Hey everyone!
It's been a while since the 2.16 post, and here's what's new.
🔀 Multi-Tunnel
Run several configurations in one VPN session and choose which destinations each one carries. For example, one config can carry all traffic through your VPS while another carries 192.168.0.0/16 back to your home or office network, and both run together.
Only one tunnel reaches the system. Xlarva sends each packet to the right member by longest-prefix match. Data Usage counts each member’s traffic separately, so usage belongs to the server that actually carried it. You can also open a member's own configuration straight from the Multi-Tunnel editor.
✂️ Traffic Splitting, Continued
- Domain list catalog: import curated domain lists from a built-in catalog. You can pick several at once, and each list gets its own proxy or direct action.
- Follow your routes: hosts that match no rule can now fall back to your route settings instead of always going through the tunnel or always going direct. New and imported configurations use this by default.
- Search the domain rules list.
-
The Mac builds a large rules list much faster.
🧬 AmneziaWG 3.x Header Protection
AmneziaWG 3.0 added HeaderProtectionKey, and it's the one 3.x parameter both peers must agree on. If one side has the key and the other doesn’t, the tunnel never completes a handshake and nothing shows an error. Xlarva now supports it, so it can connect to 3.x servers that turn it on.
🛠 Self-Hosted Servers
-
Link a server Xlarva didn't deploy: Add Client now works on a WireGuard server you set up yourself. The endpoint, DNS and AllowedIPs are taken from one of that server's existing configs, so a new client behaves like the ones you already have.
-
Servers with several WireGuard interfaces are supported. The right interface is chosen by matching the server's public key.
-
A server's linked configurations can now be edited after the server is set up.
🔌 Connection Reliability
-
Peers now dial an address your current network can route. They reconnect when a switch between Wi-Fi and cellular leaves them stranded.
-
Tapping the power button stops a tunnel that's stuck reconnecting. A reconnect no longer hangs on a DNS lookup that never returns.
-
Starting a tunnel with no network now waits for one instead of failing right away.
-
DNS over HTTPS/TLS returns as soon as the first answer arrives.
-
Custom DNS now applies to every domain even when the tunnel isn't the default route, unless you've set up split DNS.
-
Gateway connections to unreachable destinations now fail promptly instead of hanging.
-
Fixed a DNS reply leak.
🌍 Other Improvements
-
App icons: choose from four alternate icons under Settings › General on iPhone, iPad and Mac.
-
Mac: the menu bar icon shows when a connection fails, and the menu tells you the VPN keeps running after you quit the app. Memory use is lower.
-
Apple TV: fixed a launch crash on tvOS 17. Disconnecting now asks before it turns off auto-start.
Xlarva is built natively in Swift and Rust. It supports WireGuard, AmneziaWG and CONNECT-IP (MASQUE), and syncs configs across your Apple devices through iCloud. It can also set up a server on your VPS for you, or you can run our open-source relay, ferneast/masque-tunnel.
It's available on the App Store as a universal purchase for iPhone, iPad, Mac and Apple TV.
We'd love to hear your feedback, so drop a comment or open an issue. Thanks for the support!
Source: r/xlarva · by /u/lispnot