StartOS StartTunnel 1.3.0

StartTunnel 1.3.0 closes a tracking vector in its UPnP endpoints, serves hostname routes to devices that can only reach it over UPnP, and works as a gateway for ordinary UPnP clients.

Highlights

• Security - the UPnP device description no longer answers web pages. It named the product and a stable identifier derived from the tunnel's WireGuard key to anyone who could reach it, so a malicious site could rebind its own domain to the gateway and read that from any tunneled phone or laptop - re-identifying the same visitor from any network. Every UPnP endpoint now refuses requests whose Host is not an IP address, which a real client always sends and a rebinding page never can.
• Devices can claim a hostname on a shared port over UPnP, not only PCP. Where an intermediate device filters the protocol StartOS prefers, it now falls back automatically instead of quietly keeping its port forwards while losing hostname routing. These routes always carry a lease, so a vanished device cannot squat a hostname against its owner.
• Third-party UPnP clients can use the tunnel as a gateway. Torrent clients and consumer apps built on the common UPnP library rejected it outright with "no valid UPnP Internet Gateway Device found", or created a mapping and then reported it failed because they could not read it back. StartOS was unaffected.
• An automatic port forward with a time limit now expires when that time runs out, rather than being held as though permanent until the tunnel next restarted.
• start-tunnel reaches a daemon that listens on a wildcard address. A tunnel server binds 0.0.0.0 by nature, and the CLI was left dialling https://0.0.0.0 with no token attached.
• subnet <SUBNET> set-wan and subnet <SUBNET> set-ipv6 can be run. Both asked for the subnet a second time and no invocation satisfied that; they now take it once from the parent command, as the documentation shows.
• Generated WireGuard configs mark the gateway as accepting inbound connections, while keeping their StartTunnel header for older StartOS versions.

Full changelog for v1.3.0 - every change in this release.

start-tunnel packages Checksums

SHA-256

bc5fb84a8298c32a2e5f2d39bf80e8f166e78468262f362188bfb9eee4057567  start-tunnel_1.3.0_amd64.deb
88b74862389b1108fc9e73f7acf6433322e51a60786b2739cf9e971b0a1f47e8  start-tunnel_1.3.0_arm64.deb
c4fb03ee81b7de62e760ed429f81a8c4ea7cff664595343de8f9c33f34833174  start-tunnel_1.3.0_riscv64.deb

BLAKE-3

88ed06bf2e40d6ee56083330289deb9f921cd82c6d22c72e00346e28975341fd  start-tunnel_1.3.0_amd64.deb
867141c070c7c6db756f9bfc9263df3fc8bdc5a178a25c7052c257d427d02ed6  start-tunnel_1.3.0_arm64.deb
e8950c7700ff5bf3d150f043e33dbc756506cefd52637bd7225710d9d384f4f5  start-tunnel_1.3.0_riscv64.deb