wiresock/proxifyre v2.7.0

ProxiFyre 2.7.0

on GitHub

ProxiFyre 2.7.0 adds an optional global DNS policy: conventional DNS (UDP and TCP port 53) can now be sent through a selected SOCKS5 proxy, whichever process asks, including the Windows DNS Client service. It also stops proxied replies from leaking in ICMP errors.

Highlights

• DNS routing, Direct or Proxy. A new dns section in app-config.json, and a DNS routing group on the GUI's Settings tab, select the mode. Direct is the default and applies to existing configurations. In Proxy mode all port-53 traffic goes through the proxy rule named by dns.proxyId, over IPv4 and IPv6, and is blocked rather than sent directly when that proxy cannot carry it. UDP DNS shares one SOCKS5 UDP ASSOCIATE per address family; TCP DNS uses a CONNECT per connection. Windows DNS settings are not changed, and there is no resolver or cache.
• serverOverride. In Proxy mode the proxy can be asked for a resolver of your choice, for example 1.1.1.1, instead of the server Windows queried. This is what makes a router or ISP resolver, which the proxy cannot reach, usable; applications still see answers from the server they asked.
• Stable rule ids. A proxy rule can have an id, and the DNS policy refers to it, so reordering or editing rules does not change the DNS proxy. The GUI assigns ids when a rule is selected.
• No reply leaks through ICMP. When a proxied UDP reply or DNS answer arrived after the application had closed its socket, Windows sent an ICMP "port unreachable" error, quoting the reply, straight to the remote server from the computer's own address. ProxiFyre now drops those errors; ping and other ICMP are unaffected.
• Listener replies and TCP close. A reply from a local proxy listener that cannot be translated back is dropped instead of being sent toward the original server, and a proxied TCP connection is tracked through its whole close.
• Configuration strings are read verbatim. A password or other value that looks like an ISO date-time, such as 2024-01-15T10:00:00Z, is no longer re-formatted when the configuration is loaded and saved.
• Windows Packet Filter API as a submodule. The copied SDK sources are replaced by a submodule of wiresock/ndisapi. Clone with --recurse-submodules, or run git submodule update --init.

Upgrading

Install the setup package matching your Windows architecture. Installer upgrades preserve your configuration and logs. Two things change for existing configurations:

• TCP port 53 is now direct in Direct mode. Earlier releases bypassed only UDP port 53 and routed TCP port 53 like the owning application's other traffic, so a rule could carry it through a proxy. Use Proxy mode to send DNS through a proxy.
• id and dns keys are now interpreted. Earlier releases ignored a rule property named id and a top-level property named dns. An invalid or repeated id is only a warning unless DNS Proxy mode refers to it. A dns value that is not a DNS policy object, such as "dns": "8.8.8.8", is a configuration error and the service does not start until it is corrected.

In Proxy mode the selected rule must support both TCP and UDP, and the SOCKS5 server must support UDP ASSOCIATE. Only port 53 is covered: DNS over HTTPS, TLS or QUIC follows the ordinary application rules. Run ipconfig /flushdns after switching modes. See the DNS routing reference for the details and limitations.

For manual ZIP deployment, follow the protected staging procedure.

Validation

The DNS policy and the ICMP handling were validated on Windows 11 through the Windows Packet Filter 3.6.2.1 driver against a live SOCKS5-over-TLS server, with captures at the physical adapter, in addition to 419 managed tests, 400 native tests and the 118-test portable suite.

Downloads

For a normal installation or upgrade, choose the online setup:

Standalone MSIs, application ZIPs, and SHA-256 checksums are also included. Use an MSI or ZIP only after the required .NET Framework, Visual C++ runtime, and Windows Packet Filter are installed; the ZIP is not an installer.

Implemented in PR #190 and PR #192.

Full changelog