diff --git a/hosts/deertopia/configuration.nix b/hosts/deertopia/configuration.nix
index 507fd45..bd50c59 100755
--- a/hosts/deertopia/configuration.nix
+++ b/hosts/deertopia/configuration.nix
@@ -1,4 +1,5 @@
 { config, pkgs, lib, disko, sydnix-cli, ... }:
+
 {
   imports = [
     ./hardware.nix
@@ -103,6 +104,7 @@
     waypipe
     sydnix-cli.packages.x86_64-linux.default
     (import ../../scripts/port-tools { inherit pkgs; })
+    (import ../../scripts/vpn-tools { inherit pkgs; })
   ];
 
   services.openssh = {
diff --git a/scripts/port-tools/result b/scripts/port-tools/result
deleted file mode 120000
index 3d1e4ab..0000000
--- a/scripts/port-tools/result
+++ /dev/null
@@ -1 +0,0 @@
-/nix/store/vnfvgwnkx6jf2cmla3lsmj3kpnxmyv7k-ports
\ No newline at end of file
diff --git a/scripts/vpn-tools/.envrc b/scripts/vpn-tools/.envrc
new file mode 100644
index 0000000..1d953f4
--- /dev/null
+++ b/scripts/vpn-tools/.envrc
@@ -0,0 +1 @@
+use nix
diff --git a/scripts/vpn-tools/bb.edn b/scripts/vpn-tools/bb.edn
new file mode 100644
index 0000000..e69de29
diff --git a/scripts/vpn-tools/default.nix b/scripts/vpn-tools/default.nix
new file mode 100644
index 0000000..f5ed414
--- /dev/null
+++ b/scripts/vpn-tools/default.nix
@@ -0,0 +1,7 @@
+{ pkgs ? import <nixpkgs> {} }:
+
+pkgs.writeShellScriptBin "vpn" ''
+  exit=0
+  ${pkgs.babashka}/bin/bb --init "${./vpn}" -m vpn-tools -- "$@" || exit=$?
+  exit $exit
+''
diff --git a/scripts/vpn-tools/shell.nix b/scripts/vpn-tools/shell.nix
new file mode 100644
index 0000000..d0fadf6
--- /dev/null
+++ b/scripts/vpn-tools/shell.nix
@@ -0,0 +1,7 @@
+{ pkgs ? import <nixpkgs> {} }:
+
+pkgs.mkShell {
+  packages = [
+    pkgs.babashka
+  ];
+}
diff --git a/scripts/vpn-tools/vpn b/scripts/vpn-tools/vpn
new file mode 100755
index 0000000..b5a5ec6
--- /dev/null
+++ b/scripts/vpn-tools/vpn
@@ -0,0 +1,58 @@
+#!/usr/bin/env sh
+:$(); # -*- mode: clojure -*-
+:$(); exit=0
+:$(); bb --init "$0" -- "$@" || exit=$?
+:$(); exit $exit
+(ns vpn-tools
+  (:require [babashka.cli :as cli]
+            [babashka.process :as p]
+            [babashka.http-client :as http])
+  (:import [clojure.lang ExceptionInfo]))
+
+(defn adorn-with-help-option [spec]
+  (letfn [(fn-with-help [opts]
+            ;; TODO: Implement
+            ((:fn spec) opts))]
+    (-> spec
+        (assoc-in [:spec :help]
+                  {:help {:coerce :bool}})
+        (assoc :fn fn-with-help))))
+
+(defn help [opts]
+  (prn 'help))
+
+(defn vpn-shell [opts]
+  (let [cmd (or (:args opts) ["bash"])
+        user (System/getenv "USER")
+        namespace (-> opts :opts :namespace)
+        ip-cmd (concat ["sudo" "ip" "netns" "exec"
+                        namespace "sudo" "-u" user]
+                       cmd)]
+    (apply println "$" ip-cmd)
+    (-> (apply p/shell ip-cmd)
+        :exit System/exit)))
+
+(defn test-mullvad [_opts]
+  (p/shell "curl https://am.i.mullvad.net/connected"))
+
+(def namespace-option
+  {:namespace {:coerce :string
+               :alias :n
+               :default "wg"
+               :ref "NAMESPACE"}})
+
+(def cli-table
+  (map adorn-with-help-option
+       [{:cmds ["shell"]
+         :fn vpn-shell
+         :spec namespace-option}
+        {:cmds ["test-mullvad"]
+         :fn test-mullvad}
+        {:cmds []
+         :fn help}]))
+
+(defn -main [& args]
+  (cli/dispatch cli-table args))
+
+#_
+(apply -main *command-line-args*)