diff --git a/hosts/yevaud/experiments/pennykettle.nix b/hosts/yevaud/experiments/pennykettle.nix
index 53f7661..80395d3 100644
--- a/hosts/yevaud/experiments/pennykettle.nix
+++ b/hosts/yevaud/experiments/pennykettle.nix
@@ -3,34 +3,33 @@
 {
   networking.nat.enable = true;
   networking.nat.enableIPv6 = true;
-  networking.nat.internalInterfaces = [ "ve-pennykettle1" ];
+  networking.nat.internalInterfaces = [ "ve-pennykettle" ];
   networking.nat.externalInterface = "ens3";
-  networking.firewall.allowedUDPPorts = [ 51821 ];
-  
-  # RA = Router Advertisement (how a host finds a gateway IPv6 address for
-  # SLAAC or DHCPv6).
-  # networkd usually defaults this to true, but instead defaults it to false
-  # for ALL networks if ANY network has IPv6Forwarding enabled, on the
-  # (reasonable) assumption that a host doing IP forwarding is probably a
-  # network bridge.
-  # The kernel's RA implementation does this too, and the NixOS networking.nat
-  # module explicitly overrides that with sysctl, but networkd doesn't pay
-  # attention to that.
-  # We thus explicitly enable it, as otherwise external IPv6 is broken.
-  systemd.network.networks."40-ens3".networkConfig.IPv6AcceptRA = true;
+  networking.nat.forwardPorts = [
+    {
+      sourcePort = 51820;
+      destination = "10.231.136.2:51820";
+      proto = "udp";
+    }
+    {
+      sourcePort = 51820;
+      destination = "[fc00::2]:51820";
+      proto = "udp";
+    }
+  ];
+  networking.firewall.allowedUDPPorts = [ 51820 ];
 
-  containers."pennykettle1" = {
+  containers."pennykettle" = {
     privateNetwork = true;
-    extraVeths."ve-pennykettle1" = {
+    extraVeths."ve-pennykettle" = {
       hostAddress = "10.231.136.1";
       localAddress = "10.231.136.2";
       hostAddress6 = "fc00::1";
       localAddress6 = "fc00::2";
-      forwardPorts = [{ hostPort = 51821; }];
     };
     ephemeral = true;
     autoStart = true;
-    bindMounts."/run/secrets/wg-key".hostPath = config.age.secrets.protonvpn-pennykettle1.path;
+    bindMounts."/run/secrets/wg-key".hostPath = config.age.secrets.protonvpn-pennykettle.path;
 
     config = { config, pkgs, ... }: {
       system.stateVersion = "24.05";
@@ -39,24 +38,23 @@
 
       networking.useDHCP = false;
       networking.useHostResolvConf = false;
-      networking.firewall.allowedUDPPorts = [ 51821 ];
+      networking.firewall.allowedUDPPorts = [ 51820 ];
       systemd.network = {
         enable = true;
 
-        networks."10-ve" = {
-          matchConfig.Name = "ve-pennykettle1";
+        networks."10-ve-pennykettle" = {
+          matchConfig.Name = "ve-pennykettle";
           networkConfig.Address = [ "10.231.136.2/24" "fc00::2/64" ];
-          # linkConfig.RequiredForOnline = "routable";
+          linkConfig.RequiredForOnline = "yes";
           routes = [{
             Gateway = [ "10.231.136.1" "fc00::1" ];
             Destination = "217.138.216.162";
           }];
         };
 
-        networks."30-protonvpn" = {
+        networks."30-wg-protonvpn" = {
           matchConfig.Name = "wg-protonvpn";
           networkConfig = {
-            DefaultRouteOnDevice = true;
             Address = [ "10.2.0.2/32" ];
             DNS = "10.2.0.1";
           };
@@ -64,33 +62,54 @@
             RequiredForOnline = "yes";
             ActivationPolicy = "always-up";
           };
+          routes = [
+            { Gateway = [ "0.0.0.0" ]; }
+            { Gateway = [ "::" ]; } # TODO: ipv6 out is still not working for unclear reasons
+          ];
         };
 
-        netdevs."30-protonvpn" = {
+        netdevs."30-wg-protonvpn" = {
           netdevConfig = {
             Name = "wg-protonvpn";
             Kind = "wireguard";
             Description = "WireGuard tunnel to ProtonVPN (DE#1; NAT: strict, no port forwarding)";
           };
           wireguardConfig = {
-            ListenPort = 51821;
+            ListenPort = 51820;
             PrivateKeyFile = "/run/secrets/wg-key";
           };
           wireguardPeers = [{
             PublicKey = "C+u+eQw5yWI2APCfVJwW6Ovj3g4IrTOfe+tMZnNz43s=";
-            AllowedIPs = "0.0.0.0/0";
+            AllowedIPs = [ "0.0.0.0/0" "::/0" ];
             Endpoint = "217.138.216.162:51820";
             PersistentKeepalive = 5;
           }];
         };
       };
+
+      networking.nat.enable = true;
+      networking.nat.enableIPv6 = true;
+      networking.nat.internalInterfaces = [ "ve-pennykettle" ];
+      networking.nat.externalInterface = "wg-protonvpn";
     };
   };
 
-  age.secrets.protonvpn-pennykettle1 = {
+  age.secrets.protonvpn-pennykettle = {
     file = ../../../secrets/protonvpn-pennykettle1.age;
     owner = "root";
     group = "systemd-network";
     mode = "640";
   };
+
+  # TODO: password-protect the proxy instead of relying on only listening over Tailscale
+  services.microsocks = {
+    enable = true;
+    port = 1080;
+    ip = "::";
+    outgoingBindIp = "fc00::2";
+    # authUsername = "testusername123";
+    # authPasswordFile = pkgs.writeText "testpassword" "testpassworddonotuse";
+    # execWrapper = "${lib.getExe pkgs.strace}";
+  };
+  networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 1080 ];
 }
diff --git a/hosts/yevaud/networking.nix b/hosts/yevaud/networking.nix
index 9423165..d54ca7f 100644
--- a/hosts/yevaud/networking.nix
+++ b/hosts/yevaud/networking.nix
@@ -1,6 +1,5 @@
 { config, lib, pkgs, ... }:
 
 {
-  networking.useNetworkd = true;
   networking.interfaces.ens3.useDHCP = true;
 }