BibaVPN: what I’ve been working on over the past three months

Hey everyone, I’ve released another update to BibaVPN, my open-source, self-hosted VPN project.

Around 100 people in Russia are using it now. I’m also getting feedback from people in other countries where tools like this matter. Thanks to everyone here who’s tried it and told me what broke. Those reports have given me plenty to work on.

Here’s what changed in v1.4.0:

• 12 security fixes, including removing the default token and fixing SSRF, path traversal, and DNS-map poisoning issues.
• Split tunneling improvements, with domain bypass rules, per-app rules on Android, and Linux system proxy support.
• Fewer desktop freezes. Opening the tray menu, quitting, or importing a link could block the window for tens of seconds. That’s fixed.
• Connection fixes for sleep, network changes, and socket leaks during long sessions.
• Safer imports. Link imports now ask for confirmation and only accept known addresses. Keys and tokens are no longer passed to the UI.

There’s also better handling of idle clients on the server, Linux .deb and AppImage packages, and an app icon at last.

iOS still needs work. This release fixes the misleading “connected” status when the tunnel hasn’t actually started.

I’m continuing development, so if something breaks, please open an issue. Thanks for helping me get this far.

Release notes and downloads