diff --git a/src/Makefile.am b/src/Makefile.am
index 7e7f2743..a9fbb8ff 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -6,7 +6,7 @@ AM_LDFLAGS = -static
 
 SS_COMMON_LIBS = $(top_builddir)/libev/libev.la $(INET_NTOP_LIB)
  
-bin_PROGRAMS = ss-local
+bin_PROGRAMS = ss-local ss-tunnel
 
 if !BUILD_WINCOMPAT
 bin_PROGRAMS += ss-server
@@ -15,26 +15,39 @@ endif
 ss_local_SOURCES = utils.c \
                    jconf.c \
                    json.c \
-		   encrypt.c \
-		   udprelay.c \
-		   cache.c \
-		   local.c
+				   encrypt.c \
+				   udprelay.c \
+				   cache.c \
+				   local.c
+
+ss_tunnel_SOURCES = utils.c \
+					jconf.c \
+					json.c \
+					encrypt.c \
+					udprelay.c \
+					cache.c \
+					tunnel.c
+
 ss_server_SOURCES = utils.c \
                     jconf.c \
                     json.c \
                     encrypt.c \
-		    udprelay.c \
-		    cache.c \
+					udprelay.c \
+					cache.c \
                     server.c
+
 ss_local_LDADD = $(SS_COMMON_LIBS)
+ss_tunnel_LDADD = $(SS_COMMON_LIBS)
 ss_server_LDADD = $(SS_COMMON_LIBS)
 ss_server_LDADD += $(top_builddir)/libasyncns/libasyncns.la
 
 ss_local_CFLAGS = $(AM_CFLAGS) -DUDPRELAY_LOCAL
+ss_tunnel_CFLAGS = $(AM_CFLAGS) -DUDPRELAY_LOCAL -DUDPRELAY_TUNNEL
 ss_server_CFLAGS = $(AM_CFLAGS) -DUDPRELAY_REMOTE
 
 if BUILD_WINCOMPAT
 ss_local_SOURCES += win32.c
+ss_tunnel_SOURCES += win32.c
 endif
 
 if BUILD_REDIRECTOR
diff --git a/src/Makefile.in b/src/Makefile.in
index f7e9d086..3ae83b7f 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -34,10 +34,12 @@ PRE_UNINSTALL = :
 POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
-bin_PROGRAMS = ss-local$(EXEEXT) $(am__EXEEXT_1) $(am__EXEEXT_2)
+bin_PROGRAMS = ss-local$(EXEEXT) ss-tunnel$(EXEEXT) $(am__EXEEXT_1) \
+	$(am__EXEEXT_2)
 @BUILD_WINCOMPAT_FALSE@am__append_1 = ss-server
 @BUILD_WINCOMPAT_TRUE@am__append_2 = win32.c
-@BUILD_REDIRECTOR_TRUE@am__append_3 = ss-redir
+@BUILD_WINCOMPAT_TRUE@am__append_3 = win32.c
+@BUILD_REDIRECTOR_TRUE@am__append_4 = ss-redir
 subdir = src
 DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
@@ -89,6 +91,19 @@ ss_server_DEPENDENCIES = $(am__DEPENDENCIES_2) \
 ss_server_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
 	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(ss_server_CFLAGS) \
 	$(CFLAGS) $(AM_LDFLAGS) $(LDFLAGS) -o $@
+am__ss_tunnel_SOURCES_DIST = utils.c jconf.c json.c encrypt.c \
+	udprelay.c cache.c tunnel.c win32.c
+@BUILD_WINCOMPAT_TRUE@am__objects_2 = ss_tunnel-win32.$(OBJEXT)
+am_ss_tunnel_OBJECTS = ss_tunnel-utils.$(OBJEXT) \
+	ss_tunnel-jconf.$(OBJEXT) ss_tunnel-json.$(OBJEXT) \
+	ss_tunnel-encrypt.$(OBJEXT) ss_tunnel-udprelay.$(OBJEXT) \
+	ss_tunnel-cache.$(OBJEXT) ss_tunnel-tunnel.$(OBJEXT) \
+	$(am__objects_2)
+ss_tunnel_OBJECTS = $(am_ss_tunnel_OBJECTS)
+ss_tunnel_DEPENDENCIES = $(am__DEPENDENCIES_2)
+ss_tunnel_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(ss_tunnel_CFLAGS) \
+	$(CFLAGS) $(AM_LDFLAGS) $(LDFLAGS) -o $@
 DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/depcomp
 am__depfiles_maybe = depfiles
@@ -102,9 +117,11 @@ CCLD = $(CC)
 LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
 	--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
 	$(LDFLAGS) -o $@
-SOURCES = $(ss_local_SOURCES) $(ss_redir_SOURCES) $(ss_server_SOURCES)
+SOURCES = $(ss_local_SOURCES) $(ss_redir_SOURCES) $(ss_server_SOURCES) \
+	$(ss_tunnel_SOURCES)
 DIST_SOURCES = $(am__ss_local_SOURCES_DIST) \
-	$(am__ss_redir_SOURCES_DIST) $(ss_server_SOURCES)
+	$(am__ss_redir_SOURCES_DIST) $(ss_server_SOURCES) \
+	$(am__ss_tunnel_SOURCES_DIST)
 ETAGS = etags
 CTAGS = ctags
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -233,18 +250,22 @@ AM_LDFLAGS = -static
 SS_COMMON_LIBS = $(top_builddir)/libev/libev.la $(INET_NTOP_LIB)
 ss_local_SOURCES = utils.c jconf.c json.c encrypt.c udprelay.c cache.c \
 	local.c $(am__append_2)
+ss_tunnel_SOURCES = utils.c jconf.c json.c encrypt.c udprelay.c \
+	cache.c tunnel.c $(am__append_3)
 ss_server_SOURCES = utils.c \
                     jconf.c \
                     json.c \
                     encrypt.c \
-		    udprelay.c \
-		    cache.c \
+					udprelay.c \
+					cache.c \
                     server.c
 
 ss_local_LDADD = $(SS_COMMON_LIBS)
+ss_tunnel_LDADD = $(SS_COMMON_LIBS)
 ss_server_LDADD = $(SS_COMMON_LIBS) \
 	$(top_builddir)/libasyncns/libasyncns.la
 ss_local_CFLAGS = $(AM_CFLAGS) -DUDPRELAY_LOCAL
+ss_tunnel_CFLAGS = $(AM_CFLAGS) -DUDPRELAY_LOCAL -DUDPRELAY_TUNNEL
 ss_server_CFLAGS = $(AM_CFLAGS) -DUDPRELAY_REMOTE
 @BUILD_REDIRECTOR_TRUE@ss_redir_SOURCES = utils.c \
 @BUILD_REDIRECTOR_TRUE@                   jconf.c \
@@ -339,6 +360,9 @@ ss-redir$(EXEEXT): $(ss_redir_OBJECTS) $(ss_redir_DEPENDENCIES) $(EXTRA_ss_redir
 ss-server$(EXEEXT): $(ss_server_OBJECTS) $(ss_server_DEPENDENCIES) $(EXTRA_ss_server_DEPENDENCIES) 
 	@rm -f ss-server$(EXEEXT)
 	$(ss_server_LINK) $(ss_server_OBJECTS) $(ss_server_LDADD) $(LIBS)
+ss-tunnel$(EXEEXT): $(ss_tunnel_OBJECTS) $(ss_tunnel_DEPENDENCIES) $(EXTRA_ss_tunnel_DEPENDENCIES) 
+	@rm -f ss-tunnel$(EXEEXT)
+	$(ss_tunnel_LINK) $(ss_tunnel_OBJECTS) $(ss_tunnel_LDADD) $(LIBS)
 
 mostlyclean-compile:
 	-rm -f *.$(OBJEXT)
@@ -365,6 +389,14 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_server-server.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_server-udprelay.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_server-utils.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_tunnel-cache.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_tunnel-encrypt.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_tunnel-jconf.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_tunnel-json.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_tunnel-tunnel.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_tunnel-udprelay.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_tunnel-utils.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ss_tunnel-win32.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/utils.Po@am__quote@
 
 .c.o:
@@ -598,6 +630,118 @@ ss_server-server.obj: server.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_server_CFLAGS) $(CFLAGS) -c -o ss_server-server.obj `if test -f 'server.c'; then $(CYGPATH_W) 'server.c'; else $(CYGPATH_W) '$(srcdir)/server.c'; fi`
 
+ss_tunnel-utils.o: utils.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-utils.o -MD -MP -MF $(DEPDIR)/ss_tunnel-utils.Tpo -c -o ss_tunnel-utils.o `test -f 'utils.c' || echo '$(srcdir)/'`utils.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-utils.Tpo $(DEPDIR)/ss_tunnel-utils.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='utils.c' object='ss_tunnel-utils.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-utils.o `test -f 'utils.c' || echo '$(srcdir)/'`utils.c
+
+ss_tunnel-utils.obj: utils.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-utils.obj -MD -MP -MF $(DEPDIR)/ss_tunnel-utils.Tpo -c -o ss_tunnel-utils.obj `if test -f 'utils.c'; then $(CYGPATH_W) 'utils.c'; else $(CYGPATH_W) '$(srcdir)/utils.c'; fi`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-utils.Tpo $(DEPDIR)/ss_tunnel-utils.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='utils.c' object='ss_tunnel-utils.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-utils.obj `if test -f 'utils.c'; then $(CYGPATH_W) 'utils.c'; else $(CYGPATH_W) '$(srcdir)/utils.c'; fi`
+
+ss_tunnel-jconf.o: jconf.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-jconf.o -MD -MP -MF $(DEPDIR)/ss_tunnel-jconf.Tpo -c -o ss_tunnel-jconf.o `test -f 'jconf.c' || echo '$(srcdir)/'`jconf.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-jconf.Tpo $(DEPDIR)/ss_tunnel-jconf.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='jconf.c' object='ss_tunnel-jconf.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-jconf.o `test -f 'jconf.c' || echo '$(srcdir)/'`jconf.c
+
+ss_tunnel-jconf.obj: jconf.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-jconf.obj -MD -MP -MF $(DEPDIR)/ss_tunnel-jconf.Tpo -c -o ss_tunnel-jconf.obj `if test -f 'jconf.c'; then $(CYGPATH_W) 'jconf.c'; else $(CYGPATH_W) '$(srcdir)/jconf.c'; fi`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-jconf.Tpo $(DEPDIR)/ss_tunnel-jconf.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='jconf.c' object='ss_tunnel-jconf.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-jconf.obj `if test -f 'jconf.c'; then $(CYGPATH_W) 'jconf.c'; else $(CYGPATH_W) '$(srcdir)/jconf.c'; fi`
+
+ss_tunnel-json.o: json.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-json.o -MD -MP -MF $(DEPDIR)/ss_tunnel-json.Tpo -c -o ss_tunnel-json.o `test -f 'json.c' || echo '$(srcdir)/'`json.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-json.Tpo $(DEPDIR)/ss_tunnel-json.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='json.c' object='ss_tunnel-json.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-json.o `test -f 'json.c' || echo '$(srcdir)/'`json.c
+
+ss_tunnel-json.obj: json.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-json.obj -MD -MP -MF $(DEPDIR)/ss_tunnel-json.Tpo -c -o ss_tunnel-json.obj `if test -f 'json.c'; then $(CYGPATH_W) 'json.c'; else $(CYGPATH_W) '$(srcdir)/json.c'; fi`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-json.Tpo $(DEPDIR)/ss_tunnel-json.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='json.c' object='ss_tunnel-json.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-json.obj `if test -f 'json.c'; then $(CYGPATH_W) 'json.c'; else $(CYGPATH_W) '$(srcdir)/json.c'; fi`
+
+ss_tunnel-encrypt.o: encrypt.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-encrypt.o -MD -MP -MF $(DEPDIR)/ss_tunnel-encrypt.Tpo -c -o ss_tunnel-encrypt.o `test -f 'encrypt.c' || echo '$(srcdir)/'`encrypt.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-encrypt.Tpo $(DEPDIR)/ss_tunnel-encrypt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='encrypt.c' object='ss_tunnel-encrypt.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-encrypt.o `test -f 'encrypt.c' || echo '$(srcdir)/'`encrypt.c
+
+ss_tunnel-encrypt.obj: encrypt.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-encrypt.obj -MD -MP -MF $(DEPDIR)/ss_tunnel-encrypt.Tpo -c -o ss_tunnel-encrypt.obj `if test -f 'encrypt.c'; then $(CYGPATH_W) 'encrypt.c'; else $(CYGPATH_W) '$(srcdir)/encrypt.c'; fi`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-encrypt.Tpo $(DEPDIR)/ss_tunnel-encrypt.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='encrypt.c' object='ss_tunnel-encrypt.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-encrypt.obj `if test -f 'encrypt.c'; then $(CYGPATH_W) 'encrypt.c'; else $(CYGPATH_W) '$(srcdir)/encrypt.c'; fi`
+
+ss_tunnel-udprelay.o: udprelay.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-udprelay.o -MD -MP -MF $(DEPDIR)/ss_tunnel-udprelay.Tpo -c -o ss_tunnel-udprelay.o `test -f 'udprelay.c' || echo '$(srcdir)/'`udprelay.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-udprelay.Tpo $(DEPDIR)/ss_tunnel-udprelay.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='udprelay.c' object='ss_tunnel-udprelay.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-udprelay.o `test -f 'udprelay.c' || echo '$(srcdir)/'`udprelay.c
+
+ss_tunnel-udprelay.obj: udprelay.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-udprelay.obj -MD -MP -MF $(DEPDIR)/ss_tunnel-udprelay.Tpo -c -o ss_tunnel-udprelay.obj `if test -f 'udprelay.c'; then $(CYGPATH_W) 'udprelay.c'; else $(CYGPATH_W) '$(srcdir)/udprelay.c'; fi`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-udprelay.Tpo $(DEPDIR)/ss_tunnel-udprelay.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='udprelay.c' object='ss_tunnel-udprelay.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-udprelay.obj `if test -f 'udprelay.c'; then $(CYGPATH_W) 'udprelay.c'; else $(CYGPATH_W) '$(srcdir)/udprelay.c'; fi`
+
+ss_tunnel-cache.o: cache.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-cache.o -MD -MP -MF $(DEPDIR)/ss_tunnel-cache.Tpo -c -o ss_tunnel-cache.o `test -f 'cache.c' || echo '$(srcdir)/'`cache.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-cache.Tpo $(DEPDIR)/ss_tunnel-cache.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='cache.c' object='ss_tunnel-cache.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-cache.o `test -f 'cache.c' || echo '$(srcdir)/'`cache.c
+
+ss_tunnel-cache.obj: cache.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-cache.obj -MD -MP -MF $(DEPDIR)/ss_tunnel-cache.Tpo -c -o ss_tunnel-cache.obj `if test -f 'cache.c'; then $(CYGPATH_W) 'cache.c'; else $(CYGPATH_W) '$(srcdir)/cache.c'; fi`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-cache.Tpo $(DEPDIR)/ss_tunnel-cache.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='cache.c' object='ss_tunnel-cache.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-cache.obj `if test -f 'cache.c'; then $(CYGPATH_W) 'cache.c'; else $(CYGPATH_W) '$(srcdir)/cache.c'; fi`
+
+ss_tunnel-tunnel.o: tunnel.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-tunnel.o -MD -MP -MF $(DEPDIR)/ss_tunnel-tunnel.Tpo -c -o ss_tunnel-tunnel.o `test -f 'tunnel.c' || echo '$(srcdir)/'`tunnel.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-tunnel.Tpo $(DEPDIR)/ss_tunnel-tunnel.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='tunnel.c' object='ss_tunnel-tunnel.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-tunnel.o `test -f 'tunnel.c' || echo '$(srcdir)/'`tunnel.c
+
+ss_tunnel-tunnel.obj: tunnel.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-tunnel.obj -MD -MP -MF $(DEPDIR)/ss_tunnel-tunnel.Tpo -c -o ss_tunnel-tunnel.obj `if test -f 'tunnel.c'; then $(CYGPATH_W) 'tunnel.c'; else $(CYGPATH_W) '$(srcdir)/tunnel.c'; fi`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-tunnel.Tpo $(DEPDIR)/ss_tunnel-tunnel.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='tunnel.c' object='ss_tunnel-tunnel.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-tunnel.obj `if test -f 'tunnel.c'; then $(CYGPATH_W) 'tunnel.c'; else $(CYGPATH_W) '$(srcdir)/tunnel.c'; fi`
+
+ss_tunnel-win32.o: win32.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-win32.o -MD -MP -MF $(DEPDIR)/ss_tunnel-win32.Tpo -c -o ss_tunnel-win32.o `test -f 'win32.c' || echo '$(srcdir)/'`win32.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-win32.Tpo $(DEPDIR)/ss_tunnel-win32.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='win32.c' object='ss_tunnel-win32.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-win32.o `test -f 'win32.c' || echo '$(srcdir)/'`win32.c
+
+ss_tunnel-win32.obj: win32.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -MT ss_tunnel-win32.obj -MD -MP -MF $(DEPDIR)/ss_tunnel-win32.Tpo -c -o ss_tunnel-win32.obj `if test -f 'win32.c'; then $(CYGPATH_W) 'win32.c'; else $(CYGPATH_W) '$(srcdir)/win32.c'; fi`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ss_tunnel-win32.Tpo $(DEPDIR)/ss_tunnel-win32.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='win32.c' object='ss_tunnel-win32.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ss_tunnel_CFLAGS) $(CFLAGS) -c -o ss_tunnel-win32.obj `if test -f 'win32.c'; then $(CYGPATH_W) 'win32.c'; else $(CYGPATH_W) '$(srcdir)/win32.c'; fi`
+
 mostlyclean-libtool:
 	-rm -f *.lo
 
diff --git a/src/local.c b/src/local.c
index 38003eb3..b08612da 100644
--- a/src/local.c
+++ b/src/local.c
@@ -766,7 +766,6 @@ static void accept_cb (EV_P_ ev_io *w, int revents)
     if (sockfd < 0)
     {
         ERROR("socket");
-        close(sockfd);
         freeaddrinfo(res);
         return;
     }
diff --git a/src/redir.c b/src/redir.c
index 1b67cc8a..9167f9bd 100644
--- a/src/redir.c
+++ b/src/redir.c
@@ -630,7 +630,6 @@ static void accept_cb (EV_P_ ev_io *w, int revents)
     if (sockfd < 0)
     {
         ERROR("socket");
-        close(sockfd);
         freeaddrinfo(res);
         return;
     }
diff --git a/src/tunnel.c b/src/tunnel.c
index 1dbb3eba..41a863f9 100644
--- a/src/tunnel.c
+++ b/src/tunnel.c
@@ -168,6 +168,7 @@ static void server_recv_cb (EV_P_ ev_io *w, int revents)
     }
 
     remote->buf = ss_encrypt(BUF_SIZE, remote->buf, &r, server->e_ctx);
+
     if (remote->buf == NULL)
     {
         LOGE("invalid password or cipher");
@@ -175,7 +176,9 @@ static void server_recv_cb (EV_P_ ev_io *w, int revents)
         close_and_free_server(EV_A_ server);
         return;
     }
+
     int s = send(remote->fd, remote->buf, r, 0);
+
     if(s == -1)
     {
         if (errno == EAGAIN || errno == EWOULDBLOCK)
@@ -323,6 +326,7 @@ static void remote_recv_cb (EV_P_ ev_io *w, int revents)
     }
 
     server->buf = ss_decrypt(BUF_SIZE, server->buf, &r, server->d_ctx);
+
     if (server->buf == NULL)
     {
         LOGE("invalid password or cipher");
@@ -330,6 +334,7 @@ static void remote_recv_cb (EV_P_ ev_io *w, int revents)
         close_and_free_server(EV_A_ server);
         return;
     }
+
     int s = send(server->fd, server->buf, r, 0);
 
     if (s == -1)
@@ -378,7 +383,63 @@ static void remote_send_cb (EV_P_ ev_io *w, int revents)
             remote_send_ctx->connected = 1;
             ev_io_stop(EV_A_ &remote_send_ctx->io);
             ev_timer_stop(EV_A_ &remote_send_ctx->watcher);
+
+            // send destaddr
+            char *addr_to_send = malloc(BUF_SIZE);
+            ssize_t addr_len = 0;
+            struct sockaddr *sa = &server->destaddr;
+            addr_to_send[addr_len++] = 1;
+            
+            if (sa->sa_family == AF_INET)
+            {
+                // handle IPv4
+                struct sockaddr_in *sin = (struct sockaddr_in *)sa;
+                size_t in_addr_len = sizeof(struct in_addr);
+                memcpy(addr_to_send + addr_len, &sin->sin_addr, in_addr_len);
+                addr_len += in_addr_len;
+                memcpy(addr_to_send + addr_len, &sin->sin_port, 2);
+                addr_len += 2;
+            }
+            else if (sa->sa_family == AF_INET6)
+            {
+                // handle IPv6
+                struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
+                size_t in6_addr_len = sizeof(struct in6_addr);
+                memcpy(addr_to_send + addr_len, &sin6->sin6_addr, in6_addr_len);
+                addr_len += in6_addr_len;
+                memcpy(addr_to_send + addr_len, &sin6->sin6_port, 2);
+                addr_len += 2;
+            }
+            else
+            {
+                LOGE("unsupported addr type");
+                close_and_free_remote(EV_A_ remote);
+                close_and_free_server(EV_A_ server);
+                return;
+            }
+
+            addr_to_send = ss_encrypt(BUF_SIZE, addr_to_send, &addr_len, server->e_ctx);
+            if (addr_to_send == NULL)
+            {
+                LOGE("invalid password or cipher");
+                close_and_free_remote(EV_A_ remote);
+                close_and_free_server(EV_A_ server);
+                return;
+            }
+
+            int s = send(remote->fd, addr_to_send, addr_len, 0);
+            free(addr_to_send);
+
+            if (s < addr_len)
+            {
+                LOGE("failed to send remote addr.");
+                close_and_free_remote(EV_A_ remote);
+                close_and_free_server(EV_A_ server);
+            }
+
+            ev_io_start(EV_A_ &remote->recv_ctx->io);
             ev_io_start(EV_A_ &server->recv_ctx->io);
+
             return;
         }
         else
@@ -508,7 +569,6 @@ struct server* new_server(int fd, int method)
     server->recv_ctx->connected = 0;
     server->send_ctx->server = server;
     server->send_ctx->connected = 0;
-    server->stage = 0;
     if (method)
     {
         server->e_ctx = malloc(sizeof(struct enc_ctx));
@@ -581,7 +641,7 @@ static void accept_cb (EV_P_ ev_io *w, int revents)
     setsockopt(serverfd, SOL_SOCKET, SO_NOSIGPIPE, &opt, sizeof(opt));
 #endif
 
-    struct addrinfo hints, *res;
+    struct addrinfo hints, *res, *dest;
     int sockfd;
     memset(&hints, 0, sizeof hints);
     hints.ai_family = AF_UNSPEC;
@@ -598,12 +658,20 @@ static void accept_cb (EV_P_ ev_io *w, int revents)
         return;
     }
 
+    err = getaddrinfo(listener->tunnel_addr.host, listener->tunnel_addr.port, &hints, &dest);
+    if (err)
+    {
+        freeaddrinfo(res);
+        ERROR("getaddrinfo");
+        return;
+    }
+
     sockfd = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
     if (sockfd < 0)
     {
         ERROR("socket");
-        close(sockfd);
         freeaddrinfo(res);
+        freeaddrinfo(dest);
         return;
     }
 
@@ -620,10 +688,12 @@ static void accept_cb (EV_P_ ev_io *w, int revents)
 
     struct server *server = new_server(serverfd, listener->method);
     struct remote *remote = new_remote(sockfd, listener->timeout);
+    server->destaddr = *dest->ai_addr;
     server->remote = remote;
     remote->server = server;
     connect(sockfd, res->ai_addr, res->ai_addrlen);
     freeaddrinfo(res);
+    freeaddrinfo(dest);
     // listen to remote connected event
     ev_io_start(EV_A_ &remote->send_ctx->io);
     ev_timer_start(EV_A_ &remote->send_ctx->watcher);
@@ -651,7 +721,7 @@ int main (int argc, char **argv)
 
     opterr = 0;
 
-    while ((c = getopt (argc, argv, "f:s:p:l:k:t:m:i:c:b:uv")) != -1)
+    while ((c = getopt (argc, argv, "f:s:p:l:k:t:m:i:c:b:L:uv")) != -1)
     {
         switch (c)
         {
@@ -690,7 +760,7 @@ int main (int argc, char **argv)
         case 'u':
             udprelay = 1;
             break;
-        case "L":
+        case 'L':
             tunnel_addr.host = optarg;
             break;
         case 'v':
diff --git a/src/tunnel.h b/src/tunnel.h
index be15a219..bd0f6d48 100644
--- a/src/tunnel.h
+++ b/src/tunnel.h
@@ -38,6 +38,7 @@ struct server
     struct server_ctx *recv_ctx;
     struct server_ctx *send_ctx;
     struct remote *remote;
+    struct sockaddr destaddr;
 };
 
 struct remote_ctx