1.14.0-alpha.48

📝 Release Notes

• Add SSO support for AnyConnect 1
• Add Linux support for the desktop client application 2
• Fixes and improvements

1:

The OpenConnect Client endpoint now supports SSO (single sign-on) authentication for Cisco AnyConnect servers, available through the sing-box graphical clients.

2:

The sing-box for Desktop client is now available for Linux (x64 / arm64 / armv7l) from GitHub Releases.

1.14.0-alpha.47

📝 Release Notes

• Add OpenVPN client and server support 1
• Add OpenConnect client support 2
• Fixes and improvements

1:

The new OpenVPN Client and OpenVPN Server endpoints are compatible with standard OpenVPN clients and servers. Interactive client authentication is available through the sing-box graphical clients and Dashboard.

2:

The new OpenConnect Client endpoint supports Cisco AnyConnect, GlobalProtect, Fortinet, F5, Pulse Connect Secure, and Juniper Network Connect VPN servers. Interactive authentication is available through the sing-box graphical clients and Dashboard.

1.14.0-alpha.46

📝 Release Notes

• Add multiple tags support to rule-sets 1
• Add new UDP NAT options 2
• Fixes and improvements

1:

The rule-set tag field now accepts a list of tags to define multiple rule-sets sharing other options at once, with the {tag} placeholder in path or url replaced by each tag.

2:

The new UDP NAT fields udp_mapping, udp_filtering and udp_nat_max configure the NAT mapping and filtering behaviors and the maximum number of UDP NAT sessions for TUN and TProxy inbounds and the WireGuard endpoint.

1.14.0-alpha.45

📝 Release Notes

• Improve the Windows client application 1
• Fixes and improvements

1:

The Windows client now includes an updater, adds support for Windows native sharing of sing-box profile and JSON files, and fixes the Tailscale SSH terminal. The Tailscale SSH server can now open sessions for any local user in the graphical client, while the command line client remains limited to the user sing-box runs as. Additionally, configurations that use privileges unrelated to networking are now rejected by default; an insecure mode is available to allow them.

1.14.0-alpha.44

📝 Release Notes

• Introducing our new Windows client application 1
• Fixes and improvements

1:

The new Windows client provides an experience equal to other standard sing-box graphical clients, is available for Windows 10+ (x64 / x86 / arm64), and is distributed as an installer from GitHub Releases (SFW-<version>-<architecture>.exe).

1.14.0-alpha.43

📝 Release Notes

• Add network namespace support 1
• Fixes and improvements

1:

The new network_namespaces option defines Linux network namespaces for inbounds and outbounds, referenced by tag from the new tun netns field and the existing Listen and Dial netns fields.

The unshare type creates the namespace at startup without requiring root privileges: a rootless sing-box can provide a tun (including auto_route and auto_redirect) inside a namespace, which can be entered with nsenter.

1.14.0-alpha.42

📝 Release Notes

• Fixes and improvements

1.14.0-alpha.41

📝 Release Notes

• Add windows bridge 1
• Add preferred_by support for bridge 2
• Add hysteria2 realm IP version restriction 3
• Add hysteria2 realm port mapping 4
• Fixes and improvements

1:

The bridge outbound is now supported on Windows, implemented via WinDivert and requiring Administrator privileges.

2:

The bridge outbound now works with the preferred_by route rule item. It is recommended to use preferred_by as a gate in the route rule: it only matches in pre-match and excludes local addresses that cannot be routed.

3:

The new realm.ip_version inbound and outbound field restricts realm connections (STUN, hole punching, and the resulting QUIC path) to a single IP version.

4:

The new realm.port_mapping inbound and outbound field maintains a UDP port mapping on the local gateway via UPnP or NAT-PMP, improving hole-punching reliability behind gateways that support it.

1.14.0-alpha.40

📝 Release Notes

• Add bridge outbound 1
• Fixes and improvements

1:

The new bridge outbound is the L3 counterpart of direct: it forwards L3 traffic (TCP, UDP and ICMP) from a TUN or other L3 endpoints directly out of a network interface, without going through L3 to L4 translation. It requires privileges and is supported on Linux, macOS, rooted Android, and jailbroken iOS.

See Bridge.

1.14.0-alpha.39

📝 Release Notes

• Add L3 forwarding support 1
• Fixes and improvements

1:

Building on the ICMP proxy support introduced in sing-box 1.13.0, TCP and UDP traffic from L3 inbounds (TUN, WireGuard, and Tailscale) can now be forwarded directly to WireGuard and Tailscale endpoints at L3, without going through L3 to L4 translation.

See Pre-match.