github DanielLavrushin/b4 v1.88.0
on GitHub

3 hours ago

[1.88.0] - 2026-10-21

  • ADDED: A set can handle only calls, such as Discord voice calls - the option is Handle only calls in the Calls field on a set's UDP tab, and Which calls can narrow it to the Discord app or to browsers. Such a set has no targets and acts only on the packet that opens each call on its UDP ports, taking the call from any other set. The guide Discord voice calls describes the setup, and such sets also come from the import tool or the Community Hub.
  • ADDED: The dashboard lists devices again, in its Devices panel - a row shows a device's name and address, how many connections it made and the sites it connects to most. Clicking a device opens its traffic on the Traffic page, its connections through proxy sets and b4's SOCKS5 server included. A device whose MAC address b4 does not know, such as the router itself, is listed by its IP address.
  • ADDED: Devices that left the network can be forgotten under Settings, Core, Devices - an offline device has a Forget device icon next to its name, and Forget offline clears them all at once. b4 deletes the name, selection and MSS value it keeps for the device and removes it from the source devices of sets. A device name can also be removed by saving it empty.
  • ADDED: Settings and the set editor mark unsaved changes and ask before they are lost - a dot marks each changed field and the tab, section or list item that holds it. Leaving the page with unsaved changes, or Discard Changes, first lists each change with its old and new value. In the set editor, Discard Changes takes the place of Cancel and does not close the editor. #434, thanks @alle-ox
  • ADDED: A slider's value can be typed in - clicking the number next to a slider opens a box for it. Enter or a click elsewhere applies the value, and Escape cancels. #434, thanks @alle-ox
  • ADDED: For a site that needs no bypass, Discovery lists the strategies that also loaded it, and any of them can be applied as a set - this helps when a browser still cannot open a site that Discovery's checks load without b4. They appear under N other strategies worked, on the site's result card and in its history row. #423
  • CHANGED: Filter STUN Packets on a set's UDP tab became the Calls field - on became Pass call setup, and off became Handle like other UDP. With Pass call setup, the set lets STUN requests and the Discord app's voice packets through unchanged. The rest of a call, such as browser audio and video, still gets the set's Action Mode.
  • CHANGED: A set acts on QUIC to an address it learned only when the connection carries a site name the set targets - it also acted on every QUIC connection to such an address, including connections to other sites that share it, such as a CDN address. On the Traffic page the set appears only on the packets of such a connection that carry the name. QUIC Matching set to By SNI or matched destination, on the set's UDP tab, keeps the old behaviour, and UDP that is not QUIC still follows a learned address. #437
  • CHANGED: The Traffic page and the dashboard show a device by its name, or by its IP address when it has none - the Traffic page used device names only with Enable Device Filtering or Vendor Lookup on. Otherwise it showed most devices by MAC address, and some of a device's connections apart, under its IP address. The MAC address shows on hover and in the Detail pane.
  • CHANGED: A set's JSON pasted on the Import/Export tab is no longer imported at once - it appears formatted in the box, and Import applies it. The box shows where a broken JSON fails, and Format JSON tidies text typed by hand. #434, thanks @alle-ox
  • CHANGED: A Device Filtering change takes effect when the settings are saved, with no restart - the change used to wait for a restart of b4. Before that restart, turning the filter on or off could make b4 process the same connections twice.
  • FIXED: The Traffic page showed STUN and Discord voice packets as handled by a set that let them through - with Filter STUN Packets on, a set passed these packets through unchanged, yet their rows looked the same as rows of packets the set had handled.
  • FIXED: Some set editor help texts described the wrong behaviour - the TCP Port Filter said port 443 is always included, and the UDP Port Filter said an empty field turns it off. A list limits the set to the ports listed, and an empty field means every port. The UDP Evasion Technique said None sends fakes unchanged and TTL lets them expire, while UDP fakes always use the set's Fake TTL.
  • FIXED: The Connection Packets Limit sliders on a set's TCP and UDP tabs had no effect - b4 took the limit for every set from TCP Connection Packets Limit and UDP Connection Packets Limit under Settings, Core, Packet Engine.
  • FIXED: The import tool lost a port filter or the shared domains without a warning - a zapret port range with equal or reversed ends, such as 3478-3478, was dropped when the set was saved. A set whose port filter held only that range acted on every port. Shared domains went unused when every profile had a host list of its own.
  • FIXED: Site tests reported sites that redirect to their www. address, such as youtube.com and wikipedia.org, as failing both with and without b4 - the MCP tool b4_test_domain_now and the Test button of a Community Hub set stopped at any redirect to another host, even one of the same site. If a site sent visitors on to another site, such as twitter.com to x.com, or answered with a nearly empty page, b4_test_domain_now also said the address may be blocked or the site may be down. #445
  • FIXED: MCP answers did not tell an AI app which setting to change, or where - a refused write read only "Configuration is invalid". Messages about Allow active probes and Allow configuration changes did not say that these switches are in b4's web interface. An AI app then sent users to its own settings. #446
  • FIXED: An MCP undo that needed Allow active probes stayed refused after the switch was turned on - b4 counted the switch itself as a newer change to the configuration and refused the undo as outdated.
  • FIXED: A block set limited to Source Interfaces also blocked other interfaces and the router itself - only blocking by address followed the list. Blocking by name, in DNS lookups and in connections, applied to every device and to the router's own connections. A block set with an escalation target also stopped blocking a site once a device retried a blocked connection a few times.
  • FIXED: Block QUIC (force TCP) had no effect on a proxy set with Route UDP through upstream on - b4 sent all of the set's UDP, QUIC included, to the upstream before the switch could act. Over a slow upstream, such as one behind a TCP-only VPN, videos then loaded slowly. With Route UDP through upstream off, QUIC was refused, but the set's other UDP left directly, including the WebRTC requests that can reveal the real address. #456
  • FIXED: On ASUS routers with Asuswrt-Merlin, a proxy set with Route UDP through upstream off did not refuse QUIC - the router's firewall accepted the devices' traffic before it reached b4's rule. QUIC to the set's addresses left directly, around the upstream.
  • FIXED: On ASUS routers with AiProtection on, and for the devices KeeneticOS lists for its hotspot, b4 missed the replies of many device connections - the firmware writes connection marks of its own. When such a mark held every bit of b4's Packet Mark, b4 took the connection for one of its own lookups. It then saw none of the connection's SYN-ACKs, resets or answers from DNS servers outside the router. #441
  • FIXED: A proxy set with All devices except selected under Source Devices refused QUIC from the excluded devices too - the set refuses QUIC when Route UDP through upstream is off, and that refusal ignored the device list.
  • FIXED: With the UDP action Coalesce QUIC Initial, an app that opens a QUIC connection in a single packet could not connect at all, even to sites the network does not block - servers such as Cloudflare's and Google's leave a packet that begins with b4's padding packet unanswered, and b4 put the padding packet in front of every repeat the app sent. Browsers were not affected: they open a connection with two packets, and only one of them carries the site name. #427
  • FIXED: b4 could stop on a malformed QUIC packet sent to an address a set covers - the packet's header declared a longer start than the packet carried. b4 read past the end of the packet while preparing the set's fake packets, and this reached every version that sends them.
  • FIXED: A site a set drops, rejects or blocks over QUIC still opened when another set had learned its address - on an address shared by several sites, such as a CDN address, b4 took both the set and the site name from what the other set had learned for that address, and never read the name the connection itself carried. #437
  • FIXED: In TUN mode, memory use grew with every new connection - b4 kept a record of where each connection came from and never removed old records.
  • FIXED: On a phone the set editor's Cancel and Save buttons covered the set name, and long section headers were cut off - the buttons shared a row with the name field, which cannot shrink below its minimum width. Section headers were held to one line, so a header wider than its card ran past the edge. Russian headers, being longer, hit it first. #448, #449
  • FIXED: In the Russian interface the units on sliders and the name of a new set stayed in English - sliders read bytes, ms and sec, and a new set was named Set 5. In both languages the SYN Fake TTL slider showed its value in milliseconds, although the setting counts hops rather than time. #450
  • FIXED: Device Filtering ignored the devices added under Manual Devices - such a device got no DPI bypass when selected, and still got it when excluded. A selection made only of such devices applied DPI bypass to every device. The filter matched devices by MAC address alone, and these devices, such as clients of the router's own VPN server, have no MAC address b4 can see. #442
  • FIXED: In TUN mode, Device Filtering kept the selected devices out of RST Injection Protection and Remove ECH keys from DNS answers - b4 took only the packets these devices sent. Resets and answers from a DNS resolver outside the router come from the server, so they never reached b4.
  • FIXED: A device without a name vanished from the device lists when it went offline, while b4 kept its selection and MSS value - this hit the list under Settings, Core, Devices and a set's Source Devices list. Such a device still counted as selected but could not be seen or unselected on its own. In a set's list, a device whose MAC address was stored in lowercase also showed as not selected.
  • FIXED: Discovery for a set that writes its own DSCP value, and the watchdog's heals of such a set, ran their tests without that value - the tests carried it only to addresses the set had already learned from other traffic. Where a router in front of b4 picks the internet provider by DSCP, the search ran through another provider than the set's traffic. A heal could then write a strategy found there into the set, and applying a result could move its sites into a set with another DSCP value or none.
  • FIXED: b4 kept trying to remove a DSCP chain that was already gone when it ran on iptables and legacy iptables tables also existed - iptables reports a missing chain differently there, and b4 did not read that answer as gone. Its DSCP rules then counted as not applied, and the firewall monitor retried them every few seconds.

What's Changed

New Contributors

Full Changelog: v1.87.0...v1.88.0

Check out latest releases or
releases around DanielLavrushin/b4 v1.88.0

Don't miss a new b4 release

NewReleases is sending notifications on new releases.

Get notifications