v1.79.0rc1

[1.79.0] - 2026-08-18

• ADDED: An egress IP for a set, which rewrites the source address of its traffic instead of leaving the output interface's own address in place - a set could only be steered somewhere by naming an interface or an upstream SOCKS5 proxy. Where the tunnels are terminated by a router above b4, neither was free: the tunnel had to be brought onto b4's own host as an interface with a routing table behind it, once per destination, or every packet had to be relayed through a proxy that costs CPU the kernel does not. A router that already picks a path by source address needed nothing from b4 except the right source, and there was no way to set one. b4 puts the address on the interface itself and takes it back when the set stops using it, so there is nothing to add by hand and nothing that a reboot forgets; it ARP-probes first and keeps masquerading, rather than claiming an address another host already answers for.
• FIXED: A set bound to a manually added source device stopped taking its route - a device added by hand has no MAC address on the network, so b4 gives it a placeholder built from its IP, and the firewall rule that limits a set to its source devices was built from that placeholder. Nothing on the wire carries such an address, so the rule matched no packet and the traffic left over the normal link, while the connection log still named the set, because the matching done outside the kernel resolves the placeholder from the source IP and succeeds. The same placeholder quietly disarmed block sets, the QUIC rejection that pushes a client back to TCP, and the "all devices except selected" option, which kept routing the one device it was told to leave alone. A device added by hand is matched by the IP address entered for it, devices found in the ARP table keep being matched by MAC, and a device filter that resolves to nothing leaves the set without a rule and says so in the log instead of letting everything through unmarked.
• CHANGED: The global device filter skipped devices added by hand - ticking only manually added devices under Settings, Device Filtering left the filter inert and routing kept applying to every device on the network rather than to the ones that were ticked. Such devices count towards the routing side of the filter, matched by the IP address entered for them, so a list containing only them confines routing to those addresses. The allow and deny list still selects traffic for DPI bypass by MAC address alone, so that half remains inert for them.
• FIXED: An MSS clamp attached to a device added by hand clamped nothing, and pulled every other forwarded connection down with it - the clamp rule was built from the placeholder MAC address b4 derives from such a device's IP, so it matched no packet. On iptables the reply direction cannot be narrowed by MAC at all, so b4 covered it with one catch-all rule that clamped every returning connection through the router down to the smallest configured size, and that catch-all was installed on the strength of rules that were already dead. A set combining destination addresses with a source device also lost the reply half of its clamp, leaving the incoming SYN-ACK unclamped. Devices added by hand are matched by the IP address entered for them in both directions, and the catch-all reply rule is kept only where a device really is matched by MAC and cannot be narrowed.

What's Changed

• B4 mcp server by @DanielLavrushin in #312

Full Changelog: v1.78.0rc1...v1.79.0rc1