diff --git a/openbsc/include/openbsc/bsc_nat.h b/openbsc/include/openbsc/bsc_nat.h
index df3841e..abf32fc 100644
--- a/openbsc/include/openbsc/bsc_nat.h
+++ b/openbsc/include/openbsc/bsc_nat.h
@@ -314,6 +314,9 @@
 
 	/* statistics */
 	struct bsc_nat_statistics stats;
+
+	/* control interface */
+	struct ctrl_handle *ctrl;
 };
 
 struct bsc_nat_ussd_con {
diff --git a/openbsc/include/openbsc/control_cmd.h b/openbsc/include/openbsc/control_cmd.h
index 2a5391f..a3f74b4 100644
--- a/openbsc/include/openbsc/control_cmd.h
+++ b/openbsc/include/openbsc/control_cmd.h
@@ -150,6 +150,5 @@
 }
 
 struct gsm_network;
-int controlif_setup(struct gsm_network *gsmnet, uint16_t port);
 
 #endif /* _CONTROL_CMD_H */
diff --git a/openbsc/include/openbsc/control_if.h b/openbsc/include/openbsc/control_if.h
index 96fbf6b..6afc86d 100644
--- a/openbsc/include/openbsc/control_if.h
+++ b/openbsc/include/openbsc/control_if.h
@@ -5,9 +5,17 @@
 #include <openbsc/control_cmd.h>
 #include <openbsc/gsm_data.h>
 
+struct ctrl_handle {
+	struct osmo_fd listen_fd;
+	struct gsm_network *gsmnet;
+
+	/* List of control connections */
+	struct llist_head ccon_list;
+};
+
 int ctrl_cmd_send(struct osmo_wqueue *queue, struct ctrl_cmd *cmd);
 int ctrl_cmd_handle(struct ctrl_cmd *cmd, void *data);
-int controlif_setup(struct gsm_network *gsmnet, uint16_t port);
+struct ctrl_handle *controlif_setup(struct gsm_network *gsmnet, uint16_t port);
 
 #endif /* _CONTROL_IF_H */
 
diff --git a/openbsc/include/openbsc/gsm_data.h b/openbsc/include/openbsc/gsm_data.h
index 572f8f5..dea4119 100644
--- a/openbsc/include/openbsc/gsm_data.h
+++ b/openbsc/include/openbsc/gsm_data.h
@@ -266,6 +266,9 @@
 	/* subscriber related features */
 	int keep_subscr;
 	struct gsm_sms_queue *sms_queue;
+
+	/* control interface */
+	struct ctrl_handle *ctrl;
 };
 
 #define SMS_HDR_SIZE	128
diff --git a/openbsc/src/libctrl/control_if.c b/openbsc/src/libctrl/control_if.c
index 36fdc28..e871a51 100644
--- a/openbsc/src/libctrl/control_if.c
+++ b/openbsc/src/libctrl/control_if.c
@@ -39,6 +39,7 @@
 #include <sys/types.h>
 
 #include <openbsc/control_cmd.h>
+#include <openbsc/control_if.h>
 #include <openbsc/debug.h>
 #include <openbsc/gsm_data.h>
 #include <openbsc/ipaccess.h>
@@ -62,14 +63,6 @@
 #include <osmocom/abis/e1_input.h>
 #include <osmocom/abis/ipa.h>
 
-struct ctrl_handle {
-	struct osmo_fd listen_fd;
-	struct gsm_network *gsmnet;
-
-	/* List of control connections */
-	struct llist_head ccon_list;
-};
-
 vector ctrl_node_vec;
 
 int ctrl_cmd_send(struct osmo_wqueue *queue, struct ctrl_cmd *cmd)
@@ -607,33 +600,37 @@
 	return 0;
 }
 
-int controlif_setup(struct gsm_network *gsmnet, uint16_t port)
+struct ctrl_handle *controlif_setup(struct gsm_network *gsmnet, uint16_t port)
 {
 	int ret;
 	struct ctrl_handle *ctrl;
 
 	ctrl = talloc_zero(tall_bsc_ctx, struct ctrl_handle);
 	if (!ctrl)
-		return -ENOMEM;
+		return NULL;
 
 	INIT_LLIST_HEAD(&ctrl->ccon_list);
 
 	ctrl->gsmnet = gsmnet;
 
 	ctrl_node_vec = vector_init(5);
-	if (!ctrl_node_vec)
-		return -ENOMEM;
+	if (!ctrl_node_vec) {
+		talloc_free(ctrl);
+		return NULL;
+	}
 
 	/* Listen for control connections */
 	ret = make_sock(&ctrl->listen_fd, IPPROTO_TCP, INADDR_LOOPBACK, port,
 			0, listen_fd_cb, ctrl);
 	if (ret < 0) {
 		talloc_free(ctrl);
-		return ret;
+		vector_free(ctrl_node_vec);
+		ctrl_node_vec = NULL;
+		return NULL;
 	}
 
 	ctrl_cmd_install(CTRL_NODE_ROOT, &cmd_rate_ctr);
 	ctrl_cmd_install(CTRL_NODE_ROOT, &cmd_counter);
 
-	return ret;
+	return ctrl;
 }
diff --git a/openbsc/src/osmo-bsc/osmo_bsc_main.c b/openbsc/src/osmo-bsc/osmo_bsc_main.c
index 63e1d8e..aa53eef 100644
--- a/openbsc/src/osmo-bsc/osmo_bsc_main.c
+++ b/openbsc/src/osmo-bsc/osmo_bsc_main.c
@@ -19,7 +19,6 @@
  */
 
 #include <openbsc/bss.h>
-#include <openbsc/control_cmd.h>
 #include <openbsc/debug.h>
 #include <openbsc/gsm_data.h>
 #include <openbsc/osmo_bsc.h>
@@ -29,6 +28,9 @@
 #include <openbsc/vty.h>
 #include <openbsc/ipaccess.h>
 
+#include <openbsc/control_cmd.h>
+#include <openbsc/control_if.h>
+
 #include <osmocom/core/application.h>
 #include <osmocom/core/linuxlist.h>
 #include <osmocom/core/talloc.h>
@@ -425,7 +427,8 @@
 	}
 	bsc_api_init(bsc_gsmnet, osmo_bsc_api());
 
-	controlif_setup(bsc_gsmnet, 4249);
+	bsc_gsmnet->ctrl = controlif_setup(bsc_gsmnet, 4249);
+
 	ctrl_cmd_install(CTRL_NODE_NET, &cmd_net_loc);
 	ctrl_cmd_install(CTRL_NODE_NET, &cmd_net_rf_lock);
 	ctrl_cmd_install(CTRL_NODE_TRX, &cmd_trx_rf_lock);
diff --git a/openbsc/src/osmo-bsc_nat/bsc_nat.c b/openbsc/src/osmo-bsc_nat/bsc_nat.c
index 295535a..b9d4639 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_nat.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_nat.c
@@ -39,12 +39,14 @@
 #include <openbsc/bsc_msc.h>
 #include <openbsc/bsc_nat.h>
 #include <openbsc/bsc_nat_sccp.h>
-#include <openbsc/control_cmd.h>
 #include <openbsc/ipaccess.h>
 #include <openbsc/abis_nm.h>
 #include <openbsc/socket.h>
 #include <openbsc/vty.h>
 
+#include <openbsc/control_cmd.h>
+#include <openbsc/control_if.h>
+
 #include <osmocom/core/application.h>
 #include <osmocom/core/talloc.h>
 
@@ -1760,7 +1762,7 @@
 		exit(1);
 	}
 
-	controlif_setup(NULL, 4250);
+	nat->ctrl = controlif_setup(NULL, 4250);
 	ctrl_cmd_install(CTRL_NODE_ROOT, &cmd_fwd_cmd);
 
 	nat->msc_con->connection_loss = msc_connection_was_lost;