v1.70.0

[1.70.0] - 2026-06-21

• ADDED: New engine for devices without NFQUEUE - some minimal devices lack the kernel modules b4 normally needs, so it could not run on them. A new mode under Settings → Feature Flags routes traffic through a virtual interface (TUN) instead. It inspects only the first packets of each TLS (port 443) and DNS connection, like the normal engine, rather than carrying every packet, and leaves the device's default route in place; on kernels that cannot count per-connection packets it routes the whole default route through the TUN instead. Strategy discovery (auto-tuning) still needs NFQUEUE, so it cannot run on these devices.
• ADDED: TUN uplink can follow the default route automatically - leave the uplink on Auto (the default) and b4 takes the outbound interface, gateway and source address from the current default route, re-pointing them whenever it changes; pick a specific interface to pin a fixed path instead. Without it the uplink was fixed at startup, so a WAN failover or an L2TP/PPP/VPN tunnel reconnecting after b4 had started left processed traffic going out the old, dead path and bypassing b4 until a manual restart.
• ADDED: Sortable columns in the Traffic page's Aggregated view - clicking a column header sorts the grouped list by that column, ascending or descending, like the Raw feed.
• CHANGED: Web UI password is now stored securely - it is kept only as a hash and is no longer shown on the settings page (leave the field blank to keep it, or type a new one to change it).
• CHANGED: Dashboard rebuilt on one consistent design - it now leads with a live signal panel that puts connection-rate and the key counters together, with every block sharing one panel, row, and header style.
• FIXED: A set's encrypted DNS (DoH) redirect failed in some setups - lookups could time out or come back empty, so pages would not load. This affected gateway and container setups (for example b4 in a container on MikroTik) using NAT masquerade.
• FIXED: Routing set stopped updating its addresses on its own - in some setups (for example b4 in a container on MikroTik) the set's addresses only filled in on restart or when the set was toggled, then expired and were never refreshed. The set now learns addresses live from DNS replies again.
• FIXED: Telegram bridge did not recover after an internet outage - if the connection dropped and came back later, a set using the Telegram bridge kept failing until b4 was restarted by hand.

What's Changed

• Refactor NFQueue verdict handling and introduce TUN device management by @DanielLavrushin in #256
• tun: land gen2 follow-up commits missed by #256 squash by @DanielLavrushin in #258
• feat: add sortable columns in the Traffic page's Aggregated view and … by @DanielLavrushin in #259

Full Changelog: v1.69.1...v1.70.0