Release history
15 releases of NetProxy.
New 🎉
- Ready-made plugins, in every package.
- Plugins can answer the client themselves.
- Select proxies on the Plugins list (right-click): tick the proxies that use a plugin in one dialog.
Changed 😎
- The proxy list now carries which plugins each proxy uses, and there is a new management request for Select proxies.
Fixed 🐛
- No fixes to 3.1.0 behavior in this release.
🚨 🚨 THIS VERSION IS NOT BACKWARD COMPATIBLE WITH PREVIOUS VERSION CONFIGURATION. You will need to delete your configuration in C:\ProgramData\NetProxy. I'm sorry about this, but the introduction of UPD caused inevitable tech-dept cleanup.
New 🎉
- Configuration import and export.
- Proxy statistics are now persisted so that they grow until cleared.
Changed 😎
- Certificates are now centrally configured. This makes it easier to assign the certificate to multiple sites and to support renewal.
Fixed 🐛
- NADA! 🥳
🚨 🚨 THIS VERSION IS NOT BACKWARD COMPATIBLE WITH PREVIOUS VERSION CONFIGURATION. You will need to delete your configuration in C:\ProgramData\NetProxy. I'm sorry about this, but the introduction of UPD caused inevitable tech-dept cleanup.
New 🎉
- Port sharing by host name: several HTTP or HTTPS proxies can listen on one port, each answering to its own exact or wildcard host names. Each host name can have its own certificate (SNI), and one proxy without host names can be the default.
- Plugin API: .NET plugins with service, proxy, connection and data events. The data events see decrypted HTTPS traffic before it is re-encrypted. Plugins are configured on the service, ordered, and opted into per proxy, with a Plugins window in the console.
- Management API and netproxyctl: a client library and a cross-platform command line tool. It applies proxies by name (kubectl style) and supports a dry run, export/import, reload, logs, stats, connections and user management, with a per-user credentials file.
- Reload from files: edit the configuration files by hand, then reload applies only what changed.
- UDP proxying: UDP is a new traffic type, with a session per client and an idle timeout.
- X-Forwarded-For and X-Forwarded-Proto: optional per proxy (off, replace or append).
- Certificate reload: renewed PFX files are picked up without a restart.
- Connection limits and timeouts: per proxy and per client, with an idle timeout.
- Console: a Proxy menu (add, refresh, start, stop, edit, delete), a sortable connections grid that matches the proxies grid, and sortable columns on both grids.
- Remote file browser: pick certificates, plugin assemblies and the log folder on the service machine from a console on another machine.
- Documentation: a new guide (NetProxy-Guide.md), win-acme wildcard certificate instructions, and a test suite of about 460 tests.
Changed 😎
- Traffic type renamed: Raw is now TCP. There is no migration of old files.
- New endpoints are enabled by default.
- Enums in configuration files: they are stored as names, not numbers.
- Console forms: all of them are now built in the designer.
Fixed 🐛
- Several host routing bugs.
- Save dialog no longer closes when its save is refused, so a rejected save (for example a duplicate proxy name) keeps what you typed.
- Proxy list updates no longer reset the selection.
Full Changelog: https://github.com/NTDLS/NetProxy/compare/2.5.0...2.5.1
New 🎉
- Endpoint connections list.
Changed 😎
- Main window: the connection list sits under the proxy list. Selecting no proxy (Esc, or Ctrl-click) leaves it empty.
- Connection tracking: each connection now records its own byte counts, listening address and port, endpoint address and port, and negotiated TLS version.
Fixed 🐛
- n/a
Full Changelog: https://github.com/NTDLS/NetProxy/compare/2.4.1...2.5.0
New 🎉
- Encrypted management connection. The console and the service now agree on a key (NTDLS.SecureKeyExchange) when they connect, and everything after that, including the login and every setting, is encrypted with NTDLS.Permafrost. The service refuses a login over a connection that is not encrypted.
- TLS for the listener. Choose the HTTPS traffic type and give the proxy a PFX certificate; header rules then apply to HTTPS too. The certificate password is stored encrypted.
- TLS to endpoints. Each endpoint has its own traffic type (Raw, HTTP or HTTPS, starting as the listener’s) and a Validate Certificate option.
- HTTP/2 and gRPC with header rules. Tick Allow HTTP/2. It is negotiated on HTTPS listeners, and plain HTTP/2 (h2c) clients are detected on HTTP listeners. HTTP/1.1 clients keep working.
- Connection limits and idle timeouts. Each proxy can limit its total connections and the connections per client address, and close connections that carry no data. The default of 0 means no limit.
- IPv6. Listen on IPv4, IPv6 or both, bind to IPv6 addresses, and use IPv6 addresses or host names as endpoints. The management port can listen on IPv6 too.
- Localization. The console is translated, with Settings > Language... and a Language button on the connect window.
- Dark mode. The console follows the Windows light/dark setting.
- A new home-page chart. It shows sent, received and connections over time, for all proxies or the selected one, plus a status bar with totals.
- Logging. The service has a rolling log file with a size limit and retained count, writes warnings and exceptions to the Windows event log, and logs to the console when run by hand. All of it is configured in Server Settings.
- Linux builds. The service is published self-contained for x64 and arm64 as zips, with a systemd install guide.
- Tool tips on every input and grid column, and a new application icon.
Changes 😎
- The HTTP/1.x header handling was rewritten as a streaming parser, and HTTP header rules now also apply to PATCH and TRACE.
- User and certificate passwords in the configuration files are encrypted with a key kept beside them (secret.key). Older plain-text files are converted on first load.
- Load balancing was reworked. Balanced picks the endpoint with the fewest connections, fail-over and round-robin skip endpoints that are down, and an endpoint that fails is tried last for a short while.
- The accept backlog setting is now applied (values below 128 are raised to 128), and buffer sizes are validated.
- The console connects once, encrypted, and ChangeConnection() receives that live connection. The connect window no longer connects twice.
- The console and the service must now be the same version.
Fixes 🐛
- Fixed several connection-handling bugs in the proxy engine, including a balancer that could retry a dead endpoint forever, a listener that stopped accepting after a failed accept, and connections that were not always released.
- A client that finishes its request now still receives the whole response (half-close is passed on).
- Sticky sessions now expire correctly and fall back to another endpoint when theirs is down.
- Passwords are compared in constant time, and failed logins are slowed down.
- A proxy that cannot start (for example, its port is in use) now tells the console why.
- Deselecting a proxy in the list (Escape, a click on empty space or Ctrl+click) returns the chart to all proxies.
- Updated all packages, spelling corrections.
- Fixed UI hang on close.
- Null handling enhancements.
- Moved null and Winforms helpers to nuget.
- Better UI validation.
- Update to .net8
- Moved messages to convention based.
- Reworked authentication.
- Split out PumpBuffer and separated HTTP header parser.
Full Changelog: https://github.com/NTDLS/NetProxy/compare/2.0.0...2.1.0
Major release:
- A nearly complete application rewrite.
- Completely rewrite of TCP/IP stream framer, IPC messaging, peer connection handler, peer->peer data pump, socket server and client.
- .net update to 7.0
- Moved concurrency, stream framing, and ipc messaging to nuget packages.
- Lots of bug fixes.
- Major performance fixes.
Full Changelog: https://github.com/NTDLS/NetProxy/compare/1.0.0...2.0.0