diff --git a/include/llarp.h b/include/llarp.h
deleted file mode 100644
index e86360d9a..000000000
--- a/include/llarp.h
+++ /dev/null
@@ -1,110 +0,0 @@
-#ifndef LLARP_H_
-#define LLARP_H_
-#include <stdint.h>
-#include <unistd.h>
-
-namespace llarp
-{
-  struct Context;
-}
-
-#ifdef __cplusplus
-extern "C"
-{
-#endif
-
-  /// packet writer to send packets to lokinet internals
-  struct llarp_vpn_writer_pipe;
-  /// packet reader to recv packets from lokinet internals
-  struct llarp_vpn_reader_pipe;
-
-  /// vpn io api
-  /// all hooks called in native code
-  /// for use with a vpn interface managed by external code
-  /// the external vpn interface MUST be up and have addresses set
-  struct llarp_vpn_io
-  {
-    /// private implementation
-    void* impl;
-    /// user data
-    void* user;
-    /// hook set by user called by lokinet core when lokinet is done with the
-    /// vpn io
-    void (*closed)(struct llarp_vpn_io*);
-    /// hook set by user called from lokinet core after attempting to inject
-    /// into endpoint passed a bool set to true if we were injected otherwise
-    /// set to false
-    void (*injected)(struct llarp_vpn_io*, bool);
-    /// hook set by user called every event loop tick
-    void (*tick)(struct llarp_vpn_io*);
-  };
-
-  /// info about the network interface that we give to lokinet core
-  struct llarp_vpn_ifaddr_info
-  {
-    /// name of the network interface
-    char ifname[64];
-    /// interface's address as string
-    char ifaddr[128];
-    /// netmask number of bits set
-    uint8_t netmask;
-  };
-
-  /// initialize llarp_vpn_io private implementation
-  /// returns false if either parameter is nullptr
-  bool
-  llarp_vpn_io_init(llarp::Context* ctx, struct llarp_vpn_io* io);
-
-  /// get the packet pipe for writing IP packets to lokinet internals
-  /// returns nullptr if llarp_vpn_io is nullptr or not initialized
-  struct llarp_vpn_pkt_writer*
-  llarp_vpn_io_packet_writer(struct llarp_vpn_io* io);
-
-  /// get the packet pipe for reading IP packets from lokinet internals
-  /// returns nullptr if llarp_vpn_io is nullptr or not initialized
-  struct llarp_vpn_pkt_reader*
-  llarp_vpn_io_packet_reader(struct llarp_vpn_io* io);
-
-  /// blocking read on packet reader from lokinet internals
-  /// returns -1 on error, returns size of packet read
-  /// thread safe
-  ssize_t
-  llarp_vpn_io_readpkt(struct llarp_vpn_pkt_reader* r, unsigned char* dst, size_t dstlen);
-
-  /// blocking write on packet writer to lokinet internals
-  /// returns false if we can't write this packet
-  /// return true if we wrote this packet
-  /// thread safe
-  bool
-  llarp_vpn_io_writepkt(struct llarp_vpn_pkt_writer* w, unsigned char* pktbuf, size_t pktlen);
-
-  /// close vpn io and free private implementation after done
-  /// operation is async and calls llarp_vpn_io.closed after fully closed
-  /// after fully closed the llarp_vpn_io MUST be re-initialized by
-  /// llarp_vpn_io_init if it is to be used again
-  void
-  llarp_vpn_io_close_async(struct llarp_vpn_io* io);
-
-  /// give main context a vpn io for mobile when it is reader to do io with
-  /// associated info tries to give the vpn io to endpoint with name epName a
-  /// deferred call to llarp_vpn_io.injected is queued unconditionally
-  /// thread safe
-  bool
-  llarp_main_inject_vpn_by_name(
-      struct llarp::Context* m,
-      const char* epName,
-      struct llarp_vpn_io* io,
-      struct llarp_vpn_ifaddr_info info);
-
-  /// give main context a vpn io on its default endpoint
-  static bool
-  llarp_main_inject_default_vpn(
-      struct llarp::Context* m, struct llarp_vpn_io* io, struct llarp_vpn_ifaddr_info info)
-  {
-    return llarp_main_inject_vpn_by_name(m, "default", io, info);
-  }
-
-#ifdef __cplusplus
-}
-#endif
-#endif
diff --git a/include/llarp.hpp b/include/llarp.hpp
index 99e60b561..7d326600e 100644
--- a/include/llarp.hpp
+++ b/include/llarp.hpp
@@ -1,6 +1,5 @@
 #ifndef LLARP_HPP
 #define LLARP_HPP
-#include <llarp.h>
 
 #include <future>
 #include <iostream>
diff --git a/llarp/CMakeLists.txt b/llarp/CMakeLists.txt
index 5866eb53f..54566ee07 100644
--- a/llarp/CMakeLists.txt
+++ b/llarp/CMakeLists.txt
@@ -107,8 +107,6 @@ add_library(liblokinet
 
   consensus/table.cpp
 
-  ev/vpnio.cpp
-
   bootstrap.cpp
   context.cpp
   crypto/crypto_libsodium.cpp
diff --git a/llarp/context.cpp b/llarp/context.cpp
index 887b2803c..47c8a68f6 100644
--- a/llarp/context.cpp
+++ b/llarp/context.cpp
@@ -6,7 +6,6 @@
 #include "crypto/crypto_libsodium.hpp"
 #include "dht/context.hpp"
 #include "ev/ev.hpp"
-#include "ev/vpnio.hpp"
 #include <memory>
 #include "nodedb.hpp"
 #include "router/router.hpp"
@@ -201,87 +200,3 @@ namespace llarp
 #endif
 
 }  // namespace llarp
-
-extern "C"
-{
-  ssize_t
-  llarp_vpn_io_readpkt(struct llarp_vpn_pkt_reader* r, unsigned char* dst, size_t dstlen)
-  {
-    if (r == nullptr)
-      return -1;
-    if (not r->queue.enabled())
-      return -1;
-    auto pkt = r->queue.popFront();
-    ManagedBuffer mbuf = pkt.ConstBuffer();
-    const llarp_buffer_t& buf = mbuf;
-    if (buf.sz > dstlen || buf.sz == 0)
-      return -1;
-    std::copy_n(buf.base, buf.sz, dst);
-    return buf.sz;
-  }
-
-  bool
-  llarp_vpn_io_writepkt(struct llarp_vpn_pkt_writer* w, unsigned char* pktbuf, size_t pktlen)
-  {
-    if (pktlen == 0 || pktbuf == nullptr)
-      return false;
-    if (w == nullptr)
-      return false;
-    llarp_vpn_pkt_queue::Packet_t pkt;
-    llarp_buffer_t buf(pktbuf, pktlen);
-    if (not pkt.Load(buf))
-      return false;
-    return w->queue.pushBack(std::move(pkt)) == llarp::thread::QueueReturn::Success;
-  }
-
-  bool
-  llarp_main_inject_vpn_by_name(
-      llarp::Context* ctx,
-      const char* name,
-      struct llarp_vpn_io* io,
-      struct llarp_vpn_ifaddr_info info)
-  {
-    if (name == nullptr || io == nullptr)
-      return false;
-    if (ctx == nullptr || ctx->router == nullptr)
-      return false;
-    auto ep = ctx->router->hiddenServiceContext().GetEndpointByName(name);
-    return ep && ep->InjectVPN(io, info);
-  }
-
-  void
-  llarp_vpn_io_close_async(struct llarp_vpn_io* io)
-  {
-    if (io == nullptr || io->impl == nullptr)
-      return;
-    static_cast<llarp_vpn_io_impl*>(io->impl)->AsyncClose();
-  }
-
-  bool
-  llarp_vpn_io_init(llarp::Context* ctx, struct llarp_vpn_io* io)
-  {
-    if (io == nullptr || ctx == nullptr)
-      return false;
-    llarp_vpn_io_impl* impl = new llarp_vpn_io_impl(ctx, io);
-    io->impl = impl;
-    return true;
-  }
-
-  struct llarp_vpn_pkt_writer*
-  llarp_vpn_io_packet_writer(struct llarp_vpn_io* io)
-  {
-    if (io == nullptr || io->impl == nullptr)
-      return nullptr;
-    llarp_vpn_io_impl* vpn = static_cast<llarp_vpn_io_impl*>(io->impl);
-    return &vpn->writer;
-  }
-
-  struct llarp_vpn_pkt_reader*
-  llarp_vpn_io_packet_reader(struct llarp_vpn_io* io)
-  {
-    if (io == nullptr || io->impl == nullptr)
-      return nullptr;
-    llarp_vpn_io_impl* vpn = static_cast<llarp_vpn_io_impl*>(io->impl);
-    return &vpn->reader;
-  }
-}
diff --git a/llarp/ev/vpnio.cpp b/llarp/ev/vpnio.cpp
deleted file mode 100644
index cb98bd05c..000000000
--- a/llarp/ev/vpnio.cpp
+++ /dev/null
@@ -1,25 +0,0 @@
-#include "vpnio.hpp"
-#include <llarp.hpp>
-#include <llarp/router/abstractrouter.hpp>
-
-void
-llarp_vpn_io_impl::AsyncClose()
-{
-  reader.queue.disable();
-  writer.queue.disable();
-
-  // TODO: call asynchronously
-  if (ctx)
-    ctx->CallSafe([this]() { Expunge(); });
-  else
-    Expunge();
-}
-
-void
-llarp_vpn_io_impl::Expunge()
-{
-  parent->impl = nullptr;
-  if (parent->closed)
-    parent->closed(parent);
-  delete this;
-}
diff --git a/llarp/ev/vpnio.hpp b/llarp/ev/vpnio.hpp
deleted file mode 100644
index f333fd728..000000000
--- a/llarp/ev/vpnio.hpp
+++ /dev/null
@@ -1,43 +0,0 @@
-#pragma once
-#include <llarp/net/ip_packet.hpp>
-#include <llarp/util/thread/queue.hpp>
-#include <llarp.hpp>
-#include <functional>
-
-struct llarp_main;
-struct llarp_vpn_io;
-
-struct llarp_vpn_pkt_queue
-{
-  using Packet_t = llarp::net::IPPacket;
-  llarp::thread::Queue<Packet_t> queue;
-
-  llarp_vpn_pkt_queue() : queue(1024){};
-  ~llarp_vpn_pkt_queue() = default;
-};
-
-struct llarp_vpn_pkt_writer : public llarp_vpn_pkt_queue
-{};
-
-struct llarp_vpn_pkt_reader : public llarp_vpn_pkt_queue
-{};
-
-struct llarp_vpn_io_impl
-{
-  llarp_vpn_io_impl(llarp::Context* c, llarp_vpn_io* io) : ctx(c), parent(io)
-  {}
-  ~llarp_vpn_io_impl() = default;
-
-  llarp::Context* ctx;
-  llarp_vpn_io* parent;
-
-  llarp_vpn_pkt_writer writer;
-  llarp_vpn_pkt_reader reader;
-
-  void
-  AsyncClose();
-
- private:
-  void
-  Expunge();
-};
diff --git a/llarp/service/endpoint.hpp b/llarp/service/endpoint.hpp
index 0df51e15d..1d99eda29 100644
--- a/llarp/service/endpoint.hpp
+++ b/llarp/service/endpoint.hpp
@@ -1,5 +1,4 @@
 #pragma once
-#include <llarp.h>
 #include <llarp/dht/messages/gotrouter.hpp>
 #include <llarp/ev/ev.hpp>
 #include <llarp/exit/session.hpp>
@@ -115,14 +114,6 @@ namespace llarp
       std::optional<ConvoTag>
       GetBestConvoTagForService(Address addr) const;
 
-      /// inject vpn io
-      /// return false if not supported
-      virtual bool
-      InjectVPN(llarp_vpn_io*, llarp_vpn_ifaddr_info)
-      {
-        return false;
-      }
-
       /// get our ifaddr if it is set
       virtual huint128_t
       GetIfAddr() const