v1.80.2

[1.80.1] - 2026-08-29

• FIXED: The interface reported an older version than the binary on disk, with nothing to say why - the version is stamped in at build time, so a service whose file is replaced without a restart keeps answering with the version it was compiled as while the command line reports the new one, and where the running process cannot read its own path, as in a container without /proc, the diagnostics named that path . instead of saying it did not know.

• FIXED: A set routed to a tunnel or an upstream proxy could take the router down within seconds of the service starting - the rules pick a packet by its destination alone, so a packet the proxy handed back for that same address was picked again and sent straight back to it, thirty-one turns before its hop count ran out. Where such a set carried the router's own traffic as well, the proxy answered each turn by opening a connection of its own from the same box, on a fresh source port every time, until the memory was gone.

• FIXED: A routed set could carry nothing at all, with nothing in the interface saying otherwise - the kernel's reverse-path check dropped every reply arriving on the set's interface, a set left on interface mode with no interface chosen or on proxy mode with no upstream port was dropped from the pass without a line in the log, turning domain-only matching off never rebuilt the set so its address list stayed empty, the firmware rebuilding its own firewall took b4's jump with it, and on a Broadcom router the firmware hands out the connection mark itself and overwrote the routing decision b4 keeps there.

• FIXED: A routed set could send half a connection one way and half the other, or claim what another program was using - a domain's address is only learned when its lookup is answered, which is a moment after the connection has already started, so the handshake left by the ordinary uplink and the rest went down the set's route; the table number came from the output interface's name with nothing checking /etc/iproute2/rt_tables or the rules already pointing at it; each proxy set put its firewall jump ahead of the set before it, so the last in the list claimed addresses two of them targeted; a filter written to match a LAN client can never match a packet the router itself crafts, so a device-bound set's fakes travelled the ordinary uplink; on nftables a proxy set's mark returns sat at the top of a shared hook chain and ended it for every set below; and every rebuild deleted the set's own policy rule before putting the identical one back, so anything marked in that window found nothing pointing at the set's table and took the main one.

• ADDED: A kill switch for a set's output interface - when the interface went away the kernel removed the route b4 had put in the set's table, the mark rule found the table empty, and the lookup fell through to the main table, so the set left through the ordinary uplink with the router's real address while its rules still read as correct.

• CHANGED: A set routed into a tunnel no longer has its packets faked, fragmented and desynced - the work was done on the inner packet, which is wrapped or terminated on the router before anything on the network sees it, so it bought nothing and cost CPU on every connection, and the fake packets were delivered to the tunnel program's own stack one hop away with no room to expire. SYN health checks, dead-IP escalation, IP block detection and TCP duplication stop with it; a set keeps its bypass strategy when it routes to a plain second uplink and when its output interface is present but down.

• FIXED: b4's own firewall work could take the whole network with it - on a router whose iptables has no lock flag the commands run unserialised while the firmware rewrites the same tables on WAN checks and DHCP events, so a command that lost that race left b4 on half a rule set and one start was fine while the next took the network off the air until a reboot; a running but overloaded b4 had its queue filled and the kernel dropped every packet past the four thousandth with nothing to say why; and stopping b4 put back a strict TCP window setting that this firewall drops packets over, so a page loaded its first fifty kilobytes and stopped.

• FIXED: Picking network interfaces to monitor could switch the bypass off for the whole network with nothing saying so - the setting matches the interface a packet leaves by, which a VPN client or a transparent proxy moves without touching the list, so a selection made before that quietly stopped matching and every packet was queued to b4 and then accepted unchanged. A new Guides section covers the three interface settings and running b4 alongside Xray.

• FIXED: On the TUN engine b4 captured the wrong traffic and missed what it needed - the capture rule sat below the routing rules a transparent proxy, a multi-WAN manager or a VPN script installs, so the network's packets were claimed before b4 saw them while what b4 did capture was the proxy's own upstream connection; a request from the LAN to a device on another bridge was carried into the tunnel and sent to the internet with the uplink's address; and only DNS queries were carried in, never the answers, so nothing learned an address into a routing set, stripped AAAA records or healed a dead address.

• FIXED: Telegram kept reporting the MTProto proxy as incorrectly configured and switching it off - the dialog comes from a single four-byte -444 relayed back from a data center, not from a slow dial, and b4 could send an ordinary session to a data center's media edge, which answers a non-media session with exactly that; the 1.78.0 fix routed around nothing because both names lead to the same address. On a router without IPv6 the bridge also gave up on an edge whose name carries an IPv6 address, because a connection to one on a box with no IPv6 route is refused outright.

• ADDED: An MCP server that can act on b4 rather than only describe it - the AI could read status and change one setting at a time, so anything a user asked for came back as instructions to carry out by hand. It gains per-setting facts, geosite and geoip search, target and set editing, the last update's transcript, and behind a separate Allow active probes permission, testing whether a domain loads and running Discovery; every tool call and every turned-away request is logged. Settings > Integrations.

• FIXED: A Discovery run's result became unreachable the moment the run ended, and the watchdog judged domains on a fetch that skipped the bypass - only the copy held in memory was consulted and that is dropped 30 seconds after a run finishes, a strategy named while a run was still testing read as settled, stopping a run early threw away what it had found, the history file grew by roughly half a megabyte per domain because every strategy tried was saved with a full copy of the set built to test it, and the watchdog's own checks carried the mark b4 puts on traffic it has already handled.

• FIXED: The settings folder was open for any account on the router to write to, and a downloaded backup could hold nothing - the settings file holds the web interface login and the MCP access token yet was created readable and writable by everyone, the copies kept before each upgrade the same, and restoring followed folder shortcuts left in that folder so an entry in the archive could land anywhere; b4 also skipped every file marked as a program, and on drives prepared from Windows the settings files carry that mark.

• FIXED: Importing a zapret or byedpi configuration converted a fraction of what was pasted, and misdescribed what it did convert - a configuration file was read one line at a time, so multi-line values, variable references and the order its launcher joins them in were all lost.

• FIXED: The MTProto settings page asked for a WEB proxy relay hostname while the proxy that serves it was off - the WEB carrier reuses the MTProto proxy's listener and its secrets, so with that proxy off the card was collecting a hostname for a relay that could not answer, beside a secrets card whose every control was dead, under header chips repeating the switch, the hostname and the transport mode already visible below them.

• ADDED: Documentation for the Telegram WEB proxy, which shipped in 1.79.0 with nothing written about it - its prerequisites cannot be worked out from the interface: the MTProto proxy has to be running, the relay needs a hostname of its own with publicly trusted TLS, and the link Telegram Desktop accepts carries a different form of the secret than the settings show. It joins a Telegram section covering the three modes separately, replacing one page that described two of them and quoted log lines b4 does not write.

• ADDED: Update mirrors, and a personal Cloudflare Worker to put in them - under Settings, Control, the Update mirrors field takes https addresses that the service and the installer try ahead of the built-in ones when GitHub cannot be reached, and b4 hands the list to the installer when an update starts. The documentation carries a Worker script that stands in for GitHub on a free Cloudflare account, so a reader blocked from the release host can mirror through one of their own.

• ADDED: Installing an update from a file, for a router that can reach no download source at all - the update window takes a b4-linux-<arch>.tar.gz fetched on another machine, with an optional field for the SHA256 from the release page, which is the one check the automatic path cannot make independently because it reads the archive and its checksum from the same host. The upload is refused unless it holds a b4 built for that router, so the wrong architecture is named rather than installed and rolled back.

• FIXED: Installing or updating the service failed where the network blocks GitHub's download hosts, and the update window could come up with no versions listed - the release archive is handed over by a redirect to a separate GitHub CDN that several providers drop by address, and the fallback proxy passed that redirect back to the router instead of following it, so the router went to the blocked host anyway and waited out a two-minute timeout, while the version list was fetched by the browser against an hourly GitHub limit shared by every user behind the same address.

What's Changed

• Add binary state tracking to detect file replacements by @DanielLavrushin in #334

Full Changelog: v1.80.1...v1.80.2