Rocket Proxy 1.5 for macOS
Rocket Proxy 1.5 for macOS
This release fixes a DNS privacy leak. If you use WireGuard, AmneziaWG or OpenConnect, please update.
Fixed: DNS leak on WireGuard, AmneziaWG and OpenConnect
When connected over these three protocols, some DNS lookups were sent outside the tunnel, in plaintext, over your normal network connection. Anyone able to observe that connection — an ISP, a network operator, a hostile Wi-Fi — could see the names of the sites being looked up, even while the app reported "connected".
Your traffic itself was always encrypted and tunnelled. What escaped were the lookups, and only on these three of the twelve protocols.
Root cause. On Apple platforms, a network extension's own traffic bypasses its own tunnel by design. These three backends resolved certain hostnames inside the extension process, so those queries went straight out the physical interface. The other protocols use fake-IP mapping and resolve in-tunnel at connect time, which is why they were never affected. It was not a flaw in WireGuard, AmneziaWG or OpenConnect themselves.
Fix. Name resolution for these backends now goes through the tunnel's own network interface — the same path already used when establishing a connection — and falls back to fake-IP mapping rather than to any system resolver. Real IPs are required for WireGuard L3 passthrough (which routes by destination address), so simply suppressing resolution was not an option.
Also hardened. DNS query transaction IDs are now random per query. They had been a hardcoded constant, which makes off-path response spoofing considerably easier than it should be.
Validation
The full 36-combination protocol × transport matrix, exercised through real multi-tab browsing with a packet capture running on the physical interface:
36 / 36 PASS — 0 DNS leaks
macOS: now universal
The 1.4 DMG was Apple-silicon only. 1.5 is a universal build and runs natively on both Apple silicon and Intel Macs (macOS 13 or later).
Verify your download
shasum -a 256 RocketProxy-1.5.dmg
7a9cf47bbb0a27861184fadd1c83070d65f897155a923a4c3e713f5dd3ce3693
Signed with a Developer ID, notarized and stapled by Apple.
Installing
Open the DMG and drag Rocket Proxy onto Applications in Finder. Don't launch it from the disk image — macOS would run it from a temporary copy and the network extension won't install.
iOS, iPadOS and tvOS builds of 1.5 are distributed through the App Store; they cannot be installed from here.