WDTT server — xxcipher (XXcipherX) 2.0.0.70

swg-panel build of the xxcipher server (XXcipherX/proxy-turn-vk-android, assets/linux-server), upstream v2.0.0.70 @ a9c0ff7a. The upstream bump itself was clean — our patch applied unchanged and the flag surface matches v2.0.0.68.

Also fixes a crash-loop this fork hit on any non-default tunnel subnet. Our -wg-addr patch moved the address pool to the instances own subnet, but xxcipher carries a second, hardcoded validator that re-checks every stored device against 10.66.66.x when the database is read. The allocator wrote records the validator then refused to load, so the server died as soon as the first client had connected and been persisted — and it died on startup, after the peer existed, which reads as "the server broke by itself" rather than as a bad address. The validator now derives the pool from the same subnet the allocator uses, and rejects a record only when it genuinely falls outside it.

Static (CGO off), amd64 + arm64. Patch: forks/wdtt/xxcipherx/wdtt-xxcipherx.patch.

WDTT server — WDTT-Plus (Ivan4537) 15

swg-panel build of the WDTT-Plus server (Ivan4537/WDTT-Plus), upstream v15 @ 3038b8dd.

A routine upstream bump. Our patch applied with a single re-anchor — the wdttServerVersion context line (14 → 15) — and the flag surface is identical to v14, so behaviour under the panel is unchanged.

Static (CGO off), amd64 + arm64. Patch: forks/wdtt/wdttplus/wdtt-wdttplus.patch.

WDTT server — qWDTT (SpaceNeuroX) 1.4.3

swg-panel build of the qWDTT server (SpaceNeuroX/proxy-turn-vk-android, app/src/main/assets/linux-server), upstream v1.4.3 @ fae121ef.

Fixes a defect that made RAW unusable with -fixed-config. Upstream 1.4.3 added per-device binding to the RAW config handler, and -fixed-config deliberately keys a generated password to one keypair rather than to a device — so every RAW data worker was denied while the GETCONF worker, which does not take that branch, still registered. The session came up and carried DNS but delivered no downlink: the exact shape of "connected, no internet". The binding check now carries the same -fixed-config exemption the WireGuard path already had.

qWDTT is the fork with RAW-IP mode: a second listener (-listen-raw) carrying peer traffic without WireGuard, for roughly six times the throughput at the cost of forward secrecy. The app resolves that port from a single app-wide setting and ignores what the link says, so the panel fixes it at 56003, keeps it reserved on every node, and allows one RAW server per address.

Static (CGO off), amd64 + arm64. Patch: forks/qwdtt/qwdtt-swgpanel.patch.

WDTT server — ildarmaga 1.5.40-2

swg-panel build of the ildarmaga server (ildarmaga/wdtt), upstream @ ef697994 — the same upstream commit as wdtt-ildarmaga-1.5.40. The -2 suffix marks a rebuild of OUR patch, not an upstream bump.

Brings ildarmagas RAW-IP datapath under panel management. Upstream derives the RAW listener from the DTLS port + 3 and always binds it, with a process-global wdtt-raw TUN name and subnet, and opens its own firewall rule for it. Under the panel that meant a UDP port nothing allocated or reserved — an instance on DTLS 56000 silently held 56003, which the panel would then hand to another instance as its DTLS port — and one TUN name that two instances on a node would fight over.

This build adds -listen-raw, -raw-iface and -raw-addr, and makes the first of them a gate: no flag, no RAW listener at all, with WireGuard and DTLS untouched. Given without the other two it refuses rather than falling back to the stock name and subnet. -no-nat is honoured throughout, so the fork never opens firewall rules or touches sysctls — the node owns that.

Verified against a control binary built from the previous patch, with no -listen-raw in either run: the old build bound DTLS+3, this one binds nothing.

⚠️ Upstreams public source is frozen at a docs-only commit and every recent tag points at it, so this build tracks that snapshot rather than their released binaries — which contain features their source does not.

Static (CGO off), amd64 + arm64. Patch: forks/wdtt/ildarmaga/wdtt-ildarmaga.patch. GPL-3.0.

---

Assets replaced 2026-09-02 after first publication. The originally uploaded binary carried a RAW client-address allocator that ignored -raw-addr: it built addresses from a hardcoded 10.70.x.y (correct for upstream's /16, wrong for the per-instance /24 the panel assigns), so a client on a 10.70.1.1/24 TUN was handed 10.70.0.2 — off-subnet, unroutable, uplink only. Found by the first real client. The pool now walks hosts inside the configured subnet; server/rawpool_test.go covers it. Re-download if you fetched this tag before 06:43 UTC.

csqtt server — amurcanov 2.1.9

swg-panel build of the csqtt server (amurcanov/csqtt, rust-server), upstream v2.1.9 @ 446293aa.

Upstream shipped 2.1.5 → 2.1.9 as a single squashed release — 110 files, +14243/−3726 — skipping the 2.1.6 we had been waiting on. Five of the seven files our patch touches moved under it; 12 of 15 hunks still applied and three were re-ported by hand (dataplane.rs twice, where the file gained packet/, striped_scheduler and a shards field, and web_panel.rs, where the password cap moved 986 → 1145).

swg-panel flags this build adds, all optional — absent, it behaves like stock csqtt:

• --iface / --tun-addr — per-instance TUN name and /24, so one node runs many csqtt servers
• --desired — declarative password set; the panel owns it, csqtt owns runtime device/traffic state
• --max-passwords — runtime cap (upstream is a build-time constant of 20)
• --no-web — headless: no web admin panel (it binds 0.0.0.0), no self-signed cert, no DPI/syscalls monitor sockets
• --no-nat — accepted but inert since 2.1.5; the binary no longer touches NAT at all

Live-verified on a test node: device registration, SRTP sessions, GETCONF→TUNCONF and real traffic, with the web/DPI/syscalls ports confirmed unbound under --no-web.

Static musl (cargo-zigbuild), amd64 + arm64. Patch: forks/csqtt/csqtt-swgpanel.patch. csqtt is PolyForm-Noncommercial-1.0.0 — non-commercial use only.

WDTT server — XXcipherX 2.0.0.68

swg-panel build of the XXcipherX WDTT server (XXcipherX/proxy-turn-vk-android, app/src/main/assets/linux-server), upstream v2.0.0.68 @ 9a3a7b87.

Supersedes our 2.0.0.61 build. The patch was re-ported as a union merge: v2 added its own backoff constants and the legacy/relay flags alongside ours.

Static (CGO off), amd64 + arm64. Patch: forks/wdtt/xxcipherx/wdtt-xxcipherx.patch, recipe: forks/wdtt/xxcipherx/build.sh.

WDTT server — Ivan4537 14

swg-panel build of the WDTT-Plus server (Ivan4537/WDTT-Plus), upstream v14 @ 10c6939b.

Supersedes our v13 build. The patch was re-ported for v14, which added its own wgIface/Addr/CIDR constants — our duplicates were dropped rather than carried.

Static (CGO off), amd64 + arm64. Patch: forks/wdtt/wdttplus/wdtt-wdttplus.patch, recipe: forks/wdtt/wdttplus/build.sh.

WDTT server — qWDTT (SpaceNeuroX) 1.4.1

swg-panel build of the qWDTT server (SpaceNeuroX/proxy-turn-vk-android, app/src/main/assets/linux-server), upstream Release 1.4.1 @ 854a72fe.

First published build of this fork. It was mirror-only until now, which meant a fresh install had no way to obtain it — qWDTT simply did not work there.

qWDTT is the fork with RAW-IP mode: a second listener (-listen-raw) that carries peer traffic without WireGuard for roughly six times the throughput, at the cost of forward secrecy. The app resolves that port from a single app-wide setting and ignores what the link says, so the panel fixes it at 56003, keeps it reserved on every node, and allows one RAW server per address.

Static (CGO off), amd64 + arm64. Patch: forks/qwdtt/qwdtt-swgpanel.patch.

WDTT server — ildarmaga 1.5.40

swg-panel build of the ildarmaga WDTT server (ildarmaga/wdtt, server/./cmd), upstream v1.5.40 @ ef697994.

Supersedes our 1.4.63 build. Static (CGO off), amd64 + arm64. Patch: forks/wdtt/ildarmaga/wdtt-ildarmaga.patch, recipe: forks/wdtt/ildarmaga/build.sh.

csqtt server — amurcanov 2.0.1

swg-panel build of the csqtt server (amurcanov/csqtt, csqtt-uring), upstream v2.0.1 @ 31114cb7.

First published build. csqtt is amurcanov's rewrite of WDTT and its successor: a raw-IP tunnel with no WireGuard inside it, which makes it markedly faster over the same VK relay. A user's whole credential is a password the panel issues — there is no server keypair at all.

Its dataplane is io_uring with no fallback. On a Docker node that matters: the default seccomp profile denies io_uring_setup, so the server dies the instant it starts. Set SWG_NODE_SECCOMP=unconfined in the node's .env (the panel names this as the cause if you miss it). Bare metal needs nothing extra — the unit allows @io-uring explicitly.

Static musl (cargo-zigbuild, Rust 1.97.1), amd64 + arm64. Patch: forks/csqtt/csqtt-swgpanel.patch, recipe: forks/csqtt/build.sh.

Upstream is PolyForm-Noncommercial-1.0.0 — build and run for non-commercial use only.