v1.5.2 (pre-release) — optional kill switch

v1.5.2 is a technical pre-release after v1.5.1. It adds an optional kill switch on Android and Windows. The CONNECT-IP protocol is unchanged; existing profiles keep working. v1.5.0 remains GitHub Latest. No new Linux server binary is required.

What this tag is

• Optional kill switch, off until the user enables it.
• Android 1.5.2 (versionCode 19); Windows product 1.5.2.
• Same server as v1.5.0 / v1.5.1.

Kill switch

After Connect, if the tunnel dies while the app/service is still running, traffic is blackholed instead of falling back to the ISP. Disconnect restores the normal default route.

• Android: VpnService blocking mode + TUN kept up across reconnect attempts.
• Windows: default routes installed before the first dial and kept until Disconnect.

This does not survive a killed process (OEM battery saver, taskkill). On Android also enable system Always-on VPN and Block connections without VPN.

iOS

No iOS build is attached. TestFlight remains v1.6.

Who should update

• Anyone who wants leak protection when QUIC drops but the VPN UI/service is still up.
• No server upgrade for this tag.

Notes

• Experimental, self-hosted software. No third-party security audit.
• Android APKs are signed when built with the project keystore.
• Next technical slices: v1.5.3 dual-port + DoH + library bump; v1.5.4 install.sh / attestations; v1.5.5 QUIC over IPv6.

Files

• masque-1.5.2.msi — Windows VPN client
• masque-phone-1.5.2.apk — Android phone
• masque-tv-1.5.2.apk — Android TV