v1.77.0

[1.77.0] - 2026-08-15

Screencast.From.2026-08-16.03-02-37.mp4

• ADDED: A Customize control on the dashboard: panels are reordered by dragging, widened or narrowed by dragging the right edge across a twelve column grid, and hidden with the eye, remembered per browser - the order and the widths were fixed in the code, so a panel worth keeping an eye on, such as the MTProto proxy and the devices using it, sat below a domain list hundreds of rows long, there was no way to move it up, give it more room or drop a panel that never gets read, and a short panel beside a tall one left everything after it waiting below the taller one.
• CHANGED: The dashboard layout is kept in b4's own configuration rather than in the browser - the order, the hidden panels and the widths were held in browser storage alone, so a layout arranged on one machine was absent from every other one, and a new browser, a private window or a cleared site cache put the dashboard back to its defaults. The browser copy is still written and is read when b4 cannot be reached, so the page keeps its arrangement while the service is restarting.
• CHANGED: The runtime, live signal and blackhole panels lay themselves out by their own width rather than the width of the window - each read the browser's breakpoints, so a panel given less than the full width of the page kept a layout sized for the whole screen and had its contents cut off at the panel edge.
• FIXED: The packets b4 makes itself left a router by whichever uplink the main routing table picked, not by the interface the set they belong to is routed through - fakes, split segments and desync packets are sent by b4 rather than forwarded, so they carried only b4's own mark and the set's routing never applied to them. On a router balancing two WANs the connection opened over one and continued over the other, from a different public address, and the destination reset it; with a set routed through a tunnel those packets, and the server name inside them, went out over the plain uplink instead.
• CHANGED: A set's hand-picked firewall mark is refused, and one is assigned instead, when it carries every bit of the mark b4 puts on its own packets - the two became indistinguishable, and the set's traffic was read as traffic b4 had injected.
• ADDED: The enabled sets in the trace header, with domain lists counted rather than listed and proxy credentials left out - a trace carried the system side of a report and nothing about what b4 was told to match, so a set that misbehaves had to be read without its targets, strategy or routing at hand.
• FIXED: A set routed through a proxy leaked two sockets and two pipes for every connection whose far side died without closing - the count reached the router's open-file limit within about an hour, and b4 stopped working until it was restarted.
• CHANGED: A proxied connection carrying no data in either direction is dropped after an hour, and after five minutes once one side has finished sending - a relay had no time limit at all once the proxy handshake was done.
• CHANGED: A set that cannot reach its proxy reports it in the log and in the diagnostics bundle - the failed connection was recorded at trace level only, so a proxy refusing every attempt left nothing behind at the default log level. Traffic the set matched was accepted, held for the length of the connection timeout and then dropped, with nothing on record to say why.
• FIXED: A set whose MSS limit is scoped to IPv4 addresses no longer caps the IPv6 traffic of the devices it names - the limit was written once per address family, and the family the set holds no addresses for fell back to matching the device alone, so every IPv6 HTTPS connection from that device was capped at the set's value regardless of where it was headed.
• FIXED: A site switched to a backup set still had its name looked up by the set that was failing - the backup's pinned addresses, DoH server and forwarding target were never consulted for it, so a domain that only the backup could resolve stayed unresolvable however the escalation was set up.
• ADDED: An unusable name lookup switches the site to the backup set - NXDOMAIN, SERVFAIL and answers that carry no address count towards the switch, and the backup set answers the lookup that tripped it. Escalation only ever reacted to something that happens after a connection is already open, which a site with no address on record never reaches.
• ADDED: A destination that answers no connection attempt switches the site to the backup set - b4 already spotted the address going unanswered and confirmed it by probing from the router itself, but that finding went nowhere except into cutting the device's attempt short. The most common way a site fails, its address dropped outright, had no path to the backup set.
• FIXED: The backup set only took over once a TLS handshake had been read out of the traffic - a connection that never gets that far, and the opening packet of a connection to a site already switched over, were both handled by the set that was failing, so the backup set's SYN-stage settings never ran.
• FIXED: How readily a site switches over was read from IP block detection, a separate feature that is off by default - unanswered TLS handshakes, forged resets and unusable name lookups each got a control of their own on the Escalation tab. The single one on offer before governed forged resets only, so moving it changed nothing about the trigger that fires most.
• FIXED: Turning a backup set off destroyed the link to it - the link was erased on the next save and the set could not be picked again until it was enabled, so a set switched off for a minute had to be wired back by hand.
• FIXED: A set routed through a proxy could not escalate any further - the chain stopped at the first proxy hop, though it is built to run up to eight.
• FIXED: Only the single address a connection was headed for was handed to the backup set's routing - a site behind several addresses had to fail once per address, and the entry aged out of the firewall while the switch was still in force, which put the traffic back on the failing path without a word.
• FIXED: A switch-over ignored which devices the backup set targets - one device's failure moved every device on the network onto the backup set.
• CHANGED: Editing a set drops only the switch-overs that the edit invalidates - every switch-over in force was discarded on each save, including those for sites the edit did not touch.
• FIXED: The chain-length warning repeated for every packet - once a site had been through all eight hops, each retransmission logged it again.

What's Changed

• 1-77-0 by @DanielLavrushin in #305
• Implement log trace sets and relay functionality by @DanielLavrushin in #306
• fix(tests): enhance stubBinaries function to properly manage binary c… by @DanielLavrushin in #307

Full Changelog: v1.76.2...v1.77.0