Free Net Hub 4.3.10 R54 V508 — Unsigned Windows Preview

Free Net Hub 4.3.10 R54 V508 — unsigned Windows preview

Experimental prerelease. Not a signed or stable update. Windows SmartScreen may warn because this installer has no trusted Authenticode signature. Latest Stable remains v4.3.9-r53-windows-stable. Linux R21 remains distributed separately.

Changes

• Windows native full-system tunnel status path avoids unrelated WSL console polling when an exact valid PC_TUNNEL owner and TUN are present. Console mode still performs console checks.
• Retains V506 name-scoped Windows DNS53 firewall queries, V501 exact Native TUN owner-record fix, and V496 tunnel peer-loop fix.
• Native TUN is opt-in; the default browser-proxy network state is preserved.

Exact artifact verification

• Source commit: 8621b3a79bac65b60dce0c7d7fa29e314f9c852c
• Gateway manifest SHA-256: 1E7036AF9D560C6BAAE9501AB6CEA4C824396A63B20C986247FE98F5444AB1DB
• Installer SHA-256: 13534B9FCC9186361D43BE3AB6423D9D1D8A80547084F75CA56166BD89293CA9
• GitHub Actions general CI 38918502421, private Gateway fresh/upgrade 38918502484, isolated R54 fresh/upgrade 38918502410: all SUCCESS on this exact commit.
• Owner Windows in-place upgrade EXIT 0, user settings retained, WARP browser SOCKS listener restored.
• Installed V508 Native TUN exact field receipt PASS: valid owner, Native DNS four guard rules, IPv4/IPv6 HTTPS 204, independent SYSTEM rollback armed before TUN start; normal bounded stop restored TUN 0/guard rules 0 and preserved browser WARP.
• Physical NIC PktMon DNS53 capture positive/negative observation: on Ethernet 3, 18 outgoing UDP/53 frames before the exact Native owner verification time, versus zero Ethernet 3 outgoing TCP/UDP53 frames among 25 captured frames during/after verified Native ownership, spanning two direct DNS probes. Capture SHA-256 4B4799695ADC2089E99E8F8E01B05781E8B8FFAFA264E1C5C56D36FFA1D7338A.

Outstanding acceptance

• The physical capture observation is scoped to Ethernet 3, these direct DNS53 probes, and the observed test interval. It does not prove absolute prevention of all DNS leaks or protection on Wi-Fi. Independent Wi-Fi DNS53 positive/negative capture, physical link failover, and permanent session/crash recovery are still pending.
• Administrator permission may be needed when explicitly enabling a device-wide TUN. Maintain alternative recovery access. Do not attempt to install over a running full-system tunnel.
• Trusted digital signing remains a separate lawful eligibility/compliance process. No certificate has been obtained.

Verify SHA256SUMS_V508.txt before installing. V508 is not promoted to Stable/FINAL.

FreeNet Hub 4.3.10 R54 V506 - Unsigned Windows Preview

Free Net Hub 4.3.10 R54 V506 — unsigned Windows preview

Experimental public prerelease, not the Stable version. This Windows installer has no trusted Authenticode signature. The Stable Latest release remains v4.3.9 R53. The earlier V501 preview stays available; Linux R21 is unchanged.

What's improved

• Windows Native DNS53 Firewall guard reads in elevated Apply, Stop, and watchdog are scoped to FreeNetHub's exact FreeNetHub-PC-DNS53-Guard-* namespace instead of enumerating the entire ActiveStore, without weakening terminating errors or owner checks.
• Retains V501's fix for PowerShell case-insensitive owner-record variable collision, V499's fail-closed native owner postcondition, and V496's scoped peer-loop prevention.

Exact verification

• Source commit: f9e6cd6c51494c4281c54210e8fea256476fc68f
• Gateway manifest SHA-256: 16A48249FCDA890CA832D2A47AECDAC7402DA877E20CB97C9D6BC73260BF56CD
• Windows installer SHA-256: B26BA35B9E219A681F98DE700D061904459BD644898E2FFBC2AA662232DF5BCE
• Exact hosted GitHub Actions: CI, R54 isolated install/upgrade, Gateway candidate fresh/upgrade: all successful.
• Actual owner Windows in-place installation: setup Exit 0, preserved settings hash, browser WARP reconnect Exit 0, installed Gateway matched expected SHA-256; native adapter and product DNS53 guards absent after installation. Private owner receipt SHA-256 6F1B7D89BAD8455BC70EDB48E88FB1BF43D8F85B2025E3C4B2F903C40D3CE65C.

Outstanding safety gates

Full-system Native TUN remains opt-in and experimental. Previous physical tests verified that TUN can connect, create owner.json, carry IPv4/IPv6 HTTPS and coexist with Tailscale MagicDNS, and can be safely stopped. However, a definitive physical-NIC negative-control capture showing no DNS53 leakage while TUN is enabled, controlled Wi-Fi/Ethernet failover, and permanent session-loss recovery have not passed. A native-mode capture attempt (V505) failed before ETL recording and was safely rolled back. No "leak-proof", failover or Stable/FINAL assertion is made.

Disconnect full-device tunneling before upgrades, verify the installer using the bundled SHA256SUMS, retain remote/local recovery access, and expect administrative approval for Native TUN operations. Unsigned publication is independent of the ongoing lawful certificate-eligibility inquiry.

Current Stable · Previous V501 preview

FreeNet Hub 4.3.10 R54 V501 - Unsigned Windows Preview

Free Net Hub 4.3.10 R54 — V501 Unsigned Windows Preview

This is an unsigned experimental Windows prerelease, not the stable release and not a trusted digital signature. Windows may warn before installation. The stable Latest release remains Windows 4.3.9 R53. Publishing this preview does not depend on obtaining a signing certificate.

What changed

• Fixed Windows Native TUN owner-record creation: PowerShell treats $Owner and $owner as the same variable. V501 uses a separate $OwnerPath to persist owner.json correctly.
• Retained the V499 fail-closed owner verification and the V496 scoped TUN peer-loop prevention.
• Retained WARP/NODE selection, Tailscale split-route exclusions, optional full-system Native DNS, and Wired/Wireless DNS53 firewall guards.

Verified for this exact source and binary

• Source commit: e6003d00af8fb90b06c82d88357ac458fd14fdbc.
• Gateway manifest SHA-256: CD6AF7A07D2BA11F42C3874CDEB054A5222DFF6543311111AF3A964BE851DEAF.
• Windows preview installer SHA-256: B5D0EE91F0B155A6CE5DBCE45CDC9A9327E742E32AEC2B6F884653AB45F34521.
• Exact GitHub Actions acceptance: CI 38899659090, isolated R54 install/upgrade 38899659417, private Gateway fresh/upgrade 38899659123: all successful.
• Owner Windows inplace upgrade: installer exit 0; user settings hash preserved; browser WARP reconnected.
• Live owner machine: Native TUN and owner.json existed with StartPc exit 0 and running=true, four owned physical DNS53 guards, IPv4 and IPv6 HTTPS 204 with WARP on, and Tailscale MagicDNS lookup succeeded. An independent SYSTEM timer successfully stopped the exact trial without residual TUN or guards.

Safety limitations

• Native full-system TUN remains experimental and opt-in, not declared security-FINAL. The combined timed acceptance harness reported TUN_NOT_PRESENT after its independent safety timer had already removed the adapter; router-side DNS53 packet-capture positive control and wired/wireless uplink-transition acceptance are still open.
• Changing network routes, using TUN, or bypassing full-system DNS may require Windows administrator approval for that specific operation; normal browser-proxy use does not.
• No trusted Authenticode signature is present. Certificate eligibility/compliance review is being pursued separately; no identity or security trust is implied by this download.
• Use SHA256SUMS_R54_V501.txt to verify the exact installer. Do not install over an active full-device tunnel; use the product's disconnect action and keep recovery access available.

This prerelease does not replace Windows R53 Stable. Linux R21 remains in the earlier R54 public preview release; V501 changes are Windows Gateway-specific.

FreeNet Hub 4.3.10 R54 — Unsigned Public Preview (Windows)

FreeNet Hub 4.3.10 R54 — Public Unsigned Preview

Public preview / پیش‌انتشار عمومی — not the stable "Latest" release. This is an opt-in Windows test build while FreeNet Hub 4.3.9 R53 remains the stable release. Code signing is pending; it is not necessary to download this preview. The Windows setup is unsigned, and Windows SmartScreen or Smart App Control may warn or block execution. Never disable system-wide security settings to install it.

Download and verification

• Windows: FreeNetHub_4.3.10_R54_Unsigned_Preview.exe
• Windows version: 4.3.10.0, per-user installer, fixed app identity; expected SHA-256 0F178C63C64823A9DF90BAE06C5E380346963DF1D999E882287ABF9B4C9A7553 (24,275,359 bytes).
• Linux: FreeNetHub_4.2.0_Linux_R21.zip, SHA-256 82305E1A15684662B7711B53A84522122C6A11D618366314D9DD297B3A7FEC1A. This is the unchanged, previously published R21 archive, not a new Linux release.
• Verify downloaded checksums against SHA256SUMS_R54_PREVIEW.txt before installation. Review R54_PREVIEW_EVIDENCE.json and THIRD_PARTY_NOTICES.md.

What passed

• Source-only V493 Gateway STOP ownership/DNS53 hardening and cross-process mutation locking; default UI selection is Browser Only. Native whole-PC tunneling requires deliberate user selection and approval.
• Hosted Windows/Android/Linux/iOS source and installer checks: V493 PR CI 10/10 PASS, Push CI 10/10 PASS; isolated private Gateway fresh/upgrade 2/2 PASS and R54 fresh/upgrade 2/2 PASS.
• Local V493 source-matched, unsigned installer SHA, Gateway 18/18 file-manifest checks, and owner-side read-only PRE-UAC 14/14 PASS.
• Browser-scoped connectivity has been observed on owner Windows and Linux in the release lineage; this is not evidence of universal connectivity on every network.

Known limitations and safety

Windows Full System / Native TUN is EXPERIMENTAL — NOT FIELD-ACCEPTED. Physical Ethernet/Wi-Fi route swapping, DNS/IPv6 leak prevention, and an independently tested automatic network rollback are NOT proven for this exact build. Do not enable Full System on a remotely managed machine or as a production privacy/security guarantee; test it only with local physical access and an independently tested recovery plan. Other VPNs, games, virtual adapters and consoles may be affected.

Android/iOS emulator checks are not proof of real mobile traffic forwarding or iOS production entitlements. Linux native WARP requires explicit applicable consent and privilege. Connectivity depends on providers, local restrictions and network conditions; no guarantee of uninterrupted or universally unblocked Internet. Before upgrades, keep your existing settings/profiles backed up. This preview does not install itself on existing devices.

Build provenance

R54 application/installer source base e4112be was combined with V493 Gateway changes from 2e73cd9; resulting Gateway manifest SHA-256 9E7F677A8793BA902E4ED1C198A594B033BE46E3A0A348CEECE0C68CA49C2621. The tag points to the Gateway source review lineage, not an independently reproducible single-commit R54 installer source tree; see the included evidence and third-party notices. CI runner installer bytes need not match the separately built owner-side installer above.

Signing later: the next signed build will be published and separately hash-verified. This unsigned preview will remain identified as unsigned; adding a signature produces different binary bytes and a new SHA-256.

فارسی: این نسخه عمومی ولی آزمایشی و بدون امضای دیجیتال است. حالت پیش‌فرض «فقط مرورگر» است. تونل کل سیستم، جلوگیری از نشت DNS و بازیابی خودکار هنوز آزمون فیزیکی نهایی ندارند. نسخهٔ پایدار 4.3.9 بدون تغییر باقی می‌ماند.

FreeNet Hub 4.3.9 R53 - Windows installer identity guard

Current Linux R21 update — 14 October 2026

This is the existing single Latest Release for Windows R53 and Linux R21. The original notes below describe the historical first publication of Windows R53 with Linux R20; the Linux R20 references there are superseded by this update.

• Current Windows installer: FreeNetHub_4.3.9_R53_Setup.exe. Owner physical Windows 4.3.9 installation, one canonical registered install, in-place update, real WPF UI, browser profiles and CFON scoped connectivity accepted. Digital signature remains unavailable; do not disable OS protections.
• Current Linux installer/update: FreeNetHub_4.2.0_Linux_R21.zip, version 4.2.0-linux.21-r54, SHA-256 82305e1a15684662b7711b53a84522122c6a11d618366314d9dd297b3a7fec1a. This is a separate versioned update; public R20 ZIP remains unchanged as a rollback reference.
• R20 online updater detects R21 as newer; R21 updater reports no update. Linux owner physical in-place upgrade validated application SHA checks, four retained configuration hashes, real GTK launch, app-owned CFON SOCKS5 HTTP 200, and independent Tailscale/L2TP continuity. Private quiescent R20 rollback backup retained; restore itself not destructively tested.
• Linux R21 removes implicit Cloudflare WARP Terms acceptance. Full-device official WARP still requires explicit native owner Terms acceptance, authorized OS privilege and physical DNS/route regression preserving Tailscale and L2TP. Scoped CFON success is not proof of systemwide tunneling.
• Android/iOS simulators passing CI are not real-device acceptance. Windows elevated console Gateway, Linux SYSTEM privacy and real mobile hardware remain UNPROVEN, not finalized.

Authoritative current asset SHA values are those in GitHub's public asset digest metadata. Existing R20/R53 files were not replaced or rebuilt.

---

\n# FreeNet Hub v4.3.9 / R53 ظ�¤ Windows installer identity safety

This release advances the existing public Windows installer line with one targeted safety correction. It preserves the supported browser-proxy and other existing software features; it is not a guarantee of Internet access on every network.

What changed

• The Windows Inno Setup installer now detects a conflicting canonical application directory and uninstall registration under the same AppId. It fails closed before prerequisites, runtime shutdown, or file replacement rather than silently choosing a temporary/test installation.
• The installed revision and GitHub online-update revision advance to 4.3.9-r53-inno-root-guard / R53.
• The same exact previously accepted Linux R20 ZIP is attached unchanged so Linux update discovery stays available through the single Latest Release.

Installation / update

• Windows: one FreeNetHub_4.3.9_R53_Setup.exe installer. A normal in-place upgrade is supported only when the current app is disconnected, the Uninstaller identity is consistent, and the upgrade preflight passes.
• If Setup detects multiple conflicting directories/Uninstaller histories, it deliberately refuses installation. Do not delete the temporary directory, force-stop an active tunnel, or manually rewrite the registry as a shortcut. Preserve the user's data and use a controlled recovery window.
• Windows installer remains unsigned under the explicitly accepted public release policy. Windows may warn or block an unsigned installer. Do not disable platform protections just to run it.
• Linux R20 remains browser-scoped as previously published; full-system DNS leak prevention has not been validated.

Validation boundaries

The source installer guard is tested on an isolated Windows runner for fresh install, positive upgrade and explicit rollback, plus conflicting-AppId rejection without modifying existing installed data. The full cross-platform CI matrix is required before publication. Windows physical owner upgrade with two active R51 installations, Linux global DNS/privacy, real mobile VPN forwarding, physical console deployment and interactive browser login remain separate evidence gates.

Authoritative assets

SHA-256 digests in the GitHub Release asset metadata are the final authority. Older Windows R52/R51 installers remain historic rollback references; this new release contains one current Windows installer and the pinned Linux R20 archive.

FreeNet Hub 4.3.8 — Windows R52 + Linux R20

FreeNet Hub 4.3.8 — Windows R52 / Linux R20

This official release contains one Windows installer (R52) and one Linux installation package (R20). Windows R52 is an in-place upgrade over R51, not a parallel installation. Linux R20 is the same validated package as the previous public release.

Windows R52 — improvements

• Expires old NODE HTTPS and throughput test evidence after 10 minutes; TCP reachability evidence after 5 minutes.
• Displays STALE / retest instead of falsely showing old successful tests as current.
• Smart node selection requires recent verified evidence; actual connection must still pass live HTTPS checks.
• Preserves the original Inno Setup AppId and existing per-user installation directory for in-place R51→R52 updates.

Linux R20

• Existing browser-scoped CFON, NODE and WARP functionality; package SHA256 remains exactly identical to previously accepted Linux R20.
• A system-wide, DNS-leak-free Riseup VPN has NOT been validated on the Ubuntu owner host and is NOT claimed in this release.

Security and compatibility

• Windows R52 is distributed WITHOUT a digital signature, by maintainer choice. Verify the file SHA256 and download only from the official repository.
• Windows Defender SmartScreen may display an unknown-publisher warning; Windows Smart App Control or enterprise policies can block unsigned applications. Do not disable security protection to install.
• This release does not guarantee access to every website. Interactive login to ChatGPT behind Cloudflare has not been independently accepted.
• Only the browser/proxy scope has verified active country-specific CFON connection; no silent system routing changes are introduced.
• Exact hosted CI includes Windows fresh install, R51→R52 upgrade and deliberate R52→R51 rollback, plus Linux static/install checks and multi-platform regressions.

Installer checksums (SHA256)

Windows FreeNetHub_4.3.8_R52_Setup.exe:
A48F689B22940C9D752FADB6372B849948B18192F3A30D4FC3971C15827F9883

Linux FreeNetHub_4.2.0_Linux_R20.zip:
5973D721EC2D93F7D500187EBC9BB4A5CA06AD73A937BC9AAD936E7C1D745D3B

Prior Windows R51 installer remains available in the earlier release for explicit rollback when permitted by Windows system policy.

FreeNet Hub 4.3.7 Linux R20 CFON smart browser

FreeNet Hub 4.3.7 — Linux R20 smart CFON and verified destination diagnostics.

• Linux: smart Browser AUTO falls back to CFON after NODE only when independent Google and GitHub/NVIDIA target probes pass; then WARP/Tor as before.
• Linux: explicit site checks against four allowlisted destinations from owned SOCKS5H with remote DNS; HTTP 403/challenge is never PASS. Previously verified R19 browser launch checks retained.
• Linux package: FreeNetHub_4.2.0_Linux_R20.zip (4.2.0-linux.20-r47).
• Windows: original FreeNetHub_4.3.7_R51_Setup.exe, byte-for-byte unchanged (SHA256 8283803146e1625a31f0223487a63c05d7b7d9c3d8b59d1a7432d14ab9d4ff11).
• Linux R20 fresh install and R19 upgrade tested in isolated HOME; active CFON session upgrade refuses pre-mutation with explicit error (regression tested); Ubuntu 26.04 CFON target probe passed Google/GitHub/NVIDIA, ChatGPT challenge correctly classified.
• This release is browser-scoped only; a full-system CFON/OpenVPN TCP+UDP gateway remains unaccepted and is not auto-installed or enabled. Community VPN Gate is logging and privacy-sensitive.

FreeNet Hub 4.3.7 Linux R19 browser fix

FreeNet Hub 4.3.7 — Linux browser action patch R19.

• Linux: explicit unprotected system-browser button; tunneled browser remains fail-closed until connection health is verified.
• Linux: verifies Firefox process launch before reporting success; preserves useful error feedback.
• Linux package: FreeNetHub_4.2.0_Linux_R19.zip (4.2.0-linux.19-r46).
• Windows: original FreeNetHub_4.3.7_R51_Setup.exe, byte-for-byte unchanged (SHA256 8283803146e1625a31f0223487a63c05d7b7d9c3d8b59d1a7432d14ab9d4ff11).
• Linux R19 fresh install and R18 upgrade tested in isolated HOME with locally verified pinned runtimes; native Ubuntu 26.04 isolated Firefox launch verified.
• VPN/node functionality still depends on available live upstreams; this patch does not claim to resolve blocked network paths.

FreeNet Hub 4.3.7 Final

FreeNet Hub 4.3.7 Final

Current desktop install authority:

Windows:

• FreeNetHub_4.3.7_R51_Setup.exe
• SHA-256: 8283803146E1625A31F0223487A63C05D7B7D9C3D8B59D1A7432D14AB9D4FF11
• Revision: 4.3.7-r51-protocol-expansion-2
• Final asset rebuilt from exact main after Linux R18 metadata alignment; installer manifest preflight PASS_RAW_BYTES_MATCH_APP_MANIFEST.

Linux:

• FreeNetHub_4.2.0_Linux_R18.zip
• SHA-256: 3C9254840C85B6D7305B0986209FF96EBEE578193D193538E8E8D45924ECBCD7
• Revision: 4.2.0-linux.18-r45

Linux R18 browser/node hotfix:

• Fixes NODE browser routing so Firefox uses the selected sing-box SOCKS5 listener on 127.0.0.1:19460 with remote DNS.
• Adds NODE pre-launch readiness verification and records the selected proxy port in session state.
• Uses bounded verification retry to tolerate a transient first trace failure without blind reruns.
• Standard Ubuntu Snap Firefox 157 was revalidated after the required Ubuntu 26.04 reboot; no alternate Firefox runtime is required.
• Fresh public node refresh: 8/8 sources, 2,876 parsed inputs, 2,000 merged nodes.
• Owner-host live NODE acceptance: VMess via AURX_HTTP_VERIFIED, exit 31.76.11.83 / DE, Browser scope.
• Exact R18 ZIP rebuild is reproducible; 23/23 SHA256SUMS PASS and 7/7 extracted package tests PASS.

Hosted validation:

• Exact final SHA: 06d3459
• Candidate CI run #223 / 37492728341: 10/10 SUCCESS.
• Main CI run #224 / 37494197358: 10/10 SUCCESS on the same SHA.
• windows-unit: SUCCESS
• windows-installer-fresh: SUCCESS
• linux-static + exact R18 package: SUCCESS
• console-virtual-e2e: SUCCESS
• windows-virtual-signing: SUCCESS
• android-build: SUCCESS
• android-emulator-runtime: SUCCESS
• ios-static: SUCCESS
• ios-simulator-runtime: SUCCESS
• virtual-acceptance: SUCCESS

Public tree/security:

• Public manifest verification: PASS
• Public security scan: PASS
• Public manifest: 516 files
• PUBLIC_MANIFEST SHA-256: 0E5A866F0D1D300D54C314613127BE6EA496B52AAA97EE05AB5E82CA9EE053C9

Remaining external boundaries:

• Public-trust Windows Authenticode requires an external trusted signing identity.
• Physical console/game/country field validation requires target hardware/network.
• Production mobile forwarding/signing/real-device validation remains separate from the passing virtual fail-closed runtime gates.

For new desktop installs, use only the two assets above.