v2.0.2

📦 CHANGELOG

🚀 v2.0.2– Intelligent Public IP Detection + DNS Loop Protection (2025-11-19)

🔥 New Features

• Smart Public IP Auto-Detection (IPv4-first + IPv6 fallback)
  The proxy now automatically determines the server’s public IP using multiple external services.

  • Tries IPv4 services first
  • Falls back to IPv6 providers only when IPv4 fails
  • Supports dual-stack environments
  • Fully compatible with Docker, NAT, and cloud firewalls

• Multi-Service Failover for IP Detection
  Added support for multiple providers:

  • api.ipify.org
  • ipv4.icanhazip.com
  • checkip.amazonaws.com
  • ifconfig.me
  • ident.me
    The first successful response is used, ensuring high reliability even when some services are down.

• Domain Loop Prevention via DNS Resolution
  The proxy now prevents loops when clients send requests using a domain instead of direct IP.

  • Resolves SNI/Host to IP

  • Blocks requests when domain resolves to server's public IP

  • Crucial for preventing Docker NAT feedback loops

  • Example:

    • yourdomain.com → 130.185.121.90 → forwarded back → loop
    • Now blocked instantly.

• DNS Caching for Maximum Performance
  All DNS resolutions used for loop protection are now cached to avoid repeated lookups and latency.

  • Cached per hostname
  • Zero performance overhead
  • Cache invalidation not required for this use case

---

🛠 Enhancements

• Optimized Loop Detection Logic

  • Direct comparison (Host == publicIP)
  • DNS-resolved comparison (domain → IP → match publicIP)
  • Local IP block (127.0.0.1, container IPs)

• Better Logging & Visibility
  Added more detailed slog messages for each IP detection step, provider attempts, and loop prevention cases.

---

🐛 Bug Fixes

• Fixed self-dial loops for domains that resolve to the server’s own IP
  Domains like mydomain.com previously caused infinite loops when proxied behind Docker port mappings.
  Now correctly blocked before any backend dial happens.

• Fixed scenarios where IPv6-only detection returned invalid IP in IPv4 environments
  Now strictly prioritizes IPv4 unless IPv4 is not available.

• Fixed loop where fallback IPv6 services returned empty or malformed responses
  Improved IP validation logic prevents incorrect matches.

---

📌 Technical Notes

• Public IP detection is executed once at startup.

• DNS lookups are:

  • Only performed on first encounter of a hostname
  • Cached for subsequent requests
  • Safe for high-throughput environments

• No noticeable performance overhead from DNS resolution.

• Works seamlessly with port-offset routing (e.g., 9443 → 443).

v2.0.1

📦 CHANGELOG

🚀 v2.0.1 – Loop-Safe Release (2025-11-19)

This release fixes all infinite loop issues, improves Docker compatibility, and introduces automatic port-offset routing.

🔥 New Features

• Port Offset System (9443→443, 9080→80)
  Prevents infinite NAT loops inside Docker by mapping incoming 9xxx ports back to real service ports.

  • Incoming 9443 → backend 443
  • Incoming 9080 → backend 80
  • Generic: 9xxx → xxx

• Automatic Backend Port Calculation
  Added calculateBackendPort() to derive correct upstream port from incoming port.

• Docker-Safe Architecture
  Now the proxy can run safely inside Docker without ever looping back into itself:

  docker run -p 443:9443 -p 80:9080 proxy

• Local-IP Loop Detection
  Blocks requests targeting:

  • 127.0.0.1
  • container IPs (e.g. 172.17.x.x)
  • any loopback scenario

• Improved SNI & Host Parsing

  • Robust TLS ClientHello reading
  • Safe fallback for malformed HTTP requests
  • Better error reporting

---

🛠 Enhancements

• Cleaner multi-port handling

  • Supports lists (9443,9080)
  • Supports ranges (9000-9999)
  • Mixed formats now work reliably

• Improved logging with slog

  • Context-aware fields
  • Debug mode shows detailed inbound/outbound flow

• Removed broken waitgroup logic

  • Listeners now run asynchronously without blocking startup

• Refined connection lifecycle

  • Safe CloseWrite usage
  • No panics due to non-TCPConn types

• Better error readability

  • TLS handshake failures explained
  • Invalid ports detected early

---

🐛 Bug Fixes

• Fixed infinite self-connection loop

  • Proxy no longer dials its own listening port
  • Works correctly behind Docker NAT

• Fixed HTTP detection deadlock

  • Prevented long hangs when reading initial bytes

• Fixed TLS handshake stalling

  • Added read deadlines
  • Improved ClientHello extraction using corrected ReadOnlyConn

• Fixed crash when port ranges were malformed

  • Handling of cases like 8080- or -9000

• Fixed missing pointer receiver on ReadOnlyConn

  • Deadlines now work
  • Avoids handshake blockages

---

📦 Technical Notes

• Using 9xxx → xxx port-offset model is now required for Docker deployments.

• All tests confirm zero looping under:

  • Host network mode
  • Bridge network mode
  • Exposed port mode
  • NAT rewrites

Example deployment:

docker run \
  -p 443:9443 \
  -p 80:9080 \
  ghcr.io/mrmohebi/forward-proxy:latest \
  -port 9443,9080 \
  -log-level info

v1.1.2

• add log level
• forward request on all ports

v1.0.3

fix username