diff --git a/commands/start.go b/commands/start.go
index abcaeff3..115009a2 100644
--- a/commands/start.go
+++ b/commands/start.go
@@ -94,11 +94,14 @@ func (g *start) Check() error {
 }
 
 func (g *start) Run() error {
-	defer data.TearDown()
 
+	var err error
+	defer func() {
+		data.TearDown()
+	}()
 	error := make(chan error)
 
-	err := router.Setup(error, !g.noIptables)
+	err = router.Setup(error, !g.noIptables)
 	if err != nil {
 		return fmt.Errorf("unable to start router: %v", err)
 	}
diff --git a/go.mod b/go.mod
index 8569ae67..690b2244 100644
--- a/go.mod
+++ b/go.mod
@@ -60,6 +60,7 @@ require (
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.26.0 // indirect
 	github.com/prometheus/procfs v0.6.0 // indirect
+	github.com/r3labs/diff v1.1.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/soheilhy/cmux v0.1.5 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
diff --git a/go.sum b/go.sum
index 8a68b0ab..0a61d19b 100644
--- a/go.sum
+++ b/go.sum
@@ -210,6 +210,8 @@ github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsT
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0 h1:mxy4L2jP6qMonqmq+aTtOx1ifVWUgG/TAmntgbh3xv4=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/r3labs/diff v1.1.0 h1:V53xhrbTHrWFWq3gI4b94AjgEJOerO1+1l0xyHOBi8M=
+github.com/r3labs/diff v1.1.0/go.mod h1:7WjXasNzi0vJetRcB/RqNl5dlIsmXcTTLmF5IoH6Xig=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
 github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
@@ -229,6 +231,7 @@ github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
diff --git a/internal/acls/acls.go b/internal/acls/acls.go
new file mode 100644
index 00000000..5e5aca1b
--- /dev/null
+++ b/internal/acls/acls.go
@@ -0,0 +1,7 @@
+package acls
+
+type Acl struct {
+	Mfa   []string `json:",omitempty"`
+	Allow []string `json:",omitempty"`
+	Deny  []string `json:",omitempty"`
+}
diff --git a/internal/config/config.go b/internal/config/config.go
index e9d525ab..64406fe3 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -96,6 +96,7 @@ type Config struct {
 		ListenAddresses  []string
 		Peers            map[string][]string
 		DatabaseLocation string
+		ETCDLogLevel     string
 	}
 
 	Authenticators struct {
@@ -152,44 +153,6 @@ func Values() Config {
 	return v
 }
 
-func GetEffectiveAcl(username string) acls.Acl {
-	valuesLock.RLock()
-	defer valuesLock.RUnlock()
-
-	var resultingACLs acls.Acl
-	//Add the server address by default
-	resultingACLs.Allow = []string{values.Wireguard.ServerAddress.String() + "/32"}
-
-	// Add dns servers if defined
-	// Make sure we resolve the dns servers in case someone added them as domains, so that clients dont get stuck trying to use the domain dns servers to look up the dns servers
-	// Restrict dns servers to only having 53/any by default as per #49
-	for _, server := range values.Wireguard.DNS {
-		resultingACLs.Allow = append(resultingACLs.Allow, fmt.Sprintf("%s 53/any", server))
-	}
-
-	if allPolicy, ok := values.Acls.Policies["*"]; ok {
-		resultingACLs.Allow = append(resultingACLs.Allow, allPolicy.Allow...)
-		resultingACLs.Mfa = append(resultingACLs.Mfa, allPolicy.Mfa...)
-	}
-
-	//If the user has any user specific rules, add those
-	if acl, ok := values.Acls.Policies[username]; ok {
-		resultingACLs.Allow = append(resultingACLs.Allow, acl.Allow...)
-		resultingACLs.Mfa = append(resultingACLs.Mfa, acl.Mfa...)
-	}
-
-	//This may get expensive if the user belongs to a large number of
-	for group := range values.Acls.rGroupLookup[username] {
-		//If the user belongs to a series of groups, grab those, and add their rules
-		if acl, ok := values.Acls.Policies[group]; ok {
-			resultingACLs.Allow = append(resultingACLs.Allow, acl.Allow...)
-			resultingACLs.Mfa = append(resultingACLs.Mfa, acl.Mfa...)
-		}
-	}
-
-	return resultingACLs
-}
-
 // Used in authentication methods that can specify user groups directly (for the moment just oidc)
 // Adds groups to username, even if user does not exist in the config.json file, so GetEffectiveAcls works
 func AddVirtualUser(username string, groups []string) {
diff --git a/internal/data/acls.go b/internal/data/acls.go
new file mode 100644
index 00000000..74213865
--- /dev/null
+++ b/internal/data/acls.go
@@ -0,0 +1,118 @@
+package data
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/NHAS/wag/internal/acls"
+	"github.com/NHAS/wag/internal/config"
+	clientv3 "go.etcd.io/etcd/client/v3"
+)
+
+func SetAcl(effects string, policy acls.Acl, overwrite bool) error {
+
+	response, err := etcd.Get(context.Background(), "wag-acls-"+effects)
+	if err != nil {
+		return err
+	}
+
+	if len(response.Kvs) > 0 && !overwrite {
+		return errors.New("acl already exists")
+	}
+
+	policyJson, _ := json.Marshal(policy)
+
+	_, err = etcd.Put(context.Background(), "wag-acls-"+effects, string(policyJson))
+
+	return err
+}
+
+func RemoveAcl(effects string) error {
+	_, err := etcd.Delete(context.Background(), "wag-acls-"+effects)
+	return err
+}
+
+func GetEffectiveAcl(username string) acls.Acl {
+	var resultingACLs acls.Acl
+	//Add the server address by default
+	resultingACLs.Allow = []string{config.Values().Wireguard.ServerAddress.String() + "/32"}
+
+	// Add dns servers if defined
+	// Make sure we resolve the dns servers in case someone added them as domains, so that clients dont get stuck trying to use the domain dns servers to look up the dns servers
+	// Restrict dns servers to only having 53/any by default as per #49
+	for _, server := range config.Values().Wireguard.DNS {
+		resultingACLs.Allow = append(resultingACLs.Allow, fmt.Sprintf("%s 53/any", server))
+	}
+
+	txn := etcd.Txn(context.Background())
+	txn.Then(clientv3.OpGet("wag-acls-*"), clientv3.OpGet("wag-acls-"+username), clientv3.OpGet("wag-membership"))
+	resp, err := txn.Commit()
+	if err != nil {
+		return acls.Acl{}
+	}
+
+	// the default policy contents
+	if resp.Responses[0].GetResponseRange().GetCount() != 0 {
+		var acl acls.Acl
+
+		err := json.Unmarshal(resp.Responses[0].GetResponseRange().Kvs[0].Value, &acl)
+		if err == nil {
+			resultingACLs.Allow = append(resultingACLs.Allow, acl.Allow...)
+			resultingACLs.Mfa = append(resultingACLs.Mfa, acl.Mfa...)
+		}
+	}
+
+	// User specific acls
+	if resp.Responses[1].GetResponseRange().GetCount() != 0 {
+		var acl acls.Acl
+
+		err := json.Unmarshal(resp.Responses[1].GetResponseRange().Kvs[0].Value, &acl)
+		if err == nil {
+			resultingACLs.Allow = append(resultingACLs.Allow, acl.Allow...)
+			resultingACLs.Mfa = append(resultingACLs.Mfa, acl.Mfa...)
+		}
+	}
+
+	// Membership map for finding all the other policies
+	if resp.Responses[2].GetResponseRange().GetCount() != 0 {
+		var rGroupLookup map[string]map[string]bool
+
+		err = json.Unmarshal(resp.Responses[2].GetResponseRange().Kvs[0].Value, &rGroupLookup)
+		if err == nil {
+
+			txn := etcd.Txn(context.Background())
+
+			//If the user belongs to a series of groups, grab those, and add their rules
+			var ops []clientv3.Op
+			for group := range rGroupLookup[username] {
+				ops = append(ops, clientv3.OpGet("wag-acls-"+group))
+			}
+
+			resp, err := txn.Then(ops...).Commit()
+			if err != nil {
+				return acls.Acl{}
+			}
+
+			for m := range resp.Responses {
+				r := resp.Responses[m].GetResponseRange()
+				if r.Count > 0 {
+
+					var acl acls.Acl
+
+					err := json.Unmarshal(r.Kvs[0].Value, &acl)
+					if err != nil {
+						continue
+					}
+
+					resultingACLs.Allow = append(resultingACLs.Allow, acl.Allow...)
+					resultingACLs.Mfa = append(resultingACLs.Mfa, acl.Mfa...)
+				}
+			}
+
+		}
+	}
+
+	return resultingACLs
+}
diff --git a/internal/data/config.go b/internal/data/config.go
new file mode 100644
index 00000000..23b34f68
--- /dev/null
+++ b/internal/data/config.go
@@ -0,0 +1,29 @@
+package data
+
+func SetHelpMail(helpMail string) error {
+	return nil
+}
+
+func SetExternalAddress(externalAddress string) error {
+	return nil
+}
+
+func SetDNS(dns []string) error {
+
+	return nil
+}
+
+func SetSessionLifetimeMinutes(lifetimeMinutes int) error {
+
+	return nil
+}
+
+func SetSessionInactivityTimeoutMinutes(InactivityTimeout int) error {
+
+	return nil
+}
+
+func SetLockout(accountLockout int) error {
+
+	return nil
+}
diff --git a/internal/data/devices.go b/internal/data/devices.go
index d43bfc1c..9becfeed 100644
--- a/internal/data/devices.go
+++ b/internal/data/devices.go
@@ -9,6 +9,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/NHAS/wag/internal/config"
 	"github.com/NHAS/wag/internal/utils"
 	clientv3 "go.etcd.io/etcd/client/v3"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
@@ -23,6 +24,7 @@ type Device struct {
 	Endpoint     *net.UDPAddr
 	Attempts     int
 	Active       bool
+	Authorised   bool
 }
 
 func stringToUDPaddr(address string) (r *net.UDPAddr) {
@@ -55,7 +57,7 @@ func UpdateDeviceEndpoint(address string, endpoint *net.UDPAddr) error {
 		return errors.New("device was not found")
 	}
 
-	return doSafeUpdate(context.Background(), string(realKey.Kvs[0].Value), false, func(gr *clientv3.GetResponse) (string, bool, error) {
+	return doSafeUpdate(context.Background(), string(realKey.Kvs[0].Value), func(gr *clientv3.GetResponse) (string, bool, error) {
 		if len(gr.Kvs) != 1 {
 			return "", false, errors.New("user device has multiple keys")
 		}
@@ -94,8 +96,64 @@ func GetDevice(username, id string) (device Device, err error) {
 	return
 }
 
+func AuthoriseDevice(username, address string) error {
+	return doSafeUpdate(context.Background(), deviceKey(username, address), func(gr *clientv3.GetResponse) (string, bool, error) {
+		if len(gr.Kvs) != 1 {
+			return "", false, errors.New("user device has multiple keys")
+		}
+
+		var device Device
+		err := json.Unmarshal(gr.Kvs[0].Value, &device)
+		if err != nil {
+			return "", false, err
+		}
+
+		u, err := GetUserData(device.Username)
+		if err != nil {
+			// We may want to make this lock the device if the user is not found. At the moment settle with doing nothing
+			return "", false, err
+		}
+
+		device.Authorised = !u.Locked
+
+		b, _ := json.Marshal(device)
+
+		return string(b), false, err
+	})
+}
+
+func DeauthenticateDevice(address string) error {
+
+	realKey, err := etcd.Get(context.Background(), "deviceref-"+address)
+	if err != nil {
+		return err
+	}
+
+	if realKey.Count == 0 {
+		return errors.New("device was not found")
+	}
+
+	return doSafeUpdate(context.Background(), string(realKey.Kvs[0].Value), func(gr *clientv3.GetResponse) (string, bool, error) {
+		if len(gr.Kvs) != 1 {
+			return "", false, errors.New("user device has multiple keys")
+		}
+
+		var device Device
+		err := json.Unmarshal(gr.Kvs[0].Value, &device)
+		if err != nil {
+			return "", false, err
+		}
+
+		device.Authorised = false
+
+		b, _ := json.Marshal(device)
+
+		return string(b), false, err
+	})
+}
+
 func SetDeviceAuthenticationAttempts(username, address string, attempts int) error {
-	return doSafeUpdate(context.Background(), deviceKey(username, address), false, func(gr *clientv3.GetResponse) (string, bool, error) {
+	return doSafeUpdate(context.Background(), deviceKey(username, address), func(gr *clientv3.GetResponse) (string, bool, error) {
 		if len(gr.Kvs) != 1 {
 			return "", false, errors.New("user device has multiple keys")
 		}
@@ -134,7 +192,39 @@ func GetAllDevices() (devices []Device, err error) {
 	return devices, nil
 }
 
-func AddDevice(username, address, publickey, preshared_key string) (Device, error) {
+func AddDevice(username, publickey string) (Device, error) {
+
+	preshared_key, err := wgtypes.GenerateKey()
+	if err != nil {
+		return Device{}, err
+	}
+
+	address, err := allocateIPAddress(config.Values().Wireguard.Range.String())
+	if err != nil {
+		return Device{}, err
+	}
+
+	d := Device{
+		Address:      address,
+		Publickey:    publickey,
+		Username:     username,
+		PresharedKey: preshared_key.String(),
+	}
+
+	b, _ := json.Marshal(d)
+	key := deviceKey(username, address)
+
+	_, err = etcd.Txn(context.Background()).Then(clientv3.OpPut(key, string(b)),
+		clientv3.OpPut(fmt.Sprintf("deviceref-%s", address), key),
+		clientv3.OpPut(fmt.Sprintf("deviceref-%s", publickey), key)).Commit()
+	if err != nil {
+		return Device{}, err
+	}
+
+	return d, err
+}
+
+func SetDevice(username, address, publickey, preshared_key string) (Device, error) {
 	if net.ParseIP(address) == nil {
 		return Device{}, errors.New("Address '" + address + "' cannot be parsed as IP, invalid")
 	}
@@ -229,7 +319,7 @@ func UpdateDevicePublicKey(username, address string, publicKey wgtypes.Key) erro
 		return err
 	}
 
-	err = doSafeUpdate(context.Background(), deviceKey(username, address), false, func(gr *clientv3.GetResponse) (string, bool, error) {
+	err = doSafeUpdate(context.Background(), deviceKey(username, address), func(gr *clientv3.GetResponse) (string, bool, error) {
 		if len(gr.Kvs) != 1 {
 			return "", false, errors.New("user device has multiple keys")
 		}
@@ -263,6 +353,10 @@ func GetDeviceByAddress(address string) (device Device, err error) {
 		return Device{}, err
 	}
 
+	if len(realKey.Kvs) == 0 {
+		return Device{}, errors.New("not device found for address: " + address)
+	}
+
 	if len(realKey.Kvs) != 1 {
 		return Device{}, errors.New("incorrect number of keys for device reference")
 	}
diff --git a/internal/data/dhcp.go b/internal/data/dhcp.go
new file mode 100644
index 00000000..1a6bb776
--- /dev/null
+++ b/internal/data/dhcp.go
@@ -0,0 +1,93 @@
+package data
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"slices"
+	"time"
+
+	clientv3 "go.etcd.io/etcd/client/v3"
+)
+
+// This is almost certainly unsafe from splicing during multiple client registration
+func allocateIPAddress(subnet string) (string, error) {
+
+	// Retrieve the list of allocated IPs
+	allocatedIPs, err := getAllocatedIPs()
+	if err != nil {
+		return "", err
+	}
+
+	// Find an unallocated IP address within the given subnet
+	ip, err := findUnallocatedIP(subnet, allocatedIPs)
+	if err != nil {
+		return "", err
+	}
+
+	// Mark the selected IP as allocated
+	if err := markIPAsAllocated(ip); err != nil {
+		return "", err
+	}
+
+	return ip, nil
+}
+
+func getAllocatedIPs() ([]string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	resp, err := etcd.Get(ctx, "allocated_ips", clientv3.WithPrefix())
+	if err != nil {
+		return nil, err
+	}
+
+	var allocatedIPs []string
+	for _, kv := range resp.Kvs {
+		allocatedIPs = append(allocatedIPs, string(kv.Value))
+	}
+
+	return allocatedIPs, nil
+}
+
+func findUnallocatedIP(subnet string, allocatedIPs []string) (string, error) {
+	_, ipNet, err := net.ParseCIDR(subnet)
+	if err != nil {
+		return "", err
+	}
+
+	for ip := ipNet.IP.Mask(ipNet.Mask); ipNet.Contains(ip); incrementIP(ip) {
+		// Check if the IP is unallocated
+
+		if !slices.Contains(allocatedIPs, ip.String()) {
+			return ip.String(), nil
+		}
+	}
+
+	return "", fmt.Errorf("no available unallocated IP addresses in the subnet")
+}
+
+func markIPAsAllocated(ip string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	_, err := etcd.Put(ctx, fmt.Sprintf("allocated_ips/%s", ip), ip)
+	return err
+}
+
+func markIPAsUnallocated(ip string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	_, err := etcd.Delete(ctx, fmt.Sprintf("allocated_ips/%s", ip))
+	return err
+}
+
+func incrementIP(ip net.IP) {
+	for j := len(ip) - 1; j >= 0; j-- {
+		ip[j]++
+		if ip[j] > 0 {
+			break
+		}
+	}
+}
diff --git a/internal/data/events.go b/internal/data/events.go
new file mode 100644
index 00000000..4f447b59
--- /dev/null
+++ b/internal/data/events.go
@@ -0,0 +1,214 @@
+package data
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"log"
+	"sync"
+	"time"
+
+	"github.com/NHAS/wag/internal/acls"
+	clientv3 "go.etcd.io/etcd/client/v3"
+)
+
+const (
+	CREATED = iota
+	DELETED
+	MODIFIED
+)
+
+type BasicEvent[T any] struct {
+	Key          string
+	CurrentValue T
+	Previous     T
+}
+
+type TargettedEvent[T any] struct {
+	Key     string
+	Effects string
+	Value   T
+}
+
+type WatcherFuncType[T any] interface {
+	~func(data T, state int)
+}
+
+type (
+	DeviceChangesFunc func(BasicEvent[Device], int)
+	UserChangesFunc   func(BasicEvent[UserModel], int)
+
+	AclChangesFunc   func(TargettedEvent[acls.Acl], int)
+	GroupChangesFunc func(TargettedEvent[[]string], int)
+
+	ClusterHealthFunc func(state string, dead int)
+)
+
+var (
+	deviceWatchers        []DeviceChangesFunc
+	usersWatchers         []UserChangesFunc
+	aclsWatchers          []AclChangesFunc
+	groupsWatchers        []GroupChangesFunc
+	clusterHealthWatchers []ClusterHealthFunc
+
+	lck sync.RWMutex
+)
+
+func addWatcher[I any, T WatcherFuncType[I]](watcher T, existingWatches *[]T) {
+	lck.Lock()
+	*existingWatches = append(*existingWatches, watcher)
+	lck.Unlock()
+}
+
+func execWatchers[I any, T WatcherFuncType[I]](watchers []T, data I, state int) {
+	lck.RLock()
+
+	log.Println(len(watchers), data)
+	for _, watcher := range watchers {
+		go watcher(data, state)
+	}
+
+	lck.RUnlock()
+}
+
+func RegisterDeviceWatcher(fnc DeviceChangesFunc) {
+	addWatcher(fnc, &deviceWatchers)
+}
+
+func RegisterUserWatcher(fnc UserChangesFunc) {
+	addWatcher(fnc, &usersWatchers)
+}
+
+func RegisterAclsWatcher(fnc AclChangesFunc) {
+	addWatcher(fnc, &aclsWatchers)
+}
+
+func RegisterGroupsWatcher(fnc GroupChangesFunc) {
+	addWatcher(fnc, &groupsWatchers)
+}
+
+func RegisterClusterHealthWatcher(fnc ClusterHealthFunc) {
+	addWatcher(fnc, &clusterHealthWatchers)
+}
+
+func watchEvents() {
+	wc := etcd.Watch(context.Background(), "", clientv3.WithPrefix(), clientv3.WithPrevKV())
+	for watchEvent := range wc {
+		log.Println("got event: ", watchEvent)
+
+		// TODO make sure that we account for compaction events
+		for _, event := range watchEvent.Events {
+
+			var (
+				value []byte = event.Kv.Value
+				state int
+			)
+			if event.Type == clientv3.EventTypeDelete {
+				state = DELETED
+				value = event.PrevKv.Value
+			} else if event.PrevKv == nil {
+				state = CREATED
+			} else {
+				state = MODIFIED
+			}
+
+			switch {
+			case bytes.HasPrefix(event.Kv.Key, []byte("devices-")):
+
+				be, err := makeBasicEvent[Device](event)
+				if err != nil {
+					log.Println("unable to make basic device event: ", err)
+					continue
+				}
+
+				execWatchers(deviceWatchers, be, state)
+
+			case bytes.HasPrefix(event.Kv.Key, []byte("users-")):
+
+				be, err := makeBasicEvent[UserModel](event)
+				if err != nil {
+					log.Println("unable to make basic user event: ", err)
+					continue
+				}
+
+				execWatchers(usersWatchers, be, state)
+			case bytes.HasPrefix(event.Kv.Key, []byte("wag-acls-")):
+
+				var a acls.Acl
+				err := json.Unmarshal(value, &a)
+				if err != nil {
+					log.Println("Got an event for a acls that I could not decode: ", err)
+					continue
+				}
+
+				execWatchers(aclsWatchers, TargettedEvent[acls.Acl]{Effects: string(bytes.TrimPrefix(event.Kv.Key, []byte("wag-acls-"))), Key: string(event.Kv.Key), Value: a}, state)
+			case bytes.HasPrefix(event.Kv.Key, []byte("wag-groups-")):
+
+				var groupMembers []string
+				err := json.Unmarshal(value, &groupMembers)
+				if err != nil {
+					log.Println("Got an event for a group members that I could not decode: ", err)
+					continue
+
+				}
+				execWatchers(groupsWatchers,
+					TargettedEvent[[]string]{
+						Effects: string(bytes.TrimPrefix(event.Kv.Key, []byte("wag-groups-"))),
+						Key:     string(event.Kv.Key),
+						Value:   groupMembers,
+					}, state)
+			default:
+				continue
+			}
+
+		}
+
+	}
+}
+
+func makeBasicEvent[T any](event *clientv3.Event) (BasicEvent[T], error) {
+	var d T
+	err := json.Unmarshal(event.Kv.Value, &d)
+	if err != nil {
+		return BasicEvent[T]{}, err
+	}
+
+	be := BasicEvent[T]{
+		CurrentValue: d,
+		Key:          string(event.Kv.Key),
+	}
+
+	if event.PrevKv != nil {
+		err = json.Unmarshal(event.PrevKv.Value, &be.Previous)
+		if err != nil {
+			return BasicEvent[T]{}, err
+		}
+	}
+
+	return be, nil
+}
+
+func checkClusterHealth() {
+
+	for {
+
+		select {
+		case <-etcdServer.Server.LeaderChangedNotify():
+			execWatchers(clusterHealthWatchers, "changed", 0)
+			leader := etcdServer.Server.Leader()
+			if leader == 0 {
+				execWatchers(clusterHealthWatchers, "electing", 0)
+				<-time.After(etcdServer.Server.Cfg.ElectionTimeout() * 2)
+				leader = etcdServer.Server.Leader()
+			}
+
+			if leader != 0 {
+				execWatchers(clusterHealthWatchers, "healthy", 0)
+			} else {
+				execWatchers(clusterHealthWatchers, "dead", 0)
+			}
+
+		}
+
+	}
+}
diff --git a/internal/data/groups.go b/internal/data/groups.go
new file mode 100644
index 00000000..7707324c
--- /dev/null
+++ b/internal/data/groups.go
@@ -0,0 +1,111 @@
+package data
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	clientv3 "go.etcd.io/etcd/client/v3"
+)
+
+func SetGroup(group string, members []string, overwrite bool) error {
+	response, err := etcd.Get(context.Background(), "wag-groups-"+group)
+	if err != nil {
+		return err
+	}
+
+	if len(response.Kvs) > 0 && !overwrite {
+		return errors.New("group already exists")
+	}
+
+	membersJson, _ := json.Marshal(members)
+
+	putResp, err := etcd.Put(context.Background(), "wag-groups-"+group, string(membersJson), clientv3.WithPrevKV())
+	if err != nil {
+		return err
+	}
+
+	var oldMembers []string
+	if putResp.PrevKv != nil {
+		err = json.Unmarshal(putResp.PrevKv.Value, &oldMembers)
+		if err != nil {
+			return err
+		}
+	}
+
+	err = doSafeUpdate(context.Background(), "wag-membership", func(gr *clientv3.GetResponse) (value string, onErrwrite bool, err error) {
+
+		if len(gr.Kvs) != 1 {
+			return "", false, errors.New("bad number of membership keys")
+		}
+
+		var rGroupLookup map[string]map[string]bool
+		err = json.Unmarshal(gr.Kvs[0].Value, &rGroupLookup)
+		if err != nil {
+			return "", false, err
+		}
+
+		for _, member := range oldMembers {
+			delete(rGroupLookup[member], group)
+		}
+
+		for _, member := range members {
+			if rGroupLookup[member] == nil {
+				rGroupLookup[member] = make(map[string]bool)
+			}
+
+			rGroupLookup[member][group] = true
+		}
+
+		reverseMappingJson, _ := json.Marshal(rGroupLookup)
+
+		return string(reverseMappingJson), false, nil
+	})
+
+	return err
+
+}
+
+func RemoveGroup(groupName string) error {
+
+	if groupName == "*" {
+		return fmt.Errorf("cannot delete default group")
+	}
+
+	delResp, err := etcd.Delete(context.Background(), "wag-groups-"+groupName, clientv3.WithPrevKV())
+	if err != nil {
+		return err
+	}
+
+	var oldMembers []string
+	if len(delResp.PrevKvs) == 1 {
+		err = json.Unmarshal(delResp.PrevKvs[0].Value, &oldMembers)
+		if err != nil {
+			return err
+		}
+	}
+
+	err = doSafeUpdate(context.Background(), "wag-membership", func(gr *clientv3.GetResponse) (value string, onErrwrite bool, err error) {
+
+		if len(gr.Kvs) != 1 {
+			return "", false, errors.New("bad number of membership keys")
+		}
+
+		var rGroupLookup map[string]map[string]bool
+		err = json.Unmarshal(gr.Kvs[0].Value, &rGroupLookup)
+		if err != nil {
+			return "", false, err
+		}
+
+		for _, member := range oldMembers {
+			delete(rGroupLookup[member], groupName)
+		}
+
+		reverseMappingJson, _ := json.Marshal(rGroupLookup)
+
+		return string(reverseMappingJson), false, nil
+	})
+
+	return err
+}
diff --git a/internal/data/init.go b/internal/data/init.go
index 322793b4..89f96a55 100644
--- a/internal/data/init.go
+++ b/internal/data/init.go
@@ -1,7 +1,6 @@
 package data
 
 import (
-	"bytes"
 	"context"
 	"database/sql"
 	"encoding/json"
@@ -74,7 +73,7 @@ func Load(path string) error {
 	cfg := embed.NewConfig()
 	cfg.Name = config.Values().Clustering.Name
 	cfg.InitialClusterToken = "wag-test"
-	cfg.LogLevel = "error"
+	cfg.LogLevel = config.Values().Clustering.ETCDLogLevel
 	cfg.ListenPeerUrls = parseUrls(config.Values().Clustering.ListenAddresses...)
 	cfg.ListenClientUrls = parseUrls("http://127.0.0.1:2480")
 	cfg.AdvertisePeerUrls = cfg.ListenPeerUrls
@@ -105,6 +104,7 @@ func Load(path string) error {
 		return errors.New("etcd took too long to start")
 	}
 
+	log.Println("etcd server started!")
 	log.Println("Connecting to etcd")
 
 	etcd, err = clientv3.New(clientv3.Config{
@@ -115,6 +115,8 @@ func Load(path string) error {
 		return err
 	}
 
+	log.Println("Successfully connected to etcd")
+
 	response, err := etcd.Get(context.Background(), "wag-migrated-sql")
 	if err != nil {
 		return err
@@ -130,7 +132,7 @@ func Load(path string) error {
 		}
 
 		for _, device := range devices {
-			_, err := AddDevice(device.Username, device.Address, device.Publickey, device.PresharedKey)
+			_, err := SetDevice(device.Username, device.Address, device.Publickey, device.PresharedKey)
 			if err != nil {
 				return err
 			}
@@ -219,7 +221,7 @@ func Load(path string) error {
 
 	}
 
-	response, err = etcd.Get(context.Background(), "wag-acls")
+	response, err = etcd.Get(context.Background(), "wag-acls-", clientv3.WithPrefix())
 	if err != nil {
 		return err
 	}
@@ -236,7 +238,7 @@ func Load(path string) error {
 		}
 	}
 
-	response, err = etcd.Get(context.Background(), "wag-groups")
+	response, err = etcd.Get(context.Background(), "wag-groups-", clientv3.WithPrefix())
 	if err != nil {
 		return err
 	}
@@ -244,13 +246,31 @@ func Load(path string) error {
 	if len(response.Kvs) == 0 {
 		log.Println("no groups found in database, importing from .json file (from this point the json file will be ignored)")
 
-		for groupName, group := range config.Values().Acls.Groups {
-			groupJson, _ := json.Marshal(group)
+		// User to groups
+		rGroupLookup := map[string]map[string]bool{}
+
+		for groupName, members := range config.Values().Acls.Groups {
+			groupJson, _ := json.Marshal(members)
 			_, err = etcd.Put(context.Background(), "wag-groups-"+groupName, string(groupJson))
 			if err != nil {
 				return err
 			}
+
+			for _, user := range members {
+				if rGroupLookup[user] == nil {
+					rGroupLookup[user] = make(map[string]bool)
+				}
+
+				rGroupLookup[user][groupName] = true
+			}
 		}
+
+		reverseMappingJson, _ := json.Marshal(rGroupLookup)
+		_, err = etcd.Put(context.Background(), "wag-membership", string(reverseMappingJson))
+		if err != nil {
+			return err
+		}
+
 	}
 
 	response, err = etcd.Get(context.Background(), "wag-config")
@@ -261,8 +281,8 @@ func Load(path string) error {
 	if len(response.Kvs) == 0 {
 		log.Println("no config found in database, importing from .json file (from this point the json file will be ignored)")
 
-		groups, _ := json.Marshal(config.Values())
-		_, err = etcd.Put(context.Background(), "wag-config", string(groups))
+		configData, _ := json.Marshal(config.Values())
+		_, err = etcd.Put(context.Background(), "wag-config", string(configData))
 		if err != nil {
 			return err
 		}
@@ -276,66 +296,14 @@ func Load(path string) error {
 
 func TearDown() {
 	if etcdServer != nil {
+		log.Println("Tearing down server")
 		etcdServer.Close()
 	}
 }
 
-func watchEvents() {
-	wc := etcd.Watch(context.Background(), "", clientv3.WithPrefix(), clientv3.WithCreatedNotify())
-	for watchEvent := range wc {
-
-		for _, event := range watchEvent.Events {
-
-			switch {
-			case bytes.HasPrefix(event.Kv.Key, []byte("devices-")):
-
-			case bytes.HasPrefix(event.Kv.Key, []byte("users-")):
-
-			default:
-				continue
-			}
-
-		}
-
-	}
-}
-
-func checkClusterHealth() {
-	startup := true
-	for {
-		leader := etcdServer.Server.Leader()
-		if leader == 0 {
-
-			if startup {
-				// When we first start up, make sure we wait for an election to either have occured, or is occuring before we check to make sure things are still up
-				time.Sleep(etcdServer.Server.Cfg.ElectionTimeout() * 2)
-				continue
-			}
-
-			select {
-			case <-etcdServer.Server.LeaderChangedNotify():
-				// Something has changed, so try and check whats going on
-				continue
-			case <-time.After(30 * time.Second):
-				// Do a random recheck just for fun
-				continue
-			case <-time.After(etcdServer.Server.Cfg.ElectionTimeout() * 2):
-				// Dead
-				log.Println("Cluster is no longer contactable. Shutting wag down and entering degraded state")
-
-			}
-		}
-
-		startup = false
-	}
-}
-
-func doSafeUpdate(ctx context.Context, key string, prefix bool, mutateFunc func(*clientv3.GetResponse) (value string, onErrwrite bool, err error)) error {
+func doSafeUpdate(ctx context.Context, key string, mutateFunc func(*clientv3.GetResponse) (value string, onErrwrite bool, err error)) error {
 	//https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/pkg/storage/etcd3/store.go#L382
 	opts := []clientv3.OpOption{}
-	if prefix {
-		opts = append(opts, clientv3.WithPrefix())
-	}
 
 	if mutateFunc == nil {
 		return errors.New("no mutate function set in safe update")
@@ -377,3 +345,36 @@ func doSafeUpdate(ctx context.Context, key string, prefix bool, mutateFunc func(
 		return err
 	}
 }
+
+func GetInitialData() (users []UserModel, devices []Device, err error) {
+	txn := etcd.Txn(context.Background())
+	txn.Then(clientv3.OpGet("users-", clientv3.WithPrefix(), clientv3.WithSort(clientv3.SortByKey, clientv3.SortDescend)),
+		clientv3.OpGet("devices-", clientv3.WithPrefix(), clientv3.WithSort(clientv3.SortByKey, clientv3.SortDescend)))
+
+	resp, err := txn.Commit()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	for _, res := range resp.Responses[0].GetResponseRange().Kvs {
+		var user UserModel
+		err := json.Unmarshal(res.Value, &user)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		users = append(users, user)
+	}
+
+	for _, res := range resp.Responses[1].GetResponseRange().Kvs {
+		var device Device
+		err := json.Unmarshal(res.Value, &device)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		devices = append(devices, device)
+	}
+
+	return
+}
diff --git a/internal/data/registration.go b/internal/data/registration.go
index 16e29a7e..1d1f8291 100644
--- a/internal/data/registration.go
+++ b/internal/data/registration.go
@@ -78,7 +78,7 @@ func DeleteRegistrationToken(identifier string) error {
 func FinaliseRegistration(token string) error {
 
 	errVal := errors.New("registration token has expired")
-	err := doSafeUpdate(context.Background(), "tokens-"+token, false, func(gr *clientv3.GetResponse) (string, bool, error) {
+	err := doSafeUpdate(context.Background(), "tokens-"+token, func(gr *clientv3.GetResponse) (string, bool, error) {
 
 		var result control.RegistrationResult
 		err := json.Unmarshal(gr.Kvs[0].Value, &result)
diff --git a/internal/data/ui.go b/internal/data/ui.go
index 5e2b0357..f648cc03 100644
--- a/internal/data/ui.go
+++ b/internal/data/ui.go
@@ -80,7 +80,7 @@ func CompareAdminKeys(username, password string) error {
 		subtle.ConstantTimeCompare(hash, hash)
 	}
 
-	err := doSafeUpdate(context.Background(), "admin-users-"+username, false, func(gr *clientv3.GetResponse) (string, bool, error) {
+	err := doSafeUpdate(context.Background(), "admin-users-"+username, func(gr *clientv3.GetResponse) (string, bool, error) {
 
 		var result admin
 		err := json.Unmarshal(gr.Kvs[0].Value, &result)
@@ -121,7 +121,7 @@ func CompareAdminKeys(username, password string) error {
 // Lock admin account and make them unable to login
 func SetAdminUserLock(username string) error {
 
-	return doSafeUpdate(context.Background(), "admin-users-"+username, false, func(gr *clientv3.GetResponse) (string, bool, error) {
+	return doSafeUpdate(context.Background(), "admin-users-"+username, func(gr *clientv3.GetResponse) (string, bool, error) {
 		var result admin
 		err := json.Unmarshal(gr.Kvs[0].Value, &result)
 		if err != nil {
@@ -141,7 +141,7 @@ func SetAdminUserLock(username string) error {
 // Unlock admin account
 func SetAdminUserUnlock(username string) error {
 
-	return doSafeUpdate(context.Background(), "admin-users-"+username, false, func(gr *clientv3.GetResponse) (string, bool, error) {
+	return doSafeUpdate(context.Background(), "admin-users-"+username, func(gr *clientv3.GetResponse) (string, bool, error) {
 		var result admin
 		err := json.Unmarshal(gr.Kvs[0].Value, &result)
 		if err != nil {
@@ -215,7 +215,7 @@ func SetAdminPassword(username, password string) error {
 
 	hash := argon2.IDKey([]byte(password), salt, 1, 10*1024, 4, 32)
 
-	return doSafeUpdate(context.Background(), "admin-users-"+username, false, func(gr *clientv3.GetResponse) (value string, onErrwrite bool, err error) {
+	return doSafeUpdate(context.Background(), "admin-users-"+username, func(gr *clientv3.GetResponse) (value string, onErrwrite bool, err error) {
 
 		if len(gr.Kvs) != 1 {
 			return "", false, errors.New("invalid number of admin users")
@@ -239,7 +239,7 @@ func SetAdminPassword(username, password string) error {
 }
 
 func setAdminHash(username, hash string) error {
-	return doSafeUpdate(context.Background(), "admin-users-"+username, false, func(gr *clientv3.GetResponse) (value string, onErrwrite bool, err error) {
+	return doSafeUpdate(context.Background(), "admin-users-"+username, func(gr *clientv3.GetResponse) (value string, onErrwrite bool, err error) {
 
 		if len(gr.Kvs) != 1 {
 			return "", false, errors.New("invalid number of admin users")
@@ -262,7 +262,7 @@ func setAdminHash(username, hash string) error {
 }
 
 func SetLastLoginInformation(username, ip string) error {
-	return doSafeUpdate(context.Background(), "admin-users-"+username, false, func(gr *clientv3.GetResponse) (value string, onErrwrite bool, err error) {
+	return doSafeUpdate(context.Background(), "admin-users-"+username, func(gr *clientv3.GetResponse) (value string, onErrwrite bool, err error) {
 
 		if len(gr.Kvs) != 1 {
 			return "", false, errors.New("invalid number of admin users")
diff --git a/internal/data/user.go b/internal/data/user.go
index bc67c6bf..5de9269e 100644
--- a/internal/data/user.go
+++ b/internal/data/user.go
@@ -25,7 +25,7 @@ func (um *UserModel) GetID() [20]byte {
 
 // Make sure that the attempts is always incremented first to stop race condition attacks
 func IncrementAuthenticationAttempt(username, device string) error {
-	return doSafeUpdate(context.Background(), deviceKey(username, device), false, func(gr *clientv3.GetResponse) (value string, onErrwrite bool, err error) {
+	return doSafeUpdate(context.Background(), deviceKey(username, device), func(gr *clientv3.GetResponse) (value string, onErrwrite bool, err error) {
 
 		if len(gr.Kvs) != 1 {
 			return "", false, errors.New("invalid number of users")
@@ -93,7 +93,7 @@ func GetAuthenticationDetails(username, device string) (mfa, mfaType string, att
 
 // Disable authentication for user
 func SetUserLock(username string) error {
-	err := doSafeUpdate(context.Background(), "users-"+username+"-", false, func(gr *clientv3.GetResponse) (string, bool, error) {
+	err := doSafeUpdate(context.Background(), "users-"+username+"-", func(gr *clientv3.GetResponse) (string, bool, error) {
 		var result UserModel
 		err := json.Unmarshal(gr.Kvs[0].Value, &result)
 		if err != nil {
@@ -115,7 +115,7 @@ func SetUserLock(username string) error {
 }
 
 func SetUserUnlock(username string) error {
-	err := doSafeUpdate(context.Background(), "users-"+username+"-", false, func(gr *clientv3.GetResponse) (string, bool, error) {
+	err := doSafeUpdate(context.Background(), "users-"+username+"-", func(gr *clientv3.GetResponse) (string, bool, error) {
 		var result UserModel
 		err := json.Unmarshal(gr.Kvs[0].Value, &result)
 		if err != nil {
@@ -160,7 +160,7 @@ func IsEnforcingMFA(username string) bool {
 // Stop displaying MFA secrets for user
 func SetEnforceMFAOn(username string) error {
 
-	return doSafeUpdate(context.Background(), "users-"+username+"-", false, func(gr *clientv3.GetResponse) (string, bool, error) {
+	return doSafeUpdate(context.Background(), "users-"+username+"-", func(gr *clientv3.GetResponse) (string, bool, error) {
 		var result UserModel
 		err := json.Unmarshal(gr.Kvs[0].Value, &result)
 		if err != nil {
@@ -177,7 +177,7 @@ func SetEnforceMFAOn(username string) error {
 }
 
 func SetEnforceMFAOff(username string) error {
-	return doSafeUpdate(context.Background(), "users-"+username+"-", false, func(gr *clientv3.GetResponse) (string, bool, error) {
+	return doSafeUpdate(context.Background(), "users-"+username+"-", func(gr *clientv3.GetResponse) (string, bool, error) {
 		var result UserModel
 
 		err := json.Unmarshal(gr.Kvs[0].Value, &result)
@@ -298,7 +298,7 @@ func GetUserDataFromAddress(address string) (u UserModel, err error) {
 
 func SetUserMfa(username, value, mfaType string) error {
 
-	return doSafeUpdate(context.Background(), "users-"+username+"-", false, func(gr *clientv3.GetResponse) (string, bool, error) {
+	return doSafeUpdate(context.Background(), "users-"+username+"-", func(gr *clientv3.GetResponse) (string, bool, error) {
 		var result UserModel
 		err := json.Unmarshal(gr.Kvs[0].Value, &result)
 		if err != nil {
diff --git a/internal/router/bpf.go b/internal/router/bpf.go
index ab3d69d3..63c0b74a 100644
--- a/internal/router/bpf.go
+++ b/internal/router/bpf.go
@@ -52,12 +52,16 @@ var (
 		// Added in linux 5.10.
 		Flags: unix.BPF_F_NO_PREALLOC,
 
-		// We set this to 200 now, but this inner map spec gets copied
+		// We set this to 1024 now, but this inner map spec gets copied
 		// and altered later.
 		MaxEntries: 1024,
 	}
 
 	userPolicyMaps = map[[20]byte]*ebpf.Map{}
+
+	// Pain
+	usersToAddresses = map[string]map[string]string{}
+	addressesToUsers = map[string]string{}
 )
 
 type Timespec struct {
@@ -139,7 +143,7 @@ func attachXDP() error {
 	return nil
 }
 
-func setupXDP() error {
+func setupXDP(users []data.UserModel, knownDevices []data.Device) error {
 
 	if err := loadXDP(); err != nil {
 		return err
@@ -149,16 +153,6 @@ func setupXDP() error {
 		return err
 	}
 
-	users, err := data.GetAllUsers()
-	if err != nil {
-		return errors.New("xdp setup get all users: " + err.Error())
-	}
-
-	knownDevices, err := data.GetAllDevices()
-	if err != nil {
-		return errors.New("xdp setup get all devices: " + err.Error())
-	}
-
 	errs := bulkCreateUserMaps(users)
 	if len(errs) != 0 {
 		return fmt.Errorf("%s", errs)
@@ -283,6 +277,27 @@ func xdpAddDevice(username, address string) error {
 	return xdpObjects.Devices.Put(ip.To4(), deviceStruct.Bytes())
 }
 
+func SetLockAccount(username string, locked uint32) error {
+	lock.Lock()
+	defer lock.Unlock()
+
+	userid := sha1.Sum([]byte(username))
+
+	for address := range usersToAddresses[username] {
+		err := _deauthenticate(address)
+		if err != nil {
+			log.Println(err)
+		}
+	}
+
+	err := xdpObjects.AccountLocked.Put(userid, &locked)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 // Takes the LPM table and associates a route to a policy
 func xdpAddRoute(usersRouteTable *ebpf.Map, userAcls acls.Acl) error {
 	rules, err := routetypes.ParseRules(userAcls.Mfa, userAcls.Allow, userAcls.Deny)
@@ -332,7 +347,14 @@ func AddUser(username string, acls acls.Acl) error {
 		return err
 	}
 
-	return setSingleUserMap(userid, acls)
+	err = setSingleUserMap(userid, acls)
+	if err != nil {
+		return err
+	}
+
+	usersToAddresses[username] = make(map[string]string)
+
+	return nil
 }
 
 func setSingleUserMap(userid [20]byte, acls acls.Acl) error {
@@ -381,7 +403,7 @@ func bulkCreateUserMaps(users []data.UserModel) []error {
 		// This speeds up things like refresh acls, but not wag start up
 		if policiesInnerTable, ok := userPolicyMaps[userid]; ok {
 
-			err := xdpAddRoute(policiesInnerTable, config.GetEffectiveAcl(user.Username))
+			err := xdpAddRoute(policiesInnerTable, data.GetEffectiveAcl(user.Username))
 
 			if err != nil {
 				errors = append(errors, err)
@@ -427,7 +449,7 @@ func bulkCreateUserMaps(users []data.UserModel) []error {
 	}
 
 	for username, m := range maps {
-		err := xdpAddRoute(m, config.GetEffectiveAcl(username))
+		err := xdpAddRoute(m, data.GetEffectiveAcl(username))
 		if err != nil {
 			errors = append(errors, err)
 		}
@@ -455,6 +477,13 @@ func RemoveUser(username string) error {
 
 	delete(userPolicyMaps, userid)
 
+	for address, publicKey := range usersToAddresses[username] {
+		err = _removePeer(publicKey, address)
+		if err != nil {
+			log.Println("unable to remove peer: ", err)
+		}
+	}
+
 	return nil
 }
 
@@ -490,7 +519,7 @@ func RefreshUserAcls(username string) error {
 
 	userid := sha1.Sum([]byte(username))
 
-	acls := config.GetEffectiveAcl(username)
+	acls := data.GetEffectiveAcl(username)
 
 	return setSingleUserMap(userid, acls)
 }
@@ -520,6 +549,27 @@ func SetAuthorized(internalAddress, username string) error {
 
 func Deauthenticate(address string) error {
 
+	lock.Lock()
+	defer lock.Unlock()
+
+	return _deauthenticate(address)
+}
+
+func DeauthenticateAllDevices(username string) error {
+	lock.Lock()
+	defer lock.Unlock()
+
+	for address := range usersToAddresses[username] {
+		err := _deauthenticate(address)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func _deauthenticate(address string) error {
 	ip := net.ParseIP(address)
 	if ip == nil {
 		return errors.New("Unable to get IP address from: " + address)
@@ -529,9 +579,6 @@ func Deauthenticate(address string) error {
 		return errors.New("IP address was not ipv4")
 	}
 
-	lock.Lock()
-	defer lock.Unlock()
-
 	deviceBytes, err := xdpObjects.Devices.LookupBytes(ip.To4())
 	if err != nil {
 		return err
diff --git a/internal/router/ebpf_test.go b/internal/router/ebpf_test.go
index 2767e2aa..3fe2e352 100644
--- a/internal/router/ebpf_test.go
+++ b/internal/router/ebpf_test.go
@@ -1,1425 +1,1425 @@
 package router
 
-import (
-	"crypto/sha1"
-	"encoding/binary"
-	"fmt"
-	"log"
-	"math"
-	"math/rand"
-	"net"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/NHAS/wag/internal/config"
-	"github.com/NHAS/wag/internal/data"
-	"github.com/NHAS/wag/internal/routetypes"
-
-	"github.com/cilium/ebpf"
-	"golang.org/x/net/ipv4"
-)
-
-const (
-	XDP_DROP = 1
-	XDP_PASS = 2
-)
-
-func TestBasicLoad(t *testing.T) {
-	if err := setup("../config/test_in_memory_db.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-}
-
-func TestBlankPacket(t *testing.T) {
-
-	if err := setup("../config/test_in_memory_db.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	buff := make([]byte, 15)
-	value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(buff)
-	if err != nil {
-		t.Fatalf("program failed %s", err)
-	}
-
-	if result(value) != "XDP_DROP" {
-		t.Fatal("program did not drop a completely blank packet: did", result(value))
-	}
-}
-
-func TestAddNewDevices(t *testing.T) {
-
-	if err := setup("../config/test_in_memory_db.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var ipBytes []byte
-	var deviceBytes = make([]byte, 40)
-
-	found := map[string]bool{}
-
-	iter := xdpObjects.Devices.Iterate()
-	for iter.Next(&ipBytes, &deviceBytes) {
-		ip := net.IP(ipBytes)
-
-		var newDevice fwentry
-		err := newDevice.Unpack(deviceBytes)
-		if err != nil {
-			t.Fatal("unpacking new device:", err)
-		}
-
-		if newDevice.lastPacketTime != 0 || newDevice.sessionExpiry != 0 {
-			t.Fatal("timers were not 0 immediately after device add")
-		}
-		found[ip.String()] = true
-	}
-
-	if iter.Err() != nil {
-		t.Fatalf("iterator reported an error: %s", iter.Err())
-	}
-
-	if len(found) != len(out) {
-		t.Fatalf("expected number of devices not found when iterating timestamp map %d != %d", len(found), len(out))
-	}
-
-	for _, device := range out {
-		if !found[device.Address] {
-			t.Fatalf("%s not found even though it should have been added", device.Address)
-		}
-	}
-
-}
-
-func TestAddUser(t *testing.T) {
-
-	if err := setup("../config/test_in_memory_db.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	for _, device := range out {
-		policiesTable, err := checkLPMMap(device.Username, xdpObjects.PoliciesTable)
-		if err != nil {
-			t.Fatal("checking policy table:", err)
-		}
-
-		acl := config.GetEffectiveAcl(device.Username)
-
-		results, err := routetypes.ParseRules(acl.Mfa, acl.Allow, nil)
-		if err != nil {
-			t.Fatal("parsing rules failed?:", err)
-		}
-
-		resultsAsString := []string{}
-		for _, r := range results {
-			for m := range r.Keys {
-				resultsAsString = append(resultsAsString, r.Keys[m].String())
-			}
-		}
-
-		if !contains(policiesTable, resultsAsString) {
-			t.Fatal("policies list does not match configured acls\n got: ", policiesTable, "\nexpected:", resultsAsString)
-		}
-
-	}
-}
-
-func contains(x, y []string) bool {
-	f := map[string]bool{}
-	for _, nx := range x {
-		f[nx] = true
-	}
-
-	for _, ny := range y {
-		if ok := f[ny]; !ok {
-			return false
-		}
-	}
-
-	return true
-}
-
-func TestRoutePriority(t *testing.T) {
-
-	if err := setup("../config/test_roaming_all_routes_mfa_priority.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	headers := []ipv4.Header{
-
-		{
-			Version: 4,
-			Dst:     net.ParseIP("8.8.8.8"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP("11.11.11.11"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP("1.1.1.1"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP(out[0].Address),
-			Src:     net.ParseIP("1.1.1.1"),
-			Len:     ipv4.HeaderLen,
-		}, {
-			Version: 4,
-			Dst:     net.ParseIP("192.168.1.1"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-	}
-
-	expectedResults := map[string]uint32{
-		headers[0].String(): XDP_DROP,
-		headers[1].String(): XDP_PASS,
-		headers[2].String(): XDP_PASS,
-		headers[3].String(): XDP_PASS,
-		headers[4].String(): XDP_PASS,
-	}
-
-	for i := range headers {
-		if headers[i].Src == nil || headers[i].Dst == nil {
-			t.Fatal("could not parse ip")
-		}
-
-		packet, err := headers[i].Marshal()
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
-		if err != nil {
-			t.Fatalf("program failed %s", err)
-		}
-
-		if result(value) != result(expectedResults[headers[i].String()]) {
-			t.Logf("(%s) program did not %s packet instead did: %s", headers[i].String(), result(expectedResults[headers[i].String()]), result(value))
-			t.Fail()
-		}
-	}
-
-}
-
-func TestBasicAuthorise(t *testing.T) {
-	if err := setup("../config/test_in_memory_db.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = SetAuthorized(out[0].Address, out[0].Username)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if !IsAuthed(out[0].Address) {
-		t.Fatal("after setting user as authorized it should be.... authorized")
-	}
-
-	headers := []ipv4.Header{
-		{
-			Version: 4,
-			Dst:     net.ParseIP("11.11.11.11"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP("192.168.3.11"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP("8.8.8.8"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP("3.21.11.11"),
-			Src:     net.ParseIP(out[1].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP("7.7.7.7"),
-			Src:     net.ParseIP(out[1].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP("4.3.3.3"),
-			Src:     net.ParseIP(out[1].Address),
-			Len:     ipv4.HeaderLen,
-		},
-	}
-
-	expectedResults := map[string]uint32{
-		headers[0].String(): XDP_DROP,
-		headers[1].String(): XDP_PASS,
-		headers[2].String(): XDP_PASS,
-		headers[3].String(): XDP_DROP,
-		headers[4].String(): XDP_PASS,
-		headers[5].String(): XDP_DROP,
-	}
-
-	mfas, err := routetypes.ParseRules(config.GetEffectiveAcl(out[0].Username).Mfa, nil, nil)
-	if err != nil {
-		t.Fatal("failed to parse mfa rules: ", err)
-	}
-
-	for i := range mfas {
-		newHeader := ipv4.Header{
-			Version: 4,
-			Dst:     mfas[i].Keys[0].AsIP(),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		}
-		headers = append(headers, newHeader)
-
-		expectedResults[newHeader.String()] = XDP_PASS
-
-	}
-
-	for i := range headers {
-		if headers[i].Src == nil || headers[i].Dst == nil {
-			t.Fatal("could not parse ip")
-		}
-
-		packet, err := headers[i].Marshal()
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
-		if err != nil {
-			t.Fatalf("program failed %s", err)
-		}
-
-		if value != expectedResults[headers[i].String()] {
-			t.Fatalf("%s program did not %s packet instead did: %s", headers[i].String(), result(expectedResults[headers[i].String()]), result(value))
-		}
-	}
-
-	err = Deauthenticate(out[0].Address)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if IsAuthed(out[0].Address) {
-		t.Fatal("after setting user as deauthorized it should be.... deauthorized")
-	}
-
-	for i := range headers {
-		if headers[i].Src == nil || headers[i].Dst == nil {
-			t.Fatal("could not parse ip")
-		}
-
-		if out[0].Address != headers[i].Src.String() {
-			continue
-		}
-
-		packet, err := headers[i].Marshal()
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
-		if err != nil {
-			t.Fatalf("program failed %s", err)
-		}
-
-		if value != XDP_DROP {
-			t.Fatalf("after deauthenticating, everything should be XDP_DROP instead %s", result(value))
-		}
-	}
-
-}
-
-func TestRoutePreference(t *testing.T) {
-	if err := setup("../config/test_route_restriction_preference.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	headers := []ipv4.Header{
-		{
-			Version: 4,
-			Dst:     net.ParseIP("1.1.3.43"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP("1.1.1.11"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP("1.1.4.1"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP("3.21.11.11"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP("1.1.2.7"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-		{
-			Version: 4,
-			Dst:     net.ParseIP("1.1.2.3"),
-			Src:     net.ParseIP(out[0].Address),
-			Len:     ipv4.HeaderLen,
-		},
-	}
-
-	expectedResults := map[string]uint32{
-		headers[0].String(): XDP_DROP,
-		headers[1].String(): XDP_PASS,
-		headers[2].String(): XDP_PASS,
-		headers[3].String(): XDP_DROP,
-		headers[4].String(): XDP_PASS,
-		headers[5].String(): XDP_DROP,
-	}
-
-	for i := range headers {
-		if headers[i].Src == nil || headers[i].Dst == nil {
-			t.Fatal("could not parse ip")
-		}
-
-		packet, err := headers[i].Marshal()
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
-		if err != nil {
-			t.Fatalf("program failed %s", err)
-		}
-
-		if value != expectedResults[headers[i].String()] {
-			t.Logf("%s program did not %s packet instead did: %s", headers[i].String(), result(expectedResults[headers[i].String()]), result(value))
-			t.Fail()
-		}
-	}
-}
-
-func TestSlidingWindow(t *testing.T) {
-	if err := setup("../config/test_disabled_max_lifetime.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = SetAuthorized(out[0].Address, out[0].Username)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if !IsAuthed(out[0].Address) {
-		t.Fatal("after setting user as authorized it should be.... authorized")
-	}
-
-	ip, _, err := net.ParseCIDR(config.GetEffectiveAcl(out[0].Username).Mfa[0])
-	if err != nil {
-		t.Fatal("could not parse ip: ", err)
-	}
-
-	testAuthorizedPacket := ipv4.Header{
-		Version: 4,
-		Dst:     ip,
-		Src:     net.ParseIP(out[0].Address),
-		Len:     ipv4.HeaderLen,
-	}
-
-	log.Println(testAuthorizedPacket.Dst, testAuthorizedPacket.Src)
-
-	if testAuthorizedPacket.Src == nil || testAuthorizedPacket.Dst == nil {
-		t.Fatal("could not parse ip")
-	}
-
-	packet, err := testAuthorizedPacket.Marshal()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var beforeDevice fwentry
-	deviceBytes, err := xdpObjects.Devices.LookupBytes(net.ParseIP(out[0].Address).To4())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = beforeDevice.Unpack(deviceBytes)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var timeoutFromMap uint64
-	err = xdpObjects.InactivityTimeoutMinutes.Lookup(uint32(0), &timeoutFromMap)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	difference := uint64(config.Values().SessionInactivityTimeoutMinutes) * 60000000000
-	if timeoutFromMap != difference {
-		t.Fatal("timeout retrieved from ebpf program does not match json")
-	}
-
-	value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
-	if err != nil {
-		t.Fatalf("program failed %s", err)
-	}
-
-	if value != 2 {
-		t.Fatalf("program did not %s packet instead did: %s", result(2), result(value))
-	}
-
-	var afterDevice fwentry
-	deviceBytes, err = xdpObjects.Devices.LookupBytes(net.ParseIP(out[0].Address).To4())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = afterDevice.Unpack(deviceBytes)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if afterDevice.lastPacketTime == beforeDevice.lastPacketTime {
-		t.Fatal("sending a packet did not change sliding window timeout")
-	}
-
-	if afterDevice.lastPacketTime < beforeDevice.lastPacketTime {
-		t.Fatal("the resulting update must be closer in time")
-	}
-
-	t.Logf("Now doing timing test for sliding window waiting %d+10seconds", config.Values().SessionInactivityTimeoutMinutes)
-
-	//Check slightly after inactivity timeout to see if the user is now not authenticated
-	time.Sleep(time.Duration(config.Values().SessionInactivityTimeoutMinutes)*time.Minute + 10*time.Second)
-
-	value, _, err = xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
-	if err != nil {
-		t.Fatalf("program failed %s", err)
-	}
-
-	if value != 1 {
-		t.Fatalf("program did not %s packet instead did: %s", result(1), result(value))
-	}
-
-	if IsAuthed(out[0].Address) {
-		t.Fatal("user is still authorized after inactivity timeout should have killed them")
-	}
-}
-
-func TestCompositeRules(t *testing.T) {
-	if err := setup("../config/test_mutliple_rule_definitions_and_mfa_preference.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = SetAuthorized(out[0].Address, out[0].Username)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	successPackets := [][]byte{
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.TCP, 11),
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.TCP, 8080),
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.UDP, 8080),
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.UDP, 9080),
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.TCP, 50),
-
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("7.7.7.7"), routetypes.ICMP, 0),
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("7.7.7.7"), routetypes.TCP, 22),
-	}
-
-	for i := range successPackets {
-
-		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(successPackets[i])
-		if err != nil {
-			t.Fatalf("program failed %s", err)
-		}
-
-		if value != XDP_PASS {
-			fw, _ := GetRules()
-			t.Logf("%+v", fw)
-			t.Fatalf("%d program did not XDP_PASS packet instead did: %s", i, result(value))
-		}
-	}
-
-	err = Deauthenticate(out[0].Address)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	expectedResults := []uint32{
-		XDP_DROP,
-		XDP_PASS,
-		XDP_PASS,
-
-		XDP_DROP,
-		XDP_DROP,
-
-		XDP_PASS,
-	}
-
-	packets := [][]byte{
-
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.TCP, 11),
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.TCP, 8080),
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.UDP, 8080),
-
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.UDP, 9080),
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.TCP, 50),
-
-		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.ICMP, 0),
-	}
-
-	for i := range packets {
-
-		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packets[i])
-		if err != nil {
-			t.Fatalf("program failed %s", err)
-		}
-
-		if value != expectedResults[i] {
-			fw, _ := GetRules()
-			t.Logf("%s:%+v", out[0].Username, fw[out[0].Username])
-			t.Fatalf("%d program did not %s packet instead did: %s", i, result(expectedResults[i]), result(value))
-		}
-	}
-
-}
-
-func TestDisabledSlidingWindow(t *testing.T) {
-	if err := setup("../config/test_disabled_sliding_window.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var timeoutFromMap uint64
-	err = xdpObjects.InactivityTimeoutMinutes.Lookup(uint32(0), &timeoutFromMap)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if timeoutFromMap != math.MaxUint64 {
-		t.Fatalf("the inactivity timeout was not set to max uint64, was %d (maxuint64 %d)", timeoutFromMap, uint64(math.MaxUint64))
-	}
-
-	err = SetAuthorized(out[0].Address, out[0].Username)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if !IsAuthed(out[0].Address) {
-		t.Fatal("after setting user as authorized it should be.... authorized")
-	}
-
-	ip, _, err := net.ParseCIDR(config.GetEffectiveAcl(out[0].Username).Mfa[0])
-	if err != nil {
-		t.Fatal("could not parse ip: ", err)
-	}
-
-	testAuthorizedPacket := ipv4.Header{
-		Version: 4,
-		Dst:     ip,
-		Src:     net.ParseIP(out[0].Address),
-		Len:     ipv4.HeaderLen,
-	}
-
-	if testAuthorizedPacket.Src == nil || testAuthorizedPacket.Dst == nil {
-		t.Fatal("could not parse ip")
-	}
-
-	packet, err := testAuthorizedPacket.Marshal()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	t.Logf("Now doing timing test for disabled sliding window waiting...")
-
-	elapsed := 0
-	for {
-		time.Sleep(15 * time.Second)
-		elapsed += 15
-
-		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
-		if err != nil {
-			t.Fatalf("program failed %s", err)
-		}
-
-		if value == 1 {
-			if elapsed < config.Values().MaxSessionLifetimeMinutes*60 {
-				t.Fatal("epbf kernel blocking valid traffic early")
-			} else {
-				break
-			}
-
-		}
-	}
-
-}
-
-func TestMaxSessionLifetime(t *testing.T) {
-	if err := setup("../config/test_disabled_sliding_window.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = SetAuthorized(out[0].Address, out[0].Username)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if !IsAuthed(out[0].Address) {
-		t.Fatal("after setting user device as authorized it should be.... authorized")
-	}
-
-	ip, _, err := net.ParseCIDR(config.GetEffectiveAcl(out[0].Username).Mfa[0])
-	if err != nil {
-		t.Fatal("could not parse ip: ", err)
-	}
-
-	testAuthorizedPacket := ipv4.Header{
-		Version: 4,
-		Dst:     ip,
-		Src:     net.ParseIP(out[0].Address),
-		Len:     ipv4.HeaderLen,
-	}
-
-	if testAuthorizedPacket.Src == nil || testAuthorizedPacket.Dst == nil {
-		t.Fatal("could not parse ip")
-	}
-
-	packet, err := testAuthorizedPacket.Marshal()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
-	if err != nil {
-		t.Fatalf("program failed %s", err)
-	}
-
-	if value != 2 {
-		t.Fatalf("program did not %s packet instead did: %s", result(2), result(value))
-	}
-
-	t.Logf("Waiting for %d minutes to test max session timeout", config.Values().MaxSessionLifetimeMinutes)
-
-	time.Sleep(time.Minute * time.Duration(config.Values().MaxSessionLifetimeMinutes))
-
-	value, _, err = xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
-	if err != nil {
-		t.Fatalf("program failed %s", err)
-	}
-
-	if value != 1 {
-		t.Fatalf("program did not %s packet instead did: %s", result(1), result(value))
-	}
-
-	if IsAuthed(out[0].Address) {
-		t.Fatal("user is still authorized after inactivity timeout should have killed them")
-	}
-}
-
-func TestDisablingMaxLifetime(t *testing.T) {
-	if err := setup("../config/test_disabled_max_lifetime.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = SetAuthorized(out[0].Address, out[0].Username)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if !IsAuthed(out[0].Address) {
-		t.Fatal("after setting user as authorized it should be.... authorized")
-	}
-
-	var maxSessionLifeDevice fwentry
-	deviceBytes, err := xdpObjects.Devices.LookupBytes(net.ParseIP(out[0].Address).To4())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = maxSessionLifeDevice.Unpack(deviceBytes)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if maxSessionLifeDevice.sessionExpiry != math.MaxUint64 {
-		t.Fatalf("lifetime was not set to max uint64, was %d (maxuint64 %d)", maxSessionLifeDevice.sessionExpiry, uint64(math.MaxUint64))
-	}
-
-	ip, _, err := net.ParseCIDR(config.GetEffectiveAcl(out[0].Username).Mfa[0])
-	if err != nil {
-		t.Fatal("could not parse ip: ", err)
-	}
-
-	testAuthorizedPacket := ipv4.Header{
-		Version: 4,
-		Dst:     ip,
-		Src:     net.ParseIP(out[0].Address),
-		Len:     ipv4.HeaderLen,
-	}
-
-	if testAuthorizedPacket.Src == nil || testAuthorizedPacket.Dst == nil {
-		t.Fatal("could not parse ip")
-	}
-
-	packet, err := testAuthorizedPacket.Marshal()
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Log(GetRoutes("tester"))
-	t.Logf("Now doing timing test for disabled sliding window waiting...")
-
-	elapsed := 0
-	for {
-		time.Sleep(15 * time.Second)
-		elapsed += 15
+// import (
+// 	"crypto/sha1"
+// 	"encoding/binary"
+// 	"fmt"
+// 	"log"
+// 	"math"
+// 	"math/rand"
+// 	"net"
+// 	"strings"
+// 	"testing"
+// 	"time"
+
+// 	"github.com/NHAS/wag/internal/config"
+// 	"github.com/NHAS/wag/internal/data"
+// 	"github.com/NHAS/wag/internal/routetypes"
+
+// 	"github.com/cilium/ebpf"
+// 	"golang.org/x/net/ipv4"
+// )
+
+// const (
+// 	XDP_DROP = 1
+// 	XDP_PASS = 2
+// )
+
+// func TestBasicLoad(t *testing.T) {
+// 	if err := setup("../config/test_in_memory_db.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+// }
+
+// func TestBlankPacket(t *testing.T) {
+
+// 	if err := setup("../config/test_in_memory_db.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	buff := make([]byte, 15)
+// 	value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(buff)
+// 	if err != nil {
+// 		t.Fatalf("program failed %s", err)
+// 	}
+
+// 	if result(value) != "XDP_DROP" {
+// 		t.Fatal("program did not drop a completely blank packet: did", result(value))
+// 	}
+// }
+
+// func TestAddNewDevices(t *testing.T) {
+
+// 	if err := setup("../config/test_in_memory_db.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	var ipBytes []byte
+// 	var deviceBytes = make([]byte, 40)
+
+// 	found := map[string]bool{}
+
+// 	iter := xdpObjects.Devices.Iterate()
+// 	for iter.Next(&ipBytes, &deviceBytes) {
+// 		ip := net.IP(ipBytes)
+
+// 		var newDevice fwentry
+// 		err := newDevice.Unpack(deviceBytes)
+// 		if err != nil {
+// 			t.Fatal("unpacking new device:", err)
+// 		}
+
+// 		if newDevice.lastPacketTime != 0 || newDevice.sessionExpiry != 0 {
+// 			t.Fatal("timers were not 0 immediately after device add")
+// 		}
+// 		found[ip.String()] = true
+// 	}
+
+// 	if iter.Err() != nil {
+// 		t.Fatalf("iterator reported an error: %s", iter.Err())
+// 	}
+
+// 	if len(found) != len(out) {
+// 		t.Fatalf("expected number of devices not found when iterating timestamp map %d != %d", len(found), len(out))
+// 	}
+
+// 	for _, device := range out {
+// 		if !found[device.Address] {
+// 			t.Fatalf("%s not found even though it should have been added", device.Address)
+// 		}
+// 	}
+
+// }
+
+// func TestAddUser(t *testing.T) {
+
+// 	if err := setup("../config/test_in_memory_db.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	for _, device := range out {
+// 		policiesTable, err := checkLPMMap(device.Username, xdpObjects.PoliciesTable)
+// 		if err != nil {
+// 			t.Fatal("checking policy table:", err)
+// 		}
+
+// 		acl := config.GetEffectiveAcl(device.Username)
+
+// 		results, err := routetypes.ParseRules(acl.Mfa, acl.Allow, nil)
+// 		if err != nil {
+// 			t.Fatal("parsing rules failed?:", err)
+// 		}
+
+// 		resultsAsString := []string{}
+// 		for _, r := range results {
+// 			for m := range r.Keys {
+// 				resultsAsString = append(resultsAsString, r.Keys[m].String())
+// 			}
+// 		}
+
+// 		if !contains(policiesTable, resultsAsString) {
+// 			t.Fatal("policies list does not match configured acls\n got: ", policiesTable, "\nexpected:", resultsAsString)
+// 		}
+
+// 	}
+// }
+
+// func contains(x, y []string) bool {
+// 	f := map[string]bool{}
+// 	for _, nx := range x {
+// 		f[nx] = true
+// 	}
+
+// 	for _, ny := range y {
+// 		if ok := f[ny]; !ok {
+// 			return false
+// 		}
+// 	}
+
+// 	return true
+// }
+
+// func TestRoutePriority(t *testing.T) {
+
+// 	if err := setup("../config/test_roaming_all_routes_mfa_priority.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	headers := []ipv4.Header{
+
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("8.8.8.8"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("11.11.11.11"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("1.1.1.1"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP(out[0].Address),
+// 			Src:     net.ParseIP("1.1.1.1"),
+// 			Len:     ipv4.HeaderLen,
+// 		}, {
+// 			Version: 4,
+// 			Dst:     net.ParseIP("192.168.1.1"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 	}
+
+// 	expectedResults := map[string]uint32{
+// 		headers[0].String(): XDP_DROP,
+// 		headers[1].String(): XDP_PASS,
+// 		headers[2].String(): XDP_PASS,
+// 		headers[3].String(): XDP_PASS,
+// 		headers[4].String(): XDP_PASS,
+// 	}
+
+// 	for i := range headers {
+// 		if headers[i].Src == nil || headers[i].Dst == nil {
+// 			t.Fatal("could not parse ip")
+// 		}
+
+// 		packet, err := headers[i].Marshal()
+// 		if err != nil {
+// 			t.Fatal(err)
+// 		}
+
+// 		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
+// 		if err != nil {
+// 			t.Fatalf("program failed %s", err)
+// 		}
+
+// 		if result(value) != result(expectedResults[headers[i].String()]) {
+// 			t.Logf("(%s) program did not %s packet instead did: %s", headers[i].String(), result(expectedResults[headers[i].String()]), result(value))
+// 			t.Fail()
+// 		}
+// 	}
+
+// }
+
+// func TestBasicAuthorise(t *testing.T) {
+// 	if err := setup("../config/test_in_memory_db.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	err = SetAuthorized(out[0].Address, out[0].Username)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	if !IsAuthed(out[0].Address) {
+// 		t.Fatal("after setting user as authorized it should be.... authorized")
+// 	}
+
+// 	headers := []ipv4.Header{
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("11.11.11.11"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("192.168.3.11"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("8.8.8.8"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("3.21.11.11"),
+// 			Src:     net.ParseIP(out[1].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("7.7.7.7"),
+// 			Src:     net.ParseIP(out[1].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("4.3.3.3"),
+// 			Src:     net.ParseIP(out[1].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 	}
+
+// 	expectedResults := map[string]uint32{
+// 		headers[0].String(): XDP_DROP,
+// 		headers[1].String(): XDP_PASS,
+// 		headers[2].String(): XDP_PASS,
+// 		headers[3].String(): XDP_DROP,
+// 		headers[4].String(): XDP_PASS,
+// 		headers[5].String(): XDP_DROP,
+// 	}
+
+// 	mfas, err := routetypes.ParseRules(config.GetEffectiveAcl(out[0].Username).Mfa, nil, nil)
+// 	if err != nil {
+// 		t.Fatal("failed to parse mfa rules: ", err)
+// 	}
+
+// 	for i := range mfas {
+// 		newHeader := ipv4.Header{
+// 			Version: 4,
+// 			Dst:     mfas[i].Keys[0].AsIP(),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		}
+// 		headers = append(headers, newHeader)
+
+// 		expectedResults[newHeader.String()] = XDP_PASS
+
+// 	}
+
+// 	for i := range headers {
+// 		if headers[i].Src == nil || headers[i].Dst == nil {
+// 			t.Fatal("could not parse ip")
+// 		}
+
+// 		packet, err := headers[i].Marshal()
+// 		if err != nil {
+// 			t.Fatal(err)
+// 		}
+
+// 		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
+// 		if err != nil {
+// 			t.Fatalf("program failed %s", err)
+// 		}
+
+// 		if value != expectedResults[headers[i].String()] {
+// 			t.Fatalf("%s program did not %s packet instead did: %s", headers[i].String(), result(expectedResults[headers[i].String()]), result(value))
+// 		}
+// 	}
+
+// 	err = Deauthenticate(out[0].Address)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	if IsAuthed(out[0].Address) {
+// 		t.Fatal("after setting user as deauthorized it should be.... deauthorized")
+// 	}
+
+// 	for i := range headers {
+// 		if headers[i].Src == nil || headers[i].Dst == nil {
+// 			t.Fatal("could not parse ip")
+// 		}
+
+// 		if out[0].Address != headers[i].Src.String() {
+// 			continue
+// 		}
+
+// 		packet, err := headers[i].Marshal()
+// 		if err != nil {
+// 			t.Fatal(err)
+// 		}
+
+// 		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
+// 		if err != nil {
+// 			t.Fatalf("program failed %s", err)
+// 		}
+
+// 		if value != XDP_DROP {
+// 			t.Fatalf("after deauthenticating, everything should be XDP_DROP instead %s", result(value))
+// 		}
+// 	}
+
+// }
+
+// func TestRoutePreference(t *testing.T) {
+// 	if err := setup("../config/test_route_restriction_preference.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	headers := []ipv4.Header{
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("1.1.3.43"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("1.1.1.11"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("1.1.4.1"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("3.21.11.11"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("1.1.2.7"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 		{
+// 			Version: 4,
+// 			Dst:     net.ParseIP("1.1.2.3"),
+// 			Src:     net.ParseIP(out[0].Address),
+// 			Len:     ipv4.HeaderLen,
+// 		},
+// 	}
+
+// 	expectedResults := map[string]uint32{
+// 		headers[0].String(): XDP_DROP,
+// 		headers[1].String(): XDP_PASS,
+// 		headers[2].String(): XDP_PASS,
+// 		headers[3].String(): XDP_DROP,
+// 		headers[4].String(): XDP_PASS,
+// 		headers[5].String(): XDP_DROP,
+// 	}
+
+// 	for i := range headers {
+// 		if headers[i].Src == nil || headers[i].Dst == nil {
+// 			t.Fatal("could not parse ip")
+// 		}
+
+// 		packet, err := headers[i].Marshal()
+// 		if err != nil {
+// 			t.Fatal(err)
+// 		}
+
+// 		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
+// 		if err != nil {
+// 			t.Fatalf("program failed %s", err)
+// 		}
+
+// 		if value != expectedResults[headers[i].String()] {
+// 			t.Logf("%s program did not %s packet instead did: %s", headers[i].String(), result(expectedResults[headers[i].String()]), result(value))
+// 			t.Fail()
+// 		}
+// 	}
+// }
+
+// func TestSlidingWindow(t *testing.T) {
+// 	if err := setup("../config/test_disabled_max_lifetime.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	err = SetAuthorized(out[0].Address, out[0].Username)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	if !IsAuthed(out[0].Address) {
+// 		t.Fatal("after setting user as authorized it should be.... authorized")
+// 	}
+
+// 	ip, _, err := net.ParseCIDR(config.GetEffectiveAcl(out[0].Username).Mfa[0])
+// 	if err != nil {
+// 		t.Fatal("could not parse ip: ", err)
+// 	}
+
+// 	testAuthorizedPacket := ipv4.Header{
+// 		Version: 4,
+// 		Dst:     ip,
+// 		Src:     net.ParseIP(out[0].Address),
+// 		Len:     ipv4.HeaderLen,
+// 	}
+
+// 	log.Println(testAuthorizedPacket.Dst, testAuthorizedPacket.Src)
+
+// 	if testAuthorizedPacket.Src == nil || testAuthorizedPacket.Dst == nil {
+// 		t.Fatal("could not parse ip")
+// 	}
+
+// 	packet, err := testAuthorizedPacket.Marshal()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	var beforeDevice fwentry
+// 	deviceBytes, err := xdpObjects.Devices.LookupBytes(net.ParseIP(out[0].Address).To4())
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	err = beforeDevice.Unpack(deviceBytes)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	var timeoutFromMap uint64
+// 	err = xdpObjects.InactivityTimeoutMinutes.Lookup(uint32(0), &timeoutFromMap)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	difference := uint64(config.Values().SessionInactivityTimeoutMinutes) * 60000000000
+// 	if timeoutFromMap != difference {
+// 		t.Fatal("timeout retrieved from ebpf program does not match json")
+// 	}
+
+// 	value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
+// 	if err != nil {
+// 		t.Fatalf("program failed %s", err)
+// 	}
+
+// 	if value != 2 {
+// 		t.Fatalf("program did not %s packet instead did: %s", result(2), result(value))
+// 	}
+
+// 	var afterDevice fwentry
+// 	deviceBytes, err = xdpObjects.Devices.LookupBytes(net.ParseIP(out[0].Address).To4())
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	err = afterDevice.Unpack(deviceBytes)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	if afterDevice.lastPacketTime == beforeDevice.lastPacketTime {
+// 		t.Fatal("sending a packet did not change sliding window timeout")
+// 	}
+
+// 	if afterDevice.lastPacketTime < beforeDevice.lastPacketTime {
+// 		t.Fatal("the resulting update must be closer in time")
+// 	}
+
+// 	t.Logf("Now doing timing test for sliding window waiting %d+10seconds", config.Values().SessionInactivityTimeoutMinutes)
+
+// 	//Check slightly after inactivity timeout to see if the user is now not authenticated
+// 	time.Sleep(time.Duration(config.Values().SessionInactivityTimeoutMinutes)*time.Minute + 10*time.Second)
+
+// 	value, _, err = xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
+// 	if err != nil {
+// 		t.Fatalf("program failed %s", err)
+// 	}
+
+// 	if value != 1 {
+// 		t.Fatalf("program did not %s packet instead did: %s", result(1), result(value))
+// 	}
+
+// 	if IsAuthed(out[0].Address) {
+// 		t.Fatal("user is still authorized after inactivity timeout should have killed them")
+// 	}
+// }
+
+// func TestCompositeRules(t *testing.T) {
+// 	if err := setup("../config/test_mutliple_rule_definitions_and_mfa_preference.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	err = SetAuthorized(out[0].Address, out[0].Username)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	successPackets := [][]byte{
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.TCP, 11),
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.TCP, 8080),
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.UDP, 8080),
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.UDP, 9080),
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.TCP, 50),
+
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("7.7.7.7"), routetypes.ICMP, 0),
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("7.7.7.7"), routetypes.TCP, 22),
+// 	}
+
+// 	for i := range successPackets {
+
+// 		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(successPackets[i])
+// 		if err != nil {
+// 			t.Fatalf("program failed %s", err)
+// 		}
+
+// 		if value != XDP_PASS {
+// 			fw, _ := GetRules()
+// 			t.Logf("%+v", fw)
+// 			t.Fatalf("%d program did not XDP_PASS packet instead did: %s", i, result(value))
+// 		}
+// 	}
+
+// 	err = Deauthenticate(out[0].Address)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	expectedResults := []uint32{
+// 		XDP_DROP,
+// 		XDP_PASS,
+// 		XDP_PASS,
+
+// 		XDP_DROP,
+// 		XDP_DROP,
+
+// 		XDP_PASS,
+// 	}
+
+// 	packets := [][]byte{
+
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.TCP, 11),
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.TCP, 8080),
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.UDP, 8080),
+
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.UDP, 9080),
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.TCP, 50),
+
+// 		createPacket(net.ParseIP(out[0].Address), net.ParseIP("8.8.8.8"), routetypes.ICMP, 0),
+// 	}
+
+// 	for i := range packets {
+
+// 		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packets[i])
+// 		if err != nil {
+// 			t.Fatalf("program failed %s", err)
+// 		}
+
+// 		if value != expectedResults[i] {
+// 			fw, _ := GetRules()
+// 			t.Logf("%s:%+v", out[0].Username, fw[out[0].Username])
+// 			t.Fatalf("%d program did not %s packet instead did: %s", i, result(expectedResults[i]), result(value))
+// 		}
+// 	}
+
+// }
+
+// func TestDisabledSlidingWindow(t *testing.T) {
+// 	if err := setup("../config/test_disabled_sliding_window.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	var timeoutFromMap uint64
+// 	err = xdpObjects.InactivityTimeoutMinutes.Lookup(uint32(0), &timeoutFromMap)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	if timeoutFromMap != math.MaxUint64 {
+// 		t.Fatalf("the inactivity timeout was not set to max uint64, was %d (maxuint64 %d)", timeoutFromMap, uint64(math.MaxUint64))
+// 	}
+
+// 	err = SetAuthorized(out[0].Address, out[0].Username)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	if !IsAuthed(out[0].Address) {
+// 		t.Fatal("after setting user as authorized it should be.... authorized")
+// 	}
+
+// 	ip, _, err := net.ParseCIDR(config.GetEffectiveAcl(out[0].Username).Mfa[0])
+// 	if err != nil {
+// 		t.Fatal("could not parse ip: ", err)
+// 	}
+
+// 	testAuthorizedPacket := ipv4.Header{
+// 		Version: 4,
+// 		Dst:     ip,
+// 		Src:     net.ParseIP(out[0].Address),
+// 		Len:     ipv4.HeaderLen,
+// 	}
+
+// 	if testAuthorizedPacket.Src == nil || testAuthorizedPacket.Dst == nil {
+// 		t.Fatal("could not parse ip")
+// 	}
+
+// 	packet, err := testAuthorizedPacket.Marshal()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	t.Logf("Now doing timing test for disabled sliding window waiting...")
+
+// 	elapsed := 0
+// 	for {
+// 		time.Sleep(15 * time.Second)
+// 		elapsed += 15
+
+// 		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
+// 		if err != nil {
+// 			t.Fatalf("program failed %s", err)
+// 		}
+
+// 		if value == 1 {
+// 			if elapsed < config.Values().MaxSessionLifetimeMinutes*60 {
+// 				t.Fatal("epbf kernel blocking valid traffic early")
+// 			} else {
+// 				break
+// 			}
+
+// 		}
+// 	}
+
+// }
+
+// func TestMaxSessionLifetime(t *testing.T) {
+// 	if err := setup("../config/test_disabled_sliding_window.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	err = SetAuthorized(out[0].Address, out[0].Username)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	if !IsAuthed(out[0].Address) {
+// 		t.Fatal("after setting user device as authorized it should be.... authorized")
+// 	}
+
+// 	ip, _, err := net.ParseCIDR(config.GetEffectiveAcl(out[0].Username).Mfa[0])
+// 	if err != nil {
+// 		t.Fatal("could not parse ip: ", err)
+// 	}
+
+// 	testAuthorizedPacket := ipv4.Header{
+// 		Version: 4,
+// 		Dst:     ip,
+// 		Src:     net.ParseIP(out[0].Address),
+// 		Len:     ipv4.HeaderLen,
+// 	}
+
+// 	if testAuthorizedPacket.Src == nil || testAuthorizedPacket.Dst == nil {
+// 		t.Fatal("could not parse ip")
+// 	}
+
+// 	packet, err := testAuthorizedPacket.Marshal()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
+// 	if err != nil {
+// 		t.Fatalf("program failed %s", err)
+// 	}
+
+// 	if value != 2 {
+// 		t.Fatalf("program did not %s packet instead did: %s", result(2), result(value))
+// 	}
+
+// 	t.Logf("Waiting for %d minutes to test max session timeout", config.Values().MaxSessionLifetimeMinutes)
+
+// 	time.Sleep(time.Minute * time.Duration(config.Values().MaxSessionLifetimeMinutes))
+
+// 	value, _, err = xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
+// 	if err != nil {
+// 		t.Fatalf("program failed %s", err)
+// 	}
+
+// 	if value != 1 {
+// 		t.Fatalf("program did not %s packet instead did: %s", result(1), result(value))
+// 	}
+
+// 	if IsAuthed(out[0].Address) {
+// 		t.Fatal("user is still authorized after inactivity timeout should have killed them")
+// 	}
+// }
+
+// func TestDisablingMaxLifetime(t *testing.T) {
+// 	if err := setup("../config/test_disabled_max_lifetime.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	err = SetAuthorized(out[0].Address, out[0].Username)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	if !IsAuthed(out[0].Address) {
+// 		t.Fatal("after setting user as authorized it should be.... authorized")
+// 	}
+
+// 	var maxSessionLifeDevice fwentry
+// 	deviceBytes, err := xdpObjects.Devices.LookupBytes(net.ParseIP(out[0].Address).To4())
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	err = maxSessionLifeDevice.Unpack(deviceBytes)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	if maxSessionLifeDevice.sessionExpiry != math.MaxUint64 {
+// 		t.Fatalf("lifetime was not set to max uint64, was %d (maxuint64 %d)", maxSessionLifeDevice.sessionExpiry, uint64(math.MaxUint64))
+// 	}
+
+// 	ip, _, err := net.ParseCIDR(config.GetEffectiveAcl(out[0].Username).Mfa[0])
+// 	if err != nil {
+// 		t.Fatal("could not parse ip: ", err)
+// 	}
+
+// 	testAuthorizedPacket := ipv4.Header{
+// 		Version: 4,
+// 		Dst:     ip,
+// 		Src:     net.ParseIP(out[0].Address),
+// 		Len:     ipv4.HeaderLen,
+// 	}
+
+// 	if testAuthorizedPacket.Src == nil || testAuthorizedPacket.Dst == nil {
+// 		t.Fatal("could not parse ip")
+// 	}
+
+// 	packet, err := testAuthorizedPacket.Marshal()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	t.Log(GetRoutes("tester"))
+// 	t.Logf("Now doing timing test for disabled sliding window waiting...")
+
+// 	elapsed := 0
+// 	for {
+// 		time.Sleep(15 * time.Second)
+// 		elapsed += 15
 
-		t.Logf("waiting %d sec...", elapsed)
-
-		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
-		if err != nil {
-			t.Fatalf("program failed %s", err)
-		}
-
-		if value == 1 {
-			t.Fatalf("should not block traffic")
-		}
-
-		if elapsed > 30 {
-			break
-		}
+// 		t.Logf("waiting %d sec...", elapsed)
+
+// 		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
+// 		if err != nil {
+// 			t.Fatalf("program failed %s", err)
+// 		}
+
+// 		if value == 1 {
+// 			t.Fatalf("should not block traffic")
+// 		}
+
+// 		if elapsed > 30 {
+// 			break
+// 		}
 
-	}
+// 	}
 
-}
+// }
 
-type pkthdr struct {
-	pktType string
+// type pkthdr struct {
+// 	pktType string
 
-	src uint16
-	dst uint16
-}
-
-func (p pkthdr) String() string {
-	return fmt.Sprintf("%s, src_port %d, dst_port %d", p.pktType, p.src, p.dst)
-}
-
-func (p *pkthdr) UnpackTcp(b []byte) {
-	p.pktType = "TCP"
-	p.src = binary.BigEndian.Uint16(b)
-	p.dst = binary.BigEndian.Uint16(b[2:])
-}
-
-func (p *pkthdr) Tcp() []byte {
-	r := make([]byte, 21) // 1 byte over as we need to fake some data
-
-	binary.BigEndian.PutUint16(r, p.src)
-	binary.BigEndian.PutUint16(r[2:], p.dst)
-
-	return r
-}
-
-func (p *pkthdr) UnpackUdp(b []byte) {
-	p.pktType = "UDP"
-	p.src = binary.BigEndian.Uint16(b)
-	p.dst = binary.BigEndian.Uint16(b[2:])
-}
-
-func (p *pkthdr) Udp() []byte {
-	r := make([]byte, 9) // 1 byte over as we need to fake some data
-
-	binary.BigEndian.PutUint16(r, p.src)
-	binary.BigEndian.PutUint16(r[2:], p.dst)
-
-	return r
-}
-
-func (p *pkthdr) UnpackIcmp(b []byte) {
-	p.pktType = "ICMP"
-}
-
-func (p *pkthdr) Icmp() []byte {
-	r := make([]byte, 9) // 1 byte over as we need to fake some data
-
-	//icmp isnt parsed, other than proto and length
-
-	return r
-}
-
-func (p *pkthdr) UnpackAny(b []byte) {
-	p.pktType = "Any"
-	p.src = binary.BigEndian.Uint16(b)
-	p.dst = binary.BigEndian.Uint16(b[2:])
-}
-
-func (p *pkthdr) Any() []byte {
-	r := make([]byte, 9) // 1 byte over as we need to fake some data
-
-	//icmp isnt parsed, other than proto and length
-
-	binary.BigEndian.PutUint16(r, p.src)
-	binary.BigEndian.PutUint16(r[2:], p.dst)
-
-	return r
-}
-
-func createPacket(src, dst net.IP, proto, port int) []byte {
-	iphdr := ipv4.Header{
-		Version:  4,
-		Dst:      dst,
-		Src:      src,
-		Len:      ipv4.HeaderLen,
-		Protocol: proto,
-	}
+// 	src uint16
+// 	dst uint16
+// }
+
+// func (p pkthdr) String() string {
+// 	return fmt.Sprintf("%s, src_port %d, dst_port %d", p.pktType, p.src, p.dst)
+// }
+
+// func (p *pkthdr) UnpackTcp(b []byte) {
+// 	p.pktType = "TCP"
+// 	p.src = binary.BigEndian.Uint16(b)
+// 	p.dst = binary.BigEndian.Uint16(b[2:])
+// }
+
+// func (p *pkthdr) Tcp() []byte {
+// 	r := make([]byte, 21) // 1 byte over as we need to fake some data
+
+// 	binary.BigEndian.PutUint16(r, p.src)
+// 	binary.BigEndian.PutUint16(r[2:], p.dst)
+
+// 	return r
+// }
+
+// func (p *pkthdr) UnpackUdp(b []byte) {
+// 	p.pktType = "UDP"
+// 	p.src = binary.BigEndian.Uint16(b)
+// 	p.dst = binary.BigEndian.Uint16(b[2:])
+// }
+
+// func (p *pkthdr) Udp() []byte {
+// 	r := make([]byte, 9) // 1 byte over as we need to fake some data
+
+// 	binary.BigEndian.PutUint16(r, p.src)
+// 	binary.BigEndian.PutUint16(r[2:], p.dst)
+
+// 	return r
+// }
+
+// func (p *pkthdr) UnpackIcmp(b []byte) {
+// 	p.pktType = "ICMP"
+// }
+
+// func (p *pkthdr) Icmp() []byte {
+// 	r := make([]byte, 9) // 1 byte over as we need to fake some data
+
+// 	//icmp isnt parsed, other than proto and length
+
+// 	return r
+// }
+
+// func (p *pkthdr) UnpackAny(b []byte) {
+// 	p.pktType = "Any"
+// 	p.src = binary.BigEndian.Uint16(b)
+// 	p.dst = binary.BigEndian.Uint16(b[2:])
+// }
+
+// func (p *pkthdr) Any() []byte {
+// 	r := make([]byte, 9) // 1 byte over as we need to fake some data
+
+// 	//icmp isnt parsed, other than proto and length
+
+// 	binary.BigEndian.PutUint16(r, p.src)
+// 	binary.BigEndian.PutUint16(r[2:], p.dst)
+
+// 	return r
+// }
+
+// func createPacket(src, dst net.IP, proto, port int) []byte {
+// 	iphdr := ipv4.Header{
+// 		Version:  4,
+// 		Dst:      dst,
+// 		Src:      src,
+// 		Len:      ipv4.HeaderLen,
+// 		Protocol: proto,
+// 	}
 
-	hdrbytes, _ := iphdr.Marshal()
+// 	hdrbytes, _ := iphdr.Marshal()
 
-	pkt := pkthdr{
-		src: 3884,
-		dst: uint16(port),
-	}
+// 	pkt := pkthdr{
+// 		src: 3884,
+// 		dst: uint16(port),
+// 	}
 
-	switch proto {
-	case routetypes.UDP:
-		hdrbytes = append(hdrbytes, pkt.Udp()...)
-	case routetypes.TCP:
-		hdrbytes = append(hdrbytes, pkt.Tcp()...)
+// 	switch proto {
+// 	case routetypes.UDP:
+// 		hdrbytes = append(hdrbytes, pkt.Udp()...)
+// 	case routetypes.TCP:
+// 		hdrbytes = append(hdrbytes, pkt.Tcp()...)
 
-	case routetypes.ICMP:
-		hdrbytes = append(hdrbytes, pkt.Icmp()...)
+// 	case routetypes.ICMP:
+// 		hdrbytes = append(hdrbytes, pkt.Icmp()...)
 
-	default:
-		hdrbytes = append(hdrbytes, pkt.Any()...)
+// 	default:
+// 		hdrbytes = append(hdrbytes, pkt.Any()...)
 
-	}
+// 	}
 
-	return hdrbytes
-}
+// 	return hdrbytes
+// }
 
-func TestPortRestrictions(t *testing.T) {
-	if err := setup("../config/test_port_based_rules.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
+// func TestPortRestrictions(t *testing.T) {
+// 	if err := setup("../config/test_port_based_rules.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
 
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
 
-	/*
-		"Allow": [
-			"1.1.0.0/16",
-			"2.2.2.2",
-			"3.3.3.3 33/tcp",
-			"4.4.4.4 43/udp",
-			"5.5.5.5 55/any",
-			"6.6.6.6 100-150/tcp",
-			"7.7.7.7 icmp"
-		]
-	*/
+// 	/*
+// 		"Allow": [
+// 			"1.1.0.0/16",
+// 			"2.2.2.2",
+// 			"3.3.3.3 33/tcp",
+// 			"4.4.4.4 43/udp",
+// 			"5.5.5.5 55/any",
+// 			"6.6.6.6 100-150/tcp",
+// 			"7.7.7.7 icmp"
+// 		]
+// 	*/
 
-	acl := config.GetEffectiveAcl(out[0].Username)
+// 	acl := config.GetEffectiveAcl(out[0].Username)
 
-	rules, err := routetypes.ParseRules(acl.Mfa, acl.Allow, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+// 	rules, err := routetypes.ParseRules(acl.Mfa, acl.Allow, nil)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
 
-	var packets [][]byte
-	expectedResults := []uint32{}
+// 	var packets [][]byte
+// 	expectedResults := []uint32{}
 
-	flip := true
-	for _, rule := range rules {
+// 	flip := true
+// 	for _, rule := range rules {
 
-		for _, policy := range rule.Values {
-			if policy.Is(routetypes.STOP) {
-				break
-			}
+// 		for _, policy := range rule.Values {
+// 			if policy.Is(routetypes.STOP) {
+// 				break
+// 			}
 
-			// If we've got an any single port rule e.g 55/any, make sure that the proto is something that has ports otherwise the test fails
-			successProto := policy.Proto
-			if policy.Proto == routetypes.ANY && policy.LowerPort != routetypes.ANY {
-				successProto = routetypes.UDP
-			}
-
-			// Add matching/passing packet
-			packets = append(packets, createPacket(net.ParseIP(out[0].Address), net.IP(rule.Keys[0].IP[:]), int(successProto), int(policy.LowerPort)))
-			expectedResults = append(expectedResults, XDP_PASS)
-
-			if policy.Proto == routetypes.ANY && policy.LowerPort == routetypes.ANY && policy.Is(routetypes.SINGLE) {
-				continue
-			}
-
-			//Add single port/proto mismatch failing packet
-			port := int(policy.LowerPort)
-			proto := int(policy.Proto)
-			if proto == routetypes.ANY {
-				port -= 1
-			} else if port == routetypes.ANY {
-				proto = 88
-			} else {
-
-				if flip {
-					proto = 22
-				} else {
-					port -= 1
-				}
-
-				flip = !flip
-			}
-
-			packets = append(packets, createPacket(net.ParseIP(out[0].Address), net.IP(rule.Keys[0].IP[:]), proto, port))
-			expectedResults = append(expectedResults, XDP_DROP)
-
-			var bogusDstIp net.IP = net.ParseIP("1.1.1.1").To4()
-
-			binary.LittleEndian.PutUint32(bogusDstIp, rand.Uint32())
-
-			if net.IP.Equal(bogusDstIp, net.IP(rule.Keys[0].IP[:])) {
-				continue
-			}
-
-			// Route miss packet
-			packets = append(packets, createPacket(net.ParseIP(out[0].Address), bogusDstIp, int(policy.Proto), int(policy.LowerPort)))
-			expectedResults = append(expectedResults, XDP_DROP)
-
-		}
-	}
-
-	for i := range packets {
-
-		packet := packets[i]
-
-		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
-		if err != nil {
-			t.Fatalf("program failed %s", err)
-		}
-
-		if value != expectedResults[i] {
-
-			var iphdr ipv4.Header
-			err := iphdr.Parse(packet)
-			if err != nil {
-				t.Fatal("packet didnt parse as an IP header: ", err)
-			}
-
-			packet = packet[20:]
-
-			var pkt pkthdr
-			pkt.pktType = "unknown"
-
-			switch iphdr.Protocol {
-			case routetypes.UDP:
-				pkt.UnpackUdp(packet)
-			case routetypes.TCP:
-				pkt.UnpackTcp(packet)
-			case routetypes.ICMP:
-				pkt.UnpackIcmp(packet)
-			case routetypes.ANY:
-				pkt.UnpackAny(packet)
-
-			}
-
-			info := iphdr.Src.String() + " -> " + iphdr.Dst.String() + ", proto " + pkt.String()
-
-			m, _ := GetRules()
-			t.Logf("%+v", m)
-			t.Fatalf("%s program did not %s packet instead did: %s", info, result(expectedResults[i]), result(value))
-		}
-	}
-
-}
-
-func TestAgnosticRuleOrdering(t *testing.T) {
-	if err := setup("../config/test_port_based_rules.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var packets [][]byte
-
-	for _, user := range out {
-		acl := config.GetEffectiveAcl(user.Username)
-
-		rules, err := routetypes.ParseRules(acl.Mfa, acl.Allow, nil)
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		// Populate expected
-		for _, rule := range rules {
-
-			for _, policy := range rule.Values {
-				if policy.Is(routetypes.STOP) {
-					break
-				}
-
-				// If we've got an any single port rule e.g 55/any, make sure that the proto is something that has ports otherwise the test fails
-				successProto := policy.Proto
-				if policy.Proto == routetypes.ANY && policy.LowerPort != routetypes.ANY {
-					successProto = routetypes.UDP
-				}
-
-				// Add matching/passing packet
-				packets = append(packets, createPacket(net.ParseIP(user.Address), net.IP(rule.Keys[0].IP[:]), int(successProto), int(policy.LowerPort)))
-			}
-		}
-
-	}
-	// We check that for both users, that they all pass. This effectively enables us to check that reordered rules are equal
-	for i := range packets {
-
-		packet := packets[i]
-
-		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
-		if err != nil {
-			t.Fatalf("program failed %s", err)
-		}
-
-		var iphdr ipv4.Header
-		err = iphdr.Parse(packet)
-		if err != nil {
-			t.Fatal("packet didnt parse as an IP header: ", err)
-		}
-		packet = packet[20:]
-
-		var pkt pkthdr
-		pkt.pktType = "unknown"
-
-		switch iphdr.Protocol {
-		case routetypes.UDP:
-			pkt.UnpackUdp(packet)
-		case routetypes.TCP:
-			pkt.UnpackTcp(packet)
-		case routetypes.ICMP:
-			pkt.UnpackIcmp(packet)
-		case routetypes.ANY:
-			pkt.UnpackAny(packet)
-
-		}
-		t.Log(iphdr.Src.String(), " -> ", iphdr.Dst.String(), ", proto "+pkt.String())
-
-		if value != XDP_PASS {
-
-			t.Fatalf("program did not XDP_PASS packet instead did: %s", result(value))
-		}
-	}
-}
-
-func TestLookupDifferentKeyTypesInMap(t *testing.T) {
-	if err := setup("../config/test_port_based_rules.json"); err != nil {
-		t.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	userPublicRoutes, err := getInnerMap(out[0].Username, xdpObjects.PoliciesTable)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Check negative case
-	err = userPublicRoutes.Lookup([]byte("3470239uy4skljhd"), nil)
-	if err == nil {
-		t.Fatal("searched garbage string, should not match")
-	}
-
-	/*
-	   "Allow": [
-	       "1.1.0.0/16",
-	       "2.2.2.2",
-	       "3.3.3.3 33/tcp",
-	       "4.4.4.4 43/udp",
-	       "5.5.5.5 55/any",
-	       "6.6.6.6 100-150/tcp"
-	   ]
-	*/
-
-	k := routetypes.Key{
-		IP:        [4]byte{1, 1, 1, 1},
-		Prefixlen: 32,
-	}
-
-	var policies [routetypes.MAX_POLICIES]routetypes.Policy
-	err = userPublicRoutes.Lookup(k.Bytes(), &policies)
-	if err != nil {
-		t.Fatal("searched for valid subnet: ", err)
-	}
-
-	if !policies[0].Is(routetypes.SINGLE) {
-		t.Fatal("the route type was not single: ", policies[0])
-	}
-
-	if policies[0].LowerPort != 0 || policies[0].Proto != 0 {
-		t.Fatal("policy was not marked as allow all despite having no rules defined")
-	}
-
-	if !policies[1].Is(routetypes.STOP) {
-		t.Fatal("policy should only contain one any/any rule")
-	}
-
-	k = routetypes.Key{
-		IP:        [4]byte{3, 3, 3, 3},
-		Prefixlen: 32,
-	}
-
-	err = userPublicRoutes.Lookup(k.Bytes(), &policies)
-	if err != nil {
-		t.Fatal("searched for ip failed")
-	}
-
-	if !policies[0].Is(routetypes.SINGLE) {
-		t.Fatal("the route type was not single")
-	}
-
-	if policies[0].LowerPort != 33 || policies[0].Proto != routetypes.TCP {
-		t.Fatal("policy had incorrect proto and port defintions")
-	}
-
-	if !policies[1].Is(routetypes.STOP) {
-		t.Fatal("policy should only contain one any/any rule")
-	}
-
-}
-
-func BenchmarkGeneralRun(b *testing.B) {
-
-	if err := setup("../config/test_port_based_rules.json"); err != nil {
-		b.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		b.Fatal(err)
-	}
-
-	packet := createPacket(net.ParseIP(out[0].Address), net.ParseIP("10.10.10.10"), routetypes.TCP, 8082)
-
-	b.ResetTimer()
-	_, duration, err := xdpObjects.bpfPrograms.XdpWagFirewall.Benchmark(packet, b.N, nil)
-	if err != nil {
-		b.Fatalf("program failed %s", err)
-	}
-
-	b.ReportMetric(float64(duration), "ns/op")
-
-}
-
-func BenchmarkGeneralDenyRun(b *testing.B) {
-
-	if err := setup("../config/test_port_based_rules.json"); err != nil {
-		b.Fatal(err)
-	}
-	defer xdpObjects.Close()
-
-	out, err := addDevices()
-	if err != nil {
-		b.Fatal(err)
-	}
-
-	packet := createPacket(net.ParseIP(out[0].Address), net.ParseIP("10.10.10.10"), routetypes.TCP, 9999)
-
-	b.ResetTimer()
-	_, duration, err := xdpObjects.bpfPrograms.XdpWagFirewall.Benchmark(packet, b.N, nil)
-	if err != nil {
-		b.Fatalf("program failed %s", err)
-	}
-
-	b.ReportMetric(float64(duration), "ns/op")
-
-}
-
-func getInnerMap(username string, m *ebpf.Map) (*ebpf.Map, error) {
-	var innerMapID ebpf.MapID
-	userid := sha1.Sum([]byte(username))
-
-	err := m.Lookup(userid, &innerMapID)
-	if err != nil {
-		return nil, err
-	}
-
-	innerMap, err := ebpf.NewMapFromID(innerMapID)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get map from id: %s", err)
-	}
-
-	return innerMap, nil
-}
-
-func checkLPMMap(username string, m *ebpf.Map) ([]string, error) {
-
-	innerMap, err := getInnerMap(username, m)
-	if err != nil {
-		return nil, err
-	}
-
-	result := []string{}
-
-	var innerKey []byte
-	var val [routetypes.MAX_POLICIES]routetypes.Policy
-	innerIter := innerMap.Iterate()
-	kv := routetypes.Key{}
-	for innerIter.Next(&innerKey, &val) {
-		kv.Unpack(innerKey)
-
-		result = append(result, kv.String())
-	}
-
-	if innerIter.Err() != nil {
-		return nil, innerIter.Err()
-	}
-
-	return result, innerMap.Close()
-}
-
-func result(code uint32) string {
-	switch code {
-	case XDP_DROP:
-		return "XDP_DROP"
-	case XDP_PASS:
-		return "XDP_PASS"
-	default:
-		return fmt.Sprintf("XDP_UNKNOWN_UNUSED(%d)", code)
-	}
-}
-
-func addDevices() ([]data.Device, error) {
-
-	devices := []data.Device{
-		{
-			Address:   "192.168.1.2",
-			Publickey: "dc99y+fmhaHwFToSIw/1MSVXewbiyegBMwNGA6LG8yM=",
-			Username:  "tester",
-			Attempts:  0,
-		},
-		{
-			Address:   "192.168.1.3",
-			Publickey: "sXns6f8d6SMehnT6DQG8URCXnNCFe6ouxVmpJB7WeS0=",
-			Username:  "randomthingappliedtoall",
-			Attempts:  0,
-		},
-	}
-
-	for i := range devices {
-		_, err := data.CreateUserDataAccount(devices[i].Username)
-		if err != nil {
-			return nil, err
-		}
-
-		err = AddUser(devices[i].Username, config.GetEffectiveAcl(devices[i].Username))
-		if err != nil {
-			return nil, err
-		}
-
-		err = xdpAddDevice(devices[i].Username, devices[i].Address)
-		if err != nil {
-			return nil, err
-		}
-	}
-	return devices, nil
-}
-
-func setup(what string) error {
-	err := config.Load(what)
-	if err != nil && !strings.Contains(err.Error(), "Configuration has already been loaded") {
-		return err
-	}
-
-	err = data.Load(config.Values().DatabaseLocation)
-	if err != nil {
-		return err
-	}
-
-	return loadXDP()
-}
+// 			// If we've got an any single port rule e.g 55/any, make sure that the proto is something that has ports otherwise the test fails
+// 			successProto := policy.Proto
+// 			if policy.Proto == routetypes.ANY && policy.LowerPort != routetypes.ANY {
+// 				successProto = routetypes.UDP
+// 			}
+
+// 			// Add matching/passing packet
+// 			packets = append(packets, createPacket(net.ParseIP(out[0].Address), net.IP(rule.Keys[0].IP[:]), int(successProto), int(policy.LowerPort)))
+// 			expectedResults = append(expectedResults, XDP_PASS)
+
+// 			if policy.Proto == routetypes.ANY && policy.LowerPort == routetypes.ANY && policy.Is(routetypes.SINGLE) {
+// 				continue
+// 			}
+
+// 			//Add single port/proto mismatch failing packet
+// 			port := int(policy.LowerPort)
+// 			proto := int(policy.Proto)
+// 			if proto == routetypes.ANY {
+// 				port -= 1
+// 			} else if port == routetypes.ANY {
+// 				proto = 88
+// 			} else {
+
+// 				if flip {
+// 					proto = 22
+// 				} else {
+// 					port -= 1
+// 				}
+
+// 				flip = !flip
+// 			}
+
+// 			packets = append(packets, createPacket(net.ParseIP(out[0].Address), net.IP(rule.Keys[0].IP[:]), proto, port))
+// 			expectedResults = append(expectedResults, XDP_DROP)
+
+// 			var bogusDstIp net.IP = net.ParseIP("1.1.1.1").To4()
+
+// 			binary.LittleEndian.PutUint32(bogusDstIp, rand.Uint32())
+
+// 			if net.IP.Equal(bogusDstIp, net.IP(rule.Keys[0].IP[:])) {
+// 				continue
+// 			}
+
+// 			// Route miss packet
+// 			packets = append(packets, createPacket(net.ParseIP(out[0].Address), bogusDstIp, int(policy.Proto), int(policy.LowerPort)))
+// 			expectedResults = append(expectedResults, XDP_DROP)
+
+// 		}
+// 	}
+
+// 	for i := range packets {
+
+// 		packet := packets[i]
+
+// 		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
+// 		if err != nil {
+// 			t.Fatalf("program failed %s", err)
+// 		}
+
+// 		if value != expectedResults[i] {
+
+// 			var iphdr ipv4.Header
+// 			err := iphdr.Parse(packet)
+// 			if err != nil {
+// 				t.Fatal("packet didnt parse as an IP header: ", err)
+// 			}
+
+// 			packet = packet[20:]
+
+// 			var pkt pkthdr
+// 			pkt.pktType = "unknown"
+
+// 			switch iphdr.Protocol {
+// 			case routetypes.UDP:
+// 				pkt.UnpackUdp(packet)
+// 			case routetypes.TCP:
+// 				pkt.UnpackTcp(packet)
+// 			case routetypes.ICMP:
+// 				pkt.UnpackIcmp(packet)
+// 			case routetypes.ANY:
+// 				pkt.UnpackAny(packet)
+
+// 			}
+
+// 			info := iphdr.Src.String() + " -> " + iphdr.Dst.String() + ", proto " + pkt.String()
+
+// 			m, _ := GetRules()
+// 			t.Logf("%+v", m)
+// 			t.Fatalf("%s program did not %s packet instead did: %s", info, result(expectedResults[i]), result(value))
+// 		}
+// 	}
+
+// }
+
+// func TestAgnosticRuleOrdering(t *testing.T) {
+// 	if err := setup("../config/test_port_based_rules.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	var packets [][]byte
+
+// 	for _, user := range out {
+// 		acl := config.GetEffectiveAcl(user.Username)
+
+// 		rules, err := routetypes.ParseRules(acl.Mfa, acl.Allow, nil)
+// 		if err != nil {
+// 			t.Fatal(err)
+// 		}
+
+// 		// Populate expected
+// 		for _, rule := range rules {
+
+// 			for _, policy := range rule.Values {
+// 				if policy.Is(routetypes.STOP) {
+// 					break
+// 				}
+
+// 				// If we've got an any single port rule e.g 55/any, make sure that the proto is something that has ports otherwise the test fails
+// 				successProto := policy.Proto
+// 				if policy.Proto == routetypes.ANY && policy.LowerPort != routetypes.ANY {
+// 					successProto = routetypes.UDP
+// 				}
+
+// 				// Add matching/passing packet
+// 				packets = append(packets, createPacket(net.ParseIP(user.Address), net.IP(rule.Keys[0].IP[:]), int(successProto), int(policy.LowerPort)))
+// 			}
+// 		}
+
+// 	}
+// 	// We check that for both users, that they all pass. This effectively enables us to check that reordered rules are equal
+// 	for i := range packets {
+
+// 		packet := packets[i]
+
+// 		value, _, err := xdpObjects.bpfPrograms.XdpWagFirewall.Test(packet)
+// 		if err != nil {
+// 			t.Fatalf("program failed %s", err)
+// 		}
+
+// 		var iphdr ipv4.Header
+// 		err = iphdr.Parse(packet)
+// 		if err != nil {
+// 			t.Fatal("packet didnt parse as an IP header: ", err)
+// 		}
+// 		packet = packet[20:]
+
+// 		var pkt pkthdr
+// 		pkt.pktType = "unknown"
+
+// 		switch iphdr.Protocol {
+// 		case routetypes.UDP:
+// 			pkt.UnpackUdp(packet)
+// 		case routetypes.TCP:
+// 			pkt.UnpackTcp(packet)
+// 		case routetypes.ICMP:
+// 			pkt.UnpackIcmp(packet)
+// 		case routetypes.ANY:
+// 			pkt.UnpackAny(packet)
+
+// 		}
+// 		t.Log(iphdr.Src.String(), " -> ", iphdr.Dst.String(), ", proto "+pkt.String())
+
+// 		if value != XDP_PASS {
+
+// 			t.Fatalf("program did not XDP_PASS packet instead did: %s", result(value))
+// 		}
+// 	}
+// }
+
+// func TestLookupDifferentKeyTypesInMap(t *testing.T) {
+// 	if err := setup("../config/test_port_based_rules.json"); err != nil {
+// 		t.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	userPublicRoutes, err := getInnerMap(out[0].Username, xdpObjects.PoliciesTable)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	// Check negative case
+// 	err = userPublicRoutes.Lookup([]byte("3470239uy4skljhd"), nil)
+// 	if err == nil {
+// 		t.Fatal("searched garbage string, should not match")
+// 	}
+
+// 	/*
+// 	   "Allow": [
+// 	       "1.1.0.0/16",
+// 	       "2.2.2.2",
+// 	       "3.3.3.3 33/tcp",
+// 	       "4.4.4.4 43/udp",
+// 	       "5.5.5.5 55/any",
+// 	       "6.6.6.6 100-150/tcp"
+// 	   ]
+// 	*/
+
+// 	k := routetypes.Key{
+// 		IP:        [4]byte{1, 1, 1, 1},
+// 		Prefixlen: 32,
+// 	}
+
+// 	var policies [routetypes.MAX_POLICIES]routetypes.Policy
+// 	err = userPublicRoutes.Lookup(k.Bytes(), &policies)
+// 	if err != nil {
+// 		t.Fatal("searched for valid subnet: ", err)
+// 	}
+
+// 	if !policies[0].Is(routetypes.SINGLE) {
+// 		t.Fatal("the route type was not single: ", policies[0])
+// 	}
+
+// 	if policies[0].LowerPort != 0 || policies[0].Proto != 0 {
+// 		t.Fatal("policy was not marked as allow all despite having no rules defined")
+// 	}
+
+// 	if !policies[1].Is(routetypes.STOP) {
+// 		t.Fatal("policy should only contain one any/any rule")
+// 	}
+
+// 	k = routetypes.Key{
+// 		IP:        [4]byte{3, 3, 3, 3},
+// 		Prefixlen: 32,
+// 	}
+
+// 	err = userPublicRoutes.Lookup(k.Bytes(), &policies)
+// 	if err != nil {
+// 		t.Fatal("searched for ip failed")
+// 	}
+
+// 	if !policies[0].Is(routetypes.SINGLE) {
+// 		t.Fatal("the route type was not single")
+// 	}
+
+// 	if policies[0].LowerPort != 33 || policies[0].Proto != routetypes.TCP {
+// 		t.Fatal("policy had incorrect proto and port defintions")
+// 	}
+
+// 	if !policies[1].Is(routetypes.STOP) {
+// 		t.Fatal("policy should only contain one any/any rule")
+// 	}
+
+// }
+
+// func BenchmarkGeneralRun(b *testing.B) {
+
+// 	if err := setup("../config/test_port_based_rules.json"); err != nil {
+// 		b.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		b.Fatal(err)
+// 	}
+
+// 	packet := createPacket(net.ParseIP(out[0].Address), net.ParseIP("10.10.10.10"), routetypes.TCP, 8082)
+
+// 	b.ResetTimer()
+// 	_, duration, err := xdpObjects.bpfPrograms.XdpWagFirewall.Benchmark(packet, b.N, nil)
+// 	if err != nil {
+// 		b.Fatalf("program failed %s", err)
+// 	}
+
+// 	b.ReportMetric(float64(duration), "ns/op")
+
+// }
+
+// func BenchmarkGeneralDenyRun(b *testing.B) {
+
+// 	if err := setup("../config/test_port_based_rules.json"); err != nil {
+// 		b.Fatal(err)
+// 	}
+// 	defer xdpObjects.Close()
+
+// 	out, err := addDevices()
+// 	if err != nil {
+// 		b.Fatal(err)
+// 	}
+
+// 	packet := createPacket(net.ParseIP(out[0].Address), net.ParseIP("10.10.10.10"), routetypes.TCP, 9999)
+
+// 	b.ResetTimer()
+// 	_, duration, err := xdpObjects.bpfPrograms.XdpWagFirewall.Benchmark(packet, b.N, nil)
+// 	if err != nil {
+// 		b.Fatalf("program failed %s", err)
+// 	}
+
+// 	b.ReportMetric(float64(duration), "ns/op")
+
+// }
+
+// func getInnerMap(username string, m *ebpf.Map) (*ebpf.Map, error) {
+// 	var innerMapID ebpf.MapID
+// 	userid := sha1.Sum([]byte(username))
+
+// 	err := m.Lookup(userid, &innerMapID)
+// 	if err != nil {
+// 		return nil, err
+// 	}
+
+// 	innerMap, err := ebpf.NewMapFromID(innerMapID)
+// 	if err != nil {
+// 		return nil, fmt.Errorf("failed to get map from id: %s", err)
+// 	}
+
+// 	return innerMap, nil
+// }
+
+// func checkLPMMap(username string, m *ebpf.Map) ([]string, error) {
+
+// 	innerMap, err := getInnerMap(username, m)
+// 	if err != nil {
+// 		return nil, err
+// 	}
+
+// 	result := []string{}
+
+// 	var innerKey []byte
+// 	var val [routetypes.MAX_POLICIES]routetypes.Policy
+// 	innerIter := innerMap.Iterate()
+// 	kv := routetypes.Key{}
+// 	for innerIter.Next(&innerKey, &val) {
+// 		kv.Unpack(innerKey)
+
+// 		result = append(result, kv.String())
+// 	}
+
+// 	if innerIter.Err() != nil {
+// 		return nil, innerIter.Err()
+// 	}
+
+// 	return result, innerMap.Close()
+// }
+
+// func result(code uint32) string {
+// 	switch code {
+// 	case XDP_DROP:
+// 		return "XDP_DROP"
+// 	case XDP_PASS:
+// 		return "XDP_PASS"
+// 	default:
+// 		return fmt.Sprintf("XDP_UNKNOWN_UNUSED(%d)", code)
+// 	}
+// }
+
+// func addDevices() ([]data.Device, error) {
+
+// 	devices := []data.Device{
+// 		{
+// 			Address:   "192.168.1.2",
+// 			Publickey: "dc99y+fmhaHwFToSIw/1MSVXewbiyegBMwNGA6LG8yM=",
+// 			Username:  "tester",
+// 			Attempts:  0,
+// 		},
+// 		{
+// 			Address:   "192.168.1.3",
+// 			Publickey: "sXns6f8d6SMehnT6DQG8URCXnNCFe6ouxVmpJB7WeS0=",
+// 			Username:  "randomthingappliedtoall",
+// 			Attempts:  0,
+// 		},
+// 	}
+
+// 	for i := range devices {
+// 		_, err := data.CreateUserDataAccount(devices[i].Username)
+// 		if err != nil {
+// 			return nil, err
+// 		}
+
+// 		err = AddUser(devices[i].Username, config.GetEffectiveAcl(devices[i].Username))
+// 		if err != nil {
+// 			return nil, err
+// 		}
+
+// 		err = xdpAddDevice(devices[i].Username, devices[i].Address)
+// 		if err != nil {
+// 			return nil, err
+// 		}
+// 	}
+// 	return devices, nil
+// }
+
+// func setup(what string) error {
+// 	err := config.Load(what)
+// 	if err != nil && !strings.Contains(err.Error(), "Configuration has already been loaded") {
+// 		return err
+// 	}
+
+// 	err = data.Load(config.Values().DatabaseLocation)
+// 	if err != nil {
+// 		return err
+// 	}
+
+// 	return loadXDP()
+// }
diff --git a/internal/router/init.go b/internal/router/init.go
index fdb308d1..39b712b0 100644
--- a/internal/router/init.go
+++ b/internal/router/init.go
@@ -1,6 +1,7 @@
 package router
 
 import (
+	"errors"
 	"fmt"
 	"log"
 	"strings"
@@ -18,7 +19,12 @@ var lock sync.RWMutex
 
 func Setup(error chan<- error, iptables bool) (err error) {
 
-	err = setupWireguard()
+	initialUsers, knownDevices, err := data.GetInitialData()
+	if err != nil {
+		return errors.New("xdp setup get all users and devices: " + err.Error())
+	}
+
+	err = setupWireguard(knownDevices)
 	if err != nil {
 		return err
 	}
@@ -36,11 +42,13 @@ func Setup(error chan<- error, iptables bool) (err error) {
 		}
 	}()
 
-	err = setupXDP()
+	err = setupXDP(initialUsers, knownDevices)
 	if err != nil {
 		return err
 	}
 
+	handleEvents()
+
 	go func() {
 		startup := true
 		cache := map[string]string{}
diff --git a/internal/router/statemachine.go b/internal/router/statemachine.go
new file mode 100644
index 00000000..6e299608
--- /dev/null
+++ b/internal/router/statemachine.go
@@ -0,0 +1,135 @@
+package router
+
+import (
+	"log"
+
+	"github.com/NHAS/wag/internal/acls"
+	"github.com/NHAS/wag/internal/data"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+func handleEvents() {
+	data.RegisterAclsWatcher(aclsChanges)
+	data.RegisterClusterHealthWatcher(clusterState)
+	data.RegisterDeviceWatcher(deviceChanges)
+	data.RegisterGroupsWatcher(groupChanges)
+	data.RegisterUserWatcher(userChanges)
+}
+
+func deviceChanges(device data.BasicEvent[data.Device], state int) {
+	switch state {
+	case data.DELETED:
+		err := RemovePeer(device.CurrentValue.Publickey, device.CurrentValue.Address)
+		if err != nil {
+			log.Println("could not remove peer: ", err)
+		}
+
+	case data.CREATED:
+
+		key, _ := wgtypes.ParseKey(device.CurrentValue.Publickey)
+		err := AddPeer(key, device.CurrentValue.Username, device.CurrentValue.Address, device.CurrentValue.PresharedKey)
+		if err != nil {
+			log.Println("error creating peer: ", err)
+		}
+
+	case data.MODIFIED:
+		if device.CurrentValue.Publickey != device.Previous.Publickey {
+			key, _ := wgtypes.ParseKey(device.CurrentValue.Publickey)
+			err := ReplacePeer(device.Previous, key)
+			if err != nil {
+				log.Println(err)
+			}
+		}
+
+		if (device.CurrentValue.Attempts != device.Previous.Attempts && device.CurrentValue.Attempts > 5) ||
+			device.CurrentValue.Endpoint.String() != device.Previous.Endpoint.String() {
+			err := Deauthenticate(device.CurrentValue.Address)
+			if err != nil {
+				log.Println(err)
+			}
+		}
+
+	default:
+		panic("unknown state")
+	}
+}
+
+func userChanges(user data.BasicEvent[data.UserModel], state int) {
+	switch state {
+	case data.CREATED:
+		acls := data.GetEffectiveAcl(user.CurrentValue.Username)
+		err := AddUser(user.CurrentValue.Username, acls)
+		if err != nil {
+			log.Println(err)
+		}
+	case data.DELETED:
+		err := RemoveUser(user.CurrentValue.Username)
+		if err != nil {
+			log.Println(err)
+		}
+	case data.MODIFIED:
+
+		if user.CurrentValue.Locked != user.Previous.Locked {
+
+			lock := uint32(1)
+			if !user.CurrentValue.Locked {
+				lock = 0
+			}
+
+			err := SetLockAccount(user.CurrentValue.Username, lock)
+			if err != nil {
+				log.Println(err)
+			}
+		}
+
+		if user.CurrentValue.Mfa != user.Previous.Mfa || user.CurrentValue.MfaType != user.Previous.MfaType {
+			err := DeauthenticateAllDevices(user.CurrentValue.Username)
+			if err != nil {
+				log.Println(err)
+			}
+		}
+
+	}
+}
+
+func aclsChanges(aclChange data.TargettedEvent[acls.Acl], state int) {
+	switch state {
+	case data.CREATED, data.DELETED, data.MODIFIED:
+		err := RefreshConfiguration()
+		if err != nil {
+			log.Println(err)
+		}
+
+	}
+}
+
+func groupChanges(groupChange data.TargettedEvent[[]string], state int) {
+	switch state {
+	case data.CREATED, data.DELETED, data.MODIFIED:
+
+		for _, username := range groupChange.Value {
+			err := RefreshUserAcls(username)
+			if err != nil {
+				log.Println(err)
+			}
+		}
+
+	}
+}
+
+func clusterState(stateText string, state int) {
+	switch stateText {
+	case "dead":
+		TearDown()
+	case "healthy":
+		errors := make(chan error)
+		go func() {
+			<-errors
+			// TODO fix this
+		}()
+		err := Setup(errors, true)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+}
diff --git a/internal/router/wireguard.go b/internal/router/wireguard.go
index e586c2ca..55cd5eb5 100644
--- a/internal/router/wireguard.go
+++ b/internal/router/wireguard.go
@@ -1,12 +1,10 @@
 package router
 
 import (
-	"bytes"
 	"encoding/binary"
 	"errors"
 	"fmt"
 	"net"
-	"sort"
 	"time"
 	"unsafe"
 
@@ -15,8 +13,6 @@ import (
 	"github.com/mdlayher/netlink"
 	"golang.org/x/sys/unix"
 
-	"github.com/NHAS/wag/internal/utils"
-
 	"golang.zx2c4.com/wireguard/wgctrl"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
@@ -50,7 +46,7 @@ func (msg *IfAddrmsg) Serialize() []byte {
 	return (*(*[unix.SizeofIfAddrmsg]byte)(unsafe.Pointer(msg)))[:]
 }
 
-func setupWireguard() error {
+func setupWireguard(devices []data.Device) error {
 
 	var c wgtypes.Config
 
@@ -83,11 +79,6 @@ func setupWireguard() error {
 		c.ListenPort = &port
 	}
 
-	devices, err := data.GetAllDevices()
-	if err != nil {
-		return errors.New("setup wireguard get all devices: " + err.Error())
-	}
-
 	for _, device := range devices {
 		pk, _ := wgtypes.ParseKey(device.Publickey)
 		var psk *wgtypes.Key = nil
@@ -114,6 +105,7 @@ func setupWireguard() error {
 		c.Peers = append(c.Peers, pc)
 	}
 
+	var err error
 	ctrl, err = wgctrl.New()
 	if err != nil {
 		return fmt.Errorf("cannot start wireguard control %v", err)
@@ -149,6 +141,10 @@ func RemovePeer(publickey, address string) error {
 	lock.Lock()
 	defer lock.Unlock()
 
+	return _removePeer(publickey, address)
+}
+
+func _removePeer(publickey, address string) error {
 	pubkey, err := wgtypes.ParseKey(publickey)
 	if err != nil {
 		return err
@@ -172,6 +168,11 @@ func RemovePeer(publickey, address string) error {
 		return err1
 	}
 
+	user := addressesToUsers[address]
+	addr := usersToAddresses[user]
+	delete(addr, address)
+	usersToAddresses[user] = addr
+
 	return nil
 }
 
@@ -211,8 +212,16 @@ func ReplacePeer(device data.Device, newPublicKey wgtypes.Key) error {
 		},
 	}
 
-	return ctrl.ConfigureDevice(config.Values().Wireguard.DevName, c)
+	err = ctrl.ConfigureDevice(config.Values().Wireguard.DevName, c)
+	if err != nil {
+		return err
+	}
+
+	addresses := usersToAddresses[device.Username]
+	addresses[device.Address] = newPublicKey.String()
+	usersToAddresses[device.Username] = addresses
 
+	return nil
 }
 
 func ListPeers() ([]wgtypes.Peer, error) {
@@ -229,46 +238,19 @@ func ListPeers() ([]wgtypes.Peer, error) {
 }
 
 // AddPeer adds the device to wireguard
-func AddPeer(public wgtypes.Key, username string) (address string, psk string, err error) {
+func AddPeer(public wgtypes.Key, username, addresss, presharedKey string) (err error) {
 
 	lock.Lock()
 	defer lock.Unlock()
 
-	dev, err := ctrl.Device(config.Values().Wireguard.DevName)
-	if err != nil {
-		return "", "", err
-	}
-
-	preshared_key, err := wgtypes.GenerateKey()
-	if err != nil {
-		return "", "", err
-	}
-
-	//Poor selection algorithm
-	//If we dont have any peers take the server tun address and increment that
-	newAddress := net.ParseIP(config.Values().Wireguard.ServerAddress.String())
-	if len(dev.Peers) > 0 {
-		addresses := make([]net.IP, 0, len(dev.Peers))
-		for _, peer := range dev.Peers {
-			addresses = append(addresses, net.ParseIP(utils.GetIP(peer.AllowedIPs[0].IP.String())))
-		}
-
-		// Find the last added address
-		sort.Slice(addresses, func(i, j int) bool {
-			return bytes.Compare(addresses[i], addresses[j]) < 0
-		})
-
-		newAddress = addresses[len(addresses)-1]
-	}
-
-	newAddress, err = incrementIP(newAddress.String(), config.Values().Wireguard.Range.String())
+	preshared_key, err := wgtypes.ParseKey(presharedKey)
 	if err != nil {
-		return "", "", err
+		return err
 	}
 
-	_, network, err := net.ParseCIDR(newAddress.String() + "/32")
+	_, network, err := net.ParseCIDR(addresss + "/32")
 	if err != nil {
-		return "", "", err
+		return err
 	}
 
 	var c wgtypes.Config
@@ -281,13 +263,27 @@ func AddPeer(public wgtypes.Key, username string) (address string, psk string, e
 		},
 	}
 
-	err = xdpAddDevice(username, newAddress.String())
+	err = xdpAddDevice(username, addresss)
+	if err != nil {
+
+		return err
+	}
+
+	err = ctrl.ConfigureDevice(config.Values().Wireguard.DevName, c)
 	if err != nil {
+		return err
+	}
 
-		return "", "", err
+	addressesMap, ok := usersToAddresses[username]
+	if !ok {
+		addressesMap = make(map[string]string)
 	}
 
-	return newAddress.String(), preshared_key.String(), ctrl.ConfigureDevice(config.Values().Wireguard.DevName, c)
+	addressesMap[addresss] = public.String()
+	usersToAddresses[username] = addressesMap
+	addressesToUsers[addresss] = username
+
+	return nil
 }
 
 func GetPeerRealIp(address string) (string, error) {
@@ -305,24 +301,6 @@ func GetPeerRealIp(address string) (string, error) {
 	return "", errors.New("not found")
 }
 
-func incrementIP(origIP, cidr string) (net.IP, error) {
-	ip := net.ParseIP(origIP)
-	_, ipNet, err := net.ParseCIDR(cidr)
-	if err != nil {
-		return ip, err
-	}
-	for i := len(ip) - 1; i >= 0; i-- {
-		ip[i]++
-		if ip[i] != 0 {
-			break
-		}
-	}
-	if !ipNet.Contains(ip) {
-		return ip, fmt.Errorf("overflowed CIDR while incrementing IP (ip: %s range: %s)", ip.String(), ipNet.String())
-	}
-	return ip, nil
-}
-
 func addWg(c *netlink.Conn, name string, address net.IPNet, mtu int) error {
 
 	infomsg := IfInfomsg{
diff --git a/internal/router/wireguard_test.go b/internal/router/wireguard_test.go
index a3e809ff..03ac36a4 100644
--- a/internal/router/wireguard_test.go
+++ b/internal/router/wireguard_test.go
@@ -1,147 +1,134 @@
 package router
 
-import (
-	"fmt"
-	"net"
-	"testing"
-
-	"github.com/NHAS/wag/internal/acls"
-	"github.com/NHAS/wag/internal/config"
-	"github.com/NHAS/wag/internal/data"
-	"github.com/mdlayher/netlink"
-	"golang.org/x/sys/unix"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-func setupWgTest() error {
-	if err := config.Load("../config/test_in_memory_db.json"); err != nil {
-		return err
-	}
-
-	err := data.Load(config.Values().DatabaseLocation)
-	if err != nil {
-		return fmt.Errorf("cannot load database: %v", err)
-	}
-
-	err = setupWireguard()
-	if err != nil {
-		return fmt.Errorf("cannot setup wireguard: %v", err)
-	}
-
-	err = setupXDP()
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func TestWgLoadBasic(t *testing.T) {
-
-	err := setupWgTest()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	i, err := net.InterfaceByName(config.Values().Wireguard.DevName)
-	if err != nil {
-		t.Fatal("interface was not actually create despite setupWireguard not failing")
-	}
-
-	if i.MTU != config.Values().Wireguard.MTU {
-		t.Fatal("device settings are not correct (MTU)")
-	}
-
-	addrs, err := i.Addrs()
-	if err != nil {
-		t.Fatal("unable to get device addresses: ", err)
-	}
-
-	if len(addrs) != 1 {
-		t.Fatal("the device does not have the expected numer of ip addresses: ", len(addrs))
-	}
-
-	conn, err := netlink.Dial(unix.NETLINK_ROUTE, nil)
-	if err != nil {
-		t.Fatal("Unable to remove wireguard device, netlink connection failed: ", err.Error())
-	}
-	defer conn.Close()
-
-	err = delWg(conn, config.Values().Wireguard.DevName)
-	if err != nil {
-		t.Fatal("Unable to remove wireguard device, delete failed: ", err.Error())
-	}
-
-}
-
-func TestWgAddRemove(t *testing.T) {
-	err := setupWgTest()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	pk, err := wgtypes.GenerateKey()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = AddUser("toaster", acls.Acl{})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	address, _, err := AddPeer(pk, "toaster")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if address != "10.2.43.2" {
-		t.Fatal("address of added peer did not match expected: ", address)
-	}
-
-	dev, err := ctrl.Device(config.Values().Wireguard.DevName)
-	if err != nil {
-		t.Fatal("could not connect to wireguard device to check the details there")
-	}
-
-	if len(dev.Peers) != 1 {
-		t.Fatal("Added one device, didnt get 1 device back from the wg device")
-	}
-
-	if dev.Peers[0].PublicKey.String() != pk.String() {
-		t.Fatal("The peer added to the wg device did not have the correct pulic key")
-	}
-
-	if len(dev.Peers[0].AllowedIPs) != 1 {
-		t.Fatal("the peer did not have only 1 ip address")
-	}
-
-	if dev.Peers[0].AllowedIPs[0].IP.String() != "10.2.43.2" {
-		t.Fatal("the peer did have the same ip address as what was added: ", dev.Peers[0].AllowedIPs[0].IP.String())
-	}
-
-	err = RemovePeer(pk.String(), address)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	dev, err = ctrl.Device(config.Values().Wireguard.DevName)
-	if err != nil {
-		t.Fatal("could not connect to wireguard device to check the details there")
-	}
-
-	if len(dev.Peers) != 0 {
-		t.Fatal("Removed only device the wireguard device was not informed")
-	}
-
-	conn, err := netlink.Dial(unix.NETLINK_ROUTE, nil)
-	if err != nil {
-		t.Fatal("Unable to remove wireguard device, netlink connection failed: ", err.Error())
-	}
-	defer conn.Close()
-
-	err = delWg(conn, config.Values().Wireguard.DevName)
-	if err != nil {
-		t.Fatal("Unable to remove wireguard device, delete failed: ", err.Error())
-	}
-}
+// func setupWgTest() error {
+// 	if err := config.Load("../config/test_in_memory_db.json"); err != nil {
+// 		return err
+// 	}
+
+// 	err := data.Load(config.Values().DatabaseLocation)
+// 	if err != nil {
+// 		return fmt.Errorf("cannot load database: %v", err)
+// 	}
+
+// 	err = setupWireguard()
+// 	if err != nil {
+// 		return fmt.Errorf("cannot setup wireguard: %v", err)
+// 	}
+
+// 	err = setupXDP()
+// 	if err != nil {
+// 		return err
+// 	}
+
+// 	return nil
+// }
+
+// func TestWgLoadBasic(t *testing.T) {
+
+// 	err := setupWgTest()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	i, err := net.InterfaceByName(config.Values().Wireguard.DevName)
+// 	if err != nil {
+// 		t.Fatal("interface was not actually create despite setupWireguard not failing")
+// 	}
+
+// 	if i.MTU != config.Values().Wireguard.MTU {
+// 		t.Fatal("device settings are not correct (MTU)")
+// 	}
+
+// 	addrs, err := i.Addrs()
+// 	if err != nil {
+// 		t.Fatal("unable to get device addresses: ", err)
+// 	}
+
+// 	if len(addrs) != 1 {
+// 		t.Fatal("the device does not have the expected numer of ip addresses: ", len(addrs))
+// 	}
+
+// 	conn, err := netlink.Dial(unix.NETLINK_ROUTE, nil)
+// 	if err != nil {
+// 		t.Fatal("Unable to remove wireguard device, netlink connection failed: ", err.Error())
+// 	}
+// 	defer conn.Close()
+
+// 	err = delWg(conn, config.Values().Wireguard.DevName)
+// 	if err != nil {
+// 		t.Fatal("Unable to remove wireguard device, delete failed: ", err.Error())
+// 	}
+
+// }
+
+// func TestWgAddRemove(t *testing.T) {
+// 	err := setupWgTest()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	pk, err := wgtypes.GenerateKey()
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	err = AddUser("toaster", acls.Acl{})
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	address, _, err := AddPeer(pk, "toaster")
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	if address != "10.2.43.2" {
+// 		t.Fatal("address of added peer did not match expected: ", address)
+// 	}
+
+// 	dev, err := ctrl.Device(config.Values().Wireguard.DevName)
+// 	if err != nil {
+// 		t.Fatal("could not connect to wireguard device to check the details there")
+// 	}
+
+// 	if len(dev.Peers) != 1 {
+// 		t.Fatal("Added one device, didnt get 1 device back from the wg device")
+// 	}
+
+// 	if dev.Peers[0].PublicKey.String() != pk.String() {
+// 		t.Fatal("The peer added to the wg device did not have the correct pulic key")
+// 	}
+
+// 	if len(dev.Peers[0].AllowedIPs) != 1 {
+// 		t.Fatal("the peer did not have only 1 ip address")
+// 	}
+
+// 	if dev.Peers[0].AllowedIPs[0].IP.String() != "10.2.43.2" {
+// 		t.Fatal("the peer did have the same ip address as what was added: ", dev.Peers[0].AllowedIPs[0].IP.String())
+// 	}
+
+// 	err = RemovePeer(pk.String(), address)
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	dev, err = ctrl.Device(config.Values().Wireguard.DevName)
+// 	if err != nil {
+// 		t.Fatal("could not connect to wireguard device to check the details there")
+// 	}
+
+// 	if len(dev.Peers) != 0 {
+// 		t.Fatal("Removed only device the wireguard device was not informed")
+// 	}
+
+// 	conn, err := netlink.Dial(unix.NETLINK_ROUTE, nil)
+// 	if err != nil {
+// 		t.Fatal("Unable to remove wireguard device, netlink connection failed: ", err.Error())
+// 	}
+// 	defer conn.Close()
+
+// 	err = delWg(conn, config.Values().Wireguard.DevName)
+// 	if err != nil {
+// 		t.Fatal("Unable to remove wireguard device, delete failed: ", err.Error())
+// 	}
+// }
diff --git a/internal/users/user.go b/internal/users/user.go
index 7f424bfe..ebeed69f 100644
--- a/internal/users/user.go
+++ b/internal/users/user.go
@@ -7,7 +7,6 @@ import (
 
 	"github.com/NHAS/wag/internal/config"
 	"github.com/NHAS/wag/internal/data"
-	"github.com/NHAS/wag/internal/router"
 	"github.com/NHAS/wag/internal/webserver/authenticators"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
@@ -61,7 +60,7 @@ func (u *user) GetDevicePresharedKey(address string) (presharedKey string, err e
 
 func (u *user) AddDevice(publickey wgtypes.Key) (device data.Device, err error) {
 
-	return //data.AddDevice(u.Username, address, publickey.String(), psk)
+	return data.AddDevice(u.Username, publickey.String())
 }
 
 func (u *user) DeleteDevice(address string) (err error) {
@@ -146,13 +145,18 @@ func (u *user) Authenticate(device, mfaType string, authenticator authenticators
 		return fmt.Errorf("%s %s unable to reset number of mfa attempts: %s", u.Username, device, err)
 	}
 
+	err = data.AuthoriseDevice(u.Username, device)
+	if err != nil {
+		return fmt.Errorf("%s %s unable to reset number of mfa attempts: %s", u.Username, device, err)
+	}
+
 	// TODO gonna have to do an additional something here in order to send the statemachine a message we need to update the ebpf
 
 	return nil
 }
 
 func (u *user) Deauthenticate(device string) error {
-	return router.Deauthenticate(device)
+	return data.DeauthenticateDevice(device)
 }
 
 func (u *user) MFA() (string, error) {
diff --git a/internal/webserver/web.go b/internal/webserver/web.go
index d3c22485..da373ed6 100644
--- a/internal/webserver/web.go
+++ b/internal/webserver/web.go
@@ -450,7 +450,7 @@ func registerDevice(w http.ResponseWriter, r *http.Request) {
 		}()
 	}
 
-	acl := config.GetEffectiveAcl(username)
+	acl := data.GetEffectiveAcl(username)
 
 	wgPublicKey, wgPort, err := router.ServerDetails()
 	if err != nil {
@@ -644,7 +644,7 @@ func status(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	acl := config.GetEffectiveAcl(user.Username)
+	acl := data.GetEffectiveAcl(user.Username)
 
 	w.Header().Set("Content-Disposition", "attachment; filename=acl")
 	w.Header().Set("Content-Type", "application/json")