diff --git a/EduNetworkBuilder/NetworkCard.cs b/EduNetworkBuilder/NetworkCard.cs
index 639d616..1df909b 100644
--- a/EduNetworkBuilder/NetworkCard.cs
+++ b/EduNetworkBuilder/NetworkCard.cs
@@ -379,6 +379,8 @@ namespace EduNetworkBuilder
             NetworkLink nl;
             if (NB.GetComponentType(tPacket.WhereAmI) != GeneralComponentType.device) return false;  //we cannot do this.
             NetworkDevice WhereFrom = (NetworkDevice)tPacket.WhereAmI;
+            if (WhereFrom.hostname == "wrouter0" && tPacket.MyType == PacketType.ping_answer)
+                Console.WriteLine("wearehere");
             NicType what = GetNicType;
             if (!tPacket.isFresh && WhereFrom.IsWirelessForwarder() && what == NicType.wlan)
                 what = NicType.wport;
@@ -497,7 +499,7 @@ namespace EduNetworkBuilder
                 case NicType.vpn:
                     foreach (NetworkInterface nf in interfaces.ToList())
                     {
-                        if (nf.isLocal(tPacket.OutboundIP))
+                        if (nf.isLocal(tPacket.OutboundIP, false))
                         {
                             //We need to tell the original packet that it is inside another packet
                             tPacket.MyStatus = PacketStatus.encapsulated;
@@ -519,6 +521,29 @@ namespace EduNetworkBuilder
                     if (tPacket.InboundNic == this) 
                         break; //This is the port we came in on.  Do not sent it back out this port
                     nPacket = new Packet(tPacket);
+                    if((tPacket.InboundNic != null && tPacket.InboundNic.GetNicType == NicType.wan) || tPacket.InboundNic == null) 
+                    {
+                        //We need to find destination MAC and set source MAC
+                        nPacket.sourceMAC = MAC;
+                        //Update the MAC
+                        nPacket.destMAC = WhereFrom.LookupArpFromIP(tPacket.OutboundIP.GetIPString);
+                        if (nPacket.MyType == PacketType.arp_request)
+                        {
+                            nPacket.destMAC = NB.BroadcastMACString;
+                        }
+
+                        if (nPacket.destMAC == "")
+                        {
+                            nPacket.AddMessage(DebugLevel.debug, "  No Machine matching that IP address on this subnet. " + nPacket.destIP.GetIPString);
+                            Network mynet = NB.GetNetwork();
+                            NetworkDevice nd = mynet.GetDeviceFromID(myID);
+                            string hostname = "No Host";
+                            if (nd != null) hostname = nd.hostname;
+                            nPacket.Tracking.Status = hostname + "  No Machine matching that IP address on this subnet.  " + nPacket.destIP.GetIPString;
+                            nPacket.MyStatus = PacketStatus.finished_failed;
+                            return false;
+                        }
+                    }
                     if (HasBroadcastAddresses(tPacket.destIP))
                     {
                         //Broadcast packets will go to everything and we want a response from all of them.
diff --git a/EduNetworkBuilder/NetworkDevice.cs b/EduNetworkBuilder/NetworkDevice.cs
index 7a396cd..ecca5bd 100644
--- a/EduNetworkBuilder/NetworkDevice.cs
+++ b/EduNetworkBuilder/NetworkDevice.cs
@@ -120,6 +120,9 @@ namespace EduNetworkBuilder
                         tnic = new NetworkCard(NICs.Count(), GetUniqueIdentifier, hostname, NicType.wport); //Add a wireless port
                         NICs.Add(tnic);
                     }
+                    //Add one vpn port
+                    tnic = new NetworkCard(0, GetUniqueIdentifier, hostname, NicType.vpn);
+                    NICs.Insert(1, tnic); //Make this first in the list - becomes second
                     //Add one wan port
                     tnic = new NetworkCard(0, GetUniqueIdentifier, hostname, NicType.wan);
                     NICs.Insert(1, tnic); //Make this first in the list
@@ -1115,6 +1118,12 @@ namespace EduNetworkBuilder
 
         public void TunnelPacketFromHere(IPAddress Destination, Packet Payload, string Encryption = "")
         {
+            if(Destination == null)
+            {
+                Payload.MyStatus = PacketStatus.finished_failed;
+                Payload.Tracking.AddMessage(DebugLevel.info, hostname, "Packet sent out tunnel but no endpoint set.  Dropping");
+                return;
+            }
             PacketType TunType = PacketType.tun_packet;
             if (Encryption != "") 
                 TunType = PacketType.vpn_packet;
@@ -1305,6 +1314,7 @@ namespace EduNetworkBuilder
             //     Store the nic on the packet, store the interface on the packet
             //     Resume processing at the nic level, not the device level when the arp comes back
             int count = 0;
+            bool PacketSentOutWAN = false;
             foreach(NetworkCard nic in NICs)
             {
                 switch(nic.GetNicType)
@@ -1334,6 +1344,8 @@ namespace EduNetworkBuilder
                             if(nic.SendPacketOutNIC(tPacket))
                             {
                                 count++;
+                                if (nic.GetNicType == NicType.wan)
+                                    PacketSentOutWAN = true;
                             }
                             tPacket.destMAC = tMAC;
                             tPacket.OutboundDestMAC = ttMAC;
@@ -1341,7 +1353,11 @@ namespace EduNetworkBuilder
                         break;
                     case NicType.port:
                     case NicType.wport:
+                        if (PacketSentOutWAN)
+                            continue; //do not send packets out of ports if they have been sent out a WAN nic
                         NetworkCard tdNic = dNic;
+                        if (hostname == "wrouter0" && tPacket.MyType == PacketType.ping_answer)
+                            Console.WriteLine("wearehere");
                         if (myType == NetworkComponentType.wrouter)
                         {
                             //On wRouters, the wPorts are hubs, but the ports are switches
@@ -1355,7 +1371,7 @@ namespace EduNetworkBuilder
                             if (nic.GetNicType == NicType.wport)
                                 tdNic = null; //Hubs/WAPs never know the dnic.  They still need the sNic, however
                         }
-                        if (!ExactMatch && !MacAddressMatch)
+                        if (!ExactMatch && (!MacAddressMatch || ForwardsPackets()))
                         {
                             //If the packet does not terminate here, and we are not routing it to here...
                             //Pass it to the port.  The port duplicates it and sends it out
diff --git a/EduNetworkBuilder/NetworkInterface.cs b/EduNetworkBuilder/NetworkInterface.cs
index 0022461..71ecc19 100644
--- a/EduNetworkBuilder/NetworkInterface.cs
+++ b/EduNetworkBuilder/NetworkInterface.cs
@@ -84,9 +84,11 @@ namespace EduNetworkBuilder
             IPAddressEntry ipe = new IPAddressEntry(myIP,ND);
             ipe.ShowDialog();
         }
-        public bool isLocal(IPAddress tIp)
+        public bool isLocal(IPAddress tIp, bool AllowZeroMatch = true)
         {
             if (tIp == null) return false;
+            if (!AllowZeroMatch && (myIP == null || myIP.GetIP == 0))
+                return false;
             if (myIP.IsLocal(tIp))
                 return true;
             return false;
diff --git a/EduNetworkBuilder/Packet.cs b/EduNetworkBuilder/Packet.cs
index ecc3393..c6fcab4 100644
--- a/EduNetworkBuilder/Packet.cs
+++ b/EduNetworkBuilder/Packet.cs
@@ -145,6 +145,7 @@ namespace EduNetworkBuilder
             WhereAmI = start;
             payloadData = payload;
             MyType = theType;
+            
             if (theType != PacketType.arp_answer && theType != PacketType.arp_request)
             {
                 sourceIP = new IPAddress(NB.ZeroIPString);