diff --git a/libs/libuecc/Makefile b/libs/libuecc/Makefile
new file mode 100644
index 0000000..ad34f26
--- /dev/null
+++ b/libs/libuecc/Makefile
@@ -0,0 +1,40 @@
+#
+# Copyright (C) 2012 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=libuecc
+PKG_VERSION:=3
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/42
+PKG_MD5SUM:=3c45ffecc7709ea929892993808e218e
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/libuecc
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE:=Very small Elliptic Curve Cryptography library
+  URL:=http://git.universe-factory.net/libuecc/
+endef
+
+CMAKE_OPTIONS += \
+	-DCMAKE_BUILD_TYPE:String="MINSIZEREL"
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/libuecc-$(PKG_VERSION) $(1)/usr/include/
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libuecc.a $(1)/usr/lib/
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libuecc.pc $(1)/usr/lib/pkgconfig/
+endef
+
+$(eval $(call BuildPackage,libuecc))
diff --git a/net/fastd/Config.in b/net/fastd/Config.in
new file mode 100644
index 0000000..93d4375
--- /dev/null
+++ b/net/fastd/Config.in
@@ -0,0 +1,34 @@
+menu "Configuration"
+	depends on PACKAGE_fastd
+
+config FASTD_ENABLE_METHOD_XSALSA20_POLY1305
+	bool "Enable xsalsa20-poly1305 method"
+	depends on PACKAGE_fastd
+	default y
+
+config FASTD_ENABLE_METHOD_AES128_GCM
+	bool "Enable aes128-gcm method"
+	depends on PACKAGE_fastd && (FASTD_ENABLE_CRYPTO_AES128CTR_NACL || FASTD_ENABLE_CRYPTO_AES128CTR_LINUX) && (FASTD_ENABLE_CRYPTO_GHASH_BUILTIN || FASTD_ENABLE_CRYPTO_GHASH_LINUX)
+	default y
+
+config FASTD_ENABLE_CRYPTO_AES128CTR_NACL
+	bool "Include the AES128-CTR implementation from the NaCl library"
+	depends on PACKAGE_fastd
+	default y
+
+config FASTD_ENABLE_CRYPTO_AES128CTR_LINUX
+	bool "Support using the AES128-CTR implementation in the Linux kernel"
+	depends on PACKAGE_fastd
+	default y
+
+config FASTD_ENABLE_CRYPTO_GHASH_BUILTIN
+	bool "Include the built-in GHASH implementation"
+	depends on PACKAGE_fastd
+	default y
+
+config FASTD_ENABLE_CRYPTO_GHASH_LINUX
+	bool "Support using the GHASH implementation in the Linux kernel"
+	depends on PACKAGE_fastd
+	default y
+
+endmenu
diff --git a/net/fastd/Makefile b/net/fastd/Makefile
new file mode 100644
index 0000000..d78ca75
--- /dev/null
+++ b/net/fastd/Makefile
@@ -0,0 +1,118 @@
+#
+# Copyright (C) 2012 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=fastd
+PKG_VERSION:=7
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/43
+PKG_MD5SUM:=17dd6049d072f24dba9d959ac9edbc16
+
+PKG_CONFIG_DEPENDS:=\
+	CONFIG_FASTD_ENABLE_METHOD_XSALSA20_POLY1305 \
+	CONFIG_FASTD_ENABLE_METHOD_AES128_GCM \
+	CONFIG_FASTD_ENABLE_CRYPTO_AES128CTR_NACL \
+	CONFIG_FASTD_ENABLE_CRYPTO_AES128CTR_LINUX \
+	CONFIG_FASTD_ENABLE_CRYPTO_GHASH_BUILTIN \
+	CONFIG_FASTD_ENABLE_CRYPTO_GHASH_LINUX
+
+PKG_BUILD_DEPENDS:=nacl libuecc
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/fastd
+  SECTION:=net
+  CATEGORY:=Network
+  DEPENDS:=+kmod-tun +librt +libpthread
+  TITLE:=Fast and Secure Tunneling Daemon
+  URL:=https://projects.universe-factory.net/projects/fastd
+  SUBMENU:=VPN
+endef
+
+define Package/fastd/config
+  source "$(SOURCE)/Config.in"
+endef
+
+CMAKE_OPTIONS += \
+	-DCMAKE_BUILD_TYPE:String="MINSIZEREL" \
+	-DWITH_CAPABILITIES=FALSE
+
+ifeq ($(CONFIG_FASTD_ENABLE_METHOD_XSALSA20_POLY1305),y)
+CMAKE_OPTIONS += \
+	-DWITH_METHOD_XSALSA20_POLY1305:BOOL=TRUE
+else
+CMAKE_OPTIONS += \
+	-DWITH_METHOD_XSALSA20_POLY1305:BOOL=FALSE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_METHOD_AES128_GCM),y)
+CMAKE_OPTIONS += \
+	-DWITH_METHOD_AES128_GCM:BOOL=TRUE
+else
+CMAKE_OPTIONS += \
+	-DWITH_METHOD_AES128_GCM:BOOL=FALSE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_CRYPTO_AES128CTR_NACL),y)
+CMAKE_OPTIONS += \
+	-DWITH_CRYPTO_AES128CTR_NACL:BOOL=TRUE
+else
+CMAKE_OPTIONS += \
+	-DWITH_CRYPTO_AES128CTR_NACL:BOOL=FALSE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_CRYPTO_AES128CTR_LINUX),y)
+CMAKE_OPTIONS += \
+	-DWITH_CRYPTO_AES128CTR_LINUX:BOOL=TRUE
+else
+CMAKE_OPTIONS += \
+	-DWITH_CRYPTO_AES128CTR_LINUX:BOOL=FALSE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_CRYPTO_GHASH_BUILTIN),y)
+CMAKE_OPTIONS += \
+	-DWITH_CRYPTO_GHASH_BUILTIN:BOOL=TRUE
+else
+CMAKE_OPTIONS += \
+	-DWITH_CRYPTO_GHASH_BUILTIN:BOOL=FALSE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_CRYPTO_GHASH_LINUX),y)
+CMAKE_OPTIONS += \
+	-DWITH_CRYPTO_GHASH_LINUX:BOOL=TRUE
+else
+CMAKE_OPTIONS += \
+	-DWITH_CRYPTO_GHASH_LINUX:BOOL=FALSE
+endif
+
+
+define Package/fastd/description
+ Fast and secure tunneling daemon, which is optimized on small code size and few dependencies
+endef
+
+define Package/fastd/conffiles
+/etc/config/fastd
+endef
+
+define Package/fastd/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/fastd $(1)/usr/bin/
+
+	$(INSTALL_DIR) $(1)/etc/init.d/
+	$(INSTALL_BIN) files/fastd.init $(1)/etc/init.d/fastd
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) files/fastd.config $(1)/etc/config/fastd
+	$(INSTALL_DIR) $(1)/etc/fastd
+	$(INSTALL_DIR) $(1)/lib/upgrade/keep.d
+	$(INSTALL_DATA) files/fastd.upgrade $(1)/lib/upgrade/keep.d/fastd
+endef
+
+$(eval $(call BuildPackage,fastd))
diff --git a/net/fastd/files/fastd.config b/net/fastd/files/fastd.config
new file mode 100644
index 0000000..afba82c
--- /dev/null
+++ b/net/fastd/files/fastd.config
@@ -0,0 +1,94 @@
+package fastd
+
+config fastd sample_config
+
+	# Set to 1 to enable this instance:
+	option enabled 0
+
+	# Sets a static config file, optional
+	# Options set via UCI have higher priority that statically configured ones
+	# If a config file is set all other options except the interface may become optional if the are set in the file
+#	list config '/etc/fastd/sample_config/fastd.conf'
+
+	# Sets a directory from which peers configurations are read
+	# The peer list can be reloaded without restarting fastd
+	# Peer can either be configured via UCI (see example below) or via peer dirs
+	list config_peer_dir '/etc/fastd/sample_config/peers'
+
+	# Sets the log level
+	# Possible values: error, warn, info, verbose, debug
+	# Default: info
+	option syslog_level 'info'
+
+	# IP address and port of the local end, optional
+	# 'any' can be used to bind to both IPv4 and IPv6
+	# If the port is 0 fastd will bind to a random port
+#	list bind 'any:1337'
+#	list bind '0.0.0.0:1337'
+#	list bind '[::]:1337'
+
+	# "method null" uses no encryption or MAC
+	# "method xsalsa20-poly1305" uses the XSalsa20 encryption ad the Poly1305 MAC
+	list method 'xsalsa20-poly1305'
+
+	# "mode tap" will create an ethernet tunnel (tap device),
+	# "mode tun" will create an IP tunnel (tun device).
+	option mode 'tap'
+
+	# Set the name of the tunnel interface to use
+	option interface 'tap0'
+#	option interface 'tun0'
+#	option interface 'fastd0'
+
+	# Sets the MTU of the tunnel interface, default is 1500
+	# 1426 is a good value that avoids fragmentation for the xsalsa20-poly1305 method
+	# when the tunnel uses an IPv4 connection on a line with an MTU of 1492 or higher
+	option mtu 1426
+
+	# Enables direct forwaring of packets between peers
+	# WARNING: Only enable this if you know what you are doing, as this can lead to forwarding loops!
+	option forward 0
+
+	# The secret key
+	# A keypair can be generated with `fastd --generate-key`
+	# When the corresponding public key is lost it can be recovered with `/etc/init.d/fastd show-key <config name>`
+#	option secret '0000000000000000000000000000000000000000000000000000000000000000'
+
+	# command to configure IP addresses etc. after the tunnel interface is up; $1 will be the interface name (optional)
+#	option up ''
+
+	# command to execute before the tunnel interface is set down; $1 will be the interface name (optional)
+#	option down ''
+
+
+config peer sample_peer
+
+	# Set to 1 to enable this peer:
+        option enabled 0
+
+	# Controls which instance this peer is associated with
+        option net 'sample_config'
+
+	# The peer's public key
+	option key '0000000000000000000000000000000000000000000000000000000000000000'
+
+	# A complete remote specification consists of an address or a hostname, and a port
+	# When a hostname is given, it is recommended to specify an address family to use
+
+	# The address to connect to (optional)
+#	option address '192.0.2.1'
+#	option address '[2001:db8::1]'
+
+	# The hostname to connect to (optional)
+#	option hostname 'example.com'
+
+	# The address family to use to connect to the hostname (optional)
+	# Must be 'ipv4' or 'ipv6'
+	# Has no effect when an address is specified
+#	option address_family 'ipv4'
+
+	# The remote port to connect to (optional)
+#	option port 1337
+
+	# Setting float to 1 allow incoming connections with this key from other addresses/hostnames/ports than the specified remote
+	option float 0
diff --git a/net/fastd/files/fastd.init b/net/fastd/files/fastd.init
new file mode 100644
index 0000000..5cea2ee
--- /dev/null
+++ b/net/fastd/files/fastd.init
@@ -0,0 +1,303 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2012-2013 OpenWrt.org
+
+START=95
+
+EXTRA_COMMANDS="up down show_key generate_key"
+
+LIST_SEP="
+"
+TMP_FASTD=/tmp/fastd
+FASTD_COMMAND=/usr/bin/fastd
+
+append_opt() {
+	local v="$1"; local p="$2"
+
+	OPTS="$OPTS --${p//_/-} '${v//'/\\'}'"
+}
+
+append_opt_bool() {
+	local p="$1"
+
+	OPTS="$OPTS --${p//_/-}"
+}
+
+append_opts() {
+	local p; local v; local s="$1"; shift
+	for p in $*; do
+		config_get v "$s" "$p"
+		[ -n "$v" ] && append_opt "$v" "$p"
+	done
+}
+
+append_opts_bool() {
+	local p; local v; local s="$1"; shift
+	for p in $*; do
+		config_get_bool v "$s" "$p" 0
+		[ "$v" = 1 ] && append_opt_bool "$p"
+	done
+}
+
+append_opts_list() {
+	local p; local s="$1"; shift
+	for p in $*; do
+		config_list_foreach "$s" "$p" append_opt "$p"
+	done
+}
+
+section_enabled() {
+	config_get_bool enabled "$1" 'enabled' 0
+	[ $enabled -gt 0 ]
+}
+
+error() {
+	echo "${initscript}:" "$@" 1>&2
+}
+
+create_peer_config() {
+	local s="$2"; local peer="$1"
+
+	config_get net "$peer" net
+	[ "$net" == "$s" ] || return 0
+
+	section_enabled "$peer" || return 0
+
+	config_get key "$peer" key
+	config_get address "$peer" address
+	config_get hostname "$peer" hostname
+	config_get address_family "$peer" address_family
+	config_get port "$peer" port
+	config_get_bool float "$peer" float 0
+
+	if [ -z "$key" ]; then
+		error "peer $peer: key is not set"
+		return 1
+	fi
+
+	local remote=''
+	if [ "$address" -o "$hostname" ]; then
+		if [ "$address" -a "$hostname" ]; then
+			error "peer $peer: both address and hostname given"
+			return 1
+		fi
+
+		if [ "$float" = 0 ]; then
+			float=''
+		else
+			float='float'
+		fi
+
+		if [ "$port" ]; then
+			if [ "$address" ]; then
+				remote="remote $address port $port $float;"
+			else # $hostname
+				if [ "$address_family" -a "$address_family" != 'ipv4' -a "$address_family" != 'ipv6' ]; then
+					error "peer $peer: invalid address family given"
+					return 1
+				fi
+				remote="remote $address_family \"$hostname\" port $port $float;"
+			fi
+		else
+			error "peer $peer: address or hostname, but no port given"
+			return 1
+		fi
+	fi
+
+	cat > "$TMP_FASTD/fastd.$s.peers/$peer" <<EOF
+key "$key";
+$remote
+EOF
+}
+
+update_peers_instance() {
+	local s="$1"
+
+	rm -rf "$TMP_FASTD/fastd.$s.peers"
+	mkdir -p "$TMP_FASTD/fastd.$s.peers"
+
+	config_foreach create_peer_config 'peer' "$s"
+}
+
+get_key_instance() {
+	local s="$1"
+
+	config_get secret "$s" secret
+	if [ "$secret" = 'generate' ]; then
+		secret=`fastd --generate-key --machine-readable`
+		uci -q set fastd."$s".secret="$secret" && uci -q commit fastd
+	fi
+
+	echo "$secret"
+}
+
+generate_key_instance() {
+	local s="$1"
+
+	config_get secret "$s" secret
+	if [ -z "$secret" -o "$secret" = 'generate' ]; then
+		secret=`fastd --generate-key --machine-readable`
+		uci -q set fastd."$s".secret="$secret" && uci -q commit fastd
+	fi
+
+	"$FASTD_COMMAND" --config - --show-key --machine-readable <<EOF
+secret "$secret";
+EOF
+}
+
+show_key_instance() {
+	local s="$1"
+
+	local secret=`get_key_instance "$s"`
+	if [ -z "$secret" ]; then
+		error "$s: secret is not set"
+		return 1
+	fi
+
+	"$FASTD_COMMAND" --config - --show-key --machine-readable <<EOF
+secret "$secret";
+EOF
+}
+
+start_instance() {
+	local s="$1"
+
+	section_enabled "$s" || return 1
+
+	SERVICE_PID_FILE="/var/run/fastd.$s.pid"
+	OPTS=""
+
+	config_get interface "$s" interface
+	if [ -z "$interface" ]; then
+		error "$s: interface is not set"
+		return 1
+	fi
+
+	if ifconfig "$interface" &>/dev/null; then
+		error "$s: interface '$interface' is already in use"
+		return 1
+	fi
+
+	local secret=`get_key_instance "$s"`
+	if [ -z "$secret" ]; then
+		error "$s: secret is not set"
+		return 1
+	fi
+
+	append_opts_list "$s" config config_peer_dir bind method
+	append_opts "$s" syslog_level mode interface mtu
+	append_opts_bool "$s" forward
+
+	update_peers_instance "$s"
+
+	eval service_start "'$FASTD_COMMAND'" --daemon --pid-file "'$SERVICE_PID_FILE'" --syslog-level info $OPTS --config-peer-dir "$TMP_FASTD/fastd.$s.peers" --config - <<EOF
+secret "$secret";
+EOF
+
+	if ! ifconfig "$interface" >/dev/null 2>&1; then
+		error "$s: startup failed"
+		return 1
+	fi
+
+	config_get up "$s" up
+	[ -n "$up" ] && sh -c "$up" - "$interface"
+}
+
+stop_instance() {
+	local s="$1"
+
+	section_enabled "$s" || return 1
+
+	SERVICE_PID_FILE="/var/run/fastd.$s.pid"
+
+	config_get interface "$s" interface
+	if [ -z "$interface" ]; then
+		error "$s: interface is not set"
+		return 1
+	fi
+
+	if ! ifconfig "$interface" &>/dev/null; then
+		error "$s: interface '$interface' does not exist"
+		return 1
+	fi
+
+	config_get down "$s" down
+	[ -n "$down" ] && sh -c "$down" - "$interface"
+
+	service_stop "$FASTD_COMMAND"
+
+	rm -rf "$TMP_FASTD/fastd.$s.peers"
+}
+
+reload_instance() {
+        local s="$1"
+
+        section_enabled "$s" || return 1
+
+	update_peers_instance "$s"
+
+        SERVICE_PID_FILE="/var/run/fastd.$s.pid"
+        service_reload "$FASTD_COMMAND"
+}
+
+start() {
+	config_load 'fastd'
+	config_foreach start_instance 'fastd'
+}
+
+stop() {
+	config_load 'fastd'
+	config_foreach stop_instance 'fastd'
+}
+
+reload() {
+        config_load 'fastd'
+        config_foreach reload_instance 'fastd'
+}
+
+up() {
+	local exists
+	local instance
+	config_load 'fastd'
+	for instance in "$@"; do
+		config_get exists "$instance" 'TYPE'
+		if [ "$exists" = 'fastd' ]; then
+			start_instance "$instance"
+		fi
+	done
+}
+
+down() {
+	local exists
+	local instance
+	config_load 'fastd'
+	for instance in "$@"; do
+		config_get exists "$instance" 'TYPE'
+		if [ "$exists" = 'fastd' ]; then
+			stop_instance "$instance"
+		fi
+	done
+}
+
+show_key() {
+	local exists
+	local instance
+	config_load 'fastd'
+	for instance in "$@"; do
+		config_get exists "$instance" 'TYPE'
+		if [ "$exists" = 'fastd' ]; then
+			show_key_instance "$instance"
+		fi
+	done
+}
+
+generate_key() {
+	local exists
+	local instance
+	config_load 'fastd'
+	for instance in "$@"; do
+		config_get exists "$instance" 'TYPE'
+		if [ "$exists" = 'fastd' ]; then
+			generate_key_instance "$instance"
+		fi
+	done
+}
diff --git a/net/fastd/files/fastd.upgrade b/net/fastd/files/fastd.upgrade
new file mode 100644
index 0000000..7406613
--- /dev/null
+++ b/net/fastd/files/fastd.upgrade
@@ -0,0 +1 @@
+/etc/fastd/