diff --git a/CMakeLists.txt b/CMakeLists.txt
index b5f3029..84fb7f3 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -80,16 +80,9 @@
   set(BUILD_WINVNC 1)
 endif()
 
-# Minimum version is Windows 2000 (5.0)
+# Minimum version is Windows XP SP2 (5.2)
 if(WIN32)
-  if(NOT CMAKE_SIZEOF_VOID_P MATCHES 8)
-    add_definitions(-D_WIN32_IE=0x0500 -D_WIN32_WINNT=0x0500)
-  else()
-    set(WIN64 1)
-    # Win64 doesn't like us requesting a Windows version that didn't have
-    # 64-bit support. Request XP (5.1) instead.
-    add_definitions(-D_WIN32_IE=0x0501 -D_WIN32_WINNT=0x0501)
-  endif()
+  add_definitions(-D_WIN32_IE=0x0502 -D_WIN32_WINNT=0x0502)
 endif()
 
 if(CMAKE_SIZEOF_VOID_P MATCHES 8)
@@ -259,24 +252,6 @@
 endif()
 set(HAVE_PAM ${ENABLE_PAM})
 
-# Check for socket functions
-if(WIN32)
-  set(CMAKE_EXTRA_INCLUDE_FILES winsock2.h ws2tcpip.h)
-  set(CMAKE_REQUIRED_LIBRARIES ws2_32)
-else()
-  set(CMAKE_EXTRA_INCLUDE_FILES sys/socket.h)
-endif()
-check_function_exists(inet_aton HAVE_INET_ATON)
-# This might give a false positive on Windows as it is also guarded by
-# a version check that we do not satisfy (requires Vista, but we target
-# Windows 2000).
-if(NOT WIN32)
-check_function_exists(inet_pton HAVE_INET_PTON)
-endif()
-check_function_exists(getaddrinfo HAVE_GETADDRINFO)
-set(CMAKE_EXTRA_INCLUDE_FILES) 
-set(CMAKE_REQUIRED_LIBRARIES)
-
 # Generate config.h and make sure the source finds it
 configure_file(config.h.in config.h)
 add_definitions(-DHAVE_CONFIG_H)
diff --git a/common/network/TcpSocket.cxx b/common/network/TcpSocket.cxx
index e19f52b..3b656cd 100644
--- a/common/network/TcpSocket.cxx
+++ b/common/network/TcpSocket.cxx
@@ -31,10 +31,8 @@
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <arpa/inet.h>
-#include <netinet/in.h>
 #include <netinet/tcp.h>
 #include <netdb.h>
-#include <unistd.h>
 #include <errno.h>
 #include <string.h>
 #include <signal.h>
@@ -42,11 +40,16 @@
 #endif
 
 #include <stdlib.h>
+#include <unistd.h>
 #include <network/TcpSocket.h>
 #include <rfb/util.h>
 #include <rfb/LogWriter.h>
 #include <rfb/Configuration.h>
 
+#ifdef WIN32
+#include <os/winerrno.h>
+#endif
+
 #ifndef INADDR_NONE
 #define INADDR_NONE ((unsigned long)-1)
 #endif
@@ -54,30 +57,23 @@
 #define INADDR_LOOPBACK ((unsigned long)0x7F000001)
 #endif
 
-#if defined(HAVE_GETADDRINFO) && !defined(IN6_ARE_ADDR_EQUAL)
+#ifndef IN6_ARE_ADDR_EQUAL
 #define IN6_ARE_ADDR_EQUAL(a,b) \
   (memcmp ((const void*)(a), (const void*)(b), sizeof (struct in6_addr)) == 0)
 #endif
 
+// Missing on older Windows and OS X
+#ifndef AI_NUMERICSERV
+#define AI_NUMERICSERV 0
+#endif
+
 using namespace network;
 using namespace rdr;
 
-typedef struct vnc_sockaddr {
-	union {
-		sockaddr	sa;
-		sockaddr_in	sin;
-#ifdef HAVE_GETADDRINFO
-		sockaddr_in6	sin6;
-#endif
-	} u;
-} vnc_sockaddr_t;
-
 static rfb::LogWriter vlog("TcpSocket");
 
 static rfb::BoolParameter UseIPv4("UseIPv4", "Use IPv4 for incoming and outgoing connections.", true);
-#ifdef HAVE_GETADDRINFO
 static rfb::BoolParameter UseIPv6("UseIPv6", "Use IPv6 for incoming and outgoing connections.", true);
-#endif
 
 /* Tunnelling support. */
 int network::findFreeTcpPort (void)
@@ -122,6 +118,23 @@
 }
 
 
+// -=- Socket duplication help for Windows
+static int dupsocket(int fd)
+{
+#ifdef WIN32
+  int ret;
+  WSAPROTOCOL_INFO info;
+  ret = WSADuplicateSocket(fd, GetCurrentProcessId(), &info);
+  if (ret != 0)
+    throw SocketException("unable to duplicate socket", errorNumber);
+  return WSASocket(info.iAddressFamily, info.iSocketType, info.iProtocol,
+                   &info, 0, 0);
+#else
+  return dup(fd);
+#endif
+}
+
+
 // -=- TcpSocket
 
 TcpSocket::TcpSocket(int sock, bool close)
@@ -135,14 +148,11 @@
   int sock, err, result, family;
   vnc_sockaddr_t sa;
   socklen_t salen;
-#ifdef HAVE_GETADDRINFO
   struct addrinfo *ai, *current, hints;
-#endif
 
   // - Create a socket
   initSockets();
 
-#ifdef HAVE_GETADDRINFO
   memset(&hints, 0, sizeof(struct addrinfo));
   hints.ai_family = AF_UNSPEC;
   hints.ai_socktype = SOCK_STREAM;
@@ -152,7 +162,7 @@
 
   if ((result = getaddrinfo(host, NULL, &hints, &ai)) != 0) {
     throw Exception("unable to resolve host by name: %s",
-		    gai_strerror(result));
+                    gai_strerror(result));
   }
 
   // This logic is too complex for the compiler to determine if
@@ -183,37 +193,10 @@
     else
       sa.u.sin6.sin6_port = htons(port);
 
-#else /* HAVE_GETADDRINFO */
-    if (!UseIPv4)
-      throw Exception("Only IPv4 available but it is disabled");
-
-    family = AF_INET;
-    salen = sizeof(struct sockaddr_in);
-
-    /* Try processing the host as an IP address */
-    memset(&sa, 0, sizeof(sa));
-    sa.u.sin.sin_family = AF_INET;
-    sa.u.sin.sin_addr.s_addr = inet_addr((char *)host);
-    sa.u.sin.sin_port = htons(port);
-    if ((int)sa.u.sin.sin_addr.s_addr == -1) {
-      /* Host was not an IP address - try resolving as DNS name */
-      struct hostent *hostinfo;
-      hostinfo = gethostbyname((char *)host);
-      if (hostinfo && hostinfo->h_addr) {
-        sa.u.sin.sin_addr.s_addr = ((struct in_addr *)hostinfo->h_addr)->s_addr;
-      } else {
-        err = errorNumber;
-        throw SocketException("unable to resolve host by name", err);
-      }
-    }
-#endif /* HAVE_GETADDRINFO */
-
     sock = socket (family, SOCK_STREAM, 0);
     if (sock == -1) {
       err = errorNumber;
-#ifdef HAVE_GETADDRINFO
       freeaddrinfo(ai);
-#endif /* HAVE_GETADDRINFO */
       throw SocketException("unable to create socket", err);
     }
 
@@ -222,13 +205,12 @@
       err = errorNumber;
 #ifndef WIN32
       if (err == EINTR)
-	continue;
+        continue;
 #endif
       closesocket(sock);
       break;
     }
 
-#ifdef HAVE_GETADDRINFO
     if (result == 0)
       break;
   }
@@ -237,7 +219,6 @@
 
   if (current == NULL)
     throw Exception("No useful address for host");
-#endif /* HAVE_GETADDRINFO */
 
   if (result == -1)
     throw SocketException("unable connect to socket", err);
@@ -274,16 +255,16 @@
     return rfb::strDup("");
   }
 
-#if defined(HAVE_GETADDRINFO) && defined(HAVE_INET_PTON)
   if (sa.u.sa.sa_family == AF_INET6) {
     char buffer[INET6_ADDRSTRLEN + 2];
-    const char *name;
+    int ret;
 
     buffer[0] = '[';
 
-    name = inet_ntop(sa.u.sa.sa_family, &sa.u.sin6.sin6_addr,
-                     buffer + 1, sizeof(buffer) - 2);
-    if (name == NULL) {
+    ret = getnameinfo(&sa.u.sa, sizeof(sa.u.sin6),
+                      buffer + 1, sizeof(buffer) - 2, NULL, 0,
+                      NI_NUMERICHOST);
+    if (ret != 0) {
       vlog.error("unable to convert peer name to a string");
       return rfb::strDup("");
     }
@@ -292,7 +273,6 @@
 
     return rfb::strDup(buffer);
   }
-#endif
 
   if (sa.u.sa.sa_family == AF_INET) {
     char *name;
@@ -317,10 +297,8 @@
   getpeername(getFd(), &sa.u.sa, &sa_size);
 
   switch (sa.u.sa.sa_family) {
-#ifdef HAVE_GETADDRINFO
   case AF_INET6:
     return ntohs(sa.u.sin6.sin6_port);
-#endif /* HAVE_GETADDRINFO */
   case AF_INET:
     return ntohs(sa.u.sin.sin_port);
   default:
@@ -353,12 +331,9 @@
   if (peeraddr.u.sa.sa_family != myaddr.u.sa.sa_family)
       return false;
 
-#ifdef HAVE_GETADDRINFO
   if (peeraddr.u.sa.sa_family == AF_INET6)
       return IN6_ARE_ADDR_EQUAL(&peeraddr.u.sin6.sin6_addr,
-				&myaddr.u.sin6.sin6_addr);
-#endif
-
+                                &myaddr.u.sin6.sin6_addr);
   if (peeraddr.u.sa.sa_family == AF_INET)
     return (peeraddr.u.sin.sin_addr.s_addr == myaddr.u.sin.sin_addr.s_addr);
 
@@ -375,7 +350,7 @@
 bool TcpSocket::enableNagles(int sock, bool enable) {
   int one = enable ? 0 : 1;
   if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY,
-		 (char *)&one, sizeof(one)) < 0) {
+                 (char *)&one, sizeof(one)) < 0) {
     int e = errorNumber;
     vlog.error("unable to setsockopt TCP_NODELAY: %d", e);
     return false;
@@ -416,149 +391,84 @@
     return 0;
 
   switch (sa.u.sa.sa_family) {
-#ifdef HAVE_GETADDRINFO
   case AF_INET6:
     return ntohs(sa.u.sin6.sin6_port);
-#endif /* HAVE_GETADDRINFO */
-
   default:
     return ntohs(sa.u.sin.sin_port);
   }
 }
 
-static int bindIPv6 (const char *listenaddr,
-		     int port,
-		     bool localhostOnly)
+TcpListener::TcpListener(int sock)
 {
-#ifdef HAVE_GETADDRINFO
-  struct sockaddr_in6 addr6;
-  socklen_t sa_len;
-  int fd;
-
-  if (!UseIPv6)
-    return -1;
-
-  if ((fd = socket(AF_INET6, SOCK_STREAM, 0)) < 0)
-    return -1;
-
-#ifdef IPV6_V6ONLY
-  // - We made an IPv6-capable socket, and we need it to do IPv4 too
-  int opt = 0;
-  setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, (char *)&opt, sizeof(opt));
-#else
-  vlog.error("IPV6_V6ONLY support is missing. "
-	     "IPv4 clients may not be able to connect.");
-#endif
-
-  memset(&addr6, 0, (sa_len = sizeof(addr6)));
-  addr6.sin6_family = AF_INET6;
-  addr6.sin6_port = htons(port);
-
-  if (localhostOnly)
-    addr6.sin6_addr = in6addr_loopback;
-  else if (listenaddr != NULL) {
-#ifdef HAVE_INET_PTON
-    if (inet_pton(AF_INET6, listenaddr, &addr6.sin6_addr) != 1) {
-      closesocket(fd);
-      return -1;
-    }
-#else
-    // Unable to parse without inet_pton
-    closesocket(fd);
-    return -1;
-#endif
-  }
-
-  if (bind(fd, (struct sockaddr *) &addr6, sa_len) == -1) {
-    closesocket(fd);
-    return -1;
-  }
-
-  return fd;
-#else
-  return -1;
-#endif /* HAVE_GETADDRINFO */
+  fd = sock;
 }
 
-static int bindIPv4 (const char *listenaddr,
-		     int port,
-		     bool localhostOnly)
+TcpListener::TcpListener(const TcpListener& other)
 {
-  struct sockaddr_in addr;
-  socklen_t sa_len;
-  int fd;
-
-  if (!UseIPv4)
-    return -1;
-
-  if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
-    return -1;
-
-  memset(&addr, 0, (sa_len = sizeof(addr)));
-  addr.sin_family = AF_INET;
-  addr.sin_port = htons(port);
-
-  if (localhostOnly)
-    addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
-  else if (listenaddr != NULL) {
-#ifdef HAVE_INET_ATON
-    if (inet_aton(listenaddr, &addr.sin_addr) == 0)
-#else
-      /* Some systems (e.g. Windows) do not have inet_aton, sigh */
-      if ((addr.sin_addr.s_addr = inet_addr(listenaddr)) == INADDR_NONE)
-#endif
-      {
-	closesocket(fd);
-	throw Exception("invalid network interface address: %s", listenaddr);
-      }
-  } else
-    /* Bind to 0.0.0.0 by default. */
-    addr.sin_addr.s_addr = htonl(INADDR_ANY);
-
-  if (bind(fd, (struct sockaddr *) &addr, sa_len) == -1) {
-    closesocket(fd);
-    return -1;
-  }
-
-  return fd;
+  fd = dupsocket (other.fd);
+  // Hope TcpListener::shutdown(other) doesn't get called...
 }
 
-TcpListener::TcpListener(const char *listenaddr, int port, bool localhostOnly,
-			 int sock, bool close_) : closeFd(close_)
+TcpListener& TcpListener::operator= (const TcpListener& other)
 {
-  if (sock != -1) {
-    fd = sock;
-    return;
+  if (this != &other)
+  {
+    closesocket (fd);
+    fd = dupsocket (other.fd);
+    // Hope TcpListener::shutdown(other) doesn't get called...
   }
+  return *this;
+}
+
+TcpListener::TcpListener(const struct sockaddr *listenaddr,
+                         socklen_t listenaddrlen)
+{
+  int one = 1;
+  vnc_sockaddr_t sa;
+  int sock;
 
   initSockets();
-  if ((fd = bindIPv6 (listenaddr, port, localhostOnly)) < 0)
-    if ((fd = bindIPv4 (listenaddr, port, localhostOnly)) < 0)
-      throw SocketException("unable to create listening socket", errorNumber);
+
+  if ((sock = socket (listenaddr->sa_family, SOCK_STREAM, 0)) < 0)
+    throw SocketException("unable to create listening socket", errorNumber);
+
+  memcpy (&sa, listenaddr, listenaddrlen);
+#ifdef IPV6_V6ONLY
+  if (listenaddr->sa_family == AF_INET6) {
+    if (setsockopt (sock, IPPROTO_IPV6, IPV6_V6ONLY, (char*)&one, sizeof(one)))
+      throw SocketException("unable to set IPV6_V6ONLY", errorNumber);
+  }
+#endif /* defined(IPV6_V6ONLY) */
+
+  if (bind(sock, &sa.u.sa, listenaddrlen) == -1) {
+    closesocket(sock);
+    throw SocketException("failed to bind socket", errorNumber);
+  }
 
 #ifndef WIN32
   // - By default, close the socket on exec()
-  fcntl(fd, F_SETFD, FD_CLOEXEC);
+  fcntl(sock, F_SETFD, FD_CLOEXEC);
 
-  int one = 1;
-  if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
-		 (char *)&one, sizeof(one)) < 0) {
+  if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
+                 (char *)&one, sizeof(one)) < 0) {
     int e = errorNumber;
-    closesocket(fd);
+    closesocket(sock);
     throw SocketException("unable to create listening socket", e);
   }
 #endif
 
   // - Set it to be a listening socket
-  if (listen(fd, 5) < 0) {
+  if (listen(sock, 5) < 0) {
     int e = errorNumber;
-    closesocket(fd);
+    closesocket(sock);
     throw SocketException("unable to set socket to listening mode", e);
   }
+
+  fd = sock;
 }
 
 TcpListener::~TcpListener() {
-  if (closeFd) closesocket(fd);
+  closesocket(fd);
 }
 
 void TcpListener::shutdown()
@@ -597,41 +507,45 @@
 }
 
 void TcpListener::getMyAddresses(std::list<char*>* result) {
-#if defined(HAVE_GETADDRINFO) && defined(HAVE_INET_PTON)
   struct addrinfo *ai, *current, hints;
 
+  initSockets();
+
   memset(&hints, 0, sizeof(struct addrinfo));
+  hints.ai_flags = AI_PASSIVE | AI_NUMERICSERV;
   hints.ai_family = AF_UNSPEC;
   hints.ai_socktype = SOCK_STREAM;
   hints.ai_canonname = NULL;
   hints.ai_addr = NULL;
   hints.ai_next = NULL;
 
-  if ((getaddrinfo(NULL, NULL, &hints, &ai)) != 0)
+  // Windows doesn't like NULL for service, so specify something
+  if ((getaddrinfo(NULL, "1", &hints, &ai)) != 0)
     return;
 
   for (current= ai; current != NULL; current = current->ai_next) {
-    if (current->ai_family != AF_INET && current->ai_family != AF_INET6)
+    switch (current->ai_family) {
+    case AF_INET:
+      if (!UseIPv4)
+        continue;
+      break;
+    case AF_INET6:
+      if (!UseIPv6)
+        continue;
+      break;
+    default:
       continue;
+    }
 
     char *addr = new char[INET6_ADDRSTRLEN];
-    inet_ntop(current->ai_family, current->ai_addr, addr, INET6_ADDRSTRLEN);
+
+    getnameinfo(current->ai_addr, current->ai_addrlen, addr, INET6_ADDRSTRLEN,
+                NULL, 0, NI_NUMERICHOST);
+
     result->push_back(addr);
   }
+
   freeaddrinfo(ai);
-#else
-  const hostent* addrs = gethostbyname(0);
-  if (addrs == 0)
-    throw rdr::SystemException("gethostbyname", errorNumber);
-  if (addrs->h_addrtype != AF_INET)
-    throw rdr::Exception("getMyAddresses: bad family");
-  for (int i=0; addrs->h_addr_list[i] != 0; i++) {
-    const char* addrC = inet_ntoa(*((struct in_addr*)addrs->h_addr_list[i]));
-    char* addr = new char[strlen(addrC)+1];
-    strcpy(addr, addrC);
-    result->push_back(addr);
-  }
-#endif /* defined(HAVE_GETADDRINFO) && defined(HAVE_INET_PTON) */
 }
 
 int TcpListener::getMyPort() {
@@ -639,6 +553,115 @@
 }
 
 
+void network::createLocalTcpListeners(std::list<TcpListener> *listeners,
+                                      int port)
+{
+  std::list<TcpListener> new_listeners;
+  vnc_sockaddr_t sa;
+
+  initSockets();
+
+  if (UseIPv6) {
+    sa.u.sin6.sin6_family = AF_INET6;
+    sa.u.sin6.sin6_port = htons (port);
+    sa.u.sin6.sin6_addr = in6addr_loopback;
+    try {
+      new_listeners.push_back (TcpListener (&sa.u.sa, sizeof (sa.u.sin6)));
+    } catch (SocketException& e) {
+      // Ignore this if it is due to lack of address family support on
+      // the interface or on the system
+      if (e.err != EADDRNOTAVAIL && e.err != EAFNOSUPPORT)
+        // Otherwise, report the error
+        throw;
+    }
+  }
+  if (UseIPv4) {
+    sa.u.sin.sin_family = AF_INET;
+    sa.u.sin.sin_port = htons (port);
+    sa.u.sin.sin_addr.s_addr = htonl (INADDR_LOOPBACK);
+    try {
+      new_listeners.push_back (TcpListener (&sa.u.sa, sizeof (sa.u.sin)));
+    } catch (SocketException& e) {
+      // Ignore this if it is due to lack of address family support on
+      // the interface or on the system
+      if (e.err != EADDRNOTAVAIL && e.err != EAFNOSUPPORT)
+        // Otherwise, report the error
+        throw;
+    }
+  }
+
+  if (new_listeners.empty ())
+    throw SocketException("createLocalTcpListeners: no addresses available",
+                          EADDRNOTAVAIL);
+
+  listeners->splice (listeners->end(), new_listeners);
+}
+
+void network::createTcpListeners(std::list<TcpListener> *listeners,
+                                 const char *addr,
+                                 int port)
+{
+  std::list<TcpListener> new_listeners;
+
+  struct addrinfo *ai, *current, hints;
+  char service[16];
+  int result;
+
+  initSockets();
+
+  memset(&hints, 0, sizeof(struct addrinfo));
+  hints.ai_flags = AI_PASSIVE | AI_NUMERICSERV;
+  hints.ai_family = AF_UNSPEC;
+  hints.ai_socktype = SOCK_STREAM;
+  hints.ai_canonname = NULL;
+  hints.ai_addr = NULL;
+  hints.ai_next = NULL;
+
+  snprintf (service, sizeof (service) - 1, "%d", port);
+  service[sizeof (service) - 1] = '\0';
+  if ((result = getaddrinfo(addr, service, &hints, &ai)) != 0)
+    throw rdr::Exception("unable to resolve listening address: %s",
+                         gai_strerror(result));
+
+  for (current = ai; current != NULL; current = current->ai_next) {
+    switch (current->ai_family) {
+    case AF_INET:
+      if (!UseIPv4)
+        continue;
+      break;
+
+    case AF_INET6:
+      if (!UseIPv6)
+        continue;
+      break;
+
+    default:
+      continue;
+    }
+
+    try {
+      new_listeners.push_back(TcpListener (current->ai_addr,
+                                           current->ai_addrlen));
+    } catch (SocketException& e) {
+      // Ignore this if it is due to lack of address family support on
+      // the interface or on the system
+      if (e.err != EADDRNOTAVAIL && e.err != EAFNOSUPPORT) {
+        // Otherwise, report the error
+        freeaddrinfo(ai);
+        throw;
+      }
+    }
+  }
+  freeaddrinfo(ai);
+
+  if (new_listeners.empty ())
+    throw SocketException("createTcpListeners: no addresses available",
+                          EADDRNOTAVAIL);
+
+  listeners->splice (listeners->end(), new_listeners);
+}
+
+
 TcpFilter::TcpFilter(const char* spec) {
   rfb::CharArray tmp;
   tmp.buf = rfb::strDup(spec);
@@ -655,29 +678,69 @@
 
 
 static bool
-patternMatchIP(const TcpFilter::Pattern& pattern, const char* value) {
-  unsigned long address = inet_addr((char *)value);
-  if (address == INADDR_NONE) return false;
-  return ((pattern.address & pattern.mask) == (address & pattern.mask));
+patternMatchIP(const TcpFilter::Pattern& pattern, vnc_sockaddr_t *sa) {
+  switch (pattern.address.u.sa.sa_family) {
+    unsigned long address;
+
+  case AF_INET:
+    if (sa->u.sa.sa_family != AF_INET)
+      return false;
+
+    address = sa->u.sin.sin_addr.s_addr;
+    if (address == htonl (INADDR_NONE)) return false;
+    return ((pattern.address.u.sin.sin_addr.s_addr &
+             pattern.mask.u.sin.sin_addr.s_addr) ==
+            (address & pattern.mask.u.sin.sin_addr.s_addr));
+
+  case AF_INET6:
+    if (sa->u.sa.sa_family != AF_INET6)
+      return false;
+
+    for (unsigned int n = 0; n < 16; n++) {
+      unsigned int bits = (n + 1) * 8;
+      unsigned int mask;
+      if (pattern.prefixlen > bits)
+        mask = 0xff;
+      else {
+        unsigned int lastbits = 0xff;
+        lastbits <<= bits - pattern.prefixlen;
+        mask = lastbits & 0xff;
+      }
+
+      if ((pattern.address.u.sin6.sin6_addr.s6_addr[n] & mask) !=
+          (sa->u.sin6.sin6_addr.s6_addr[n] & mask))
+        return false;
+
+      if (mask < 0xff)
+        break;
+    }
+
+    return true;
+
+  case AF_UNSPEC:
+    // Any address matches
+    return true;
+
+  default:
+    break;
+  }
+
+  return false;
 }
 
 bool
 TcpFilter::verifyConnection(Socket* s) {
   rfb::CharArray name;
-
-#ifdef HAVE_GETADDRINFO
   vnc_sockaddr_t sa;
   socklen_t sa_size = sizeof(sa);
-  if (getpeername(s->getFd(), &sa.u.sa, &sa_size) != 0 ||
-      sa.u.sa.sa_family != AF_INET)
-    /* Matching only works for IPv4 */
+
+  if (getpeername(s->getFd(), &sa.u.sa, &sa_size) != 0)
     return false;
-#endif /* HAVE_GETADDRINFO */
 
   name.buf = s->getPeerAddress();
   std::list<TcpFilter::Pattern>::iterator i;
   for (i=filter.begin(); i!=filter.end(); i++) {
-    if (patternMatchIP(*i, name.buf)) {
+    if (patternMatchIP(*i, &sa)) {
       switch ((*i).action) {
       case Accept:
         vlog.debug("ACCEPT %s", name.buf);
@@ -701,31 +764,102 @@
 TcpFilter::Pattern TcpFilter::parsePattern(const char* p) {
   TcpFilter::Pattern pattern;
 
-  bool expandMask = false;
-  rfb::CharArray addr, mask;
+  rfb::CharArray addr, pref;
+  bool prefix_specified;
+  int family;
 
-  if (rfb::strSplit(&p[1], '/', &addr.buf, &mask.buf)) {
-    if (rfb::strContains(mask.buf, '.')) {
-      pattern.mask = inet_addr(mask.buf);
-    } else {
-      pattern.mask = atoi(mask.buf);
-      expandMask = true;
-    }
+  prefix_specified = rfb::strSplit(&p[1], '/', &addr.buf, &pref.buf);
+  if (addr.buf[0] == '\0') {
+    // Match any address
+    memset (&pattern.address, 0, sizeof (pattern.address));
+    pattern.address.u.sa.sa_family = AF_UNSPEC;
+    pattern.prefixlen = 0;
   } else {
-    pattern.mask = 32;
-    expandMask = true;
-  }
-  if (expandMask) {
-    unsigned long expanded = 0;
-    // *** check endianness!
-    for (int i=0; i<(int)pattern.mask; i++)
-      expanded |= 1<<(31-i);
-    pattern.mask = htonl(expanded);
+    struct addrinfo hints;
+    struct addrinfo *ai;
+    char *p = addr.buf;
+    int result;
+    memset (&hints, 0, sizeof (hints));
+    hints.ai_family = AF_UNSPEC;
+    hints.ai_flags = AI_NUMERICHOST;
+
+    // Take out brackets, if present
+    if (*p == '[') {
+      size_t len;
+      p++;
+      len = strlen (p);
+      if (len > 0 && p[len - 1] == ']')
+        p[len - 1] = '\0';
+    }
+
+    if ((result = getaddrinfo (p, NULL, &hints, &ai)) != 0) {
+      throw Exception("unable to resolve host by name: %s",
+                      gai_strerror(result));
+    }
+
+    memcpy (&pattern.address.u.sa, ai->ai_addr, ai->ai_addrlen);
+    freeaddrinfo (ai);
+
+    family = pattern.address.u.sa.sa_family;
+
+    if (prefix_specified) {
+      if (family == AF_INET &&
+          rfb::strContains(pref.buf, '.')) {
+        throw Exception("mask no longer supported for filter, "
+                        "use prefix instead");
+      }
+
+      pattern.prefixlen = (unsigned int) atoi(pref.buf);
+    } else {
+      switch (family) {
+      case AF_INET:
+        pattern.prefixlen = 32;
+        break;
+      case AF_INET6:
+        pattern.prefixlen = 128;
+        break;
+      default:
+        throw Exception("unknown address family");
+      }
+    }
   }
 
-  pattern.address = inet_addr(addr.buf) & pattern.mask;
-  if ((pattern.address == INADDR_NONE) ||
-      (pattern.address == 0)) pattern.mask = 0;
+  family = pattern.address.u.sa.sa_family;
+
+  if (pattern.prefixlen > (family == AF_INET ? 32: 128))
+    throw Exception("invalid prefix length for filter address: %u",
+                    pattern.prefixlen);
+
+  // Compute mask from address and prefix length
+  memset (&pattern.mask, 0, sizeof (pattern.mask));
+  switch (family) {
+    unsigned long mask;
+  case AF_INET:
+    mask = 0;
+    for (unsigned int i=0; i<pattern.prefixlen; i++)
+      mask |= 1<<(31-i);
+    pattern.mask.u.sin.sin_addr.s_addr = htonl(mask);
+    break;
+
+  case AF_INET6:
+    for (unsigned int n = 0; n < 16; n++) {
+      unsigned int bits = (n + 1) * 8;
+      if (pattern.prefixlen > bits)
+        pattern.mask.u.sin6.sin6_addr.s6_addr[n] = 0xff;
+      else {
+        unsigned int lastbits = 0xff;
+        lastbits <<= bits - pattern.prefixlen;
+        pattern.mask.u.sin6.sin6_addr.s6_addr[n] = lastbits & 0xff;
+        break;
+      }
+    }
+    break;
+  case AF_UNSPEC:
+    // No mask to compute
+    break;
+  default:
+    ; /* not reached */
+  }
 
   switch(p[0]) {
   case '+': pattern.action = TcpFilter::Accept; break;
@@ -737,21 +871,39 @@
 }
 
 char* TcpFilter::patternToStr(const TcpFilter::Pattern& p) {
-  in_addr tmp;
-  rfb::CharArray addr, mask;
-  tmp.s_addr = p.address;
-  addr.buf = rfb::strDup(inet_ntoa(tmp));
-  tmp.s_addr = p.mask;
-  mask.buf = rfb::strDup(inet_ntoa(tmp));
-  char* result = new char[strlen(addr.buf)+1+strlen(mask.buf)+1+1];
+  rfb::CharArray addr;
+  char buffer[INET6_ADDRSTRLEN + 2];
+
+  if (p.address.u.sa.sa_family == AF_INET) {
+    getnameinfo(&p.address.u.sa, sizeof(p.address.u.sin),
+                buffer, sizeof (buffer), NULL, 0, NI_NUMERICHOST);
+    addr.buf = rfb::strDup(buffer);
+  } else if (p.address.u.sa.sa_family == AF_INET6) {
+    buffer[0] = '[';
+    getnameinfo(&p.address.u.sa, sizeof(p.address.u.sin6),
+                buffer + 1, sizeof (buffer) - 2, NULL, 0, NI_NUMERICHOST);
+    strcat(buffer, "]");
+    addr.buf = rfb::strDup(buffer);
+  } else if (p.address.u.sa.sa_family == AF_UNSPEC)
+    addr.buf = rfb::strDup("");
+
+  char action;
   switch (p.action) {
-  case Accept: result[0] = '+'; break;
-  case Reject: result[0] = '-'; break;
-  case Query: result[0] = '?'; break;
+  case Accept: action = '+'; break;
+  case Reject: action = '-'; break;
+  default:
+  case Query: action = '?'; break;
   };
-  result[1] = 0;
-  strcat(result, addr.buf);
-  strcat(result, "/");
-  strcat(result, mask.buf);
+  size_t resultlen = (1                   // action
+                      + strlen (addr.buf) // address
+                      + 1                 // slash
+                      + 3                 // prefix length, max 128
+                      + 1);               // terminating nul
+  char* result = new char[resultlen];
+  if (addr.buf[0] == '\0')
+    snprintf(result, resultlen, "%c", action);
+  else
+    snprintf(result, resultlen, "%c%s/%u", action, addr.buf, p.prefixlen);
+
   return result;
 }
diff --git a/common/network/TcpSocket.h b/common/network/TcpSocket.h
index b0bba53..979cd4b 100644
--- a/common/network/TcpSocket.h
+++ b/common/network/TcpSocket.h
@@ -30,6 +30,14 @@
 
 #include <network/Socket.h>
 
+#ifdef WIN32
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#else
+#include <sys/socket.h> /* for socklen_t */
+#include <netinet/in.h> /* for struct sockaddr_in */
+#endif
+
 #include <list>
 
 /* Tunnelling support. */
@@ -66,20 +74,33 @@
 
   class TcpListener : public SocketListener {
   public:
-    TcpListener(const char *listenaddr, int port, bool localhostOnly=false,
-		int sock=-1, bool close=true);
+    TcpListener(const struct sockaddr *listenaddr, socklen_t listenaddrlen);
+    TcpListener(int sock);
+    TcpListener(const TcpListener& other);
+    TcpListener& operator= (const TcpListener& other);
     virtual ~TcpListener();
 
     virtual void shutdown();
     virtual Socket* accept();
 
-    void getMyAddresses(std::list<char*>* addrs);
+    static void getMyAddresses(std::list<char*>* result);
     int getMyPort();
-
-  private:
-    bool closeFd;
   };
 
+  void createLocalTcpListeners(std::list<TcpListener> *listeners,
+                               int port);
+  void createTcpListeners(std::list<TcpListener> *listeners,
+                          const char *addr,
+                          int port);
+
+  typedef struct vnc_sockaddr {
+    union {
+      sockaddr     sa;
+      sockaddr_in  sin;
+      sockaddr_in6 sin6;
+    } u;
+  } vnc_sockaddr_t;
+
   class TcpFilter : public ConnectionFilter {
   public:
     TcpFilter(const char* filter);
@@ -90,8 +111,10 @@
     typedef enum {Accept, Reject, Query} Action;
     struct Pattern {
       Action action;
-      unsigned long address;
-      unsigned long mask;
+      vnc_sockaddr_t address;
+      unsigned int prefixlen;
+
+      vnc_sockaddr_t mask; // computed from address and prefix
     };
     static Pattern parsePattern(const char* s);
     static char* patternToStr(const Pattern& p);
diff --git a/config.h.in b/config.h.in
index fb697fa..345af7d 100644
--- a/config.h.in
+++ b/config.h.in
@@ -1,9 +1,6 @@
 #define PACKAGE_NAME "@CMAKE_PROJECT_NAME@"
 #define PACKAGE_VERSION "@VERSION@"
 
-#cmakedefine HAVE_INET_ATON
-#cmakedefine HAVE_INET_PTON
-#cmakedefine HAVE_GETADDRINFO
 #cmakedefine HAVE_ACTIVE_DESKTOP_H
 #cmakedefine HAVE_ACTIVE_DESKTOP_L
 #cmakedefine ENABLE_NLS 1
diff --git a/unix/x0vncserver/x0vncserver.cxx b/unix/x0vncserver/x0vncserver.cxx
index a9b328f..2d9a066 100644
--- a/unix/x0vncserver/x0vncserver.cxx
+++ b/unix/x0vncserver/x0vncserver.cxx
@@ -477,6 +477,8 @@
   signal(SIGINT, CleanupSignalHandler);
   signal(SIGTERM, CleanupSignalHandler);
 
+  std::list<TcpListener> listeners;
+
   try {
     TXWindow::init(dpy,"x0vncserver");
     Geometry geo(DisplayWidth(dpy, DefaultScreen(dpy)),
@@ -491,13 +493,16 @@
     QueryConnHandler qcHandler(dpy, &server);
     server.setQueryConnectionHandler(&qcHandler);
 
-    TcpListener listener(NULL, (int)rfbport);
+    createTcpListeners(&listeners, 0, (int)rfbport);
     vlog.info("Listening on port %d", (int)rfbport);
 
     const char *hostsData = hostsFile.getData();
     FileTcpFilter fileTcpFilter(hostsData);
     if (strlen(hostsData) != 0)
-      listener.setFilter(&fileTcpFilter);
+      for (std::list<TcpListener>::iterator i = listeners.begin();
+           i != listeners.end();
+           i++)
+        (*i).setFilter(&fileTcpFilter);
     delete[] hostsData;
 
     PollingScheduler sched((int)pollingCycle, (int)maxProcessorUsage);
@@ -513,7 +518,11 @@
 
       FD_ZERO(&rfds);
       FD_SET(ConnectionNumber(dpy), &rfds);
-      FD_SET(listener.getFd(), &rfds);
+      for (std::list<TcpListener>::iterator i = listeners.begin();
+           i != listeners.end();
+           i++)
+        FD_SET((*i).getFd(), &rfds);
+
       server.getSockets(&sockets);
       int clients_connected = 0;
       for (i = sockets.begin(); i != sockets.end(); i++) {
@@ -558,12 +567,16 @@
       }
 
       // Accept new VNC connections
-      if (FD_ISSET(listener.getFd(), &rfds)) {
-        Socket* sock = listener.accept();
-        if (sock) {
-          server.addSocket(sock);
-        } else {
-          vlog.status("Client connection rejected");
+      for (std::list<TcpListener>::iterator i = listeners.begin();
+           i != listeners.end();
+           i++) {
+        if (FD_ISSET((*i).getFd(), &rfds)) {
+          Socket* sock = (*i).accept();
+          if (sock) {
+            server.addSocket(sock);
+          } else {
+            vlog.status("Client connection rejected");
+          }
         }
       }
 
diff --git a/unix/xserver/hw/vnc/RFBGlue.cc b/unix/xserver/hw/vnc/RFBGlue.cc
index 53d5bdb..19338fc 100644
--- a/unix/xserver/hw/vnc/RFBGlue.cc
+++ b/unix/xserver/hw/vnc/RFBGlue.cc
@@ -187,7 +187,10 @@
 int vncIsTCPPortUsed(int port)
 {
   try {
-    network::TcpListener l(NULL, port);
+    // Attempt to create TCPListeners on that port.
+    // They go out of scope immediately and are destroyed.
+    std::list<network::TcpListener> dummy;
+    network::createTcpListeners (&dummy, 0, port);
   } catch (rdr::Exception& e) {
     return 0;
   }
diff --git a/unix/xserver/hw/vnc/XserverDesktop.cc b/unix/xserver/hw/vnc/XserverDesktop.cc
index 54e09cb..165afbb 100644
--- a/unix/xserver/hw/vnc/XserverDesktop.cc
+++ b/unix/xserver/hw/vnc/XserverDesktop.cc
@@ -91,14 +91,14 @@
 
 
 XserverDesktop::XserverDesktop(int screenIndex_,
-                               network::TcpListener* listener_,
-                               network::TcpListener* httpListener_,
+                               std::list<network::TcpListener> listeners_,
+                               std::list<network::TcpListener> httpListeners_,
                                const char* name, const rfb::PixelFormat &pf,
                                int width, int height,
                                void* fbptr, int stride)
   : screenIndex(screenIndex_),
     server(0), httpServer(0),
-    listener(listener_), httpListener(httpListener_),
+    listeners(listeners_), httpListeners(httpListeners_),
     deferredUpdateTimerSet(false), directFbptr(true),
     queryConnectId(0)
 {
@@ -108,7 +108,7 @@
   setFramebuffer(width, height, fbptr, stride);
   server->setQueryConnectionHandler(this);
 
-  if (httpListener)
+  if (!httpListeners.empty ())
     httpServer = new FileHTTPServer(this);
 }
 
@@ -222,7 +222,7 @@
   }
   if (strcmp(varName, "$PORT") == 0) {
     char* str = new char[10];
-    sprintf(str, "%d", listener ? listener->getMyPort() : 0);
+    sprintf(str, "%d", listeners.empty () ? 0 : (*listeners.begin ()).getMyPort());
     return str;
   }
   if (strcmp(varName, "$WIDTH") == 0) {
@@ -393,14 +393,18 @@
 
     // Add all sockets we want read events for, after purging
     // any closed sockets.
-    if (listener)
-      FD_SET(listener->getFd(), fds);
-    if (httpListener)
-      FD_SET(httpListener->getFd(), fds);
+    for (std::list<network::TcpListener>::iterator i = listeners.begin();
+         i != listeners.end();
+         i++)
+      FD_SET((*i).getFd(), fds);
+    for (std::list<network::TcpListener>::iterator i = httpListeners.begin();
+         i != httpListeners.end();
+         i++)
+      FD_SET((*i).getFd(), fds);
 
     std::list<Socket*> sockets;
-    server->getSockets(&sockets);
     std::list<Socket*>::iterator i;
+    server->getSockets(&sockets);
     for (i = sockets.begin(); i != sockets.end(); i++) {
       int fd = (*i)->getFd();
       if ((*i)->isShutdown()) {
@@ -452,20 +456,24 @@
     // First check for file descriptors with something to do
     if (nfds >= 1) {
 
-      if (listener) {
-        if (FD_ISSET(listener->getFd(), fds)) {
-          FD_CLR(listener->getFd(), fds);
-          Socket* sock = listener->accept();
+      for (std::list<network::TcpListener>::iterator i = listeners.begin();
+           i != listeners.end();
+           i++) {
+        if (FD_ISSET((*i).getFd(), fds)) {
+          FD_CLR((*i).getFd(), fds);
+          Socket* sock = (*i).accept();
           sock->outStream().setBlocking(false);
           server->addSocket(sock);
           vlog.debug("new client, sock %d",sock->getFd());
         }
       }
 
-      if (httpListener) {
-        if (FD_ISSET(httpListener->getFd(), fds)) {
-          FD_CLR(httpListener->getFd(), fds);
-          Socket* sock = httpListener->accept();
+      for (std::list<network::TcpListener>::iterator i = httpListeners.begin();
+           i != httpListeners.end();
+           i++) {
+        if (FD_ISSET((*i).getFd(), fds)) {
+          FD_CLR((*i).getFd(), fds);
+          Socket* sock = (*i).accept();
           sock->outStream().setBlocking(false);
           httpServer->addSocket(sock);
           vlog.debug("new http client, sock %d",sock->getFd());
diff --git a/unix/xserver/hw/vnc/XserverDesktop.h b/unix/xserver/hw/vnc/XserverDesktop.h
index 7dcaa29..6909a76 100644
--- a/unix/xserver/hw/vnc/XserverDesktop.h
+++ b/unix/xserver/hw/vnc/XserverDesktop.h
@@ -50,8 +50,9 @@
                        public rfb::VNCServerST::QueryConnectionHandler {
 public:
 
-  XserverDesktop(int screenIndex, network::TcpListener* listener,
-                 network::TcpListener* httpListener_,
+  XserverDesktop(int screenIndex,
+                 std::list<network::TcpListener> listeners_,
+                 std::list<network::TcpListener> httpListeners_,
                  const char* name, const rfb::PixelFormat &pf,
                  int width, int height, void* fbptr, int stride);
   virtual ~XserverDesktop();
@@ -112,8 +113,8 @@
   int screenIndex;
   rfb::VNCServerST* server;
   rfb::HTTPServer* httpServer;
-  network::TcpListener* listener;
-  network::TcpListener* httpListener;
+  std::list<network::TcpListener> listeners;
+  std::list<network::TcpListener> httpListeners;
   bool deferredUpdateTimerSet;
   bool directFbptr;
   struct timeval dixTimeout;
diff --git a/unix/xserver/hw/vnc/vncExtInit.cc b/unix/xserver/hw/vnc/vncExtInit.cc
index 2277783..e307e31 100644
--- a/unix/xserver/hw/vnc/vncExtInit.cc
+++ b/unix/xserver/hw/vnc/vncExtInit.cc
@@ -134,33 +134,44 @@
     for (int scr = 0; scr < vncGetScreenCount(); scr++) {
 
       if (!desktop[scr]) {
-        network::TcpListener* listener = 0;
-        network::TcpListener* httpListener = 0;
+        std::list<network::TcpListener> listeners;
+        std::list<network::TcpListener> httpListeners;
         if (scr == 0 && vncInetdSock != -1) {
           if (network::TcpSocket::isSocket(vncInetdSock) &&
               !network::TcpSocket::isConnected(vncInetdSock))
           {
-            listener = new network::TcpListener(NULL, 0, 0, vncInetdSock, true);
+            listeners.push_back (network::TcpListener(vncInetdSock));
             vlog.info("inetd wait");
           }
         } else {
+          const char *addr = interface;
           int port = rfbport;
           if (port == 0) port = 5900 + atoi(vncGetDisplay());
           port += 1000 * scr;
-          if (strcasecmp(interface, "all") == 0)
-            listener = new network::TcpListener(NULL, port, localhostOnly);
+          if (strcasecmp(addr, "all") == 0)
+            addr = 0;
+          if (localhostOnly)
+            network::createLocalTcpListeners(&listeners, port);
           else
-            listener = new network::TcpListener(interface, port, localhostOnly);
+            network::createTcpListeners(&listeners, addr, port);
+
           vlog.info("Listening for VNC connections on %s interface(s), port %d",
-                    (const char*)interface, port);
+                    localhostOnly ? "local" : (const char*)interface,
+                    port);
+
           CharArray httpDirStr(httpDir.getData());
           if (httpDirStr.buf[0]) {
             port = httpPort;
             if (port == 0) port = 5800 + atoi(vncGetDisplay());
             port += 1000 * scr;
-            httpListener = new network::TcpListener(interface, port, localhostOnly);
+            if (localhostOnly)
+              network::createLocalTcpListeners(&httpListeners, port);
+            else
+              network::createTcpListeners(&httpListeners, addr, port);
+
             vlog.info("Listening for HTTP connections on %s interface(s), port %d",
-                      (const char*)interface, port);
+                      localhostOnly ? "local" : (const char*)interface,
+                      port);
           }
         }
 
@@ -168,8 +179,8 @@
         PixelFormat pf = vncGetPixelFormat(scr);
 
         desktop[scr] = new XserverDesktop(scr,
-                                          listener,
-                                          httpListener,
+                                          listeners,
+                                          httpListeners,
                                           desktopNameStr.buf,
                                           pf,
                                           vncGetScreenWidth(scr),
@@ -178,7 +189,7 @@
                                           vncFbstride[scr]);
         vlog.info("created VNC server for screen %d", scr);
 
-        if (scr == 0 && vncInetdSock != -1 && !listener) {
+        if (scr == 0 && vncInetdSock != -1 && listeners.empty()) {
           network::Socket* sock = new network::TcpSocket(vncInetdSock);
           desktop[scr]->addClient(sock, false);
           vlog.info("added inetd sock");
diff --git a/vncviewer/vncviewer.cxx b/vncviewer/vncviewer.cxx
index 5f84679..6fe6356 100644
--- a/vncviewer/vncviewer.cxx
+++ b/vncviewer/vncviewer.cxx
@@ -532,15 +532,45 @@
 #endif
 
   if (listenMode) {
+    std::list<TcpListener> listeners;
     try {
       int port = 5500;
       if (isdigit(vncServerName[0]))
         port = atoi(vncServerName);
 
-      TcpListener listener(NULL, port);
+      createTcpListeners(&listeners, 0, port);
 
       vlog.info(_("Listening on port %d\n"), port);
-      sock = listener.accept();   
+
+      /* Wait for a connection */
+      while (sock == NULL) {
+        fd_set rfds;
+        FD_ZERO(&rfds);
+        for (std::list<TcpListener>::iterator i = listeners.begin();
+             i != listeners.end();
+             i++)
+          FD_SET((*i).getFd(), &rfds);
+
+        int n = select(FD_SETSIZE, &rfds, 0, 0, 0);
+        if (n < 0) {
+          if (errno == EINTR) {
+            vlog.debug("Interrupted select() system call");
+            continue;
+          } else {
+            throw rdr::SystemException("select", errno);
+          }
+        }
+
+        for (std::list<TcpListener>::iterator i = listeners.begin ();
+             i != listeners.end();
+             i++)
+          if (FD_ISSET((*i).getFd(), &rfds)) {
+            sock = (*i).accept();
+            if (sock)
+              /* Got a connection */
+              break;
+          }
+      }
     } catch (rdr::Exception& e) {
       vlog.error("%s", e.str());
       fl_alert("%s", e.str());
diff --git a/win/rfb_win32/Dialog.cxx b/win/rfb_win32/Dialog.cxx
index 6b52244..c6f303c 100644
--- a/win/rfb_win32/Dialog.cxx
+++ b/win/rfb_win32/Dialog.cxx
@@ -86,21 +86,17 @@
 }
 
 void Dialog::setItemChecked(int id, bool state) {
-  dlog.debug("bool[%d]=%d", id, (int)state);
   SendMessage(GetDlgItem(handle, id), BM_SETCHECK, state ? BST_CHECKED : BST_UNCHECKED, 0);
 }
 void Dialog::setItemInt(int id, int value) {
-  dlog.debug("int[%d]=%d", id, value);
   SetDlgItemInt(handle, id, value, TRUE);
 }
 void Dialog::setItemString(int id, const TCHAR* s) {
-  dlog.debug("string[%d]=%s", id, (const char*)CStr(s));
   SetDlgItemText(handle, id, s);
 }
 
 
 void Dialog::enableItem(int id, bool state) {
-  dlog.debug("enable[%d]=%d", id, (int)state);
   EnableWindow(GetDlgItem(handle, id), state);
 }
 
@@ -361,7 +357,6 @@
 }
 
 void PropSheet::reInitPages() {
-  plog.debug("reInitPages %p", handle);
   std::list<PropSheetPage*>::iterator pspi;
   for (pspi=pages.begin(); pspi!=pages.end(); pspi++) {
     if ((*pspi)->handle)
@@ -370,7 +365,6 @@
 }
 
 bool PropSheet::commitPages() {
-  plog.debug("commitPages %p", handle);
   bool result = true;
   std::list<PropSheetPage*>::iterator pspi;
   for (pspi=pages.begin(); pspi!=pages.end(); pspi++) {
@@ -383,7 +377,6 @@
 
 void PropSheetPage::setChanged(bool changed) {
   if (propSheet) {
-    plog.debug("setChanged[%p(%p)]=%d", handle, propSheet->handle, (int)changed);
     if (changed)
       PropSheet_Changed(propSheet->handle, handle);
     else
diff --git a/win/rfb_win32/SocketManager.cxx b/win/rfb_win32/SocketManager.cxx
index d4f1965..b073b8f 100644
--- a/win/rfb_win32/SocketManager.cxx
+++ b/win/rfb_win32/SocketManager.cxx
@@ -174,7 +174,7 @@
       vlog.info("deleting listening socket");
       remListener(li.sock);
     } else if (network_events.lNetworkEvents & FD_ADDRESS_LIST_CHANGE) {
-      li.notifier->processAddressChange(li.sock);
+      li.notifier->processAddressChange();
       requestAddressChangeEvents(li.sock);
     } else {
       vlog.error("unknown listener event: %lx", network_events.lNetworkEvents);
diff --git a/win/rfb_win32/SocketManager.h b/win/rfb_win32/SocketManager.h
index ef35974..c3c8faf 100644
--- a/win/rfb_win32/SocketManager.h
+++ b/win/rfb_win32/SocketManager.h
@@ -48,7 +48,7 @@
       class AddressChangeNotifier {
       public:
         virtual ~AddressChangeNotifier() {}
-        virtual void processAddressChange(network::SocketListener* sl) = 0;
+        virtual void processAddressChange() = 0;
       };
 
       // Add a listening socket.  Incoming connections will be added to the supplied
diff --git a/win/vncconfig/vncconfig.cxx b/win/vncconfig/vncconfig.cxx
index 5719397..3209298 100644
--- a/win/vncconfig/vncconfig.cxx
+++ b/win/vncconfig/vncconfig.cxx
@@ -16,6 +16,7 @@
  * USA.
  */
 
+#include <winsock2.h>
 #include <windows.h>
 #include <commctrl.h>
 #include <string.h>
diff --git a/win/winvnc/ManagedListener.cxx b/win/winvnc/ManagedListener.cxx
index e7728bc..25d8dc0 100644
--- a/win/winvnc/ManagedListener.cxx
+++ b/win/winvnc/ManagedListener.cxx
@@ -26,12 +26,16 @@
 
 
 ManagedListener::ManagedListener(SocketManager* mgr)
-: sock(0), filter(0), manager(mgr), addrChangeNotifier(0), server(0), port(0), localOnly(false) {
+: filter(0), manager(mgr), addrChangeNotifier(0), server(0), port(0), localOnly(false) {
 }
 
 ManagedListener::~ManagedListener() {
-  if (sock)
-    manager->remListener(sock);
+  if (!sockets.empty()) {
+    std::list<network::TcpListener>::iterator iter;
+    for (iter = sockets.begin(); iter != sockets.end(); ++iter)
+      manager->remListener(&*iter);
+    sockets.clear();
+  }
   delete filter;
 }
 
@@ -57,8 +61,11 @@
   vlog.info("set filter to %s", filterStr);
   delete filter;
   filter = new network::TcpFilter(filterStr);
-  if (sock && !localOnly)
-    sock->setFilter(filter);
+  if (!sockets.empty() && !localOnly) {
+    std::list<network::TcpListener>::iterator iter;
+    for (iter = sockets.begin(); iter != sockets.end(); ++iter)
+      iter->setFilter(filter);
+  }
 }
 
 void ManagedListener::setAddressChangeNotifier(SocketManager::AddressChangeNotifier* acn) {
@@ -68,26 +75,40 @@
   refresh();
 }
 
+bool ManagedListener::isListening() {
+  return !sockets.empty();
+}
 
 void ManagedListener::refresh() {
-  if (sock)
-    manager->remListener(sock);
-  sock = 0;
+  std::list<network::TcpListener>::iterator iter;
+  if (!sockets.empty()) {
+    for (iter = sockets.begin(); iter != sockets.end(); ++iter)
+      manager->remListener(&*iter);
+    sockets.clear();
+  }
   if (!server)
     return;
   try {
-    if (port)
-      sock = new network::TcpListener(NULL, port, localOnly);
+    if (port) {
+      if (localOnly)
+        network::createLocalTcpListeners(&sockets, port);
+      else
+        network::createTcpListeners(&sockets, NULL, port);
+    }
   } catch (rdr::Exception& e) {
     vlog.error("%s", e.str());
   }
-  if (sock) {
-    if (!localOnly)
-      sock->setFilter(filter);
+  if (!sockets.empty()) {
+    if (!localOnly) {
+      for (iter = sockets.begin(); iter != sockets.end(); ++iter)
+        iter->setFilter(filter);
+    }
     try {
-      manager->addListener(sock, server, addrChangeNotifier);
+      for (iter = sockets.begin(); iter != sockets.end(); ++iter)
+        manager->addListener(&*iter, server, addrChangeNotifier);
     } catch (...) {
-      sock = 0;
+      // FIXME: Should unwind what we've added
+      sockets.clear();
       throw;
     }
   }
diff --git a/win/winvnc/ManagedListener.h b/win/winvnc/ManagedListener.h
index e83aa0b..1c7099f 100644
--- a/win/winvnc/ManagedListener.h
+++ b/win/winvnc/ManagedListener.h
@@ -40,10 +40,12 @@
     void setPort(int port, bool localOnly=false);
     void setFilter(const char* filter);
     void setAddressChangeNotifier(rfb::win32::SocketManager::AddressChangeNotifier* acn);
-  
-    network::TcpListener* sock;
+
+    bool isListening();
+
   protected:
     void refresh();
+    std::list<network::TcpListener> sockets;
     network::TcpFilter* filter;
     rfb::win32::SocketManager* manager;
     rfb::win32::SocketManager::AddressChangeNotifier* addrChangeNotifier;
diff --git a/win/winvnc/VNCServerWin32.cxx b/win/winvnc/VNCServerWin32.cxx
index 36dbcee..27aea9f 100644
--- a/win/winvnc/VNCServerWin32.cxx
+++ b/win/winvnc/VNCServerWin32.cxx
@@ -43,7 +43,7 @@
 static IntParameter port_number("PortNumber",
   "TCP/IP port on which the server will accept connections", 5900);
 static StringParameter hosts("Hosts",
-  "Filter describing which hosts are allowed access to this server", "+0.0.0.0/0.0.0.0");
+  "Filter describing which hosts are allowed access to this server", "+");
 static BoolParameter localHost("LocalHost",
   "Only accept connections from via the local loop-back network interface", false);
 static BoolParameter queryOnlyIfLoggedOn("QueryOnlyIfLoggedOn",
@@ -90,8 +90,8 @@
 }
 
 
-void VNCServerWin32::processAddressChange(network::SocketListener* sock_) {
-  if (!trayIcon || (sock_ != rfbSock.sock))
+void VNCServerWin32::processAddressChange() {
+  if (!trayIcon)
     return;
 
   // Tool-tip prefix depends on server mode
@@ -101,8 +101,8 @@
 
   // Fetch the list of addresses
   std::list<char*> addrs;
-  if (rfbSock.sock)
-    rfbSock.sock->getMyAddresses(&addrs);
+  if (rfbSock.isListening())
+    TcpListener::getMyAddresses(&addrs);
   else
     addrs.push_front(strDup("Not accepting connections"));
 
@@ -136,7 +136,7 @@
   httpSock.setPort(http_port, localHost);
 
   // -=- Update the Java viewer's web page port number.
-  httpServer.setRFBport(rfbSock.sock ? port_number : 0);
+  httpServer.setRFBport(rfbSock.isListening() ? port_number : 0);
 
   // -=- Update the TCP address filter for both ports, if open.
   CharArray pattern(hosts.getData());
@@ -144,7 +144,7 @@
   httpSock.setFilter(pattern.buf);
 
   // -=- Update the tray icon tooltip text with IP addresses
-  processAddressChange(rfbSock.sock);
+  processAddressChange();
 }
 
 
diff --git a/win/winvnc/VNCServerWin32.h b/win/winvnc/VNCServerWin32.h
index 1feae36..b85814a 100644
--- a/win/winvnc/VNCServerWin32.h
+++ b/win/winvnc/VNCServerWin32.h
@@ -82,7 +82,7 @@
 
     // SocketManager::AddressChangeNotifier interface
     // Used to keep tray icon up to date
-    virtual void processAddressChange(network::SocketListener* sl);
+    virtual void processAddressChange();
 
     // RegConfig::Callback interface
     // Called via the EventManager whenver RegConfig sees the registry change