v2.0.0 (experiment) — MTU 1340, TCP fallback

v2.0.0 is a full experimental GitHub pre-release. It does not replace Latest. Daily driver stays v1.7.1.

If the current VPN already works, you do not need to install 2.0.0.

What this tag is

• Tunnel MTU 1340 on Android phone, Android TV, and Windows. The client forces 1340. No MTU field and no TCP/UDP switch.
• UDP is the normal path. TCP HTTP/2 CONNECT-IP opens only when a short UDP probe to the server gets no reply. TCP uses the same host and the same ports (profile port, then optional alt_port).
• One server process listens on UDP and TCP on the same bind port. Profiles and certificates do not change.
• Android 2.0.0 (versionCode 25, TV 2.0.0-tv). Windows product 2.0.0.
• New Linux server binaries, install.sh, gen-config.sh, and Docker sources (masque-docker-2.0.0.zip, image tag masque-vpn-server:2.0.0). Install the server with install.sh. masque-setup.exe is not in this release: that wizard still opens only a UDP port.

Who should try it

• A path where UDP to the server is dropped and TCP 443 still works.
• A path where large UDP datagrams die (phone sweep: UDP empty at MTU 1365 and 1369, usable at 1340).

Everyone else: stay on v1.7.1.

Compatibility

• A v1.7.1 (and older UDP) client still reaches a v2.0.0 server. The UDP listener is the same CONNECT-IP session.
• A v2.0.0 client still reaches an older server over UDP. TCP fallback needs this 2.0.0 server: an old server has no HTTP/2 CONNECT-IP listener.
• iOS TestFlight v1.7 is unchanged and stays UDP-only. No IPA is attached.

Docker

Build on a Linux host from this tag (Compose context is the repository root):

docker compose -f server/docker-compose.yml build

masque-docker-2.0.0.zip is those same sources (Dockerfile, docker-compose.yml, entrypoint.sh). Host network, NET_ADMIN, and /dev/net/tun are required. The image is not attached as a tarball.

Files

• masque-phone-2.0.0.apk — Android phone
• masque-tv-2.0.0.apk — Android TV
• masque-2.0.0.msi — Windows VPN client
• vpn-server-linux-amd64, vpn-server-linux-arm64
• install.sh, gen-config.sh, SHA256SUMS
• masque-docker-2.0.0.zip

Fix

• Losing UDP probes no longer stay blocked after the first answer or after Connect is cancelled.

Notes

• Server TUN MTU stays 1369. Client packets are 1340, so they fit.
• Experimental, self-hosted software. No third-party security audit.

v1.7.1

v1.7.1 is GitHub Latest. It replaces v1.5.3. This drop is Android APK and Windows MSI only. The Linux server already running (1.5.x, connect-ip-go v0.3.0) stays in place.

Clients use connect-ip-go v0.4.0. They only wait for the server's address assignment (ReceiveAddressAssignment) and do not send ADDRESS_REQUEST, so a 0.3 server still accepts the session. A 1.5.x client also still reaches that same server. This tag does not replace the server binary.

iOS TestFlight v1.7.0 is unchanged. This tag does not include an IPA.

What changed

• Android and Windows clients: connect-ip-go v0.3.0 → v0.4.0, still talking to a 0.3 server.
• Android shows Connected only after the QUIC socket is kept off the VPN (protect + bind to the physical network, before the TUN route) and an ICMP echo to the server tunnel address comes back. Two automatic retries if the echo fails.
• Android Gradle Plugin 9.4.1 on the Gradle 9.8 wrapper.
• quic-go 0.63.0 (already on main).
• Android 1.7.1 (versionCode 23). Windows product 1.7.1.

Files

• masque-1.7.1.msi — Windows VPN client
• masque-phone-1.7.1.apk — Android phone
• masque-tv-1.7.1.apk — Android TV

v1.7 (iOS TestFlight)

v1.7 is iOS TestFlight only. It does not replace Latest. Daily driver stays v1.5.3. Optional IPv6 QUIC remains v1.5.6.

No APK, MSI, or Linux server binary is attached. Install the iOS client from TestFlight.

TestFlight

• Public link: https://testflight.apple.com/join/x52N41V1
• Marketing version 1.7.0, Apple build 20 (external testing approved).
• Built from GitHub Actions TestFlight run 20 on e708ea7 (fix/ios-reconnect-hold).
• This build expires in 80 days, on 4 December 2026. After that date a new TestFlight build will be published for 90 days.

Who should use this

Anyone with an iPhone or iPad who already runs a MASQUE server. Import the same profile.masque as Android/Windows. One bundle per device.

Compatibility

This TestFlight build is the iOS client as of 5 September 2026. It does not include later main work (optional alt_port, QUIC over IPv6). Use an IPv4 profile and a single UDP port, same as Latest v1.5.3.

Files

None on GitHub. The IPA is distributed by Apple TestFlight only.

v1.5.6 — QUIC over IPv6 (optional)

v1.5.6 is a full GitHub release of QUIC to the server over IPv6. It does not replace Latest. Daily driver stays v1.5.3.

Previous 1.5.x clients and servers stay compatible over IPv4. If your VPN already works, you do not need to install 1.5.6.

What this tag is

• QUIC over IPv6: A + AAAA, IPv6 preferred; optional gen-config.sh --dial writes [IPv6]:port into client profiles.
• Server bind defaults to [::]:port (dual-stack when net.ipv6.bindv6only=0). install.sh accepts MASQUE_IP and MASQUE_DIAL.
• Android 1.5.6 (versionCode 22); Windows product 1.5.6.
• Windows Disconnect closes the QUIC session (pre-1.5.6 clients stay Connected until traffic or sc stop MasqueVpn).
• install.sh, gen-config.sh, SHA256SUMS (the v1.5.5 packaging slice that was not published as its own tag).
• New vpn-server-linux-amd64 / vpn-server-linux-arm64.

Who should update

• Operators whose VPS has WAN IPv6 and who want the client path on UDP/443 IPv6.
• Anyone who wants the Windows Disconnect fix.

Everyone else: stay on v1.5.3 (Latest). Stay on v1.5.4 only if you already use alt_port and do not need IPv6 QUIC.

Compatibility

All earlier MASQUE 1.5.x (and the v1.3+/v1.4.x CONNECT-IP line) keep working:

• Old v1.5.3 / v1.5.4 clients reach a v1.5.6 server over IPv4 (same RFC 9484 capsules; keep the IPv4 SAN).
• A v1.5.6 client reaches an older IPv4-only server when the profile is IPv4 (or a name without a real AAAA).
• Do not publish AAAA for a hostname still used by pre-1.5.6 clients (ResolveUDPAddr can pick IPv6 while the old socket is IPv4-only).
• Dual-port (alt_port) is unchanged from v1.5.4.

masque-setup.exe

Experimental. One UDP listen port. Public host is IPv4 or DNS only (no IPv6 literal in the wizard). The 1.5.6 server it installs already listens dual-stack. Second port: gen-config.sh --alt-port. QUIC to a specific IPv6: MASQUE_DIAL / MASQUE_IP on install.sh, not the wizard.

iOS

No iOS build is attached. TestFlight stays v1.7.

Notes

• Experimental, self-hosted software. No third-party security audit.
• DoH/DoT is not in this tag.
• The AGP 9.4 / Gradle 9.6 bump did not land; Android stays on the 1.5.4 toolchain.

Files

• masque-1.5.6.msi — Windows VPN client (Disconnect closes QUIC)
• masque-setup.exe — experimental VPS installer
• masque-phone-1.5.6.apk — Android phone
• masque-tv-1.5.6.apk — Android TV
• vpn-server-linux-amd64 / vpn-server-linux-arm64 — server
• install.sh / gen-config.sh — VPS install
• SHA256SUMS

v1.5.4 (pre-release) — connect-ip-go v0.3.0, alt_port

v1.5.4 is a GitHub pre-release. It bumps connect-ip-go to v0.3.0 and races two QUIC ports so a path that drops UDP 443 can still connect. The CONNECT-IP protocol is unchanged; existing profiles keep working. v1.5.3 stays Latest until this soaks. This is the first new Linux server binary since v1.5.1.

What this tag is

• connect-ip-go v0.2.0 → v0.3.0 (server + Android/Windows/Linux clients). quic-go stays v0.62.0.
• Dual-port: optional [server].alt_port (any second UDP port on the same host). Clients race it with the profile port. Omit the field for a single port. gen-config.sh --alt-port N writes it.
• Android 1.5.4 (versionCode 21); Windows product 1.5.4.
• New vpn-server-linux-amd64 / vpn-server-linux-arm64.

Who should update

• Anyone whose path drops one of two UDP ports (put the other in alt_port, and open it on the VPS).
• Operators who will soak the new connect-ip-go on a machine they can roll back.

Stay on v1.5.3 if you only need a daily driver.

Compatibility

• Old v1.5.3 clients should still reach a v1.5.4 server (same RFC 9484 capsules).
• New clients should still reach a v1.5.1 server. Prefer pairing new client + new server for soak.
• Dual-port without alt_port behaves like v1.5.3 (one port). A dead alt_port fails; the profile port can still win.

iOS

No iOS build is attached. The shared Go core is updated; TestFlight stays v1.7.

Notes

• Experimental, self-hosted software. No third-party security audit.
• DoH/DoT is not in this tag (own VPS; in-tunnel UDP:53 is visible to the operator by design).
• Next: v1.5.5 masque-setup issues alt_port profiles; then install.sh / attestations. v1.5.6 QUIC over IPv6.
• masque-setup in this tag still writes one-port files. Add alt_port by hand or via gen-config.sh --alt-port.

Files

• masque-1.5.4.msi — Windows VPN client
• masque-phone-1.5.4.apk — Android phone
• masque-tv-1.5.4.apk — Android TV
• vpn-server-linux-amd64 / vpn-server-linux-arm64 — server

v1.5.3 — TV Connect fix, kill switch, IPv6

v1.5.3 is GitHub Latest. It is the v1.5.2 client line plus an Android TV Connect crash fix. Optional kill switch (default off) and optional IPv6 inside the tunnel are included. The CONNECT-IP protocol is unchanged; existing profiles keep working. Linux server binaries are the same protocol as v1.5.0 / v1.5.1. masque-setup.exe is not in this release; use v1.5.1 if you need the VPS helper.

What this tag is

• Android TV: Connect no longer crashes (leanback notification intent; skip battery-exemption on TV; IPv6 TUN skipped if the device rejects it).
• Optional kill switch, off until the user enables it (from v1.5.2).
• Android 1.5.3 (versionCode 20); Windows product 1.5.3.
• Same CONNECT-IP server as v1.5.0 / v1.5.1.

Who should update

• Android TV users on v1.5.0–v1.5.2 (Connect crash).
• Anyone who wants Latest with kill switch + IPv6 clients in one download.

iOS

No iOS build is attached. TestFlight is v1.7 (not later than 12 October 2026).

Notes

• Experimental, self-hosted software. No third-party security audit.
• Android APKs are signed when built with the project keystore.
• Linux server binaries contain no certificates.
• Next technical slices: v1.5.4 dual-port + DoH + library bump; v1.5.5 install.sh / attestations; v1.5.6 QUIC over IPv6.

Files

• masque-1.5.3.msi — Windows VPN client
• masque-phone-1.5.3.apk — Android phone
• masque-tv-1.5.3.apk — Android TV
• vpn-server-linux-amd64 / vpn-server-linux-arm64 — server

v1.5.2 (pre-release) — optional kill switch

v1.5.2 is a technical pre-release after v1.5.1. It adds an optional kill switch on Android and Windows. The CONNECT-IP protocol is unchanged; existing profiles keep working. v1.5.0 remains GitHub Latest. No new Linux server binary is required.

What this tag is

• Optional kill switch, off until the user enables it.
• Android 1.5.2 (versionCode 19); Windows product 1.5.2.
• Same server as v1.5.0 / v1.5.1.

Kill switch

After Connect, if the tunnel dies while the app/service is still running, traffic is blackholed instead of falling back to the ISP. Disconnect restores the normal default route.

• Android: VpnService blocking mode + TUN kept up across reconnect attempts.
• Windows: default routes installed before the first dial and kept until Disconnect.

This does not survive a killed process (OEM battery saver, taskkill). On Android also enable system Always-on VPN and Block connections without VPN.

iOS

No iOS build is attached. TestFlight remains v1.6.

Who should update

• Anyone who wants leak protection when QUIC drops but the VPN UI/service is still up.
• No server upgrade for this tag.

Notes

• Experimental, self-hosted software. No third-party security audit.
• Android APKs are signed when built with the project keystore.
• Next technical slices: v1.5.3 dual-port + DoH + library bump; v1.5.4 install.sh / attestations; v1.5.5 QUIC over IPv6.

Files

• masque-1.5.2.msi — Windows VPN client
• masque-phone-1.5.2.apk — Android phone
• masque-tv-1.5.2.apk — Android TV

v1.5.1 (pre-release) — CN denylist, MTU 1369, UDP 443 workaround

v1.5.1 is a technical pre-release after v1.5.0. It closes small operational gaps. The CONNECT-IP protocol is unchanged; existing profiles keep working. v1.5.0 remains GitHub Latest.

What this tag is

• Server: refuse listed client certificate CNs (/opt/masque/blocked_cns, optional tls.blocked_cns). Reload on process start.
• Windows masque-setup.exe: Revoke certificate (append CN + restart masque.service).
• Clients: default TUN MTU 1369 from path tests (MTS mobile data DF-safe at 1370, loss at 1380; one-byte margin). Details: repository docs/benchmarks/mtu.md.
• Android 1.5.1 (versionCode 18); Windows product 1.5.1.

UDP 443 unusable on the client path

Some networks drop outbound UDP 443. Keep the server bound to 443. On the VPS:

ufw allow 2053/udp
iptables -t nat -C PREROUTING -p udp --dport 2053 -j REDIRECT --to-ports 443 2>/dev/null \
  || iptables -t nat -A PREROUTING -p udp --dport 2053 -j REDIRECT --to-ports 443
netfilter-persistent save   # after installing iptables-persistent

Also allow UDP 2053 in the cloud security group. Set the client profile host to :2053. TLS server name is unchanged. Android still dials one port in this release.

iOS

First successful on-device result. No iOS build is attached here. TestFlight access is planned for v1.6 (not later than 12 October 2026).

v1.6 (committed)

• TestFlight access for the iOS client.
• Android dual-port: UDP 443 and the alternate port at the same time.

Who should update

• Operators who need to disable a leaked profile.masque without rotating the CA.
• Clients on paths where inner DF probes failed above ~1370 (use the new APK/MSI).
• Anyone hitting UDP 443 blackholes (server redirect + profile port; no client upgrade strictly required for the redirect).

Notes

• Experimental, self-hosted software. No third-party security audit.
• Android APKs are signed. Linux server binaries contain no certificates.
• Replace the server binary for the denylist. Client updates are required for MTU 1369 on Android (hardcoded). Windows uses 1369 for new/default profiles and the adapter MTU in this MSI.

Files

• masque-1.5.1.msi — Windows VPN client
• masque-setup.exe — experimental VPS installer (revoke + issue); place vpn-server-linux-* next to it
• masque-phone-1.5.1.apk — Android phone
• masque-tv-1.5.1.apk — Android TV
• vpn-server-linux-amd64 / vpn-server-linux-arm64 — server

v1.5.0 — IPv6 in the tunnel

v1.5.0 adds optional IPv6 inside the tunnel. Traffic can use a ULA address (fd00:8::/64) and NAT66 on the VPS. IPv4-only server configs (no tun_addr_v6 / pool_cidr_v6) keep working. Client profiles do not change.

Connecting to the VPN is still IPv4 QUIC. Do not publish an AAAA for the VPN hostname in this release (that needs a host-route bypass first).

Highlights

• Server: optional IPv6 pool, sticky /128 per client CN, route_v6 (::/0).
• NAT66 in systemd, Docker, and gen-config.sh.
• Android 1.5.0 (versionCode 17): assigned IPv6 on TUN (no longer sunk when the server hands out v6).
• Windows GUI and console: IPv6 on Wintun plus ::/0 through the tunnel.
• Linux console vpn-client: same IPv6 address and default/test routes.

Who should update

• Anyone whose VPS has WAN IPv6 and who wants AAAA destinations to work through the VPN.
• Existing clients on IPv4-only servers: optional; behavior stays IPv4-only until you add the v6 keys and replace the server binary.

Notes

• This is experimental, self-hosted software. No third-party security audit.
• Android APKs are signed (sideload with unknown sources). Unsigned builds would not install on current Android.
• Linux server binaries contain no certificates — keep your existing CA; do not re-run gen-config.sh just to pick up IPv6 (add the three keys to config.server.toml instead).

Files

• masque-1.5.0.msi — Windows
• masque-phone-1.5.0.apk — Android phone
• masque-tv-1.5.0.apk — Android TV
• vpn-server-linux-amd64 / vpn-server-linux-arm64 — server

v1.4.2 — experimental VPS installer (test)

This is an experimental test pre-release. It is not a finished product and not a new Android/Windows VPN client. Stable clients remain v1.4.0 (Latest). The v1.4.1 maintenance APKs/MSI are unchanged.

masque-setup.exe SSHes to a VPS as root, can change apt, ufw, and systemd, and has no certificate revocation. Use only on a machine you can wipe. Prefer the documented SSH install if you need a known-good server.

What to download

File	Role
masque-setup.exe	Windows helper (experimental)
vpn-server-linux-amd64 or vpn-server-linux-arm64	Server binary to copy onto the VPS — must sit in the same folder as the EXE (or pick it in the UI). The EXE does not contain the server.
README-SETUP.txt	Same layout rules in short form

Match amd64/arm64 to the VPS CPU. Existing MASQUE installs are detected and not overwritten; issuance starts at client #9 (test CNs 1–8 are left alone).