diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 149062a6b33..d421167c859 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -268,6 +268,7 @@
       sniproxy = 244;
       nzbget = 245;
       mosquitto = 246;
+      toxvpn = 247;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -506,6 +507,7 @@
       sniproxy = 244;
       nzbget = 245;
       mosquitto = 246;
+      #toxvpn = 247; # unused
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index be41b5ebcdd..487dc8a6d39 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -398,6 +398,7 @@
   ./services/networking/tftpd.nix
   ./services/networking/tlsdated.nix
   ./services/networking/tox-bootstrapd.nix
+  ./services/networking/toxvpn.nix
   ./services/networking/tvheadend.nix
   ./services/networking/unbound.nix
   ./services/networking/unifi.nix
diff --git a/nixos/modules/services/networking/toxvpn.nix b/nixos/modules/services/networking/toxvpn.nix
new file mode 100644
index 00000000000..8c7ad9b9164
--- /dev/null
+++ b/nixos/modules/services/networking/toxvpn.nix
@@ -0,0 +1,56 @@
+{ config, stdenv, pkgs, lib, ... }:
+
+with lib;
+
+{
+  options = {
+    services.toxvpn = {
+      enable = mkOption {
+        type        = types.bool;
+        default     = false;
+        description = "enable toxvpn running on startup";
+      };
+
+      localip = mkOption {
+        type        = types.string;
+        default     = "10.123.123.1";
+        description = "your ip on the vpn";
+      };
+
+      port = mkOption {
+        type        = types.int;
+        default     = 33445;
+        description = "udp port for toxcore, port-forward to help with connectivity if you run many nodes behind one NAT";
+      };
+    };
+  };
+
+  config = mkIf config.services.toxvpn.enable {
+    systemd.services.toxvpn = {
+      description = "toxvpn daemon";
+
+      requires = [ "network-online.target" ]; # consider replacing by NetworkManager-wait-online.service
+      wantedBy = [ "multi-user.target" ];
+
+      preStart = ''
+        mkdir -p /run/toxvpn || true
+        chown toxvpn /run/toxvpn
+      '';
+
+      serviceConfig = {
+        ExecStart = "${pkgs.toxvpn}/bin/toxvpn -i ${config.services.toxvpn.localip} -l /run/toxvpn/control -u toxvpn -p ${toString config.services.toxvpn.port}";
+        KillMode  = "process";
+        Restart   = "on-success";
+        Type      = "notify";
+      };
+    };
+
+    users.extraUsers = {
+      toxvpn = {
+        uid        = config.ids.uids.toxvpn;
+        home       = "/var/lib/toxvpn";
+        createHome = true;
+      };
+    };
+  };
+}
diff --git a/pkgs/tools/networking/toxvpn/default.nix b/pkgs/tools/networking/toxvpn/default.nix
new file mode 100644
index 00000000000..25d62ba04cc
--- /dev/null
+++ b/pkgs/tools/networking/toxvpn/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, libtoxcore, cmake, jsoncpp, lib, stdenvAdapters, libsodium, systemd, enableDebugging, libcap }:
+
+with lib;
+
+let
+  libtoxcoreLocked = stdenv.lib.overrideDerivation libtoxcore (oldAttrs: {
+    name = "libtoxcore-20151110";
+    src = fetchFromGitHub {
+      owner  = "irungentoo";
+      repo   = "toxcore";
+      rev    = "22634a4b93dda5b17cb357cd84ac46fcfdc22519";
+      sha256 = "01i92wm5lg2p7k71qn23sfh01xi8acdrwn23rk52n54h424l1fgy";
+    };
+  });
+
+in stdenv.mkDerivation {
+  name = "toxvpn-20151111";
+
+  src = fetchFromGitHub {
+    owner  = "cleverca22";
+    repo   = "toxvpn";
+    rev    = "1d06bb7da277d46abb8595cf152210c4ccf0ba7d";
+    sha256 = "1himrbdgsbkfha1d87ysj2hwyz4a6z9yxqbai286imkya84q7r15";
+  };
+
+  buildInputs = [ cmake libtoxcoreLocked jsoncpp libsodium systemd libcap ];
+
+  cmakeFlags = [ "-DSYSTEMD=1" ];
+
+  meta = {
+    description = "A powerful tool that allows one to make tunneled point to point connections over Tox";
+    homepage    = https://github.com/cleverca22/toxvpn;
+    license     = licenses.gpl3;
+    platforms   = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 809ab4a54f7..f721fdfdf88 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3545,6 +3545,8 @@ in
 
   torsocks = callPackage ../tools/security/tor/torsocks.nix { };
 
+  toxvpn = callPackage ../tools/networking/toxvpn { };
+
   tpmmanager = callPackage ../applications/misc/tpmmanager { };
 
   tpm-quote-tools = callPackage ../tools/security/tpm-quote-tools { };