diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c
index f342958e331..6cd52b14479 100644
--- a/src/openvpn/forward.c
+++ b/src/openvpn/forward.c
@@ -46,6 +46,9 @@
 
 #include "mstats.h"
 
+#include <sys/select.h>
+#include <sys/time.h>
+
 counter_type link_read_bytes_global;  /* GLOBAL */
 counter_type link_write_bytes_global; /* GLOBAL */
 
@@ -611,6 +614,21 @@ buffer_turnover(const uint8_t *orig_buf, struct buffer *dest_stub, struct buffer
     }
 }
 
+uint8_t *buff_prepsize(uint8_t *buff, int *size)
+{
+    buff[0] = ((*size >> 8) & 0xff);
+    buff[1] = ((*size >> 0) & 0xff);
+    buff += 2;
+    return buff;
+}
+
+uint8_t *buff_postsize(uint8_t *buff, int *size)
+{
+    *size = ((buff[0] << 8) + (buff[1] << 0));
+    buff += 2;
+    return buff;
+}
+
 /*
  * Compress, fragment, encrypt and HMAC-sign an outgoing packet.
  * Input: c->c2.buf
@@ -888,7 +906,7 @@ socks_postprocess_incoming_link(struct context *c, struct link_socket *sock)
 {
     if (sock->socks_proxy && sock->info.proto == PROTO_UDP)
     {
-        socks_process_incoming_udp(&c->c2.buf, &c->c2.from);
+        socks_process_incoming_udp(&c->c2.buf2, &c->c2.from);
     }
 }
 
@@ -918,7 +936,7 @@ link_socket_write_post_size_adjust(int *size, int size_delta, struct buffer *buf
 }
 
 /*
- * Output: c->c2.buf
+ * Output: c->c2.buf2
  */
 
 void
@@ -934,10 +952,10 @@ read_incoming_link(struct context *c, struct link_socket *sock)
 
     perf_push(PERF_READ_IN_LINK);
 
-    c->c2.buf = c->c2.buffers->read_link_buf;
-    ASSERT(buf_init(&c->c2.buf, c->c2.frame.buf.headroom));
+    c->c2.buf2 = c->c2.buffers->read_link_buf;
+    ASSERT(buf_init(&c->c2.buf2, c->c2.frame.buf.headroom));
 
-    status = link_socket_read(sock, &c->c2.buf, &c->c2.from);
+    status = link_socket_read(sock, &c->c2.buf2, &c->c2.from);
 
     if (socket_connection_reset(sock, status))
     {
@@ -993,17 +1011,17 @@ process_incoming_link_part1(struct context *c, struct link_socket_info *lsi, boo
     struct gc_arena gc = gc_new();
     bool decrypt_status = false;
 
-    if (c->c2.buf.len > 0)
+    if (c->c2.buf2.len > 0)
     {
-        c->c2.link_read_bytes += c->c2.buf.len;
-        link_read_bytes_global += c->c2.buf.len;
+        c->c2.link_read_bytes += c->c2.buf2.len;
+        link_read_bytes_global += c->c2.buf2.len;
 #ifdef ENABLE_MEMSTATS
         if (mmap_stats)
         {
             mmap_stats->link_read_bytes = link_read_bytes_global;
         }
 #endif
-        c->c2.original_recv_size = c->c2.buf.len;
+        c->c2.original_recv_size = c->c2.buf2.len;
     }
     else
     {
@@ -1016,21 +1034,22 @@ process_incoming_link_part1(struct context *c, struct link_socket_info *lsi, boo
     {
         if (!ask_gremlin(c->options.gremlin))
         {
-            c->c2.buf.len = 0;
+            c->c2.buf2.len = 0;
         }
-        corrupt_gremlin(&c->c2.buf, c->options.gremlin);
+        corrupt_gremlin(&c->c2.buf2, c->options.gremlin);
     }
 #endif
 
     /* log incoming packet */
 #ifdef LOG_RW
-    if (c->c2.log_rw && c->c2.buf.len > 0)
+    if (c->c2.log_rw && c->c2.buf2.len > 0)
     {
         fprintf(stderr, "R");
     }
 #endif
+
     msg(D_LINK_RW, "%s READ [%d] from %s: %s", proto2ascii(lsi->proto, lsi->af, true),
-        BLEN(&c->c2.buf), print_link_socket_actual(&c->c2.from, &gc), PROTO_DUMP(&c->c2.buf, &gc));
+        BLEN(&c->c2.buf2), print_link_socket_actual(&c->c2.from, &gc), PROTO_DUMP(&c->c2.buf2, &gc));
 
     /*
      * Good, non-zero length packet received.
@@ -1039,18 +1058,18 @@ process_incoming_link_part1(struct context *c, struct link_socket_info *lsi, boo
      * If any stage fails, it sets buf.len to 0 or -1,
      * telling downstream stages to ignore the packet.
      */
-    if (c->c2.buf.len > 0)
+    if (c->c2.buf2.len > 0)
     {
         struct crypto_options *co = NULL;
         const uint8_t *ad_start = NULL;
-        if (!link_socket_verify_incoming_addr(&c->c2.buf, lsi, &c->c2.from))
+        if (!link_socket_verify_incoming_addr(&c->c2.buf2, lsi, &c->c2.from))
         {
-            link_socket_bad_incoming_addr(&c->c2.buf, lsi, &c->c2.from);
+            link_socket_bad_incoming_addr(&c->c2.buf2, lsi, &c->c2.from);
         }
 
         if (c->c2.tls_multi)
         {
-            uint8_t opcode = *BPTR(&c->c2.buf) >> P_OPCODE_SHIFT;
+            uint8_t opcode = *BPTR(&c->c2.buf2) >> P_OPCODE_SHIFT;
 
             /*
              * If DCO is enabled, the kernel drivers require that the
@@ -1064,7 +1083,7 @@ process_incoming_link_part1(struct context *c, struct link_socket_info *lsi, boo
             {
                 msg(D_LINK_ERRORS, "Data Channel Offload doesn't support DATA_V1 packets. "
                                    "Upgrade your server to 2.4.5 or newer.");
-                c->c2.buf.len = 0;
+                c->c2.buf2.len = 0;
             }
 
             /*
@@ -1077,7 +1096,7 @@ process_incoming_link_part1(struct context *c, struct link_socket_info *lsi, boo
              * will load crypto_options with the correct encryption key
              * and return false.
              */
-            if (tls_pre_decrypt(c->c2.tls_multi, &c->c2.from, &c->c2.buf, &co, floated, &ad_start))
+            if (tls_pre_decrypt(c->c2.tls_multi, &c->c2.from, &c->c2.buf2, &co, floated, &ad_start))
             {
                 interval_action(&c->c2.tmp_int);
 
@@ -1100,12 +1119,12 @@ process_incoming_link_part1(struct context *c, struct link_socket_info *lsi, boo
          */
         if (c->c2.tls_multi && c->c2.tls_multi->multi_state < CAS_CONNECT_DONE)
         {
-            c->c2.buf.len = 0;
+            c->c2.buf2.len = 0;
         }
 
         /* authenticate and decrypt the incoming packet */
         decrypt_status =
-            openvpn_decrypt(&c->c2.buf, c->c2.buffers->decrypt_buf, co, &c->c2.frame, ad_start);
+            openvpn_decrypt(&c->c2.buf2, c->c2.buffers->decrypt_buf, co, &c->c2.frame, ad_start);
 
         if (!decrypt_status
             /* on the instance context we have only one socket, so just check the first one */
@@ -1130,12 +1149,12 @@ void
 process_incoming_link_part2(struct context *c, struct link_socket_info *lsi,
                             const uint8_t *orig_buf)
 {
-    if (c->c2.buf.len > 0)
+    if (c->c2.buf2.len > 0)
     {
 #ifdef ENABLE_FRAGMENT
         if (c->c2.fragment)
         {
-            fragment_incoming(c->c2.fragment, &c->c2.buf, &c->c2.frame_fragment);
+            fragment_incoming(c->c2.fragment, &c->c2.buf2, &c->c2.frame_fragment);
         }
 #endif
 
@@ -1143,14 +1162,14 @@ process_incoming_link_part2(struct context *c, struct link_socket_info *lsi,
         /* decompress the incoming packet */
         if (c->c2.comp_context)
         {
-            (*c->c2.comp_context->alg.decompress)(&c->c2.buf, c->c2.buffers->decompress_buf,
+            (*c->c2.comp_context->alg.decompress)(&c->c2.buf2, c->c2.buffers->decompress_buf,
                                                   c->c2.comp_context, &c->c2.frame);
         }
 #endif
 
 #ifdef PACKET_TRUNCATION_CHECK
-        /* if (c->c2.buf.len > 1) --c->c2.buf.len; */
-        ipv4_packet_size_verify(BPTR(&c->c2.buf), BLEN(&c->c2.buf), TUNNEL_TYPE(c->c1.tuntap),
+        /* if (c->c2.buf2.len > 1) --c->c2.buf2.len; */
+        ipv4_packet_size_verify(BPTR(&c->c2.buf2), BLEN(&c->c2.buf2), TUNNEL_TYPE(c->c1.tuntap),
                                 "POST_DECRYPT", &c->c2.n_trunc_post_decrypt);
 #endif
 
@@ -1163,39 +1182,39 @@ process_incoming_link_part2(struct context *c, struct link_socket_info *lsi,
          *
          * Also, update the persisted version of our packet-id.
          */
-        if (!TLS_MODE(c) && c->c2.buf.len > 0)
+        if (!TLS_MODE(c) && c->c2.buf2.len > 0)
         {
             link_socket_set_outgoing_addr(lsi, &c->c2.from, NULL, c->c2.es);
         }
 
         /* reset packet received timer */
-        if (c->options.ping_rec_timeout && c->c2.buf.len > 0)
+        if (c->options.ping_rec_timeout && c->c2.buf2.len > 0)
         {
             event_timeout_reset(&c->c2.ping_rec_interval);
         }
 
         /* increment authenticated receive byte count */
-        if (c->c2.buf.len > 0)
+        if (c->c2.buf2.len > 0)
         {
-            c->c2.link_read_bytes_auth += c->c2.buf.len;
+            c->c2.link_read_bytes_auth += c->c2.buf2.len;
             c->c2.max_recv_size_local =
                 max_int(c->c2.original_recv_size, c->c2.max_recv_size_local);
         }
 
         /* Did we just receive an openvpn ping packet? */
-        if (is_ping_msg(&c->c2.buf))
+        if (is_ping_msg(&c->c2.buf2))
         {
             dmsg(D_PING, "RECEIVED PING PACKET");
-            c->c2.buf.len = 0; /* drop packet */
+            c->c2.buf2.len = 0; /* drop packet */
         }
 
         /* Did we just receive an OCC packet? */
-        if (is_occ_msg(&c->c2.buf))
+        if (is_occ_msg(&c->c2.buf2))
         {
             process_received_occ_msg(c);
         }
 
-        buffer_turnover(orig_buf, &c->c2.to_tun, &c->c2.buf, &c->c2.buffers->read_link_buf);
+        buffer_turnover(orig_buf, &c->c2.to_tun, &c->c2.buf2, &c->c2.buffers->read_link_buf);
 
         /* to_tun defined + unopened tuntap can cause deadlock */
         if (!tuntap_defined(c->c1.tuntap))
@@ -1209,16 +1228,37 @@ process_incoming_link_part2(struct context *c, struct link_socket_info *lsi,
     }
 }
 
+void process_incoming_link_part3(struct context *c)
+{
+    if (BULK_MODE(c))
+    {
+        int leng = BLEN(&c->c2.buf2);
+        if (leng > 0)
+        {
+            c->c2.buffers->send_tun_max.offset = TUN_BAT_OFF;
+            c->c2.buffers->send_tun_max.len = leng;
+            bcopy(BPTR(&c->c2.buf2), BPTR(&c->c2.buffers->send_tun_max), leng);
+            c->c2.to_tun.offset += 2;
+            c->c2.buf2.offset += 2;
+        }
+        else
+        {
+            buf_reset(&c->c2.to_tun);
+        }
+    }
+}
+
 static void
 process_incoming_link(struct context *c, struct link_socket *sock)
 {
     perf_push(PERF_PROC_IN_LINK);
 
     struct link_socket_info *lsi = &sock->info;
-    const uint8_t *orig_buf = c->c2.buf.data;
+    const uint8_t *orig_buf = c->c2.buf2.data;
 
     process_incoming_link_part1(c, lsi, false);
     process_incoming_link_part2(c, lsi, orig_buf);
+    process_incoming_link_part3(c);
 
     perf_pop();
 }
@@ -1319,7 +1359,7 @@ process_incoming_dco(struct context *c)
  */
 
 void
-read_incoming_tun(struct context *c)
+read_incoming_tun_part2(struct context *c)
 {
     /*
      * Setup for read() call on TUN/TAP device.
@@ -1380,6 +1420,52 @@ read_incoming_tun(struct context *c)
     perf_pop();
 }
 
+void read_incoming_tun_part3(struct context *c)
+{
+    fd_set rfds;
+    struct timeval timo;
+    int plen = 0, pidx = -1;
+    int fdno = c->c1.tuntap->fd;
+    for (int x = 0; x < TUN_BAT_MIN; ++x)
+    {
+        int leng = plen, indx = (pidx + 1);
+        if (leng < 1)
+        {
+            FD_ZERO(&rfds);
+            FD_SET(fdno, &rfds);
+            timo.tv_sec = 0;
+            timo.tv_usec = 0;
+            select(fdno+1, &rfds, NULL, NULL, &timo);
+            if (FD_ISSET(fdno, &rfds))
+            {
+                read_incoming_tun_part2(c);
+                plen = BLEN(&c->c2.buf);
+            } else { break; }
+        }
+        leng = plen;
+        if (leng > 0)
+        {
+            c->c2.buffers->read_tun_bufs[indx].offset = TUN_BAT_OFF;
+            c->c2.buffers->read_tun_bufs[indx].len = leng;
+            bcopy(BPTR(&c->c2.buf), BPTR(&c->c2.buffers->read_tun_bufs[indx]), leng);
+            c->c2.bufs[indx] = c->c2.buffers->read_tun_bufs[indx];
+            pidx = indx;
+        } else { break; }
+        plen = 0;
+    }
+    c->c2.buffers->bulk_indx = 0;
+    c->c2.buffers->bulk_leng = (pidx + 1);
+}
+
+void read_incoming_tun(struct context *c)
+{
+    if (!BULK_MODE(c)) {
+        read_incoming_tun_part2(c);
+    } else {
+        read_incoming_tun_part3(c);
+    }
+}
+
 /**
  * Drops UDP packets which OS decided to route via tun.
  *
@@ -1467,7 +1553,7 @@ drop_if_recursive_routing(struct context *c, struct buffer *buf)
  */
 
 void
-process_incoming_tun(struct context *c, struct link_socket *out_sock)
+process_incoming_tun_part2(struct context *c, struct link_socket *out_sock)
 {
     struct gc_arena gc = gc_new();
 
@@ -1486,7 +1572,7 @@ process_incoming_tun(struct context *c, struct link_socket *out_sock)
 #endif
 
     /* Show packet content */
-    dmsg(D_TUN_RW, "TUN READ [%d]", BLEN(&c->c2.buf));
+    dmsg(D_TUN_RW, "TUN READ [%d] [%d]", BLEN(&c->c2.buf), c->c2.frame.buf.payload_size);
 
     if (c->c2.buf.len > 0)
     {
@@ -1510,7 +1596,10 @@ process_incoming_tun(struct context *c, struct link_socket *out_sock)
     }
     if (c->c2.buf.len > 0)
     {
-        encrypt_sign(c, true);
+        if (!BULK_MODE(c))
+        {
+            encrypt_sign(c, true);
+        }
     }
     else
     {
@@ -1520,6 +1609,57 @@ process_incoming_tun(struct context *c, struct link_socket *out_sock)
     gc_free(&gc);
 }
 
+void process_incoming_tun_part3(struct context *c, struct link_socket *out_sock)
+{
+    if (BULK_DATA(c->c2.buffers))
+    {
+        c->c2.buffers->read_tun_max.offset = TUN_BAT_OFF;
+        c->c2.buffers->read_tun_max.len = 0;
+        uint8_t *temp = BPTR(&c->c2.buffers->read_tun_max);
+        int leng = c->c2.buffers->bulk_leng;
+        int plen = 0, maxl = 0;
+        for (int x = 0; x < leng; ++x)
+        {
+            c->c2.buf = c->c2.bufs[x];
+            process_incoming_tun_part2(c, out_sock);
+            plen = BLEN(&c->c2.buf);
+            if (plen > 0)
+            {
+                temp = buff_prepsize(temp, &plen);
+                bcopy(BPTR(&c->c2.buf), temp, plen);
+                temp += plen; maxl += (plen + 2);
+            }
+            c->c2.bufs[x].len = 0;
+        }
+        if (maxl > 0)
+        {
+            c->c2.buffers->read_tun_max.offset = TUN_BAT_OFF;
+            c->c2.buffers->read_tun_max.len = maxl;
+            c->c2.buf = c->c2.buffers->read_tun_max;
+            encrypt_sign(c, true);
+        }
+        else
+        {
+            buf_reset(&c->c2.to_link);
+        }
+    }
+    else
+    {
+        buf_reset(&c->c2.to_link);
+    }
+    c->c2.buffers->bulk_indx = -1;
+    c->c2.buffers->bulk_leng = -1;
+}
+
+void process_incoming_tun(struct context *c, struct link_socket *out_sock)
+{
+    if (!BULK_MODE(c)) {
+        process_incoming_tun_part2(c, out_sock);
+    } else {
+        process_incoming_tun_part3(c, out_sock);
+    }
+}
+
 /**
  * Forges a IPv6 ICMP packet with a no route to host error code from the
  * IPv6 packet in buf and sends it directly back to the client via the tun
@@ -1746,7 +1886,7 @@ process_outgoing_link(struct context *c, struct link_socket *sock)
 
     perf_push(PERF_PROC_OUT_LINK);
 
-    if (c->c2.to_link.len > 0 && c->c2.to_link.len <= c->c2.frame.buf.payload_size)
+    if (c->c2.to_link.len > 0 && (c->c2.to_link.len <= c->c2.frame.buf.payload_size || c->c2.frame.bulk_size > 0))
     {
         /*
          * Setup for call to send/sendto which will send
@@ -1791,6 +1931,7 @@ process_outgoing_link(struct context *c, struct link_socket *sock)
                 fprintf(stderr, "W");
             }
 #endif
+
             msg(D_LINK_RW, "%s WRITE [%d] to %s: %s",
                 proto2ascii(sock->info.proto, sock->info.af, true), BLEN(&c->c2.to_link),
                 print_link_socket_actual(c->c2.to_link_addr, &gc), PROTO_DUMP(&c->c2.to_link, &gc));
@@ -1882,7 +2023,7 @@ process_outgoing_link(struct context *c, struct link_socket *sock)
  */
 
 void
-process_outgoing_tun(struct context *c, struct link_socket *in_sock)
+process_outgoing_tun_part2(struct context *c, struct link_socket *in_sock)
 {
     /*
      * Set up for write() call to TUN/TAP
@@ -1915,7 +2056,8 @@ process_outgoing_tun(struct context *c, struct link_socket *in_sock)
             fprintf(stderr, "w");
         }
 #endif
-        dmsg(D_TUN_RW, "TUN WRITE [%d]", BLEN(&c->c2.to_tun));
+
+        dmsg(D_TUN_RW, "TUN WRITE [%d] [%d]", BLEN(&c->c2.to_tun), c->c2.frame.buf.payload_size);
 
 #ifdef PACKET_TRUNCATION_CHECK
         ipv4_packet_size_verify(BPTR(&c->c2.to_tun), BLEN(&c->c2.to_tun), TUNNEL_TYPE(c->c1.tuntap),
@@ -1971,6 +2113,37 @@ process_outgoing_tun(struct context *c, struct link_socket *in_sock)
     perf_pop();
 }
 
+void process_outgoing_tun_part3(struct context *c, struct link_socket *in_sock)
+{
+    int maxl = 0, plen = 0;
+    int leng = BLEN(&c->c2.buffers->send_tun_max);
+    uint8_t *temp = BPTR(&c->c2.buffers->send_tun_max);
+    for (int x = 0; x < TUN_BAT_MIN; ++x)
+    {
+        temp = buff_postsize(temp, &plen);
+        if ((leng > 0) && (plen > 0) && ((maxl + plen) < leng))
+        {
+            c->c2.to_tun = c->c2.buffers->to_tun_max;
+            c->c2.to_tun.offset = TUN_BAT_OFF;
+            c->c2.to_tun.len = plen;
+            bcopy(temp, BPTR(&c->c2.to_tun), plen);
+            temp += plen; maxl += (plen + 2);
+            process_outgoing_tun_part2(c, in_sock);
+        } else { break; }
+    }
+    c->c2.buffers->send_tun_max.len = 0;
+    buf_reset(&c->c2.to_tun);
+}
+
+void process_outgoing_tun(struct context *c, struct link_socket *in_sock)
+{
+    if (!BULK_MODE(c)) {
+        process_outgoing_tun_part2(c, in_sock);
+    } else {
+        process_outgoing_tun_part3(c, in_sock);
+    }
+}
+
 #if defined(__GNUC__) || defined(__clang__)
 #pragma GCC diagnostic pop
 #endif
diff --git a/src/openvpn/forward.h b/src/openvpn/forward.h
index a575fafe4b7..fc1e513fe52 100644
--- a/src/openvpn/forward.h
+++ b/src/openvpn/forward.h
@@ -34,6 +34,10 @@
  * file
  */
 
+#define BULK_MODE(c) (c->c2.frame.bulk_size > 0)
+#define BULK_DATA(b) (b && (b->bulk_leng > 0) && (b->bulk_indx < b->bulk_leng))
+#define INST_LENG(a) (a && (a->inst_leng > 0) && (a->inst_indx < a->inst_leng) && (a->pending == NULL))
+
 #define TUN_OUT(c)  (BLEN(&(c)->c2.to_tun) > 0)
 #define LINK_OUT(c) (BLEN(&(c)->c2.to_link) > 0)
 #define ANY_OUT(c)  (TUN_OUT(c) || LINK_OUT(c))
@@ -196,6 +200,8 @@ bool process_incoming_link_part1(struct context *c, struct link_socket_info *lsi
 void process_incoming_link_part2(struct context *c, struct link_socket_info *lsi,
                                  const uint8_t *orig_buf);
 
+void process_incoming_link_part3(struct context *c);
+
 /**
  * Transfers \c float_sa data extracted from an incoming DCO
  * PEER_FLOAT_NTF to \c out_osaddr for later processing.
diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index f8a0fee61fc..a5a681a1fd7 100644
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -2976,6 +2976,11 @@ frame_finalize_options(struct context *c, const struct options *o)
     tailroom += COMP_EXTRA_BUFFER(payload_size);
 #endif
 
+    if (frame->bulk_size > 0)
+    {
+        payload_size = BAT_SIZE(TUN_BAT_ONE, frame->tun_mtu, TUN_BAT_OFF);
+    }
+
     frame->buf.payload_size = payload_size;
     frame->buf.headroom = headroom;
     frame->buf.tailroom = tailroom;
@@ -3478,6 +3483,10 @@ do_init_frame_tls(struct context *c)
     if (c->c2.tls_multi)
     {
         tls_multi_init_finalize(c->c2.tls_multi, c->options.ce.tls_mtu);
+        if (c->c2.frame.bulk_size > 0)
+        {
+            c->c2.tls_multi->opt.frame.buf.payload_size = c->c2.frame.tun_mtu;
+        }
         ASSERT(c->c2.tls_multi->opt.frame.buf.payload_size <= c->c2.frame.buf.payload_size);
         frame_print(&c->c2.tls_multi->opt.frame, D_MTU_INFO, "Control Channel MTU parms");
 
@@ -3545,6 +3554,14 @@ do_init_frame(struct context *c)
         c->c2.frame.extra_tun += c->options.ce.tun_mtu_extra;
     }
 
+    /*
+     * Adjust bulk size based on the --bulk-mode parameter.
+     */
+    if (c->options.ce.bulk_mode)
+    {
+        c->c2.frame.bulk_size = c->options.ce.tun_mtu;
+    }
+
     /*
      * Fill in the blanks in the frame parameters structure,
      * make sure values are rational, etc.
@@ -3685,9 +3702,43 @@ init_context_buffers(const struct frame *frame)
 
     size_t buf_size = BUF_SIZE(frame);
 
+    if (frame->bulk_size > 0)
+    {
+        size_t off_size = (frame->buf.headroom + TUN_BAT_OFF + frame->buf.tailroom);
+        buf_size = BAT_SIZE(TUN_BAT_MAX, frame->tun_mtu, off_size);
+    }
+
+    dmsg(M_INFO, "MEM NEW [%ld] [%d+%d+%d]", buf_size, frame->buf.headroom, frame->buf.payload_size, frame->buf.tailroom);
+
     b->read_link_buf = alloc_buf(buf_size);
     b->read_tun_buf = alloc_buf(buf_size);
 
+    if (frame->bulk_size > 0)
+    {
+        for (int x = 0; x < TUN_BAT_MAX; ++x)
+        {
+            size_t part_size = BUF_SIZE(frame);
+            b->read_tun_bufs[x] = alloc_buf(part_size);
+            b->read_tun_bufs[x].offset = TUN_BAT_OFF;
+            b->read_tun_bufs[x].len = 0;
+        }
+
+        b->read_tun_max = alloc_buf(buf_size);
+        b->read_tun_max.offset = TUN_BAT_OFF;
+        b->read_tun_max.len = 0;
+
+        b->send_tun_max = alloc_buf(buf_size);
+        b->send_tun_max.offset = TUN_BAT_OFF;
+        b->send_tun_max.len = 0;
+
+        b->to_tun_max = alloc_buf(buf_size);
+        b->to_tun_max.offset = TUN_BAT_OFF;
+        b->to_tun_max.len = 0;
+    }
+
+    b->bulk_indx = -1;
+    b->bulk_leng = -1;
+
     b->aux_buf = alloc_buf(buf_size);
 
     b->encrypt_buf = alloc_buf(buf_size);
@@ -3710,6 +3761,17 @@ free_context_buffers(struct context_buffers *b)
         free_buf(&b->read_tun_buf);
         free_buf(&b->aux_buf);
 
+        if (b->to_tun_max.data)
+        {
+            free_buf(&b->to_tun_max);
+            free_buf(&b->send_tun_max);
+            free_buf(&b->read_tun_max);
+            for (int x = 0; x < TUN_BAT_MAX; ++x)
+            {
+                free_buf(&b->read_tun_bufs[x]);
+            }
+        }
+
 #ifdef USE_COMP
         free_buf(&b->compress_buf);
         free_buf(&b->decompress_buf);
diff --git a/src/openvpn/mtu.c b/src/openvpn/mtu.c
index 66f81a62980..3de18954f21 100644
--- a/src/openvpn/mtu.c
+++ b/src/openvpn/mtu.c
@@ -41,9 +41,15 @@ void
 alloc_buf_sock_tun(struct buffer *buf, const struct frame *frame)
 {
     /* allocate buffer for overlapped I/O */
-    *buf = alloc_buf(BUF_SIZE(frame));
+    int alen = BUF_SIZE(frame);
+    int blen = frame->buf.payload_size;
+    if (frame->bulk_size > 0) {
+        alen = BAT_SIZE(TUN_BAT_MAX, frame->tun_mtu, TUN_BAT_OFF);
+        blen = BAT_SIZE(TUN_BAT_MAX, frame->tun_mtu, TUN_BAT_NOP);
+    }
+    *buf = alloc_buf(alen);
     ASSERT(buf_init(buf, frame->buf.headroom));
-    buf->len = frame->buf.payload_size;
+    buf->len = blen;
     ASSERT(buf_safe(buf, 0));
 }
 
diff --git a/src/openvpn/mtu.h b/src/openvpn/mtu.h
index 3bbff6f6514..aa7aba5d104 100644
--- a/src/openvpn/mtu.h
+++ b/src/openvpn/mtu.h
@@ -58,6 +58,15 @@
  */
 #define TUN_MTU_MIN 100
 
+/*
+ * Bulk mode static define values.
+ */
+#define TUN_BAT_MIN        6
+#define TUN_BAT_MAX        9
+#define TUN_BAT_OFF        250
+#define TUN_BAT_NOP        0
+#define TUN_BAT_ONE        1
+
 /*
  * Default MTU of network over which tunnel data will pass by TCP/UDP.
  */
@@ -157,6 +166,11 @@ struct frame
                             *   which defaults to 0 for tun and 32
                             *   (\c TAP_MTU_EXTRA_DEFAULT) for tap.
                             *   */
+
+    int bulk_size;         /**< Set in the init frame function to
+                            *   signal to related functions to
+                            *   process bulk mode data transfers.
+                            *   */
 };
 
 /* Forward declarations, to prevent includes */
@@ -176,6 +190,7 @@ struct options;
  * larger than the headroom.
  */
 #define BUF_SIZE(f) ((f)->buf.headroom + (f)->buf.payload_size + (f)->buf.tailroom)
+#define BAT_SIZE(a, b, c) ((a * b) + c)
 
 /*
  * Function prototypes.
diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index 2863ff173e4..b1e506312fa 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -435,6 +435,10 @@ multi_init(struct context *t)
     }
 
     m->deferred_shutdown_signal.signal_received = 0;
+
+    m->inst_indx = -1;
+    m->inst_leng = -1;
+    m->inst_list = calloc(TUN_BAT_MAX, sizeof(struct multi_instance *));
 }
 
 const char *
@@ -721,6 +725,10 @@ multi_uninit(struct multi_context *m)
         multi_reap_free(m->reaper);
         mroute_helper_free(m->route_helper);
         multi_io_free(m->multi_io);
+
+        m->inst_indx = -1;
+        m->inst_leng = -1;
+        free(m->inst_list);
     }
 }
 
@@ -3144,7 +3152,7 @@ multi_process_float(struct multi_context *m, struct multi_instance *mi, struct l
             msg(D_MULTI_LOW, "Disallow float to an address taken by another client %s",
                 multi_instance_string(ex_mi, false, &gc));
 
-            mi->context.c2.buf.len = 0;
+            mi->context.c2.buf2.len = 0;
 
             goto done;
         }
@@ -3368,7 +3376,7 @@ multi_process_incoming_link(struct multi_context *m, struct multi_instance *inst
     if (!instance)
     {
 #ifdef MULTI_DEBUG_EVENT_LOOP
-        printf("TCP/UDP -> TUN [%d]\n", BLEN(&m->top.c2.buf));
+        printf("TCP/UDP -> TUN [%d]\n", BLEN(&m->top.c2.buf2));
 #endif
         multi_set_pending(m, multi_get_create_instance_udp(m, &floated, sock));
     }
@@ -3387,7 +3395,7 @@ multi_process_incoming_link(struct multi_context *m, struct multi_instance *inst
         if (!instance)
         {
             /* transfer packet pointer from top-level context buffer to instance */
-            c->c2.buf = m->top.c2.buf;
+            c->c2.buf2 = m->top.c2.buf2;
 
             /* transfer from-addr from top-level context buffer to instance */
             if (!floated)
@@ -3396,7 +3404,7 @@ multi_process_incoming_link(struct multi_context *m, struct multi_instance *inst
             }
         }
 
-        if (BLEN(&c->c2.buf) > 0)
+        if (BLEN(&c->c2.buf2) > 0)
         {
             struct link_socket_info *lsi;
             const uint8_t *orig_buf;
@@ -3405,16 +3413,17 @@ multi_process_incoming_link(struct multi_context *m, struct multi_instance *inst
 
             perf_push(PERF_PROC_IN_LINK);
             lsi = &sock->info;
-            orig_buf = c->c2.buf.data;
+            orig_buf = c->c2.buf2.data;
             if (process_incoming_link_part1(c, lsi, floated))
             {
                 /* nonzero length means that we have a valid, decrypted packed */
-                if (floated && c->c2.buf.len > 0)
+                if (floated && c->c2.buf2.len > 0)
                 {
                     multi_process_float(m, m->pending, sock);
                 }
 
                 process_incoming_link_part2(c, lsi, orig_buf);
+                process_incoming_link_part3(c);
             }
             perf_pop();
 
@@ -3543,12 +3552,19 @@ multi_process_incoming_link(struct multi_context *m, struct multi_instance *inst
     return ret;
 }
 
+int min_max(int a, int b, int c)
+{
+    if (a > c) { return c; }
+    if (a < b) { return b; }
+    return a;
+}
+
 /*
  * Process packets in the TUN/TAP interface -> TCP/UDP socket direction,
  * i.e. server -> client direction.
  */
 bool
-multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags)
+multi_process_incoming_tun_part2(struct multi_context *m, const unsigned int mpp_flags)
 {
     bool ret = true;
 
@@ -3594,6 +3610,27 @@ multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags
                 /* for now, treat multicast as broadcast */
                 multi_bcast(m, &m->top.c2.buf, NULL, vid);
             }
+            else if (m->inst_indx == -9)
+            {
+                struct multi_instance *inst = multi_get_instance_by_virtual_addr(m, &dest, dev_type == DEV_TYPE_TUN);
+                if (inst)
+                {
+                    int leng = m->inst_leng;
+                    for (int x = 0; x < leng; ++x)
+                    {
+                        if (m->inst_list[x] == inst)
+                        {
+                            m->inst_indx = x;
+                            return true;
+                        }
+                    }
+                    leng = min_max(leng, 0, TUN_BAT_MIN - 1);
+                    m->inst_list[leng] = inst;
+                    m->inst_indx = leng;
+                    m->inst_leng = (leng + 1);
+                }
+                return true;
+            }
             else
             {
                 multi_set_pending(
@@ -3635,6 +3672,97 @@ multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags
     return ret;
 }
 
+bool multi_process_post_part2(struct multi_context *m, const unsigned int mpp_flags)
+{
+    if (!INST_LENG(m))
+    {
+        return false;
+    }
+    struct multi_instance *i = m->inst_list[m->inst_indx];
+    if (!i)
+    {
+        m->inst_indx += 1;
+        return false;
+    }
+    if (!(multi_output_queue_ready(m, i)))
+    {
+        return false;
+    }
+    multi_set_pending(m, i);
+    set_prefix(m->pending);
+    multi_process_post(m, m->pending, mpp_flags);
+    clear_prefix();
+    m->inst_list[m->inst_indx] = NULL;
+    m->inst_indx += 1;
+    return true;
+}
+
+bool multi_process_incoming_tun_part3(struct multi_context *m, const unsigned int mpp_flags)
+{
+    struct context *c, *b = &(m->top);
+    struct multi_instance *i;
+    int leng = b->c2.buffers->bulk_leng;
+    m->inst_indx = -1;
+    m->inst_leng = -1;
+    for (int x = 0; x < leng; ++x)
+    {
+        m->inst_indx = -9;
+        m->top.c2.buf = b->c2.bufs[x];
+        multi_process_incoming_tun_part2(m, mpp_flags);
+        if (m->inst_indx > -1)
+        {
+            i = m->inst_list[m->inst_indx];
+            c = &(i->context);
+            int y = min_max(c->c2.buffers->bulk_leng, 0, TUN_BAT_MIN - 1);
+            c->c2.buffers->read_tun_bufs[y].offset = TUN_BAT_OFF;
+            c->c2.buffers->read_tun_bufs[y].len = BLEN(&b->c2.bufs[x]);
+            bcopy(BPTR(&b->c2.bufs[x]), BPTR(&c->c2.buffers->read_tun_bufs[y]), BLEN(&b->c2.bufs[x]));
+            c->c2.bufs[y] = c->c2.buffers->read_tun_bufs[y];
+            c->c2.buffers->bulk_indx = 0;
+            c->c2.buffers->bulk_leng = (y + 1);
+        }
+    }
+    for (int x = 0; x < m->inst_leng; ++x)
+    {
+        i = m->inst_list[x];
+        c = &(i->context);
+        c->c2.buf = c->c2.bufs[0];
+        process_incoming_tun(c, c->c2.link_sockets[0]);
+    }
+    b->c2.buffers->bulk_indx = -1;
+    b->c2.buffers->bulk_leng = -1;
+    m->inst_indx = 0;
+    return multi_process_post_part2(m, mpp_flags);
+}
+
+bool multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags)
+{
+    if (!(m->top.options.ce.bulk_mode)) {
+        return multi_process_incoming_tun_part2(m, mpp_flags);
+    } else {
+        return multi_process_incoming_tun_part3(m, mpp_flags);
+    }
+}
+
+bool multi_in_tun(struct multi_context *m, const unsigned int mpp_flags)
+{
+    if (INST_LENG(m))
+    {
+        multi_process_post_part2(m, mpp_flags);
+    }
+    else
+    {
+        struct context *c = &(m->top);
+        read_incoming_tun(c);
+        if (!IS_SIG(c))
+        {
+            multi_process_incoming_tun(m, mpp_flags);
+        }
+        return true;
+    }
+    return false;
+}
+
 /*
  * Process a possible client-to-client/bcast/mcast message in the
  * queue.
diff --git a/src/openvpn/multi.h b/src/openvpn/multi.h
index b2b892bbb5d..57fedca7cff 100644
--- a/src/openvpn/multi.h
+++ b/src/openvpn/multi.h
@@ -218,6 +218,10 @@ struct multi_context
 #endif
 
     struct deferred_signal_schedule_entry deferred_shutdown_signal;
+
+    int inst_indx;
+    int inst_leng;
+    struct multi_instance **inst_list;
 };
 
 /**
@@ -359,6 +363,9 @@ bool multi_process_incoming_link(struct multi_context *m, struct multi_instance
  */
 bool multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags);
 
+bool multi_process_post_part2(struct multi_context *m, const unsigned int mpp_flags);
+
+bool multi_in_tun(struct multi_context *m, const unsigned int mpp_flags);
 
 void multi_process_drop_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags);
 
diff --git a/src/openvpn/multi_io.c b/src/openvpn/multi_io.c
index 0bfbb63f889..f4fe7a8f441 100644
--- a/src/openvpn/multi_io.c
+++ b/src/openvpn/multi_io.c
@@ -294,12 +294,9 @@ multi_io_dispatch(struct multi_context *m, struct multi_instance *mi, const int
 
     switch (action)
     {
+        case TA_INST_LENG:
         case TA_TUN_READ:
-            read_incoming_tun(&m->top);
-            if (!IS_SIG(&m->top))
-            {
-                multi_process_incoming_tun(m, mpp_flags);
-            }
+            multi_in_tun(m, mpp_flags);
             break;
 
         case TA_SOCKET_READ:
@@ -368,6 +365,7 @@ multi_io_post(struct multi_context *m, struct multi_instance *mi, const int acti
 #define MTP_NONE     0
 #define MTP_TUN_OUT  (1 << 0)
 #define MTP_LINK_OUT (1 << 1)
+#define MTP_MULTI_LEN (1 << 2)
     unsigned int flags = MTP_NONE;
 
     if (TUN_OUT(c))
@@ -378,9 +376,17 @@ multi_io_post(struct multi_context *m, struct multi_instance *mi, const int acti
     {
         flags |= MTP_LINK_OUT;
     }
+    if (INST_LENG(m))
+    {
+        flags  = MTP_MULTI_LEN;
+    }
 
     switch (flags)
     {
+        case MTP_MULTI_LEN:
+            newaction = TA_INST_LENG;
+            break;
+
         case MTP_TUN_OUT | MTP_LINK_OUT:
         case MTP_TUN_OUT:
             newaction = TA_TUN_WRITE;
@@ -572,7 +578,7 @@ multi_io_action(struct multi_context *m, struct multi_instance *mi, int action,
          * On our first pass, poll will be false because we already know
          * that input is available, and to call io_wait would be redundant.
          */
-        if (poll && action != TA_SOCKET_READ_RESIDUAL)
+        if (poll && action != TA_SOCKET_READ_RESIDUAL && action != TA_INST_LENG)
         {
             const int orig_action = action;
             action = multi_io_wait_lite(m, mi, action, &tun_input_pending);
diff --git a/src/openvpn/multi_io.h b/src/openvpn/multi_io.h
index 4a3c60d236d..daf43b0e0f6 100644
--- a/src/openvpn/multi_io.h
+++ b/src/openvpn/multi_io.h
@@ -44,6 +44,7 @@
 #define TA_INITIAL               8
 #define TA_TIMEOUT               9
 #define TA_TUN_WRITE_TIMEOUT     10
+#define TA_INST_LENG             11
 
 /*
  * I/O state and events tracker
diff --git a/src/openvpn/openvpn.h b/src/openvpn/openvpn.h
index cd99cd409e0..b70194708db 100644
--- a/src/openvpn/openvpn.h
+++ b/src/openvpn/openvpn.h
@@ -112,6 +112,14 @@ struct context_buffers
      */
     struct buffer read_link_buf;
     struct buffer read_tun_buf;
+
+    struct buffer read_tun_bufs[TUN_BAT_MAX];
+    struct buffer read_tun_max;
+    struct buffer send_tun_max;
+    struct buffer to_tun_max;
+
+    int bulk_indx;
+    int bulk_leng;
 };
 
 /*
@@ -373,9 +381,12 @@ struct context_2
      * struct context_buffers.
      */
     struct buffer buf;
+    struct buffer buf2;
     struct buffer to_tun;
     struct buffer to_link;
 
+    struct buffer bufs[TUN_BAT_MAX];
+
     /* should we print R|W|r|w to console on packet transfers? */
     bool log_rw;
 
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index f35738d8049..ceccf03e0de 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -306,6 +306,7 @@ static const char usage_message[] =
     "                  'maybe' -- Use per-route hints\n"
     "                  'yes'   -- Always DF (Don't Fragment)\n"
     "--mtu-test      : Empirically measure and report MTU.\n"
+    "--bulk-mode     : Use bulk TUN/TCP reads/writes.\n"
 #ifdef ENABLE_FRAGMENT
     "--fragment max  : Enable internal datagram fragmentation so that no UDP\n"
     "                  datagrams are sent which are larger than max bytes.\n"
@@ -3291,6 +3292,11 @@ options_postprocess_mutate_invariant(struct options *options)
         options->pkcs11_providers[0] = DEFAULT_PKCS11_MODULE;
     }
 #endif
+
+    if ((options->ce.proto != PROTO_TCP) && (options->ce.proto != PROTO_TCP_SERVER) && (options->ce.proto != PROTO_TCP_CLIENT))
+    {
+        options->ce.bulk_mode = false;
+    }
 }
 
 static void
@@ -9901,6 +9907,10 @@ add_option(struct options *options, char *p[], bool is_inline, const char *file,
             goto err;
         }
     }
+    else if (streq(p[0], "bulk-mode"))
+    {
+        options->ce.bulk_mode = true;
+    }
     else
     {
         int i;
diff --git a/src/openvpn/options.h b/src/openvpn/options.h
index b03306812a0..82cdb606ea5 100644
--- a/src/openvpn/options.h
+++ b/src/openvpn/options.h
@@ -174,6 +174,9 @@ struct connection_entry
 
     /* Allow only client that support resending the wrapped client key */
     bool tls_crypt_v2_force_cookie;
+
+    /* Bulk mode allows for multiple tun reads + larger tcp writes */
+    bool bulk_mode;
 };
 
 struct remote_entry