diff --git a/client/iface/device/device_netstack.go b/client/iface/device/device_netstack.go
index fc3cb0215..025715b98 100644
--- a/client/iface/device/device_netstack.go
+++ b/client/iface/device/device_netstack.go
@@ -1,6 +1,3 @@
-//go:build !android
-// +build !android
-
 package device
 
 import (
@@ -47,7 +44,7 @@ func NewNetstackDevice(name string, address wgaddr.Address, wgPort int, key stri
 	}
 }
 
-func (t *TunNetstackDevice) Create() (WGConfigurer, error) {
+func (t *TunNetstackDevice) create() (WGConfigurer, error) {
 	log.Info("create nbnetstack tun interface")
 
 	// TODO: get from service listener runtime IP
diff --git a/client/iface/device/device_netstack_android.go b/client/iface/device/device_netstack_android.go
new file mode 100644
index 000000000..45ae8ba7d
--- /dev/null
+++ b/client/iface/device/device_netstack_android.go
@@ -0,0 +1,7 @@
+//go:build android
+
+package device
+
+func (t *TunNetstackDevice) Create(routes []string, dns string, searchDomains []string) (WGConfigurer, error) {
+	return t.create()
+}
diff --git a/client/iface/device/device_netstack_generic.go b/client/iface/device/device_netstack_generic.go
new file mode 100644
index 000000000..4b3974f26
--- /dev/null
+++ b/client/iface/device/device_netstack_generic.go
@@ -0,0 +1,7 @@
+//go:build !android
+
+package device
+
+func (t *TunNetstackDevice) Create() (WGConfigurer, error) {
+	return t.create()
+}
diff --git a/client/iface/iface_new_android.go b/client/iface/iface_new_android.go
index c8babea32..132c64723 100644
--- a/client/iface/iface_new_android.go
+++ b/client/iface/iface_new_android.go
@@ -3,6 +3,7 @@ package iface
 import (
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/device"
+	"github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 )
@@ -16,6 +17,15 @@ func NewWGIFace(opts WGIFaceOpts) (*WGIface, error) {
 
 	iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, wgAddress)
 
+	if netstack.IsEnabled() {
+		wgIFace := &WGIface{
+			userspaceBind:  true,
+			tun:            device.NewNetstackDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, netstack.ListenAddr()),
+			wgProxyFactory: wgproxy.NewUSPFactory(iceBind),
+		}
+		return wgIFace, nil
+	}
+
 	wgIFace := &WGIface{
 		userspaceBind:  true,
 		tun:            device.NewTunDevice(wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, opts.MobileArgs.TunAdapter, opts.DisableDNS),
diff --git a/client/internal/stdnet/stdnet.go b/client/internal/stdnet/stdnet.go
index aa9fdd045..171cc42cb 100644
--- a/client/internal/stdnet/stdnet.go
+++ b/client/internal/stdnet/stdnet.go
@@ -9,6 +9,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/pion/transport/v3"
 	"github.com/pion/transport/v3/stdnet"
 )
@@ -32,9 +33,15 @@ type Net struct {
 // NewNetWithDiscover creates a new StdNet instance.
 func NewNetWithDiscover(iFaceDiscover ExternalIFaceDiscover, disallowList []string) (*Net, error) {
 	n := &Net{
-		iFaceDiscover:   newMobileIFaceDiscover(iFaceDiscover),
 		interfaceFilter: InterfaceFilter(disallowList),
 	}
+	// current ExternalIFaceDiscover implement in android-client https://github.dev/netbirdio/android-client
+	// so in android cli use pionDiscover
+	if netstack.IsEnabled() {
+		n.iFaceDiscover = pionDiscover{}
+	} else {
+		newMobileIFaceDiscover(iFaceDiscover)
+	}
 	return n, n.UpdateInterfaces()
 }
 
diff --git a/util/net/protectsocket_android.go b/util/net/protectsocket_android.go
index febed8a1e..00071461d 100644
--- a/util/net/protectsocket_android.go
+++ b/util/net/protectsocket_android.go
@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"sync"
 	"syscall"
+
+	"github.com/netbirdio/netbird/client/iface/netstack"
 )
 
 var (
@@ -19,6 +21,9 @@ func SetAndroidProtectSocketFn(fn func(fd int32) bool) {
 
 // ControlProtectSocket is a Control function that sets the fwmark on the socket
 func ControlProtectSocket(_, _ string, c syscall.RawConn) error {
+	if netstack.IsEnabled() {
+		return nil
+	}
 	var aErr error
 	err := c.Control(func(fd uintptr) {
 		androidProtectSocketLock.Lock()