Merge branch 'openvpn-2.5'

26 files changed, 577 insertions, 493 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index af0fb1d27c..acef112297 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -44,6 +44,7 @@ Line wrap the file at 100 chars.                                              Th
 - Randomly select addresses to use for communicating with the API.
 - Bundle a list of API addresses to use instead of assuming that the primary address can be reached.
 - Rename CLI subcommand `mullvad relay set relay` to `mullvad relay set hostname`.
+- Upgrade OpenVPN from 2.4.9 to 2.5.0.
 
 #### Android
 - Remove the Quit button.
@@ -63,6 +64,9 @@ Line wrap the file at 100 chars.                                              Th
 - Set up routes for OpenVPN using the route manager instead of relying on OpenVPN.
 - Use rule-based routing and static routes.
 
+#### Windows
+- Use Wintun instead of the OpenVPN TAP driver for OpenVPN.
+
 ### Fixed
 - Fix missing map animation after selecting a new location in the desktop app.
 - Fix crash on older kernels which report a default route through the loopback interface.
@@ -104,6 +108,7 @@ Line wrap the file at 100 chars.                                              Th
   even if the tunnel was up when the crash occurred.
 - Add firewall rules for `mullvad-exclude`, i.e. split tunneling, that disallow all traffic in the
   tunnel other than non-custom DNS traffic. This prevents leaks into the tunnel.
+- Force OpenVPN to use TLS 1.3 or newer.
 
 #### Windows
 - Block all traffic received or sent before the BFE service and daemon service have started during
diff --git a/Cargo.lock b/Cargo.lock
index ae329be543..33f33fdc61 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -98,8 +98,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25f9db3b38af870bf7e5cc649167533b493928e50744e2c30ae350230b414670"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -109,8 +109,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "687c230d85c0a52504709705fc8a53e4a692b83a2184f03dae73e38e1e93a783"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -368,9 +368,9 @@ dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2",
- "quote 1.0.7",
+ "quote",
  "strsim 0.9.3",
- "syn 1.0.41",
+ "syn",
 ]
 
 [[package]]
@@ -380,8 +380,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
 dependencies = [
  "darling_core",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -396,12 +396,13 @@ dependencies = [
 
 [[package]]
 name = "derive-try-from-primitive"
-version = "0.1.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81dbd65eb15734b6d50dc6ac86f14f928462be0a5df6bda17761e909071ede5d"
+checksum = "302ccf094df1151173bb6f5a2282fcd2f45accd5eae1bdf82dcbfefbc501ad5c"
 dependencies = [
- "quote 0.3.15",
- "syn 0.11.11",
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -413,8 +414,8 @@ dependencies = [
  "darling",
  "derive_builder_core",
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -425,8 +426,8 @@ checksum = "2791ea3e372c8495c0bc2033991d76b512cd799d07491fbd6890124db9458bef"
 dependencies = [
  "darling",
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -497,9 +498,9 @@ checksum = "22deed3a8124cff5fa835713fa105621e43bbdc46690c3a6b68328a012d350d4"
 dependencies = [
  "proc-macro-error",
  "proc-macro2",
- "quote 1.0.7",
+ "quote",
  "rustversion",
- "syn 1.0.41",
+ "syn",
  "synstructure",
 ]
 
@@ -551,8 +552,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aa4da3c766cd7a0db8242e326e9e4e081edd567072893ed320008189715366a4"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
  "synstructure",
 ]
 
@@ -681,8 +682,8 @@ checksum = "d0b5a30a4328ab5473878237c447333c093297bded83a4983d10f4deea240d39"
 dependencies = [
  "proc-macro-hack",
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -1016,8 +1017,8 @@ checksum = "c78132fe420156f13b30518fcda9449b0ab8ae3b5584e8a1c53ce390fe770b44"
 dependencies = [
  "heck",
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -1638,8 +1639,9 @@ checksum = "77af24da69f9d9341038eba93a073b1fdaaa1b788221b00a69bce9e762cb32de"
 
 [[package]]
 name = "openvpn-plugin"
-version = "0.3.0"
-source = "git+https://github.com/mullvad/openvpn-plugin-rs?branch=auth-failed-event#c989d7a43de59e4207c31355be7952251273236b"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f433e2b9c41d166526a6737b96ebf015f27f5c94b95bad06295943c241601e40"
 dependencies = [
  "derive-try-from-primitive",
  "log 0.4.11",
@@ -1789,8 +1791,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2c0e815c3ee9a031fdf5af21c10aa17c573c9c6a566328d99e3936c34e36461f"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -1864,8 +1866,8 @@ checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
 dependencies = [
  "proc-macro-error-attr",
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
  "version_check",
 ]
 
@@ -1876,7 +1878,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
+ "quote",
  "version_check",
 ]
 
@@ -1938,8 +1940,8 @@ dependencies = [
  "anyhow",
  "itertools",
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -1977,18 +1979,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "608c156fd8e97febc07dc9c2e2c80bf74cfc6ef26893eae3daf8bc2bc94a4b7f"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
 name = "quote"
-version = "0.3.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a6e920b65c65f10b2ae65c831a81a073a89edd28c7cce89475bff467ab4167a"
-
-[[package]]
-name = "quote"
 version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aa563d17ecb180e500da1cfd2b028310ac758de548efdd203e18f283af693f37"
@@ -2199,8 +2195,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9bdc5e856e51e685846fb6c13a1f5e5432946c2c90501bdc76a1319f19e29da"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -2310,8 +2306,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f630a6370fd8e457873b4bd2ffdae75408bc291ba72be773772a4c2a065d9ae8"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -2420,44 +2416,24 @@ checksum = "343f3f510c2915908f155e94f17220b19ccfacf2a64a2a5d8004f2c3e311e7fd"
 
 [[package]]
 name = "syn"
-version = "0.11.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3b891b9015c88c576343b9b3e41c2c11a51c219ef067b264bd9c8aa9b441dad"
-dependencies = [
- "quote 0.3.15",
- "synom",
- "unicode-xid 0.0.4",
-]
-
-[[package]]
-name = "syn"
 version = "1.0.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6690e3e9f692504b941dc6c3b188fd28df054f7fb8469ab40680df52fdcc842b"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
+ "quote",
  "unicode-xid 0.2.1",
 ]
 
 [[package]]
-name = "synom"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a393066ed9010ebaed60b9eafa373d4b1baac186dd7e008555b0f702b51945b6"
-dependencies = [
- "unicode-xid 0.0.4",
-]
-
-[[package]]
 name = "synstructure"
 version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b834f2d66f734cb897113e34aaff2f1ab4719ca946f9a7358dba8f8064148701"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
  "unicode-xid 0.2.1",
 ]
 
@@ -2680,8 +2656,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd80fc12f73063ac132ac92aceea36734f04a1d93c1240c6944e23a3b8841793"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -2735,8 +2711,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0c3acc6aa564495a0f2e1d59fab677cd7f81a19994cfc7f3ad0e64301560389"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -2826,8 +2802,8 @@ checksum = "19970cf58f3acc820962be74c4021b8bbc8e8a1c4e3a02095d0aa60cde5f3633"
 dependencies = [
  "proc-macro2",
  "prost-build",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -3027,8 +3003,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "80e0ccfc3378da0cce270c946b676a376943f5cd16aeba64568e7939806f4ada"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -3109,12 +3085,6 @@ checksum = "36dff09cafb4ec7c8cf0023eb0b686cb6ce65499116a12201c9e11840ca01beb"
 
 [[package]]
 name = "unicode-xid"
-version = "0.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c1f860d7d29cf02cb2f3f359fd35991af3d30bac52c57d265a3c461074cb4dc"
-
-[[package]]
-name = "unicode-xid"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f7fe0bb3479651439c9112f72b6c505038574c9fbb575ed1bf3b797fa39dd564"
@@ -3220,8 +3190,8 @@ dependencies = [
  "lazy_static",
  "log 0.4.11",
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
  "wasm-bindgen-shared",
 ]
 
@@ -3231,7 +3201,7 @@ version = "0.2.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6b13312a745c08c469f0b292dd2fcd6411dba5f7160f593da6ef69b64e407038"
 dependencies = [
- "quote 1.0.7",
+ "quote",
  "wasm-bindgen-macro-support",
 ]
 
@@ -3242,8 +3212,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f249f06ef7ee334cc3b8ff031bfc11ec99d00f34d86da7498396dc1e3b1498fe"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -3415,7 +3385,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3f369ddb18862aba61aa49bf31e74d29f0f162dec753063200e1dc084345d16"
 dependencies = [
  "proc-macro2",
- "quote 1.0.7",
- "syn 1.0.41",
+ "quote",
+ "syn",
  "synstructure",
 ]
diff --git a/dist-assets/binaries b/dist-assets/binaries
-Subproject b82a3e9a7717b8b15c339bc78d4a2f3c6d90ea5
+Subproject 793ca61d9335f9a4342fe8624c9987bf21899ca
diff --git a/dist-assets/windows/installer.nsh b/dist-assets/windows/installer.nsh
index 80c4ba998b..47b3536244 100644
--- a/dist-assets/windows/installer.nsh
+++ b/dist-assets/windows/installer.nsh
@@ -12,8 +12,8 @@
 # Do not compare variables using the <> operator - broken
 #
 
-# TAP device hardware ID
-!define TAP_HARDWARE_ID "tapmullvad0901"
+!define WINTUN_POOL "Mullvad"
+!define WINTUN_ADAPTER "Mullvad"
 
 # "sc" exit code
 !define SERVICE_STARTED 0
@@ -24,6 +24,7 @@
 !define MULLVAD_SUCCESS 1
 
 # Return codes from driverlogic
+!define DL_ADAPTER_NOT_FOUND -2
 !define DL_GENERAL_ERROR -1
 !define DL_GENERAL_SUCCESS 0
 
@@ -48,31 +49,6 @@
 !define PERSISTENT_BLOCK_OUTBOUND_IPV4_FILTER_GUID "{79860c64-9a5e-48a3-b5f3-d64b41659aa5}"
 
 #
-# ExtractTapDriver
-#
-# Extract the correct driver for the current platform
-# placing it into $TEMP\tap-driver
-#
-!macro ExtractTapDriver
-
-	SetOutPath "$TEMP\tap-driver"
-
-	File "${BUILD_RESOURCES_DIR}\..\windows\driverlogic\bin\x64-Release\driverlogic.exe"
-	File "${BUILD_RESOURCES_DIR}\binaries\x86_64-pc-windows-msvc\tap-driver\*"
-
-	${If} ${AtLeastWin10}
-		File "${BUILD_RESOURCES_DIR}\binaries\x86_64-pc-windows-msvc\tap-driver\win10\*"
-	${ElseIf} ${AtLeastWin8}
-		File "${BUILD_RESOURCES_DIR}\binaries\x86_64-pc-windows-msvc\tap-driver\win8\*"
-	${Else}
-		File "${BUILD_RESOURCES_DIR}\binaries\x86_64-pc-windows-msvc\tap-driver\win7\*"
-	${EndIf}
-
-!macroend
-
-!define ExtractTapDriver '!insertmacro "ExtractTapDriver"'
-
-#
 # ExtractWintun
 #
 # Extract Wintun installer into $TEMP
@@ -80,7 +56,8 @@
 !macro ExtractWintun
 
 	SetOutPath "$TEMP"
-	File "${BUILD_RESOURCES_DIR}\binaries\x86_64-pc-windows-msvc\mullvad-wintun-amd64.msi"
+	File "${BUILD_RESOURCES_DIR}\binaries\x86_64-pc-windows-msvc\wintun.dll"
+	File "${BUILD_RESOURCES_DIR}\..\windows\driverlogic\bin\x64-Release\driverlogic.exe"
 
 !macroend
 
@@ -102,185 +79,87 @@
 !define ExtractMullvadSetup '!insertmacro "ExtractMullvadSetup"'
 
 #
-# RemoveBrandedTap
-#
-# Try to remove the Mullvad TAP adapter driver
-#
-!macro RemoveBrandedTap
-	Push $0
-	Push $1
-
-	nsExec::ExecToStack '"$TEMP\tap-driver\driverlogic.exe" remove ${TAP_HARDWARE_ID}'
-	Pop $0
-	Pop $1
-
-	Pop $1
-	Pop $0
-
-!macroend
-
-!define RemoveBrandedTap '!insertmacro "RemoveBrandedTap"'
-
-#
-# RemoveVanillaTap
+# RemoveWintun
 #
-# Try to remove the old Mullvad TAP adapter (with a non-unique hardware ID),
-# and uninstall the driver if it's not in use.
+# Try to remove Wintun
 #
-!macro RemoveVanillaTap
+!macro RemoveWintun
 	Push $0
 	Push $1
 
-	log::Log "RemoveVanillaTap()"
-
-	nsExec::ExecToStack '"$TEMP\tap-driver\driverlogic.exe" remove-vanilla-tap'
+	log::Log "RemoveWintun()"
 
+	nsExec::ExecToStack '"$TEMP\driverlogic.exe" wintun delete-pool-driver ${WINTUN_POOL}'
 	Pop $0
 	Pop $1
 
 	${If} $0 != ${DL_GENERAL_SUCCESS}
 		IntFmt $0 "0x%X" $0
-		StrCpy $R0 "Failed to remove vanilla TAP adapter: error $0"
+		StrCpy $R0 "Failed to remove Wintun pool: error $0"
 		log::LogWithDetails $R0 $1
-
-		Goto RemoveVanillaTap_return
+		Goto RemoveWintun_return_only
 	${EndIf}
 
-	log::Log "RemoveVanillaTap() completed successfully"
-
-	RemoveVanillaTap_return:
+	log::Log "RemoveWintun() completed successfully"
 
 	Push 0
 	Pop $R0
 
+	RemoveWintun_return_only:
+
 	Pop $1
 	Pop $0
 
 !macroend
 
-!define RemoveVanillaTap '!insertmacro "RemoveVanillaTap"'
+!define RemoveWintun '!insertmacro "RemoveWintun"'
 
 #
-# InstallTapDriver
+# InstallWintun
 #
-# Install OpenVPN TAP adapter driver
+# Create Wintun Mullvad adapter
 #
 # Returns: 0 in $R0 on success, otherwise an error message in $R0
 #
-!macro InstallTapDriver
+!macro InstallWintun
 
-	log::Log "InstallTapDriver()"
+	log::Log "InstallWintun()"
 
 	Push $0
 	Push $1
 
-	#
-	# Remove the old-ID Mullvad TAP, if it exists
-	#
-	${RemoveVanillaTap}
-
-	#
-	# Silently approve the certificate before installing the driver
-	#
-	${IfNot} ${AtLeastWin10}
-		log::Log "Adding OpenVPN certificate to the certificate store"
-
-		nsExec::ExecToStack '"$SYSDIR\certutil.exe" -f -addstore TrustedPublisher "$TEMP\tap-driver\driver.cer"'
-		Pop $0
-		Pop $1
-
-		${If} $0 != 0
-			StrCpy $R0 "Failed to add trusted publisher certificate: error $0"
-			log::LogWithDetails $R0 $1
-		${EndIf}
-	${EndIf}
-
-	log::Log "Creating new virtual adapter"
-	nsExec::ExecToStack '"$TEMP\tap-driver\driverlogic.exe" install "$TEMP\tap-driver\OemVista.inf"'
+	nsExec::ExecToStack '"$TEMP\driverlogic.exe" wintun adapter-exists ${WINTUN_POOL} ${WINTUN_ADAPTER}'
 
 	Pop $0
 	Pop $1
 
-	${If} $0 != ${DL_GENERAL_SUCCESS}
+	${If} $0 == ${DL_GENERAL_ERROR}
 		IntFmt $0 "0x%X" $0
-		StrCpy $R0 "Failed to create virtual adapter: error $0"
+		StrCpy $R0 "Failed to identify virtual adapter: error $0"
 		log::LogWithDetails $R0 $1
-		Goto InstallTapDriver_return
+		Goto InstallWintun_return
 	${EndIf}
 
-	log::Log "InstallTapDriver() completed successfully"
-
-	Push 0
-	Pop $R0
-
-	InstallTapDriver_return:
-
-	Pop $1
-	Pop $0
-
-!macroend
-
-!define InstallTapDriver '!insertmacro "InstallTapDriver"'
-
-#
-# RemoveWintun
-#
-# Try to remove Wintun
-#
-!macro RemoveWintun
-	Push $0
-	Push $1
-
-	log::Log "RemoveWintun()"
-
-	msiutil::SilentUninstall "$TEMP\mullvad-wintun-amd64.msi"
-	Pop $0
-	Pop $1
-
-	${If} $0 != ${MULLVAD_SUCCESS}
-		StrCpy $R0 "Failed to remove Wintun: $1"
-		log::Log $R0
-		Goto RemoveWintun_return_only
+	${If} $0 != ${DL_ADAPTER_NOT_FOUND}
+		log::Log "Found existing virtual adapter"
+		Goto InstallWintun_return_success
 	${EndIf}
 
-	log::Log "RemoveWintun() completed successfully"
-
-	Push 0
-	Pop $R0
-
-	RemoveWintun_return_only:
-
-	Pop $1
-	Pop $0
-
-!macroend
-
-!define RemoveWintun '!insertmacro "RemoveWintun"'
-
-#
-# InstallWintun
-#
-# Install Wintun driver
-#
-# Returns: 0 in $R0 on success, otherwise an error message in $R0
-#
-!macro InstallWintun
-
-	log::Log "InstallWintun()"
-
-	Push $0
-	Push $1
+	log::Log "Creating new virtual adapter"
+	nsExec::ExecToStack '"$TEMP\driverlogic.exe" wintun create-adapter ${WINTUN_POOL} ${WINTUN_ADAPTER}'
 
-	msiutil::SilentInstall "$TEMP\mullvad-wintun-amd64.msi"
 	Pop $0
 	Pop $1
 
-	${If} $0 != ${MULLVAD_SUCCESS}
-		StrCpy $R0 "Failed to install Wintun: $1"
-		log::Log $R0
+	${If} $0 != ${DL_GENERAL_SUCCESS}
+		IntFmt $0 "0x%X" $0
+		StrCpy $R0 "Failed to create virtual adapter: error $0"
+		log::LogWithDetails $R0 $1
 		Goto InstallWintun_return
 	${EndIf}
 
+	InstallWintun_return_success:
+
 	log::Log "InstallWintun() completed successfully"
 
 	Push 0
@@ -746,14 +625,6 @@
 	${RemoveRelayCache}
 	${RemoveApiAddressCache}
 
-	${ExtractTapDriver}
-	${InstallTapDriver}
-
-	${If} $R0 != 0
-		MessageBox MB_OK "Fatal error during driver installation: $R0"
-		Goto customInstall_abort_installation
-	${EndIf}
-
 	${ExtractWintun}
 	${InstallWintun}
 
@@ -890,10 +761,6 @@
 
 	${RemoveCLIFromEnvironPath}
 
-	# Remove the TAP adapter
-	${ExtractTapDriver}
-	${RemoveBrandedTap}
-
 	${If} $FullUninstall == 1
 		${ClearFirewallRules}
 		${ClearAccountHistory}
diff --git a/gui/src/main/daemon-rpc.ts b/gui/src/main/daemon-rpc.ts
index c7f4ce8608..ffb455365c 100644
--- a/gui/src/main/daemon-rpc.ts
+++ b/gui/src/main/daemon-rpc.ts
@@ -776,8 +776,8 @@ function convertFromTunnelStateErrorCause(
       return { reason: 'ipv6_unavailable' };
     case grpcTypes.ErrorState.Cause.START_TUNNEL_ERROR:
       return { reason: 'start_tunnel_error' };
-    case grpcTypes.ErrorState.Cause.TAP_ADAPTER_PROBLEM:
-      return { reason: 'tap_adapter_problem' };
+    case grpcTypes.ErrorState.Cause.VIRTUAL_ADAPTER_PROBLEM:
+      return { reason: 'virtual_adapter_problem' };
     case grpcTypes.ErrorState.Cause.SET_FIREWALL_POLICY_ERROR:
       return {
         reason: 'set_firewall_policy_error',
diff --git a/gui/src/shared/daemon-rpc-types.ts b/gui/src/shared/daemon-rpc-types.ts
index bac978f7d6..95d8758088 100644
--- a/gui/src/shared/daemon-rpc-types.ts
+++ b/gui/src/shared/daemon-rpc-types.ts
@@ -38,7 +38,7 @@ export type ErrorStateCause =
         | 'set_dns_error'
         | 'start_tunnel_error'
         | 'is_offline'
-        | 'tap_adapter_problem';
+        | 'virtual_adapter_problem';
     }
   | { reason: 'set_firewall_policy_error'; details: FirewallPolicyError }
   | { reason: 'tunnel_parameter_error'; details: TunnelParameterError }
diff --git a/gui/src/shared/notifications/error.ts b/gui/src/shared/notifications/error.ts
index d9fd12de1a..672dc27b94 100644
--- a/gui/src/shared/notifications/error.ts
+++ b/gui/src/shared/notifications/error.ts
@@ -117,10 +117,10 @@ function getMessage(errorDetails: IErrorState, accountExpiry?: string): string {
           'notifications',
           "Your device is offline. Try connecting when it's back online.",
         );
-      case 'tap_adapter_problem':
+      case 'virtual_adapter_problem':
         return messages.pgettext(
           'notifications',
-          'Unable to detect a working TAP adapter on this device. Try enabling it. Otherwise, please reinstall the app.',
+          'Unable to detect a working virtual adapter on this device. Try enabling it. Otherwise, please reinstall the app.',
         );
     }
   }
diff --git a/mullvad-cli/src/format.rs b/mullvad-cli/src/format.rs
index 92f6076e66..7070e322ac 100644
--- a/mullvad-cli/src/format.rs
+++ b/mullvad-cli/src/format.rs
@@ -138,7 +138,6 @@ fn error_state_to_string(error_state: &ErrorState) -> String {
             );
         }
         IsOffline => "This device is offline, no tunnels can be established",
-        TapAdapterProblem => "A problem with the TAP adapter has been detected",
         #[cfg(target_os = "android")]
         VpnPermissionDenied => "The Android VPN permission was denied when creating the tunnel",
         #[cfg(not(target_os = "android"))]
diff --git a/mullvad-daemon/src/management_interface.rs b/mullvad-daemon/src/management_interface.rs
index a19179a502..57d063c6a9 100644
--- a/mullvad-daemon/src/management_interface.rs
+++ b/mullvad-daemon/src/management_interface.rs
@@ -1370,8 +1370,8 @@ fn convert_state(state: TunnelState) -> types::TunnelState {
                         i32::from(ProtoErrorCause::TunnelParameterError)
                     }
                     ErrorStateCause::IsOffline => i32::from(ProtoErrorCause::IsOffline),
-                    ErrorStateCause::TapAdapterProblem => {
-                        i32::from(ProtoErrorCause::TapAdapterProblem)
+                    ErrorStateCause::VirtualAdapterProblem => {
+                        i32::from(ProtoErrorCause::VirtualAdapterProblem)
                     }
                     #[cfg(target_os = "android")]
                     ErrorStateCause::VpnPermissionDenied => {
diff --git a/mullvad-management-interface/proto/management_interface.proto b/mullvad-management-interface/proto/management_interface.proto
index 6d40e50d78..817d97cd95 100644
--- a/mullvad-management-interface/proto/management_interface.proto
+++ b/mullvad-management-interface/proto/management_interface.proto
@@ -96,7 +96,7 @@ message ErrorState {
 		START_TUNNEL_ERROR = 4;
 		TUNNEL_PARAMETER_ERROR = 5;
 		IS_OFFLINE = 6;
-		TAP_ADAPTER_PROBLEM = 7;
+		VIRTUAL_ADAPTER_PROBLEM = 7;
 		VPN_PERMISSION_DENIED = 8;
 	}
 
diff --git a/talpid-core/Cargo.toml b/talpid-core/Cargo.toml
index 5ea9a2fea7..d9e9b544a9 100644
--- a/talpid-core/Cargo.toml
+++ b/talpid-core/Cargo.toml
@@ -31,7 +31,7 @@ rand = "0.7"
 
 
 [target.'cfg(not(target_os="android"))'.dependencies]
-openvpn-plugin = { git = "https://github.com/mullvad/openvpn-plugin-rs", branch = "auth-failed-event", features = ["serde"] }
+openvpn-plugin = { version = "0.4", features = ["serde", "auth-failed-event"] }
 parity-tokio-ipc = "0.7"
 triggered = "0.1.1"
 tonic = "0.3.1"
diff --git a/talpid-core/src/firewall/windows.rs b/talpid-core/src/firewall/windows.rs
index 90f1d73c78..ac1b0b41d9 100644
--- a/talpid-core/src/firewall/windows.rs
+++ b/talpid-core/src/firewall/windows.rs
@@ -39,9 +39,9 @@ pub enum Error {
     #[error(display = "Failed to reset firewall policies")]
     ResettingPolicy(#[error(source)] FirewallPolicyError),
 
-    /// Failure to set TAP adapter metric
-    #[error(display = "Unable to set TAP adapter metric")]
-    SetTapMetric(#[error(source)] crate::winnet::Error),
+    /// Failure to set virtual adapter metric
+    #[error(display = "Unable to set virtual adapter metric")]
+    SetTunMetric(#[error(source)] crate::winnet::Error),
 }
 
 const WINFW_TIMEOUT_SECONDS: u32 = 2;
@@ -214,7 +214,7 @@ impl Firewall {
         };
 
         let metrics_set = winnet::ensure_best_metric_for_interface(&tunnel_metadata.interface)
-            .map_err(Error::SetTapMetric)?;
+            .map_err(Error::SetTunMetric)?;
 
         if metrics_set {
             debug!("Network interface metrics were changed");
diff --git a/talpid-core/src/process/openvpn.rs b/talpid-core/src/process/openvpn.rs
index e4172ff4ec..de5206a56b 100644
--- a/talpid-core/src/process/openvpn.rs
+++ b/talpid-core/src/process/openvpn.rs
@@ -30,7 +30,7 @@ static BASE_ARGUMENTS: &[&[&str]] = &[
     &["--sndbuf", "1048576"],
     &["--fast-io"],
     &["--cipher", "AES-256-CBC"],
-    &["--tls-version-min", "1.2"],
+    &["--tls-version-min", "1.3"],
     &["--verb", "3"],
     #[cfg(windows)]
     &[
@@ -45,15 +45,32 @@ static BASE_ARGUMENTS: &[&[&str]] = &[
     // The route manager is used to add the routes.
     #[cfg(target_os = "linux")]
     &["--route-noexec"],
+    #[cfg(windows)]
+    &["--ip-win32", "ipapi"],
 ];
 
-static ALLOWED_TLS1_2_CIPHERS: &[&str] = &[
-    "TLS-DHE-RSA-WITH-AES-256-GCM-SHA384",
-    "TLS-DHE-RSA-WITH-AES-256-CBC-SHA",
-];
 static ALLOWED_TLS1_3_CIPHERS: &[&str] =
     &["TLS_AES_256_GCM_SHA384", "TLS_CHACHA20_POLY1305_SHA256"];
 
+/// Tun driver to use, specified using `--windows-driver`.
+#[derive(Clone)]
+pub enum WindowsDriver {
+    /// TAP adapter driver
+    TapWindows6,
+    /// Wintun driver
+    Wintun,
+}
+
+impl WindowsDriver {
+    /// Return string to use with the `--windows-driver` option.
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            WindowsDriver::TapWindows6 => "tap-windows6",
+            WindowsDriver::Wintun => "wintun",
+        }
+    }
+}
+
 /// An OpenVPN process builder, providing control over the different arguments that the OpenVPN
 /// binary accepts.
 #[derive(Clone)]
@@ -70,6 +87,8 @@ pub struct OpenVpnCommand {
     log: Option<PathBuf>,
     tunnel_options: net::openvpn::TunnelOptions,
     proxy_settings: Option<net::openvpn::ProxySettings>,
+    #[cfg(windows)]
+    windows_driver: Option<WindowsDriver>,
     tunnel_alias: Option<OsString>,
     enable_ipv6: bool,
     proxy_port: Option<u16>,
@@ -92,6 +111,8 @@ impl OpenVpnCommand {
             log: None,
             tunnel_options: net::openvpn::TunnelOptions::default(),
             proxy_settings: None,
+            #[cfg(windows)]
+            windows_driver: None,
             tunnel_alias: None,
             enable_ipv6: true,
             proxy_port: None,
@@ -160,6 +181,13 @@ impl OpenVpnCommand {
         self
     }
 
+    /// Sets the driver to use for tunneling
+    #[cfg(windows)]
+    pub fn windows_driver(&mut self, driver: Option<WindowsDriver>) -> &mut Self {
+        self.windows_driver = driver;
+        self
+    }
+
     /// Sets the tunnel alias which will be used to identify a tunnel device that will be used by
     /// OpenVPN.
     pub fn tunnel_alias(&mut self, tunnel_alias: Option<OsString>) -> &mut Self {
@@ -249,6 +277,12 @@ impl OpenVpnCommand {
             args.push(tunnel_device.clone());
         }
 
+        #[cfg(windows)]
+        if let Some(ref windows_driver) = self.windows_driver {
+            args.push(OsString::from("--windows-driver"));
+            args.push(OsString::from(windows_driver.as_str()));
+        }
+
         args.extend(Self::tls_cipher_arguments().iter().map(OsString::from));
         args.extend(self.proxy_arguments().iter().map(OsString::from));
 
@@ -274,8 +308,6 @@ impl OpenVpnCommand {
 
     fn tls_cipher_arguments() -> Vec<String> {
         let mut args = vec![];
-        args.push("--tls-cipher".to_owned());
-        args.push(ALLOWED_TLS1_2_CIPHERS.join(":"));
         args.push("--tls-ciphersuites".to_owned());
         args.push(ALLOWED_TLS1_3_CIPHERS.join(":"));
         args
diff --git a/talpid-core/src/tunnel/mod.rs b/talpid-core/src/tunnel/mod.rs
index 81ca04519a..3e27b792c8 100644
--- a/talpid-core/src/tunnel/mod.rs
+++ b/talpid-core/src/tunnel/mod.rs
@@ -387,7 +387,7 @@ fn try_enabling_ipv6(tunnel_parameters: &TunnelParameters) -> Result<()> {
 
     let guid = match tunnel_parameters {
         TunnelParameters::OpenVpn(..) => {
-            let alias = crate::winnet::get_tap_interface_alias().map_err(Error::WinnetError)?;
+            let alias = crate::winnet::get_interface_alias().map_err(Error::WinnetError)?;
             guid_string =
                 crate::winnet::interface_alias_to_guid(&alias).map_err(Error::WinnetError)?;
             &guid_string
diff --git a/talpid-core/src/tunnel/openvpn.rs b/talpid-core/src/tunnel/openvpn.rs
index 54591565fb..dcd2268772 100644
--- a/talpid-core/src/tunnel/openvpn.rs
+++ b/talpid-core/src/tunnel/openvpn.rs
@@ -70,15 +70,15 @@ pub enum Error {
     #[error(display = "The OpenVPN event dispatcher exited unexpectedly")]
     EventDispatcherExited,
 
-    /// No TAP adapter was detected
+    /// No virtual adapter was detected
     #[cfg(windows)]
-    #[error(display = "No TAP adapter was detected")]
-    MissingTapAdapter,
+    #[error(display = "No virtual adapter was detected")]
+    MissingVirtualAdapter,
 
-    /// TAP adapter seems to be disabled
+    /// virtual adapter seems to be disabled
     #[cfg(windows)]
-    #[error(display = "The TAP adapter appears to be disabled")]
-    DisabledTapAdapter,
+    #[error(display = "The virtual adapter appears to be disabled")]
+    DisabledVirtualAdapter,
 
     /// OpenVPN process died unexpectedly
     #[error(display = "OpenVPN process died unexpectedly")]
@@ -510,10 +510,10 @@ impl<C: OpenVpnBuilder + 'static> OpenVpnMonitor<C> {
             if let Some(log_path) = self.log_path.take() {
                 if let Ok(log) = fs::read_to_string(log_path) {
                     if log.contains("There are no TAP-Windows adapters on this system") {
-                        return Error::MissingTapAdapter;
+                        return Error::MissingVirtualAdapter;
                     }
                     if log.contains("CreateFile failed on TAP device") {
-                        return Error::DisabledTapAdapter;
+                        return Error::DisabledVirtualAdapter;
                     }
                 }
             }
@@ -600,9 +600,12 @@ impl<C: OpenVpnBuilder + 'static> OpenVpnMonitor<C> {
             .enable_ipv6(params.generic_options.enable_ipv6)
             .ca(resource_dir.join("ca.crt"));
         #[cfg(windows)]
-        cmd.tunnel_alias(Some(
-            crate::winnet::get_tap_interface_alias().map_err(Error::WinnetError)?,
-        ));
+        {
+            cmd.tunnel_alias(Some(
+                crate::winnet::get_interface_alias().map_err(Error::WinnetError)?,
+            ));
+            cmd.windows_driver(Some(crate::process::openvpn::WindowsDriver::Wintun));
+        }
         if let Some(proxy_settings) = params.proxy.clone().take() {
             cmd.proxy_settings(proxy_settings);
         }
@@ -721,6 +724,7 @@ mod event_server {
     use parity_tokio_ipc::{Endpoint as IpcEndpoint, SecurityAttributes};
     use std::{
         collections::HashMap,
+        convert::TryFrom,
         pin::Pin,
         task::{Context, Poll},
     };
@@ -769,8 +773,10 @@ mod event_server {
 
             let request = request.into_inner();
 
-            let event_type = openvpn_plugin::EventType::try_from(request.event)
-                .ok_or(tonic::Status::invalid_argument("Unknown event type"))?;
+            let event_type =
+                openvpn_plugin::EventType::try_from(request.event).map_err(|event: i32| {
+                    tonic::Status::invalid_argument(format!("Unknown event type: {}", event))
+                })?;
 
             (self.on_event)(event_type, request.env);
 
diff --git a/talpid-core/src/tunnel_state_machine/connecting_state.rs b/talpid-core/src/tunnel_state_machine/connecting_state.rs
index 60f87787a2..bc59a1d812 100644
--- a/talpid-core/src/tunnel_state_machine/connecting_state.rs
+++ b/talpid-core/src/tunnel_state_machine/connecting_state.rs
@@ -154,18 +154,18 @@ impl ConnectingState {
                 error
                 @
                 tunnel::Error::OpenVpnTunnelMonitoringError(
-                    tunnel::openvpn::Error::DisabledTapAdapter,
+                    tunnel::openvpn::Error::DisabledVirtualAdapter,
                 )
                 | error
                 @
                 tunnel::Error::OpenVpnTunnelMonitoringError(
-                    tunnel::openvpn::Error::MissingTapAdapter,
+                    tunnel::openvpn::Error::MissingVirtualAdapter,
                 ) => {
                     warn!(
                         "{}",
-                        error.display_chain_with_msg("TAP adapter problem detected")
+                        error.display_chain_with_msg("Virtual adapter problem detected")
                     );
-                    Some(ErrorStateCause::TapAdapterProblem)
+                    Some(ErrorStateCause::VirtualAdapterProblem)
                 }
                 error => {
                     warn!(
@@ -416,12 +416,12 @@ impl TunnelState for ConnectingState {
                                     #[cfg(windows)]
                                     tunnel::Error::OpenVpnTunnelMonitoringError(
                                         tunnel::openvpn::Error::WinnetError(
-                                            crate::winnet::Error::GetTapAlias,
+                                            crate::winnet::Error::GetVirtualAdapterAlias,
                                         ),
                                     )
                                     | tunnel::Error::WinnetError(
-                                        crate::winnet::Error::GetTapAlias,
-                                    ) => ErrorStateCause::TapAdapterProblem,
+                                        crate::winnet::Error::GetVirtualAdapterAlias,
+                                    ) => ErrorStateCause::VirtualAdapterProblem,
                                     #[cfg(target_os = "android")]
                                     tunnel::Error::WireguardTunnelMonitoringError(
                                         tunnel::wireguard::Error::TunnelError(
diff --git a/talpid-core/src/winnet.rs b/talpid-core/src/winnet.rs
index 9fed90ac21..e78fd5f03b 100644
--- a/talpid-core/src/winnet.rs
+++ b/talpid-core/src/winnet.rs
@@ -41,9 +41,9 @@ pub enum Error {
     #[error(display = "Failed to read IPv6 status on the TAP network interface")]
     GetIpv6Status,
 
-    /// Failed to determine alias of TAP adapter.
-    #[error(display = "Failed to determine alias of TAP adapter")]
-    GetTapAlias,
+    /// Failed to determine alias of virtual adapter.
+    #[error(display = "Failed to determine alias of virtual adapter")]
+    GetVirtualAdapterAlias,
 
     /// Can't establish whether host is connected to a non-virtual network
     #[error(display = "Network connectivity undecideable")]
@@ -102,15 +102,15 @@ pub fn enable_ipv6_for_adapter(interface_guid: &str) -> Result<(), Error> {
     }
 }
 
-/// Dynamically determines the alias of the TAP adapter.
-pub fn get_tap_interface_alias() -> Result<OsString, Error> {
+/// Dynamically determines the alias of the virtual adapter.
+pub fn get_interface_alias() -> Result<OsString, Error> {
     let mut alias_ptr: *mut wchar_t = ptr::null_mut();
     let status = unsafe {
-        WinNet_GetTapInterfaceAlias(&mut alias_ptr as *mut _, Some(log_sink), logging_context())
+        WinNet_GetInterfaceAlias(&mut alias_ptr as *mut _, Some(log_sink), logging_context())
     };
 
     if !status {
-        return Err(Error::GetTapAlias);
+        return Err(Error::GetVirtualAdapterAlias);
     }
 
     let alias = unsafe { WideCString::from_ptr_str(alias_ptr) };
@@ -521,8 +521,8 @@ mod api {
             sink_context: *const u8,
         ) -> WinNetStatus;
 
-        #[link_name = "WinNet_GetTapInterfaceAlias"]
-        pub fn WinNet_GetTapInterfaceAlias(
+        #[link_name = "WinNet_GetInterfaceAlias"]
+        pub fn WinNet_GetInterfaceAlias(
             tunnel_interface_alias: *mut *mut wchar_t,
             sink: Option<LogSink>,
             sink_context: *const u8,
diff --git a/talpid-openvpn-plugin/Cargo.toml b/talpid-openvpn-plugin/Cargo.toml
index 2a10e462e2..29799c3322 100644
--- a/talpid-openvpn-plugin/Cargo.toml
+++ b/talpid-openvpn-plugin/Cargo.toml
@@ -17,7 +17,7 @@ env_logger = "0.7"
 parity-tokio-ipc = "0.7"
 tokio = { version = "0.2", features =  [ "rt-core" ] }
 
-openvpn-plugin = { git = "https://github.com/mullvad/openvpn-plugin-rs", branch = "auth-failed-event", features = ["serde", "log"] }
+openvpn-plugin = { version = "0.4", features = ["serde", "log", "auth-failed-event"] }
 talpid-types = { path = "../talpid-types" }
 
 tonic = "0.3.1"
diff --git a/talpid-types/src/tunnel.rs b/talpid-types/src/tunnel.rs
index c803a489a7..fd476e14c6 100644
--- a/talpid-types/src/tunnel.rs
+++ b/talpid-types/src/tunnel.rs
@@ -96,8 +96,8 @@ pub enum ErrorStateCause {
     TunnelParameterError(ParameterGenerationError),
     /// This device is offline, no tunnels can be established.
     IsOffline,
-    /// A problem with the TAP adapter has been detected.
-    TapAdapterProblem,
+    /// A problem with the virtual adapter has been detected.
+    VirtualAdapterProblem,
     /// The Android VPN permission was denied.
     #[cfg(target_os = "android")]
     VpnPermissionDenied,
@@ -177,7 +177,7 @@ impl fmt::Display for ErrorStateCause {
                 return write!(f, "Failure to generate tunnel parameters: {}", err);
             }
             IsOffline => "This device is offline, no tunnels can be established",
-            TapAdapterProblem => "A problem with the TAP adapter has been detected",
+            VirtualAdapterProblem => "A problem with the virtual adapter has been detected",
             #[cfg(target_os = "android")]
             VpnPermissionDenied => "The Android VPN permission was denied when creating the tunnel",
         };
diff --git a/windows/driverlogic/driverlogic.vcxproj b/windows/driverlogic/driverlogic.vcxproj
index fd9ba06616..5d78c90479 100644
--- a/windows/driverlogic/driverlogic.vcxproj
+++ b/windows/driverlogic/driverlogic.vcxproj
@@ -61,7 +61,7 @@
       <SDLCheck>true</SDLCheck>
       <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <ConformanceMode>true</ConformanceMode>
-      <AdditionalIncludeDirectories>$(ProjectDir)../../../../dist-assets/binaries/x86_64-pc-windows-msvc/;$(ProjectDir)../windows-libraries/src/;$(ProjectDir)../</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>$(ProjectDir)../../dist-assets/binaries/x86_64-pc-windows-msvc/;$(ProjectDir)../windows-libraries/src/;$(ProjectDir)../</AdditionalIncludeDirectories>
       <LanguageStandard>stdcpplatest</LanguageStandard>
       <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
     </ClCompile>
@@ -83,7 +83,7 @@
       <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <ConformanceMode>true</ConformanceMode>
       <LanguageStandard>stdcpplatest</LanguageStandard>
-      <AdditionalIncludeDirectories>$(ProjectDir)../../../../dist-assets/binaries/x86_64-pc-windows-msvc/;$(ProjectDir)../windows-libraries/src/;$(ProjectDir)../</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>$(ProjectDir)../../dist-assets/binaries/x86_64-pc-windows-msvc/;$(ProjectDir)../windows-libraries/src/;$(ProjectDir)../</AdditionalIncludeDirectories>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
     </ClCompile>
     <Link>
diff --git a/windows/driverlogic/src/driverlogic.cpp b/windows/driverlogic/src/driverlogic.cpp
index 989ee70cf5..acc601811b 100644
--- a/windows/driverlogic/src/driverlogic.cpp
+++ b/windows/driverlogic/src/driverlogic.cpp
@@ -6,6 +6,7 @@
 #include <string>
 #include <optional>
 #include <set>
+#include <filesystem>
 #include <libcommon/error.h>
 #include <libcommon/guid.h>
 #include <libcommon/memory.h>
@@ -20,21 +21,19 @@
 #include <cfgmgr32.h>
 #include <io.h>
 #include <fcntl.h>
+#include <wintun.h>
 
 
 namespace
 {
 
-constexpr wchar_t DEPRECATED_TAP_HARDWARE_ID[] = L"tap0901";
-constexpr wchar_t TAP_HARDWARE_ID[] = L"tapmullvad0901";
-constexpr wchar_t TAP_BASE_ALIAS[] = L"Mullvad";
-
 constexpr std::chrono::milliseconds REGISTRY_GET_TIMEOUT_MS{ 10000 };
 
 enum ReturnCodes
 {
 	GENERAL_SUCCESS = 0,
-	GENERAL_ERROR = -1
+	GENERAL_ERROR = -1,
+	ADAPTER_NOT_FOUND = -2
 };
 
 struct NetworkAdapter
@@ -451,7 +450,7 @@ void ForEachNetworkDevice(const std::optional<std::wstring> hwId, std::function<
 				//
 
 				std::wstringstream ss;
-				ss << L"Skipping TAP adapter due to exception caught while iterating: "
+				ss << L"Skipping virtual adapter due to exception caught while iterating: "
 					<< common::string::ToWide(e.what());
 				LogError(ss.str());
 				continue;
@@ -504,7 +503,76 @@ std::set<NetworkAdapter> GetNetworkAdapters(const std::optional<std::wstring> ha
 	return adapters;
 }
 
-void CreateTapDevice()
+void throwUpdateException(DWORD lastError, const char *operation)
+{
+	if (ERROR_DEVICE_INSTALLER_NOT_READY == lastError)
+	{
+		bool deviceInstallDisabled = false;
+
+		try
+		{
+			const auto key = common::registry::Registry::OpenKey(
+				HKEY_LOCAL_MACHINE,
+				L"SYSTEM\\CurrentControlSet\\Services\\DeviceInstall\\Parameters"
+			);
+			deviceInstallDisabled = (0 != key->readUint32(L"DeviceInstallDisabled"));
+		}
+		catch (...)
+		{
+		}
+
+		if (deviceInstallDisabled)
+		{
+			throw common::error::WindowsException(
+				"Device installs must be enabled to continue. "
+				"Enable them in the Local Group Policy editor, or "
+				"update the registry value DeviceInstallDisabled in "
+				"[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\DeviceInstall\\Parameters]",
+				lastError
+			);
+		}
+	}
+
+	THROW_SETUPAPI_ERROR(lastError, operation);
+}
+
+//
+// Broken adapters may use our "Mullvad" name, so find one that is not in use.
+// NOTE: Enumerating adapters first and picking the next free name is not sufficient,
+//       because the broken adapter may not be included.
+//
+void RenameAdapter(const std::wstring &guid, const std::wstring &baseName)
+{
+	common::network::Nci nci;
+
+	try
+	{
+		nci.setConnectionName(common::Guid::FromString(guid), baseName.c_str());
+		return;
+	}
+	catch (...)
+	{
+	}
+
+	for (int i = 1; i < 10; i++)
+	{
+		std::wstringstream ss;
+		ss << baseName << L"-" << i;
+
+		try
+		{
+			nci.setConnectionName(common::Guid::FromString(guid), ss.str().c_str());
+			return;
+		}
+		catch (...)
+		{
+		}
+	}
+
+	THROW_ERROR("Unable to rename network adapter");
+}
+
+void CreateNetDevice(const std::wstring &hardwareId, const std::optional<std::wstring> alias, bool installDeviceDriver)
 {
 	GUID classGuid = GUID_DEVCLASS_NET;
 
@@ -542,8 +610,8 @@ void CreateTapDevice()
 		deviceInfoSet,
 		&devInfoData,
 		SPDRP_HARDWAREID,
-		reinterpret_cast<const BYTE *>(TAP_HARDWARE_ID),
-		sizeof(TAP_HARDWARE_ID) - sizeof(L'\0')
+		reinterpret_cast<const BYTE *>(hardwareId.c_str()),
+		static_cast<DWORD>(sizeof(wchar_t) * hardwareId.size())
 	);
 
 	if (FALSE == status)
@@ -565,117 +633,82 @@ void CreateTapDevice()
 		THROW_SETUPAPI_ERROR(GetLastError(), "SetupDiCallClassInstaller");
 	}
 
-	Log(L"Created new TAP adapter successfully");
-}
-
-void UpdateTapDriver(const std::wstring &infPath)
-{
-	Log(L"Attempting to install new driver");
-
-	DWORD installFlags = 0;
-	BOOL rebootRequired = FALSE;
+	Log(L"Created new network adapter successfully");
 
-ATTEMPT_UPDATE:
-
-	auto result = UpdateDriverForPlugAndPlayDevicesW(
-		nullptr,
-		TAP_HARDWARE_ID,
-		infPath.c_str(),
-		installFlags,
-		&rebootRequired
-	);
-
-	if (FALSE == result)
+	if (installDeviceDriver)
 	{
-		const auto lastError = GetLastError();
-
-		if (ERROR_NO_MORE_ITEMS == lastError
-			&& (installFlags ^ INSTALLFLAG_FORCE))
-		{
-			Log(L"Driver update failed. Attempting forced install.");
-			installFlags |= INSTALLFLAG_FORCE;
+		BOOL rebootRequired = FALSE;
 
-			goto ATTEMPT_UPDATE;
-		}
-
-		if (ERROR_DEVICE_INSTALLER_NOT_READY == lastError)
+		if (FALSE == DiInstallDevice(
+			nullptr,
+			deviceInfoSet,
+			&devInfoData,
+			nullptr,
+			0,
+			&rebootRequired
+		))
 		{
-			bool deviceInstallDisabled = false;
-
-			try
-			{
-				const auto key = common::registry::Registry::OpenKey(
-					HKEY_LOCAL_MACHINE,
-					L"SYSTEM\\CurrentControlSet\\Services\\DeviceInstall\\Parameters"
-				);
-				deviceInstallDisabled = (0 != key->readUint32(L"DeviceInstallDisabled"));
-			}
-			catch (...)
-			{
-			}
-
-			if (deviceInstallDisabled)
-			{
-				throw common::error::WindowsException(
-					"Device installs must be enabled to continue. "
-					"Enable them in the Local Group Policy editor, or "
-					"update the registry value DeviceInstallDisabled in "
-					"[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\DeviceInstall\\Parameters]",
-					lastError
-				);
-			}
+			throwUpdateException(GetLastError(), "DiInstallDevice");
 		}
 
-		THROW_SETUPAPI_ERROR(lastError, "UpdateDriverForPlugAndPlayDevicesW");
+		std::wstringstream ss;
+		ss << L"Installed driver on device. Reboot required: "
+			<< rebootRequired;
+		Log(ss.str());
 	}
 
-	//
-	// Driver successfully installed or updated
-	//
-
-	std::wstringstream ss;
-	ss << L"TAP driver update complete. Reboot required: "
-		<< rebootRequired;
-	Log(ss.str());
+	if (alias.has_value())
+	{
+		RenameAdapter(
+			GetNetCfgInstanceId(deviceInfoSet, devInfoData),
+			alias.value()
+		);
+	}
 }
 
-//
-// Broken adapters may use our "Mullvad" name, so find one that is not in use.
-// NOTE: Enumerating adapters first and picking the next free name is not sufficient,
-//       because the broken TAP may not be included.
-//
-void RenameAdapterToMullvad(const NetworkAdapter &adapter)
+std::wstring FindFreeAdapterAlias(const std::set<NetworkAdapter> &adapters, const std::wstring &baseName)
 {
-	common::network::Nci nci;
-
-	try
+	if (adapters.empty())
 	{
-		nci.setConnectionName(common::Guid::FromString(adapter.guid), TAP_BASE_ALIAS);
-		return;
+		return baseName;
 	}
-	catch (...)
+
+	auto findByAlias = [](const std::set<NetworkAdapter> &adapters, const std::wstring &alias)
 	{
+		const auto it = std::find_if(adapters.begin(), adapters.end(), [&alias](const NetworkAdapter &candidate)
+		{
+			return 0 == _wcsicmp(candidate.alias.c_str(), alias.c_str());
+		});
+
+		return it;
+	};
+
+	const auto foundAdapter = findByAlias(adapters, baseName);
+
+	if (adapters.end() == foundAdapter)
+	{
+		return baseName;
 	}
 
-	for (int i = 1; i < 10; i++)
+	for (auto i = 1; i < 100; ++i)
 	{
 		std::wstringstream ss;
-		ss << TAP_BASE_ALIAS << L"-" << i;
 
-		try
-		{
-			nci.setConnectionName(common::Guid::FromString(adapter.guid), ss.str().c_str());
-			return;
-		}
-		catch (...)
+		ss << baseName << L"-" << i;
+
+		const auto alias = ss.str();
+		const auto nextAdapter = findByAlias(adapters, alias);
+
+		if (adapters.end() == nextAdapter)
 		{
+			return alias;
 		}
 	}
 
-	THROW_ERROR("Exhausted TAP adapter namespace");
+	THROW_ERROR("Cannot find an unused adapter alias")
 }
 
-std::optional<NetworkAdapter> FindMullvadAdapter(const std::set<NetworkAdapter> &tapAdapters)
+std::optional<NetworkAdapter> FindAdapterByAlias(const std::set<NetworkAdapter> &tapAdapters, const std::wstring &baseName)
 {
 	if (tapAdapters.empty())
 	{
@@ -683,7 +716,7 @@ std::optional<NetworkAdapter> FindMullvadAdapter(const std::set<NetworkAdapter>
 	}
 
 	//
-	// Look for TAP adapter with alias "Mullvad".
+	// Look for TAP adapter with aliases starting with baseName.
 	//
 
 	auto findByAlias = [](const std::set<NetworkAdapter> &adapters, const std::wstring &alias)
@@ -696,7 +729,7 @@ std::optional<NetworkAdapter> FindMullvadAdapter(const std::set<NetworkAdapter>
 		return it;
 	};
 
-	const auto firstMullvadAdapter = findByAlias(tapAdapters, TAP_BASE_ALIAS);
+	const auto firstMullvadAdapter = findByAlias(tapAdapters, baseName);
 
 	if (tapAdapters.end() != firstMullvadAdapter)
 	{
@@ -711,7 +744,7 @@ std::optional<NetworkAdapter> FindMullvadAdapter(const std::set<NetworkAdapter>
 	{
 		std::wstringstream ss;
 
-		ss << TAP_BASE_ALIAS << L"-" << i;
+		ss << baseName << L"-" << i;
 
 		const auto alias = ss.str();
 
@@ -726,30 +759,18 @@ std::optional<NetworkAdapter> FindMullvadAdapter(const std::set<NetworkAdapter>
 	return std::nullopt;
 }
 
-NetworkAdapter FindBrandedTap()
+bool RemoveNetDevice(const std::wstring &tapHardwareId, const std::wstring &guid)
 {
-	std::set<NetworkAdapter> added = GetNetworkAdapters(TAP_HARDWARE_ID);
-
-	if (added.empty())
-	{
-		THROW_ERROR("Could not identify TAP");
-	}
-	else if (added.size() > 1)
-	{
-		LogAdapters(L"Enumerable network TAP adapters", added);
-
-		THROW_ERROR("Identified more TAP adapters than expected");
-	}
-
-	return *added.begin();
-}
+	bool deletedAdapter = false;
 
-void RemoveTapDriver(const std::wstring &tapHardwareId)
-{
-	ForEachNetworkDevice(tapHardwareId, [](HDEVINFO devInfo, const SP_DEVINFO_DATA &devInfoData) {
+	ForEachNetworkDevice(tapHardwareId, [&](HDEVINFO devInfo, const SP_DEVINFO_DATA &devInfoData) {
 		try
 		{
-			DeleteDevice(devInfo, devInfoData);
+			if (0 == GetNetCfgInstanceId(devInfo, devInfoData).compare(guid))
+			{
+				deletedAdapter = DeleteDevice(devInfo, devInfoData);
+				return false;
+			}
 		}
 		catch (const std::exception & e)
 		{
@@ -758,59 +779,222 @@ void RemoveTapDriver(const std::wstring &tapHardwareId)
 			//
 
 			std::wstringstream ss;
-			ss << L"Skipping TAP adapter due to exception caught while iterating: "
+			ss << L"Skipping virtual adapter due to exception caught while iterating: "
 				<< common::string::ToWide(e.what());
 			LogError(ss.str());
 		}
 		return true;
 	});
+
+	return deletedAdapter;
 }
 
-void DeleteVanillaMullvadAdapter()
+void RemoveNetAdapterByAlias(const std::wstring &hardwareId, const std::wstring &baseName)
 {
-	auto tapAdapters = GetNetworkAdapters(DEPRECATED_TAP_HARDWARE_ID);
-	std::optional<NetworkAdapter> mullvadAdapter = FindMullvadAdapter(tapAdapters);
+	auto tapAdapters = GetNetworkAdapters(hardwareId);
+	std::optional<NetworkAdapter> adapter = FindAdapterByAlias(tapAdapters, baseName);
 
-	if (!mullvadAdapter.has_value())
+	if (!adapter.has_value())
 	{
 		return;
 	}
 
-	const auto mullvadGuid = mullvadAdapter.value().guid;
-	bool deletedAdapter = false;
+	const auto guid = adapter.value().guid;
 
 	//
-	// Enumerate over all network devices with the hardware ID DEPRECATED_TAP_HARDWARE_ID,
+	// Enumerate over all network devices with the hardware ID,
 	// and delete any adapter whose GUID matches that of the "Mullvad" adapter.
 	//
 
-	ForEachNetworkDevice(DEPRECATED_TAP_HARDWARE_ID, [&](HDEVINFO devInfo, const SP_DEVINFO_DATA &devInfoData) {
+	if (!RemoveNetDevice(hardwareId, guid))
+	{
+		THROW_ERROR("The virtual adapter could not be removed");
+	}
+}
+
+std::filesystem::path GetCurrentModulePath()
+{
+	std::vector<wchar_t> pathBuffer;
+
+	SetLastError(ERROR_SUCCESS);
+
+	size_t nextCapacity = 256;
+
+	do
+	{
+		pathBuffer.reserve(nextCapacity);
+
+		const auto writtenChars = GetModuleFileNameW(nullptr, &pathBuffer[0], static_cast<DWORD>(pathBuffer.capacity()));
+
+		if (0 == writtenChars)
+		{
+			THROW_WINDOWS_ERROR(GetLastError(), "GetModuleFileNameW");
+		}
+
+		pathBuffer.resize(writtenChars);
+
+		nextCapacity = 2 * pathBuffer.capacity();
+	} while (ERROR_INSUFFICIENT_BUFFER == GetLastError());
+
+	return std::filesystem::path(pathBuffer.begin(), pathBuffer.end());
+}
+
+class WintunDll
+{
+public:
+
+	WintunDll() : dllHandle(nullptr)
+	{
+		auto wintunPath = GetCurrentModulePath().replace_filename(L"wintun.dll");
+		dllHandle = LoadLibraryExW(wintunPath.c_str(), nullptr, LOAD_WITH_ALTERED_SEARCH_PATH);
+
+		if (nullptr == dllHandle)
+		{
+			THROW_WINDOWS_ERROR(GetLastError(), "LoadLibraryExW");
+		}
+
 		try
 		{
-			if (0 == GetNetCfgInstanceId(devInfo, devInfoData).compare(mullvadGuid))
+			createAdapter = getProcAddressOrThrow<WINTUN_CREATE_ADAPTER_FUNC>("WintunCreateAdapter");
+			openAdapter = getProcAddressOrThrow<WINTUN_OPEN_ADAPTER_FUNC>("WintunOpenAdapter");
+			freeAdapter = getProcAddressOrThrow<WINTUN_FREE_ADAPTER_FUNC>("WintunFreeAdapter");
+			deletePoolDriver = getProcAddressOrThrow<WINTUN_DELETE_POOL_DRIVER_FUNC>("WintunDeletePoolDriver");
+		}
+		catch (...)
+		{
+			FreeLibrary(dllHandle);
+			throw;
+		}
+	}
+
+	~WintunDll()
+	{
+		if (nullptr != dllHandle)
+		{
+			FreeLibrary(dllHandle);
+		}
+	}
+
+	WINTUN_CREATE_ADAPTER_FUNC createAdapter;
+	WINTUN_OPEN_ADAPTER_FUNC openAdapter;
+	WINTUN_FREE_ADAPTER_FUNC freeAdapter;
+	WINTUN_DELETE_POOL_DRIVER_FUNC deletePoolDriver;
+
+private:
+
+	template<typename T>
+	T getProcAddressOrThrow(const char *procName)
+	{
+		const T result = reinterpret_cast<T>(GetProcAddress(dllHandle, procName));
+		if (nullptr == result)
+		{
+			THROW_WINDOWS_ERROR(GetLastError(), "GetProcAddress");
+		}
+		return result;
+	}
+
+	HMODULE dllHandle;
+};
+
+int HandleWintunCommands(int argc, const wchar_t *argv[])
+{
+	WintunDll wintun;
+
+	if (argc < 3)
+	{
+		goto INVALID_ARGUMENTS;
+	}
+
+	if (0 == _wcsicmp(argv[2], L"create-adapter"))
+	{
+		if (argc < 5)
+		{
+			goto INVALID_ARGUMENTS;
+		}
+
+		const wchar_t *pool = argv[3];
+		const wchar_t *adapter = argv[4];
+
+		GUID guidObject;
+		const GUID *requestGuid = nullptr;
+		if (argc >= 6)
+		{
+			guidObject = common::Guid::FromString(argv[5]);
+			requestGuid = &guidObject;
+		}
+
+		const auto adapters = GetNetworkAdapters(std::nullopt);
+		const auto freeAdapterName = FindFreeAdapterAlias(adapters, adapter);
+
+		const auto handle = wintun.createAdapter(
+			pool,
+			freeAdapterName.c_str(),
+			requestGuid,
+			nullptr
+		);
+
+		if (nullptr == handle)
+		{
+			const auto status = GetLastError();
+			if (ERROR_FILE_NOT_FOUND == status)
 			{
-				deletedAdapter = DeleteDevice(devInfo, devInfoData);
-				return false;
+				return ADAPTER_NOT_FOUND;
+			}
+			else
+			{
+				THROW_WINDOWS_ERROR(status, "wintun.createAdapter");
 			}
 		}
-		catch (const std::exception & e)
+		wintun.freeAdapter(handle);
+	}
+	else if (0 == _wcsicmp(argv[2], L"delete-pool-driver"))
+	{
+		if (4 != argc)
 		{
-			//
-			// Skip this adapter
-			//
+			goto INVALID_ARGUMENTS;
+		}
 
-			std::wstringstream ss;
-			ss << L"Skipping TAP adapter due to exception caught while iterating: "
-				<< common::string::ToWide(e.what());
-			LogError(ss.str());
+		const wchar_t *pool = argv[3];
+
+		wintun.deletePoolDriver(pool, nullptr);
+	}
+	else if (0 == _wcsicmp(argv[2], L"adapter-exists"))
+	{
+		if (5 != argc)
+		{
+			goto INVALID_ARGUMENTS;
 		}
-		return true;
-	});
 
-	if (!deletedAdapter)
+		const wchar_t *pool = argv[3];
+		const wchar_t *adapter = argv[4];
+
+		const auto handle = wintun.openAdapter(pool, adapter);
+
+		if (nullptr == handle)
+		{
+			const auto status = GetLastError();
+			if (ERROR_FILE_NOT_FOUND == status)
+			{
+				return ADAPTER_NOT_FOUND;
+			}
+			else
+			{
+				THROW_WINDOWS_ERROR(status, "wintun.openAdapter");
+			}
+		}
+		wintun.freeAdapter(handle);
+	}
+	else
 	{
-		THROW_ERROR("The TAP adapter could not be removed");
+		goto INVALID_ARGUMENTS;
 	}
+
+	return GENERAL_SUCCESS;
+
+INVALID_ARGUMENTS:
+
+	LogError(L"Invalid arguments.");
+	return GENERAL_ERROR;
 }
 
 } // anonymous namespace
@@ -830,38 +1014,51 @@ int wmain(int argc, const wchar_t * argv[], const wchar_t * [])
 
 	try
 	{
-		if (0 == _wcsicmp(argv[1], L"install"))
+		if (0 == _wcsicmp(argv[1], L"new-device"))
 		{
-			if (3 != argc)
+			if (4 != argc)
 			{
 				goto INVALID_ARGUMENTS;
 			}
 
-			CreateTapDevice();
-			UpdateTapDriver(argv[2]);
-			RenameAdapterToMullvad(FindBrandedTap());
+			const wchar_t *hardwareId = argv[2];
+			const wchar_t *baseName = argv[3];
+
+			CreateNetDevice(hardwareId, baseName, true);
 		}
-		else if (0 == _wcsicmp(argv[1], L"update"))
+		else if (0 == _wcsicmp(argv[1], L"remove-device"))
 		{
-			if (3 != argc)
+			if (4 != argc)
 			{
 				goto INVALID_ARGUMENTS;
 			}
 
-			UpdateTapDriver(argv[2]);
+			const wchar_t *hardwareId = argv[2];
+			const wchar_t *baseName = argv[3];
+
+			RemoveNetAdapterByAlias(hardwareId, baseName);
 		}
-		else if (0 == _wcsicmp(argv[1], L"remove"))
+		else if (0 == _wcsicmp(argv[1], L"device-exists"))
 		{
-			if (3 != argc)
+			if (4 != argc)
 			{
 				goto INVALID_ARGUMENTS;
 			}
 
-			RemoveTapDriver(argv[2]);
+			const wchar_t *hardwareId = argv[2];
+			const wchar_t *baseName = argv[3];
+
+			const auto virtualAdapters = GetNetworkAdapters(hardwareId);
+			const auto adapter = FindAdapterByAlias(virtualAdapters, baseName);
+
+			if (!adapter.has_value())
+			{
+				return ADAPTER_NOT_FOUND;
+			}
 		}
-		else if (0 == _wcsicmp(argv[1], L"remove-vanilla-tap"))
+		else if (0 == _wcsicmp(argv[1], L"wintun"))
 		{
-			DeleteVanillaMullvadAdapter();
+			return HandleWintunCommands(argc, argv);
 		}
 		else
 		{
diff --git a/windows/libshared/src/libshared/network/interfaceutils.cpp b/windows/libshared/src/libshared/network/interfaceutils.cpp
index 042753aed6..26588206b3 100644
--- a/windows/libshared/src/libshared/network/interfaceutils.cpp
+++ b/windows/libshared/src/libshared/network/interfaceutils.cpp
@@ -5,6 +5,18 @@
 #include <libcommon/error.h>
 #include <libcommon/string.h>
 
+namespace
+{
+
+// Interface description substrings found for virtual adapters.
+const wchar_t *TUNNEL_INTERFACE_DESCS[] = {
+	L"WireGuard",
+	L"Wintun",
+	L"Mullvad"
+};
+
+} // anonymous namespace
+
 namespace shared::network
 {
 
@@ -111,38 +123,34 @@ void InterfaceUtils::AddDeviceIpAddresses(NET_LUID device, const std::vector<SOC
 
 //static
 std::set<InterfaceUtils::NetworkAdapter>
-InterfaceUtils::GetTapAdapters(const std::set<NetworkAdapter>& adapters)
+InterfaceUtils::GetVirtualAdapters(const std::set<NetworkAdapter>& adapters)
 {
-	std::set<NetworkAdapter> tapAdapters;
+	std::set<NetworkAdapter> virtualAdapters;
 
 	for (const auto& adapter : adapters)
 	{
-		static constexpr wchar_t name[] = L"Mullvad VPN TAP Adapter";
-
-		//
-		// Compare partial name, because once you start having more TAP adapters
-		// they're named "Mullvad VPN TAP Adapter #2" and so on.
-		//
-
-		if (0 == adapter.name().compare(0, _countof(name) - 1, name))
+		for (size_t i = 0; i < ARRAYSIZE(TUNNEL_INTERFACE_DESCS); i++)
 		{
-			tapAdapters.insert(adapter);
+			if (nullptr != wcsstr(adapter.raw().Description, TUNNEL_INTERFACE_DESCS[i]))
+			{
+				virtualAdapters.insert(adapter);
+			}
 		}
 	}
 
-	return tapAdapters;
+	return virtualAdapters;
 }
 
 //static
-std::wstring InterfaceUtils::GetTapInterfaceAlias()
+std::wstring InterfaceUtils::GetInterfaceAlias()
 {
 	//
-	// Look for TAP adapter with alias "Mullvad".
+	// Look for virtual adapter with alias "Mullvad".
 	//
 
 	using shared::network::InterfaceUtils;
 
-	auto adapters = InterfaceUtils::GetTapAdapters(InterfaceUtils::GetAllAdapters(
+	auto adapters = InterfaceUtils::GetVirtualAdapters(InterfaceUtils::GetAllAdapters(
 		AF_INET,
 		GAA_FLAG_SKIP_UNICAST | GAA_FLAG_SKIP_ANYCAST | GAA_FLAG_SKIP_MULTICAST
 	));
@@ -165,7 +173,7 @@ std::wstring InterfaceUtils::GetTapInterfaceAlias()
 	}
 
 	//
-	// Look for TAP adapter with alias "Mullvad-1", "Mullvad-2", etc.
+	// Look for virtual adapter with alias "Mullvad-1", "Mullvad-2", etc.
 	//
 
 	for (auto i = 0; i < 10; ++i)
@@ -182,7 +190,7 @@ std::wstring InterfaceUtils::GetTapInterfaceAlias()
 		}
 	}
 
-	THROW_ERROR("Unable to find TAP adapter");
+	THROW_ERROR("Unable to find virtual adapter");
 }
 
 }
diff --git a/windows/libshared/src/libshared/network/interfaceutils.h b/windows/libshared/src/libshared/network/interfaceutils.h
index 85a243d591..e29b2fbcb2 100644
--- a/windows/libshared/src/libshared/network/interfaceutils.h
+++ b/windows/libshared/src/libshared/network/interfaceutils.h
@@ -68,12 +68,12 @@ public:
 
 	static void AddDeviceIpAddresses(NET_LUID device, const std::vector<SOCKADDR_INET> &addresses);
 
-	static std::set<NetworkAdapter> GetTapAdapters(const std::set<NetworkAdapter> &adapters);
+	static std::set<NetworkAdapter> GetVirtualAdapters(const std::set<NetworkAdapter> &adapters);
 
 	//
-	// Determines alias of primary TAP adapter.
+	// Determines alias of primary virtual adapter.
 	//
-	static std::wstring GetTapInterfaceAlias();
+	static std::wstring GetInterfaceAlias();
 };
 
 }
diff --git a/windows/winnet/src/winnet/winnet.cpp b/windows/winnet/src/winnet/winnet.cpp
index 50332a85e6..bccf5561d8 100644
--- a/windows/winnet/src/winnet/winnet.cpp
+++ b/windows/winnet/src/winnet/winnet.cpp
@@ -215,7 +215,7 @@ extern "C"
 WINNET_LINKAGE

 bool

 WINNET_API

-WinNet_GetTapInterfaceAlias(

+WinNet_GetInterfaceAlias(

 	wchar_t **alias,

 	MullvadLogSink logSink,

 	void *logSinkContext

@@ -228,7 +228,7 @@ WinNet_GetTapInterfaceAlias(
 			THROW_ERROR("Invalid argument: alias");

 		}

 

-		const auto currentAlias = InterfaceUtils::GetTapInterfaceAlias();

+		const auto currentAlias = InterfaceUtils::GetInterfaceAlias();

 

 		auto stringBuffer = new wchar_t[currentAlias.size() + 1];

 		wcscpy(stringBuffer, currentAlias.c_str());

diff --git a/windows/winnet/src/winnet/winnet.def b/windows/winnet/src/winnet/winnet.def
index 21bb2725c7..34d3c4e59d 100644
--- a/windows/winnet/src/winnet/winnet.def
+++ b/windows/winnet/src/winnet/winnet.def
@@ -3,7 +3,7 @@ EXPORTS
 	WinNet_EnsureBestMetric
 	WinNet_InterfaceAliasToGuid
 	WinNet_EnableIpv6ForAdapter
-	WinNet_GetTapInterfaceAlias
+	WinNet_GetInterfaceAlias
 	WinNet_ReleaseString
 	WinNet_ActivateConnectivityMonitor
 	WinNet_DeactivateConnectivityMonitor
diff --git a/windows/winnet/src/winnet/winnet.h b/windows/winnet/src/winnet/winnet.h
index 0da271274e..5634298a93 100644
--- a/windows/winnet/src/winnet/winnet.h
+++ b/windows/winnet/src/winnet/winnet.h
@@ -47,7 +47,7 @@ extern "C"
 WINNET_LINKAGE
 bool
 WINNET_API
-WinNet_GetTapInterfaceAlias(
+WinNet_GetInterfaceAlias(
 	wchar_t **alias,
 	MullvadLogSink logSink,
 	void *logSinkContext