diff --git a/src/tun.h b/src/tun.h
index d390f4da..516ce76d 100644
--- a/src/tun.h
+++ b/src/tun.h
@@ -32,8 +32,4 @@ struct tun_lease_st {
 	int fd;
 };
 
-ssize_t tun_write(int sockfd, const void *buf, size_t len);
-ssize_t tun_read(int sockfd, void *buf, size_t len);
-int tun_claim(int sockfd);
-
 #endif
diff --git a/src/worker-auth.c b/src/worker-auth.c
index c2f1d764..cfaf3384 100644
--- a/src/worker-auth.c
+++ b/src/worker-auth.c
@@ -39,6 +39,7 @@
 #include <vpn.h>
 #include "html.h"
 #include <worker.h>
+#include <worker-tun.h>
 #include <common.h>
 #include <tlslib.h>
 
diff --git a/src/worker-tun.c b/src/worker-tun.c
index e72e63fd..43ac4df6 100644
--- a/src/worker-tun.c
+++ b/src/worker-tun.c
@@ -49,23 +49,11 @@
 #include <ccan/list/list.h>
 #include "vhost.h"
 #include "log.h"
-
-#if defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)
-#include <net/if_var.h>
-#include <netinet/in_var.h>
-#endif
-#if defined(__OpenBSD__)
-#include <netinet6/in6_var.h>
-#endif
-#if defined(__DragonFly__)
-#include <net/tun/if_tun.h>
-#endif
-
-#if defined(__OpenBSD__) || defined(TUNSIFHEAD)
-#define TUN_AF_PREFIX 1
-#endif
+#include "worker-tun.h"
 
 #ifdef TUN_AF_PREFIX
+/* BSD-specific code, in linux tun_write and tun_read are
+ * just write and read. */
 ssize_t tun_write(int sockfd, const void *buf, size_t len)
 {
 	uint32_t head;
@@ -117,32 +105,4 @@ ssize_t tun_read(int sockfd, void *buf, size_t len)
 		ret -= sizeof(uint32_t);
 	return ret;
 }
-
-#else
-ssize_t tun_write(int sockfd, const void *buf, size_t len)
-{
-	return write(sockfd, buf, len);
-}
-
-ssize_t tun_read(int sockfd, void *buf, size_t len)
-{
-	return read(sockfd, buf, len);
-}
 #endif
-
-#ifndef __FreeBSD__
-int tun_claim(int sockfd)
-{
-	return 0;
-}
-#else
-/*
- * FreeBSD has a mechanism by which a tunnel has a single controlling process,
- * and only that one process may close it.  When the controlling process closes
- * the tunnel, the state is torn down.
- */
-int tun_claim(int sockfd)
-{
-	return ioctl(sockfd, TUNSIFPID, 0);
-}
-#endif /* !__FreeBSD__ */
diff --git a/src/worker-tun.h b/src/worker-tun.h
new file mode 100644
index 00000000..1978a61e
--- /dev/null
+++ b/src/worker-tun.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2026 Nikos Mavrogiannopoulos
+ *
+ * This file is part of ocserv.
+ *
+ * ocserv is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>
+ */
+#ifndef OC_WORKER_TUN_H
+#define OC_WORKER_TUN_H
+
+#if defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)
+#include <net/if_var.h>
+#include <netinet/in_var.h>
+#endif
+#if defined(__OpenBSD__)
+#include <netinet6/in6_var.h>
+#endif
+#if defined(__DragonFly__)
+#include <net/tun/if_tun.h>
+#endif
+
+#if defined(__OpenBSD__) || defined(TUNSIFHEAD)
+#define TUN_AF_PREFIX 1
+#endif
+
+#ifdef TUN_AF_PREFIX
+ssize_t tun_write(int sockfd, const void *buf, size_t len);
+ssize_t tun_read(int sockfd, void *buf, size_t len);
+#else
+#define tun_write write
+#define tun_read read
+#endif
+
+#ifndef __FreeBSD__
+#define tun_claim(sockfd) 0
+#else
+/*
+ * FreeBSD has a mechanism by which a tunnel has a single controlling process,
+ * and only that one process may close it.  When the controlling process closes
+ * the tunnel, the state is torn down.
+ */
+static int tun_claim(int sockfd)
+{
+	return ioctl(sockfd, TUNSIFPID, 0);
+}
+#endif /* !__FreeBSD__ */
+
+#endif
diff --git a/src/worker-vpn.c b/src/worker-vpn.c
index 6d182c95..879b9d37 100644
--- a/src/worker-vpn.c
+++ b/src/worker-vpn.c
@@ -63,6 +63,7 @@ static inline void worker_exit(int status)
 #include <poll.h>
 #include <math.h>
 #include <ev.h>
+#include "worker-tun.h"
 
 #if defined(__linux__) && !defined(IPV6_PATHMTU)
 #define IPV6_PATHMTU 61