github DanielLavrushin/b4 v1.83.0
on GitHub

4 hours ago

[1.83.0] - 2026-09-26

  • ADDED: Sets can target whole networks by their ASN - an ASN tab in the set editor takes a number such as AS15169 or an IP address, and b4 fetches the network's announced prefixes from RIPEstat and refreshes them daily. The Traffic page can add an address's announced prefix or its whole network to a set, the DPI Detector can add a hosting network, MCP b4_edit_set_targets takes the kind asns, and shared and community sets carry ASNs.
  • FIXED: A set whose GeoIP or GeoSite file or category was missing acted on every connection to the ports in its port filter, and its MSS clamp on every HTTPS connection from its source devices - b4 took a set with no expanded domains or addresses for one that matches by port alone, and an MSS clamp with no addresses fell back to the set's devices.
  • FIXED: A cut-off download of geosite.dat or geoip.dat stopped b4 from starting until the file was fetched again by hand - the installer wrote each attempt over the working file and gave up on a 74 MB GeoSite after 600 seconds, the web UI likewise put an error page or a transfer cut off without a length in its place and gave up after 10 minutes, and b4 exited on a file it could not read before its web UI or the re-download of missing files started.
  • CHANGED: The installer shows the size of each GeoSite and GeoIP source and no longer defaults to one whose file does not fit - the RUNET Freedom GeoSite is 74 MB, so on a fresh install where it does not fit in the target directory the installer offers the smallest source that does, such as Loyalsoldier at 11 MB, and a reinstall keeps the source already configured.
  • FIXED: Settings could be lost to a save cut short, for example by a power loss, or to an address added from the Traffic page during another save - the file was rewritten in place, so after an interrupted save b4 started on the defaults and wrote them over the file at the next one, and the add saved a copy of the configuration taken before the other change.
  • FIXED: Overlapping packet duplication addresses such as 8.8.0.0/16 and 8.8.8.0/24 stopped the bypass on nftables, and packet duplication and the MSS clamp picked up new addresses late - nft refused the overlapping ranges and b4 then removed its bypass rules, and a save that turned duplication on or changed its addresses did not refresh the firewall, nor did an add from the Traffic page or a GeoIP file update.
  • FIXED: Saving settings took seconds with large routing sets on nftables - every save reloaded a routing set's addresses 128 at a time, one nft call each, about 150 calls for 19,000 addresses.
  • FIXED: The IPInfo token could end up in b4's log, IPInfo and RIPE NCC lookups on the Traffic page could hang, and a failed add there showed a JSON parse error instead of the reason - a failed IPInfo request logged its URL with the token in it, the lookups had no timeout, and add errors came back as plain text.
  • ADDED: Telegram over WebSocket can be turned on with a switch under Settings, Telegram, without a set or GeoIP and GeoSite files - it bridges Telegram for the devices behind b4 and the router itself by Telegram's address ranges, which b4 carries and refreshes daily, and its card shows whether the bridge works and what is missing when it does not. The tab formerly named MTProto Proxy is named Telegram, the switch system.mtproto.bridge.enabled can be changed over MCP, sets in the Telegram over WebSocket routing mode work as before, and the Traffic page labels their connections and the bridge's Telegram bridge instead of -ws.
  • ADDED: Two options under Settings, Telegram for networks that block Telegram's WebSocket edge or throttle workers.dev - Fronting name for Telegram's WS edge (advanced) takes another TLS name, such as sprinthost.ru as tg-ws-proxy uses, that b4 tries after a handshake for the kws*.web.telegram.org names fails, and b4 closes any handshake that does not end on a telegram.org certificate. Let sets process Worker connections, shown once a Cloudflare Worker domain is set, lets a set with a working strategy for Cloudflare process b4's own connections to the Worker; both are off by default.
  • FIXED: Telegram through the MTProto proxy and the WebSocket bridge dropped connections and loaded media slowly where Telegram's own servers are blocked or unreliable, and on Android some channels' photos and videos did not load through the bridge, with -444 warnings in the log - b4 tried its routes one at a time, waited three seconds on Telegram's edge before trying Cloudflare, retried dead edges every five minutes and kept spare connections for only 20 seconds, and it took an Android session's data centre from the address, which for 149.154.167.255 gave data centre 2 instead of 4.
  • FIXED: Telegram through the WebSocket bridge kept failing where workers.dev is throttled, a working Cloudflare Worker was cut off and set aside for ten minutes mid-session, and Telegram's Cloudflare routes failed while a set covering Cloudflare was on - the bridge sent connections it could not decode to the Worker even on ports other than 443, which the Worker cannot reach, and even when its only Worker had been set aside, the stall check took an idle session's next request, or a lone acknowledgement, for a Worker that had stopped answering, and b4's own connections to Cloudflare got the faking and fragmentation of such a set, for example one with the cloudflare GeoIP or GeoSite category, which break them on some networks.
  • FIXED: b4 contacted core.telegram.org, proxy.b4core.app when that failed, and raw.githubusercontent.com on every start, even with every Telegram feature off - the Telegram data-centre list and the Cloudflare proxy domain list were downloaded whatever the settings.
  • ADDED: Discovery can find a strategy for an existing set, and the watchdog can keep a set working - a set keeps up to five addresses on the new Discovery tab of the set editor, and Find a strategy in the set card's menu opens Discovery on them. With Keep this set working with the watchdog on, the watchdog checks those addresses and, when they keep failing, runs Discovery for the set, writes in a strategy that works for every address and puts the old one back if they still fail; the per-domain list keeps working and its entries can be moved into a set, and MCP b4_find_bypass_strategy and b4_watchdog take a set.
  • CHANGED: Replacing a set's strategy from Discovery changes only what Discovery tested - the set keeps its UDP settings and routing, and adding the site to a set that does not already cover it, which also takes it out of every other set, is a checkbox that is on by default. Before, only a set that already listed the site could be picked, and the replace always added the site, took it out of every other set and copied UDP and DNS settings that Discovery never tested.
  • FIXED: A watchdog heal could damage the set it healed, and after any strategy change the sites the old strategy had failed on stayed refused for up to five minutes - the heal could write a strategy that had not passed confirmation, wiped the set's port filter, RST protection and UDP settings, and was undone by the next save from a Settings or set page opened before it, and IP block detection with Cache Blocked IPs on answered new connections to those sites with b4's own reset until the entry expired.
  • FIXED: Discovery could pass a strategy that ended on the ISP's block page, probe the router's own network, and wait out the whole timeout on a connection that froze mid-page - it judged only the page a redirect ended on, only the MCP tool refused a local or private address such as 192.168.1.1 and only when typed as one, and the 2-second stall check ran only after a read finished, while a read waits for data until the timeout ends.
  • FIXED: The watchdog and the DPI Detector reported blocking that was not there, and the Detector said port 53 queries reached their resolvers when one redirect answered them all - a same-site redirect such as /login?reason=session_blocked matched the block-page markers, a single DNS timeout or error, never retried, showed as Fake DNS for a site and Substituted for a resolver, and the port 53 summary took the absence of hijacked rows as proof that every query reached its resolver, although a redirect to a well-known resolver such as Google is never marked.
  • FIXED: Proxy sets and Telegram over WebSocket could stop carrying traffic, for example after XrayUI restarted xray - XrayUI's rule at the top of mangle PREROUTING took the packets of connections b4 had diverted to its listeners, the listener rule refused the router's own connections with Allow only selected devices on under Device Filtering, a listener whose port was taken at start stayed closed until the next save, and a proxy set whose targets included the server of an upstream running on the router or elsewhere in the network looped that upstream's own connections back into it and cut off every device behind the set.
  • FIXED: Send domain name to upstream changed nothing for most connections, so an upstream such as Tor got only an address and, with SafeSocks on, refused the connection as "giving Tor only an IP address" - the name came only from a TLS or QUIC hello b4 had seen in its packet processing, which a connection the set diverts never passes.
  • FIXED: A set with an output interface sent its fake and split packets out the main uplink after some saves on iptables, and could delete every routing rule on the router and replace its default route when routing tables 100 to 249 were all taken - a save that rebuilt the firewall rules, such as a change of ports, packet limits, NAT Masquerade or an MSS clamp, put b4's rule that lets its own packets through back above the jumps into the sets' chains, and a DNS answer for a set the sync had skipped for lack of a free table installed it anyway with mark 0 and table 0, which ip rule and ip route read as every rule and the main table.
  • CHANGED: TUN picks its routing tables itself from the free ones below 100, instead of the fixed tables 9999 and 9998 - busybox ip accepts table ids only up to 1023, so TUN did not start on it (invalid argument '9998' to 'table ID'), and TUN's cleanup deleted every rule pointing at those tables whoever had added it, flushed a table it had refused as busy and left its own two rules for the main table behind. queue.tun.route_table still sets a table by hand, and busybox ip older than 1.33 cannot run TUN at all.
  • ADDED: System Info shows how many of TUN's capture rules are in place and how often b4 restored its rules, with the time of the last restore - in TUN mode the firewall monitor interval also appears under Settings, Core, Firewall Features, with a 10-second minimum.
  • FIXED: In TUN mode, a router firewall restart, such as after a port-forward change on Xiaomi, left b4 seeing no traffic and without its other rules until b4 was restarted, some setting changes also waited for a restart, and on iptables 1.8 device filtering dropped LAN devices out of capture for a moment on every check - the TUN engine checked only that its capture chain existed, the firewall monitor, which also answers SIGUSR1, ran only with NFQUEUE, TUN read a set's ports, the packet limits, duplication addresses, the device filter, NAT Masquerade and MSS clamps once at start, and MAC addresses were compared case-sensitively while iptables 1.8 prints them in lowercase.
  • FIXED: In TUN mode with NAT Masquerade on and no interface selected, or with a router masquerade rule that names no outgoing interface, b4 captured traffic but no site opened - such a rule gave packets entering the TUN device that device's own address before TUN could give them the uplink's, so no reply came back.

What's Changed

New Contributors

Full Changelog: v1.82.3...v1.83.0

Check out latest releases or
releases around DanielLavrushin/b4 v1.83.0

Don't miss a new b4 release

NewReleases is sending notifications on new releases.

Get notifications