BlueKnight Panel 5.2.4

Proxy panel, encrypted-DNS gateway and client-subscription server for Cloudflare's edge or any Node 22+ host.

Updates and support: @BlueKnight_Net on Telegram

What's new in 5.2.4

• Sites behind Cloudflare's CDN work with no setup. Workers can't open connections to Cloudflare's own IPs, so those sites (and client ping tests against cp.cloudflare.com) failed unless you ran your own relay. When a direct connection fails or closes with no data, the Worker now retries through public NAT64 gateways (the method BPB and Nova use): the site's IPv4 is embedded in an IPv6 gateway address. All configured gateways are dialled at once and the first that answers is used. The list is editable under NAT64 Prefixes; a relay set in Relay for Cloudflare-hosted Sites still takes precedence.
• IPv6 destinations connect. IPv6 addresses were passed to Cloudflare's connect() without brackets and never connected.
• New presets: Bypass Russia and Bypass Iran + Russia. .ru, .su, .рф, Russian geosite and geoip go direct; Iran + Russia combines both countries. Available for sing-box, Clash/Mihomo and Xray.
• Geo routing actually loads in Iran and Russia. sing-box rule sets used to download from raw.githubusercontent.com over a direct connection, which is filtered there, so the rules never loaded. Rule sets and Clash geo databases now come from the jsDelivr mirror, and sing-box downloads them through the proxy.
• sing-box configs with WARP load again. The WARP IPv6 address was saved without /128, and sing-box rejected the whole config, so every node looked dead. WireGuard and AmneziaWG downloads get the same fix.

Existing settings keep working: Bypass Iran, Bypass China, Block Ads and Off are unchanged, and the "always proxy" domain rules still run before country rules.

After updating: pick a preset under Routing & Chain, then re-import your subscription in the client app.

Also includes 5.2.3 (chain proxy TLS, validation and live test on save) and 5.2.2 (relay for Cloudflare-hosted sites, clean IPs with ports).

Public NAT64 gateways can go offline. Only one of the tested defaults answered from Cloudflare on 2026-09-22 (2a01:4f9:c010:3f02:64::). If Cloudflare-hosted sites stop loading, update the NAT64 list or set a relay.

Downloads

File	Use it when
worker-standalone.js	You want to paste one file into the Cloudflare dashboard. Every lib/ module inlined, all ten wallpapers embedded — 1.81 MB, under the 3 MB Workers free-plan limit.
BlueKnight-Panel-5.2.4.zip	Full deployable project. Unzip and double-click BlueKnight-Deploy.cmd for the interactive picker across all 11 targets.
BlueKnight-Deploy.cmd	The Windows launcher on its own, if you already have the project.

Paste-deploy to Cloudflare Workers

1. Dashboard → Workers & Pages → Create → Start from Hello World.
2. Edit code, select all, paste worker-standalone.js, Deploy.
3. Settings → Variables → KV Namespace Bindings → bind a namespace to BK_KV.
4. Settings → Runtime → compatibility date 2024-09-23 or later, enable nodejs_compat. Redeploy.

Open https://<your-worker>.workers.dev/panel and set an admin password.

Sites behind Cloudflare's CDN: Workers cannot open sockets to Cloudflare's own IPs. The Worker retries those through public NAT64 gateways automatically; set Relay for Cloudflare-hosted Sites (ProxyIP) to use your own relay instead. Clean IPs may include a port, e.g. 172.67.180.1:2053.

Without the BK_KV binding the panel cannot store your password or sign sessions, and will refuse to log you in rather than fall back to a shared key.

Why a standalone build

The repo's worker.js imports ./lib/ modules and resolves /assets/theme-bg-N.jpg through a static-asset binding. Pasted into the dashboard as-is it fails on the first import, and every theme renders on a flat colour. This build bundles the imports and bakes the wallpapers in, so a single-file deploy looks the same as a Pages deploy.

Rebuild it yourself with npm run build:standalone. Test suites are maintained locally and excluded from the project download.

Deployment targets

Cloudflare Workers · Cloudflare Pages · Vercel · Netlify · Fly.io · Railway · Render · Koyeb · Docker/VPS · Local · Native sing-box stack

All except Netlify carry VLESS/Trojan tunnel traffic; Netlify's function runtime cannot hold a WebSocket open, so use it for the panel and DNS only. node deploy.mjs validates project files and runs any available local regression suites, stopping on failure. Missing local test suites are reported and skipped.

Security

• Admin password stored as PBKDF2-SHA256, 100,000 iterations, per-record salt. Upgrading from an older build migrates on first login.
• Session signing key from KV or JWT_SECRET; the panel fails closed rather than falling back to a shared key.
• Every response carries X-Frame-Options: DENY, X-Content-Type-Options: nosniff and Referrer-Policy: no-referrer; HTML adds a CSP with form-action 'self', base-uri 'none', frame-ancestors 'none'.
• There is no rate limit on /panel/login — put a Cloudflare WAF rule on it if the panel is internet-facing.

See the README for per-platform instructions and how the panel works internally.

BlueKnight Panel 5.2.3

Proxy panel, encrypted-DNS gateway and client-subscription server for Cloudflare's edge or any Node 22+ host.

Updates and support: @BlueKnight_Net on Telegram

What's new in 5.2.3

• Chain proxy actually applies. The TLS option under Routing & Chain was ignored, so a TLS upstream (HTTPS proxy or SOCKS over TLS) got plaintext and every connection failed. The Worker now opens a TLS connection to it.
• Saving checks the chain. Chain type, address, port and SOCKS5 credentials are validated before anything is written. An address like socks5://host:1080 is rejected with a clear message instead of silently breaking all traffic.
• Live test on save. With the chain enabled, saving fetches example.com through your upstream and reports "Chain test passed" (with latency) or "Chain test FAILED" (with the reason). An enabled chain never falls back to a direct connection, so this shows immediately whether traffic will flow.
• Better SOCKS5 compatibility. IPv4 and IPv6 targets are sent with their proper SOCKS5 address types; some upstreams rejected IPs sent as domain names.
• HTTP proxy passwords with non-ASCII characters now authenticate correctly.
• Removed the unused Path and SNI fields from the chain card.

The chain runs server-side for VLESS, Trojan, Shadowsocks and XHTTP. Client subscriptions still connect to the Worker directly and never contain your upstream's address or credentials. New settings reach new connections within about a minute of saving.

Also includes 5.2.2: the relay for Cloudflare-hosted sites (ProxyIP / RELAY_IP) and clean IPs with ports.

Downloads

File	Use it when
worker-standalone.js	You want to paste one file into the Cloudflare dashboard. Every lib/ module inlined, all ten wallpapers embedded — 1.81 MB, under the 3 MB Workers free-plan limit.
BlueKnight-Panel-5.2.3.zip	Full deployable project. Unzip and double-click BlueKnight-Deploy.cmd for the interactive picker across all 11 targets.
BlueKnight-Deploy.cmd	The Windows launcher on its own, if you already have the project.

Paste-deploy to Cloudflare Workers

1. Dashboard → Workers & Pages → Create → Start from Hello World.
2. Edit code, select all, paste worker-standalone.js, Deploy.
3. Settings → Variables → KV Namespace Bindings → bind a namespace to BK_KV.
4. Settings → Runtime → compatibility date 2024-09-23 or later, enable nodejs_compat. Redeploy.

Open https://<your-worker>.workers.dev/panel and set an admin password.

Sites behind Cloudflare's CDN: Workers cannot open sockets to Cloudflare's own IPs. Set Relay for Cloudflare-hosted Sites (ProxyIP) in the panel to a non-Cloudflare relay (host or host:port) and the Worker retries through it when a direct connection fails. Clean IPs may include a port, e.g. 172.67.180.1:2053.

Without the BK_KV binding the panel cannot store your password or sign sessions, and will refuse to log you in rather than fall back to a shared key.

Why a standalone build

The repo's worker.js imports ./lib/ modules and resolves /assets/theme-bg-N.jpg through a static-asset binding. Pasted into the dashboard as-is it fails on the first import, and every theme renders on a flat colour. This build bundles the imports and bakes the wallpapers in, so a single-file deploy looks the same as a Pages deploy.

Rebuild it yourself with npm run build:standalone. Test suites are maintained locally and excluded from the project download.

Deployment targets

Cloudflare Workers · Cloudflare Pages · Vercel · Netlify · Fly.io · Railway · Render · Koyeb · Docker/VPS · Local · Native sing-box stack

All except Netlify carry VLESS/Trojan tunnel traffic; Netlify's function runtime cannot hold a WebSocket open, so use it for the panel and DNS only. node deploy.mjs validates project files and runs any available local regression suites, stopping on failure. Missing local test suites are reported and skipped.

Security

• Admin password stored as PBKDF2-SHA256, 100,000 iterations, per-record salt. Upgrading from an older build migrates on first login.
• Session signing key from KV or JWT_SECRET; the panel fails closed rather than falling back to a shared key.
• Every response carries X-Frame-Options: DENY, X-Content-Type-Options: nosniff and Referrer-Policy: no-referrer; HTML adds a CSP with form-action 'self', base-uri 'none', frame-ancestors 'none'.
• There is no rate limit on /panel/login — put a Cloudflare WAF rule on it if the panel is internet-facing.

See the README for per-platform instructions and how the panel works internally.

BlueKnight Panel 5.2.2

Proxy panel, encrypted-DNS gateway and client-subscription server for Cloudflare's edge or any Node 22+ host.

Updates and support: @BlueKnight_Net on Telegram

What's new in 5.2.2

• Sites behind Cloudflare's CDN open again. Workers cannot open sockets to Cloudflare's own IP ranges, so those sites failed to connect or closed with no data. New panel setting Relay for Cloudflare-hosted Sites (ProxyIP): when a direct connection fails or closes silently, VLESS, Trojan and Shadowsocks sessions retry once through that non-Cloudflare relay (host or host:port). It stays empty until you set it, and is skipped while an upstream chain is enabled.

• Clean IPs with ports produce working configs. Entries like 172.67.180.1:2053 or [2606:4700::1001]:8443, in the Clean IP field or the Static Clean IP Pool, previously produced broken nodes in every subscription format. Host and port are now split correctly for VLESS/Trojan links, Clash, sing-box and Xray.

• Deploy script sets the relay. BlueKnight-Deploy.cmd / node deploy.mjs now asks for the relay on Cloudflare Workers and Pages (or pass --relay=host[:port], or set RELAY_IP) and stores it as the RELAY_IP secret. A relay saved in the panel takes precedence.

Verified on Node and on the Cloudflare Pages runtime (wrangler pages dev).

Downloads

File	Use it when
worker-standalone.js	You want to paste one file into the Cloudflare dashboard. Every lib/ module inlined, all ten wallpapers embedded — 1.80 MB, under the 3 MB Workers free-plan limit.
BlueKnight-Panel-5.2.2.zip	Full deployable project. Unzip and double-click BlueKnight-Deploy.cmd for the interactive picker across all 11 targets.
BlueKnight-Deploy.cmd	The Windows launcher on its own, if you already have the project.

Paste-deploy to Cloudflare Workers

1. Dashboard → Workers & Pages → Create → Start from Hello World.
2. Edit code, select all, paste worker-standalone.js, Deploy.
3. Settings → Variables → KV Namespace Bindings → bind a namespace to BK_KV.
4. Settings → Runtime → compatibility date 2024-09-23 or later, enable nodejs_compat. Redeploy.

Open https://<your-worker>.workers.dev/panel and set an admin password.

Sites behind Cloudflare's CDN: Workers cannot open sockets to Cloudflare's own IPs. Set Relay for Cloudflare-hosted Sites (ProxyIP) in the panel to a non-Cloudflare relay (host or host:port) and the Worker retries through it when a direct connection fails. Clean IPs may include a port, e.g. 172.67.180.1:2053.

Without the BK_KV binding the panel cannot store your password or sign sessions, and will refuse to log you in rather than fall back to a shared key.

Why a standalone build

The repo's worker.js imports ./lib/ modules and resolves /assets/theme-bg-N.jpg through a static-asset binding. Pasted into the dashboard as-is it fails on the first import, and every theme renders on a flat colour. This build bundles the imports and bakes the wallpapers in, so a single-file deploy looks the same as a Pages deploy.

Rebuild it yourself with npm run build:standalone. Test suites are maintained locally and excluded from the project download.

Deployment targets

Cloudflare Workers · Cloudflare Pages · Vercel · Netlify · Fly.io · Railway · Render · Koyeb · Docker/VPS · Local · Native sing-box stack

All except Netlify carry VLESS/Trojan tunnel traffic; Netlify's function runtime cannot hold a WebSocket open, so use it for the panel and DNS only. node deploy.mjs validates project files and runs any available local regression suites, stopping on failure. Missing local test suites are reported and skipped.

Security

• Admin password stored as PBKDF2-SHA256, 100,000 iterations, per-record salt. Upgrading from an older build migrates on first login.
• Session signing key from KV or JWT_SECRET; the panel fails closed rather than falling back to a shared key.
• Every response carries X-Frame-Options: DENY, X-Content-Type-Options: nosniff and Referrer-Policy: no-referrer; HTML adds a CSP with form-action 'self', base-uri 'none', frame-ancestors 'none'.
• There is no rate limit on /panel/login — put a Cloudflare WAF rule on it if the panel is internet-facing.

See the README for per-platform instructions and how the panel works internally.

Updated assets built from main commit fca3f91: Workers password-save fix, client DNS configuration, and deployment support without local test files. The release tag retains its original source snapshot; use the attached project ZIP for the updated code.

BlueKnight Panel 5.2.1

Proxy panel, encrypted-DNS gateway and client-subscription server for Cloudflare's edge or any Node 22+ host.

Updates and support: @BlueKnight_Net on Telegram

Downloads

File	Use it when
worker-standalone.js	You want to paste one file into the Cloudflare dashboard. Every lib/ module inlined, all ten wallpapers embedded — 1.80 MB, under the 3 MB Workers free-plan limit.
BlueKnight-Panel-5.2.1.zip	Full deployable project. Unzip and double-click BlueKnight-Deploy.cmd for the interactive picker across all 11 targets.
BlueKnight-Deploy.cmd	The Windows launcher on its own, if you already have the project.

Paste-deploy to Cloudflare Workers

1. Dashboard → Workers & Pages → Create → Start from Hello World.
2. Edit code, select all, paste worker-standalone.js, Deploy.
3. Settings → Variables → KV Namespace Bindings → bind a namespace to BK_KV.
4. Settings → Runtime → compatibility date 2024-09-23 or later, enable nodejs_compat. Redeploy.

Open https://<your-worker>.workers.dev/panel and set an admin password.

Sites behind Cloudflare's CDN: Workers cannot open sockets to Cloudflare's own IPs. Set Relay for Cloudflare-hosted Sites (ProxyIP) in the panel to a non-Cloudflare relay (host or host:port) and the Worker retries through it when a direct connection fails. Clean IPs may include a port, e.g. 172.67.180.1:2053.

Without the BK_KV binding the panel cannot store your password or sign sessions, and will refuse to log you in rather than fall back to a shared key.

Why a standalone build

The repo's worker.js imports ./lib/ modules and resolves /assets/theme-bg-N.jpg through a static-asset binding. Pasted into the dashboard as-is it fails on the first import, and every theme renders on a flat colour. This build bundles the imports and bakes the wallpapers in, so a single-file deploy looks the same as a Pages deploy.

Rebuild it yourself with npm run build:standalone. Test suites are maintained locally and excluded from the project download.

Deployment targets

Cloudflare Workers · Cloudflare Pages · Vercel · Netlify · Fly.io · Railway · Render · Koyeb · Docker/VPS · Local · Native sing-box stack

All except Netlify carry VLESS/Trojan tunnel traffic; Netlify's function runtime cannot hold a WebSocket open, so use it for the panel and DNS only. node deploy.mjs validates project files and runs any available local regression suites, stopping on failure. Missing local test suites are reported and skipped.

Security

• Admin password stored as PBKDF2-SHA256, 100,000 iterations, per-record salt. Upgrading from an older build migrates on first login.
• Session signing key from KV or JWT_SECRET; the panel fails closed rather than falling back to a shared key.
• Every response carries X-Frame-Options: DENY, X-Content-Type-Options: nosniff and Referrer-Policy: no-referrer; HTML adds a CSP with form-action 'self', base-uri 'none', frame-ancestors 'none'.
• There is no rate limit on /panel/login — put a Cloudflare WAF rule on it if the panel is internet-facing.

See the README for per-platform instructions and how the panel works internally.

Updated assets built from main commit fca3f91: Workers password-save fix, client DNS configuration, and deployment support without local test files. The release tag retains its original source snapshot; use the attached project ZIP for the updated code.