diff --git a/go.mod b/go.mod
index c73bb1502..0d74b74b5 100644
--- a/go.mod
+++ b/go.mod
@@ -17,7 +17,7 @@ require (
 	github.com/pborman/getopt v0.0.0-20190409184431-ee0cd42419d3
 	github.com/tailscale/hujson v0.0.0-20190930033718-5098e564d9b3
 	github.com/tailscale/winipcfg-go v0.0.0-20200213045944-185b07f8233f
-	github.com/tailscale/wireguard-go v0.0.0-20200223182756-33c04a0e6a73
+	github.com/tailscale/wireguard-go v0.0.0-20200224122332-ad79bbddc844
 	golang.org/x/crypto v0.0.0-20200210222208-86ce3cb69678
 	golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
 	golang.org/x/sys v0.0.0-20200217220822-9197077df867
diff --git a/wgengine/magicsock/magicsock.go b/wgengine/magicsock/magicsock.go
index a4dd512db..c6643a0f2 100644
--- a/wgengine/magicsock/magicsock.go
+++ b/wgengine/magicsock/magicsock.go
@@ -21,6 +21,7 @@
 	"syscall"
 	"time"
 
+	"github.com/tailscale/wireguard-go/conn"
 	"github.com/tailscale/wireguard-go/device"
 	"github.com/tailscale/wireguard-go/wgcfg"
 	"tailscale.com/derp"
@@ -415,7 +416,7 @@ func appendDests(dsts []*net.UDPAddr, as *AddrSet, b []byte) (_ []*net.UDPAddr,
 
 var errNoDestinations = errors.New("magicsock: no destinations")
 
-func (c *Conn) Send(b []byte, ep device.Endpoint) error {
+func (c *Conn) Send(b []byte, ep conn.Endpoint) error {
 	as := ep.(*AddrSet)
 
 	var addrBuf [8]*net.UDPAddr
@@ -622,7 +623,7 @@ type udpReadResult struct {
 // immediate cancellation of network operations.
 var aLongTimeAgo = time.Unix(233431200, 0)
 
-func (c *Conn) ReceiveIPv4(b []byte) (n int, ep device.Endpoint, addr *net.UDPAddr, err error) {
+func (c *Conn) ReceiveIPv4(b []byte) (n int, ep conn.Endpoint, addr *net.UDPAddr, err error) {
 	go func() {
 		// Read a packet, and process any STUN packets before returning.
 		for {
@@ -694,7 +695,7 @@ func (c *Conn) ReceiveIPv4(b []byte) (n int, ep device.Endpoint, addr *net.UDPAd
 	return n, addrSet, addr, nil
 }
 
-func (c *Conn) ReceiveIPv6(buff []byte) (int, device.Endpoint, *net.UDPAddr, error) {
+func (c *Conn) ReceiveIPv6(buff []byte) (int, conn.Endpoint, *net.UDPAddr, error) {
 	// TODO(crawshaw): IPv6 support
 	return 0, nil, nil, syscall.EAFNOSUPPORT
 }
@@ -705,6 +706,7 @@ func (c *Conn) SetPrivateKey(privateKey wgcfg.PrivateKey) error {
 }
 
 func (c *Conn) SetMark(value uint32) error { return nil }
+func (c *Conn) LastMark() uint32           { return 0 }
 
 func (c *Conn) Close() error {
 	select {
@@ -755,7 +757,7 @@ func (c *Conn) LinkChange() {
 	c.pconn.Reset(packetConn.(*net.UDPConn))
 }
 
-// AddrSet is a set of UDP addresses that implements wireguard/device.Endpoint.
+// AddrSet is a set of UDP addresses that implements wireguard/conn.Endpoint.
 type AddrSet struct {
 	publicKey key.Public    // peer public key used for DERP communication
 	addrs     []net.UDPAddr // ordered priority list (low to high) provided by wgengine
@@ -935,7 +937,7 @@ func (a *AddrSet) Addrs() []wgcfg.Endpoint {
 // CreateEndpoint is called by WireGuard to connect to an endpoint.
 // The key is the public key of the peer and addrs is a
 // comma-separated list of UDP ip:ports.
-func (c *Conn) CreateEndpoint(key [32]byte, addrs string) (device.Endpoint, error) {
+func (c *Conn) CreateEndpoint(key [32]byte, addrs string) (conn.Endpoint, error) {
 	pk := wgcfg.Key(key)
 	log.Printf("magicsock: CreateEndpoint: key=%s: %s", pk.ShortString(), addrs)
 	a := &AddrSet{
diff --git a/wgengine/userspace.go b/wgengine/userspace.go
index 0d549691e..dbb2cc614 100644
--- a/wgengine/userspace.go
+++ b/wgengine/userspace.go
@@ -13,6 +13,7 @@
 	"sync"
 	"time"
 
+	"github.com/tailscale/wireguard-go/conn"
 	"github.com/tailscale/wireguard-go/device"
 	"github.com/tailscale/wireguard-go/tun"
 	"github.com/tailscale/wireguard-go/wgcfg"
@@ -151,7 +152,7 @@ func newUserspaceEngineAdvanced(logf logger.Logf, tundev tun.Device, routerGen R
 			// here.
 			go e.RequestStatus()
 		},
-		CreateBind: func(uint16) (device.Bind, uint16, error) {
+		CreateBind: func(uint16) (conn.Bind, uint16, error) {
 			return e.magicConn, e.magicConn.LocalPort(), nil
 		},
 		CreateEndpoint: e.magicConn.CreateEndpoint,