DanielLavrushin/b4 v1.75.0

on GitHub

[1.75.0] - 2026-08-08

• FIXED: A domain was handled by a different strategy than the one Discovery found for it - every result was published with all the domains of the run, so two applied results claimed the same domains and set order picked the winner.
• FIXED: A set applied from Discovery had no effect until b4 was restarted - it was saved and listed in the interface while the traffic it named kept going out under the previous settings.
• ADDED: A warning when several enabled sets name the same domain - only one of them handles that domain, chosen by its place in the list rather than by which strategy works.
• ADDED: A switch for matching every domain, and one for matching every address - a set meant to catch everything had to be written by hand as regexp:.* or 0.0.0.0/0, and neither form appears anywhere in the interface. The IPv6 half, ::/0, was easy to leave out, so a catch-all set passed IPv6 traffic through untouched without saying so. Typing *, any or all into either field adds the same entries, and *.example.com is stored as example.com, which was taken as written and matched nothing.
• FIXED: Two sets listing the same IP range fought over it unpredictably - only one of them reached the matcher, and it was whichever was stored last rather than the one placed higher in the list. A set restricted to source devices lost the range outright to a general set below it, and the winner could change between restarts. Ranges of equal length are settled by set order, and a device-scoped set is offered the traffic first.
• FIXED: 0.0.0.0/0 among a set's IP targets was dropped on the way to the firewall - ipset cannot store a network with a zero prefix size, so on routers using iptables the routing set lost that entry, while per-set MSS clamping and duplication lost every entry alongside it, since those are loaded in one batch that fails whole. The matching engine had accepted the same entry all along, so a set matched traffic while its firewall side stood empty. Both catch-alls are written to the firewall as their two halves.
• FIXED: A set routed through a TCP-only upstream proxy left no firewall rules at all on routers using iptables - each sync of the set failed on the name of its QUIC-refusing chain, one character over the length iptables accepts. #291
• FIXED: DNS sent over TCP skipped the set's DNS server - only requests over UDP were intercepted, so a device that switched to TCP reached the router's usual resolver instead.
• ADDED: A DNS section in Settings - the port used for DNS over TCP, how long to wait for an answer, an off switch, and a check against ports other services already use.
• ADDED: DNS request outcomes in the trace - a trace named the domain but never whether the request reached the set's DNS server or slipped past it.
• FIXED: One refusal from Telegram's WebSocket edge switched off a working Cloudflare Worker - the refusal was treated as a verdict on every WebSocket route to that data center, including the relay the user runs themselves.
• FIXED: A paused Telegram data center address was answered with an instant failure - Telegram read that as grounds to reconnect immediately, filling the log with hundreds of identical lines a second.
• ADDED: A warm spare connection to your Cloudflare Worker - one ready connection per Worker and data center, in place of the 65-90 ms handshake every new Telegram connection paid for.
• FIXED: Traffic to a Cloudflare Worker was cut into one small write per Telegram message - that framing was only ever required by Telegram's own WebSocket edge.
• CHANGED: Several Worker addresses are tried in a random order - they were tried strictly as written, so the first absorbed all the traffic and all the rate limiting.
• FIXED: System diagnostics reported jq, sha256sum and nohup as missing while they were installed - the check looked in fewer folders than a terminal session does.
• FIXED: Flow offloading was reported as a problem even when it had been set up to leave b4 alone - the check could not tell a fast path that skips b4 entirely from one held back until b4 has seen the start of a connection.
• CHANGED: IP block detection also covers a destination that never answers its SYN - the feature is described for addresses the firewall drops at the IP level, but it counted TLS ClientHello retransmissions, and a ClientHello exists only once a handshake has completed. An address-level block kills the handshake itself, so the single case the description named was the one case the check could not see, and what it did catch was a stateful block after the handshake.
• ADDED: The router tests a destination itself before treating it as blocked - packets going unanswered for one device is equally consistent with a slow server, a brief routing glitch or an uplink outage, so acting on that evidence alone resets connections to a destination nothing was ever wrong with, and an uplink that drops for a minute looks indistinguishable from every destination being blocked at once.
• FIXED: A destination marked blocked stayed blocked for as long as anything kept trying it - each lookup refreshed the entry's timestamp, so the five-minute expiry was never reached while a device kept retrying, and nothing re-tested the address in the meantime. A false positive, or a block that had since been lifted, held for the lifetime of the traffic.
• ADDED: An IP Health section in Settings - whether an address answers depends on the address and the path to it rather than on the set that happened to match it, so the verdict is one shared judgement rather than a per-set one, and how long it lasts had no control of its own.
• ADDED: A switch that strips unreachable addresses out of DNS answers - a CDN answers with several addresses of which the firewall drops only some, so one device hangs on a blocked one while another on the same network loads the site. Pinning a working address by hand in the hosts file or as a dnsmasq alias had to be done per address, per domain, and again whenever the CDN changed its addresses.
• ADDED: Import from another tool - a byedpi or zapret configuration had to be rebuilt in b4 by hand, option by option. A pasted command line becomes one set per profile, and every option is reported as carried over, approximated, or without an equivalent in b4. Domains are asked for per set, since such a command line rarely carries the host list itself. Sets > Import.

What's Changed

• feat: implement Cloudflare Worker connection pooling and management by @DanielLavrushin in #290
• fix: update log level check in logDNSEvent to use LevelInfo for impro… by @DanielLavrushin in #292
• fix: enhance flow offloading detection and handling for improved perf… by @DanielLavrushin in #293
• Implement IP health monitoring and management features by @DanielLavrushin in #294
• feat: add conversion API and tools support by @DanielLavrushin in #295

Full Changelog: v1.74.2...v1.75.0