diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index e83f8841..13c5a223 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -8,6 +8,13 @@
     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
     <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
 
+    <permission
+        android:name="com.wireguard.android.permission.CONTROL_TUNNELS"
+        android:protectionLevel="dangerous"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/permission_label"
+        android:description="@string/permission_description" />
+
     <application
         android:name=".Application"
         android:allowBackup="false"
@@ -50,9 +57,13 @@
             </intent-filter>
         </receiver>
 
-        <receiver android:name=".backend.WgQuickBackend$WgQuickChangeReceiver">
+        <receiver
+            android:name=".model.TunnelManager$IntentReceiver"
+            android:permission="com.wireguard.android.permission.CONTROL_TUNNELS">
             <intent-filter>
-                <action android:name="com.wireguard.android.WGQUICK_CHANGE" />
+                <action android:name="com.wireguard.android.action.REFRESH_TUNNEL_STATES" />
+                <action android:name="com.wireguard.android.action.SET_TUNNEL_UP" />
+                <action android:name="com.wireguard.android.action.SET_TUNNEL_DOWN" />
             </intent-filter>
         </receiver>
 
diff --git a/app/src/main/java/com/wireguard/android/backend/WgQuickBackend.java b/app/src/main/java/com/wireguard/android/backend/WgQuickBackend.java
index 49b562a0..e5a5574f 100644
--- a/app/src/main/java/com/wireguard/android/backend/WgQuickBackend.java
+++ b/app/src/main/java/com/wireguard/android/backend/WgQuickBackend.java
@@ -6,12 +6,9 @@
 
 package com.wireguard.android.backend;
 
-import android.content.BroadcastReceiver;
 import android.content.Context;
-import android.content.Intent;
 import android.util.Log;
 
-import com.wireguard.android.Application;
 import com.wireguard.android.model.Tunnel;
 import com.wireguard.android.model.Tunnel.State;
 import com.wireguard.android.model.Tunnel.Statistics;
@@ -119,12 +116,4 @@ public final class WgQuickBackend implements Backend {
         if (result != 0)
             throw new Exception("Unable to configure tunnel (wg-quick returned " + result + ')');
     }
-
-    public static final class WgQuickChangeReceiver extends BroadcastReceiver {
-        @Override
-        public void onReceive(final Context context, final Intent intent) {
-            Log.d(TAG, "Refreshing tunnel states");
-            Application.getComponent().getTunnelManager().refreshTunnelStates();
-        }
-    }
 }
diff --git a/app/src/main/java/com/wireguard/android/model/TunnelManager.java b/app/src/main/java/com/wireguard/android/model/TunnelManager.java
index 8c9da7e1..4267e76c 100644
--- a/app/src/main/java/com/wireguard/android/model/TunnelManager.java
+++ b/app/src/main/java/com/wireguard/android/model/TunnelManager.java
@@ -6,11 +6,15 @@
 
 package com.wireguard.android.model;
 
+import android.content.BroadcastReceiver;
+import android.content.Context;
+import android.content.Intent;
 import android.content.SharedPreferences;
 import android.databinding.BaseObservable;
 import android.databinding.Bindable;
 import android.support.annotation.NonNull;
 
+import com.wireguard.android.Application;
 import com.wireguard.android.Application.ApplicationScope;
 import com.wireguard.android.BR;
 import com.wireguard.android.backend.Backend;
@@ -264,4 +268,37 @@ public final class TunnelManager extends BaseObservable {
             saveState();
         });
     }
+
+    public static final class IntentReceiver extends BroadcastReceiver {
+        @Override
+        public void onReceive(final Context context, final Intent intent) {
+            final TunnelManager manager = Application.getComponent().getTunnelManager();
+            if (intent == null)
+                return;
+            final String action = intent.getAction();
+            if (action == null)
+                return;
+
+            if ("com.wireguard.android.action.REFRESH_TUNNEL_STATES".equals(action)) {
+                manager.refreshTunnelStates();
+                return;
+            }
+
+            final State state;
+            if ("com.wireguard.android.action.SET_TUNNEL_UP".equals(action))
+                state = State.UP;
+            else if ("com.wireguard.android.action.SET_TUNNEL_DOWN".equals(action))
+                state = State.DOWN;
+            else
+                return;
+
+            final String tunnelName = intent.getStringExtra("tunnel");
+            if (tunnelName == null)
+                return;
+            final Tunnel tunnel = manager.getTunnels().get(tunnelName);
+            if (tunnel == null)
+                return;
+            manager.setTunnelState(tunnel, state);
+        }
+    }
 }
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index 430c8423..893f9a16 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -55,6 +55,8 @@
     <string name="mtu">MTU</string>
     <string name="name">Name</string>
     <string name="peer">Peer</string>
+    <string name="permission_label">control WireGuard tunnels</string>
+    <string name="permission_description">Allows an app to control WireGuard tunnels. Apps with this permission may enable and disable WireGuard tunnels at will, potentially misdirecting Internet traffic.</string>
     <string name="persistent_keepalive">Persistent keepalive</string>
     <string name="pre_shared_key">Pre-shared key</string>
     <string name="private_key">Private key</string>
diff --git a/app/tools/wireguard b/app/tools/wireguard
index b57461ce..a59b4d58 160000
--- a/app/tools/wireguard
+++ b/app/tools/wireguard
@@ -1 +1 @@
-Subproject commit b57461ceb01e591525201a9b8db3bf5107e51f8d
+Subproject commit a59b4d5808e8cd8da8a9f1db6be71a200a9d716c