github DanielLavrushin/b4 v1.91.0
on GitHub

59 minutes ago

[1.91.0] - 2026-11-14

Added

  • A set can advertise a small TCP window in a connection's first packets, so the server sends the start of its reply in small pieces: Real TCP window (wssize) under TCP, General in the set editor, based on wssize from zapret2. (#561, thanks @SoloIl)
  • A set can ask more than one DNS resolver: the Resolvers field on its DNS & Routing tab holds up to eight, asked in order when one fails or is slow, and replaces the resolver type switch and its two fields. (#551, thanks @asovetov)
  • Without a login for the web interface, the log warns when b4 refuses a page at another address, and names the address b4 saw and what to change.
  • On Keenetic, interface lists such as Capture Interfaces and a set's Output Interface show the name the router gives each connection, as in WARP (nwg4), and devices carry the name they have in the router's web interface. (#501, thanks @niklzz)
  • With Allow configuration changes on, an AI app connected over MCP can turn a zapret or byedpi command line or configuration file into sets, as Import on the Sets page does, and shows what did not convert before it creates them. #540
  • Disorder has a Split Position and an In Order shuffle mode in the set editor: with SNI-Based Splitting off, one cut at that byte gives an Overlap Length shorter than the position room to be sent, and In Order sends the segments as they lie in the packet. #591

Changed

  • When the login session ends while a page is open, for example after b4 restarts, a sign-in window appears over the page and unsaved changes stay in place. #569
  • The device tables under Settings, Core, Devices and on a set's Source Devices tab show a device's host name ahead of its vendor, and the Traffic page shows the address next to a named device. (#501, thanks @niklzz)
  • Fake data written out in an imported zapret or byedpi command line is saved on the Payloads tab, and the set uses it as My own Payload File or, for UDP, as its Fake Packet Payload. #538
  • The import report says when a set sends b4's default UDP fakes because its zapret or byedpi profile does nothing to UDP.
  • An imported zapret --wssize switches on Real TCP window (wssize) with its window and scale, in place of the zero-window fake ACKs of Window Manipulation.
  • Applying a set on the Community page lists the enabled sets below it whose geosite, geoip or ASN targets it takes over, and offers Disable or Replace for a set left handling nothing. #564

Fixed

  • Without a login for the web interface, the Logs, Traffic, Dashboard and Discovery pages got no live data behind a reverse proxy that drops the port from the Host header, such as nginx with proxy_set_header Host $host.
  • With the web server's Bind Address set to 127.0.0.1 behind a reverse proxy such as nginx, AI apps could not connect over MCP: every request was refused with invalid Host header, even with a valid token. #566
  • After signing in, the Ask AI to explain this setting buttons were missing until the page was reloaded, and the sign-in page kept calling b4 in the background, which filled the browser console with errors. #569
  • When another service on the router removed the routing rule of a proxy set or Telegram over WebSocket, the set passed no traffic until b4 restarted: devices' connections hung and the router's own went out directly.
  • While b4 rebuilt its routing rules, as after the router's firewall was rewritten or a set's routing was changed, a connection opened at that moment could miss a proxy set: a device's stalled, and the router's own, such as one through b4's SOCKS5 server, went out directly.
  • On routers with an old kernel, such as 3.16, a set routed through an interface gained another copy of its routing rule on rebuilds, listed under System Info.
  • With Try strategies that worked before on, Discovery began every run with remembered strategies that no longer worked, because a pass with a different fake was counted for them, and the runs took longer. #510
  • Open in a Discovery notification could lead to an empty form or to another search, such as one the watchdog started afterwards, instead of the run it announced. #552
  • When the web interface or its API answered with a server error, such as a 500, errors.log often had no line about it. #530
  • Interface lists left out interfaces that were down, so a switched-off WireGuard connection could not be picked as a set's Output Interface. (#501, thanks @niklzz)
  • A ban from IP Block Detection on a server that answers only its own sites, such as a YouTube video server, never ended early, even after the set reached the site again, because the re-tests asked for unrelated names only. #547
  • A byedpi fake imported from the command line (-l :...) came out changed when it held binary data, and its set showed Fake Payload Type as a bare 1. #538
  • An imported zapret UDP fake (--dpi-desync-fake-quic, --dpi-desync-fake-unknown-udp) went out as zeros when it was given as hex or its profile also handled TCP, and a TLS fake given as hex (--dpi-desync-fake-tls=0x...) was left out of the set. #538, #581
  • In an imported zapret configuration, --dpi-desync-repeats did not reach the UDP fakes of a profile that also handled TCP, the --dpi-desync-ttl of a UDP profile was not applied, a separate UDP profile replaced the UDP settings of a profile that had its own, a profile that filters only UDP could switch on TCP options such as Packet Duplication, --dpi-desync-any-protocol could read as Not recognized in the report, and the report warned that no set had domains, or that an earlier set already claimed them, about a set that was created disabled for another reason, such as a skipped profile.
  • IP Block Detection could ban an address for a day or a week after one connection that its server answered late, such as a YouTube video server, although that connection then loaded. #580
  • Set cards and Discovery results named the Google and DuckDuckGo fake payloads default and default2. #538
  • With one domain in two sets, one limited to IPv4 and one to IPv6 by the IP Version Filter, the first packet of a connection could get the set for the other IP version when that set was higher in the list. #582
  • Discovery tested every strategy that has an Overlap Pattern, such as combo-seqovl64, without that pattern, while the set saved from such a strategy sent it. #542
  • A Disorder set with an Overlap Length never sent the overlap while SNI-Based Splitting was off, so the Discovery strategies disorder-seqovl128-pos256 and disorder-seqovl256-pos512 tested plain Disorder. #591
  • With Full Shuffle, a Disorder set with an Overlap Length could send the overlapped segment before the bytes it overlaps, and servers that keep the first copy they receive, such as those hosted on Windows, reset the connection.

Security

  • Signing out did not stop the live logs and traffic already streaming to other tabs or apps of that session: they kept arriving until b4 restarted. #569

What's Changed

New Contributors

Full Changelog: v1.90.1...v1.91.0

Check out latest releases or
releases around DanielLavrushin/b4 v1.91.0

Don't miss a new b4 release

NewReleases is sending notifications on new releases.

Get notifications