Time for merging rebranded multi-core release from beta. Major rework of
ImmortalWrt
HomeProxy: a switchable proxy core, two built-in DPI-bypass engines,
one-click
regional routing presets, and a full diagnostics suite — all from LuCI.
Cores & install
- Rebrand to Re:HomeProxy; package renamed to luci-app-re-homeproxy
(Replaces the
old lineages). Apk (25.12+), opkg (24.10) and 23.05 legacy builds.
- Multi-core: choice of hiddify-core or sing-box-extended via the Core &
Tools tab,
which auto-picks a build that fits flash (incl. a compact UPX build) and
honors
the preferred core consistently across init.d / generate_client.
DPI bypass (no VPN needed)
- ByeDPI (ciadpi): SOCKS-level desync, 47 strategy presets, multi-site
strategy
tester, per-list node binding, secure-DNS handling, one-click installer.
- Zapret 2 (nfqws2): packet-level NFQUEUE desync as a marked
direct-outbound
(TCP + UDP/QUIC, incl. Discord voice), presets, scoped tester,
installer.
Routing & DNS
- Routing modes: Russia (proxy_banned_ru), China (bypass_cn), Iran
(bypass_ir) and
Global, with one-click RU Proxy Rules (Re:filter, Russia Inside, service
lists).
- Region rule-sets via sing-box .srs (geosite/geoip) — dropped the
bundled
china/gfw lists from the tree (~130k lines).
- Region + secure DNS (DoH/DoT) presets per mode; DNS status
diagnostics.
Subscriptions, protocols & transport
- Subscription/import: sing-box JSON (Hiddify), base64/plain
share-links,
Xray/V2Ray JSON, a shared URI parser and a headless WireGuard/AmneziaWG
importer.
- XHTTP transport, AmneziaWG/WARP, TLS fragmentation, correct
per-transport host JSON typing, unit-preserving durations.
Resilience & diagnostics
- Survives a blocked/throttled GitHub: release-mirror fallback and a fix
for the
signing-key fetch hang; dropped apk --no-cache; connectivity preflight
checks.
- Auto rpcd restart after update (fixes functions missing until reboot).
- Diagnostics: UDP TPROXY checks, active-node latency coloring, and a
full report
with passwords/keys/subscriptions redacted automatically.
Docs & i18n
- Complete wiki (Getting Started, ByeDPI, Zapret, Core Management,
Routing & Access
Control, Custom Routing, Server Settings, Supported Protocols,
Subscriptions,
DNS & Diagnostics, Custom JSON, Troubleshooting) and README updates.
- Russian/Farsi/Chinese translations.
Add a single-file interactive installer for Re:HomeProxy on OpenWrt. The script detects architecture and package manager (apk/opkg), checks OpenWrt version, supports GH_MIRROR fallback, and installs the LuCI app (with optional signature key and Russian locale). It prepares and installs proxy cores (hiddify or sing-box), optional Zapret and ByeDPI (with kmod handling), applies a Russia routing preset, enables/starts the service, and prints the LuCI URL. Uses ucode/ubus rpcd backend for backend package preparation and downloads.
Adds install.sh, a one-liner automated installer that handles LuCI app, proxy core, and optional ByeDPI/Zapret components. Supports APK (25.12+), opkg (24.10), and 23.05 legacy with architecture auto-detection. Includes GitHub mirror support for regions with connectivity issues. Updates both English and Russian READMEs with quick install instructions and manual SSH setup guides.
## dev → beta (8 commits)
### Features
- **Routing modes: `bypass_cn` and `bypass_ir`** — reverse selective
routing
(default through proxy, region's own domains/IPs direct via
geosite/geoip).
Touches generate_client.uc and firewall_post.ut.
- **DNS status & host-resolution diagnostics** — new DNS info on the
status /
diagnostics pages, fully translated (RU/FA/ZH + pot).
### Reliability / fixes
- **Blocked-GitHub hardening** — GitHub release **mirror fallback** plus
a fix
for the **signing-key fetch hanging** when GitHub is throttled/blocked,
so an
install no longer stalls.
- **Auto rpcd restart after update** — fixes "missing functions" right
after an
update (rpcd objects weren't re-registering).
- **Zapret** — zapret2 LuCI installer fix, strategy-test fix, and zapret
test
reworked (zapret_test.sh, new zapret_resolve.sh).
- **Standardize Yandex links to `ya.ru`.**
### Maintenance
- Dropped the large **bundled geodata lists** (china_ip4/6, china_list,
gfw_list — ~130k lines) from the tree.
- Translation catalogs refreshed: po/ru, po/fa_IR, po/zh_Hans,
templates/*.pot.
- Supporting backend updates: luci.homeproxy (rpcd), core_mgmt.uc,
init.d/homeproxy, update_crond.sh, client.js / node.js / status.js /
diagnostics.js.
Add translations for two new message strings in homeproxy/node.js:
- DNS not ready message (line 2725)
- Test host resolution message (line 2907)
Updated translations across Farsi, Russian, Chinese (Simplified), and template files.
Introduce gh_fetch() in both core_mgmt.uc and luci.homeproxy: tries
GitHub first, falls back to the mirror configured in
homeproxy.config.github_mirror only if GitHub fails — so a healthy
GitHub is never bypassed.
For APK signing key fetches (hiddify and zapret2), skip the download
entirely if the key is already present (pre-placed by a provisioning
tool or a prior install), use a short 20s timeout so a throttled
GitHub cannot hang the ubus call until timeout (exit 249), and fall
back to --allow-untrusted if the key fetch still fails rather than
blocking installation.
Update Yandex URLs in root/usr/share/rpcd/ucode/luci.homeproxy: replace https://www.yandex.ru with https://ya.ru in the switch-case mapping and in the conn_sites array to keep Yandex links consistent.
Add 'replaces' metadata to the APK packaging step and remove the old 'Provides' entries from the ipk CONTROL file. Includes a comment explaining why: opkg treats Provided names as satisfying dependencies (which can prevent Conflicts from firing and allow old+new to coexist), so keeping Conflicts+Replaces (and omitting Provides) ensures opkg will cleanly replace the old packages. The APK path still uses the Alpine rename idiom (provides+replaces) via the mkpkg call.
Rename references to Re:HomeProxy and the LuCI tab to "Core & Tools" / "Ядро и службы", update log/location links accordingly. Adjust recommended free space and core footprints (recommend ~40 MB free; sing-box-extended ~26 MB installed; compact hiddify-core ranges updated). Update ByeDPI docs to list 47 presets and switch recommended adaptive presets to I1/I2 (formerly numeric 31/32). Add Custom Routing and Server Settings wiki pages and a Resources & updates section for Core & Tools. Misc: polish cross‑links and wording in English and Russian docs to match these UI and behavior changes.
Expose UDP TPROXY nft chain counters to diagnostics and show them in the UI; rpcd ucode now collects lines from homeproxy UDP-related nft chains and returns them as udp_tproxy, and diagnostics.js renders that output. Update Zapret help text to note QUIC support (shorten previous comparison to ByeDPI) and update the Russian translation accordingly. Fix zapret preset picker in node.js by keeping a reference to the select element so applyPreset updates the UI selection when a preset is applied.
Introduce support for Zapret (nfqws2) across UI, RPC and core generation: add Zapret entries to client selector UI and AntiDPI status card, implement install/remove/status RPC hooks in the status view, and show kmod warnings. Diagnostics now resolve aggregate tags to configured nodes and can query a focused tag (used to show the active UDP node). generate_client.uc now treats Zapret like ByeDPI for secure-DNS detours and handles Zapret as a synthetic direct outbound with routing marks for main and UDP nodes. core_mgmt.uc avoids auto-selecting UPX-compressed builds on certain MIPS targets (UPX causes crashes) and produces clearer errors when space is constrained. Updated Russian translations for new strings.
Replace references to bol-van/zapret with bol-van/zapret2 in the UI and translations. Updates htdocs/luci-static/resources/view/homeproxy/node.js and po/ru/homeproxy.po so the frontend text and Russian translation point to the new zapret2 repository.
Integrate Zapret (nfqws2) packet-level DPI-bypass: add UI options and warnings, diagnostics, backend detection, and documentation. Changes include frontend guards when NFQUEUE kernel module (kmod-nft-queue) is missing, diagnostics card entries and NFQUEUE counter listing, translated strings, and strategy attribution. The rpcd backend now detects zapret installation/running state, exposes zapret queue contents and a kmod_ok check, and includes Zapret info in the text report. README and wiki pages updated (docs, getting-started, DNS & Diagnostics) and Russian translations adjusted.
Introduce Zapret (nfqws2) integration across UI, init, firewall and RPC. Adds UI controls to enable/install Zapret, a strategy preset picker, strategy tester, and a Discord-voice opt-in; plumbing in client.js and node.js to install/manage and test strategies. Add zapret_test.sh to run isolated strategy tests against several sites. Enable runtime nfqws2 instance via init script (procd) and ensure HomeProxy runs its own nfqws2 with admin-specified strategy. Update nft rules and firewall_post.ut to mark and queue zapret flows (including both TCP and UDP/QUIC handling) and to respect zapret marks; generate_client.uc emits zapret outbound, optional voice-port routing, adds sniff action for QUIC routing, and tweaks default uTLS fingerprint to 'edge'. Add RPC handlers (zapret_status, zapret_prepare_install, zapret_install_pkg, zapret_remove, zapret_strategy_test) to support detection, installation and testing from the web UI. Minor: register 'zapret-out' as a routing option and wire it into rule generation.
Ensure uTLS blocks are emitted for reality and default the fingerprint to 'chrome' when a node doesn't provide one. Changes add logic in xhttp_download and generate_outbound so uTLS is enabled if the node supplies a fingerprint or if reality is active (sec === 'reality' / tls_reality === '1'), preventing sing-box reality clients from crash-looping by always supplying a uTLS fingerprint when required. Comments explaining the rationale were also added.
core_mgmt.uc: drop --no-cache from apk add invocations (regular installs and --allow-untrusted) to avoid forcing an index refetch over the network. Add a comment explaining that --no-cache can be slow on poor uplinks and that kmod packages are resolved from the local index. Also remove --no-cache from the kmods install and increase the apk kmods timeout from 60s to 120s.
Add parsing support for Xray/V2Ray JSON subscription formats by introducing parse_xray_outbound and parse_xray_config. The new parser converts an Xray outbound (vless, vmess, trojan, shadowsocks, socks, http, hysteria) and its streamSettings into HomeProxy node configs, mapping TLS/Reality settings, transports (ws, grpc, h2/http, httpupgrade, xhttp), and protocol-specific fields. Special handling for hysteria (v1/v2) is included and skipped when sing-box lacks QUIC. The main subscription logic is updated to detect and decode arrays of full Xray configs (common from some providers) and fall back to existing JSON or base64 decoding; existing Shadowsocks SIP008 detection is preserved.
Apply a consistent 4-colour scheme for active-node latency across views and remove duplicate code in the status view. Client and diagnostics now treat the 65535 sentinel as a confirmed timeout (red/"timeout"), >=3000 ms as slow (orange/diag-warn), <3000 ms as good (green/diag-ok) and no/zero delay as unmeasured (gray/diag-gray). The client view sets inline colors; diagnostics uses diag-* classes. Also remove the redundant getActiveNode implementation from status.js to avoid duplication.
Add a note to the URLTest help text suggesting removal of nodes that remain orange/grey for a long time. Revise status display logic to color nodes based on the core-reported delay: 65535 = red (timeout), >=3000 ms = orange, <3000 ms = green, and no/0 delay = gray (unconfirmed); show a 'timeout' label instead of raw 65535. Update Russian translations for the modified help text and add a translation for the new 'timeout' string.
Add two new ucode scripts: import_link.uc (a headless importer for proxy share-links) and node_parse.uc (a shared parse_uri implementation). import_link.uc reads a link or a file of links, uses the shared parse_uri to convert each share-link into a homeproxy UCI node section, names sections with a stable FNV-1a hash, commits imported nodes (no grouphash) and emits JSON results. node_parse.uc implements comprehensive parsing for many URI schemes (vless, vmess, trojan, ss, hysteria, tuic, ssh, wireguard, naive, http(s), socks, etc.), performs validation, and surfaces sing-box feature checks for QUIC/UTLS support. This centralizes link parsing to avoid duplicate implementations and keeps the subscription importer and CLI/agent import in sync.
Update Russian translations for UI strings and improve diagnostics/reporting logic.
- po/ru/homeproxy.po: adjust Russian translations ("Direct IP", TLS phrasing, "passed").
- root/usr/share/rpcd/ucode/luci.homeproxy: harden UCI sanitization to handle multi-line option values (e.g. PEM keys) by redacting the option value and skipping subsequent continuation lines to avoid leaking secret bodies. Add a Connectivity section to generated diagnostics that probes several sites (Baidu, Google, YouTube, Yandex, Speedtest) using wget and records OK/FAIL for each site. Exit-IP rows are intentionally omitted.
Refine Russian translations in po/ru/homeproxy.po: change "Routing Nodes" translation from "Узлы маршрутизации" to "Правила узлов", change "Routing Rules" from "Правила маршрутизации" to "Расширенные правила", and update the combined UI hint to use the new terms.
Several small but important updates:
- UI (htdocs/luci-static/resources/view/homeproxy/client.js): add Cloudflare (1.1.1.1) and Google (8.8.8.8) DNS presets; restrict the "Same as main node" (main-out) option to non-custom routing modes and only when a main_node exists; always expose ByeDPI outbound when enabled; rename "Proxy filter mode" to "Proxy mode for devices" and add explanatory hints for gaming/global proxy IP options.
- Node UI (htdocs/luci-static/resources/view/homeproxy/node.js): fix closure variable (i -> k) to avoid iteration bug and shorten the probe hint text.
- Generator (root/etc/homeproxy/scripts/generate_client.uc): add xhttp_padding() to coerce disabled xhttp padding values ('0', '0-0' or empty) to the safe default '100-1000' and apply it when emitting sing-box/hiddify xhttp fields to prevent fatal core errors.
- Init script (root/etc/init.d/homeproxy): restore subscription auto-update cron entry on start when enabled (adds daily run at configured hour and restarts cron), reintroducing behavior lost during a prior init rewrite.
- Translations (po/ru/homeproxy.po): add and update Russian translations for the new/changed UI strings.
These changes prevent runtime failures for certain provider configs, restore missing auto-update behavior, improve UI clarity, and fix a node probing bug.
Introduce XHTTP packet-up controls and split-download support across UI, parsers and generators.
- htdocs/luci-static/resources/view/homeproxy/node.js: parse additional xhttp fields from links (scMaxEachPostBytes / sc_min_each_post_bytes and scMinPostsIntervalMs / sc_min_posts_interval_ms), add UI inputs for padding, packet-up limits and detailed split-download settings (host/path/server/port/SNI/ALPN/insecure).
- po/ru/homeproxy.po: add Russian translations for all new UI labels and help texts.
- root/etc/homeproxy/scripts/generate_client.uc: add xhttp_download() helper to build a per-core download transport, emit both camelCase (hiddify) and snake_case (sing-box) xhttp options, and attach the download section under the appropriate core-specific key.
- root/etc/homeproxy/scripts/update_subscriptions.uc: accept both dialects when parsing xhttp options (camelCase and snake_case) and handle both downloadSettings (hiddify) and download (sing-box), normalizing host/server/port and TLS/alpn/utls fields.
These changes ensure compatibility with both hiddify-core and sing-box dialects and expose finer-grained xhttp controls in the UI.
sing-box's HTTP/2 (`http`) transport takes a host ARRAY, while xhttp and
httpupgrade take a single string. The UI's DynamicList (and some share-link
parsers) store http_host as a UCI list, which emitted a JSON array and crashed
hiddify-core on xhttp nodes ("json: cannot unmarshal array into Go value of type
string", #3).
Add a transport_host() helper that coerces the host to the correct shape per
transport at both generate sites. This fixes every input path (UI edit,
share-link, subscription), auto-repairs already-broken `list http_host` configs
on the next regeneration, and preserves HTTP/2 multi-host — without any UI or
migration changes.
Fixes#3
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ransport
sing-box's HTTP/2 (`http`) transport takes a host ARRAY, while xhttp and
httpupgrade take a single string. The UI's DynamicList (and some
share-link parsers) store http_host as a UCI list, which emitted a JSON
array and crashed hiddify-core on xhttp nodes ("json: cannot unmarshal
array into Go value of type string", #3).
Add a transport_host() helper that coerces the host to the correct shape
per transport at both generate sites. This fixes every input path (UI
edit, share-link, subscription), auto-repairs already-broken `list
http_host` configs on the next regeneration, and preserves HTTP/2
multi-host — without any UI or migration changes.
Fixes#3
sing-box's HTTP/2 (`http`) transport takes a host ARRAY, while xhttp and
httpupgrade take a single string. The UI's DynamicList (and some share-link
parsers) store http_host as a UCI list, which emitted a JSON array and crashed
hiddify-core on xhttp nodes ("json: cannot unmarshal array into Go value of type
string", #3).
Add a transport_host() helper that coerces the host to the correct shape per
transport at both generate sites. This fixes every input path (UI edit,
share-link, subscription), auto-repairs already-broken `list http_host` configs
on the next regeneration, and preserves HTTP/2 multi-host — without any UI or
migration changes.
Fixes#3
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Introduce a Connectivity diagnostics section (connection checks, exit IP / active node info) with new RPCs and live polling; move connection-check UI out of status into diagnostics and add translations. Add active URLTest node display and several routing/DNS UI tweaks for 'proxy_banned_ru' mode (russia-dns, secure-dns, main-out, byedpi-out). Rework ByeDPI presets: group presets by letter, add community presets, improve "Test all" flow with ordered execution, a Stop button, clearer progress/messages and updated translations. Fix template/comment text (replace crude QUIC comment), and harden client config generation by recognizing built-in DNS tags and skipping empty/dangling routing node outbounds to avoid crashes. Minor README_ru wording update and assorted i18n strings added.
Return null for empty inputs, coerce the input to a string, and only append 's' when the value doesn't already end with a letter (e.g. preserve "10s" or "1m30s"). This prevents emitting malformed values like "10ss" and documents the intent with a comment.
Add root/usr/share/homeproxy/scripts/import_conf.uc: a ucode script to import a WireGuard/AmneziaWG .conf into the homeproxy UCI 'node' section from the CLI/SSH. Parses Interface/Peer blocks (including AWG-specific fields), maps keys (private/public/preshared, endpoint host:port with IPv6-safe parsing, addresses, MTU, etc.) to a node object, and writes it idempotently to the 'homeproxy' config using a stable FNV-1a hash-derived section name. Emits a single JSON line with result or error and is intentionally dependency-free (avoids digest/md5 for OpenWrt compatibility). Usage: ucode import_conf.uc <path-to-.conf> [label].
Several related fixes and improvements:
- htdocs/luci-static/.../client.js: Reworded the Russia Inside/Re-filter description to clarify contents and routing behavior shown in the UI.
- root/etc/homeproxy/scripts/generate_client.uc: Tightened UDP-over-TCP generation so it is only emitted for hiddify when node.udp_over_tcp is enabled; treat an empty cfg.node as equivalent to 'main-out' when selecting effective_outbound and avoid creating redundant outbounds. These changes make outbound selection more robust and prevent unnecessary outbound creation.
- root/usr/share/homeproxy/scripts/core_mgmt.uc: Made download_pkg tolerant of an optional leading core argument (accepts both (url, tmp_path) and (core, url, tmp_path)); improved install_kmods by defaulting to a detected package manager and returning a proper success/failure result with an error message when kmod installation fails. This improves compatibility with different callers and surfaces installation errors.
Rename project and packages to Re:HomeProxy (luci-app-re-homeproxy), update package metadata and build scripts, and adjust UI labels and menus accordingly. Improve core install flow: add RAM detection, overlay-compression heuristics, automatic selection between full and compact (UPX) builds, stricter storage/RAM checks, and a variant argument for prepare_install; fetch sing-box-extended releases more robustly. Fix runtime behavior: init.d restores a default config when missing, add packaged homeproxy.default, prefer user-preferred core in ucode, and suppress top-level TLS for Shadowsocks in generated client configs. UI tweaks include better install/remove UX, gating "Same as main node" for custom routing, and updated diagnostics/status strings. Update translations (po files) and rpcd/menu/acl renames to match the rebrand.
Improve the ByeDPI strategy tester UI and backend and adjust routing logic for special nodes.
- UI (htdocs/luci-static/.../node.js): probe 4 sites (YouTube, Telegram, Discord, Speedtest) to reveal destination-sensitive strategies, display per-site pass/fail dots and aggregate full/partial results, update 'Test all' flow and messages, and require curl for full testing.
- RPC (root/usr/share/rpcd/ucode/luci.homeproxy): byedpi_strategy_test now starts one ciadpi instance and runs parallel curl probes, returns detailed per-host results and reasons (dns/tls/timeout/etc.), preserves/restores nft redirect rules and ByeDPI skgid, and handles cases without curl by returning a startup-only result.
- Generator (root/etc/homeproxy/scripts/generate_client.uc): route secure-dns via direct-out when main node is byedpi-out, and force ruleset downloads via direct-out when main path uses WireGuard/AmneziaWG or is byedpi-out; add clarifying comments about why these exceptions are required.
