diff --git a/Android.bp b/Android.bp
index 95c5d50..bf348a4 100644
--- a/Android.bp
+++ b/Android.bp
@@ -191,6 +191,7 @@
     visibility: [
         "//packages/modules/Connectivity/Tethering",
         "//packages/modules/Connectivity/tests/cts/net",
+        "//packages/modules/Connectivity/tests/cts/hostside/app",
     ],
 }
 
@@ -211,6 +212,7 @@
     visibility: [
         "//packages/modules/Connectivity/Tethering",
         "//packages/modules/Connectivity/tests/cts/net",
+        "//packages/modules/Connectivity/tests/cts/hostside/app",
     ],
 }
 
diff --git a/apishim/29/com/android/networkstack/apishim/api29/VpnServiceBuilderShimImpl.java b/apishim/29/com/android/networkstack/apishim/api29/VpnServiceBuilderShimImpl.java
new file mode 100644
index 0000000..0f221bf
--- /dev/null
+++ b/apishim/29/com/android/networkstack/apishim/api29/VpnServiceBuilderShimImpl.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.networkstack.apishim.api29;
+
+import android.net.IpPrefix;
+import android.net.VpnService;
+
+import com.android.networkstack.apishim.common.UnsupportedApiLevelException;
+import com.android.networkstack.apishim.common.VpnServiceBuilderShim;
+
+/**
+ * Implementation of {@link com.android.networkstack.apishim.common.VpnServiceBuilderShim}.
+ */
+public class VpnServiceBuilderShimImpl implements VpnServiceBuilderShim {
+
+    /**
+     * Get a new instance of {@link VpnServiceBuilderShim}.
+     */
+    public static VpnServiceBuilderShim newInstance() {
+        return new VpnServiceBuilderShimImpl();
+    }
+
+    @Override
+    public VpnService.Builder excludeRoute(VpnService.Builder builder, IpPrefix prefix)
+            throws UnsupportedApiLevelException {
+        throw new UnsupportedApiLevelException("Only supported after API level 31.");
+    }
+
+    @Override
+    public VpnService.Builder addRoute(VpnService.Builder builder, IpPrefix prefix)
+            throws UnsupportedApiLevelException {
+        throw new UnsupportedApiLevelException("Only supported after API level 31.");
+    }
+}
diff --git a/apishim/31/com/android/networkstack/apishim/api31/VpnServiceBuilderShimImpl.java b/apishim/31/com/android/networkstack/apishim/api31/VpnServiceBuilderShimImpl.java
new file mode 100644
index 0000000..8b82935
--- /dev/null
+++ b/apishim/31/com/android/networkstack/apishim/api31/VpnServiceBuilderShimImpl.java
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.networkstack.apishim.api31;
+
+/**
+ * Implementation of {@link com.android.networkstack.apishim.common.VpnServiceBuilderShim}.
+ */
+public class VpnServiceBuilderShimImpl extends
+        com.android.networkstack.apishim.api29.VpnServiceBuilderShimImpl {
+}
diff --git a/apishim/33/com/android/networkstack/apishim/VpnServiceBuilderShimImpl.java b/apishim/33/com/android/networkstack/apishim/VpnServiceBuilderShimImpl.java
new file mode 100644
index 0000000..da8f774
--- /dev/null
+++ b/apishim/33/com/android/networkstack/apishim/VpnServiceBuilderShimImpl.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.networkstack.apishim;
+
+import android.net.IpPrefix;
+import android.net.VpnService;
+import android.os.Build;
+
+import androidx.annotation.RequiresApi;
+
+import com.android.modules.utils.build.SdkLevel;
+import com.android.networkstack.apishim.common.UnsupportedApiLevelException;
+import com.android.networkstack.apishim.common.VpnServiceBuilderShim;
+
+/**
+ * Implementation of {@link com.android.networkstack.apishim.common.VpnServiceBuilderShim}.
+ */
+@RequiresApi(Build.VERSION_CODES.TIRAMISU)
+public class VpnServiceBuilderShimImpl extends
+        com.android.networkstack.apishim.api31.VpnServiceBuilderShimImpl {
+
+    /**
+     * Get a new instance of {@link VpnServiceBuilderShim}.
+     */
+    @RequiresApi(Build.VERSION_CODES.Q)
+    public static VpnServiceBuilderShim newInstance() {
+        if (SdkLevel.isAtLeastT()) {
+            return new VpnServiceBuilderShimImpl();
+        } else {
+            return new com.android.networkstack.apishim.api31.VpnServiceBuilderShimImpl();
+        }
+    }
+
+    @Override
+    public VpnService.Builder excludeRoute(VpnService.Builder builder, IpPrefix prefix)
+            throws UnsupportedApiLevelException {
+        return builder.excludeRoute(prefix);
+    }
+
+    @Override
+    public VpnService.Builder addRoute(VpnService.Builder builder, IpPrefix prefix)
+            throws UnsupportedApiLevelException {
+        return builder.addRoute(prefix);
+    }
+}
diff --git a/apishim/common/com/android/networkstack/apishim/common/VpnServiceBuilderShim.java b/apishim/common/com/android/networkstack/apishim/common/VpnServiceBuilderShim.java
new file mode 100644
index 0000000..fbfcf6c
--- /dev/null
+++ b/apishim/common/com/android/networkstack/apishim/common/VpnServiceBuilderShim.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.networkstack.apishim.common;
+
+import android.net.IpPrefix;
+import android.net.VpnService;
+
+/** Shim for {@link VpnService.Builder}. */
+public interface VpnServiceBuilderShim {
+    /**
+     * @see VpnService.Builder#excludeRoute(IpPrefix)
+     */
+    VpnService.Builder excludeRoute(VpnService.Builder builder, IpPrefix prefix)
+            throws UnsupportedApiLevelException;
+
+    /**
+     * @see VpnService.Builder#addRoute(IpPrefix)
+     */
+    VpnService.Builder addRoute(VpnService.Builder builder, IpPrefix prefix)
+            throws UnsupportedApiLevelException;
+}