diff --git a/src/or/channeltls.c b/src/or/channeltls.c
index 9fb309d0fd..02b783a8e3 100644
--- a/src/or/channeltls.c
+++ b/src/or/channeltls.c
@@ -49,6 +49,7 @@
 #include "connection.h"
 #include "connection_or.h"
 #include "control.h"
+#include "entrynodes.h"
 #include "link_handshake.h"
 #include "relay.h"
 #include "rephist.h"
@@ -1095,6 +1096,10 @@ channel_tls_handle_cell(cell_t *cell, or_connection_t *conn)
   if (conn->base_.state == OR_CONN_STATE_OR_HANDSHAKING_V3)
     or_handshake_state_record_cell(conn, conn->handshake_state, cell, 1);
 
+  /* We note that we're on the internet whenever we read a cell. This is
+   * a fast operation. */
+  entry_guards_note_internet_connectivity(get_guard_selection_info());
+
   switch (cell->command) {
     case CELL_PADDING:
       ++stats_n_padding_cells_processed;
@@ -1273,6 +1278,10 @@ channel_tls_handle_var_cell(var_cell_t *var_cell, or_connection_t *conn)
       return;
   }
 
+  /* We note that we're on the internet whenever we read a cell. This is
+   * a fast operation. */
+  entry_guards_note_internet_connectivity(get_guard_selection_info());
+
   /* Now handle the cell */
 
   switch (var_cell->command) {
diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c
index 959b4221c1..4a998975d8 100644
--- a/src/or/entrynodes.c
+++ b/src/or/entrynodes.c
@@ -1039,6 +1039,14 @@ entry_guard_consider_retry(entry_guard_t *guard)
   }
 }
 
+/** Tell the entry guards subsystem that we have confirmed that as of
+ * just now, we're on the internet. */
+void
+entry_guards_note_internet_connectivity(guard_selection_t *gs)
+{
+  gs->last_time_on_internet = approx_time();
+}
+
 /**
  * Get a guard for use with a circuit.  Prefer to pick a running primary
  * guard; then a non-pending running filtered confirmed guard; then a
diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h
index 5b3aa66a26..7119d547b1 100644
--- a/src/or/entrynodes.h
+++ b/src/or/entrynodes.h
@@ -283,6 +283,13 @@ struct circuit_guard_state_t {
 };
 #endif
 
+/* Common entry points for old and new guard code */
+void guards_update_all(void);
+const node_t *guards_choose_guard(cpath_build_state_t *state,
+                                  circuit_guard_state_t **guard_state_out);
+const node_t *guards_choose_dirguard(dirinfo_type_t info,
+                                     circuit_guard_state_t **guard_state_out);
+
 #if 1
 /* XXXX NM I would prefer that all of this stuff be private to
  * entrynodes.c. */
@@ -313,12 +320,15 @@ int entry_guard_pick_for_circuit(guard_selection_t *gs,
                                  circuit_guard_state_t **guard_state_out);
 int entry_guard_succeeded(guard_selection_t *gs,
                           circuit_guard_state_t **guard_state_p);
-int entry_guard_failed(guard_selection_t *gs,
+void entry_guard_failed(guard_selection_t *gs,
                        circuit_guard_state_t **guard_state_p);
+void entry_guard_chan_failed(guard_selection_t *gs,
+                            channel_t *chan);
 void entry_guards_update_all(guard_selection_t *gs);
 int entry_guards_upgrade_waiting_circuits(guard_selection_t *gs,
                                           smartlist_t *all_circuits,
                                           smartlist_t *newly_complete_out);
+void entry_guards_note_internet_connectivity(guard_selection_t *gs);
 
 /* Used by bridges.c only. */
 void add_bridge_as_entry_guard(guard_selection_t *gs,