Aether is a user-space proxy client. It tunnels traffic out of a filtered network and exposes a local SOCKS5 proxy on 127.0.0.1:1819. Point a browser, terminal, or system proxy at that address and your traffic leaves through the tunnel.
What's new in v1.7.0:
New
--upstream <url> dials out through another proxy, so Aether can be chained behind a VPN or proxy app already running on the machine. Accepts socks5://host:port, http://host:port, or a bare host:port for SOCKS5, with credentials in the URL. A SOCKS5 proxy with UDP associate carries every transport; an HTTP proxy carries the HTTP/2 carrier only, since CONNECT cannot carry UDP, so pair it with --h2.
The endpoint scan, the registration calls, and the ECH lookup go through the proxy as well, so the sweep does not reveal your address while the tunnel hides it. A destination matched by --route-direct still goes out directly, because that rule exists to bypass the tunnel.
Fixes
Domain routing rules silently never matched behind a tun front end. The front end resolves the name itself, so the proxy was handed an address and --route-block and --route-direct entries written as domains could not apply. The name is now taken from the TLS server name or the HTTP Host header of the first bytes and the decision is made on that, with address and port rules still applying when no name is found. AETHER_ROUTE_SNIFF=0 turns it off, AETHER_ROUTE_SNIFF_MS widens the wait.
Both hops of --gool always landed on the same edge address, so warp-in-warp had no second layer. Two separate edges are now picked out of one scan, at no extra scan cost.
The WireGuard scan put every seed address on port 2408 at the front of the sweep, and turbo stops at the first answer, so it latched onto one address that answers a handshake but carries no traffic. Each address gets its own port again and the sweep spreads across addresses and ports as it did before.
A saved identity that Cloudflare no longer accepts kept its key recognised, so the handshake succeeded, the endpoint looked healthy, and nothing passed. Aether now checks the saved identity on startup, says so, and registers a fresh device rather than reporting the scan as the problem. AETHER_REPROVISION=0 reports it without replacing anything. Only the account API refusing the device counts, so being offline or rate limited does not discard a good identity.
An upstream proxy is no longer used for a loopback or private destination, which would otherwise have sent the inner --gool tunnel through the proxy's own loopback.
See README.md and the Docs directory for install steps, transport selection, obfuscation profiles, and the full environment-variable reference.
What's Changed
- fix: stop unbounded memory growth that hangs the OS by @abolfazlakbarzadeh in #66
New Contributors
- @abolfazlakbarzadeh made their first contribution in #66
Full Changelog: v1.6.0...v1.7.0