diff --git a/cmake/unix.cmake b/cmake/unix.cmake
index 51c796ddc..56ce80667 100644
--- a/cmake/unix.cmake
+++ b/cmake/unix.cmake
@@ -2,16 +2,21 @@ add_definitions(-DUNIX)
 add_definitions(-DPOSIX)
 
 if(${CMAKE_SYSTEM_NAME} MATCHES "Linux")
+  set(FS_LIB stdc++fs)
   get_filename_component(LIBTUNTAP_IMPL ${TT_ROOT}/tuntap-unix-linux.c ABSOLUTE)
 elseif(${CMAKE_SYSTEM_NAME} MATCHES "Android")
+
+  set(FS_LIB stdc++fs)
   get_filename_component(LIBTUNTAP_IMPL ${TT_ROOT}/tuntap-unix-linux.c ABSOLUTE)
 elseif (${CMAKE_SYSTEM_NAME} MATCHES "OpenBSD")
   set(LIBTUNTAP_IMPL ${TT_ROOT}/tuntap-unix-openbsd.c ${TT_ROOT}/tuntap-unix-bsd.c)
 elseif (${CMAKE_SYSTEM_NAME} MATCHES "NetBSD")
   set(LIBTUNTAP_IMPL ${TT_ROOT}/tuntap-unix-netbsd.c ${TT_ROOT}/tuntap-unix-bsd.c)
 elseif (${CMAKE_SYSTEM_NAME} MATCHES "FreeBSD" OR ${CMAKE_SYSTEM_NAME} MATCHES "DragonFly")
+  set(FS_LIB c++experimental)
   set(LIBTUNTAP_IMPL ${TT_ROOT}/tuntap-unix-freebsd.c ${TT_ROOT}/tuntap-unix-bsd.c)
 elseif (${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
+  set(FS_LIB stdc++fs)
   set(LIBTUNTAP_IMPL ${TT_ROOT}/tuntap-unix-darwin.c ${TT_ROOT}/tuntap-unix-bsd.c)
 elseif (${CMAKE_SYSTEM_NAME} MATCHES "SunOS")
   set(LIBTUNTAP_IMPL ${TT_ROOT}/tuntap-unix-sunos.c)
@@ -19,7 +24,6 @@ else()
   message(FATAL_ERROR "Your operating system is not supported yet")
 endif()
 
-set(FS_LIB stdc++fs)
 
 set(EXE_LIBS ${STATIC_LIB} libutp)
 
diff --git a/llarp/crypto/types.cpp b/llarp/crypto/types.cpp
index 21bde322f..29e0dc9b7 100644
--- a/llarp/crypto/types.cpp
+++ b/llarp/crypto/types.cpp
@@ -25,18 +25,7 @@ namespace llarp
   bool
   SecretKey::LoadFromFile(const char* fname)
   {
-    const fs::path fpath = std::string(fname);
-
-    std::error_code ec;
-    if(!fs::exists(fpath, ec))
-    {
-      return false;
-    }
-    auto optional_f = util::OpenFileStream< std::ifstream >(
-        fpath, std::ios::in | std::ios::binary);
-    if(!optional_f)
-      return false;
-    auto& f = optional_f.value();
+    std::ifstream f(fname, std::ios::in | std::ios::binary);
     if(!f.is_open())
     {
       return false;
@@ -72,15 +61,15 @@ namespace llarp
       return false;
     }
     const fs::path fpath = std::string(fname);
-    auto optional_f      = llarp::util::OpenFileStream< std::ofstream >(
-        fpath, std::ios::binary | std::ios::out);
+    auto optional_f =
+        llarp::util::OpenFileStream< std::ofstream >(fpath, std::ios::binary);
     if(!optional_f)
       return false;
     auto& f = optional_f.value();
     if(!f.is_open())
       return false;
     f.write((char*)buf.base, buf.cur - buf.base);
-    return true;
+    return f.good();
   }
 
   bool
diff --git a/llarp/nodedb.hpp b/llarp/nodedb.hpp
index eb08706be..38e62f2ab 100644
--- a/llarp/nodedb.hpp
+++ b/llarp/nodedb.hpp
@@ -159,9 +159,9 @@ struct llarp_nodedb
   static bool
   ensure_dir(const char *dir);
 
- private:
   void
   SaveAll() LOCKS_EXCLUDED(access);
+
 };
 
 /// struct for async rc verification
diff --git a/llarp/router/router.cpp b/llarp/router/router.cpp
index e9ed88c13..6d1afe7e0 100644
--- a/llarp/router/router.cpp
+++ b/llarp/router/router.cpp
@@ -1361,6 +1361,14 @@ namespace llarp
         {
           dht()->impl->ExploreNetworkVia(dht::Key_t{rc.pubkey});
         }
+        // explore via every conected peer
+        ForEachPeer([&](ILinkSession *s) {
+          if(!s->IsEstablished())
+            return;
+          const RouterContact rc = s->GetRemoteRC();
+          if(rc.IsPublicRouter())
+            dht()->impl->ExploreNetworkVia(dht::Key_t{rc.pubkey});
+        });
       }
       else
         LogError("we have no bootstrap nodes specified");
diff --git a/llarp/util/bencode.hpp b/llarp/util/bencode.hpp
index 1a8081fee..c03b71f5a 100644
--- a/llarp/util/bencode.hpp
+++ b/llarp/util/bencode.hpp
@@ -3,6 +3,7 @@
 
 #include <util/buffer.hpp>
 #include <util/bencode.h>
+#include <util/fs.hpp>
 #include <util/logger.hpp>
 #include <util/mem.hpp>
 
@@ -356,8 +357,12 @@ namespace llarp
       return false;
     buf.sz = buf.cur - buf.base;
     {
-      std::ofstream f;
-      f.open(fpath);
+      const fs::path path = std::string(fpath);
+      auto optional_f =
+          llarp::util::OpenFileStream< std::ofstream >(path, std::ios::binary);
+      if(!optional_f)
+        return false;
+      auto& f = optional_f.value();
       if(!f.is_open())
         return false;
       f.write((char*)buf.base, buf.sz);
diff --git a/llarp/util/fs.cpp b/llarp/util/fs.cpp
index 5168bb7f1..0d647e3f0 100644
--- a/llarp/util/fs.cpp
+++ b/llarp/util/fs.cpp
@@ -3,34 +3,60 @@
 #include <sys/stat.h>
 #include <unistd.h>
 #include <system_error>
+#include <util/logger.hpp>
 
 namespace llarp
 {
   namespace util
   {
+    static std::error_code
+    errno_error()
+    {
+      int e = errno;
+      errno = 0;
+      return std::make_error_code(static_cast< std::errc >(e));
+    }
+
     error_code_t
     EnsurePrivateFile(fs::path pathname)
     {
-      auto str = pathname.string();
-      error_code_t ec;
+      const auto str  = pathname.string();
+      errno  = 0;
+      error_code_t ec = errno_error();
       if(fs::exists(pathname, ec))  // file exists
       {
-        fs::permissions(pathname,
-                        ~fs::perms::group_all | ~fs::perms::others_all
-                            | fs::perms::owner_read | fs::perms::owner_write,
-                        ec);
+        auto st = fs::status(pathname, ec);
+        if(ec)
+          return ec;
+        auto perms = st.permissions();
+        if((perms & fs::perms::others_exec) != fs::perms::none)
+          perms ^= fs::perms::others_exec;
+        if((perms & fs::perms::others_write)  != fs::perms::none)
+          perms ^= fs::perms::others_write;
+        if((perms & fs::perms::others_write)  != fs::perms::none)
+          perms ^= fs::perms::others_write;
+        if((perms & fs::perms::group_read)  != fs::perms::none)
+          perms ^= fs::perms::group_read;
+        if((perms & fs::perms::others_read)  != fs::perms::none)
+          perms ^= fs::perms::others_read;
+        if((perms & fs::perms::owner_exec) != fs::perms::none)
+          perms ^= fs::perms::owner_exec;
+        fs::permissions(pathname, perms, ec);
+        if(ec)
+          llarp::LogError("failed to set permissions on ", pathname);
       }
       else if(!ec)  // file is not there
       {
-        int fd = ::open(str.c_str(), O_WRONLY | O_CREAT, 0600);
-        int e  = errno;
+        errno  = 0;
+        int fd = ::open(str.c_str(), O_RDWR | O_CREAT, 0600);
+        ec     = errno_error();
         if(fd != -1)
         {
           ::close(fd);
         }
-        ec    = std::error_code(e, std::generic_category());
-        errno = 0;
       }
+      if(ec)
+        llarp::LogError("failed to ensure ", str, ", ", ec.message());
       return ec;
     }
   }  // namespace util
diff --git a/llarp/util/fs.hpp b/llarp/util/fs.hpp
index ffae4d291..8d6edc6ec 100644
--- a/llarp/util/fs.hpp
+++ b/llarp/util/fs.hpp
@@ -35,11 +35,10 @@ namespace llarp
     OpenFileStream(fs::path pathname, std::ios::openmode mode)
     {
       if(EnsurePrivateFile(pathname))
-      {
-        std::string f = pathname.string();
-        return T{pathname, mode};
-      }
-      return {};
+        return {};
+
+      std::string f = pathname.string();
+      return T{pathname, mode};
     }
 
     using PathVisitor = std::function< bool(const fs::path &) >;