coder
diff --git a/‎cli/vpndaemon_windows.go
+1-1 b/‎cli/vpndaemon_windows.go
+1-1
diff --git a/‎codersdk/wsjson/encoder.go
+1 b/‎codersdk/wsjson/encoder.go
+1
diff --git a/‎tailnet/conn.go
+17-7 b/‎tailnet/conn.go
+17-7
@@ -60,7 +60,7 @@ func (r *RootCmd) vpnDaemonRun() *serpent.Command {
 			defer pipe.Close()
 
 			logger.Info(ctx, "starting tunnel")
-			tunnel, err := vpn.NewTunnel(ctx, logger, pipe)
+			tunnel, err := vpn.NewTunnel(ctx, logger, pipe, vpn.NewClient())
 			if err != nil {
 				return xerrors.Errorf("create new tunnel for client: %w", err)
 			}
 
@@ -27,6 +27,7 @@ func (e *Encoder[T]) Encode(v T) error {
 	return nil
 }
 
+// nolint: revive // complains that Decoder has the same function name
 func (e *Encoder[T]) Close(c websocket.StatusCode) error {
 	return e.conn.Close(c, "")
 }
 
@@ -14,6 +14,7 @@ import (
 
 	"github.com/cenkalti/backoff/v4"
 	"github.com/google/uuid"
+	"github.com/tailscale/wireguard-go/tun"
 	"golang.org/x/xerrors"
 	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
@@ -113,6 +114,8 @@ type Options struct {
 	DNSConfigurator dns.OSConfigurator
 	// Router is optional, and is passed to the underlying wireguard engine.
 	Router router.Router
+	// TUNDev is optional, and is passed to the underlying wireguard engine.
+	TUNDev tun.Device
 }
 
 // TelemetrySink allows tailnet.Conn to send network telemetry to the Coder
@@ -143,6 +146,8 @@ func NewConn(options *Options) (conn *Conn, err error) {
 		return nil, xerrors.New("At least one IP range must be provided")
 	}
 
+	netns.SetEnabled(options.TUNDev != nil)
+
 	var telemetryStore *TelemetryStore
 	if options.TelemetrySink != nil {
 		var err error
@@ -187,6 +192,7 @@ func NewConn(options *Options) (conn *Conn, err error) {
 		SetSubsystem: sys.Set,
 		DNS:          options.DNSConfigurator,
 		Router:       options.Router,
+		Tun:          options.TUNDev,
 	})
 	if err != nil {
 		return nil, xerrors.Errorf("create wgengine: %w", err)
@@ -197,11 +203,14 @@ func NewConn(options *Options) (conn *Conn, err error) {
 		}
 	}()
 	wireguardEngine.InstallCaptureHook(options.CaptureHook)
-	dialer.UseNetstackForIP = func(ip netip.Addr) bool {
-		_, ok := wireguardEngine.PeerForIP(ip)
-		return ok
+	if options.TUNDev == nil {
+		dialer.UseNetstackForIP = func(ip netip.Addr) bool {
+			_, ok := wireguardEngine.PeerForIP(ip)
+			return ok
+		}
 	}
 
+	wireguardEngine = wgengine.NewWatchdog(wireguardEngine)
 	sys.Set(wireguardEngine)
 
 	magicConn := sys.MagicSock.Get()
@@ -244,11 +253,12 @@ func NewConn(options *Options) (conn *Conn, err error) {
 		return nil, xerrors.Errorf("create netstack: %w", err)
 	}
 
-	dialer.NetstackDialTCP = func(ctx context.Context, dst netip.AddrPort) (net.Conn, error) {
-		return netStack.DialContextTCP(ctx, dst)
+	if options.TUNDev == nil {
+		dialer.NetstackDialTCP = func(ctx context.Context, dst netip.AddrPort) (net.Conn, error) {
+			return netStack.DialContextTCP(ctx, dst)
+		}
+		netStack.ProcessLocalIPs = true
 	}
-	netStack.ProcessLocalIPs = true
-	wireguardEngine = wgengine.NewWatchdog(wireguardEngine)
 
 	cfgMaps := newConfigMaps(
 		options.Logger,
Original file line number	Diff line number	Diff line change
`@@ -60,7 +60,7 @@ func (r RootCmd) vpnDaemonRun() serpent.Command {`
`60`	`60`	`defer pipe.Close()`
`61`	`61`
`62`	`62`	`logger.Info(ctx, "starting tunnel")`
`63`		`- tunnel, err := vpn.NewTunnel(ctx, logger, pipe)`
	`63`	`+ tunnel, err := vpn.NewTunnel(ctx, logger, pipe, vpn.NewClient())`
`64`	`64`	`if err != nil {`
`65`	`65`	`return xerrors.Errorf("create new tunnel for client: %w", err)`
`66`	`66`	`}`
Original file line number	Diff line number	Diff line change
`@@ -27,6 +27,7 @@ func (e *Encoder[T]) Encode(v T) error {`
`27`	`27`	`return nil`
`28`	`28`	`}`
`29`	`29`
	`30`	`+// nolint: revive // complains that Decoder has the same function name`
`30`	`31`	`func (e *Encoder[T]) Close(c websocket.StatusCode) error {`
`31`	`32`	`return e.conn.Close(c, "")`
`32`	`33`	`}`