diff --git a/Cargo.lock b/Cargo.lock
index 9d92325..9eb8a02 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -163,7 +163,7 @@ dependencies = [
 
 [[package]]
 name = "client"
-version = "1.5.1"
+version = "1.5.2"
 dependencies = [
  "anyhow",
  "colored",
@@ -973,7 +973,7 @@ dependencies = [
 
 [[package]]
 name = "server"
-version = "1.5.1"
+version = "1.5.2"
 dependencies = [
  "anyhow",
  "bytes",
@@ -1006,7 +1006,7 @@ dependencies = [
 
 [[package]]
 name = "shared"
-version = "1.5.1"
+version = "1.5.2"
 dependencies = [
  "anyhow",
  "atty",
@@ -1389,7 +1389,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "wireguard-control"
-version = "1.5.1"
+version = "1.5.2"
 dependencies = [
  "base64",
  "curve25519-dalek",
@@ -1401,7 +1401,7 @@ dependencies = [
 
 [[package]]
 name = "wireguard-control-sys"
-version = "1.5.1"
+version = "1.5.2"
 dependencies = [
  "bindgen",
  "cc",
diff --git a/README.md b/README.md
index f02447f..54a4838 100644
--- a/README.md
+++ b/README.md
@@ -214,10 +214,10 @@ brew install tonarino/innernet/innernet
 
 ```sh
 # to install innernet:
-cargo install --git https://github.com/tonarino/innernet --tag v1.5.1 client
+cargo install --git https://github.com/tonarino/innernet --tag v1.5.2 client
 
 # to install innernet-server:
-cargo install --git https://github.com/tonarino/innernet --tag v1.5.1 server
+cargo install --git https://github.com/tonarino/innernet --tag v1.5.2 server
 ```
 
 Note that you'll be responsible for updating manually.
diff --git a/client/Cargo.toml b/client/Cargo.toml
index e572805..6e733aa 100644
--- a/client/Cargo.toml
+++ b/client/Cargo.toml
@@ -7,7 +7,7 @@ license = "MIT"
 name = "client"
 publish = false
 repository = "https://github.com/tonarino/innernet"
-version = "1.5.1"
+version = "1.5.2"
 
 [[bin]]
 name = "innernet"
diff --git a/doc/innernet-server.8 b/doc/innernet-server.8
index c1ba262..fa7f94c 100644
--- a/doc/innernet-server.8
+++ b/doc/innernet-server.8
@@ -1,25 +1,32 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.48.5.
-.TH INNERNET-SERVER "8" "November 2021" "innernet-server 1.5.1" "System Administration Utilities"
+.TH INNERNET-SERVER "8" "December 2021" "innernet-server 1.5.2" "System Administration Utilities"
 .SH NAME
-innernet-server \- manual page for innernet-server 1.5.1
+innernet-server \- manual page for innernet-server 1.5.2
 .SH DESCRIPTION
-innernet\-server 1.5.1
+innernet\-server 1.5.2
 A server to coordinate innernet networks.
 .SS "USAGE:"
 .IP
 innernet\-server [OPTIONS] <SUBCOMMAND>
 .SS "OPTIONS:"
 .TP
+\fB\-c\fR, \fB\-\-config\-dir\fR <config\-dir>
+[default: /etc/innernet\-server]
+.TP
+\fB\-d\fR, \fB\-\-data\-dir\fR <data\-dir>
+[default: /var/lib/innernet\-server]
+.TP
 \fB\-\-no\-routing\fR
-Whether the routing should be done by innernet or is done by an external tool like e.g.
-babeld
+Whether the routing should be done by innernet or is done by an external tool like
+e.g. babeld
 .TP
 \fB\-\-backend\fR <backend>
 Specify a WireGuard backend to use. If not set, innernet will auto\-select based on
 availability [default: kernel]  [possible values: kernel, userspace]
 .TP
 \fB\-\-mtu\fR <mtu>
-Specify the desired MTU for your interface (default: 1420 for IPv4 and 1400 for IPv6)
+Specify the desired MTU for your interface (default: 1420 for IPv4 and 1400 for
+IPv6)
 .TP
 \fB\-h\fR, \fB\-\-help\fR
 Prints help information
diff --git a/doc/innernet-server.8.gz b/doc/innernet-server.8.gz
index 8a9c152..2435d6e 100644
Binary files a/doc/innernet-server.8.gz and b/doc/innernet-server.8.gz differ
diff --git a/doc/innernet-server.completions.bash b/doc/innernet-server.completions.bash
index 205f78c..013f716 100644
--- a/doc/innernet-server.completions.bash
+++ b/doc/innernet-server.completions.bash
@@ -50,13 +50,29 @@ _innernet-server() {
 
     case "${cmd}" in
         innernet-server)
-            opts=" -h -V  --no-routing --help --version --backend --mtu   new uninstall serve add-peer rename-peer add-cidr delete-cidr completions help  init"
+            opts=" -h -V -c -d  --no-routing --help --version --config-dir --data-dir --backend --mtu   new uninstall serve add-peer rename-peer add-cidr delete-cidr completions help  init"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 1 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
             fi
             case "${prev}" in
                 
+                --config-dir)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                    -c)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --data-dir)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                    -d)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
                 --backend)
                     COMPREPLY=($(compgen -W "kernel userspace" -- "${cur}"))
                     return 0
diff --git a/doc/innernet-server.completions.elvish b/doc/innernet-server.completions.elvish
index cdbfbff..f1bdbde 100644
--- a/doc/innernet-server.completions.elvish
+++ b/doc/innernet-server.completions.elvish
@@ -15,6 +15,10 @@ edit:completion:arg-completer[innernet-server] = [@words]{
     }
     completions = [
         &'innernet-server'= {
+            cand -c 'c'
+            cand --config-dir 'config-dir'
+            cand -d 'd'
+            cand --data-dir 'data-dir'
             cand --backend 'Specify a WireGuard backend to use. If not set, innernet will auto-select based on availability'
             cand --mtu 'Specify the desired MTU for your interface (default: 1420 for IPv4 and 1400 for IPv6)'
             cand --no-routing 'Whether the routing should be done by innernet or is done by an external tool like e.g. babeld'
diff --git a/doc/innernet-server.completions.fish b/doc/innernet-server.completions.fish
index 2335d79..6a9b319 100644
--- a/doc/innernet-server.completions.fish
+++ b/doc/innernet-server.completions.fish
@@ -1,3 +1,5 @@
+complete -c innernet-server -n "__fish_use_subcommand" -s c -l config-dir
+complete -c innernet-server -n "__fish_use_subcommand" -s d -l data-dir
 complete -c innernet-server -n "__fish_use_subcommand" -l backend -d 'Specify a WireGuard backend to use. If not set, innernet will auto-select based on availability' -r -f -a "kernel userspace"
 complete -c innernet-server -n "__fish_use_subcommand" -l mtu -d 'Specify the desired MTU for your interface (default: 1420 for IPv4 and 1400 for IPv6)'
 complete -c innernet-server -n "__fish_use_subcommand" -l no-routing -d 'Whether the routing should be done by innernet or is done by an external tool like e.g. babeld'
diff --git a/doc/innernet-server.completions.powershell b/doc/innernet-server.completions.powershell
index 22744f0..81d2075 100644
--- a/doc/innernet-server.completions.powershell
+++ b/doc/innernet-server.completions.powershell
@@ -20,6 +20,10 @@ Register-ArgumentCompleter -Native -CommandName 'innernet-server' -ScriptBlock {
 
     $completions = @(switch ($command) {
         'innernet-server' {
+            [CompletionResult]::new('-c', 'c', [CompletionResultType]::ParameterName, 'c')
+            [CompletionResult]::new('--config-dir', 'config-dir', [CompletionResultType]::ParameterName, 'config-dir')
+            [CompletionResult]::new('-d', 'd', [CompletionResultType]::ParameterName, 'd')
+            [CompletionResult]::new('--data-dir', 'data-dir', [CompletionResultType]::ParameterName, 'data-dir')
             [CompletionResult]::new('--backend', 'backend', [CompletionResultType]::ParameterName, 'Specify a WireGuard backend to use. If not set, innernet will auto-select based on availability')
             [CompletionResult]::new('--mtu', 'mtu', [CompletionResultType]::ParameterName, 'Specify the desired MTU for your interface (default: 1420 for IPv4 and 1400 for IPv6)')
             [CompletionResult]::new('--no-routing', 'no-routing', [CompletionResultType]::ParameterName, 'Whether the routing should be done by innernet or is done by an external tool like e.g. babeld')
diff --git a/doc/innernet-server.completions.zsh b/doc/innernet-server.completions.zsh
index d3f417e..0877f43 100644
--- a/doc/innernet-server.completions.zsh
+++ b/doc/innernet-server.completions.zsh
@@ -15,6 +15,10 @@ _innernet-server() {
 
     local context curcontext="$curcontext" state line
     _arguments "${_arguments_options[@]}" \
+'-c+[]' \
+'--config-dir=[]' \
+'-d+[]' \
+'--data-dir=[]' \
 '--backend=[Specify a WireGuard backend to use. If not set, innernet will auto-select based on availability]: :(kernel userspace)' \
 '--mtu=[Specify the desired MTU for your interface (default: 1420 for IPv4 and 1400 for IPv6)]' \
 '--no-routing[Whether the routing should be done by innernet or is done by an external tool like e.g. babeld]' \
diff --git a/doc/innernet.8 b/doc/innernet.8
index e7d0b07..82039dc 100644
--- a/doc/innernet.8
+++ b/doc/innernet.8
@@ -1,9 +1,9 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.48.5.
-.TH INNERNET "8" "November 2021" "innernet 1.5.1" "System Administration Utilities"
+.TH INNERNET "8" "December 2021" "innernet 1.5.2" "System Administration Utilities"
 .SH NAME
-innernet \- manual page for innernet 1.5.1
+innernet \- manual page for innernet 1.5.2
 .SH DESCRIPTION
-innernet 1.5.1
+innernet 1.5.2
 A client to manage innernet network interfaces.
 .SS "USAGE:"
 .IP
@@ -14,6 +14,14 @@ innernet [OPTIONS] [SUBCOMMAND]
 .IP
 Verbose output, use \fB\-vv\fR for even higher verbositude
 .HP
+\fB\-c\fR, \fB\-\-config\-dir\fR <config\-dir>
+.IP
+[default: /etc/innernet]
+.HP
+\fB\-d\fR, \fB\-\-data\-dir\fR <data\-dir>
+.IP
+[default: /var/lib/innernet]
+.HP
 \fB\-\-no\-routing\fR
 .IP
 Whether the routing should be done by innernet or is done by an external tool like e.g. babeld
diff --git a/doc/innernet.8.gz b/doc/innernet.8.gz
index 68af196..c9dfec0 100644
Binary files a/doc/innernet.8.gz and b/doc/innernet.8.gz differ
diff --git a/doc/innernet.completions.bash b/doc/innernet.completions.bash
index dae137f..d4149d0 100644
--- a/doc/innernet.completions.bash
+++ b/doc/innernet.completions.bash
@@ -86,13 +86,29 @@ _innernet() {
 
     case "${cmd}" in
         innernet)
-            opts=" -v -h -V  --verbose --no-routing --help --version --backend --mtu   install show up fetch uninstall down add-peer rename-peer add-cidr delete-cidr list-cidrs disable-peer enable-peer add-association delete-association list-associations set-listen-port override-endpoint completions help  redeem  list"
+            opts=" -v -h -V -c -d  --verbose --no-routing --help --version --config-dir --data-dir --backend --mtu   install show up fetch uninstall down add-peer rename-peer add-cidr delete-cidr list-cidrs disable-peer enable-peer add-association delete-association list-associations set-listen-port override-endpoint completions help  redeem  list"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 1 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
             fi
             case "${prev}" in
                 
+                --config-dir)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                    -c)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --data-dir)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                    -d)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
                 --backend)
                     COMPREPLY=($(compgen -W "kernel userspace" -- "${cur}"))
                     return 0
@@ -285,7 +301,7 @@ _innernet() {
             return 0
             ;;
         innernet__fetch)
-            opts=" -h -V  --no-write-hosts --help --version --hosts-path  <interface> "
+            opts=" -h -V  --no-write-hosts --no-nat-traversal --no-nat-candidates --help --version --hosts-path --exclude-nat-candidates  <interface> "
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -296,6 +312,10 @@ _innernet() {
                     COMPREPLY=($(compgen -f "${cur}"))
                     return 0
                     ;;
+                --exclude-nat-candidates)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
                 *)
                     COMPREPLY=()
                     ;;
@@ -319,7 +339,7 @@ _innernet() {
             return 0
             ;;
         innernet__install)
-            opts=" -d -h -V  --no-write-hosts --default-name --delete-invite --help --version --hosts-path --name  <invite> "
+            opts=" -d -h -V  --no-write-hosts --default-name --delete-invite --no-nat-traversal --no-nat-candidates --help --version --hosts-path --name --exclude-nat-candidates  <invite> "
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -334,6 +354,10 @@ _innernet() {
                     COMPREPLY=($(compgen -f "${cur}"))
                     return 0
                     ;;
+                --exclude-nat-candidates)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
                 *)
                     COMPREPLY=()
                     ;;
@@ -387,13 +411,21 @@ _innernet() {
             return 0
             ;;
         innernet__override__endpoint)
-            opts=" -u -h -V  --unset --help --version  <interface> "
+            opts=" -u -h -V -e  --unset --yes --help --version --endpoint  <interface> "
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
             fi
             case "${prev}" in
                 
+                --endpoint)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                    -e)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
                 *)
                     COMPREPLY=()
                     ;;
@@ -402,7 +434,7 @@ _innernet() {
             return 0
             ;;
         innernet__redeem)
-            opts=" -d -h -V  --no-write-hosts --default-name --delete-invite --help --version --hosts-path --name  <invite> "
+            opts=" -d -h -V  --no-write-hosts --default-name --delete-invite --no-nat-traversal --no-nat-candidates --help --version --hosts-path --name --exclude-nat-candidates  <invite> "
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -417,6 +449,10 @@ _innernet() {
                     COMPREPLY=($(compgen -f "${cur}"))
                     return 0
                     ;;
+                --exclude-nat-candidates)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
                 *)
                     COMPREPLY=()
                     ;;
@@ -448,13 +484,21 @@ _innernet() {
             return 0
             ;;
         innernet__set__listen__port)
-            opts=" -u -h -V  --unset --help --version  <interface> "
+            opts=" -u -h -V -l  --unset --yes --help --version --listen-port  <interface> "
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
             fi
             case "${prev}" in
                 
+                --listen-port)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                    -l)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
                 *)
                     COMPREPLY=()
                     ;;
@@ -493,7 +537,7 @@ _innernet() {
             return 0
             ;;
         innernet__up)
-            opts=" -d -h -V  --daemon --no-write-hosts --help --version --interval --hosts-path  <interface> "
+            opts=" -d -h -V  --daemon --no-write-hosts --no-nat-traversal --no-nat-candidates --help --version --interval --hosts-path --exclude-nat-candidates  <interface> "
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -508,6 +552,10 @@ _innernet() {
                     COMPREPLY=($(compgen -f "${cur}"))
                     return 0
                     ;;
+                --exclude-nat-candidates)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
                 *)
                     COMPREPLY=()
                     ;;
diff --git a/doc/innernet.completions.elvish b/doc/innernet.completions.elvish
index e987e20..5d5d9df 100644
--- a/doc/innernet.completions.elvish
+++ b/doc/innernet.completions.elvish
@@ -15,6 +15,10 @@ edit:completion:arg-completer[innernet] = [@words]{
     }
     completions = [
         &'innernet'= {
+            cand -c 'c'
+            cand --config-dir 'config-dir'
+            cand -d 'd'
+            cand --data-dir 'data-dir'
             cand --backend 'Specify a WireGuard backend to use. If not set, innernet will auto-select based on availability'
             cand --mtu 'Specify the desired MTU for your interface (default: 1420 for IPv4 and 1400 for IPv6)'
             cand -v 'Verbose output, use -vv for even higher verbositude'
@@ -48,10 +52,13 @@ edit:completion:arg-completer[innernet] = [@words]{
         &'innernet;install'= {
             cand --hosts-path 'The path to write hosts to'
             cand --name 'Set a specific interface name'
+            cand --exclude-nat-candidates 'Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates ''0.0.0.0/0'' would report no candidates'
             cand --no-write-hosts 'Don''t write to any hosts files'
             cand --default-name 'Use the network name inside the invitation as the interface name'
             cand -d 'Delete the invitation after a successful install'
             cand --delete-invite 'Delete the invitation after a successful install'
+            cand --no-nat-traversal 'Don''t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates'
+            cand --no-nat-candidates 'Don''t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates ''0.0.0.0/0'''
             cand -h 'Prints help information'
             cand --help 'Prints help information'
             cand -V 'Prints version information'
@@ -70,9 +77,12 @@ edit:completion:arg-completer[innernet] = [@words]{
         &'innernet;up'= {
             cand --interval 'Keep fetching the latest peer list at the specified interval in seconds. Valid only in daemon mode'
             cand --hosts-path 'The path to write hosts to'
+            cand --exclude-nat-candidates 'Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates ''0.0.0.0/0'' would report no candidates'
             cand -d 'Enable daemon mode i.e. keep the process running, while fetching the latest peer list periodically'
             cand --daemon 'Enable daemon mode i.e. keep the process running, while fetching the latest peer list periodically'
             cand --no-write-hosts 'Don''t write to any hosts files'
+            cand --no-nat-traversal 'Don''t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates'
+            cand --no-nat-candidates 'Don''t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates ''0.0.0.0/0'''
             cand -h 'Prints help information'
             cand --help 'Prints help information'
             cand -V 'Prints version information'
@@ -80,7 +90,10 @@ edit:completion:arg-completer[innernet] = [@words]{
         }
         &'innernet;fetch'= {
             cand --hosts-path 'The path to write hosts to'
+            cand --exclude-nat-candidates 'Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates ''0.0.0.0/0'' would report no candidates'
             cand --no-write-hosts 'Don''t write to any hosts files'
+            cand --no-nat-traversal 'Don''t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates'
+            cand --no-nat-candidates 'Don''t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates ''0.0.0.0/0'''
             cand -h 'Prints help information'
             cand --help 'Prints help information'
             cand -V 'Prints version information'
@@ -178,16 +191,22 @@ edit:completion:arg-completer[innernet] = [@words]{
             cand --version 'Prints version information'
         }
         &'innernet;set-listen-port'= {
+            cand -l 'The listen port you''d like to set for the interface'
+            cand --listen-port 'The listen port you''d like to set for the interface'
             cand -u 'Unset the local listen port to use a randomized port'
             cand --unset 'Unset the local listen port to use a randomized port'
+            cand --yes 'Bypass confirmation'
             cand -h 'Prints help information'
             cand --help 'Prints help information'
             cand -V 'Prints version information'
             cand --version 'Prints version information'
         }
         &'innernet;override-endpoint'= {
+            cand -e 'The listen port you''d like to set for the interface'
+            cand --endpoint 'The listen port you''d like to set for the interface'
             cand -u 'Unset an existing override to use the automatic endpoint discovery'
             cand --unset 'Unset an existing override to use the automatic endpoint discovery'
+            cand --yes 'Bypass confirmation'
             cand -h 'Prints help information'
             cand --help 'Prints help information'
             cand -V 'Prints version information'
diff --git a/doc/innernet.completions.fish b/doc/innernet.completions.fish
index 3685870..0c93dff 100644
--- a/doc/innernet.completions.fish
+++ b/doc/innernet.completions.fish
@@ -1,3 +1,5 @@
+complete -c innernet -n "__fish_use_subcommand" -s c -l config-dir
+complete -c innernet -n "__fish_use_subcommand" -s d -l data-dir
 complete -c innernet -n "__fish_use_subcommand" -l backend -d 'Specify a WireGuard backend to use. If not set, innernet will auto-select based on availability' -r -f -a "kernel userspace"
 complete -c innernet -n "__fish_use_subcommand" -l mtu -d 'Specify the desired MTU for your interface (default: 1420 for IPv4 and 1400 for IPv6)'
 complete -c innernet -n "__fish_use_subcommand" -s v -l verbose -d 'Verbose output, use -vv for even higher verbositude'
@@ -26,9 +28,12 @@ complete -c innernet -n "__fish_use_subcommand" -f -a "completions" -d 'Generate
 complete -c innernet -n "__fish_use_subcommand" -f -a "help" -d 'Prints this message or the help of the given subcommand(s)'
 complete -c innernet -n "__fish_seen_subcommand_from install" -l hosts-path -d 'The path to write hosts to'
 complete -c innernet -n "__fish_seen_subcommand_from install" -l name -d 'Set a specific interface name'
+complete -c innernet -n "__fish_seen_subcommand_from install" -l exclude-nat-candidates -d 'Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates \'0.0.0.0/0\' would report no candidates'
 complete -c innernet -n "__fish_seen_subcommand_from install" -l no-write-hosts -d 'Don\'t write to any hosts files'
 complete -c innernet -n "__fish_seen_subcommand_from install" -l default-name -d 'Use the network name inside the invitation as the interface name'
 complete -c innernet -n "__fish_seen_subcommand_from install" -s d -l delete-invite -d 'Delete the invitation after a successful install'
+complete -c innernet -n "__fish_seen_subcommand_from install" -l no-nat-traversal -d 'Don\'t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates'
+complete -c innernet -n "__fish_seen_subcommand_from install" -l no-nat-candidates -d 'Don\'t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates \'0.0.0.0/0\''
 complete -c innernet -n "__fish_seen_subcommand_from install" -s h -l help -d 'Prints help information'
 complete -c innernet -n "__fish_seen_subcommand_from install" -s V -l version -d 'Prints version information'
 complete -c innernet -n "__fish_seen_subcommand_from show" -s s -l short -d 'One-line peer list'
@@ -37,12 +42,18 @@ complete -c innernet -n "__fish_seen_subcommand_from show" -s h -l help -d 'Prin
 complete -c innernet -n "__fish_seen_subcommand_from show" -s V -l version -d 'Prints version information'
 complete -c innernet -n "__fish_seen_subcommand_from up" -l interval -d 'Keep fetching the latest peer list at the specified interval in seconds. Valid only in daemon mode'
 complete -c innernet -n "__fish_seen_subcommand_from up" -l hosts-path -d 'The path to write hosts to'
+complete -c innernet -n "__fish_seen_subcommand_from up" -l exclude-nat-candidates -d 'Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates \'0.0.0.0/0\' would report no candidates'
 complete -c innernet -n "__fish_seen_subcommand_from up" -s d -l daemon -d 'Enable daemon mode i.e. keep the process running, while fetching the latest peer list periodically'
 complete -c innernet -n "__fish_seen_subcommand_from up" -l no-write-hosts -d 'Don\'t write to any hosts files'
+complete -c innernet -n "__fish_seen_subcommand_from up" -l no-nat-traversal -d 'Don\'t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates'
+complete -c innernet -n "__fish_seen_subcommand_from up" -l no-nat-candidates -d 'Don\'t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates \'0.0.0.0/0\''
 complete -c innernet -n "__fish_seen_subcommand_from up" -s h -l help -d 'Prints help information'
 complete -c innernet -n "__fish_seen_subcommand_from up" -s V -l version -d 'Prints version information'
 complete -c innernet -n "__fish_seen_subcommand_from fetch" -l hosts-path -d 'The path to write hosts to'
+complete -c innernet -n "__fish_seen_subcommand_from fetch" -l exclude-nat-candidates -d 'Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates \'0.0.0.0/0\' would report no candidates'
 complete -c innernet -n "__fish_seen_subcommand_from fetch" -l no-write-hosts -d 'Don\'t write to any hosts files'
+complete -c innernet -n "__fish_seen_subcommand_from fetch" -l no-nat-traversal -d 'Don\'t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates'
+complete -c innernet -n "__fish_seen_subcommand_from fetch" -l no-nat-candidates -d 'Don\'t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates \'0.0.0.0/0\''
 complete -c innernet -n "__fish_seen_subcommand_from fetch" -s h -l help -d 'Prints help information'
 complete -c innernet -n "__fish_seen_subcommand_from fetch" -s V -l version -d 'Prints version information'
 complete -c innernet -n "__fish_seen_subcommand_from uninstall" -s h -l help -d 'Prints help information'
@@ -87,10 +98,14 @@ complete -c innernet -n "__fish_seen_subcommand_from delete-association" -s h -l
 complete -c innernet -n "__fish_seen_subcommand_from delete-association" -s V -l version -d 'Prints version information'
 complete -c innernet -n "__fish_seen_subcommand_from list-associations" -s h -l help -d 'Prints help information'
 complete -c innernet -n "__fish_seen_subcommand_from list-associations" -s V -l version -d 'Prints version information'
+complete -c innernet -n "__fish_seen_subcommand_from set-listen-port" -s l -l listen-port -d 'The listen port you\'d like to set for the interface'
 complete -c innernet -n "__fish_seen_subcommand_from set-listen-port" -s u -l unset -d 'Unset the local listen port to use a randomized port'
+complete -c innernet -n "__fish_seen_subcommand_from set-listen-port" -l yes -d 'Bypass confirmation'
 complete -c innernet -n "__fish_seen_subcommand_from set-listen-port" -s h -l help -d 'Prints help information'
 complete -c innernet -n "__fish_seen_subcommand_from set-listen-port" -s V -l version -d 'Prints version information'
+complete -c innernet -n "__fish_seen_subcommand_from override-endpoint" -s e -l endpoint -d 'The listen port you\'d like to set for the interface'
 complete -c innernet -n "__fish_seen_subcommand_from override-endpoint" -s u -l unset -d 'Unset an existing override to use the automatic endpoint discovery'
+complete -c innernet -n "__fish_seen_subcommand_from override-endpoint" -l yes -d 'Bypass confirmation'
 complete -c innernet -n "__fish_seen_subcommand_from override-endpoint" -s h -l help -d 'Prints help information'
 complete -c innernet -n "__fish_seen_subcommand_from override-endpoint" -s V -l version -d 'Prints version information'
 complete -c innernet -n "__fish_seen_subcommand_from completions" -s h -l help -d 'Prints help information'
diff --git a/doc/innernet.completions.powershell b/doc/innernet.completions.powershell
index 4a1f131..746a1fc 100644
--- a/doc/innernet.completions.powershell
+++ b/doc/innernet.completions.powershell
@@ -20,6 +20,10 @@ Register-ArgumentCompleter -Native -CommandName 'innernet' -ScriptBlock {
 
     $completions = @(switch ($command) {
         'innernet' {
+            [CompletionResult]::new('-c', 'c', [CompletionResultType]::ParameterName, 'c')
+            [CompletionResult]::new('--config-dir', 'config-dir', [CompletionResultType]::ParameterName, 'config-dir')
+            [CompletionResult]::new('-d', 'd', [CompletionResultType]::ParameterName, 'd')
+            [CompletionResult]::new('--data-dir', 'data-dir', [CompletionResultType]::ParameterName, 'data-dir')
             [CompletionResult]::new('--backend', 'backend', [CompletionResultType]::ParameterName, 'Specify a WireGuard backend to use. If not set, innernet will auto-select based on availability')
             [CompletionResult]::new('--mtu', 'mtu', [CompletionResultType]::ParameterName, 'Specify the desired MTU for your interface (default: 1420 for IPv4 and 1400 for IPv6)')
             [CompletionResult]::new('-v', 'v', [CompletionResultType]::ParameterName, 'Verbose output, use -vv for even higher verbositude')
@@ -54,10 +58,13 @@ Register-ArgumentCompleter -Native -CommandName 'innernet' -ScriptBlock {
         'innernet;install' {
             [CompletionResult]::new('--hosts-path', 'hosts-path', [CompletionResultType]::ParameterName, 'The path to write hosts to')
             [CompletionResult]::new('--name', 'name', [CompletionResultType]::ParameterName, 'Set a specific interface name')
+            [CompletionResult]::new('--exclude-nat-candidates', 'exclude-nat-candidates', [CompletionResultType]::ParameterName, 'Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates ''0.0.0.0/0'' would report no candidates')
             [CompletionResult]::new('--no-write-hosts', 'no-write-hosts', [CompletionResultType]::ParameterName, 'Don''t write to any hosts files')
             [CompletionResult]::new('--default-name', 'default-name', [CompletionResultType]::ParameterName, 'Use the network name inside the invitation as the interface name')
             [CompletionResult]::new('-d', 'd', [CompletionResultType]::ParameterName, 'Delete the invitation after a successful install')
             [CompletionResult]::new('--delete-invite', 'delete-invite', [CompletionResultType]::ParameterName, 'Delete the invitation after a successful install')
+            [CompletionResult]::new('--no-nat-traversal', 'no-nat-traversal', [CompletionResultType]::ParameterName, 'Don''t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates')
+            [CompletionResult]::new('--no-nat-candidates', 'no-nat-candidates', [CompletionResultType]::ParameterName, 'Don''t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates ''0.0.0.0/0''')
             [CompletionResult]::new('-h', 'h', [CompletionResultType]::ParameterName, 'Prints help information')
             [CompletionResult]::new('--help', 'help', [CompletionResultType]::ParameterName, 'Prints help information')
             [CompletionResult]::new('-V', 'V', [CompletionResultType]::ParameterName, 'Prints version information')
@@ -78,9 +85,12 @@ Register-ArgumentCompleter -Native -CommandName 'innernet' -ScriptBlock {
         'innernet;up' {
             [CompletionResult]::new('--interval', 'interval', [CompletionResultType]::ParameterName, 'Keep fetching the latest peer list at the specified interval in seconds. Valid only in daemon mode')
             [CompletionResult]::new('--hosts-path', 'hosts-path', [CompletionResultType]::ParameterName, 'The path to write hosts to')
+            [CompletionResult]::new('--exclude-nat-candidates', 'exclude-nat-candidates', [CompletionResultType]::ParameterName, 'Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates ''0.0.0.0/0'' would report no candidates')
             [CompletionResult]::new('-d', 'd', [CompletionResultType]::ParameterName, 'Enable daemon mode i.e. keep the process running, while fetching the latest peer list periodically')
             [CompletionResult]::new('--daemon', 'daemon', [CompletionResultType]::ParameterName, 'Enable daemon mode i.e. keep the process running, while fetching the latest peer list periodically')
             [CompletionResult]::new('--no-write-hosts', 'no-write-hosts', [CompletionResultType]::ParameterName, 'Don''t write to any hosts files')
+            [CompletionResult]::new('--no-nat-traversal', 'no-nat-traversal', [CompletionResultType]::ParameterName, 'Don''t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates')
+            [CompletionResult]::new('--no-nat-candidates', 'no-nat-candidates', [CompletionResultType]::ParameterName, 'Don''t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates ''0.0.0.0/0''')
             [CompletionResult]::new('-h', 'h', [CompletionResultType]::ParameterName, 'Prints help information')
             [CompletionResult]::new('--help', 'help', [CompletionResultType]::ParameterName, 'Prints help information')
             [CompletionResult]::new('-V', 'V', [CompletionResultType]::ParameterName, 'Prints version information')
@@ -89,7 +99,10 @@ Register-ArgumentCompleter -Native -CommandName 'innernet' -ScriptBlock {
         }
         'innernet;fetch' {
             [CompletionResult]::new('--hosts-path', 'hosts-path', [CompletionResultType]::ParameterName, 'The path to write hosts to')
+            [CompletionResult]::new('--exclude-nat-candidates', 'exclude-nat-candidates', [CompletionResultType]::ParameterName, 'Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates ''0.0.0.0/0'' would report no candidates')
             [CompletionResult]::new('--no-write-hosts', 'no-write-hosts', [CompletionResultType]::ParameterName, 'Don''t write to any hosts files')
+            [CompletionResult]::new('--no-nat-traversal', 'no-nat-traversal', [CompletionResultType]::ParameterName, 'Don''t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates')
+            [CompletionResult]::new('--no-nat-candidates', 'no-nat-candidates', [CompletionResultType]::ParameterName, 'Don''t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates ''0.0.0.0/0''')
             [CompletionResult]::new('-h', 'h', [CompletionResultType]::ParameterName, 'Prints help information')
             [CompletionResult]::new('--help', 'help', [CompletionResultType]::ParameterName, 'Prints help information')
             [CompletionResult]::new('-V', 'V', [CompletionResultType]::ParameterName, 'Prints version information')
@@ -200,8 +213,11 @@ Register-ArgumentCompleter -Native -CommandName 'innernet' -ScriptBlock {
             break
         }
         'innernet;set-listen-port' {
+            [CompletionResult]::new('-l', 'l', [CompletionResultType]::ParameterName, 'The listen port you''d like to set for the interface')
+            [CompletionResult]::new('--listen-port', 'listen-port', [CompletionResultType]::ParameterName, 'The listen port you''d like to set for the interface')
             [CompletionResult]::new('-u', 'u', [CompletionResultType]::ParameterName, 'Unset the local listen port to use a randomized port')
             [CompletionResult]::new('--unset', 'unset', [CompletionResultType]::ParameterName, 'Unset the local listen port to use a randomized port')
+            [CompletionResult]::new('--yes', 'yes', [CompletionResultType]::ParameterName, 'Bypass confirmation')
             [CompletionResult]::new('-h', 'h', [CompletionResultType]::ParameterName, 'Prints help information')
             [CompletionResult]::new('--help', 'help', [CompletionResultType]::ParameterName, 'Prints help information')
             [CompletionResult]::new('-V', 'V', [CompletionResultType]::ParameterName, 'Prints version information')
@@ -209,8 +225,11 @@ Register-ArgumentCompleter -Native -CommandName 'innernet' -ScriptBlock {
             break
         }
         'innernet;override-endpoint' {
+            [CompletionResult]::new('-e', 'e', [CompletionResultType]::ParameterName, 'The listen port you''d like to set for the interface')
+            [CompletionResult]::new('--endpoint', 'endpoint', [CompletionResultType]::ParameterName, 'The listen port you''d like to set for the interface')
             [CompletionResult]::new('-u', 'u', [CompletionResultType]::ParameterName, 'Unset an existing override to use the automatic endpoint discovery')
             [CompletionResult]::new('--unset', 'unset', [CompletionResultType]::ParameterName, 'Unset an existing override to use the automatic endpoint discovery')
+            [CompletionResult]::new('--yes', 'yes', [CompletionResultType]::ParameterName, 'Bypass confirmation')
             [CompletionResult]::new('-h', 'h', [CompletionResultType]::ParameterName, 'Prints help information')
             [CompletionResult]::new('--help', 'help', [CompletionResultType]::ParameterName, 'Prints help information')
             [CompletionResult]::new('-V', 'V', [CompletionResultType]::ParameterName, 'Prints version information')
diff --git a/doc/innernet.completions.zsh b/doc/innernet.completions.zsh
index 3816e19..53d77a5 100644
--- a/doc/innernet.completions.zsh
+++ b/doc/innernet.completions.zsh
@@ -15,6 +15,10 @@ _innernet() {
 
     local context curcontext="$curcontext" state line
     _arguments "${_arguments_options[@]}" \
+'-c+[]' \
+'--config-dir=[]' \
+'-d+[]' \
+'--data-dir=[]' \
 '--backend=[Specify a WireGuard backend to use. If not set, innernet will auto-select based on availability]: :(kernel userspace)' \
 '--mtu=[Specify the desired MTU for your interface (default: 1420 for IPv4 and 1400 for IPv6)]' \
 '*-v[Verbose output, use -vv for even higher verbositude]' \
@@ -37,10 +41,13 @@ _innernet() {
 _arguments "${_arguments_options[@]}" \
 '--hosts-path=[The path to write hosts to]' \
 '(--default-name)--name=[Set a specific interface name]' \
+'*--exclude-nat-candidates=[Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates '\''0.0.0.0/0'\'' would report no candidates]' \
 '(--hosts-path)--no-write-hosts[Don'\''t write to any hosts files]' \
 '--default-name[Use the network name inside the invitation as the interface name]' \
 '-d[Delete the invitation after a successful install]' \
 '--delete-invite[Delete the invitation after a successful install]' \
+'--no-nat-traversal[Don'\''t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates]' \
+'(--exclude-nat-candidates)--no-nat-candidates[Don'\''t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates '\''0.0.0.0/0'\'']' \
 '-h[Prints help information]' \
 '--help[Prints help information]' \
 '-V[Prints version information]' \
@@ -52,10 +59,13 @@ _arguments "${_arguments_options[@]}" \
 _arguments "${_arguments_options[@]}" \
 '--hosts-path=[The path to write hosts to]' \
 '(--default-name)--name=[Set a specific interface name]' \
+'*--exclude-nat-candidates=[Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates '\''0.0.0.0/0'\'' would report no candidates]' \
 '(--hosts-path)--no-write-hosts[Don'\''t write to any hosts files]' \
 '--default-name[Use the network name inside the invitation as the interface name]' \
 '-d[Delete the invitation after a successful install]' \
 '--delete-invite[Delete the invitation after a successful install]' \
+'--no-nat-traversal[Don'\''t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates]' \
+'(--exclude-nat-candidates)--no-nat-candidates[Don'\''t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates '\''0.0.0.0/0'\'']' \
 '-h[Prints help information]' \
 '--help[Prints help information]' \
 '-V[Prints version information]' \
@@ -93,20 +103,26 @@ _arguments "${_arguments_options[@]}" \
 _arguments "${_arguments_options[@]}" \
 '--interval=[Keep fetching the latest peer list at the specified interval in seconds. Valid only in daemon mode]' \
 '--hosts-path=[The path to write hosts to]' \
+'*--exclude-nat-candidates=[Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates '\''0.0.0.0/0'\'' would report no candidates]' \
 '-d[Enable daemon mode i.e. keep the process running, while fetching the latest peer list periodically]' \
 '--daemon[Enable daemon mode i.e. keep the process running, while fetching the latest peer list periodically]' \
 '(--hosts-path)--no-write-hosts[Don'\''t write to any hosts files]' \
+'--no-nat-traversal[Don'\''t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates]' \
+'(--exclude-nat-candidates)--no-nat-candidates[Don'\''t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates '\''0.0.0.0/0'\'']' \
 '-h[Prints help information]' \
 '--help[Prints help information]' \
 '-V[Prints version information]' \
 '--version[Prints version information]' \
-':interface:_files' \
+'::interface:_files' \
 && ret=0
 ;;
 (fetch)
 _arguments "${_arguments_options[@]}" \
 '--hosts-path=[The path to write hosts to]' \
+'*--exclude-nat-candidates=[Exclude one or more CIDRs from NAT candidate reporting. ex. --exclude-nat-candidates '\''0.0.0.0/0'\'' would report no candidates]' \
 '(--hosts-path)--no-write-hosts[Don'\''t write to any hosts files]' \
+'--no-nat-traversal[Don'\''t attempt NAT traversal. Note that this still will report candidates unless you also specify to exclude all NAT candidates]' \
+'(--exclude-nat-candidates)--no-nat-candidates[Don'\''t report any candidates to coordinating server. Shorthand for --exclude-nat-candidates '\''0.0.0.0/0'\'']' \
 '-h[Prints help information]' \
 '--help[Prints help information]' \
 '-V[Prints version information]' \
@@ -245,8 +261,11 @@ _arguments "${_arguments_options[@]}" \
 ;;
 (set-listen-port)
 _arguments "${_arguments_options[@]}" \
-'-u[Unset the local listen port to use a randomized port]' \
-'--unset[Unset the local listen port to use a randomized port]' \
+'-l+[The listen port you'\''d like to set for the interface]' \
+'--listen-port=[The listen port you'\''d like to set for the interface]' \
+'(-l --listen-port)-u[Unset the local listen port to use a randomized port]' \
+'(-l --listen-port)--unset[Unset the local listen port to use a randomized port]' \
+'--yes[Bypass confirmation]' \
 '-h[Prints help information]' \
 '--help[Prints help information]' \
 '-V[Prints version information]' \
@@ -256,8 +275,11 @@ _arguments "${_arguments_options[@]}" \
 ;;
 (override-endpoint)
 _arguments "${_arguments_options[@]}" \
-'-u[Unset an existing override to use the automatic endpoint discovery]' \
-'--unset[Unset an existing override to use the automatic endpoint discovery]' \
+'-e+[The listen port you'\''d like to set for the interface]' \
+'--endpoint=[The listen port you'\''d like to set for the interface]' \
+'(-e --endpoint)-u[Unset an existing override to use the automatic endpoint discovery]' \
+'(-e --endpoint)--unset[Unset an existing override to use the automatic endpoint discovery]' \
+'--yes[Bypass confirmation]' \
 '-h[Prints help information]' \
 '--help[Prints help information]' \
 '-V[Prints version information]' \
diff --git a/server/Cargo.toml b/server/Cargo.toml
index faf7f80..1168adf 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT"
 name = "server"
 publish = false
 readme = "README.md"
-version = "1.5.1"
+version = "1.5.2"
 
 [[bin]]
 name = "innernet-server"
diff --git a/shared/Cargo.toml b/shared/Cargo.toml
index cd0e1e4..e7b902b 100644
--- a/shared/Cargo.toml
+++ b/shared/Cargo.toml
@@ -4,7 +4,7 @@ edition = "2018"
 license = "MIT"
 name = "shared"
 publish = false
-version = "1.5.1"
+version = "1.5.2"
 
 [dependencies]
 anyhow = "1"
diff --git a/wireguard-control-sys/Cargo.toml b/wireguard-control-sys/Cargo.toml
index 815a4df..0606b26 100644
--- a/wireguard-control-sys/Cargo.toml
+++ b/wireguard-control-sys/Cargo.toml
@@ -6,7 +6,7 @@ license = "LGPL-2.1-or-later"
 name = "wireguard-control-sys"
 readme = "README.md"
 repository = "https://github.com/tonarino/innernet"
-version = "1.5.1"
+version = "1.5.2"
 
 [dependencies]
 libc = "0.2"
diff --git a/wireguard-control/Cargo.toml b/wireguard-control/Cargo.toml
index 2694f05..999637c 100644
--- a/wireguard-control/Cargo.toml
+++ b/wireguard-control/Cargo.toml
@@ -7,7 +7,7 @@ license = "LGPL-2.1-or-later"
 name = "wireguard-control"
 readme = "README.md"
 repository = "https://github.com/tonarino/innernet"
-version = "1.5.1"
+version = "1.5.2"
 
 [dependencies]
 base64 = "0.13"
@@ -15,7 +15,7 @@ hex = "0.4"
 libc = "0.2"
 
 [target.'cfg(target_os = "linux")'.dependencies]
-wireguard-control-sys = { path = "../wireguard-control-sys", version = "1.5.1" }
+wireguard-control-sys = { path = "../wireguard-control-sys", version = "1.5.2" }
 
 [target.'cfg(not(target_os = "linux"))'.dependencies]
 rand_core = "0.6"