[1.89.0] - 2026-10-30
- ADDED: Connections to an address the provider blocks for all sites on it fail at once instead of hanging - sets with IP Block Detection and Cache Blocked IPs on ban such an address for 24 hours, or for 7 days when it is caught again. DNS answers that list other addresses leave it out, and the dashboard's Banned addresses panel lists the bans. Bans are on by default, and Remember blocked addresses under Settings, Core, Packet Engine turns them off. The saved ban list with re-tests is inspired by Ladon.
- ADDED: AI apps connected to b4's MCP server can look up b4's REST API - the b4_api_reference tool describes every operation of that API from a copy built into b4, for tasks the other MCP tools do not cover. With a login set for the web interface, calls to the API need its username and password. The tool tells the AI app to ask the user for them first.
- CHANGED: The MTProto proxy's first answer to a Telegram app follows the answer of its Fake SNI Domain - b4 checks that site from the router every few hours and copies its cipher, its key exchange and the size of the first part of its answer. The answer also carries a real encryption key instead of random bytes and comes after a short pause. A site without TLS 1.3 cannot be followed, and the log warns about it.
- FIXED: In TUN mode b4 could keep the router's processor fully busy, and sites stopped opening on every device - b4 learned which device a connection came from by reading the router's whole list of connections. On some routers one read takes about a quarter of a second, and b4 did one for nearly every new connection. Since 1.88.0 it also did one for every DNS answer the router sends a device.
- FIXED: On Keenetic, connections to port 443 through a proxy set or Telegram over WebSocket stalled once they opened - Telegram, for example, stayed on Updating. Keenetic's firewall drops data that arrives for port 443 on the router itself, apart from its own. These sets hand their connections to b4 on the router, and that rule dropped their data. #469, thanks @asovetov
- FIXED: Sites that need a bypass could stop loading until b4 was restarted - this happened when the firmware or another service removed the firewall rules that pass traffic to b4 but left the rest of b4's rules. b4 checks its rules regularly, but these were not part of the check and were never put back. #468, thanks @asovetov
- FIXED: With Telegram over WebSocket on, proxy sets never got the Telegram connections the bridge cannot relay itself - the switch takes every connection to Telegram's addresses ahead of other sets. Such connections, a bot's requests to api.telegram.org for example, went through the Cloudflare Worker or directly, even when a proxy set listed the site or covered Telegram's addresses. Where Telegram's addresses are blocked, they were reset after about 13 seconds.
- FIXED: Photos and videos through the MTProto proxy or Telegram over WebSocket sometimes started loading only after 1-3 seconds - b4 sent each media connection of a Telegram app through Telegram's own WebSocket server or a Cloudflare relay, whichever answered. The two led to different Telegram servers, and the app's key for media worked only on the side that made it. Each switch made the app create a new key, and its other new connections waited for it.
- FIXED: On some networks Telegram over WebSocket and the MTProto proxy stopped loading photos, videos and files - b4 opened each connection through Cloudflare, to the shared domains or a Cloudflare Worker, with a first message too large for one network packet. Since late October some networks drop such connections to Cloudflare. Where Telegram's own servers were reachable, messages still went through, but everything that needs a Cloudflare route timed out.
What's Changed
- feat: add landing page components and styles by @DanielLavrushin in #470
- tables: keep the capture chain's queue rules under watch, so a firmware netfilter rebuild cannot silently stop every strategy by @asovetov in #468
- Implement IP banning functionality with tests by @DanielLavrushin in #471
- feat: add GitHub Actions workflow for test build process by @DanielLavrushin in #472
- tables: exempt tproxy-delivered packets in the mangle INPUT table too, so a firmware drop on locally delivered 443 cannot kill a proxied connection by @asovetov in #469
- docs: banned addresses, 1.89.0 changelog entry and Ladon credit by @DanielLavrushin in #473
- Add API specification tests and MCP API handler by @DanielLavrushin in #474
- feat: update changelog for version 1.89.0 with new features and fixes by @DanielLavrushin in #476
- Add skills for b4 issue triage, MCP server management, pull request h… by @DanielLavrushin in #477
- feat: enhance TUN source resolver with local socket handling and conn… by @DanielLavrushin in #478
- feat(tproxy): add SetMatcher interface and implement host/address mat… by @DanielLavrushin in #479
Full Changelog: v1.88.2...v1.89.0