1.15.0-alpha.12

📝 Release Notes

• Fixes and improvements

1.15.0-alpha.11

📝 Release Notes

• Fixes and improvements

1.14.3

📝 Release Notes

• Fixes and improvements

1.15.0-alpha.10

📝 Release Notes

• Fixes and improvements

1.15.0-alpha.9

📝 Release Notes

• Update NaiveProxy to 154.0.8037.49-2
• Fixes and improvements

1.15.0-alpha.8

📝 Release Notes

• Add dns_server_address and dns_search_domain rule items 1
• Fixes and improvements

1:

Match the server addresses and search domains that DNS servers obtain from the system, DHCP or VPN.

See Route Rule and DNS Rule.

1.14.2

📝 Release Notes

• Fixes and improvements

1.15.0-alpha.7

📝 Release Notes

• Add MASQUE client and server support 1
• Add HTTP/2, HTTP/3 and UDP support for HTTP proxy 2
• Add full certificate pinning for TLS 3
• Fixes and improvements

1:

The new MASQUE Client and MASQUE Server endpoints provide IP proxying over HTTP (CONNECT-IP), supporting HTTP/1.1, HTTP/2 and HTTP/3, address assignment and route advertisement. They can use the internal network stack or a system TUN interface.

2:

The HTTP proxy implementation has been rewritten, adding HTTP/2, HTTP/3 and UDP proxying through CONNECT-UDP to HTTP inbounds and outbounds.

HTTP outbounds now use HTTP/2 by default with automatic fallback to HTTP/1.1. Configurations using path or the Host header continue to use HTTP/1.1. HTTP/3 can be enabled through the version option.

The term "MASQUE VPN" usually refers to CONNECT-IP, rather than a combination of CONNECT and CONNECT-UDP, which is an enhancement to HTTP proxying. CONNECT-UDP and CONNECT-IP are collectively known as MASQUE in the IETF; the traditional CONNECT method for TCP proxying is not itself a MASQUE protocol.

See HTTP Inbound and HTTP Outbound.

3:

The new certificate_sha256 and client_certificate_sha256 TLS options pin the SHA-256 hash of the whole certificate, complementing the existing public key pinning options.

See TLS.

1.15.0-alpha.6

📝 Release Notes

• Fixes and improvements

1.15.0-alpha.5

📝 Release Notes

• Add Tailcat support 1
• Fixes and improvements

1:

Tailcat is Tailscale's data plane without its control plane: point-to-point WireGuard tunnels bootstrapped through DERP, with NAT traversal.

See Tailcat Inbound and Tailcat Outbound.

The DERP service can verify Tailcat clients with the new verify_client_inbound and verify_client_key options, see DERP Service.