unbraid 2.4.9

A route that can't connect now blocks only its own apps, with Headscale device names, more reliable timed pauses and many privacy and connection fixes. When a provider signs you out or a route can't connect, only the apps on the affected routes lose internet, and your other routes keep running. This release also keeps more of unbraid's own lookups inside the tunnels, and fixes problems with pauses, imports, sign-in and statistics.

New features

• Headscale device names. With your own Headscale server, you can now reach devices by name under its DNS domain. Turn on Device names under that domain in Settings, Tailscale, Advanced. Your server then answers every lookup under that domain. Changing Control server turns it off again.

Changes and enhancements

• Imports. An OpenVPN config that never checks the server's identity now shows the weak security warning, with Import anyway to continue.
• Sign-in. Back clears a provider's sign-in form also while the sign-in is still running. The sign-in finishes in the background, and a failure no longer leaves an error on a form you closed.
• Sign-in. Sign-in errors hide the passwords, tokens and keys that unbraid recognises in them.
• Stats. unbraid no longer saves the peak speeds seen in normal use, which it never showed, and deletes the ones earlier versions saved.
• Connection checks. When every checked provider tunnel fails, unbraid sends one request to Google over the phone's own network, to tell whether that network reaches the internet.
• Connection checks. Routes pinned to one server and NordVPN Dedicated IP routes are checked too. unbraid never moves them to another server.
• ExpressVPN. unbraid checks ExpressVPN server addresses before it prepares a connection.

Bug fixes

• Blocked routes. Signing out of a provider, or a provider refusing your login, no longer turns the whole VPN off. That provider's routes are blocked: their apps can't reach the internet, and they don't fall back to your normal connection. Other routes keep running, and local and home access still work. Sign in again or move the apps to another route.
• Blocked routes. A route without a usable connection blocks its apps and tries again after 5 seconds, then less often, up to every 5 minutes, and at once when the phone changes networks. A signed-out or refused login waits until you sign in again. Routes says which routes are blocked and why.
• Blocked routes. After a tunnel keeps failing, unbraid checks whether Mullvad removed this phone's device or IVPN ended its session. If so, that provider's routes are blocked and Routes asks you to sign in again.
• Pinned servers. A route pinned to one IVPN, Windscribe, ExpressVPN or NordVPN server connects again after the provider changes that server's address or key. unbraid looks the server up in the provider's current list each time it connects, and uses its last copy while the provider can't be reached. A server the provider no longer lists is reported on Routes, and its apps are blocked until you pick another.
• Network problems. When every checked provider tunnel fails and the check over the phone's own network fails too, unbraid keeps your current servers and checks less often until the network works again.
• Pause. A timed pause uses an exact alarm when Android allows it. Otherwise the notification says Paused until about the time, and Routes says resumes about it, because Android may wake unbraid later while the phone sleeps.
• Pause. Changing the phone's clock no longer changes how long a timed pause lasts. A late resume alarm no longer ends a newer pause, or reconnects after you disconnect.
• Pause. Resuming after another VPN app took over while unbraid was paused now ends the pause properly. The paused notification and the timed resume go away.
• VPN behaviour. Changing Always-on VPN or Block connections without VPN in Android's settings takes effect as soon as you come back to unbraid. Direct apps keep working, and the pause notice says correctly whether apps go offline.
• Connection. Connecting right after disconnecting keeps the connection and its notification in step. When Android ends the VPN service, unbraid closes its connection engine too.
• Connection. While a provider looks up a server for a route change, you can pause, disconnect or make another change without waiting.
• Connection. A failure to save recently used server details no longer stops a connection.
• Shared connections. Two routes with the same WireGuard key on the same server share one connection when their settings match, also when one comes from a provider sign-in and the other from an imported config. When the settings differ, or a route uses the same key and server as the home tunnel, its apps are blocked with an explanation.
• Shared connections. Two routes on the same imported OpenVPN config and login, or two ExpressVPN routes that share a connection, now connect.
• Incoming connections. unbraid refuses new connections opened toward your phone through its WireGuard, OpenVPN and Tailscale tunnels. Your apps' own connections and their replies work as before.
• Domain table. After a pause or reconnect, unbraid uses the next of eight address ranges for the stand-in addresses it gives apps, and refuses the others. An address an app kept from earlier is much less likely to reach a different site.
• DNS. When an imported OpenVPN server sends no DNS settings at all and no custom DNS is set, names are looked up through Quad9 inside that tunnel instead of failing.
• DNS. Connection checks look up their test servers through the DNS of the tunnel they check, not through the phone's own network.
• Route options. With a custom DNS server set, the blocking options of Mullvad, Private Internet Access and IVPN routes show Protection off and can't be changed, as Threat Protection Lite already did for NordVPN. Your choice comes back when you clear the custom DNS.
• Tailscale. Only names under ts.net with Tailscale's own server, or under the Headscale domain you allowed, are looked up through your tailnet.
• Tailscale. Apps on a Tailscale exit reach tailscale.com and tailscale.io directly only while a sign-in is waiting. Afterwards those sites follow the exit. With Headscale, only its own server is reached directly, and only then.
• Tailscale. unbraid refuses files sent to it through Taildrop, and deletes any it received before when it starts.
• Tailscale. A Headscale server whose name starts with a digit, such as 1hs.example.com, no longer stops Tailscale exit routes from starting.
• Tailscale. Old unencrypted Tailscale sign-in state is removed only after its encrypted copy is saved. If that fails, unbraid says so and tries again.
• Tailscale. When it's off and no exit-node route uses Tailscale, Reach your tailnet reads "From apps routed through unbraid", since apps you set to Direct skip unbraid unless Block connections without VPN is on.
• Speed test. After testing another Tailscale exit node, unbraid switches Tailscale back to the node your routes use, or to no exit node if it can't find that one. This also happens when the test is cancelled or fails. A test of the routed node waits for that switch.
• Speed test. If a route's provider, place or chosen server changes during a test, the result isn't saved and the test asks you to try again.
• Local & home access. A private home subnet written with a host address, such as 192.168.1.0/16, now reaches home through the tunnel instead of the local network, and malformed entries are ignored. The same applies to a home WireGuard config's ranges.
• Local & home access. Allow Nearby devices now says what the permission does for Tailscale: reaching devices on this network directly instead of through a slower relay. It also shows this when Tailscale only runs for an exit-node route.
• Surfshark. Server addresses now come from gluetun's public server list on GitHub, so connecting doesn't look up server names through your network's DNS. unbraid keeps a copy on the phone for when GitHub can't be reached. Keys still come from Surfshark.
• Surfshark. The server list in the picker shows each server once.
• Windscribe. A config from Windscribe's Config Generator is no longer mistaken for a Static IP config when it names the location's WireGuard server.
• Imports. A WireGuard config saved with a byte-order mark at the start imports normally.
• Imports. A WireGuard config whose AllowedIPs together cover every IPv4 address, such as 0.0.0.0/1 and 128.0.0.0/1, can be an app's exit. Invalid ranges are refused, and a config that leaves out private ranges says so.
• Imports. An OpenVPN config that checks the server's name or name prefix in a certificate field other than its common name (x509-username-field) is refused with an explanation.
• Sign-in. When a provider turns a sign-in down for too many attempts, has a server problem or sends an unexpected reply, unbraid says so instead of asking you to check your connection.
• Sign-in. A config file chosen with Choose file is no longer lost when the phone rotates while the picker is open or the file is loading.
• Settings. When settings or a sign-in can't be saved, a warning stays until they are, and tapping it saves again. Unsaved changes stay in effect until unbraid restarts.
• Settings. Signing out of a provider keeps the screen responsive while the change is saved. Signing out of everything, signing out of Tailscale and changing its control server delete the connection's files only after the VPN has stopped.
• Settings. When signing out of your last connection takes unbraid back to sign-in, copies kept of settings and account files that once failed to open are removed too.
• Apps. When you come back to unbraid, Apps shows apps installed meanwhile. Apps you uninstalled no longer keep their routes, so those connections can close.
• Stats. Old statistics are deleted when unbraid starts or you come back to it, also with Stats off, after the times the privacy policy names: hourly data after 8 days, daily data after about 13 months.
• Stats. Changing a route's provider, place or chosen server starts a new history for it, so earlier usage and speed tests keep the settings they were recorded with. Route usage from before this update shows its provider as Unknown (older data).
• Stats. Usage is credited to the right app after an app is uninstalled and another installed in its place while unbraid keeps running.
• Stats. The time chart and the This week figures now say connected, which is what they measure. The per-exit rows in App flows say "1 app" instead of "1 apps".
• Usage. The note under By provider now says that apps following a Direct default route are counted.
• Routes and widget. With Direct as the default and no app or home tunnel on a VPN, the header and the widget say connected instead of protected.
• Speed test notice. The M-Lab notice says that for your own servers and Tailscale nodes M-Lab picks a nearby server, and that the exit's country is sent with a test when it's known. The tour's Stats stop says statistics stay on this phone and that M-Lab publishes speed test results.
• Welcome. Rotating the phone keeps the VPN notice, the installed-apps notice or the leak protection steps open, and a connection waiting for the VPN notice continues after you agree.
• Widget. Android's widget picker describes the widget as showing whether you're protected, paused or off, with one button to connect, pause or resume.

Install

Download unbraid-2.4.9.apk below and open it on your phone. It requires Android 13 or later on a 64-bit ARM device. Install it over the GitHub version of 2.4.8 to keep your settings.

This build has no Google Play Billing or in-app tip jar. Like the Play version, it uses Google's open-source AndroidX libraries.

Android allows one active VPN app per user or profile. Before starting unbraid, turn off any other VPN app in that profile, including its Always-on VPN setting.

Check the download

Download both unbraid-2.4.9.apk and SHA256SUMS into the same folder. From that folder, run:

shasum -a 256 -c SHA256SUMS

The result should say unbraid-2.4.9.apk: OK.

The APK uses the same signing certificate as the GitHub version of 2.4.8. Its SHA-256 fingerprint is:

42:BA:8E:3D:52:1C:DE:47:B7:C3:E6:93:94:ED:97:73:91:0D:B3:C0:CD:DC:BA:28:9C:EA:5D:B4:39:09:F5:EB