📦 CHANGELOG

🚀 v2.0.2– Intelligent Public IP Detection + DNS Loop Protection (2025-11-19)

Smart Public IP Auto-Detection (IPv4-first + IPv6 fallback)
The proxy now automatically determines the server’s public IP using multiple external services.
- Tries IPv4 services first
- Falls back to IPv6 providers only when IPv4 fails
- Supports dual-stack environments
- Fully compatible with Docker, NAT, and cloud firewalls
Multi-Service Failover for IP Detection
Added support for multiple providers:
- api.ipify.org
- ipv4.icanhazip.com
- checkip.amazonaws.com
- ifconfig.me
- ident.me
  The first successful response is used, ensuring high reliability even when some services are down.
Domain Loop Prevention via DNS Resolution
The proxy now prevents loops when clients send requests using a domain instead of direct IP.
- Resolves SNI/Host to IP
- Blocks requests when domain resolves to server's public IP
- Crucial for preventing Docker NAT feedback loops
- Example:
  - yourdomain.com → 130.185.121.90 → forwarded back → loop
  - Now blocked instantly.
DNS Caching for Maximum Performance
All DNS resolutions used for loop protection are now cached to avoid repeated lookups and latency.
- Cached per hostname
- Zero performance overhead
- Cache invalidation not required for this use case

Optimized Loop Detection Logic
- Direct comparison (Host == publicIP)
- DNS-resolved comparison (domain → IP → match publicIP)
- Local IP block (127.0.0.1, container IPs)
Better Logging & Visibility
Added more detailed slog messages for each IP detection step, provider attempts, and loop prevention cases.

Fixed self-dial loops for domains that resolve to the server’s own IP
Domains like mydomain.com previously caused infinite loops when proxied behind Docker port mappings.
Now correctly blocked before any backend dial happens.
Fixed scenarios where IPv6-only detection returned invalid IP in IPv4 environments
Now strictly prioritizes IPv4 unless IPv4 is not available.
Fixed loop where fallback IPv6 services returned empty or malformed responses
Improved IP validation logic prevents incorrect matches.

Public IP detection is executed once at startup.
DNS lookups are:
- Only performed on first encounter of a hostname
- Cached for subsequent requests
- Safe for high-throughput environments
No noticeable performance overhead from DNS resolution.
Works seamlessly with port-offset routing (e.g., 9443 → 443).