Repository navigation
0.9.11 (Kill switch, DNS overhaul and NaiveProxy)
Contributors in this release: @cergo666, @kjljxybr, @n0pashkov, @octopussy, @yandexru45 — thanks for the code, tests and reviews. The full list lives in the README, section "Участники".
• Kill switch (fail-closed, "Block Leaks When Tunnel Is Down"). While NetShift
is not intercepting traffic - a service restart, a sing-box crash and its
recovery - traffic bound for proxied destinations is blocked instead of
leaking straight to the internet, and DNS is not handed back to the direct
resolvers, so proxied domains wait too. Direct traffic is not touched while
sing-box is up. Off by default.
• DNS: the main server and the extras are one list now, the first entry being
the main one. Priority mode asks the next server when the previous one fails,
parallel mode asks all of them and the first usable answer wins. Any
transport the core knows: udp, tcp, dot, doh, doh3, doq.
• DNS: forwarding by zone. Queries for a zone (".ru") go to a chosen resolver
instead of through sing-box, and the entries live in the NetShift config, so
this works with the DNS redirect on - no more "Don't Touch My DHCP" for it.
• DNS: plain DNS of the LAN devices is sent to the router even when a device
asks another server (a hard-coded 8.8.8.8). Without it such devices never get
the FakeIP answers that routing by domain depends on. DoT/DoH are not
touched.
• DNS: the EDNS Client Subnet is detected from the WAN, including behind
carrier-grade NAT - the address the internet sees is looked up once and
cached.
• DNS: speed test. Every upstream is timed from the router, through the tunnel
when DNS goes through an outbound, so the choice is a measurement on your
provider instead of a table of "best" servers.
• IPv4 and IPv6 per section: a section can keep its IPv4 route (FakeIP) while
the AAAA queries of its domains get the real addresses, so its IPv6 goes out
directly.
• Ports: chosen ports can go directly (SSH, torrents, a game) or be the only
ones that go through the tunnel - both in the sing-box routing and in
nftables.
• QUIC has three modes instead of a flag: off, only the QUIC that goes through
the tunnel (the old flag, the app falls back to TCP), and all QUIC - every
UDP/443 packet from the network is refused.
• "Where will a request go": a diagnostic block and a command replay the
routing of the generated config for a domain or an IP and name the section,
the DNS server or the block that takes it.
• Domain lists: full:/keyword:/regex: prefixes, as in v2ray. A broken regex is
found and skipped with a warning instead of breaking the whole config.
• Subscription filters by protocol, transport and security, next to the name
and country filters.
• Published lists of feeds: "Add feeds from a list" takes a text or JSON list
and adds every feed it names. "Servers per feed" keeps the config small - a
collected list easily holds thousands of servers and the router has to test
them all.
• Per-feed subscription refresh on the dashboard, and "Refresh all
subscriptions". The traffic left and the expiry date the panel reports are
shown next to the feeds.
• A Mixed Proxy section can require a login (a user name and a password), and a
proxy whose port is already taken by another section or by NetShift itself is
skipped with a warning instead of making the core reject the whole config.
• NaiveProxy: links are understood, and the client itself is installed from
the Component Manager (check, install, remove) - for cores without the
native outbound.
• Reality: a link may ask for the post-quantum X25519MLKEM768 key share
(support-x25519mlkem768=true), which Xray-core 26.9.8+ servers require.
• XHTTP: the extra parameters of a link (padding, post sizes and intervals,
xmux) reach the core, plus x_padding_bytes.
• Features follow the installed core: a page no longer offers what the core
cannot carry, and the new get_core_capabilities command reports what it can.
• URLTest check interval: 10m, 20m, 30m, 1h, 6h, 24h and "only at start". A
longer interval means less traffic through every server of the group.
• Snapshots of the settings: one is taken on every successful start and on
demand, and the last ten can be brought back with one click after a change
that broke the service.
• "Leave a dead server chosen by hand": a server picked manually that stops
answering goes back to the automatic group after three failed probes instead
of leaving the section dead.
• "Update is available" on the dashboard when a newer NetShift or
sing-box-extended is out.
• Diagnostics: an "Environment" block - flow offloading, clock, IPv6 - the
things that quietly break the redirect.
• "Connections" tab: the live connection table of the core. The "Devices" tab
now shows the local network only, with search and static DHCP leases.
• Telegram subnets are built in: when the list cannot be downloaded (GitHub is
often blocked by the same provider that blocks Telegram) the ranges are still
routed.
• Ready-made ad-block lists (sing-geosite .srs) are suggested in the Remote
Domain Lists field.
• Dashboard in several columns, the tiles stacked on a phone, tiles that can be
turned off, and the same look on every tab.
• Copy a section, with a warning when the domains of a DNS section are already
routed by another section (such a domain never reaches the DNS section).
• Errors from the log are grouped instead of one banner per line.
• Fixed: "UDP over TCP" did nothing for socks and ss links from subscriptions
(it worked for a single link, a selector and an urltest).
• Fixed: dnsmasq was restored on stop even when NetShift did not own the config
yet, and a false "DNS restore" warning appeared.
• Fixed: unclosed CSS rules on the dashboard and in diagnostics broke the
layout of both pages.
• Fixed: the device and connection tables on a phone.
• Fixed: text-list links were numbered differently from the backend, and the
servers of "Selector/URLTest (text list)" sections were missing on the
dashboard.
• Fixed: IPv6 routing resolved the name before routing, so a v6 connection
could go out directly.
• Fixed: a self-update installed the downloaded packages without checking them
first.
• A published feed of collected links is parsed straight from the file and only
up to "Servers per feed": a hundred-megabyte list no longer eats the router's
memory, and a download left behind by a killed start is cleaned up.
Restart NetShift after updating (/etc/init.d/netshift restart).
The settings are kept. Check the DNS tab: the servers are one list now, and a
zone you used to forward through dnsmasq belongs in "DNS forwarding by zone".
