diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..d8c8979
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+.zig-cache
+zig-out
diff --git a/build.zig b/build.zig
index 5b21e2d..8df2ed5 100644
--- a/build.zig
+++ b/build.zig
@@ -64,18 +64,8 @@ pub fn build(b: *std.Build) void {
     const run_step = b.step("run", "Run the app");
     run_step.dependOn(&run_cmd.step);
 
-    // Creates a step for unit testing. This only builds the test executable
-    // but does not run it.
-    const lib_unit_tests = b.addTest(.{
-        .root_source_file = b.path("src/root.zig"),
-        .target = target,
-        .optimize = optimize,
-    });
-
-    const run_lib_unit_tests = b.addRunArtifact(lib_unit_tests);
-
     const exe_unit_tests = b.addTest(.{
-        .root_source_file = b.path("src/main.zig"),
+        .root_source_file = b.path("src/test_all.zig"),
         .target = target,
         .optimize = optimize,
     });
@@ -86,6 +76,5 @@ pub fn build(b: *std.Build) void {
     // the `zig build --help` menu, providing a way for the user to request
     // running the unit tests.
     const test_step = b.step("test", "Run unit tests");
-    test_step.dependOn(&run_lib_unit_tests.step);
     test_step.dependOn(&run_exe_unit_tests.step);
 }
diff --git a/src/main.zig b/src/main.zig
index c8a3f67..6275bbc 100644
--- a/src/main.zig
+++ b/src/main.zig
@@ -16,6 +16,10 @@ pub fn main() !void {
     try bw.flush(); // don't forget to flush!
 }
 
+const Tunnel = struct {
+    name: []u8,
+};
+
 test "simple test" {
     var list = std.ArrayList(i32).init(std.testing.allocator);
     defer list.deinit(); // try commenting this out and see if zig detects the memory leak!
diff --git a/src/root.zig b/src/root.zig
deleted file mode 100644
index ecfeade..0000000
--- a/src/root.zig
+++ /dev/null
@@ -1,10 +0,0 @@
-const std = @import("std");
-const testing = std.testing;
-
-export fn add(a: i32, b: i32) i32 {
-    return a + b;
-}
-
-test "basic add functionality" {
-    try testing.expect(add(3, 7) == 10);
-}
diff --git a/src/test_all.zig b/src/test_all.zig
new file mode 100644
index 0000000..ccc5f94
--- /dev/null
+++ b/src/test_all.zig
@@ -0,0 +1,4 @@
+test "nyotun test suite" {
+    _ = @import("main.zig");
+    _ = @import("tunnel.zig");
+}
diff --git a/src/tunnel.zig b/src/tunnel.zig
new file mode 100644
index 0000000..c570a83
--- /dev/null
+++ b/src/tunnel.zig
@@ -0,0 +1,62 @@
+const std = @import("std");
+const os = std.os;
+const mem = std.mem;
+const posix = std.posix;
+
+const log = std.log.scoped(.nyotun);
+
+const IFF_TUN = 0x0001; // <linux/if_tun.h>
+const IFF_NO_PI = 0x1000; // <linux/if_tun.h>
+const TUNSETIFF = 0x800454ca; // same value on all archs, see go/src/syscall/*.go
+
+dev: [posix.IFNAMESIZE - 1:0]u8,
+tunFile: posix.fd_t,
+
+pub fn init(devname: ?[]const u8) !Tunnel {
+    const tunFile = try posix.open(
+        "/dev/net/tun",
+        posix.O{
+            .ACCMODE = .RDWR,
+            .CLOEXEC = true,
+        },
+        0,
+    );
+    errdefer posix.close(tunFile);
+
+    var ifr: posix.ifreq = undefined;
+    @memset(@as([*]u8, @ptrCast(&ifr))[0..@sizeOf(posix.ifreq)], 0);
+
+    ifr.ifru.flags = IFF_TUN | IFF_NO_PI;
+
+    if (devname) |name| {
+        if (name.len >= posix.IFNAMESIZE - 1) {
+            return error.BadInterfaceName;
+        }
+        @memcpy(ifr.ifrn.name[0..name.len], name);
+    }
+
+    const err = posix.system.ioctl(tunFile, TUNSETIFF, @intFromPtr(&ifr));
+    if (posix.errno(err) != .SUCCESS) {
+        log.err("unable to set TUNSETIFF: {s}", .{@tagName(posix.errno(err))});
+        return error.OpenDevTun;
+    }
+
+    var tunnel = Tunnel{
+        .dev = undefined,
+        .tunFile = tunFile,
+    };
+    @memcpy(tunnel.dev[0..posix.IFNAMESIZE], mem.sliceTo(&ifr.ifrn.name, 0));
+
+    return tunnel;
+}
+
+pub fn close(self: *Tunnel) void {
+    posix.close(self.tunFile);
+}
+
+const Tunnel = @This();
+
+test "init tunnel" {
+    var tun = try init("nyotun");
+    tun.close();
+}