${{ matrix.deb_arch }}" \
            "$version" \
            "tsunagi_${version}_${{ matrix.deb_arch }}.deb"
@@ -202,7 +239,7 @@ jobs:
          version="${GITHUB_REF_NAME#v}"
          pkgver="${version//-/_}"
          bash dist/arch/build-pkg.sh \
-            "target/${{ matrix.target }}/release/tsunagi" \
+            "target/${{ matrix.target }}/release/tsng" \
            "${{ matrix.pkg_arch }}" \
            "$version" \
            "tsunagi-${pkgver}-1-${{ matrix.pkg_arch }}.pkg.tar.zst"
@@ -218,11 +255,11 @@ jobs:
          pkgver="${version//-/_}"
          tray="target/${{ matrix.gnu_target }}/release/tsunagi-tray"
          bash dist/deb/build-deb.sh \
-            "target/${{ matrix.target }}/release/tsunagi" \
+            "target/${{ matrix.target }}/release/tsng" \
            "${{ matrix.deb_arch }}" "$version" \
            "tsunagi-gui_${version}_${{ matrix.deb_arch }}.deb" "$tray"
          bash dist/arch/build-pkg.sh \
-            "target/${{ matrix.target }}/release/tsunagi" \
+            "target/${{ matrix.target }}/release/tsng" \
            "${{ matrix.pkg_arch }}" "$version" \
            "tsunagi-gui-${pkgver}-1-${{ matrix.pkg_arch }}.pkg.tar.zst" "$tray"

@@ -237,6 +274,7 @@ jobs:
            ${{ matrix.asset }}-*.*
            *.deb
            *.pkg.tar.zst
+            tsunagi-setup-*.exe
          if-no-files-found: error

  publish:
@@ -308,5 +346,5 @@ jobs:
              cat up.json >&2 || true
              rc=1
            fi
-          done < <(find artifacts -type f \( -name '*.tar.gz' -o -name '*.zip' -o -name '*.deb' -o -name '*.pkg.tar.zst' \) -print0)
+          done < <(find artifacts -type f \( -name '*.tar.gz' -o -name '*.zip' -o -name '*.deb' -o -name '*.pkg.tar.zst' -o -name 'tsunagi-setup-*.exe' \) -print0)
          exit "$rc"
@@ -47,6 +47,16 @@ jobs:
            deb: true
            deb_arch: arm64
            pkg_arch: aarch64
+          # 32-bit ARM with hardware float (ARMv7, `v7l`): single-board and edge
+          # devices. Statically linked like the others.
+          - os: ubuntu-latest
+            target: armv7-unknown-linux-musleabihf
+            asset: tsunagi-linux-armv7
+            archive: tar.gz
+            zig: true
+            deb: true
+            deb_arch: armhf
+            pkg_arch: armv7h
          - os: macos-latest
            target: aarch64-apple-darwin
            asset: tsunagi-macos-aarch64
@@ -100,9 +110,9 @@ jobs:
            # one lint to keep the musl build log clean. A real link error still
            # fails the build.
            export RUSTFLAGS="${RUSTFLAGS:-} -A linker_messages"
-            cargo zigbuild --release --locked --target "${{ matrix.target }}" --bin tsunagi
+            cargo zigbuild --release --locked --target "${{ matrix.target }}" --bin tsng
          else
-            cargo build --release --locked --target "${{ matrix.target }}" --bin tsunagi
+            cargo build --release --locked --target "${{ matrix.target }}" --bin tsng
          fi

      # The tray GUI. On Linux it is built against glibc (an old baseline for
@@ -138,8 +148,8 @@ jobs:
          stage="dist/pkg/${{ matrix.asset }}"
          mkdir -p "$stage"

-          bin="tsunagi"
-          [[ "${{ runner.os }}" == "Windows" ]] && bin="tsunagi.exe"
+          bin="tsng"
+          [[ "${{ runner.os }}" == "Windows" ]] && bin="tsng.exe"
          cp "target/${{ matrix.target }}/release/${bin}" "$stage/"

          # The tray GUI alongside it, where it was built (Linux: x86_64 only).
@@ -165,6 +175,10 @@ jobs:
            macOS)
              cp dist/macos/cy.hexor.tsunagi.plist "$stage/"
              cp dist/macos/README.md "$stage/INSTALL.md"
+              # The tray as an application bundle, for the Homebrew cask.
+              bash dist/macos/build-app.sh \
+                "target/${{ matrix.target }}/release/tsunagi-tray" \
+                "$version" "$stage/Tsunagi.app"
              ;;
            Windows)
              cp dist/windows/README.md "$stage/INSTALL.md"
@@ -178,6 +192,29 @@ jobs:
            tar -C dist/pkg -czf "${archive}" "${{ matrix.asset }}"
          fi

+      # The Windows installer: the agent as a service, Wintun, the tray and the
+      # PATH entry in one setup program. Wintun is the signed library from
+      # wintun.net, pinned by hash so a changed download fails the build.
+      - name: Build the Windows installer
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $version = $env:GITHUB_REF_NAME.TrimStart('v')
+          Invoke-WebRequest -Uri https://www.wintun.net/builds/wintun-0.14.1.zip -OutFile wintun.zip
+          $hash = (Get-FileHash wintun.zip -Algorithm SHA256).Hash
+          if ($hash -ne '07C256185D6EE3652E09FA55C0B673E2624B565E02C4B9091C79CA7D2F24EF51') {
+            throw "wintun.zip has an unexpected hash: $hash"
+          }
+          Expand-Archive wintun.zip -DestinationPath wintun-dl
+          choco install innosetup -y --no-progress
+          $iscc = Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'
+          $stage = Join-Path $PWD 'dist/pkg/${{ matrix.asset }}'
+          & $iscc "/DAppVersion=$version" "/DSourceDir=$stage" `
+            "/DWintunDir=$(Join-Path $PWD 'wintun-dl/wintun/bin/amd64')" `
+            "/O$PWD" dist/windows/tsunagi.iss
+          if ($LASTEXITCODE -ne 0) { throw "ISCC failed with $LASTEXITCODE" }
+
      # A dependency-free .deb for the x86_64 and aarch64 Linux builds: it drops
      # the static binary, the systemd service and the polkit rule. Built with
      # dpkg-deb (present on the runner); see dist/deb/build-deb.sh.
@@ -188,7 +225,7 @@ jobs:
          set -euo pipefail
          version="${GITHUB_REF_NAME#v}"
          bash dist/deb/build-deb.sh \
-            "target/${{ matrix.target }}/release/tsunagi" \
+            "target/${{ matrix.target }}/release/tsng" \
            "${{ matrix.deb_arch }}" \
            "$version" \
            "tsunagi_${version}_${{ matrix.deb_arch }}.deb"
@@ -204,7 +241,7 @@ jobs:
          version="${GITHUB_REF_NAME#v}"
          pkgver="${version//-/_}"
          bash dist/arch/build-pkg.sh \
-            "target/${{ matrix.target }}/release/tsunagi" \
+            "target/${{ matrix.target }}/release/tsng" \
            "${{ matrix.pkg_arch }}" \
            "$version" \
            "tsunagi-${pkgver}-1-${{ matrix.pkg_arch }}.pkg.tar.zst"
@@ -220,11 +257,11 @@ jobs:
          pkgver="${version//-/_}"
          tray="target/${{ matrix.gnu_target }}/release/tsunagi-tray"
          bash dist/deb/build-deb.sh \
-            "target/${{ matrix.target }}/release/tsunagi" \
+            "target/${{ matrix.target }}/release/tsng" \
            "${{ matrix.deb_arch }}" "$version" \
            "tsunagi-gui_${version}_${{ matrix.deb_arch }}.deb" "$tray"
          bash dist/arch/build-pkg.sh \
-            "target/${{ matrix.target }}/release/tsunagi" \
+            "target/${{ matrix.target }}/release/tsng" \
            "${{ matrix.pkg_arch }}" "$version" \
            "tsunagi-gui-${pkgver}-1-${{ matrix.pkg_arch }}.pkg.tar.zst" "$tray"

@@ -236,6 +273,7 @@ jobs:
            ${{ matrix.asset }}-*.*
            *.deb
            *.pkg.tar.zst
+            tsunagi-setup-*.exe
          if-no-files-found: error

  publish:
@@ -264,7 +302,7 @@ jobs:

          # download-artifact nests each artifact under its own directory, so
          # the archives are artifacts/<asset>/<file>.
-          mapfile -t files < <(find artifacts -type f \( -name '*.tar.gz' -o -name '*.zip' -o -name '*.deb' -o -name '*.pkg.tar.zst' \))
+          mapfile -t files < <(find artifacts -type f \( -name '*.tar.gz' -o -name '*.zip' -o -name '*.deb' -o -name '*.pkg.tar.zst' -o -name 'tsunagi-setup-*.exe' \))
          printf 'asset: %s\n' "${files[@]}"

          prerelease=()
@@ -30,7 +30,7 @@ scripts when improving the interactive workflow.
 Keep these separate. Crossing them is the main thing to review for.

 - **Control plane vs data plane.** The separation is **logical, not physical**.
-  The control protocol in `crates/tsunagi/src/proto/` knows nothing about
+  The control protocol in `crates/tsunagi-core/src/proto/` knows nothing about
  packets, and a protocol crate knows nothing about the control protocol;
  either can be replaced on its own. Both may ride on iroh — refusing to
  would throw away iroh's NAT traversal and force the data plane to
@@ -70,9 +70,9 @@ Keep these separate. Crossing them is the main thing to review for.
  ownership checks or add broadcast flooding to encrypted transit.
 - **Plugins never learn reachability.** An `IpPlugin` is handed a `PacketLink`
  per peer and moves datagrams over it. Addresses, hole punching and relays
-  belong to `crates/tsunagi/src/dataplane/transport/`. A plugin announcement says *who*, never
+  belong to `crates/tsunagi-core/src/dataplane/transport/`. A plugin announcement says *who*, never
  *where*.
- **The core never parses a plugin payload.** See `crates/tsunagi/src/dataplane/mod.rs`. Only
+- **The core never parses a plugin payload.** See `crates/tsunagi-core/src/dataplane/mod.rs`. Only
  `crates/tsunagi-wg-quic/src/announcement.rs` interprets `wg-quic` payloads, and
  only after bounding every field. A data plane failure must never stop the
  control plane.
@@ -81,7 +81,7 @@ Keep these separate. Crossing them is the main thing to review for.
  inbound packets are dropped unless their source is the address derived for
  the peer that sent them. Never trust an address a peer announces.
 - **Signed state is the only durable agreement.** A fact that must survive a
-  participant being away goes in `crates/tsunagi/src/state/` as a record signed by its
+  participant being away goes in `crates/tsunagi-core/src/state/` as a record signed by its
  author, never in a session. Merging is deterministic, an older version never
  rolls back a newer one, and absence from a snapshot is not deletion. Never
  add a vote or a quorum: a majority is not a trust root here, and it would
@@ -115,7 +115,7 @@ Keep these separate. Crossing them is the main thing to review for.
   normal path *and* the important failures. See [docs/testing.md](docs/testing.md).
   Do not add tests for getters or to move a coverage number.
 2. **Never change `IDENTITY_SCHEME`, the derivation labels, or the transcript
-   encoding** in `crates/tsunagi/src/identity/network.rs` and `crates/tsunagi/src/proto/handshake.rs` without
+   encoding** in `crates/tsunagi-core/src/identity/network.rs` and `crates/tsunagi-core/src/proto/handshake.rs` without
   treating it as an incompatible protocol change. Bumping the crate version or
   the control protocol version must not change an existing `NetworkId`.
 3. **Secrets never leak.** Not into logs, not into `Debug`, not into status
@@ -126,7 +126,7 @@ Keep these separate. Crossing them is the main thing to review for.
   the library; tests opt out explicitly at the top of each file.
 5. **Bounds before allocation.** Frame lengths are checked against
   `Limits::max_frame_len` before a buffer is allocated. Every string, list and
-   queue has a limit in `crates/tsunagi/src/config.rs`.
+   queue has a limit in `crates/tsunagi-core/src/config.rs`.
 6. **Failure is contained.** A bad signature, wrong secret, malformed packet or
   unknown version rejects one message or one session. It never stops another
   network and never stops the agent. There is no irreversible global error
@@ -150,18 +150,18 @@ Keep these separate. Crossing them is the main thing to review for.

 | path                | responsibility |
 |---------------------|----------------|
-| `crates/tsunagi/src/identity/`     | device identity; deterministic network space identity and derived keys |
-| `crates/tsunagi/src/storage/`      | `state.sqlite`, `cache.sqlite`, directory ownership lock |
-| `crates/tsunagi/src/discovery.rs`  | candidate sources; test and static backends |
-| `crates/tsunagi/src/proto/`        | framing, message formats, membership handshake |
-| `crates/tsunagi/src/net.rs`        | iroh endpoint adapter and observability snapshots |
-| `crates/tsunagi/src/agent/`        | agent lifecycle, per-network runtimes, sessions, events, status |
-| `crates/tsunagi/src/state/`        | signed records that outlive a session, their merge rules and address allocation |
-| `crates/tsunagi/src/overlay/`   | the one interface an agent owns: provisioning, the TUN, routing, source checks, broadcast host rules |
-| `crates/tsunagi/src/dataplane/` | the protocol contract and the authenticated packet transport |
-| `crates/tsunagi/src/dns/`       | the DNS view of a network: zone, server, resolver publication |
+| `crates/tsunagi-core/src/identity/`     | device identity; deterministic network space identity and derived keys |
+| `crates/tsunagi-core/src/storage/`      | `state.sqlite`, `cache.sqlite`, directory ownership lock |
+| `crates/tsunagi-core/src/discovery.rs`  | candidate sources; test and static backends |
+| `crates/tsunagi-core/src/proto/`        | framing, message formats, membership handshake |
+| `crates/tsunagi-core/src/net.rs`        | iroh endpoint adapter and observability snapshots |
+| `crates/tsunagi-core/src/agent/`        | agent lifecycle, per-network runtimes, sessions, events, status |
+| `crates/tsunagi-core/src/state/`        | signed records that outlive a session, their merge rules and address allocation |
+| `crates/tsunagi-core/src/overlay/`   | the one interface an agent owns: provisioning, the TUN, routing, source checks, broadcast host rules |
+| `crates/tsunagi-core/src/dataplane/` | the protocol contract and the authenticated packet transport |
+| `crates/tsunagi-core/src/dns/`       | the DNS view of a network: zone, server, resolver publication |
 | `crates/tsunagi-wg-quic/`       | the `wg-quic` protocol: its keys, its announcement, its tunnels |
-| `crates/tsunagi-cli/` | the command line agent; the only place that owns a runtime, a logger and signals |
+| `crates/tsunagi/` | the command line agent, built as `tsng`; the only place that owns a runtime, a logger and signals |
 | `tests/`            | integration tests; `tests/common/` is the shared harness |

 Add abstractions only at real substitution or testing boundaries. Do not add a
@@ -6234,6 +6234,28 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 [[package]]
 name = "tsunagi"
 version = "0.1.0"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap",
+ "iroh",
+ "netwatch",
+ "nix 0.31.3",
+ "simple-dns",
+ "tempfile",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+ "tsunagi-core",
+ "tsunagi-tcp-tls",
+ "tsunagi-wg-quic",
+ "tsunagi-wireguard",
+ "windows-service",
+]
+
+[[package]]
+name = "tsunagi-core"
+version = "0.1.0"
 dependencies = [
 "arc-swap",
 "bytes",
@@ -6266,34 +6288,13 @@ dependencies = [
 "tokio-stream",
 "tracing",
 "tracing-subscriber",
- "tsunagi",
+ "tsunagi-core",
 "tun",
 "windows-sys 0.61.2",
 "zbus",
 "zeroize",
 ]

-[[package]]
-name = "tsunagi-cli"
-version = "0.1.0"
-dependencies = [
- "anstream",
- "anstyle",
- "clap",
- "iroh",
- "netwatch",
- "nix 0.31.3",
- "simple-dns",
- "tempfile",
- "tokio",
- "tracing",
- "tracing-subscriber",
- "tsunagi",
- "tsunagi-tcp-tls",
- "tsunagi-wg-quic",
- "tsunagi-wireguard",
-]
-
 [[package]]
 name = "tsunagi-tcp-tls"
 version = "0.1.0"
@@ -6318,7 +6319,7 @@ dependencies = [
 "tokio-rustls",
 "tracing",
 "tracing-subscriber",
- "tsunagi",
+ "tsunagi-core",
 "x25519-dalek",
 "zeroize",
 ]
@@ -6334,7 +6335,7 @@ dependencies = [
 "tracing",
 "tracing-subscriber",
 "tray-icon",
- "tsunagi",
+ "tsunagi-core",
 "winit",
 ]

@@ -6359,7 +6360,7 @@ dependencies = [
 "tokio",
 "tracing",
 "tracing-subscriber",
- "tsunagi",
+ "tsunagi-core",
 "zeroize",
 ]

@@ -6383,7 +6384,7 @@ dependencies = [
 "tokio",
 "tracing",
 "tracing-subscriber",
- "tsunagi",
+ "tsunagi-core",
 "zeroize",
 ]

@@ -7135,6 +7136,17 @@ dependencies = [
 "windows-link",
 ]

+[[package]]
+name = "windows-service"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "857224b3b211c6f3616921f081ee54721ee3ad2ace2fac6a6337e032f7b4dcf2"
+dependencies = [
+ "bitflags 2.13.2",
+ "widestring",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "windows-strings"
 version = "0.1.0"
@@ -36,7 +36,7 @@ A working library with **real iroh connections** and integration tests:
  overlay with deterministically derived addresses and optional IPv4, real
  tunnels carried over iroh, and address ownership enforced rather than
  believed;
- a **command line agent**, `tsunagi`, with a local control socket.
+- a **command line agent**, `tsng`, with a local control socket.

 ### What it deliberately does **not** do

@@ -71,8 +71,8 @@ On the first machine:

 ```bash
 cargo build --release
-./target/release/tsunagi status          # this device, the agent, and this host
-./target/release/tsunagi network         # the networks this device belongs to
+./target/release/tsng status          # this device, the agent, and this host
+./target/release/tsng network         # the networks this device belongs to
 ```

 Two commands do the work, and they are separate on purpose: `up` runs the
@@ -81,19 +81,19 @@ what it belongs to, at any time, while it runs.

 ```bash
 # Terminal one: the agent. It prints its endpoint id and then serves.
-./target/release/tsunagi up
+./target/release/tsng up

 # Terminal two: make a network. With no --secret it invents one and prints
 # it, along with the line to send the other machine.
-./target/release/tsunagi join --network lab
+./target/release/tsng join --network lab
 ```

 On the second machine, start its agent and join the same network with the
 secret that was printed:

 ```bash
-./target/release/tsunagi up
-./target/release/tsunagi join --network lab --secret tsn1...
+./target/release/tsng up
+./target/release/tsng join --network lab --secret tsn1...
 ```

 **Name and secret are enough for the first meeting.** Mainline DHT discovery
@@ -141,7 +141,7 @@ wg-quic: tsun0 on 10.13.37.69/24 mtu 1280, 1/1 tunnel(s) established
 From another shell on either machine:

 ```bash
-tsunagi status
+tsng status
 ```

 ```text
@@ -170,8 +170,8 @@ ping  100.65.243.53
 what they find, so `--ipv4-range` only matters for whoever starts the network:

 ```bash
-tsunagi up --ipv4-range 10.44.0.0/16
-tsunagi up --ipv4-range none   # no data plane at all
+tsng up --ipv4-range 10.44.0.0/16
+tsng up --ipv4-range none   # no data plane at all
 ```

 One agent has one interface, so two of its networks cannot both use that
@@ -193,7 +193,7 @@ assigns it to the interface itself.

 ## Levels

-The command line is split the way the design is. A bare `tsunagi up` needs
+The command line is split the way the design is. A bare `tsng up` needs
 only a network name and a secret; everything else sits under the level it
 belongs to, which `--help` shows as two sections:

@@ -204,7 +204,7 @@ belongs to, which `--help` shows as two sections:
  their own settings (`-o key=value`, or `-o protocol:key=value`).

 ```bash
-tsunagi protocols          # what this build can carry packets with
+tsng protocols          # what this build can carry packets with
 ```

 ```text
@@ -223,7 +223,7 @@ A pair of peers uses a protocol they both have **at the same wire version**.
 That is not the software version: two peers on different builds carry traffic
 for each other for as long as the bytes between them have not changed. A peer
 with nothing in common keeps its control plane — messages and signed state
-still flow — and simply has no data plane, which `tsunagi status` shows as a
+still flow — and simply has no data plane, which `tsng status` shows as a
 session with no agreed protocol.

 ## Names
@@ -233,12 +233,12 @@ each named after the network, so members can be reached by name instead of
 by address:

 ```bash
-tsunagi up               # DNS is already enabled
+tsng up               # DNS is already enabled
 dig @127.0.0.1 -p 5354 music.lab
 ```

-An explicit choice is remembered across restarts. `--no-dns` or `tsunagi dns off`
-disables it; `--dns` or `tsunagi dns on` enables it again. Existing saved opt-outs
+An explicit choice is remembered across restarts. `--no-dns` or `tsng dns off`
+disables it; `--dns` or `tsng dns on` enables it again. Existing saved opt-outs
 remain respected. The `dns on` and `dns off` commands also take effect immediately
 on a running agent. `--dns` and `--no-dns` cannot be combined.

@@ -299,7 +299,7 @@ polkit.addRule(function(action, subject) {
 RULE
 ```

-**Without it the server still runs** — `tsunagi status` prints where it is
+**Without it the server still runs** — `tsng status` prints where it is
 listening and the exact `dig` line — so the automatic part is missing, not
 the feature. The refusal is said once rather than on every pass, and retried
 slowly, because nothing but a person will change it.
@@ -318,7 +318,7 @@ remote peer could influence.
 That needs `CAP_NET_ADMIN`, granted once:

 ```bash
-sudo setcap cap_net_admin+p /usr/local/bin/tsunagi
+sudo setcap cap_net_admin+p /usr/local/bin/tsng
 ```

 `+p` rather than `+ep`: the capability is then *permitted* but not
@@ -328,7 +328,7 @@ allocation changes. Everything else, including every byte from the network,
 is handled with it lowered. `+ep` works too; the agent lowers it on the way
 in.

-`tsunagi status` says which of these applies on the host it runs on, along
+`tsng status` says which of these applies on the host it runs on, along
 with what the agent is doing. It grades each finding: **ok** for what works,
 **warn** for what the agent runs without and you can fix from the line it
 prints, **FAIL** for what it cannot work around. The words carry the grade as
@@ -353,28 +353,28 @@ Every item takes the same shape, so there is nothing to remember: name it to
 see it, name it with a value to change it.

 ```
-tsunagi id                      everything about this device
-tsunagi id hostname             the name it answers to
-tsunagi id hostname mango       change it
-tsunagi id key                  the key it signs with
-tsunagi id key rotate           replace that key
+tsng id                      everything about this device
+tsng id hostname             the name it answers to
+tsng id hostname mango       change it
+tsng id key                  the key it signs with
+tsng id key rotate           replace that key

-tsunagi network                 the networks this device belongs to
-tsunagi network join -n lab -s tsn1…   join one; adds it to a running agent
-tsunagi network join -n lab     resume one this device has, or make it on the spot
-tsunagi network stop lab        stop serving it, keeping everything
-tsunagi network start lab       serve it again, from where it left off
-tsunagi network leave lab       give up the address and name, then forget it
-tsunagi network secret          the secret of each joined network
-tsunagi network secret lab      just that one, for copying
-tsunagi network secret generate a fresh secret for a network that does not exist yet
+tsng network                 the networks this device belongs to
+tsng network join -n lab -s tsn1…   join one; adds it to a running agent
+tsng network join -n lab     resume one this device has, or make it on the spot
+tsng network stop lab        stop serving it, keeping everything
+tsng network start lab       serve it again, from where it left off
+tsng network leave lab       give up the address and name, then forget it
+tsng network secret          the secret of each joined network
+tsng network secret lab      just that one, for copying
+tsng network secret generate a fresh secret for a network that does not exist yet

-tsunagi dns                     whether the local resolver is serving, and what
-tsunagi dns on                  start it, now and after every restart
-tsunagi dns off                 stop it, now and after every restart
+tsng dns                     whether the local resolver is serving, and what
+tsng dns on                  start it, now and after every restart
+tsng dns off                 stop it, now and after every restart
 ```

-**A network without a secret makes one.** `tsunagi join --network lab`
+**A network without a secret makes one.** `tsng join --network lab`
 resolves a bare name in the obvious way: if this device is already in
 exactly one network called `lab`, that one — so the name alone resumes what
 you have; if it is in none, a fresh random secret, printed in full with the
@@ -386,11 +386,11 @@ joined `lab` (k2on43wadbi5x267vp6z3ogkm7nbjedfdoxyauxhtxhwqrprylba)

 Run this on the other machine:

-  tsunagi join --network lab --secret tsn1u7c…
+  tsng join --network lab --secret tsn1u7c…

 Its agent has to be running. If it is not:

-  tsunagi up --peer 91e83a6e2b7a…
+  tsng up --peer 91e83a6e2b7a…
 ```

 Two networks of one name is a thing that happens — a mistyped secret makes
@@ -410,11 +410,11 @@ Asking for it is deliberate, because these reports get pasted into chats.

 **`up` takes no network at all** if you would rather decide later: it
 brings up the agent and whatever it is already configured for, and waits.
-That is the shape of a daemon in one terminal and `tsunagi network join`
+That is the shape of a daemon in one terminal and `tsng network join`
 in another.

 `network join` is also the answer to a question `up` cannot: a state
-directory belongs to one live agent, so a second `tsunagi up` cannot add a
+directory belongs to one live agent, so a second `tsng up` cannot add a
 network to the one already running. This adds it over the control socket and
 it starts at once. With no agent running it is written to the configuration
 and starts with the next `up`.
@@ -477,11 +477,11 @@ The original IP packet, including its DF bit, is preserved. See
 |---|---|---|
 | `setcap cap_net_admin+p` | ordinary user, one capability | recommended: nothing to prepare, nothing left behind. Lost on every rebuild or copy of the binary. |
 | systemd service | `User=`, `AmbientCapabilities=CAP_NET_ADMIN` | the same, for an installed service |
-| `sudo tsunagi up` | root | everything works, nothing is isolated |
+| `sudo tsng up` | root | everything works, nothing is isolated |
 | macOS root LaunchDaemon | root | the native macOS deployment; see below |
 | `--no-tun` | ordinary user, no capabilities | tunnels run and handshake, traffic never reaches the OS |

-On Windows, put `wintun.dll` beside the executable and start `tsunagi up`
+On Windows, put `wintun.dll` beside the executable and start `tsng up`
 from PowerShell or Command Prompt opened with **Run as administrator**.
 Run commands controlling that agent (`join`, `status`, `dns`, `network`)
 as the same Windows user with the same elevation. If Windows denies access
@@ -498,7 +498,7 @@ grant like Linux, and a `utun` plus `/etc/resolver` are root-only. The kernel
 assigns the interface its `utunN` name, so the name derived from the network id
 is only a request and the real one is adopted once the interface is up.

-Run it as root — `sudo tsunagi up` for a quick start, or install it as a root
+Run it as root — `sudo tsng up` for a quick start, or install it as a root
 **LaunchDaemon** for the native always-on deployment. As a daemon the agent runs
 unprivileged commands (`join`, `status`, `dns`, `network`) over its control
 socket like any other platform; the socket lives at `/var/run/tsunagi/agent.sock`
@@ -613,10 +613,10 @@ paths. It supports `255.255.255.255` and the overlay subnet's broadcast address;
 received broadcasts never trigger another fanout.

 ```sh
-tsunagi join -n games --no-broadcast
-tsunagi join -n games --broadcast
-tsunagi network broadcast games off
-tsunagi network broadcast games on
+tsng join -n games --no-broadcast
+tsng join -n games --broadcast
+tsng network broadcast games off
+tsng network broadcast games on
 ```

 The choice persists across restarts and a plain `join`. It can be changed while
@@ -681,8 +681,8 @@ directories by default; `--state-dir` and `--cache-dir` override them.
 One state directory belongs to one live agent, enforced with a real OS file
 lock rather than an existence check. That directory *is* the identity: one
 agent, one device key, one interface, and as many networks as you like on it
-— `tsunagi network join` adds them to the agent that is already running,
-which is why a second `tsunagi up` on the same directory is refused rather
+— `tsng network join` adds them to the agent that is already running,
+which is why a second `tsng up` on the same directory is refused rather
 than made to work. A second agent on the same host is a second identity, and
 needs everything of its own: its own state and cache directories, its own
 interface name and its own overlay range. The library owns no globals, so
@@ -693,9 +693,9 @@ several of them run side by side in one process as readily as in one host.
 Membership outlives a session, so it also has to be possible to end it.

 ```bash
-tsunagi network                     # what this device belongs to
-tsunagi network leave lab           # give up the address and the name, then forget it
-tsunagi wipe --yes                  # remove everything and be a stranger again
+tsng network                     # what this device belongs to
+tsng network leave lab           # give up the address and the name, then forget it
+tsng wipe --yes                  # remove everything and be a stranger again
 ```

 **Stopping is not leaving.** `stop` closes this network's sessions, takes
@@ -1,47 +0,0 @@
-[package]
-name = "tsunagi-cli"
-version = "0.1.0"
-description = "The tsunagi command line agent."
-edition.workspace = true
-rust-version.workspace = true
-license.workspace = true
-repository.workspace = true
-
-[[bin]]
-name = "tsunagi"
-path = "src/main.rs"
-# The binary and the library share a name, which `cargo doc` cannot map to
-# two directories. The command line is documented by `--help`, not rustdoc,
-# so the library keeps the name and this opts out.
-doc = false
-
-[dependencies]
-tsunagi = { path = "../tsunagi", version = "0.1.0", features = ["tun-device", "dns-publish"] }
-tsunagi-wireguard = { path = "../tsunagi-wireguard", version = "0.1.0" }
-tsunagi-wg-quic = { path = "../tsunagi-wg-quic", version = "0.1.0" }
-tsunagi-tcp-tls = { path = "../tsunagi-tcp-tls", version = "0.1.0" }
-iroh.workspace = true
-tokio = { version = "1.53", features = ["rt", "rt-multi-thread", "sync", "time", "macros", "signal"] }
-tracing.workspace = true
-tracing-subscriber.workspace = true
-clap = { version = "4.5", features = ["derive", "env"] }
-# Already in the tree through clap. `anstream` strips the escapes when stdout
-# is not a terminal and turns on virtual terminal processing on Windows, so
-# colour is never written where it would show up as rubbish.
-anstream = "1.0"
-anstyle = "1.0"
-# Local interface addresses, for the diagnostics in `status`.
-netwatch = "0.19.3"
-
-# Resolving a group name to its gid for `up --control-group`, through a safe
-# wrapper (no unsafe of our own). Unix only.
-[target.'cfg(unix)'.dependencies]
-nix = { version = "0.31", features = ["user"] }
-
-[dev-dependencies]
-tokio = { version = "1.53", features = ["rt", "rt-multi-thread", "sync", "time", "macros", "process"] }
-tempfile.workspace = true
-simple-dns = "0.12"
-
-[lints]
-workspace = true
@@ -1,56 +0,0 @@
-//! What the command line says about this device, against a running agent.
-//!
-//! These drive the real binary, which is why they live beside it rather
-//! than with the library's own tests: the library cannot depend on a binary
-//! built from a crate that depends on it.
-
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
-use tempfile::TempDir;
-use tsunagi::Agent;
-use tsunagi::config::{AgentConfig, StoragePaths, TransportPolicy};
-
-/// Asking who this device is must not need the directory lock.
-///
-/// The lock belongs to the one agent allowed to *write* the state. `id` only
-/// reads, so making it take the lock would mean the question could never be
-/// answered while an agent was running — which is exactly when you want to
-/// ask it.
-#[tokio::test]
-async fn identity_can_be_read_while_an_agent_holds_the_directory() {
-    let dir = TempDir::new().unwrap();
-
-    // Hold the directory the way a running agent does.
-    let agent = Agent::spawn(
-        AgentConfig::new(StoragePaths::under(dir.path()))
-            .with_transport(TransportPolicy::LocalOnly)
-            .with_loopback_bind(),
-    )
-    .await
-    .unwrap();
-    let expected = agent.endpoint_id().to_string();
-
-    let output = tokio::process::Command::new(env!("CARGO_BIN_EXE_tsunagi"))
-        .arg("id")
-        // The same layout `StoragePaths::under` gives the agent above.
-        .arg("--state-dir")
-        .arg(dir.path().join("state"))
-        .arg("--cache-dir")
-        .arg(dir.path().join("cache"))
-        .output()
-        .await
-        .unwrap();
-
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    let stderr = String::from_utf8_lossy(&output.stderr);
-    assert!(
-        output.status.success(),
-        "`id` failed while an agent was running:\n{stderr}"
-    );
-    assert!(
-        stdout.contains(&expected),
-        "expected {expected} in:\n{stdout}"
-    );
-
-    agent.shutdown().await;
-}
@@ -0,0 +1,113 @@
+[package]
+name = "tsunagi-core"
+version = "0.1.0"
+description = "Small private mesh networks: persistent agent identity, deterministic network spaces, an iroh control plane, signed state and a local DNS view."
+readme = "../../README.md"
+keywords = ["mesh", "p2p", "iroh", "networking"]
+categories = ["network-programming"]
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[lib]
+name = "tsunagi"
+
+[features]
+default = []
+# A real TUN device, so a plugin can carry actual IP traffic. On Linux it
+# needs CAP_NET_ADMIN; on Windows the process must run elevated and
+# `wintun.dll` must be reachable. Without either the in-memory device serves
+# tests. The platform-specific dependencies are declared per target, so
+# enabling this only pulls what the target it is built for actually uses.
+tun-device = [
+    "dep:tun",
+    "dep:rtnetlink",
+    "dep:caps",
+    "dep:futures-util",
+]
+# Telling the operating system where to send its DNS questions. systemd-resolved
+# on Linux, the Name Resolution Policy Table on Windows; the zone and the
+# server work without it either way.
+dns-publish = ["dep:zbus"]
+# The test harness in `testing`, for this crate's own tests and for a
+# protocol crate's. Not on by default: it is only of use to a test.
+testing = ["dep:tempfile", "dep:tracing-subscriber"]
+
+[dependencies]
+arc-swap = "1.9"
+iroh.workspace = true
+# `net` for the local control interface: a Unix socket on Unix, a named pipe
+# on Windows. Both live behind the same `net` feature.
+tokio = { workspace = true, features = ["net"] }
+tokio-stream = "0.1"
+serde.workspace = true
+postcard.workspace = true
+bytes.workspace = true
+thiserror.workspace = true
+tracing.workspace = true
+hex.workspace = true
+data-encoding.workspace = true
+rusqlite = { version = "0.40", features = ["bundled"] }
+hkdf = "0.13"
+hmac = "0.13"
+sha2 = "0.11"
+subtle = "2.6"
+zeroize = { version = "1.9", features = ["derive"] }
+rand = "0.10"
+# Already in the tree through iroh. A packet codec, not a DNS server: the
+# zone logic is ours and a full server framework would be a large dependency
+# for answering A records from memory.
+simple-dns = "0.12"
+# The IANA top-level domain list, compiled in: one function, no
+# dependencies, no network. Used only to warn that a zone name shadows a
+# real public domain, never to refuse one.
+tld = "2.40"
+fs4 = { version = "1.1", features = ["sync"] }
+directories = "6.0"
+# The real system hostname, without a libc call of our own: this crate is
+# forbidden `unsafe` and will not make one.
+gethostname = "1.1"
+netwatch = "0.19.3"
+netdev = "0.46"
+mainline = "8.0"
+futures-lite = "2.6"
+tun = { version = "0.8", features = ["async"], optional = true }
+# Only for the `testing` harness, which a protocol crate's tests use too.
+tempfile = { version = "3.24", optional = true }
+tracing-subscriber = { version = "0.3", features = ["env-filter"], optional = true }
+
+# Linux-only interface provisioning. `rtnetlink` configures the interface in
+# process, so no `ip` invocation is ever needed; `caps` keeps CAP_NET_ADMIN
+# out of the effective set except during the moments it is used.
+[target.'cfg(target_os = "linux")'.dependencies]
+rtnetlink = { version = "0.23", optional = true }
+# Pure Rust D-Bus, no libdbus to link against. `tokio` rather than the
+# default reactor, because the agent brings its own.
+zbus = { version = "5.19", default-features = false, features = ["tokio"], optional = true }
+caps = { version = "0.5", optional = true }
+futures-util = { version = "0.3", default-features = false, optional = true }
+
+# Windows-only interface provisioning. The Wintun adapter itself is created
+# and driven through the `tun` dependency, whose safe wrapper is the only way
+# in — loading `wintun.dll` is an `unsafe` call this crate forbids. `netdev`
+# (already in the tree through `netwatch`) reads the interface table through a
+# safe wrapper, which is how the provisioner observes an adapter by name
+# before deciding what to change. Creating an adapter needs the process to be
+# elevated and `wintun.dll` to be reachable at run time.
+[target.'cfg(target_os = "windows")'.dependencies]
+windows-sys = { version = "0.61", features = [
+    "Win32_Security",
+    "Win32_Security_Authorization",
+    "Win32_Foundation",
+] }
+
+[dev-dependencies]
+# Its own tests use the harness it publishes.
+tsunagi-core = { path = ".", features = ["testing"] }
+tokio = { version = "1.53", features = ["rt", "rt-multi-thread", "sync", "time", "macros", "process", "test-util"] }
+tempfile.workspace = true
+tracing-subscriber.workspace = true
+
+[lints]
+workspace = true
@@ -582,7 +582,7 @@ impl Agent {
                        "`{name}` is already configured with a different secret, as {}. \
                         Joining with this one adds a second network under the same name; \
                         they share nothing. Check the secret, or use \
-                         `tsunagi network secret` \
+                         `tsng network secret` \
                         to see which is which.",
                        other.network_id
                    );
@@ -800,6 +800,11 @@ impl Agent {
        // itself stays, because the agent owns it and other networks may
        // still be using it.
        self.inner.routes.remove_network(network_id);
+        if let Some(interface) = self.inner.interface.get() {
+            interface
+                .set_underlay(network_id, Vec::new(), Vec::new())
+                .await;
+        }
        if let Some(interface) = self.inner.interface.get()
            && let Err(err) = interface.sync_addresses().await
        {
@@ -712,6 +712,34 @@ impl Runtime {
        self.start_dials();
        // Last, so it carries what this round learned.
        self.introduce_peers();
+        self.refresh_underlay().await;
+    }
+
+    /// Hands the interface the underlay destinations this network depends
+    /// on: the verified direct IPv4 paths of every control connection, and
+    /// the relays in use. Only hosts that cannot exempt the agent from an
+    /// exit node's default route read it.
+    async fn refresh_underlay(&self) {
+        let Some(interface) = self.params.interface.clone() else {
+            return;
+        };
+        let mut addresses = Vec::new();
+        let mut hosts = Vec::new();
+        for session in self.sessions.values() {
+            for path in snapshot_connection(&session.conn).paths {
+                match path.remote {
+                    PathAddr::Ip(std::net::SocketAddr::V4(socket)) => addresses.push(*socket.ip()),
+                    PathAddr::Relay(url) => hosts.extend(relay_host(&url)),
+                    _ => {}
+                }
+            }
+        }
+        for url in self.params.adapter.snapshot().relay_urls {
+            hosts.extend(relay_host(&url));
+        }
+        interface
+            .set_underlay(self.network_id, addresses, hosts)
+            .await;
    }

    fn add_candidate(&mut self, candidate: Candidate) {
@@ -1218,7 +1246,7 @@ impl Runtime {
                network = %self.network_id,
                exit_node = %via.fmt_short(),
                "the exit node is gone or no longer offers to be one; internet traffic stays \
-                 routed through it and is dropped until it returns or `tsunagi exit-node off`"
+                 routed through it and is dropped until it returns or `tsng exit-node off`"
            );
        }
    }
@@ -2448,3 +2476,48 @@ mod tests {
        assert_eq!(chosen_restored.copied(), Some("wg"));
    }
 }
+
+/// The host name of a relay URL such as `https://relay.example:443/`.
+fn relay_host(url: &str) -> Option<String> {
+    let rest = url.split_once("://").map_or(url, |(_, rest)| rest);
+    let authority = rest.split(['/', '?', '#']).next()?;
+    let host = authority.rsplit_once('@').map_or(authority, |(_, h)| h);
+    let host = if host.starts_with('[') {
+        host.split_once(']')?.0.trim_start_matches('[')
+    } else {
+        host.split(':').next()?
+    };
+    (!host.is_empty()
+        && host.len() <= 253
+        && host
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || c == '.' || c == '-' || c == ':'))
+    .then(|| host.to_ascii_lowercase())
+}
+
+#[cfg(test)]
+mod relay_host_tests {
+    use super::relay_host;
+
+    #[test]
+    fn the_host_is_taken_out_of_a_relay_url() {
+        assert_eq!(
+            relay_host("https://relay.example.com./").as_deref(),
+            Some("relay.example.com.")
+        );
+        assert_eq!(
+            relay_host("https://Euw1-1.relay.iroh.network:443/x").as_deref(),
+            Some("euw1-1.relay.iroh.network")
+        );
+        assert_eq!(
+            relay_host("http://192.0.2.7:3340").as_deref(),
+            Some("192.0.2.7")
+        );
+        assert_eq!(
+            relay_host("https://[2001:db8::1]:443/").as_deref(),
+            Some("2001:db8::1")
+        );
+        assert_eq!(relay_host("https:///").as_deref(), None);
+        assert_eq!(relay_host("https://bad host/").as_deref(), None);
+    }
+}
@@ -214,7 +214,7 @@ pub enum Request {
    ///
    /// Asked of the running agent because that is the only way to add a
    /// network to an agent that is already up: the state directory belongs
-    /// to one live agent, so a second `tsunagi up` cannot.
+    /// to one live agent, so a second `tsng up` cannot.
    Join {
        /// The network name.
        name: String,
@@ -764,7 +764,7 @@ where
 ///
 /// A local answer comes from memory, so anything this slow means the agent is
 /// wedged rather than busy. Saying so beats waiting: unbounded, one wedged
-/// runtime leaves `tsunagi status` hanging with nothing on screen and no way
+/// runtime leaves `tsng status` hanging with nothing on screen and no way
 /// out but Ctrl-C.
 pub const EXCHANGE_TIMEOUT: Duration = Duration::from_secs(5);

@@ -210,7 +210,7 @@ impl Drop for ControlSocket {
 /// Accepts one client at a time, keeping a fresh instance ready for the next.
 ///
 /// A named pipe server instance serves a single client, so a new instance is
-/// created as soon as one is taken — otherwise a second `tsunagi status` while
+/// created as soon as one is taken — otherwise a second `tsng status` while
 /// the first is mid-flight would find nothing listening.
 async fn serve(
    name: String,
@@ -294,7 +294,7 @@ pub(crate) async fn connect(path: &Path) -> Result<NamedPipeClient> {
                        format!(
                            "the agent's control pipe exists, but Windows denied access. \
                             Run this command as the same Windows user and with the same \
-                             elevation as `tsunagi up` (use an administrator terminal if \
+                             elevation as `tsng up` (use an administrator terminal if \
                             the agent is elevated). Windows error: {err}"
                        ),
                    ),
@@ -35,6 +35,17 @@ pub struct ExitHostPlan {
    pub offer: Vec<Ipv4Range>,
    /// Whether this device sends its internet traffic through a member.
    pub client: bool,
+    /// The range of every network on the interface. Only the using side
+    /// reads it, to keep this agent's own traffic *to* the overlay inside it
+    /// where the host has no per-user routing (macOS).
+    pub overlay: Vec<Ipv4Range>,
+    /// Underlay addresses this agent talks to directly and must keep reaching
+    /// outside the overlay's default route. Only filled while `client` is set
+    /// and only for hosts that report [`ExitHostRules::needs_bypass`].
+    pub bypass: Vec<std::net::Ipv4Addr>,
+    /// Host names (relay servers) that must stay reachable the same way; the
+    /// host rules resolve them.
+    pub bypass_hosts: Vec<String>,
 }

 impl ExitHostPlan {
@@ -72,6 +83,13 @@ pub trait ExitHostRules: Send + Sync + std::fmt::Debug + 'static {
    /// when nothing is there: it runs on the shutdown path, and once at
    /// startup to take away what a crashed run left.
    fn clear<'a>(&'a self, interface: &'a str) -> BoxFuture<'a, ()>;
+
+    /// Whether using an exit node on this host needs the underlay addresses
+    /// the agent talks to, because the host cannot exempt the agent's own
+    /// traffic from the default route by user id (Windows). The default is no.
+    fn needs_bypass(&self) -> bool {
+        false
+    }
 }

 /// The tag every firewall object of one offered range carries.
@@ -99,6 +117,7 @@ pub struct MockExitRules {
    calls: Arc<Mutex<Vec<String>>>,
    forwarding: Arc<Mutex<Option<bool>>>,
    failure: Arc<Mutex<Option<String>>>,
+    needs_bypass: Arc<Mutex<bool>>,
 }

 impl MockExitRules {
@@ -114,6 +133,11 @@ impl MockExitRules {
        *lock(&self.forwarding) = forwarding;
    }

+    /// Whether this host asks for the underlay addresses, like Windows.
+    pub fn set_needs_bypass(&self, needs: bool) {
+        *lock(&self.needs_bypass) = needs;
+    }
+
    /// Makes every step fail with this reason from now on.
    pub fn fail_with(&self, reason: Option<String>) {
        *lock(&self.failure) = reason;
@@ -138,6 +162,10 @@ fn lock<T>(mutex: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
 }

 impl ExitHostRules for MockExitRules {
+    fn needs_bypass(&self) -> bool {
+        *lock(&self.needs_bypass)
+    }
+
    fn apply<'a>(&'a self, plan: &'a ExitHostPlan) -> BoxFuture<'a, ExitHostReport> {
        Box::pin(async move {
            lock(&self.calls).push(format!("apply:{}", plan.interface));
@@ -204,6 +232,8 @@ mod tests {
            interface: "tsun0".into(),
            offer: vec![range()],
            client: true,
+            overlay: vec![range()],
+            ..Default::default()
        };
        let report = rules.apply(&plan).await;
        assert_eq!(report.offer[0].1, RuleOutcome::Applied);
@@ -218,6 +248,8 @@ mod tests {
                interface: "tsun0".into(),
                offer: vec![range()],
                client: false,
+                overlay: Vec::new(),
+                ..Default::default()
            })
            .await;
        assert_eq!(report.forwarding, Some(false));
@@ -66,24 +66,68 @@ pub(super) enum Ran {
 pub(super) type Run<'a> = &'a dyn Fn(&[String]) -> Ran;

 /// The match and target of the rule, without the chain or position.
-fn rule_spec(plan: &BroadcastRulesPlan) -> Vec<String> {
-    [
-        "-i",
-        plan.interface.as_str(),
-        "-p",
-        "udp",
-        "-s",
-        &plan.range.to_string(),
-        "-m",
-        "comment",
-        "--comment",
-        &plan.tag(),
-        "-j",
-        "ACCEPT",
-    ]
-    .into_iter()
-    .map(str::to_string)
-    .collect()
+///
+/// `comment` false leaves the tag off, for a kernel that has no `comment`
+/// match; the rule is then recognised by its shape, see [`tagged_deletions`].
+fn rule_spec(plan: &BroadcastRulesPlan, comment: bool) -> Vec<String> {
+    let range = plan.range.to_string();
+    let tag = plan.tag();
+    let mut words = vec!["-i", plan.interface.as_str(), "-p", "udp", "-s", &range];
+    if comment {
+        words.extend(["-m", "comment", "--comment", &tag]);
+    }
+    words.extend(["-j", "ACCEPT"]);
+    words.into_iter().map(str::to_string).collect()
+}
+
+/// Whether the kernel has the `comment` match, which a rule needs to carry
+/// its tag. Asked of iptables itself: checking a rule that does not exist
+/// fails either way, but only a missing match says so.
+pub(super) fn comment_supported(run: Run<'_>) -> bool {
+    let probe = locked(
+        [
+            "-t",
+            "filter",
+            "-C",
+            "FORWARD",
+            "-m",
+            "comment",
+            "--comment",
+            "tsunagi-probe",
+            "-j",
+            "ACCEPT",
+        ]
+        .map(str::to_string),
+    );
+    match run(&probe) {
+        Ran::Exited {
+            success: false,
+            stderr,
+            ..
+        } => !stderr.contains("No chain/target/match by that name"),
+        _ => true,
+    }
+}
+
+/// `iptables -S` words as option clauses: an option with its value, a negated
+/// one with its `!`. It prints the options in its own order, not the one a
+/// rule was written in, so rules are compared by their clauses, sorted.
+fn clauses(words: &[String]) -> Vec<String> {
+    let mut out = Vec::new();
+    let mut at = 0;
+    while at < words.len() {
+        let take = if words[at] == "!" { 3 } else { 2 };
+        let end = (at + take).min(words.len());
+        out.push(words[at..end].join(" "));
+        at = end;
+    }
+    out.sort();
+    out
+}
+
+/// Whether two rules say the same thing, whatever order they list it in.
+pub(super) fn same_rule(a: &[String], b: &[String]) -> bool {
+    clauses(a) == clauses(b)
 }

 /// Waits briefly for the xtables lock instead of failing when another tool
@@ -96,19 +140,19 @@ pub(super) fn locked(args: impl IntoIterator<Item = String>) -> Vec<String> {
        .collect()
 }

-fn check_args(plan: &BroadcastRulesPlan) -> Vec<String> {
+fn check_args(plan: &BroadcastRulesPlan, comment: bool) -> Vec<String> {
    locked(
        ["-C".to_string(), CHAIN.to_string()]
            .into_iter()
-            .chain(rule_spec(plan)),
+            .chain(rule_spec(plan, comment)),
    )
 }

-fn insert_args(plan: &BroadcastRulesPlan) -> Vec<String> {
+fn insert_args(plan: &BroadcastRulesPlan, comment: bool) -> Vec<String> {
    locked(
        ["-I".to_string(), CHAIN.to_string(), "1".to_string()]
            .into_iter()
-            .chain(rule_spec(plan)),
+            .chain(rule_spec(plan, comment)),
    )
 }

@@ -147,8 +191,28 @@ pub(super) fn split_rule_line(line: &str) -> Vec<String> {
    words
 }

+/// Whether a rule is the one this module writes for some range of the
+/// interface the tag belongs to, with no comment on it.
+fn is_uncommented_rule(tag: &str, rest: &[String]) -> bool {
+    let Some(interface) = tag.strip_prefix("tsunagi:") else {
+        return false;
+    };
+    let Some(range) = rest
+        .windows(2)
+        .find(|pair| pair[0] == "-s")
+        .map(|pair| pair[1].as_str())
+    else {
+        return false;
+    };
+    let ours: Vec<String> = ["-i", interface, "-p", "udp", "-s", range, "-j", "ACCEPT"]
+        .map(str::to_string)
+        .to_vec();
+    same_rule(&ours, rest)
+}
+
 /// The delete commands for every rule in an `iptables -S INPUT` listing that
-/// carries exactly this tag. Anything else in the chain is left alone.
+/// carries exactly this tag, or, with no `comment` match in the kernel, is
+/// exactly the rule written for some range. Anything else is left alone.
 fn tagged_deletions(listing: &str, tag: &str) -> Vec<Vec<String>> {
    listing
        .lines()
@@ -162,7 +226,8 @@ fn tagged_deletions(listing: &str, tag: &str) -> Vec<Vec<String>> {
            }
            let tagged = rest
                .windows(2)
-                .any(|pair| pair[0] == "--comment" && pair[1] == tag);
+                .any(|pair| pair[0] == "--comment" && pair[1] == tag)
+                || is_uncommented_rule(tag, rest);
            tagged.then(|| {
                locked(
                    ["-D".to_string(), CHAIN.to_string()]
@@ -197,7 +262,8 @@ fn missing(plan: &BroadcastRulesPlan) -> String {

 /// Makes the firewall hold exactly one rule for this interface, the planned one.
 fn apply_firewall(run: Run<'_>, plan: &BroadcastRulesPlan) -> RuleOutcome {
-    let present = match run(&check_args(plan)) {
+    let comment = comment_supported(run);
+    let present = match run(&check_args(plan, comment)) {
        Ran::Missing => return RuleOutcome::Failed(missing(plan)),
        Ran::Exited { success, .. } => success,
    };
@@ -227,7 +293,7 @@ fn apply_firewall(run: Run<'_>, plan: &BroadcastRulesPlan) -> RuleOutcome {
            return RuleOutcome::Failed(failure(&stderr));
        }
    }
-    match run(&insert_args(plan)) {
+    match run(&insert_args(plan, comment)) {
        Ran::Missing => RuleOutcome::Failed(missing(plan)),
        Ran::Exited { success: true, .. } => RuleOutcome::Applied,
        Ran::Exited { stderr, .. } => RuleOutcome::Failed(failure(&stderr)),
@@ -365,7 +431,7 @@ mod tests {

    #[test]
    fn the_rule_is_udp_only_from_the_overlay_range_on_this_interface() {
-        let spec = words(&rule_spec(&plan()));
+        let spec = words(&rule_spec(&plan(), true));
        assert_eq!(
            spec,
            "-i tsun0 -p udp -s 10.13.37.0/24 -m comment --comment tsunagi:tsun0 -j ACCEPT"
@@ -373,8 +439,8 @@ mod tests {
        // Nothing here may widen to other protocols or every source.
        assert!(spec.contains("-p udp"));
        assert!(!spec.contains("0.0.0.0/0"));
-        assert!(words(&insert_args(&plan())).starts_with("-w 5 -I INPUT 1 -i tsun0"));
-        assert!(words(&check_args(&plan())).starts_with("-w 5 -C INPUT -i tsun0"));
+        assert!(words(&insert_args(&plan(), true)).starts_with("-w 5 -I INPUT 1 -i tsun0"));
+        assert!(words(&check_args(&plan(), true)).starts_with("-w 5 -C INPUT -i tsun0"));
    }

    #[test]
@@ -408,6 +474,49 @@ mod tests {
        assert!(tagged_deletions("", "tsunagi:tsun0").is_empty());
    }

+    #[test]
+    fn a_kernel_without_the_comment_match_says_so_in_its_error() {
+        let answer = |stderr: &'static str| {
+            move |_: &[String]| Ran::Exited {
+                success: false,
+                stdout: String::new(),
+                stderr: stderr.to_string(),
+            }
+        };
+        assert!(!comment_supported(&answer(
+            "iptables: No chain/target/match by that name."
+        )));
+        assert!(comment_supported(&answer(
+            "iptables: Bad rule (does a matching rule exist in that chain?)."
+        )));
+        assert!(comment_supported(&|_: &[String]| Ran::Missing));
+    }
+
+    #[test]
+    fn a_rule_written_without_a_comment_is_found_by_its_shape() {
+        // Listed the way iptables prints it: its own option order.
+        let listing = "\
+-P INPUT ACCEPT
+-A INPUT -s 10.13.37.0/24 -i tsun0 -p udp -j ACCEPT
+-A INPUT -s 10.99.0.0/16 -i tsun0 -p udp -j ACCEPT
+-A INPUT -s 10.13.37.0/24 -i tsun1 -p udp -j ACCEPT
+-A INPUT -s 10.13.37.0/24 -i tsun0 -p udp -j DROP
+-A INPUT -s 10.13.37.0/24 -i tsun0 -p tcp -j ACCEPT
+";
+        let deletions = tagged_deletions(listing, "tsunagi:tsun0");
+        assert_eq!(deletions.len(), 2, "{deletions:?}");
+        assert!(words(&deletions[0]).ends_with("-s 10.13.37.0/24 -i tsun0 -p udp -j ACCEPT"));
+        assert!(words(&deletions[1]).contains("10.99.0.0/16"));
+    }
+
+    #[test]
+    fn without_a_comment_the_rule_has_none() {
+        let with = words(&rule_spec(&plan(), true));
+        let without = words(&rule_spec(&plan(), false));
+        assert!(with.contains("-m comment --comment tsunagi:tsun0"));
+        assert_eq!(without, "-i tsun0 -p udp -s 10.13.37.0/24 -j ACCEPT");
+    }
+
    /// A scripted `iptables`: answers by the leading verb, records every call.
    struct Fake {
        calls: RefCell<Vec<String>>,
@@ -428,6 +537,14 @@ mod tests {
            }
        }
        fn run(&self, args: &[String]) -> Ran {
+            // The probe for the `comment` match: not part of what is tested.
+            if args.iter().any(|word| word == "tsunagi-probe") {
+                return Ran::Exited {
+                    success: false,
+                    stdout: String::new(),
+                    stderr: "Bad rule".into(),
+                };
+            }
            self.calls.borrow_mut().push(words(args));
            if self.missing {
                return Ran::Missing;
@@ -47,7 +47,10 @@ use crate::state::Ipv4Range;

 use super::RuleOutcome;
 use super::exit::{ExitHostPlan, ExitHostReport, ExitHostRules, exit_tag, exit_tag_prefix};
-use super::linux::{LinuxHostRules, Ran, Run, failure, locked, run_iptables, split_rule_line};
+use super::linux::{
+    LinuxHostRules, Ran, Run, comment_supported, failure, locked, run_iptables, same_rule,
+    split_rule_line,
+};

 /// The chains the offering rules live in: `(table, chain)`.
 const CHAINS: [(&str, &str); 2] = [("nat", "POSTROUTING"), ("filter", "FORWARD")];
@@ -65,14 +68,23 @@ fn owned(words: &[&str]) -> Vec<String> {
 }

 /// The three rules of one offered range.
-fn offer_rules(interface: &str, range: &Ipv4Range) -> Vec<Rule> {
+///
+/// Each carries a comment naming its interface and range, which is how it is
+/// found again. A kernel without the `comment` match (small router builds
+/// leave it out) cannot take that, so `comment` false leaves it off and the
+/// rules are recognised by their shape instead; see [`tagged_rules`].
+fn offer_rules(interface: &str, range: &Ipv4Range, comment: bool) -> Vec<Rule> {
    let range_text = range.to_string();
    let tag = exit_tag(interface, range);
-    let comment = ["-m", "comment", "--comment", tag.as_str()];
+    let comment: Vec<String> = if comment {
+        owned(&["-m", "comment", "--comment", tag.as_str()])
+    } else {
+        Vec::new()
+    };
    let spec = |head: &[&str], tail: &[&str]| -> Vec<String> {
        owned(head)
            .into_iter()
-            .chain(owned(&comment))
+            .chain(comment.iter().cloned())
            .chain(owned(tail))
            .collect()
    };
@@ -142,9 +154,16 @@ struct Found {
    rest: Vec<String>,
 }

-/// Every rule in an `iptables -S <chain>` listing carrying a tag that starts
-/// with `prefix`. Anything else in the chain is left alone.
+/// Every rule in an `iptables -S <chain>` listing that is ours: carrying a
+/// tag that starts with `prefix`, or, on a kernel with no `comment` match,
+/// being exactly one of the three rules this module writes for some range.
+/// Anything else in the chain is left alone.
 fn tagged_rules(listing: &str, chain: &str, prefix: &str) -> Vec<Found> {
+    // `tsunagi-exit:<interface>:`
+    let interface = prefix
+        .strip_prefix("tsunagi-exit:")
+        .and_then(|rest| rest.strip_suffix(':'))
+        .unwrap_or_default();
    listing
        .lines()
        .filter_map(|line| {
@@ -158,7 +177,8 @@ fn tagged_rules(listing: &str, chain: &str, prefix: &str) -> Vec<Found> {
            let tag = rest
                .windows(2)
                .find(|pair| pair[0] == "--comment" && pair[1].starts_with(prefix))
-                .map(|pair| pair[1].clone())?;
+                .map(|pair| pair[1].clone())
+                .or_else(|| uncommented_tag(interface, chain, rest))?;
            Some(Found {
                tag,
                rest: rest.to_vec(),
@@ -167,6 +187,22 @@ fn tagged_rules(listing: &str, chain: &str, prefix: &str) -> Vec<Found> {
        .collect()
 }

+/// The tag a rule would have carried, when it is one of ours written without
+/// a comment: its words are those of the rule for the range it names.
+fn uncommented_tag(interface: &str, chain: &str, rest: &[String]) -> Option<String> {
+    if interface.is_empty() {
+        return None;
+    }
+    let range: Ipv4Range = rest
+        .windows(2)
+        .find(|pair| pair[0] == "-s" || pair[0] == "-d")
+        .and_then(|pair| pair[1].parse().ok())?;
+    offer_rules(interface, &range, false)
+        .iter()
+        .any(|rule| rule.chain == chain && same_rule(&rule.spec, rest))
+        .then(|| exit_tag(interface, &range))
+}
+
 fn delete_args(table: &str, chain: &str, found: &Found) -> Vec<String> {
    locked(
        owned(&["-t", table, "-D", chain])
@@ -236,6 +272,7 @@ fn apply_offer(
    };
    let prefix = exit_tag_prefix(interface);
    let wanted: Vec<String> = ranges.iter().map(|r| exit_tag(interface, r)).collect();
+    let comment = comment_supported(run);

    // What is there now, per chain.
    let mut present: Vec<(&str, &str, Vec<Found>)> = Vec::new();
@@ -263,7 +300,7 @@ fn apply_offer(
    ranges
        .iter()
        .map(|range| {
-            let rules = offer_rules(interface, range);
+            let rules = offer_rules(interface, range, comment);
            let tag = exit_tag(interface, range);
            let in_place = rules
                .iter()
@@ -468,7 +505,7 @@ mod tests {

    #[test]
    fn the_rules_masquerade_the_range_out_of_every_other_interface_and_forward_it() {
-        let rules = offer_rules("tsun0", &range());
+        let rules = offer_rules("tsun0", &range(), true);
        assert_eq!(rules.len(), 3);
        assert_eq!(
            words(&rules[0].spec),
@@ -521,6 +558,8 @@ mod tests {
        listing: RefCell<Vec<(String, String)>>,
        missing: bool,
        check_ok: bool,
+        /// A kernel with no `comment` match, as small router builds have.
+        no_comment: bool,
    }

    impl Fake {
@@ -530,6 +569,7 @@ mod tests {
                listing: RefCell::new(Vec::new()),
                missing: false,
                check_ok,
+                no_comment: false,
            }
        }

@@ -556,6 +596,13 @@ mod tests {
                stdout,
                stderr: String::new(),
            };
+            if self.no_comment && line.contains("-m comment") {
+                return Ran::Exited {
+                    success: false,
+                    stdout: String::new(),
+                    stderr: "iptables: No chain/target/match by that name.".to_string(),
+                };
+            }
            if line.contains(" -S ") {
                let listing: Vec<String> = self
                    .listing
@@ -586,6 +633,44 @@ mod tests {
        }
    }

+    #[test]
+    fn a_kernel_without_the_comment_match_gets_the_rules_without_comments() {
+        let mut fake = Fake::new(false);
+        fake.no_comment = true;
+        let outcome = apply_offer(&|args| fake.run(args), "tsun0", &[range()]);
+        assert_eq!(outcome, vec![(range(), RuleOutcome::Applied)]);
+        let inserted = fake.verbs("-I");
+        assert_eq!(inserted.len(), 3, "{inserted:?}");
+        assert!(
+            inserted.iter().all(|call| !call.contains("comment")),
+            "{inserted:?}"
+        );
+    }
+
+    #[test]
+    fn rules_written_without_a_comment_are_ours_and_are_removed_with_them() {
+        // The way iptables prints them: its own option order.
+        let listing = "\
+-P FORWARD ACCEPT
+-A FORWARD -s 10.13.37.0/24 -i tsun0 ! -o tsun0 -j ACCEPT
+-A FORWARD -d 10.13.37.0/24 -o tsun0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A FORWARD -i tsun0 -j ACCEPT
+-A FORWARD -s 10.13.37.0/24 -i tsun1 ! -o tsun1 -j ACCEPT
+";
+        let found = tagged_rules(listing, "FORWARD", &exit_tag_prefix("tsun0"));
+        assert_eq!(found.len(), 2, "{found:?}");
+        assert!(
+            found
+                .iter()
+                .all(|rule| rule.tag == exit_tag("tsun0", &range()))
+        );
+        let nat = "-A POSTROUTING -s 10.13.37.0/24 ! -o tsun0 -j MASQUERADE\n";
+        assert_eq!(
+            tagged_rules(nat, "POSTROUTING", &exit_tag_prefix("tsun0")).len(),
+            1
+        );
+    }
+
    #[test]
    fn a_fresh_host_gets_the_three_rules() {
        let fake = Fake::new(false);
@@ -19,6 +19,10 @@

 use crate::BoxFuture;

+use std::sync::{Arc, Mutex};
+
+use super::exit::{ExitHostPlan, ExitHostReport, ExitHostRules};
+use super::macos_exit::{apply_plan, clear_all, run_tool};
 use super::{BroadcastHostRules, BroadcastRulesPlan, BroadcastRulesReport, RuleOutcome};

 /// The limited-broadcast destination routed through the overlay interface.
@@ -60,14 +64,19 @@ fn firewall_todo(plan: &BroadcastRulesPlan) -> String {
    )
 }

-/// The macOS implementation: `route` for the route, no firewall yet.
+/// The macOS implementation: `route` for the route, no firewall yet, and
+/// `pf` plus `route` for exit nodes (see [`super::macos_exit`]).
 #[derive(Debug, Default)]
-pub struct MacosHostRules;
+pub struct MacosHostRules {
+    /// The reference `pfctl -E` handed out, held while exit-node rules need
+    /// `pf` on and released when they are removed.
+    pub(super) pf_token: Arc<Mutex<Option<String>>>,
+}

 impl MacosHostRules {
    /// Creates the host rules.
    pub fn new() -> Self {
-        Self
+        Self::default()
    }

    /// Installs the route, replacing one this agent added earlier so the call
@@ -82,11 +91,46 @@ impl MacosHostRules {
    }
 }

+impl ExitHostRules for MacosHostRules {
+    fn apply<'a>(&'a self, plan: &'a ExitHostPlan) -> BoxFuture<'a, ExitHostReport> {
+        Box::pin(async move {
+            let job_plan = plan.clone();
+            let token = Arc::clone(&self.pf_token);
+            tokio::task::spawn_blocking(move || apply_plan(&run_tool, &token, &job_plan))
+                .await
+                .unwrap_or_else(|err| {
+                    let failed = RuleOutcome::Failed(format!("the task failed: {err}"));
+                    ExitHostReport {
+                        offer: plan
+                            .offer
+                            .iter()
+                            .map(|range| (*range, failed.clone()))
+                            .collect(),
+                        forwarding: None,
+                        client: plan.client.then_some(failed),
+                    }
+                })
+        })
+    }
+
+    fn clear<'a>(&'a self, interface: &'a str) -> BoxFuture<'a, ()> {
+        Box::pin(async move {
+            let name = interface.to_string();
+            let token = Arc::clone(&self.pf_token);
+            let _ = tokio::task::spawn_blocking(move || clear_all(&run_tool, &token, &name)).await;
+        })
+    }
+}
+
 impl BroadcastHostRules for MacosHostRules {
    fn name(&self) -> &str {
        "route"
    }

+    fn exit_rules(&self) -> Option<&dyn ExitHostRules> {
+        Some(self)
+    }
+
    fn apply<'a>(&'a self, plan: &'a BroadcastRulesPlan) -> BoxFuture<'a, BroadcastRulesReport> {
        Box::pin(async move {
            let route = self.set_route(plan.interface.clone()).await;
@@ -0,0 +1,915 @@
+//! Exit-node host rules on macOS: a `pf` anchor and `route` entries.
+//!
+//! Compiled on every platform so the rule text and the parsers are tested
+//! everywhere; only `MacosHostRules` runs them, and only on macOS.
+//!
+//! # Offering
+//!
+//! Per offered range, in the anchor `com.apple/tsunagi-exit-<if>`:
+//!
+//! ```text
+//! nat on <egress> inet from <range> to any -> (<egress>)
+//! pass in quick on <if> inet from <range> to ! <range>
+//! ```
+//!
+//! The anchor lives under `com.apple/` on purpose: the stock `/etc/pf.conf`
+//! evaluates `nat-anchor "com.apple/*"` and `anchor "com.apple/*"`, so the
+//! rules take effect without editing the user's ruleset. `pf` cannot say
+//! "every interface but one" in a translation address, so the egress is the
+//! interface of the default route **when the rules are applied**; after the
+//! default route moves (Wi-Fi to Ethernet) the rules are re-applied by
+//! switching the exit node off and on, or restarting the agent.
+//!
+//! The kernel's `net.inet.ip.forwarding` is only read, never written: it
+//! changes how the whole host behaves, which is the owner's decision.
+//!
+//! # Using
+//!
+//! macOS has no `uidrange` policy routing, and the agent is root, so the
+//! Linux scheme does not carry over. Instead:
+//!
+//! ```text
+//! route add -net 0.0.0.0/1   -interface <if>
+//! route add -net 128.0.0.0/1 -interface <if>
+//! pass out quick on <if> route-to (<egress> <gateway>) inet proto { tcp udp }
+//!     from any to ! <overlay ranges> user <agent uid>
+//! nat on <egress> inet from (<if>) to any -> (<egress>)
+//! ```
+//!
+//! The two halves outrank the default route without replacing it, and every
+//! more specific route (LAN, another VPN) keeps working. The `route-to` rule
+//! sends the *agent's own* traffic — QUIC, relay, DHT, which would otherwise
+//! loop into the tunnel it carries — back out the physical interface, and the
+//! translation gives it that interface's address, since an unbound socket
+//! picked the overlay address when the route pointed at the overlay. Like the
+//! Linux exemption this is by user id, so anything else running as root also
+//! bypasses the tunnel.
+//!
+//! IPv6 is blocked while an exit node is in use, as on Linux: `::/1` and
+//! `8000::/1` are rejecting routes, so applications fall back to IPv4 at once
+//! instead of leaking.
+//!
+//! Every object is derived from local state and the interface the agent owns;
+//! none of it comes from a peer.
+
+use std::net::Ipv4Addr;
+use std::sync::Mutex;
+
+use crate::state::Ipv4Range;
+
+use super::RuleOutcome;
+use super::exit::{ExitHostPlan, ExitHostReport};
+
+/// The programs this module runs, always by absolute path.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Tool {
+    Route,
+    Pfctl,
+    Sysctl,
+    Id,
+}
+
+impl Tool {
+    fn path(self) -> &'static str {
+        match self {
+            Self::Route => "/sbin/route",
+            Self::Pfctl => "/sbin/pfctl",
+            Self::Sysctl => "/usr/sbin/sysctl",
+            Self::Id => "/usr/bin/id",
+        }
+    }
+}
+
+/// What running a tool came to.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) enum Ran {
+    /// The program is not there.
+    Missing,
+    /// It ran.
+    Exited {
+        success: bool,
+        stdout: String,
+        stderr: String,
+    },
+}
+
+/// Runs a tool with optional standard input; injectable so the logic is
+/// tested without touching the host.
+pub(super) type Run<'a> = &'a dyn Fn(Tool, &[String], Option<&str>) -> Ran;
+
+/// Runs a real tool. Blocking: callers use `spawn_blocking`.
+pub(super) fn run_tool(tool: Tool, args: &[String], stdin: Option<&str>) -> Ran {
+    use std::io::Write;
+    use std::process::{Command, Stdio};
+
+    let mut command = Command::new(tool.path());
+    command
+        .args(args)
+        .stdin(if stdin.is_some() {
+            Stdio::piped()
+        } else {
+            Stdio::null()
+        })
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    let mut child = match command.spawn() {
+        Ok(child) => child,
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => return Ran::Missing,
+        Err(err) => {
+            return Ran::Exited {
+                success: false,
+                stdout: String::new(),
+                stderr: format!("could not run {}: {err}", tool.path()),
+            };
+        }
+    };
+    if let (Some(text), Some(mut pipe)) = (stdin, child.stdin.take()) {
+        // A write error shows up as the tool's own failure below.
+        let _ = pipe.write_all(text.as_bytes());
+    }
+    match child.wait_with_output() {
+        Ok(output) => Ran::Exited {
+            success: output.status.success(),
+            stdout: String::from_utf8_lossy(&output.stdout).into_owned(),
+            stderr: String::from_utf8_lossy(&output.stderr).into_owned(),
+        },
+        Err(err) => Ran::Exited {
+            success: false,
+            stdout: String::new(),
+            stderr: format!("could not run {}: {err}", tool.path()),
+        },
+    }
+}
+
+fn owned(words: &[&str]) -> Vec<String> {
+    words.iter().map(|word| word.to_string()).collect()
+}
+
+/// A name that is safe in a `pf` rule, an anchor path and a table name.
+fn safe_name(name: &str) -> bool {
+    !name.is_empty() && name.len() <= 32 && name.chars().all(|c| c.is_ascii_alphanumeric())
+}
+
+/// The anchor holding every rule of one interface.
+fn anchor_name(interface: &str) -> Result<String, String> {
+    if safe_name(interface) {
+        Ok(format!("com.apple/tsunagi-exit-{interface}"))
+    } else {
+        Err(format!(
+            "`{interface}` is not an interface name this agent can write a pf rule for"
+        ))
+    }
+}
+
+/// The default route as `route -n get default` reports it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) struct DefaultRoute {
+    pub interface: String,
+    pub gateway: Option<Ipv4Addr>,
+}
+
+/// Reads `interface:` and `gateway:` out of `route -n get default`.
+fn parse_default_route(text: &str) -> Option<DefaultRoute> {
+    let field = |name: &str| {
+        text.lines().find_map(|line| {
+            let (key, value) = line.split_once(':')?;
+            (key.trim() == name).then(|| value.trim().to_string())
+        })
+    };
+    let interface = field("interface").filter(|name| safe_name(name))?;
+    let gateway = field("gateway").and_then(|value| value.parse().ok());
+    Some(DefaultRoute { interface, gateway })
+}
+
+fn failure(stderr: &str, stdout: &str) -> String {
+    let text = if stderr.trim().is_empty() {
+        stdout.trim()
+    } else {
+        stderr.trim()
+    };
+    if text.is_empty() {
+        "the command failed without saying why".to_string()
+    } else {
+        text.to_string()
+    }
+}
+
+/// Runs a tool and turns a failure into a sentence a person can act on.
+fn run_ok(
+    run: Run<'_>,
+    tool: Tool,
+    args: &[String],
+    stdin: Option<&str>,
+) -> Result<String, String> {
+    match run(tool, args, stdin) {
+        Ran::Missing => Err(format!("{} not found", tool.path())),
+        Ran::Exited {
+            success: true,
+            stdout,
+            ..
+        } => Ok(stdout),
+        Ran::Exited { stderr, stdout, .. } => Err(format!(
+            "{} {} failed: {}",
+            tool.path(),
+            args.join(" "),
+            failure(&stderr, &stdout)
+        )),
+    }
+}
+
+/// The route traffic leaves by now, which is the egress for translation and
+/// for the agent's own sockets. Read *before* the overlay routes are added.
+fn default_route(run: Run<'_>, overlay: &str) -> Result<DefaultRoute, String> {
+    let out = run_ok(run, Tool::Route, &owned(&["-n", "get", "default"]), None)
+        .map_err(|why| format!("cannot find the default route: {why}"))?;
+    let route = parse_default_route(&out)
+        .ok_or_else(|| "the host has no default route to send traffic out of".to_string())?;
+    if route.interface == overlay {
+        return Err(format!(
+            "the default route already goes through `{overlay}`"
+        ));
+    }
+    Ok(route)
+}
+
+/// Whether the kernel forwards IPv4. Read only.
+fn forwarding_state(run: Run<'_>) -> Option<bool> {
+    let out = run_ok(
+        run,
+        Tool::Sysctl,
+        &owned(&["-n", "net.inet.ip.forwarding"]),
+        None,
+    )
+    .ok()?;
+    match out.trim() {
+        "1" => Some(true),
+        "0" => Some(false),
+        _ => None,
+    }
+}
+
+/// The effective user id of this process, from `id -u`.
+fn agent_uid(run: Run<'_>) -> Result<u32, String> {
+    run_ok(run, Tool::Id, &owned(&["-u"]), None)
+        .ok()
+        .and_then(|out| out.trim().parse().ok())
+        .ok_or_else(|| "cannot tell which user this agent runs as".to_string())
+}
+
+/// What the using side adds to the rules.
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct ClientRules<'a> {
+    uid: u32,
+    /// Every overlay range: the agent's own traffic *to* those still goes
+    /// through the interface.
+    overlay: &'a [Ipv4Range],
+}
+
+/// The text of the anchor: translation first, filtering after, which is the
+/// order `pf` insists on.
+fn pf_rules(
+    interface: &str,
+    egress: &DefaultRoute,
+    offer: &[Ipv4Range],
+    client: Option<&ClientRules<'_>>,
+) -> String {
+    let out = &egress.interface;
+    let mut nat = Vec::new();
+    let mut filter = Vec::new();
+    for range in offer {
+        nat.push(format!("nat on {out} inet from {range} to any -> ({out})"));
+        filter.push(format!(
+            "pass in quick on {interface} inet from {range} to ! {range}"
+        ));
+    }
+    let mut tables = Vec::new();
+    if let Some(client) = client {
+        nat.push(format!(
+            "nat on {out} inet from ({interface}) to any -> ({out})"
+        ));
+        let target = if client.overlay.is_empty() {
+            "any".to_string()
+        } else {
+            let ranges: Vec<String> = client.overlay.iter().map(|r| r.to_string()).collect();
+            // A table, because `! { a, b }` expands to one rule per element
+            // in older `pf`, which matches everything.
+            tables.push(format!(
+                "table <tsunagi_overlay_{interface}> const {{ {} }}",
+                ranges.join(", ")
+            ));
+            format!("! <tsunagi_overlay_{interface}>")
+        };
+        let via = match egress.gateway {
+            Some(gateway) => format!("({out} {gateway})"),
+            None => out.clone(),
+        };
+        filter.push(format!(
+            "pass out quick on {interface} route-to {via} inet proto {{ tcp udp }} \
+             from any to {target} user {}",
+            client.uid
+        ));
+    }
+    tables
+        .into_iter()
+        .chain(nat)
+        .chain(filter)
+        .collect::<Vec<_>>()
+        .join("\n")
+        + "\n"
+}
+
+/// Turns `pf` on if nobody has, holding the reference `pfctl` hands out so it
+/// can be released when the agent is done. One reference at most.
+fn acquire_pf(run: Run<'_>, slot: &Mutex<Option<String>>) -> Result<(), String> {
+    if lock(slot).is_some() {
+        return Ok(());
+    }
+    match run(Tool::Pfctl, &owned(&["-E"]), None) {
+        Ran::Missing => Err(format!("{} not found", Tool::Pfctl.path())),
+        Ran::Exited {
+            success,
+            stdout,
+            stderr,
+        } => {
+            // `pfctl -E` reports `Token : <n>` on stderr, and also says so
+            // when pf is already enabled.
+            let token = stdout.lines().chain(stderr.lines()).find_map(parse_token);
+            if !success && token.is_none() {
+                return Err(format!("cannot enable pf: {}", failure(&stderr, &stdout)));
+            }
+            *lock(slot) = token;
+            Ok(())
+        }
+    }
+}
+
+fn parse_token(line: &str) -> Option<String> {
+    let (key, value) = line.split_once(':')?;
+    let value = value.trim();
+    (key.trim().eq_ignore_ascii_case("token")
+        && !value.is_empty()
+        && value.chars().all(|c| c.is_ascii_digit()))
+    .then(|| value.to_string())
+}
+
+fn release_pf(run: Run<'_>, slot: &Mutex<Option<String>>) {
+    if let Some(token) = lock(slot).take()
+        && let Err(why) = run_ok(run, Tool::Pfctl, &["-X".to_string(), token], None)
+    {
+        tracing::debug!(%why, "cannot release the pf reference");
+    }
+}
+
+fn lock<T>(mutex: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
+    match mutex.lock() {
+        Ok(guard) => guard,
+        Err(poisoned) => poisoned.into_inner(),
+    }
+}
+
+fn flush_args(anchor: &str) -> Vec<String> {
+    owned(&["-q", "-a", anchor, "-F", "all"])
+}
+
+fn load_args(anchor: &str) -> Vec<String> {
+    owned(&["-q", "-a", anchor, "-f", "-"])
+}
+
+/// The two halves that out-rank the default route.
+const HALVES: [&str; 2] = ["0.0.0.0/1", "128.0.0.0/1"];
+/// The IPv6 halves, made unreachable.
+const HALVES_V6: [&str; 2] = ["::/1", "8000::/1"];
+
+fn route_add_args(half: &str, interface: &str) -> Vec<String> {
+    owned(&["-q", "-n", "add", "-net", half, "-interface", interface])
+}
+
+fn route_del_args(half: &str, interface: &str) -> Vec<String> {
+    owned(&["-q", "-n", "delete", "-net", half, "-interface", interface])
+}
+
+fn route_add_v6_args(half: &str) -> Vec<String> {
+    owned(&["-q", "-n", "add", "-inet6", "-net", half, "::1", "-reject"])
+}
+
+fn route_del_v6_args(half: &str) -> Vec<String> {
+    owned(&["-q", "-n", "delete", "-inet6", "-net", half, "::1"])
+}
+
+/// Takes away the overlay default routes. Best effort: what is not there is
+/// the state wanted.
+fn clear_routes(run: Run<'_>, interface: &str) {
+    for half in HALVES {
+        let _ = run(Tool::Route, &route_del_args(half, interface), None);
+    }
+    for half in HALVES_V6 {
+        let _ = run(Tool::Route, &route_del_v6_args(half), None);
+    }
+}
+
+fn set_routes(run: Run<'_>, interface: &str) -> Result<(), String> {
+    clear_routes(run, interface);
+    for half in HALVES {
+        if let Err(why) = run_ok(run, Tool::Route, &route_add_args(half, interface), None) {
+            clear_routes(run, interface);
+            return Err(why);
+        }
+    }
+    for half in HALVES_V6 {
+        // A host without IPv6 has nothing to block; not a failure.
+        if let Err(why) = run_ok(run, Tool::Route, &route_add_v6_args(half), None) {
+            tracing::debug!(%why, "cannot block IPv6 for the exit node");
+        }
+    }
+    Ok(())
+}
+
+/// Makes the host match the plan.
+pub(super) fn apply_plan(
+    run: Run<'_>,
+    token: &Mutex<Option<String>>,
+    plan: &ExitHostPlan,
+) -> ExitHostReport {
+    let forwarding = if plan.offer.is_empty() {
+        None
+    } else {
+        forwarding_state(run)
+    };
+    let outcome = apply_rules(run, token, plan);
+    let verdict = |ok: bool, why: &str| {
+        if ok {
+            RuleOutcome::Applied
+        } else {
+            RuleOutcome::Failed(why.to_string())
+        }
+    };
+    match outcome {
+        Ok(()) => ExitHostReport {
+            offer: plan
+                .offer
+                .iter()
+                .map(|range| (*range, RuleOutcome::Applied))
+                .collect(),
+            forwarding,
+            client: plan.client.then_some(RuleOutcome::Applied),
+        },
+        Err(why) => ExitHostReport {
+            offer: plan
+                .offer
+                .iter()
+                .map(|range| (*range, verdict(false, &why)))
+                .collect(),
+            forwarding,
+            client: plan.client.then(|| verdict(false, &why)),
+        },
+    }
+}
+
+fn apply_rules(
+    run: Run<'_>,
+    token: &Mutex<Option<String>>,
+    plan: &ExitHostPlan,
+) -> Result<(), String> {
+    let interface = plan.interface.as_str();
+    let anchor = anchor_name(interface)?;
+    let egress = default_route(run, interface)?;
+    let uid = if plan.client {
+        Some(agent_uid(run)?)
+    } else {
+        None
+    };
+    let client = uid.map(|uid| ClientRules {
+        uid,
+        overlay: &plan.overlay,
+    });
+    let rules = pf_rules(interface, &egress, &plan.offer, client.as_ref());
+
+    acquire_pf(run, token)?;
+    run_ok(run, Tool::Pfctl, &load_args(&anchor), Some(&rules))
+        .map_err(|why| format!("cannot load the pf rules: {why}"))?;
+    // The routes come after the rules that keep the agent's own traffic off
+    // them: the other order would loop for as long as it takes.
+    if plan.client {
+        set_routes(run, interface)?;
+    } else {
+        clear_routes(run, interface);
+    }
+    Ok(())
+}
+
+/// Removes everything this agent put there for the interface.
+pub(super) fn clear_all(run: Run<'_>, token: &Mutex<Option<String>>, interface: &str) {
+    clear_routes(run, interface);
+    if let Ok(anchor) = anchor_name(interface) {
+        // Flushing an anchor nothing was ever loaded into is not an error
+        // worth reporting.
+        if let Err(why) = run_ok(run, Tool::Pfctl, &flush_args(&anchor), None) {
+            tracing::debug!(%why, "cannot flush the exit node pf anchor");
+        }
+    }
+    release_pf(run, token);
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+    use std::cell::RefCell;
+
+    use super::*;
+
+    fn range() -> Ipv4Range {
+        "10.13.37.0/24".parse().unwrap()
+    }
+
+    const DEFAULT_ROUTE: &str = "   route to: default\n\
+destination: default\n\
+       mask: default\n\
+    gateway: 192.168.1.1\n\
+  interface: en0\n\
+      flags: <UP,GATEWAY,DONE,STATIC,PRCLONING,GLOBAL>\n";
+
+    fn egress() -> DefaultRoute {
+        DefaultRoute {
+            interface: "en0".into(),
+            gateway: Some(Ipv4Addr::new(192, 168, 1, 1)),
+        }
+    }
+
+    /// A scripted host that records every call.
+    struct Fake {
+        calls: RefCell<Vec<String>>,
+        stdins: RefCell<Vec<String>>,
+        default_route: Option<String>,
+        forwarding: &'static str,
+        pf_missing: bool,
+        pf_load_fails: bool,
+        route_add_fails: bool,
+        pf_enable_output: &'static str,
+    }
+
+    impl Fake {
+        fn new() -> Self {
+            Self {
+                calls: RefCell::new(Vec::new()),
+                stdins: RefCell::new(Vec::new()),
+                default_route: Some(DEFAULT_ROUTE.to_string()),
+                forwarding: "1\n",
+                pf_missing: false,
+                pf_load_fails: false,
+                route_add_fails: false,
+                pf_enable_output: "pf enabled\nToken : 4242\n",
+            }
+        }
+
+        fn run(&self, tool: Tool, args: &[String], stdin: Option<&str>) -> Ran {
+            let line = format!("{:?} {}", tool, args.join(" "));
+            self.calls.borrow_mut().push(line);
+            if let Some(text) = stdin {
+                self.stdins.borrow_mut().push(text.to_string());
+            }
+            let ok = |stdout: &str, stderr: &str| Ran::Exited {
+                success: true,
+                stdout: stdout.to_string(),
+                stderr: stderr.to_string(),
+            };
+            let fail = |why: &str| Ran::Exited {
+                success: false,
+                stdout: String::new(),
+                stderr: why.to_string(),
+            };
+            match tool {
+                Tool::Id => ok("0\n", ""),
+                Tool::Sysctl => ok(self.forwarding, ""),
+                Tool::Route if args.first().map(String::as_str) == Some("-n") => {
+                    match &self.default_route {
+                        Some(text) => ok(text, ""),
+                        None => fail("route: writing to routing socket: not in table"),
+                    }
+                }
+                Tool::Route if args.contains(&"add".to_string()) && self.route_add_fails => {
+                    fail("route: writing to routing socket: File exists")
+                }
+                Tool::Route => ok("", ""),
+                Tool::Pfctl if self.pf_missing => Ran::Missing,
+                Tool::Pfctl if args == ["-E"] => ok("", self.pf_enable_output),
+                Tool::Pfctl if args.contains(&"-f".to_string()) && self.pf_load_fails => {
+                    fail("pfctl: Syntax error")
+                }
+                Tool::Pfctl => ok("", ""),
+            }
+        }
+
+        fn calls(&self) -> Vec<String> {
+            self.calls.borrow().clone()
+        }
+
+        fn position(&self, needle: &str) -> Option<usize> {
+            self.calls.borrow().iter().position(|c| c.contains(needle))
+        }
+
+        fn count(&self, needle: &str) -> usize {
+            self.calls
+                .borrow()
+                .iter()
+                .filter(|c| c.contains(needle))
+                .count()
+        }
+    }
+
+    fn plan(offer: bool, client: bool) -> ExitHostPlan {
+        ExitHostPlan {
+            interface: "utun5".into(),
+            offer: if offer { vec![range()] } else { Vec::new() },
+            client,
+            overlay: vec![range()],
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn the_default_route_is_read_from_route_output() {
+        assert_eq!(parse_default_route(DEFAULT_ROUTE), Some(egress()));
+        // A point-to-point default has no gateway line to use.
+        let ppp = "destination: default\n  interface: ppp0\n";
+        assert_eq!(
+            parse_default_route(ppp),
+            Some(DefaultRoute {
+                interface: "ppp0".into(),
+                gateway: None
+            })
+        );
+        assert_eq!(parse_default_route("route: not in table"), None);
+        // An interface name that is not plain letters and digits never ends
+        // up in a rule.
+        assert_eq!(parse_default_route("interface: en0; pass all\n"), None);
+    }
+
+    #[test]
+    fn the_anchor_is_under_com_apple_and_only_for_plain_names() {
+        assert_eq!(
+            anchor_name("utun5").unwrap(),
+            "com.apple/tsunagi-exit-utun5"
+        );
+        assert!(anchor_name("").is_err());
+        assert!(anchor_name("utun5 pass all").is_err());
+        assert!(anchor_name("../x").is_err());
+    }
+
+    #[test]
+    fn offering_translates_the_range_and_admits_it_in() {
+        let text = pf_rules("utun5", &egress(), &[range()], None);
+        assert_eq!(
+            text,
+            "nat on en0 inet from 10.13.37.0/24 to any -> (en0)\n\
+             pass in quick on utun5 inet from 10.13.37.0/24 to ! 10.13.37.0/24\n"
+        );
+        // Translation precedes filtering, as pf requires.
+        assert!(text.find("nat on").unwrap() < text.find("pass in").unwrap());
+    }
+
+    #[test]
+    fn using_sends_the_agents_own_traffic_back_out_the_physical_interface() {
+        let other: Ipv4Range = "10.99.0.0/16".parse().unwrap();
+        let overlay = [range(), other];
+        let client = ClientRules {
+            uid: 0,
+            overlay: &overlay,
+        };
+        let text = pf_rules("utun5", &egress(), &[], Some(&client));
+        assert!(
+            text.starts_with(
+                "table <tsunagi_overlay_utun5> const { 10.13.37.0/24, 10.99.0.0/16 }\n"
+            ),
+            "{text}"
+        );
+        assert!(
+            text.contains("nat on en0 inet from (utun5) to any -> (en0)\n"),
+            "{text}"
+        );
+        assert!(
+            text.contains(
+                "pass out quick on utun5 route-to (en0 192.168.1.1) inet proto { tcp udp } \
+                 from any to ! <tsunagi_overlay_utun5> user 0\n"
+            ),
+            "{text}"
+        );
+        // Only the agent's user, and only what is not the overlay.
+        assert!(!text.contains("from any to any"));
+
+        let direct = DefaultRoute {
+            interface: "ppp0".into(),
+            gateway: None,
+        };
+        let text = pf_rules(
+            "utun5",
+            &direct,
+            &[],
+            Some(&ClientRules {
+                uid: 501,
+                overlay: &[],
+            }),
+        );
+        assert!(text.contains("route-to ppp0 inet"), "{text}");
+        assert!(text.contains("to any user 501"), "{text}");
+        assert!(!text.contains("table"), "{text}");
+    }
+
+    #[test]
+    fn the_overlay_default_routes_are_halves_and_ipv6_is_rejected() {
+        assert_eq!(
+            route_add_args("0.0.0.0/1", "utun5").join(" "),
+            "-q -n add -net 0.0.0.0/1 -interface utun5"
+        );
+        assert_eq!(
+            route_del_args("128.0.0.0/1", "utun5").join(" "),
+            "-q -n delete -net 128.0.0.0/1 -interface utun5"
+        );
+        assert_eq!(
+            route_add_v6_args("8000::/1").join(" "),
+            "-q -n add -inet6 -net 8000::/1 ::1 -reject"
+        );
+        assert_eq!(
+            route_del_v6_args("::/1").join(" "),
+            "-q -n delete -inet6 -net ::/1 ::1"
+        );
+    }
+
+    #[test]
+    fn the_pf_token_is_found_in_either_stream() {
+        assert_eq!(parse_token("Token : 1234"), Some("1234".into()));
+        assert_eq!(parse_token("token: 9"), Some("9".into()));
+        assert_eq!(parse_token("pf enabled"), None);
+        assert_eq!(parse_token("Token : x; rm"), None);
+    }
+
+    #[test]
+    fn offering_loads_the_anchor_and_reads_but_never_writes_forwarding() {
+        let fake = Fake::new();
+        let token = Mutex::new(None);
+        let report = apply_plan(&|t, a, s| fake.run(t, a, s), &token, &plan(true, false));
+        assert_eq!(report.offer, vec![(range(), RuleOutcome::Applied)]);
+        assert_eq!(report.forwarding, Some(true));
+        assert_eq!(report.client, None);
+        let calls = fake.calls();
+        assert!(
+            calls
+                .iter()
+                .any(|c| c == "Pfctl -q -a com.apple/tsunagi-exit-utun5 -f -"),
+            "{calls:?}"
+        );
+        assert_eq!(
+            fake.stdins.borrow()[0],
+            "nat on en0 inet from 10.13.37.0/24 to any -> (en0)\n\
+             pass in quick on utun5 inet from 10.13.37.0/24 to ! 10.13.37.0/24\n"
+        );
+        // sysctl is only ever asked, never told.
+        assert!(
+            calls
+                .iter()
+                .filter(|c| c.starts_with("Sysctl"))
+                .all(|c| c == "Sysctl -n net.inet.ip.forwarding"),
+            "{calls:?}"
+        );
+        // No client routes were added for an offer alone.
+        assert_eq!(fake.count(" add "), 0);
+        assert_eq!(token.lock().unwrap().as_deref(), Some("4242"));
+    }
+
+    #[test]
+    fn forwarding_off_is_reported_and_unreadable_is_none() {
+        let mut fake = Fake::new();
+        fake.forwarding = "0\n";
+        let token = Mutex::new(None);
+        let report = apply_plan(&|t, a, s| fake.run(t, a, s), &token, &plan(true, false));
+        assert_eq!(report.forwarding, Some(false));
+        fake.forwarding = "junk";
+        let report = apply_plan(&|t, a, s| fake.run(t, a, s), &token, &plan(true, false));
+        assert_eq!(report.forwarding, None);
+    }
+
+    #[test]
+    fn the_client_rules_are_loaded_before_the_routes_that_need_them() {
+        let fake = Fake::new();
+        let token = Mutex::new(None);
+        let report = apply_plan(&|t, a, s| fake.run(t, a, s), &token, &plan(false, true));
+        assert_eq!(report.client, Some(RuleOutcome::Applied));
+        assert!(report.offer.is_empty());
+        let load = fake.position("-f -").unwrap();
+        let add = fake.position(" add -net 0.0.0.0/1").unwrap();
+        assert!(load < add, "{:?}", fake.calls());
+        assert!(fake.position("add -net 128.0.0.0/1").is_some());
+        assert!(fake.position("-inet6 -net ::/1 ::1 -reject").is_some());
+        assert!(fake.stdins.borrow()[0].contains("user 0"));
+        // The default route was read before any overlay route existed.
+        assert!(fake.position("-n get default").unwrap() < add);
+    }
+
+    #[test]
+    fn no_routes_are_added_when_the_rules_did_not_load() {
+        let mut fake = Fake::new();
+        fake.pf_load_fails = true;
+        let token = Mutex::new(None);
+        let report = apply_plan(&|t, a, s| fake.run(t, a, s), &token, &plan(true, true));
+        let Some(RuleOutcome::Failed(why)) = report.client else {
+            panic!("{report:?}");
+        };
+        assert!(why.contains("cannot load the pf rules"), "{why}");
+        assert!(why.contains("Syntax error"), "{why}");
+        assert!(matches!(report.offer[0].1, RuleOutcome::Failed(_)));
+        // Nothing sent the host's traffic into a tunnel it could not exempt
+        // the agent from.
+        assert_eq!(fake.count(" add "), 0);
+    }
+
+    #[test]
+    fn a_failing_route_is_a_failure_and_leaves_nothing_behind() {
+        let mut fake = Fake::new();
+        fake.route_add_fails = true;
+        let token = Mutex::new(None);
+        let report = apply_plan(&|t, a, s| fake.run(t, a, s), &token, &plan(false, true));
+        let Some(RuleOutcome::Failed(why)) = report.client else {
+            panic!("{report:?}");
+        };
+        assert!(why.contains("File exists"), "{why}");
+        // The cleanup after the failed add removed whatever did land.
+        let last_add = fake
+            .calls()
+            .iter()
+            .rposition(|c| c.contains(" add "))
+            .unwrap();
+        assert!(
+            fake.calls()[last_add..]
+                .iter()
+                .any(|c| c.contains("delete"))
+        );
+    }
+
+    #[test]
+    fn a_missing_pfctl_or_default_route_says_what_is_wrong() {
+        let mut fake = Fake::new();
+        fake.pf_missing = true;
+        let token = Mutex::new(None);
+        let report = apply_plan(&|t, a, s| fake.run(t, a, s), &token, &plan(true, false));
+        let RuleOutcome::Failed(why) = &report.offer[0].1 else {
+            panic!("{report:?}");
+        };
+        assert!(why.contains("/sbin/pfctl not found"), "{why}");
+
+        let mut fake = Fake::new();
+        fake.default_route = None;
+        let report = apply_plan(&|t, a, s| fake.run(t, a, s), &token, &plan(true, false));
+        let RuleOutcome::Failed(why) = &report.offer[0].1 else {
+            panic!("{report:?}");
+        };
+        assert!(why.contains("default route"), "{why}");
+        assert_eq!(fake.count("-f -"), 0);
+    }
+
+    #[test]
+    fn a_default_route_through_the_overlay_is_refused() {
+        let mut fake = Fake::new();
+        fake.default_route = Some("gateway: 10.13.37.1\ninterface: utun5\n".into());
+        let token = Mutex::new(None);
+        let report = apply_plan(&|t, a, s| fake.run(t, a, s), &token, &plan(true, false));
+        let RuleOutcome::Failed(why) = &report.offer[0].1 else {
+            panic!("{report:?}");
+        };
+        assert!(why.contains("already goes through"), "{why}");
+    }
+
+    #[test]
+    fn pf_is_enabled_once_and_released_once_on_clear() {
+        let fake = Fake::new();
+        let token = Mutex::new(None);
+        let run = |t, a: &[String], s: Option<&str>| fake.run(t, a, s);
+        apply_plan(&run, &token, &plan(true, false));
+        apply_plan(&run, &token, &plan(true, true));
+        assert_eq!(fake.count("Pfctl -E"), 1, "{:?}", fake.calls());
+
+        clear_all(&run, &token, "utun5");
+        assert_eq!(fake.count("Pfctl -X 4242"), 1);
+        assert!(
+            fake.position("-a com.apple/tsunagi-exit-utun5 -F all")
+                .is_some()
+        );
+        assert!(
+            fake.position("delete -net 0.0.0.0/1 -interface utun5")
+                .is_some()
+        );
+        assert_eq!(*token.lock().unwrap(), None);
+        // A second clear has nothing to release and still succeeds.
+        clear_all(&run, &token, "utun5");
+        assert_eq!(fake.count("Pfctl -X"), 1);
+    }
+
+    #[test]
+    fn dropping_the_client_removes_its_routes() {
+        let fake = Fake::new();
+        let token = Mutex::new(None);
+        let run = |t, a: &[String], s: Option<&str>| fake.run(t, a, s);
+        apply_plan(&run, &token, &plan(true, false));
+        assert!(fake.position("delete -net 0.0.0.0/1").is_some());
+        assert_eq!(fake.count(" add "), 0);
+    }
+}
@@ -61,11 +61,16 @@ pub use linux::LinuxHostRules;
 // Compiled everywhere so the scripts it builds are tested everywhere; only
 // the type that runs them is exported on Windows.
 mod windows;
+#[cfg_attr(not(target_os = "windows"), allow(dead_code))]
+mod windows_exit;
 #[cfg(all(feature = "tun-device", target_os = "windows"))]
 pub use windows::WindowsHostRules;

+// Compiled everywhere so its rule text and parsers are tested everywhere.
 #[cfg(all(feature = "tun-device", target_os = "macos"))]
 mod macos;
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
+mod macos_exit;
 #[cfg(all(feature = "tun-device", target_os = "macos"))]
 pub use macos::MacosHostRules;

@@ -29,6 +29,8 @@

 use crate::BoxFuture;

+use super::exit::{ExitHostPlan, ExitHostReport, ExitHostRules};
+use super::windows_exit;
 use super::{BroadcastHostRules, BroadcastRulesPlan, BroadcastRulesReport, RuleOutcome, tag_for};

 /// A PowerShell single-quoted literal, with any embedded quote doubled.
@@ -90,7 +92,7 @@ fn classify(what: &str, text: &str) -> String {
        || lower.contains("run as administrator")
        || lower.contains("permissiondenied")
    {
-        format!("{what}: Windows refused; run tsunagi from an elevated (administrator) process")
+        format!("{what}: Windows refused; run tsng from an elevated (administrator) process")
    } else if lower.contains("is not recognized") || lower.contains("commandnotfound") {
        format!("{what}: the NetTCPIP/NetSecurity PowerShell modules are not available: {text}")
    } else if text.is_empty() {
@@ -113,6 +115,11 @@ fn powershell_path() -> std::path::PathBuf {

 /// Runs a script and returns what it said on failure.
 fn run_powershell(script: &str) -> Result<(), String> {
+    run_powershell_output(script).map(|_| ())
+}
+
+/// Runs a script and returns what it printed, or what it said on failure.
+fn run_powershell_output(script: &str) -> Result<String, String> {
    let output = std::process::Command::new(powershell_path())
        .args([
            "-NoProfile",
@@ -125,7 +132,7 @@ fn run_powershell(script: &str) -> Result<(), String> {
        .output()
        .map_err(|err| format!("could not run PowerShell: {err}"))?;
    if output.status.success() {
-        return Ok(());
+        return Ok(String::from_utf8_lossy(&output.stdout).into_owned());
    }
    let stderr = String::from_utf8_lossy(&output.stderr);
    let text = if stderr.trim().is_empty() {
@@ -155,11 +162,73 @@ impl WindowsHostRules {
    }
 }

+/// The IPv4 addresses a host name resolves to; empty when it does not.
+fn resolve_host(host: &str) -> Vec<std::net::Ipv4Addr> {
+    use std::net::{IpAddr, ToSocketAddrs};
+    (host, 443)
+        .to_socket_addrs()
+        .map(|addrs| {
+            addrs
+                .filter_map(|addr| match addr.ip() {
+                    IpAddr::V4(ip) => Some(ip),
+                    IpAddr::V6(_) => None,
+                })
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+impl ExitHostRules for WindowsHostRules {
+    fn needs_bypass(&self) -> bool {
+        true
+    }
+
+    fn apply<'a>(&'a self, plan: &'a ExitHostPlan) -> BoxFuture<'a, ExitHostReport> {
+        Box::pin(async move {
+            let job = plan.clone();
+            tokio::task::spawn_blocking(move || {
+                windows_exit::apply_plan(
+                    &|script| run_powershell_output(script),
+                    &resolve_host,
+                    &job,
+                )
+            })
+            .await
+            .unwrap_or_else(|err| {
+                let failed = RuleOutcome::Failed(format!("the task failed: {err}"));
+                ExitHostReport {
+                    offer: plan
+                        .offer
+                        .iter()
+                        .map(|range| (*range, failed.clone()))
+                        .collect(),
+                    forwarding: None,
+                    client: plan.client.then_some(failed),
+                }
+            })
+        })
+    }
+
+    fn clear<'a>(&'a self, interface: &'a str) -> BoxFuture<'a, ()> {
+        Box::pin(async move {
+            let name = interface.to_string();
+            let _ = tokio::task::spawn_blocking(move || {
+                windows_exit::clear_all(&|script| run_powershell_output(script), &name)
+            })
+            .await;
+        })
+    }
+}
+
 impl BroadcastHostRules for WindowsHostRules {
    fn name(&self) -> &str {
        "windows-netsecurity"
    }

+    fn exit_rules(&self) -> Option<&dyn ExitHostRules> {
+        Some(self)
+    }
+
    fn apply<'a>(&'a self, plan: &'a BroadcastRulesPlan) -> BoxFuture<'a, BroadcastRulesReport> {
        Box::pin(async move {
            let route = step("route", route_script(plan)).await;
@@ -0,0 +1,603 @@
+//! Exit-node host rules on Windows: WinNAT through PowerShell.
+//!
+//! Compiled on every platform so the scripts and the plan logic are tested
+//! everywhere; only `WindowsHostRules` runs them, and only on Windows. It
+//! could not be run against a real Windows host while it was written.
+//!
+//! # Offering
+//!
+//! One NAT object per offered range, named with the usual tag
+//! `tsunagi-exit:<if>:<range>`:
+//!
+//! ```text
+//! New-NetNat -Name <tag> -InternalIPInterfaceAddressPrefix <range>
+//! ```
+//!
+//! WinNAT translates that range out of whichever interface the traffic leaves
+//! by, which is the Windows counterpart of the Linux masquerade. Windows
+//! forwards per interface, and the egress is not known here, so forwarding is
+//! only *read* for the overlay interface; turning it on for the interfaces
+//! involved is the owner's decision (`Set-NetIPInterface -Forwarding Enabled`).
+//! Some Windows versions allow a single NAT per host: a second offered range
+//! then reports its own failure.
+//!
+//! # Using
+//!
+//! Windows has no per-user or per-process routing, so the Linux scheme (an
+//! exemption for the agent's user) does not carry over. Instead the agent's
+//! own underlay traffic is exempted by *destination*:
+//!
+//! ```text
+//! New-NetRoute 0.0.0.0/1   on the overlay interface, metric 1
+//! New-NetRoute 128.0.0.0/1 on the overlay interface, metric 1
+//! New-NetRoute <ip>/32 via the physical default gateway, metric 7373
+//! ```
+//!
+//! The halves out-rank the default route without replacing it, so every more
+//! specific route (LAN, another VPN) keeps working. A `/32` per address the
+//! agent talks to directly (the verified direct paths of its connections, and
+//! the relays it uses, resolved when the rules are applied) keeps that traffic
+//! on the physical network instead of looping into the tunnel it carries. The
+//! metric 7373 marks those routes as ours, which is how stale ones are found
+//! and removed. Everything is written to the active store, so a reboot clears
+//! it. IPv6 is blackholed with `::/1` and `8000::/1` on the overlay interface,
+//! which has no IPv6: applications fall back to IPv4 after a delay, where
+//! Linux and macOS answer at once. The bypass follows the agent's paths as
+//! they change; a path that appears after the last apply is reached through
+//! the tunnel until the next one.
+//!
+//! The bypass routes are written before the halves, and removed after them.
+
+use super::RuleOutcome;
+use std::net::Ipv4Addr;
+
+use super::exit::{ExitHostPlan, ExitHostReport, exit_tag, exit_tag_prefix};
+use crate::state::Ipv4Range;
+
+/// The route metric that marks a bypass route as this agent's.
+const BYPASS_METRIC: u32 = 7373;
+
+/// Runs a PowerShell script and returns what it printed.
+pub(super) type RunScript<'a> = &'a dyn Fn(&str) -> Result<String, String>;
+
+/// Resolves a host name to its IPv4 addresses.
+pub(super) type Resolve<'a> = &'a dyn Fn(&str) -> Vec<Ipv4Addr>;
+
+/// A PowerShell single-quoted literal, with any embedded quote doubled.
+fn ps_literal(value: &str) -> String {
+    format!("'{}'", value.replace('\'', "''"))
+}
+
+/// Creates the NAT of one range, replacing one this agent made before.
+fn nat_script(interface: &str, range: &Ipv4Range) -> String {
+    let name = ps_literal(&exit_tag(interface, range));
+    let prefix = ps_literal(&range.to_string());
+    format!(
+        "$ErrorActionPreference = 'Stop'\n\
+         $name = {name}\n\
+         Get-NetNat -Name $name -ErrorAction SilentlyContinue | \
+         Remove-NetNat -Confirm:$false -ErrorAction SilentlyContinue\n\
+         New-NetNat -Name $name -InternalIPInterfaceAddressPrefix {prefix} | Out-Null\n"
+    )
+}
+
+/// Removes this interface's NAT objects except those named in `keep`.
+fn prune_script(interface: &str, keep: &[Ipv4Range]) -> String {
+    let prefix = ps_literal(&exit_tag_prefix(interface));
+    let keep: Vec<String> = keep
+        .iter()
+        .map(|range| ps_literal(&exit_tag(interface, range)))
+        .collect();
+    format!(
+        "$ErrorActionPreference = 'SilentlyContinue'\n\
+         $prefix = {prefix}\n\
+         $keep = @({})\n\
+         Get-NetNat | Where-Object {{ $_.Name.StartsWith($prefix) -and \
+         ($keep -notcontains $_.Name) }} | Remove-NetNat -Confirm:$false\n\
+         exit 0\n",
+        keep.join(", ")
+    )
+}
+
+/// Prints `Enabled` or `Disabled` for the interface's IPv4 forwarding.
+fn forwarding_script(interface: &str) -> String {
+    let alias = ps_literal(interface);
+    format!(
+        "$ErrorActionPreference = 'Stop'\n\
+         (Get-NetIPInterface -InterfaceAlias {alias} -AddressFamily IPv4).Forwarding\n"
+    )
+}
+
+/// Prints `<interface index> <next hop>` of the best default route that is
+/// not through the overlay interface.
+fn gateway_script(interface: &str) -> String {
+    let alias = ps_literal(interface);
+    format!(
+        "$ErrorActionPreference = 'Stop'\n\
+         $alias = {alias}\n\
+         $best = Get-NetRoute -DestinationPrefix '0.0.0.0/0' -AddressFamily IPv4 \
+         -PolicyStore ActiveStore | Where-Object {{ $_.InterfaceAlias -ne $alias -and \
+         $_.NextHop -ne '0.0.0.0' }} | Sort-Object {{ $_.RouteMetric + \
+         (Get-NetIPInterface -InterfaceIndex $_.InterfaceIndex -AddressFamily IPv4).InterfaceMetric }} | \
+         Select-Object -First 1\n\
+         if (-not $best) {{ throw 'the host has no default gateway outside the overlay' }}\n\
+         \"$($best.InterfaceIndex) $($best.NextHop)\"\n"
+    )
+}
+
+/// The default gateway as the script above printed it.
+fn parse_gateway(text: &str) -> Option<(u32, Ipv4Addr)> {
+    let mut words = text.split_whitespace();
+    let index = words.next()?.parse().ok()?;
+    let hop = words.next()?.parse().ok()?;
+    words.next().is_none().then_some((index, hop))
+}
+
+/// Replaces the bypass routes with one per address, through the gateway.
+fn bypass_script(index: u32, gateway: Ipv4Addr, addresses: &[Ipv4Addr]) -> String {
+    let list: Vec<String> = addresses
+        .iter()
+        .map(|address| ps_literal(&address.to_string()))
+        .collect();
+    format!(
+        "$ErrorActionPreference = 'Stop'\n\
+         Get-NetRoute -AddressFamily IPv4 -PolicyStore ActiveStore -ErrorAction SilentlyContinue | \
+         Where-Object {{ $_.RouteMetric -eq {BYPASS_METRIC} -and $_.DestinationPrefix.EndsWith('/32') }} | \
+         Remove-NetRoute -Confirm:$false -ErrorAction SilentlyContinue\n\
+         foreach ($ip in @({})) {{\n\
+         New-NetRoute -DestinationPrefix \"$ip/32\" -InterfaceIndex {index} -NextHop '{gateway}' \
+         -RouteMetric {BYPASS_METRIC} -PolicyStore ActiveStore -ErrorAction SilentlyContinue | Out-Null\n\
+         }}\n",
+        list.join(", ")
+    )
+}
+
+/// Sends everything else through the overlay interface.
+fn halves_script(interface: &str) -> String {
+    let alias = ps_literal(interface);
+    format!(
+        "$ErrorActionPreference = 'Stop'\n\
+         $alias = {alias}\n\
+         foreach ($p in '0.0.0.0/1', '128.0.0.0/1') {{\n\
+         Get-NetRoute -DestinationPrefix $p -InterfaceAlias $alias -PolicyStore ActiveStore \
+         -ErrorAction SilentlyContinue | Remove-NetRoute -Confirm:$false -ErrorAction SilentlyContinue\n\
+         New-NetRoute -DestinationPrefix $p -InterfaceAlias $alias -NextHop '0.0.0.0' \
+         -RouteMetric 1 -PolicyStore ActiveStore | Out-Null\n\
+         }}\n\
+         foreach ($p in '::/1', '8000::/1') {{\n\
+         Get-NetRoute -DestinationPrefix $p -InterfaceAlias $alias -PolicyStore ActiveStore \
+         -ErrorAction SilentlyContinue | Remove-NetRoute -Confirm:$false -ErrorAction SilentlyContinue\n\
+         New-NetRoute -DestinationPrefix $p -InterfaceAlias $alias -NextHop '::' \
+         -RouteMetric 1 -PolicyStore ActiveStore -ErrorAction SilentlyContinue | Out-Null\n\
+         }}\n"
+    )
+}
+
+/// Removes the halves and every bypass route. What is not there is the state
+/// wanted.
+fn remove_client_script(interface: &str) -> String {
+    let alias = ps_literal(interface);
+    format!(
+        "$ErrorActionPreference = 'SilentlyContinue'\n\
+         $alias = {alias}\n\
+         foreach ($p in '0.0.0.0/1', '128.0.0.0/1', '::/1', '8000::/1') {{\n\
+         Get-NetRoute -DestinationPrefix $p -InterfaceAlias $alias -PolicyStore ActiveStore | \
+         Remove-NetRoute -Confirm:$false\n\
+         }}\n\
+         Get-NetRoute -AddressFamily IPv4 -PolicyStore ActiveStore | \
+         Where-Object {{ $_.RouteMetric -eq {BYPASS_METRIC} -and $_.DestinationPrefix.EndsWith('/32') }} | \
+         Remove-NetRoute -Confirm:$false\n\
+         exit 0\n"
+    )
+}
+
+/// Every address to keep direct: the ones given and what the names resolve
+/// to, sorted and without duplicates.
+fn bypass_addresses(
+    resolve: Resolve<'_>,
+    addresses: &[Ipv4Addr],
+    hosts: &[String],
+) -> Vec<Ipv4Addr> {
+    let mut all: std::collections::BTreeSet<Ipv4Addr> = addresses.iter().copied().collect();
+    for host in hosts {
+        all.extend(resolve(host));
+    }
+    all.into_iter()
+        .filter(|a| !a.is_loopback() && !a.is_unspecified() && !a.is_multicast())
+        .collect()
+}
+
+fn apply_client(
+    run: RunScript<'_>,
+    resolve: Resolve<'_>,
+    plan: &ExitHostPlan,
+) -> Result<(), String> {
+    let interface = plan.interface.as_str();
+    let gateway = run(&gateway_script(interface))?;
+    let (index, hop) = parse_gateway(&gateway)
+        .ok_or_else(|| format!("cannot read the default gateway from `{}`", gateway.trim()))?;
+    let addresses = bypass_addresses(resolve, &plan.bypass, &plan.bypass_hosts);
+    run(&bypass_script(index, hop, &addresses))?;
+    if let Err(why) = run(&halves_script(interface)) {
+        // Do not leave a half-installed set: bypass routes alone are harmless
+        // but the next apply starts clean.
+        let _ = run(&remove_client_script(interface));
+        return Err(why);
+    }
+    Ok(())
+}
+
+fn parse_forwarding(text: &str) -> Option<bool> {
+    match text.trim().to_ascii_lowercase().as_str() {
+        "enabled" | "1" => Some(true),
+        "disabled" | "0" => Some(false),
+        _ => None,
+    }
+}
+
+/// Makes the host match the plan.
+pub(super) fn apply_plan(
+    run: RunScript<'_>,
+    resolve: Resolve<'_>,
+    plan: &ExitHostPlan,
+) -> ExitHostReport {
+    let interface = plan.interface.as_str();
+    // What an earlier plan left and this one no longer wants.
+    let pruned = run(&prune_script(interface, &plan.offer));
+    let offer = plan
+        .offer
+        .iter()
+        .map(|range| {
+            let outcome = match &pruned {
+                Err(why) => RuleOutcome::Failed(why.clone()),
+                Ok(_) => match run(&nat_script(interface, range)) {
+                    Ok(_) => RuleOutcome::Applied,
+                    Err(why) => RuleOutcome::Failed(why),
+                },
+            };
+            (*range, outcome)
+        })
+        .collect();
+    let client = if plan.client {
+        Some(match apply_client(run, resolve, plan) {
+            Ok(()) => RuleOutcome::Applied,
+            Err(why) => RuleOutcome::Failed(why),
+        })
+    } else {
+        // Whatever an earlier plan left must not stay in force.
+        let _ = run(&remove_client_script(interface));
+        None
+    };
+    let forwarding = if plan.offer.is_empty() {
+        None
+    } else {
+        run(&forwarding_script(interface))
+            .ok()
+            .and_then(|text| parse_forwarding(&text))
+    };
+    ExitHostReport {
+        offer,
+        forwarding,
+        client,
+    }
+}
+
+/// Removes every NAT object of this agent's for the interface.
+pub(super) fn clear_all(run: RunScript<'_>, interface: &str) {
+    if let Err(why) = run(&prune_script(interface, &[])) {
+        tracing::warn!(interface, "cannot remove the exit node NAT: {why}");
+    }
+    if let Err(why) = run(&remove_client_script(interface)) {
+        tracing::warn!(interface, "cannot remove the exit node routes: {why}");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+    use std::cell::RefCell;
+
+    use super::*;
+
+    fn range() -> Ipv4Range {
+        "10.13.37.0/24".parse().unwrap()
+    }
+
+    fn plan(client: bool) -> ExitHostPlan {
+        ExitHostPlan {
+            interface: "tsun0".into(),
+            offer: vec![range()],
+            client,
+            overlay: vec![range()],
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn the_nat_is_named_with_the_tag_and_replaces_its_own() {
+        let script = nat_script("tsun0", &range());
+        assert!(
+            script.contains("$name = 'tsunagi-exit:tsun0:10.13.37.0/24'"),
+            "{script}"
+        );
+        assert!(script.contains("-InternalIPInterfaceAddressPrefix '10.13.37.0/24'"));
+        assert!(
+            script.find("Remove-NetNat").unwrap() < script.find("New-NetNat").unwrap(),
+            "{script}"
+        );
+    }
+
+    #[test]
+    fn a_quote_in_a_value_cannot_escape_the_literal() {
+        let script = nat_script("x'; Remove-Item C:\\ #", &range());
+        assert!(script.contains("'tsunagi-exit:x''; Remove-Item C:\\ #:10.13.37.0/24'"));
+        assert!(prune_script("x'y", &[]).contains("'tsunagi-exit:x''y:'"));
+        assert!(forwarding_script("x'y").contains("'x''y'"));
+    }
+
+    #[test]
+    fn pruning_keeps_wanted_ranges_and_only_selects_this_interfaces_nats() {
+        let script = prune_script("tsun0", &[range()]);
+        assert!(script.contains("$prefix = 'tsunagi-exit:tsun0:'"));
+        assert!(script.contains("$keep = @('tsunagi-exit:tsun0:10.13.37.0/24')"));
+        assert!(script.contains("StartsWith($prefix)"));
+        assert!(script.contains("exit 0"));
+        assert!(prune_script("tsun0", &[]).contains("$keep = @()"));
+    }
+
+    #[test]
+    fn forwarding_text_is_read_never_written() {
+        assert_eq!(parse_forwarding("Enabled\r\n"), Some(true));
+        assert_eq!(parse_forwarding("Disabled"), Some(false));
+        assert_eq!(parse_forwarding("what"), None);
+        let script = forwarding_script("tsun0");
+        assert!(script.contains("Get-NetIPInterface"));
+        assert!(!script.contains("Set-NetIPInterface"));
+    }
+
+    #[test]
+    fn offering_prunes_then_creates_and_reads_forwarding() {
+        let calls = RefCell::new(Vec::new());
+        let run = |script: &str| -> Result<String, String> {
+            calls.borrow_mut().push(script.to_string());
+            Ok(if script.contains("Get-NetIPInterface") {
+                "Disabled\n".to_string()
+            } else {
+                String::new()
+            })
+        };
+        let report = apply_plan(&run, &no_names, &plan(false));
+        assert_eq!(report.offer, vec![(range(), RuleOutcome::Applied)]);
+        assert_eq!(report.forwarding, Some(false));
+        assert_eq!(report.client, None);
+        let calls = calls.borrow();
+        assert!(calls[0].contains("StartsWith"), "{calls:?}");
+        assert!(calls[1].contains("New-NetNat"), "{calls:?}");
+        // Without a client, the routes of an earlier plan are taken away.
+        assert!(calls[2].contains("RouteMetric -eq 7373"), "{calls:?}");
+        assert!(calls[3].contains("Get-NetIPInterface"), "{calls:?}");
+    }
+
+    #[test]
+    fn a_failing_nat_is_that_ranges_failure() {
+        let run = |script: &str| -> Result<String, String> {
+            if script.contains("New-NetNat") {
+                Err("A NAT with this prefix already exists".into())
+            } else {
+                Ok(String::new())
+            }
+        };
+        let report = apply_plan(&run, &no_names, &plan(false));
+        let RuleOutcome::Failed(why) = &report.offer[0].1 else {
+            panic!("{report:?}");
+        };
+        assert!(why.contains("already exists"), "{why}");
+    }
+
+    fn no_names(_: &str) -> Vec<Ipv4Addr> {
+        Vec::new()
+    }
+
+    fn client_plan() -> ExitHostPlan {
+        ExitHostPlan {
+            interface: "tsun0".into(),
+            offer: Vec::new(),
+            client: true,
+            overlay: vec![range()],
+            bypass: vec![Ipv4Addr::new(138, 201, 61, 182)],
+            bypass_hosts: vec!["relay.example".into()],
+        }
+    }
+
+    #[test]
+    fn the_gateway_is_read_from_the_script_output() {
+        assert_eq!(
+            parse_gateway("12 192.168.1.1\r\n"),
+            Some((12, Ipv4Addr::new(192, 168, 1, 1)))
+        );
+        assert_eq!(parse_gateway(""), None);
+        assert_eq!(parse_gateway("12"), None);
+        assert_eq!(parse_gateway("12 gw"), None);
+        assert_eq!(parse_gateway("12 1.1.1.1 extra"), None);
+        let script = gateway_script("tsun0");
+        assert!(script.contains("-ne $alias"));
+        assert!(script.contains("-ne '0.0.0.0'"));
+    }
+
+    #[test]
+    fn bypass_routes_are_marked_host_routes_through_the_physical_gateway() {
+        let script = bypass_script(
+            12,
+            Ipv4Addr::new(192, 168, 1, 1),
+            &[Ipv4Addr::new(1, 2, 3, 4), Ipv4Addr::new(5, 6, 7, 8)],
+        );
+        assert!(script.contains("@('1.2.3.4', '5.6.7.8')"), "{script}");
+        assert!(script.contains("-InterfaceIndex 12 -NextHop '192.168.1.1'"));
+        assert!(script.contains("-RouteMetric 7373"));
+        assert!(script.contains("-PolicyStore ActiveStore"));
+        // Stale marked routes go first, and only /32 ones with our metric.
+        assert!(script.find("Remove-NetRoute").unwrap() < script.find("New-NetRoute").unwrap());
+        assert!(script.contains("RouteMetric -eq 7373"));
+        assert!(script.contains("EndsWith('/32')"));
+    }
+
+    #[test]
+    fn the_halves_go_through_the_overlay_and_ipv6_is_blackholed() {
+        let script = halves_script("tsun0");
+        assert!(script.contains("'0.0.0.0/1', '128.0.0.0/1'"));
+        assert!(script.contains("-InterfaceAlias $alias -NextHop '0.0.0.0'"));
+        assert!(script.contains("'::/1', '8000::/1'"));
+        assert!(script.contains("-PolicyStore ActiveStore"));
+        assert!(
+            !script.contains("0.0.0.0/0"),
+            "the default route is left alone"
+        );
+        assert!(halves_script("x'y").contains("'x''y'"));
+    }
+
+    #[test]
+    fn addresses_are_resolved_merged_and_cleaned() {
+        let resolve = |host: &str| -> Vec<Ipv4Addr> {
+            match host {
+                "relay.example" => vec![Ipv4Addr::new(9, 9, 9, 9), Ipv4Addr::new(1, 2, 3, 4)],
+                _ => Vec::new(),
+            }
+        };
+        let all = bypass_addresses(
+            &resolve,
+            &[
+                Ipv4Addr::new(1, 2, 3, 4),
+                Ipv4Addr::LOCALHOST,
+                Ipv4Addr::UNSPECIFIED,
+            ],
+            &["relay.example".into(), "gone.example".into()],
+        );
+        assert_eq!(
+            all,
+            vec![Ipv4Addr::new(1, 2, 3, 4), Ipv4Addr::new(9, 9, 9, 9)]
+        );
+    }
+
+    #[test]
+    fn the_bypass_is_written_before_the_halves_that_need_it() {
+        let calls = RefCell::new(Vec::new());
+        let run = |script: &str| -> Result<String, String> {
+            calls.borrow_mut().push(script.to_string());
+            Ok(if script.contains("Select-Object -First 1") {
+                "12 192.168.1.1\n".to_string()
+            } else {
+                String::new()
+            })
+        };
+        let resolve = |_: &str| vec![Ipv4Addr::new(9, 9, 9, 9)];
+        let report = apply_plan(&run, &resolve, &client_plan());
+        assert_eq!(report.client, Some(RuleOutcome::Applied));
+        let calls = calls.borrow();
+        let at = |needle: &str| calls.iter().position(|c| c.contains(needle)).unwrap();
+        assert!(at("Select-Object -First 1") < at("-RouteMetric 7373"));
+        assert!(at("-RouteMetric 7373") < at("'0.0.0.0/1', '128.0.0.0/1'"));
+        let bypass = &calls[at("-RouteMetric 7373")];
+        assert!(
+            bypass.contains("'9.9.9.9'") && bypass.contains("'138.201.61.182'"),
+            "{bypass}"
+        );
+    }
+
+    #[test]
+    fn nothing_goes_through_the_overlay_when_the_bypass_cannot_be_written() {
+        let run = |script: &str| -> Result<String, String> {
+            if script.contains("Select-Object -First 1") {
+                Ok("12 192.168.1.1".to_string())
+            } else if script.contains("-RouteMetric 7373") && script.contains("foreach ($ip") {
+                Err("Access is denied".to_string())
+            } else {
+                assert!(!script.contains("-NextHop '0.0.0.0'"), "{script}");
+                Ok(String::new())
+            }
+        };
+        let report = apply_plan(&run, &no_names, &client_plan());
+        assert_eq!(
+            report.client,
+            Some(RuleOutcome::Failed("Access is denied".into()))
+        );
+    }
+
+    #[test]
+    fn a_missing_gateway_is_a_failure_that_installs_no_route() {
+        let run = |script: &str| -> Result<String, String> {
+            assert!(!script.contains("New-NetRoute"), "{script}");
+            if script.contains("Select-Object -First 1") {
+                Err("the host has no default gateway outside the overlay".into())
+            } else {
+                Ok(String::new())
+            }
+        };
+        let report = apply_plan(&run, &no_names, &client_plan());
+        let Some(RuleOutcome::Failed(why)) = report.client else {
+            panic!("{report:?}");
+        };
+        assert!(why.contains("no default gateway"), "{why}");
+    }
+
+    #[test]
+    fn a_failed_halves_step_removes_what_was_written() {
+        let calls = RefCell::new(Vec::new());
+        let run = |script: &str| -> Result<String, String> {
+            calls.borrow_mut().push(script.to_string());
+            if script.contains("Select-Object -First 1") {
+                Ok("12 192.168.1.1".to_string())
+            } else if script.contains("'128.0.0.0/1'") && script.contains("New-NetRoute") {
+                Err("boom".to_string())
+            } else {
+                Ok(String::new())
+            }
+        };
+        let report = apply_plan(&run, &no_names, &client_plan());
+        assert!(matches!(report.client, Some(RuleOutcome::Failed(_))));
+        assert!(calls.borrow().last().unwrap().contains("Remove-NetRoute"));
+    }
+
+    #[test]
+    fn dropping_the_client_removes_its_routes_and_clearing_does_too() {
+        let calls = RefCell::new(Vec::new());
+        let run = |script: &str| -> Result<String, String> {
+            calls.borrow_mut().push(script.to_string());
+            Ok(String::new())
+        };
+        let report = apply_plan(&run, &no_names, &plan(false));
+        assert_eq!(report.client, None);
+        assert!(
+            calls
+                .borrow()
+                .iter()
+                .any(|c| c.contains("RouteMetric -eq 7373"))
+        );
+        let script = remove_client_script("tsun0");
+        assert!(script.contains("'0.0.0.0/1', '128.0.0.0/1', '::/1', '8000::/1'"));
+        assert!(script.contains("exit 0"));
+        // Only routes on our interface, or marked ours, are touched.
+        assert!(script.contains("-InterfaceAlias $alias"));
+        calls.borrow_mut().clear();
+        clear_all(&run, "tsun0");
+        assert!(
+            calls
+                .borrow()
+                .iter()
+                .any(|c| c.contains("RouteMetric -eq 7373"))
+        );
+    }
+
+    #[test]
+    fn clearing_prunes_everything_for_the_interface() {
+        let seen = RefCell::new(Vec::<String>::new());
+        let run = |script: &str| -> Result<String, String> {
+            seen.borrow_mut().push(script.to_string());
+            Ok(String::new())
+        };
+        clear_all(&run, "tsun0");
+        let seen = seen.borrow();
+        assert!(seen[0].contains("$keep = @()"));
+        assert!(seen[0].contains("'tsunagi-exit:tsun0:'"));
+    }
+}
@@ -164,6 +164,17 @@ pub struct Interface {
    rules_report: std::sync::Mutex<Option<BroadcastRulesReport>>,
    /// What the exit-node rules were last asked for, and what came of it.
    exit_state: std::sync::Mutex<ExitState>,
+    /// Where each network's runtime reaches its peers and relays outside the
+    /// overlay; read only by hosts that cannot exempt the agent from the
+    /// exit node's default route.
+    underlay: std::sync::Mutex<std::collections::HashMap<NetworkId, Underlay>>,
+}
+
+/// Underlay destinations one network's runtime currently depends on.
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+struct Underlay {
+    addresses: std::collections::BTreeSet<std::net::Ipv4Addr>,
+    hosts: std::collections::BTreeSet<String>,
 }

 /// The exit-node host rules as this interface last left them.
@@ -275,6 +286,7 @@ impl Interface {
            host_rules,
            rules_report: std::sync::Mutex::new(None),
            exit_state: std::sync::Mutex::new(ExitState::default()),
+            underlay: std::sync::Mutex::new(std::collections::HashMap::new()),
        })
    }

@@ -350,10 +362,20 @@ impl Interface {
            .collect();
        ranges.sort_by_key(|range| (range.base, range.prefix_len));
        ranges.dedup();
+        let client = self.routes.exit_via().is_some();
+        let overlay = self.routes.overlay_ranges();
+        let (bypass, bypass_hosts) = if client && exit.needs_bypass() {
+            self.underlay_targets(&overlay)
+        } else {
+            (Vec::new(), Vec::new())
+        };
        let wanted = ExitHostPlan {
            interface: self.name.clone(),
            offer: ranges,
-            client: self.routes.exit_via().is_some(),
+            client,
+            overlay,
+            bypass,
+            bypass_hosts,
        };

        let first = !std::mem::replace(&mut self.exit_state().cleaned, true);
@@ -398,9 +420,15 @@ impl Interface {
            tracing::warn!(
                interface = %self.name,
                "kernel forwarding is off for this interface, so nothing is forwarded for the \
-                 exit node yet: `sysctl -w net.ipv4.conf.{0}.forwarding=1` (or \
-                 `net.ipv4.ip_forward=1`), and set it in sysctl.d to keep it",
-                self.name
+                 exit node yet: {}",
+                if cfg!(target_os = "windows") {
+                    "`Set-NetIPInterface -Forwarding Enabled` on the interfaces involved"
+                } else if cfg!(target_os = "macos") {
+                    "`sysctl -w net.inet.ip.forwarding=1`, set again after every reboot"
+                } else {
+                    "`sysctl -w net.ipv4.ip_forward=1` (or `net.ipv4.conf.<interface>.forwarding=1`), \
+                     and set it in sysctl.d to keep it"
+                }
            );
        }
        match &report.client {
@@ -419,6 +447,68 @@ impl Interface {
        state.report = Some(report);
    }

+    /// Tells the interface where a network's runtime reaches peers and
+    /// relays outside the overlay. When the host needs those kept out of the
+    /// exit node's default route and the set changed, the rules follow.
+    pub async fn set_underlay(
+        &self,
+        network: NetworkId,
+        addresses: impl IntoIterator<Item = std::net::Ipv4Addr>,
+        hosts: impl IntoIterator<Item = String>,
+    ) {
+        let new = Underlay {
+            addresses: addresses.into_iter().collect(),
+            hosts: hosts.into_iter().collect(),
+        };
+        let changed = {
+            let mut map = match self.underlay.lock() {
+                Ok(guard) => guard,
+                Err(poisoned) => poisoned.into_inner(),
+            };
+            if new == Underlay::default() {
+                map.remove(&network).is_some()
+            } else {
+                map.insert(network, new.clone()) != Some(new)
+            }
+        };
+        let needed = changed
+            && self.routes.exit_via().is_some()
+            && self
+                .host_rules
+                .as_ref()
+                .and_then(|rules| rules.exit_rules())
+                .is_some_and(|exit| exit.needs_bypass());
+        if needed {
+            self.sync_exit_rules().await;
+        }
+    }
+
+    /// Every underlay destination worth keeping direct, minus anything that
+    /// is the overlay itself, loopback or link-local.
+    fn underlay_targets(
+        &self,
+        overlay: &[crate::state::Ipv4Range],
+    ) -> (Vec<std::net::Ipv4Addr>, Vec<String>) {
+        let map = match self.underlay.lock() {
+            Ok(guard) => guard,
+            Err(poisoned) => poisoned.into_inner(),
+        };
+        let mut addresses = std::collections::BTreeSet::new();
+        let mut hosts = std::collections::BTreeSet::new();
+        for underlay in map.values() {
+            addresses.extend(underlay.addresses.iter().copied().filter(|address| {
+                !address.is_loopback()
+                    && !address.is_link_local()
+                    && !address.is_multicast()
+                    && !address.is_unspecified()
+                    && !address.is_broadcast()
+                    && !overlay.iter().any(|range| range.contains(*address))
+            }));
+            hosts.extend(underlay.hosts.iter().cloned());
+        }
+        (addresses.into_iter().collect(), hosts.into_iter().collect())
+    }
+
    fn exit_state(&self) -> std::sync::MutexGuard<'_, ExitState> {
        match self.exit_state.lock() {
            Ok(guard) => guard,
@@ -443,7 +533,7 @@ impl Interface {
                "this overlay interface is not on the host (no TUN device), so there is \
                 nothing to forward to",
            ),
-            Some(false) => Some("exit nodes are only supported on Linux yet"),
+            Some(false) => Some("exit nodes are not supported on this platform yet"),
            Some(true) => None,
        };
        let failed = |detail: &str| RuleSetReport {
@@ -1336,6 +1426,65 @@ mod tests {
        assert_eq!(interface.counters().received, 1);
    }

+    #[tokio::test]
+    async fn the_underlay_reaches_the_rules_only_for_hosts_that_need_it_and_only_while_using_one() {
+        let rules = MockHostRules::new();
+        let (interface, routes, id) = managed_interface(&rules, false).await;
+        let relay = || vec!["relay.example".to_string()];
+        let direct = || {
+            vec![
+                Ipv4Addr::new(138, 201, 61, 182),
+                Ipv4Addr::new(10, 13, 37, 9), // the overlay itself
+                Ipv4Addr::LOCALHOST,
+                Ipv4Addr::new(169, 254, 1, 1),
+            ]
+        };
+
+        // A host that does not ask never gets them, so Linux and macOS do not
+        // re-apply their rules whenever a path moves.
+        routes.set_exit(id, using(peer(2)));
+        interface.set_underlay(id, direct(), relay()).await;
+        interface.sync_exit_rules().await;
+        let plan = rules.exit().installed().unwrap();
+        assert!(plan.client);
+        assert!(plan.bypass.is_empty() && plan.bypass_hosts.is_empty());
+
+        // A host that does gets the usable ones, and follows changes.
+        rules.exit().set_needs_bypass(true);
+        interface.set_underlay(id, direct(), relay()).await;
+        interface.sync_exit_rules().await;
+        let plan = rules.exit().installed().unwrap();
+        assert_eq!(plan.bypass, vec![Ipv4Addr::new(138, 201, 61, 182)]);
+        assert_eq!(plan.bypass_hosts, relay());
+        let applies = || {
+            rules
+                .exit()
+                .calls()
+                .iter()
+                .filter(|c| c.starts_with("apply"))
+                .count()
+        };
+        let before = applies();
+        interface.set_underlay(id, direct(), relay()).await;
+        assert_eq!(applies(), before, "an unchanged set is not applied again");
+        interface
+            .set_underlay(id, vec![Ipv4Addr::new(5, 6, 7, 8)], relay())
+            .await;
+        assert_eq!(applies(), before + 1);
+        assert_eq!(
+            rules.exit().installed().unwrap().bypass,
+            vec![Ipv4Addr::new(5, 6, 7, 8)]
+        );
+
+        // Not using an exit node: nothing to keep direct.
+        routes.set_exit(id, Default::default());
+        interface.sync_exit_rules().await;
+        interface
+            .set_underlay(id, vec![Ipv4Addr::new(1, 1, 1, 1)], relay())
+            .await;
+        assert!(rules.exit().installed().is_none());
+    }
+
    #[tokio::test]
    async fn the_exit_rules_follow_the_routing_table_and_leave_with_the_interface() {
        let rules = MockHostRules::new();
@@ -702,14 +702,37 @@ fn exit_default_route(index: Option<u32>) -> rtnetlink::packet_route::route::Rou
    builder.build()
 }

-/// Removes the exit node's routing rules and its table. Nothing there is
+/// The exit table's IPv6 default: nothing is reachable through it.
+///
+/// There is no IPv6 through an exit node, and what the ordinary route would do
+/// is send it out in the clear. This turns it into an immediate refusal, which
+/// is what makes applications fall back to IPv4.
+fn exit_blocking_route_v6() -> rtnetlink::packet_route::route::RouteMessage {
+    RouteMessageBuilder::<std::net::Ipv6Addr>::new()
+        .destination_prefix(std::net::Ipv6Addr::UNSPECIFIED, 0)
+        .table_id(EXIT_TABLE)
+        .kind(rtnetlink::packet_route::route::RouteType::Unreachable)
+        .build()
+}
+
+/// A host with no IPv6 at all has nothing to block, and says so this way.
+fn family_unsupported(err: &impl std::fmt::Display) -> bool {
+    let text = err.to_string();
+    text.contains("not supported") || text.contains("Address family")
+}
+
+/// Removes the exit node's routing rules and its tables. Nothing there is
 /// success: it also runs once at startup, for what a crashed run left.
 async fn clear_exit_client() -> Result<(), OverlayError> {
    with_netlink(|handle| async move { remove_exit_client(&handle).await }).await
 }

-async fn remove_exit_client(handle: &rtnetlink::Handle) -> Result<(), OverlayError> {
-    let mut rules = handle.rule().get(IpVersion::V4).execute();
+/// Deletes this agent's exit rules of one address family.
+async fn remove_exit_rules(
+    handle: &rtnetlink::Handle,
+    version: IpVersion,
+) -> Result<(), OverlayError> {
+    let mut rules = handle.rule().get(version).execute();
    let mut ours = Vec::new();
    while let Some(rule) = rules
        .try_next()
@@ -732,12 +755,32 @@ async fn remove_exit_client(handle: &rtnetlink::Handle) -> Result<(), OverlayErr
            }
        }
    }
+    Ok(())
+}
+
+async fn remove_exit_client(handle: &rtnetlink::Handle) -> Result<(), OverlayError> {
+    remove_exit_rules(handle, IpVersion::V4).await?;
    match handle.route().del(exit_default_route(None)).execute().await {
-        Ok(()) => Ok(()),
+        Ok(()) => {}
        // "No such process": no such route, which is the goal.
-        Err(err) if err.to_string().contains("No such") => Ok(()),
+        Err(err) if err.to_string().contains("No such") => {}
+        Err(err) => {
+            return Err(OverlayError::Unavailable(format!(
+                "cannot remove the exit node default route: {err}"
+            )));
+        }
+    }
+
+    match remove_exit_rules(handle, IpVersion::V6).await {
+        Ok(()) => {}
+        Err(OverlayError::Unavailable(reason)) if family_unsupported(&reason) => return Ok(()),
+        Err(err) => return Err(err),
+    }
+    match handle.route().del(exit_blocking_route_v6()).execute().await {
+        Ok(()) => Ok(()),
+        Err(err) if err.to_string().contains("No such") || family_unsupported(&err) => Ok(()),
        Err(err) => Err(OverlayError::Unavailable(format!(
-            "cannot remove the exit node default route: {err}"
+            "cannot remove the exit node IPv6 block: {err}"
        ))),
    }
 }
@@ -751,6 +794,9 @@ async fn remove_exit_client(handle: &rtnetlink::Handle) -> Result<(), OverlayErr
 /// ip rule add priority 5300 lookup 0x7473
 /// ```
 ///
+/// and the same for IPv6 with `ip -6 route replace unreachable default table
+/// 0x7473`, so that IPv6 is refused instead of leaving the ordinary way.
+///
 /// What an earlier call left is removed first, so repeating it is safe, and
 /// the rules go in last, so a failure part way never leaves a rule that
 /// sends traffic to a table with no route in it.
@@ -817,11 +863,81 @@ async fn set_exit_client(name: &str, uid: u32) -> Result<(), OverlayError> {
            .priority(EXIT_DEFAULT_PRIORITY)
            .execute()
            .await
-            .map_err(|err| fail("rule for the default route", err))
+            .map_err(|err| fail("rule for the default route", err))?;
+
+        set_exit_block_v6(&handle, uid).await
    })
    .await
 }

+/// The IPv6 half: an unreachable default for everything but the agent's own
+/// connections and the specific routes, which keep working.
+async fn set_exit_block_v6(handle: &rtnetlink::Handle, uid: u32) -> Result<(), OverlayError> {
+    let fail = |what: &str, err: rtnetlink::Error| {
+        OverlayError::Unavailable(format!("cannot add the exit node IPv6 {what}: {err}"))
+    };
+    if let Err(err) = handle
+        .route()
+        .add(exit_blocking_route_v6())
+        .replace()
+        .execute()
+        .await
+    {
+        // Without IPv6 there is nothing to leak.
+        return if family_unsupported(&err) {
+            Ok(())
+        } else {
+            Err(fail("block", err))
+        };
+    }
+
+    let mut bypass = handle
+        .rule()
+        .add()
+        .v6()
+        .table_id(MAIN_TABLE)
+        .action(RuleAction::ToTable)
+        .priority(EXIT_BYPASS_PRIORITY);
+    bypass
+        .message_mut()
+        .attributes
+        .push(RuleAttribute::UidRange(RuleUidRange {
+            start: uid,
+            end: uid,
+        }));
+    bypass
+        .execute()
+        .await
+        .map_err(|err| fail("rule for the agent's own traffic", err))?;
+
+    let mut specific = handle
+        .rule()
+        .add()
+        .v6()
+        .table_id(MAIN_TABLE)
+        .action(RuleAction::ToTable)
+        .priority(EXIT_SPECIFIC_PRIORITY);
+    specific
+        .message_mut()
+        .attributes
+        .push(RuleAttribute::SuppressPrefixLen(0));
+    specific
+        .execute()
+        .await
+        .map_err(|err| fail("rule for the specific routes", err))?;
+
+    handle
+        .rule()
+        .add()
+        .v6()
+        .table_id(EXIT_TABLE)
+        .action(RuleAction::ToTable)
+        .priority(EXIT_DEFAULT_PRIORITY)
+        .execute()
+        .await
+        .map_err(|err| fail("rule for the default route", err))
+}
+
 async fn configure_link(configure: &Configure) -> Result<(), OverlayError> {
    let name = configure.name.as_str();
    with_netlink(|handle| async move {
@@ -994,6 +1110,25 @@ mod tests {
        assert!(!is_exit_rule(&rule(5280, 100, vec![uid])));
    }

+    #[test]
+    fn the_ipv6_default_of_the_exit_table_refuses_instead_of_routing() {
+        let route = exit_blocking_route_v6();
+        assert_eq!(route.header.destination_prefix_length, 0);
+        let debug = format!("{route:?}");
+        assert!(debug.contains("Unreachable"), "{debug}");
+        assert!(debug.contains(&format!("Table({EXIT_TABLE})")), "{debug}");
+        assert!(!debug.contains("Oif"), "{debug}");
+    }
+
+    #[test]
+    fn a_host_without_ipv6_is_not_a_failure() {
+        assert!(family_unsupported(
+            &"Address family not supported by protocol"
+        ));
+        assert!(family_unsupported(&"Operation not supported"));
+        assert!(!family_unsupported(&"Operation not permitted"));
+    }
+
    #[test]
    fn the_default_route_of_the_exit_table_names_the_table_and_the_interface() {
        let route = exit_default_route(Some(7));
@@ -15,7 +15,7 @@
 //! Grant it with:
 //!
 //! ```text
-//! sudo setcap cap_net_admin,cap_net_bind_service+p /usr/local/bin/tsunagi
+//! sudo setcap cap_net_admin,cap_net_bind_service+p /usr/local/bin/tsng
 //! ```
 //!
 //! `+p` rather than `+ep`: with `+p` the capability is permitted but not
@@ -171,7 +171,7 @@ mod linux_impl {
            caps::raise(None, CapSet::Effective, Capability::CAP_NET_ADMIN).map_err(|err| {
                OverlayError::Unavailable(format!(
                    "cannot raise CAP_NET_ADMIN: {err}. {}",
-                    Privilege::how_to_grant("tsunagi")
+                    Privilege::how_to_grant("tsng")
                ))
            })?;
            Ok(Self { raised: true })
@@ -204,10 +204,8 @@ mod tests {

    #[test]
    fn the_grant_instructions_name_the_program() {
-        let text = Privilege::how_to_grant("/usr/local/bin/tsunagi");
-        assert!(
-            text.contains("setcap cap_net_admin,cap_net_bind_service+p /usr/local/bin/tsunagi")
-        );
+        let text = Privilege::how_to_grant("/usr/local/bin/tsng");
+        assert!(text.contains("setcap cap_net_admin,cap_net_bind_service+p /usr/local/bin/tsng"));
        assert!(text.contains("--no-tun"), "the fallback is offered too");
    }

@@ -293,6 +293,18 @@ impl RoutingTable {
        offers
    }

+    /// The range of every network in the table that has agreed one, sorted.
+    pub fn overlay_ranges(&self) -> Vec<Ipv4Range> {
+        let mut ranges: Vec<Ipv4Range> = self
+            .read()
+            .values()
+            .filter_map(|routes| routes.range)
+            .collect();
+        ranges.sort_by_key(|range| (range.base, range.prefix_len));
+        ranges.dedup();
+        ranges
+    }
+
    /// One network's exit-node settings and its range, if it is in the table.
    pub fn exit_settings(&self, network: NetworkId) -> Option<(ExitPolicy, Option<Ipv4Range>)> {
        self.read()
@@ -483,15 +483,15 @@ mod system {
        if denied {
            let hint = if cfg!(target_os = "windows") {
                "Open PowerShell or Command Prompt with 'Run as administrator' and \
-                 start `tsunagi up` there."
+                 start `tsng up` there."
            } else if cfg!(target_os = "linux") {
-                "Start `tsunagi up` as root or grant CAP_NET_ADMIN with \
+                "Start `tsng up` as root or grant CAP_NET_ADMIN with \
                 `sudo setcap cap_net_admin,cap_net_bind_service+p /path/to/tsunagi`."
            } else if cfg!(target_os = "macos") {
-                "Creating a utun interface needs root on macOS; start `tsunagi up` \
+                "Creating a utun interface needs root on macOS; start `tsng up` \
                 with `sudo`, or install it as a root LaunchDaemon."
            } else {
-                "Start `tsunagi up` with the privileges required to create a TUN interface."
+                "Start `tsng up` with the privileges required to create a TUN interface."
            };
            return OverlayError::Unavailable(format!(
                "permission denied while creating the TUN interface `{name}`. \
@@ -539,7 +539,7 @@ mod system {
            let message = open_error("tsun0", error).to_string();
            assert!(message.contains("permission denied"), "{message}");
            assert!(message.contains("tsun0"), "{message}");
-            assert!(message.contains("tsunagi up"), "{message}");
+            assert!(message.contains("tsng up"), "{message}");
            #[cfg(target_os = "windows")]
            assert!(message.contains("Run as administrator"), "{message}");
            #[cfg(target_os = "linux")]
@@ -0,0 +1,173 @@
+//! Scenario 1: deterministic network identity.
+//!
+//! The same name and secret must yield the same network space on different
+//! devices, and nothing else — hostname, device key, restart — may change it.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use tsunagi::Agent;
+use tsunagi::discovery::SharedMemoryDiscovery;
+use tsunagi::identity::{NetworkKeys, NetworkName, NetworkSecret};
+use tsunagi::testing::{TestAgent, config_with, network};
+
+#[test]
+fn derivation_is_a_pure_function_of_name_and_secret() {
+    let name = NetworkName::new("home").unwrap();
+    let other = NetworkName::new("Home").unwrap();
+    let secret = NetworkSecret::generate();
+    let other_secret = NetworkSecret::generate();
+
+    let a = NetworkKeys::derive(&name, &secret);
+    let b = NetworkKeys::derive(&name, &secret);
+    assert_eq!(a.network_id(), b.network_id());
+    assert_eq!(a.discovery_key(), b.discovery_key());
+    assert_eq!(a.descriptor(), b.descriptor());
+
+    // A different name is a different space. Names are used verbatim, so case
+    // matters.
+    assert_ne!(
+        a.network_id(),
+        NetworkKeys::derive(&other, &secret).network_id()
+    );
+    // A different secret is a different space.
+    assert_ne!(
+        a.network_id(),
+        NetworkKeys::derive(&name, &other_secret).network_id()
+    );
+    // Separated key material: the discovery key is not the network id.
+    assert_ne!(a.network_id().as_bytes(), a.discovery_key().as_bytes());
+}
+
+#[test]
+fn descriptor_carries_no_creator_time_or_secret() {
+    let name = NetworkName::new("shared").unwrap();
+    let secret = NetworkSecret::generate();
+    let first = NetworkKeys::derive(&name, &secret).descriptor();
+    let second = NetworkKeys::derive(&name, &secret).descriptor();
+
+    // Two independently built descriptors are byte identical: no random
+    // creator id, no creation timestamp, no owner signature.
+    assert_eq!(first.to_canonical_bytes(), second.to_canonical_bytes());
+
+    let encoded = first.to_canonical_bytes();
+    let secret_bytes = secret.encode();
+    assert!(
+        !encoded
+            .windows(secret_bytes.len())
+            .any(|window| window == secret_bytes.as_bytes()),
+        "the secret must never appear in the public descriptor"
+    );
+}
+
+#[test]
+fn names_are_validated_not_silently_normalised() {
+    assert!(NetworkName::new("").is_err());
+    assert!(NetworkName::new(" home").is_err(), "must not be trimmed");
+    assert!(NetworkName::new("home ").is_err(), "must not be trimmed");
+    assert!(NetworkName::new("ho\nme").is_err());
+    assert!(NetworkName::new("a".repeat(65)).is_err());
+    assert_eq!(NetworkName::new("home").unwrap().as_str(), "home");
+}
+
+#[test]
+fn secrets_are_not_truncated_or_normalised() {
+    let secret = NetworkSecret::generate();
+    let text = secret.encode();
+    let round_tripped = NetworkSecret::decode(&text).unwrap();
+    assert_eq!(secret, round_tripped);
+
+    // Short secrets are rejected rather than stretched.
+    assert!(NetworkSecret::from_bytes(vec![7u8; 15]).is_err());
+    assert!(NetworkSecret::from_bytes(vec![7u8; 16]).is_ok());
+
+    // Debug output must not leak the secret.
+    let rendered = format!("{secret:?}");
+    assert_eq!(rendered, "NetworkSecret(<redacted>)");
+}
+
+#[tokio::test]
+async fn different_devices_and_hostnames_agree_on_the_network_id() {
+    let discovery = SharedMemoryDiscovery::new();
+    let (name, secret) = network("agreement");
+
+    let a = TestAgent::spawn_with(|cfg| cfg.with_hostname("alpha"), &discovery)
+        .await
+        .unwrap();
+    let b = TestAgent::spawn_with(|cfg| cfg.with_hostname("beta"), &discovery)
+        .await
+        .unwrap();
+
+    assert_ne!(
+        a.agent.endpoint_id(),
+        b.agent.endpoint_id(),
+        "different devices must have different endpoint ids"
+    );
+    assert_eq!(a.agent.hostname(), "alpha");
+    assert_eq!(b.agent.hostname(), "beta");
+
+    let id_a = a.agent.join_network(&name, &secret).await.unwrap();
+    let id_b = b.agent.join_network(&name, &secret).await.unwrap();
+    assert_eq!(id_a, id_b);
+
+    a.agent.shutdown().await;
+    b.agent.shutdown().await;
+}
+
+#[tokio::test]
+async fn restart_keeps_the_device_and_network_identity() {
+    let discovery = SharedMemoryDiscovery::new();
+    let (name, secret) = network("stable");
+
+    let first = TestAgent::spawn(&discovery).await.unwrap();
+    let device_id = first.agent.endpoint_id();
+    let network_id = first.agent.join_network(&name, &secret).await.unwrap();
+    let dir = first.stop().await;
+
+    let reopened = Agent::spawn(config_with(dir.path(), &discovery))
+        .await
+        .unwrap();
+    assert_eq!(
+        reopened.endpoint_id(),
+        device_id,
+        "restarting must not mint a new peer"
+    );
+    let networks = reopened.list_networks().await.unwrap();
+    assert_eq!(networks.len(), 1);
+    assert_eq!(networks[0].network_id, network_id);
+    assert!(networks[0].active, "auto-start networks come back up");
+
+    reopened.shutdown().await;
+    drop(reopened);
+    drop(dir);
+}
+
+#[tokio::test]
+async fn changing_the_secret_keeps_the_device_identity() {
+    let discovery = SharedMemoryDiscovery::new();
+    let dir = tempfile::TempDir::new().unwrap();
+    let agent = Agent::spawn(config_with(dir.path(), &discovery))
+        .await
+        .unwrap();
+    let device_id = agent.endpoint_id();
+
+    let name = NetworkName::new("rotating").unwrap();
+    let old = agent
+        .join_network(&name, &NetworkSecret::generate())
+        .await
+        .unwrap();
+    let new = agent
+        .join_network(&name, &NetworkSecret::generate())
+        .await
+        .unwrap();
+
+    assert_ne!(old, new, "a new secret is a new network space");
+    assert_eq!(
+        agent.endpoint_id(),
+        device_id,
+        "rotating the network secret must not change the persistent iroh id"
+    );
+
+    agent.shutdown().await;
+    drop(agent);
+    drop(dir);
+}
@@ -8,7 +8,7 @@ license.workspace = true
 repository.workspace = true

 [dependencies]
-tsunagi = { path = "../tsunagi", version = "0.1.0" }
+tsunagi-core = { path = "../tsunagi-core", version = "0.1.0" }
 iroh.workspace = true
 tokio = { workspace = true, features = ["net", "io-util", "time", "sync", "macros"] }
 rustls = "0.23"
@@ -33,7 +33,7 @@ netdev = "0.46"
 caps = "0.5"

 [dev-dependencies]
-tsunagi = { path = "../tsunagi", features = ["testing"] }
+tsunagi-core = { path = "../tsunagi-core", features = ["testing"] }
 tempfile.workspace = true
 tracing-subscriber.workspace = true

@@ -15,7 +15,7 @@ path = "src/main.rs"
 # The agent control client and the report types: the GUI is a thin client over
 # the same local control interface the CLI uses, so it reuses these directly
 # and never re-implements the protocol.
-tsunagi = { path = "../tsunagi", version = "0.1.0" }
+tsunagi-core = { path = "../tsunagi-core", version = "0.1.0" }
 # Native, lightweight GUI — no web engine. eframe re-exports egui.
 eframe = { version = "0.31", default-features = false, features = ["default_fonts", "glow", "wayland", "x11"] }
 # Cross-platform tray icon + menu (Windows tray, macOS menu bar, Linux SNI).
@@ -81,6 +81,8 @@ impl App {
        }
        let builder = egui::ViewportBuilder::default()
            .with_title("About tsunagi")
+            .with_app_id(crate::icon::APP_ID)
+            .with_icon(crate::icon::window())
            .with_inner_size([560.0, 520.0])
            .with_min_inner_size([380.0, 280.0]);
        let socket = self.agent.socket();
@@ -112,6 +114,8 @@ impl App {
            let viewport_id = egui::ViewportId::from_hash_of(("devices", &id));
            let builder = egui::ViewportBuilder::default()
                .with_title(devices::title(network))
+                .with_app_id(crate::icon::APP_ID)
+                .with_icon(crate::icon::window())
                .with_inner_size([940.0, 540.0])
                .with_min_inner_size([480.0, 320.0]);
            let agent = &self.agent;
@@ -48,6 +48,21 @@ pub(crate) struct ExitConfirm {
    name: String,
    /// Stop using it, rather than start.
    stop: bool,
+    /// Asked in the main window, not in the devices window of the network.
+    main: bool,
+}
+
+impl ExitConfirm {
+    /// A question about stopping the exit node a network's tile shows.
+    pub(crate) fn stop_from_tile(network: &NetworkReport, peer_id: &str) -> Self {
+        Self {
+            network_id: network.network_id.clone(),
+            peer_id: peer_id.to_string(),
+            name: exit::name_of(network, peer_id),
+            stop: true,
+            main: true,
+        }
+    }
 }

 impl Device<'_> {
@@ -126,18 +141,24 @@ pub(crate) fn show(
                device_table(ui, unit, network, &devices, traffic, confirm);
            });
    });
-    confirm_exit(ctx, agent, confirm, &network.network_id);
+    confirm_exit(ctx, agent, confirm, Some(&network.network_id));
 }

 /// The confirmation for an exit-node choice, drawn in the window it was
 /// made in. Everything behind it is blocked until it is answered.
-fn confirm_exit(
+///
+/// `network_id` is the devices window the question is drawn in, or `None` for
+/// the main window; a question appears in the window it was asked in only.
+pub(crate) fn confirm_exit(
    ctx: &egui::Context,
    agent: &AgentClient,
    confirm: &mut Option<ExitConfirm>,
-    network_id: &str,
+    network_id: Option<&str>,
 ) {
-    let Some(pending) = confirm.as_ref().filter(|c| c.network_id == network_id) else {
+    let Some(pending) = confirm.as_ref().filter(|c| match network_id {
+        Some(id) => !c.main && c.network_id == id,
+        None => c.main,
+    }) else {
        return;
    };
    egui::Area::new(egui::Id::new("exit confirm backdrop"))
@@ -151,48 +172,31 @@ fn confirm_exit(
        });

    let (mut accepted, mut cancelled) = (false, false);
-    egui::Window::new(if pending.stop {
-        "Stop using exit node"
-    } else {
-        "Use as exit node"
-    })
-    .order(egui::Order::Foreground)
-    .collapsible(false)
-    .resizable(false)
-    .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
-    .show(ctx, |ui| {
-        ui.set_max_width(380.0);
-        if pending.stop {
-            ui.label(format!("Stop using {} as exit node?", pending.name));
-            ui.label("Your internet traffic will leave this device the ordinary way again.");
-        } else {
-            ui.label(
-                egui::RichText::new(format!(
-                    "Send ALL your internet traffic through {}?",
-                    pending.name
-                ))
-                .strong(),
-            );
-            ui.label(
-                "Everything not on this network will leave through that device, which can \
-                 see it.",
-            );
-        }
-        ui.add_space(8.0);
-        ui.horizontal(|ui| {
-            let label = if pending.stop {
-                "Stop"
+    egui::Window::new("Exit node")
+        .order(egui::Order::Foreground)
+        .collapsible(false)
+        .resizable(false)
+        .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
+        .show(ctx, |ui| {
+            ui.set_max_width(380.0);
+            ui.label(if pending.stop {
+                format!("Stop using {}?", pending.name)
            } else {
-                "Use as exit node"
-            };
-            if ui.button(label).clicked() {
-                accepted = true;
-            }
-            if ui.button("Cancel").clicked() {
-                cancelled = true;
-            }
+                format!("Use {} as exit node?", pending.name)
+            });
+            ui.add_space(8.0);
+            ui.horizontal(|ui| {
+                if ui
+                    .button(if pending.stop { "Stop" } else { "Use" })
+                    .clicked()
+                {
+                    accepted = true;
+                }
+                if ui.button("Cancel").clicked() {
+                    cancelled = true;
+                }
+            });
        });
-    });
    if accepted {
        agent.send(Command::SetExitNode {
            network_id: pending.network_id.clone(),
@@ -431,6 +435,7 @@ fn exit_cell(
            peer_id: device.id.to_string(),
            name: device.name(),
            stop: device.in_use,
+            main: false,
        });
    }
 }
Author	SHA1	Message	Date
UltradesuandClaude Sonnet 5.5	21328bf818	Windows installer: agent service, Wintun, tray and PATH in one setup program Running on Windows needed wintun.dll by hand, an elevated console and a manually started agent; without the DLL the agent silently ran with no interface (and so no exit node or routing at all). `tsng service` (hidden) runs the same `up` under the Windows service manager: src/winservice.rs registers with the SCM through the windows-service crate, reports Running/StopPending/Stopped, and maps a stop request onto the existing shutdown path (stop_signal). The only unsafe is the extern "system" entry point that define_windows_service! expands to, allowed in that module alone. A service has no console, so it logs to %ProgramData%\Tsunagi\logs\tsng.log (one older file kept past 8 MiB). Its state defaults to %ProgramData%\Tsunagi\{data,cache} and its control socket to the system-wide default every client already uses, so an unelevated `tsng status` and the tray find it. dist/windows/tsunagi.iss (Inno Setup) installs tsng.exe, the tray and Wintun 0.14.1 (pinned by SHA-256 in CI, licence text shipped), registers the "Tsunagi" service as LocalSystem with auto start and restart-on-failure, locks the data/cache/log directories to SYSTEM and Administrators by SID, and by tasks adds tsng to the PATH, an inbound firewall rule for the agent and a tray autostart. It stops the service, the tray and any hand-started agent before replacing files; uninstall removes the service, rule and PATH entry and asks before deleting the data (never on a silent uninstall). The release workflows (GitHub and Gitea) build it on the Windows job and publish tsunagi-setup-<version>-x86_64.exe. .cargo/config.toml links the MSVC C runtime statically so nothing needs a Visual C++ redistributable on a clean machine. Compatibility: an agent run by hand keeps its data in the user profile; the service has its own, so networks must be joined again once. Checks: cargo fmt --check, clippy -D warnings, cargo test --workspace passed on macOS (one unrelated wireguard restart test failed once under load and passed on three reruns). winservice.rs was cargo-checked for x86_64-pc-windows-msvc in a scratch crate; the whole tsunagi crate cannot be built for Windows from macOS (aws-lc needs the Windows SDK). The .iss script and the CI step were NOT compiled or run: no Inno Setup or Windows here. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-03 14:16:05 +01:00
UltradesuandClaude Sonnet 5.5	7c176e0b74	Exit nodes on Windows: use a member as exit node via destination bypass routes Choosing an exit node on Windows did nothing: the using side was refused, because Windows has no per-user routing and the agent's own traffic would loop into the tunnel it carries. Now the overlay interface gets 0.0.0.0/1 and 128.0.0.0/1 routes (and ::/1, 8000::/1 as an IPv6 blackhole), and every underlay address the agent talks to directly gets a /32 route through the physical default gateway, marked with route metric 7373 so stale ones are found and removed. Bypass routes are written before the halves and removed after them; a failed step removes what was written. All routes are in the active store. The addresses come from the runtime: each network runtime hands the interface the verified direct IPv4 paths of its control connections and the relay hosts in use (Interface::set_underlay, refreshed every dial round); relay names are resolved when the rules are applied. ExitHostRules::needs_bypass (true only on Windows) gates it, so Linux and macOS plans never carry or re-apply on path changes. ExitHostPlan gains `bypass` and `bypass_hosts`; networks leaving forget their entry. Limits: a path that appears after the last apply goes through the tunnel until the next apply; data-plane-only addresses are not collected separately (the data links ride the same iroh paths). Nothing was run on Windows. Checks: cargo fmt --check, cargo clippy --locked --workspace --all-targets -D warnings and cargo test --locked --workspace --all-targets passed on macOS; scripts and ordering are unit-tested with an injected runner and resolver, and Interface::set_underlay with the mock host. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-03 13:43:01 +01:00
UltradesuandClaude Sonnet 5.5	637915600e	Exit nodes on Windows: offer through WinNAT; using is refused Windows reported exit nodes as unsupported. The offering side now creates one WinNAT object per offered range (New-NetNat, named tsunagi-exit:<if>:<range>), prunes this interface's stale ones, reads (never writes) IPv4 forwarding of the overlay interface, and removes everything on clear. All values are single-quoted PowerShell literals. The using side is deliberately not implemented: Windows has no per-user or per-process routing, so the agent's own QUIC/relay traffic cannot be kept out of a default route through the overlay and would loop. It reports that reason and installs no route. The CLI/tray forwarding hint and the kernel-forwarding warning name the Windows command; docs/exit-node.md has a Windows section. Checks: cargo fmt --check, cargo clippy --locked --workspace --all-targets -D warnings and cargo test --locked --workspace --all-targets passed on macOS. The script builders and plan logic are unit-tested with an injected runner on every platform; nothing was run against a real Windows host or cross-compiled (no Windows target installed). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-03 12:33:22 +01:00
UltradesuandClaude Sonnet 5.5	47c5d38d0c	Exit nodes on macOS: pf anchor for offering, routes plus route-to for using The exit-node host rules existed only for Linux (iptables + policy routing); macOS reported "only supported on Linux yet". Offering: a pf anchor com.apple/tsunagi-exit-<if> (evaluated by the stock pf.conf) holds a nat rule per offered range and a pass-in rule. pf is enabled if needed and the pfctl -E reference is released when the rules are removed. net.inet.ip.forwarding is only read, never written, as on Linux. Using: macOS has no uidrange policy routing and the agent is root, so the overlay gets 0.0.0.0/1 and 128.0.0.0/1 routes and a pf route-to rule (matched by the agent's uid) sends the agent's own QUIC/relay traffic back out the physical interface, translated to its address. The rules are loaded before the routes, so a failed load never sends traffic into a tunnel it cannot exempt the agent from. IPv6 is blocked with rejecting ::/1 and 8000::/1 routes. ExitHostPlan gains `overlay` (every network range) for the route-to exemption; Linux ignores it. Known limits: the egress is the default route's interface at apply time; other root processes also bypass the tunnel. Forwarding hints in the CLI and tray name the macOS sysctl. The rule text and command order are unit-tested with a scripted host; nothing was run against a live pf/route (needs root), so the route-to + nat second-pass behaviour is unverified. Checks: cargo fmt --check, cargo clippy --locked --workspace --all-targets -D warnings and cargo test --locked --workspace --all-targets, run on macOS only. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-03 12:29:40 +01:00
Aleksandr BogomiakovandClaude	0cfc1cbafc	Tray state icon and window picture; firewall rules without the comment match; macOS app bundle The tray icon is dark red with no connection (or a lost exit node), blue when connected and green while an exit node is in use; the windows get the logo and an app id that matches the desktop entry, and the exit icon moves to the bottom left of the tile. Exit-node and broadcast firewall rules fall back to being recognised by their shape on kernels that have no `comment` match, as small router builds do. The macOS archive carries Tsunagi.app for the Homebrew cask, and the daemon plist opens the control socket to the admin group. Co-Authored-By: Claude <noreply@anthropic.com>	2026-10-03 03:30:47 +01:00
Aleksandr BogomiakovandClaude	c9c653023d	Release: build a static ARMv7 (armhf) Linux agent Adds armv7-unknown-linux-musleabihf to both release pipelines: the archive, a .deb for armhf and an Arch package for armv7h. Agent and CLI only, like the other non-x86_64 Linux builds. Co-Authored-By: Claude <noreply@anthropic.com>	2026-10-03 02:25:43 +01:00
Aleksandr BogomiakovandClaude	9966b50407	Rename the CLI package to tsunagi and its executable to tsng The command line package is now `tsunagi` and builds the `tsng` executable, which the packages, the unit, the installers and the workflows install and run. The core library package becomes `tsunagi-core`, keeping the library name `tsunagi`, so no code changes `use tsunagi::...`. Directories follow (crates/tsunagi-core, crates/tsunagi). Every command shown to a person is now `tsng ...`. Co-Authored-By: Claude <noreply@anthropic.com>	2026-10-03 02:14:43 +01:00
Aleksandr BogomiakovandClaude	bb38562b0a	Exit nodes: block IPv6 while one is in use; exit icon on the network tile IPv6 has no way through an exit node, so the same policy rules get an unreachable default for IPv6 instead of leaking it. The tray shows a green icon in the tile corner while an exit node is in use, with a one-line confirmation to stop it; confirmations are shortened. Co-Authored-By: Claude <noreply@anthropic.com>	2026-10-03 02:09:14 +01:00