BlueKnight Panel 5.2.4

Proxy panel, encrypted-DNS gateway and client-subscription server for Cloudflare's edge or any Node 22+ host.

Updates and support: @BlueKnight_Net on Telegram

What's new in 5.2.4

• Sites behind Cloudflare's CDN work with no setup. Workers can't open connections to Cloudflare's own IPs, so those sites (and client ping tests against cp.cloudflare.com) failed unless you ran your own relay. When a direct connection fails or closes with no data, the Worker now retries through public NAT64 gateways (the method BPB and Nova use): the site's IPv4 is embedded in an IPv6 gateway address. All configured gateways are dialled at once and the first that answers is used. The list is editable under NAT64 Prefixes; a relay set in Relay for Cloudflare-hosted Sites still takes precedence.
• IPv6 destinations connect. IPv6 addresses were passed to Cloudflare's connect() without brackets and never connected.
• New presets: Bypass Russia and Bypass Iran + Russia. .ru, .su, .рф, Russian geosite and geoip go direct; Iran + Russia combines both countries. Available for sing-box, Clash/Mihomo and Xray.
• Geo routing actually loads in Iran and Russia. sing-box rule sets used to download from raw.githubusercontent.com over a direct connection, which is filtered there, so the rules never loaded. Rule sets and Clash geo databases now come from the jsDelivr mirror, and sing-box downloads them through the proxy.
• sing-box configs with WARP load again. The WARP IPv6 address was saved without /128, and sing-box rejected the whole config, so every node looked dead. WireGuard and AmneziaWG downloads get the same fix.

Existing settings keep working: Bypass Iran, Bypass China, Block Ads and Off are unchanged, and the "always proxy" domain rules still run before country rules.

After updating: pick a preset under Routing & Chain, then re-import your subscription in the client app.

Also includes 5.2.3 (chain proxy TLS, validation and live test on save) and 5.2.2 (relay for Cloudflare-hosted sites, clean IPs with ports).

Public NAT64 gateways can go offline. Only one of the tested defaults answered from Cloudflare on 2026-09-22 (2a01:4f9:c010:3f02:64::). If Cloudflare-hosted sites stop loading, update the NAT64 list or set a relay.

Downloads

File	Use it when
worker-standalone.js	You want to paste one file into the Cloudflare dashboard. Every lib/ module inlined, all ten wallpapers embedded — 1.81 MB, under the 3 MB Workers free-plan limit.
BlueKnight-Panel-5.2.4.zip	Full deployable project. Unzip and double-click BlueKnight-Deploy.cmd for the interactive picker across all 11 targets.
BlueKnight-Deploy.cmd	The Windows launcher on its own, if you already have the project.

Paste-deploy to Cloudflare Workers

1. Dashboard → Workers & Pages → Create → Start from Hello World.
2. Edit code, select all, paste worker-standalone.js, Deploy.
3. Settings → Variables → KV Namespace Bindings → bind a namespace to BK_KV.
4. Settings → Runtime → compatibility date 2024-09-23 or later, enable nodejs_compat. Redeploy.

Open https://<your-worker>.workers.dev/panel and set an admin password.

Sites behind Cloudflare's CDN: Workers cannot open sockets to Cloudflare's own IPs. The Worker retries those through public NAT64 gateways automatically; set Relay for Cloudflare-hosted Sites (ProxyIP) to use your own relay instead. Clean IPs may include a port, e.g. 172.67.180.1:2053.

Without the BK_KV binding the panel cannot store your password or sign sessions, and will refuse to log you in rather than fall back to a shared key.

Why a standalone build

The repo's worker.js imports ./lib/ modules and resolves /assets/theme-bg-N.jpg through a static-asset binding. Pasted into the dashboard as-is it fails on the first import, and every theme renders on a flat colour. This build bundles the imports and bakes the wallpapers in, so a single-file deploy looks the same as a Pages deploy.

Rebuild it yourself with npm run build:standalone. Test suites are maintained locally and excluded from the project download.

Deployment targets

Cloudflare Workers · Cloudflare Pages · Vercel · Netlify · Fly.io · Railway · Render · Koyeb · Docker/VPS · Local · Native sing-box stack

All except Netlify carry VLESS/Trojan tunnel traffic; Netlify's function runtime cannot hold a WebSocket open, so use it for the panel and DNS only. node deploy.mjs validates project files and runs any available local regression suites, stopping on failure. Missing local test suites are reported and skipped.

Security

• Admin password stored as PBKDF2-SHA256, 100,000 iterations, per-record salt. Upgrading from an older build migrates on first login.
• Session signing key from KV or JWT_SECRET; the panel fails closed rather than falling back to a shared key.
• Every response carries X-Frame-Options: DENY, X-Content-Type-Options: nosniff and Referrer-Policy: no-referrer; HTML adds a CSP with form-action 'self', base-uri 'none', frame-ancestors 'none'.
• There is no rate limit on /panel/login — put a Cloudflare WAF rule on it if the panel is internet-facing.

See the README for per-platform instructions and how the panel works internally.