Hello Binect; yes I could, in which case I wouldn't need chroot; it's just that I'm prototyping the solution, while waiting for the networks to open up the firewall to dns, which will resolve svchost, to a pool of two-three devices for scaling and failover. Even then, i could use multiple connect host:port in stunnel conf, though i'd prefer to have a single stunnel conf to use intact in all envs (dev/test/live) and in git. But as you suggested, if stunnel is not mature enough to offer a decent chroot, i'll have to hardcode the ips (and forget its chroot "feature")...