diff --git a/cmd/derper/derper.go b/cmd/derper/derper.go
index bad33d683..3eccdfbee 100644
--- a/cmd/derper/derper.go
+++ b/cmd/derper/derper.go
@@ -185,7 +185,7 @@ func main() {
 		}
 		httpsrv.TLSConfig = certManager.TLSConfig()
 		go func() {
-			err := http.ListenAndServe(":80", certManager.HTTPHandler(tsweb.Port80Handler{mux}))
+			err := http.ListenAndServe(":80", certManager.HTTPHandler(tsweb.Port80Handler{Main: mux}))
 			if err != nil {
 				if err != http.ErrServerClosed {
 					log.Fatal(err)
diff --git a/cmd/tailscale/cli/up.go b/cmd/tailscale/cli/up.go
index 01161425c..4b21a277b 100644
--- a/cmd/tailscale/cli/up.go
+++ b/cmd/tailscale/cli/up.go
@@ -97,9 +97,9 @@ func parseIPOrCIDR(s string) (wgcfg.CIDR, bool) {
 		return wgcfg.CIDR{}, false
 	}
 	if ip.Is4() {
-		return wgcfg.CIDR{ip, 32}, true
+		return wgcfg.CIDR{IP: ip, Mask: 32}, true
 	} else {
-		return wgcfg.CIDR{ip, 128}, true
+		return wgcfg.CIDR{IP: ip, Mask: 128}, true
 	}
 }
 
diff --git a/net/netcheck/netcheck.go b/net/netcheck/netcheck.go
index ab7abeda8..0a6b3156b 100644
--- a/net/netcheck/netcheck.go
+++ b/net/netcheck/netcheck.go
@@ -1157,7 +1157,7 @@ func (c *Client) nodeAddr(ctx context.Context, n *tailcfg.DERPNode, proto probeP
 		if proto == probeIPv6 && ip.Is4() {
 			return nil
 		}
-		return netaddr.IPPort{ip, uint16(port)}.UDPAddr()
+		return netaddr.IPPort{IP: ip, Port: uint16(port)}.UDPAddr()
 	}
 
 	switch proto {
@@ -1167,7 +1167,7 @@ func (c *Client) nodeAddr(ctx context.Context, n *tailcfg.DERPNode, proto probeP
 			if !ip.Is4() {
 				return nil
 			}
-			return netaddr.IPPort{ip, uint16(port)}.UDPAddr()
+			return netaddr.IPPort{IP: ip, Port: uint16(port)}.UDPAddr()
 		}
 	case probeIPv6:
 		if n.IPv6 != "" {
@@ -1175,7 +1175,7 @@ func (c *Client) nodeAddr(ctx context.Context, n *tailcfg.DERPNode, proto probeP
 			if !ip.Is6() {
 				return nil
 			}
-			return netaddr.IPPort{ip, uint16(port)}.UDPAddr()
+			return netaddr.IPPort{IP: ip, Port: uint16(port)}.UDPAddr()
 		}
 	default:
 		return nil
diff --git a/wgengine/magicsock/magicsock.go b/wgengine/magicsock/magicsock.go
index 4c7139704..59abf5cbd 100644
--- a/wgengine/magicsock/magicsock.go
+++ b/wgengine/magicsock/magicsock.go
@@ -2828,7 +2828,7 @@ func (de *discoEndpoint) Addrs() []wgcfg.Endpoint {
 	if err != nil {
 		panic(err)
 	}
-	return []wgcfg.Endpoint{{host, uint16(port)}}
+	return []wgcfg.Endpoint{{Host: host, Port: uint16(port)}}
 }
 
 func (de *discoEndpoint) ClearSrc()           {}
diff --git a/wgengine/packet/packet_test.go b/wgengine/packet/packet_test.go
index 7bb88b213..3810e2f31 100644
--- a/wgengine/packet/packet_test.go
+++ b/wgengine/packet/packet_test.go
@@ -206,9 +206,11 @@ func TestParsedPacket(t *testing.T) {
 		})
 	}
 
+	var sink string
 	allocs := testing.AllocsPerRun(1000, func() {
-		tests[0].qdecode.String()
+		sink = tests[0].qdecode.String()
 	})
+	_ = sink
 	if allocs != 1 {
 		t.Errorf("allocs = %v; want 1", allocs)
 	}
diff --git a/wgengine/tstun/tun_test.go b/wgengine/tstun/tun_test.go
index f5dd48abf..7d7452050 100644
--- a/wgengine/tstun/tun_test.go
+++ b/wgengine/tstun/tun_test.go
@@ -29,17 +29,24 @@ func udp(src, dst packet.IP, sport, dport uint16) []byte {
 	return packet.Generate(header, []byte("udp_payload"))
 }
 
+func filterNet(ip, mask packet.IP) filter.Net {
+	return filter.Net{IP: ip, Mask: mask}
+}
+
 func nets(ips []packet.IP) []filter.Net {
 	out := make([]filter.Net, 0, len(ips))
 	for _, ip := range ips {
-		out = append(out, filter.Net{ip, filter.Netmask(32)})
+		out = append(out, filterNet(ip, filter.Netmask(32)))
 	}
 	return out
 }
 
 func ippr(ip packet.IP, start, end uint16) []filter.NetPortRange {
 	return []filter.NetPortRange{
-		filter.NetPortRange{filter.Net{ip, filter.Netmask(32)}, filter.PortRange{start, end}},
+		filter.NetPortRange{
+			Net:   filterNet(ip, filter.Netmask(32)),
+			Ports: filter.PortRange{First: start, Last: end},
+		},
 	}
 }
 
@@ -49,7 +56,7 @@ func setfilter(logf logger.Logf, tun *TUN) {
 		{Srcs: nets([]packet.IP{0x01020304}), Dsts: ippr(0x05060708, 98, 98)},
 	}
 	localNets := []filter.Net{
-		{packet.IP(0x01020304), filter.Netmask(16)},
+		filterNet(packet.IP(0x01020304), filter.Netmask(16)),
 	}
 	tun.SetFilter(filter.New(matches, localNets, nil, logf))
 }