diff --git a/Makefile b/Makefile
index c91d7a2..7f5af22 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 PACKAGE	= VPN
 VERSION	= 0.0.0
-SUBDIRS	= data include src
+SUBDIRS	= include src tools
 RM	?= rm -f
 LN	?= ln -f
 TAR	?= tar -czvf
@@ -21,18 +21,20 @@ dist:
 	$(RM) -r -- $(PACKAGE)-$(VERSION)
 	$(LN) -s -- . $(PACKAGE)-$(VERSION)
 	@$(TAR) $(PACKAGE)-$(VERSION).tar.gz -- \
-		$(PACKAGE)-$(VERSION)/data/Makefile \
-		$(PACKAGE)-$(VERSION)/data/VPN.interface \
-		$(PACKAGE)-$(VERSION)/data/project.conf \
 		$(PACKAGE)-$(VERSION)/include/VPN.h \
 		$(PACKAGE)-$(VERSION)/include/Makefile \
+		$(PACKAGE)-$(VERSION)/include/VPN.interface \
+		$(PACKAGE)-$(VERSION)/include/appbroker.sh \
 		$(PACKAGE)-$(VERSION)/include/project.conf \
 		$(PACKAGE)-$(VERSION)/src/vpn.c \
 		$(PACKAGE)-$(VERSION)/src/main.c \
 		$(PACKAGE)-$(VERSION)/src/Makefile \
-		$(PACKAGE)-$(VERSION)/src/appbroker.sh \
+		$(PACKAGE)-$(VERSION)/src/common.c \
 		$(PACKAGE)-$(VERSION)/src/vpn.h \
 		$(PACKAGE)-$(VERSION)/src/project.conf \
+		$(PACKAGE)-$(VERSION)/tools/libvpn.c \
+		$(PACKAGE)-$(VERSION)/tools/Makefile \
+		$(PACKAGE)-$(VERSION)/tools/project.conf \
 		$(PACKAGE)-$(VERSION)/COPYING \
 		$(PACKAGE)-$(VERSION)/Makefile \
 		$(PACKAGE)-$(VERSION)/config.h \
diff --git a/data/Makefile b/data/Makefile
deleted file mode 100644
index 23df4db..0000000
--- a/data/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-PREFIX	= /usr/local
-DESTDIR	=
-MKDIR	?= mkdir -p
-INSTALL	?= install
-RM	?= rm -f
-
-
-all:
-
-clean:
-
-distclean: clean
-
-install:
-	$(MKDIR) $(DESTDIR)$(PREFIX)/etc/AppInterface
-	$(INSTALL) -m 0644 -- VPN.interface $(DESTDIR)$(PREFIX)/etc/AppInterface/VPN.interface
-
-uninstall:
-	$(RM) -- $(DESTDIR)$(PREFIX)/etc/AppInterface/VPN.interface
-
-.PHONY: all clean distclean install uninstall
diff --git a/data/project.conf b/data/project.conf
deleted file mode 100644
index 6a0b33d..0000000
--- a/data/project.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-dist=Makefile,VPN.interface
-
-[VPN.interface]
-install=$(PREFIX)/etc/AppInterface
diff --git a/include/Makefile b/include/Makefile
index bff06a8..16337a0 100644
--- a/include/Makefile
+++ b/include/Makefile
@@ -1,3 +1,7 @@
+MKDIR	?= mkdir -p
+INSTALL	?= install
+RM	?= rm -f
+TARGETS	= VPN.h
 PREFIX	= /usr/local
 DESTDIR	=
 RM	?= rm -f
@@ -7,17 +11,25 @@ INSTALL	?= install
 INCLUDEDIR= $(PREFIX)/include
 
 
-all:
+all: $(TARGETS)
+
+VPN.h: VPN.interface
+	./appbroker.sh -P "$(PREFIX)" -- "VPN.h"
 
 clean:
+	$(RM) -- $(VPN.h_OBJS)
 
 distclean: clean
+	$(RM) -- $(TARGETS)
 
-install:
+install: $(TARGETS)
 	$(MKDIR) $(DESTDIR)$(INCLUDEDIR)
 	$(INSTALL) -m 0644 -- VPN.h $(DESTDIR)$(INCLUDEDIR)/VPN.h
+	$(MKDIR) $(DESTDIR)$(PREFIX)/etc/AppInterface
+	$(INSTALL) -m 0644 -- VPN.interface $(DESTDIR)$(PREFIX)/etc/AppInterface/VPN.interface
 
 uninstall:
 	$(RM) -- $(DESTDIR)$(INCLUDEDIR)/VPN.h
+	$(RM) -- $(DESTDIR)$(PREFIX)/etc/AppInterface/VPN.interface
 
 .PHONY: all clean distclean install uninstall
diff --git a/include/VPN.h b/include/VPN.h
index 2253044..c922755 100644
--- a/include/VPN.h
+++ b/include/VPN.h
@@ -1,26 +1,56 @@
 /* $Id$ */
-/* Copyright (c) 2010 Pierre Pronchery <khorben@defora.org> */
-/* This file is part of DeforaOS System VPN */
-/* This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, version 3 of the License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>. */
 
 
 
 #ifndef VPN_VPN_H
 # define VPN_VPN_H
 
+# include <stdint.h>
+# include <System.h>
+
 
-/* VPN */
 /* types */
-typedef enum _VPNProtocol { VPN_PROTOCOL_IP_TCP = 0 } VPNProtocol;
+typedef Buffer * BUFFER;
+typedef double * DOUBLE;
+typedef float * FLOAT;
+typedef int16_t INT16;
+typedef int32_t INT32;
+typedef uint16_t UINT16;
+typedef uint32_t UINT32;
+typedef String const * STRING;
+typedef void VOID;
+
+typedef BUFFER BUFFER_IN;
+
+typedef DOUBLE DOUBLE_IN;
+
+typedef FLOAT FLOAT_IN;
+typedef INT32 INT32_IN;
+typedef UINT32 UINT32_IN;
+typedef STRING STRING_IN;
+
+typedef Buffer * BUFFER_OUT;
+typedef int32_t * INT32_OUT;
+typedef uint32_t * UINT32_OUT;
+typedef String ** STRING_OUT;
+
+typedef Buffer * BUFFER_INOUT;
+typedef int32_t * INT32_INOUT;
+typedef uint32_t * UINT32_INOUT;
+typedef String ** STRING_INOUT;
+
+
+/* constants */
+# define VPN_PROTOCOL_IP_TCP	0
+# define VPN_EPERM	1
+# define VPN_EBADF	9
+# define VPN_EPROTO	96
+
+
+/* calls */
+INT32 VPN_close(INT32 fd);
+INT32 VPN_connect(UINT32 protocol, STRING name);
+INT32 VPN_recv(INT32 fd, BUFFER_IN buf, UINT32 size, UINT32 flags);
+INT32 VPN_send(INT32 fd, BUFFER_OUT buf, UINT32 size, UINT32 flags);
 
 #endif /* !VPN_VPN_H */
diff --git a/data/VPN.interface b/include/VPN.interface
similarity index 86%
rename from data/VPN.interface
rename to include/VPN.interface
index 8ac9257..a06427f 100644
--- a/data/VPN.interface
+++ b/include/VPN.interface
@@ -2,6 +2,14 @@
 service=VPN
 port=4246
 
+[constants]
+#protocols
+PROTOCOL_IP_TCP=0
+#errno
+EPERM=1
+EBADF=9
+EPROTO=96
+
 [call::close]
 ret=INT32
 arg1=INT32,fd
diff --git a/include/appbroker.sh b/include/appbroker.sh
new file mode 100755
index 0000000..c98177d
--- /dev/null
+++ b/include/appbroker.sh
@@ -0,0 +1,56 @@
+#!/bin/sh
+#$Id$
+#Copyright (c) 2011 Pierre Pronchery <khorben@defora.org>
+#All rights reserved.
+#
+#Redistribution and use in source and binary forms, with or without
+#modification, are permitted provided that the following conditions are met:
+#
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+#
+#THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+#AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+#IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+#FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+#DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+#SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+#CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+#OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+#OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+
+#functions
+#usage
+_usage()
+{
+	echo "Usage: appbroker.sh target" 1>&2
+	return 1
+}
+
+
+#main
+while getopts P: name; do
+	case "$name" in
+		P)
+			#we can ignore it
+			;;
+		?)
+			_usage
+			exit $?
+			;;
+	esac
+done
+shift $(($OPTIND - 1))
+if [ $# -ne 1 ]; then
+	_usage
+	exit $?
+fi
+
+APPINTERFACE="${1%%.h}.interface"
+AppBroker -o "$1" "$APPINTERFACE"
diff --git a/include/project.conf b/include/project.conf
index acbd8a7..432d8d9 100644
--- a/include/project.conf
+++ b/include/project.conf
@@ -1,2 +1,11 @@
+targets=VPN.h
 includes=VPN.h
-dist=Makefile
+dist=Makefile,VPN.interface,appbroker.sh
+
+[VPN.h]
+type=script
+script=./appbroker.sh
+depends=VPN.interface
+
+[VPN.interface]
+install=$(PREFIX)/etc/AppInterface
diff --git a/project.conf b/project.conf
index 1a99dcf..1868d5a 100644
--- a/project.conf
+++ b/project.conf
@@ -2,5 +2,5 @@ package=VPN
 version=0.0.0
 config=h
 
-subdirs=data,include,src
+subdirs=include,src,tools
 dist=COPYING,Makefile,config.h
diff --git a/src/Makefile b/src/Makefile
index 0ef6ef1..90efc78 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -1,4 +1,4 @@
-TARGETS	= ../data/VPN.h VPN
+TARGETS	= ../include/VPN.h VPN
 PREFIX	= /usr/local
 DESTDIR	=
 BINDIR	= $(PREFIX)/bin
@@ -17,8 +17,8 @@ INSTALL	?= install
 
 all: $(TARGETS)
 
-../data/VPN.h: ../data/VPN.interface
-	./appbroker.sh -P "$(PREFIX)" -- "../data/VPN.h"
+../include/VPN.h:
+	../include/appbroker.sh -P "$(PREFIX)" -- "../include/VPN.h"
 
 VPN_OBJS = vpn.o main.o
 VPN_CFLAGS = $(CPPFLAGSF) $(CPPFLAGS) $(CFLAGSF) $(CFLAGS)
@@ -27,14 +27,14 @@ VPN_LDFLAGS = $(LDFLAGSF) $(LDFLAGS)
 VPN: $(VPN_OBJS)
 	$(CC) -o VPN $(VPN_OBJS) $(VPN_LDFLAGS)
 
-vpn.o: vpn.c ../data/VPN.h
+vpn.o: vpn.c ../include/VPN.h
 	$(CC) $(VPN_CFLAGS) -c vpn.c
 
 main.o: main.c
 	$(CC) $(VPN_CFLAGS) -c main.c
 
 clean:
-	$(RM) -- $(../data/VPN.h_OBJS) $(VPN_OBJS)
+	$(RM) -- $(../include/VPN.h_OBJS) $(VPN_OBJS)
 
 distclean: clean
 	$(RM) -- $(TARGETS)
diff --git a/src/project.conf b/src/project.conf
index 84883bb..2a33ab3 100644
--- a/src/project.conf
+++ b/src/project.conf
@@ -1,16 +1,15 @@
-targets=../data/VPN.h,VPN
+targets=../include/VPN.h,VPN
 cppflags_force=-I ../include
 cppflags=
 cflags_force=-W `pkg-config --cflags libApp`
 cflags=-Wall -g -O2 -pedantic
 ldflags_force=`pkg-config --libs libApp` -Wl,--export-dynamic
 ldflags=
-dist=Makefile,appbroker.sh,vpn.h
+dist=Makefile,common.c,vpn.h
 
-[../data/VPN.h]
+[../include/VPN.h]
 type=script
-script=./appbroker.sh
-depends=../data/VPN.interface
+script=../include/appbroker.sh
 
 [VPN]
 type=binary
@@ -18,4 +17,4 @@ sources=vpn.c,main.c
 install=$(BINDIR)
 
 [vpn.c]
-depends=../data/VPN.h
+depends=../include/VPN.h
diff --git a/src/vpn.c b/src/vpn.c
index 2253020..0d0e466 100644
--- a/src/vpn.c
+++ b/src/vpn.c
@@ -25,7 +25,6 @@
 #include <System.h>
 #include "VPN.h"
 #include "vpn.h"
-#include "../data/VPN.h"
 #include "../config.h"
 
 
@@ -39,6 +38,11 @@ typedef struct _VPNClient
 	size_t sockets_cnt;
 } VPNClient;
 
+typedef enum _VPNProtocol
+{
+	VP_IP_TCP = VPN_PROTOCOL_IP_TCP
+} VPNProtocol;
+
 
 /* variables */
 static AppServer * _appserver;
@@ -111,7 +115,7 @@ int32_t VPN_connect(uint32_t protocol, String const * uri)
 
 	switch(vprotocol)
 	{
-		case VPN_PROTOCOL_IP_TCP:
+		case VP_IP_TCP:
 			sdomain = PF_INET;
 			stype = SOCK_STREAM;
 			sa_in.sin_family = AF_INET;
diff --git a/tools/Makefile b/tools/Makefile
new file mode 100644
index 0000000..7133aa1
--- /dev/null
+++ b/tools/Makefile
@@ -0,0 +1,46 @@
+TARGETS	= libVPN.so
+PREFIX	= /usr/local
+DESTDIR	=
+LIBDIR	= $(PREFIX)/lib
+CC	?= cc
+CPPFLAGSF= -I ../include
+CPPFLAGS= -I $(PREFIX)/include
+CFLAGSF	= -W -fPIC `pkg-config --cflags libApp`
+CFLAGS	= -Wall -g -O2 -pedantic
+LDFLAGSF= `pkg-config --libs libApp`
+LDFLAGS	= 
+AR	?= ar
+RANLIB	?= ranlib
+CCSHARED?= $(CC) -shared
+RM	?= rm -f
+LN	?= ln -f
+MKDIR	?= mkdir -p
+INSTALL	?= install
+
+
+all: $(TARGETS)
+
+libVPN_OBJS = libvpn.o
+libVPN_CFLAGS = $(CPPFLAGSF) $(CPPFLAGS) $(CFLAGSF) $(CFLAGS)
+libVPN_LDFLAGS = $(LDFLAGSF) $(LDFLAGS)
+
+libVPN.so: $(libVPN_OBJS)
+	$(CCSHARED) -o libVPN.so $(libVPN_OBJS) $(libVPN_LDFLAGS)
+
+libvpn.o: libvpn.c ../include/VPN.h
+	$(CC) $(libVPN_CFLAGS) -c libvpn.c
+
+clean:
+	$(RM) -- $(libVPN_OBJS)
+
+distclean: clean
+	$(RM) -- $(TARGETS)
+
+install: $(TARGETS)
+	$(MKDIR) $(DESTDIR)$(PREFIX)/lib/AppWrapper
+	$(INSTALL) -m 0644 -- libVPN.so $(DESTDIR)$(PREFIX)/lib/AppWrapper/libVPN.so
+
+uninstall:
+	$(RM) -- $(DESTDIR)$(PREFIX)/lib/AppWrapper/libVPN.so
+
+.PHONY: all clean distclean install uninstall
diff --git a/tools/libvpn.c b/tools/libvpn.c
new file mode 100644
index 0000000..d791455
--- /dev/null
+++ b/tools/libvpn.c
@@ -0,0 +1,105 @@
+/* $Id$ */
+/* Copyright (c) 2011 Pierre Pronchery <khorben@defora.org> */
+/* This file is part of DeforaOS System VPN */
+/* This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>. */
+
+
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <dlfcn.h>
+#include <sys/socket.h>
+#include <System.h>
+#include <System/App.h>
+#include "../src/common.c"
+
+
+/* libVPN */
+/* private */
+/* types */
+typedef struct _VPNSocket
+{
+	int fd;
+} VPNSocket;
+
+
+/* constants */
+#define PROGNAME	"libVPN"
+#define VPN_OFFSET	1024
+
+
+/* variables */
+static AppClient * _appclient = NULL;
+
+/* local functions */
+static int (*old_connect)(int fd, const struct sockaddr * name,
+		socklen_t namelen);
+
+
+/* prototypes */
+static void _libvpn_init(void);
+
+
+/* functions */
+static void _libvpn_init(void)
+{
+	static void * hdl = NULL;
+	/* FIXME some symbols may be in libsocket.so instead */
+	static char * libc[] = { "/lib/libc.so", "/lib/libc.so.6" };
+	size_t i;
+
+	if(hdl != NULL)
+		return;
+	for(i = 0; i < sizeof(libc) / sizeof(*libc); i++)
+		if((hdl = dlopen(libc[i], RTLD_LAZY)) != NULL)
+			break;
+	if(hdl == NULL)
+	{
+		fprintf(stderr, "%s: %s\n", PROGNAME, dlerror());
+		exit(1);
+	}
+	if((old_connect = dlsym(hdl, "connect")) == NULL)
+	{
+		fprintf(stderr, "%s: %s\n", PROGNAME, dlerror());
+		dlclose(hdl);
+		exit(1);
+	}
+	dlclose(hdl);
+	if((_appclient = appclient_new("VPN")) == NULL)
+	{
+		error_print(PROGNAME);
+		exit(1);
+	}
+}
+
+
+/* public */
+/* interface */
+/* connect */
+int connect(int fd, const struct sockaddr * name, socklen_t namelen)
+{
+	int ret;
+
+	_libvpn_init();
+	if(fd < VPN_OFFSET)
+		return old_connect(fd, name, namelen);
+	if(appclient_call(_appclient, &ret, "connect", fd - VPN_OFFSET) != 0)
+		return -1;
+#ifdef DEBUG
+	fprintf(stderr, "DEBUG: connect(%d) => %d\n", fd - VFS_OFFSET, ret);
+#endif
+	if(ret != 0)
+		return _vpn_errno(_vpn_error, _vpn_error_cnt, -ret, 1);
+	return ret;
+}
diff --git a/tools/project.conf b/tools/project.conf
new file mode 100644
index 0000000..38dd171
--- /dev/null
+++ b/tools/project.conf
@@ -0,0 +1,16 @@
+targets=libVPN
+cppflags_force=-I ../include
+cppflags=-I $(PREFIX)/include
+cflags_force=-W -fPIC `pkg-config --cflags libApp`
+cflags=-Wall -g -O2 -pedantic
+ldflags_force=`pkg-config --libs libApp`
+ldflags=
+dist=Makefile
+
+[libVPN]
+type=plugin
+sources=libvpn.c
+install=$(PREFIX)/lib/AppWrapper
+
+[libvpn.c]
+depends=../include/VPN.h