Surge TestFlight Feed

Surge iOS 6 Is on the Way! We're currently preparing for the upcoming release of Surge iOS 6. As we focus on finalizing the new major version and getting everything ready for its launch, TestFlight updates will be temporarily paused. During this period, no new beta builds will be distributed through TestFlight. This is a planned pause as we transition to the next major release. TestFlight updates will resume once we're ready to move forward with testing Surge iOS 6. Thank you for your continued support and patience. Stay tuned — we'll be back soon with more updates!

Beta Updates Peer Access - peer-access-passthrough has been removed due to its side effects, and the behavior has been restored to the previous version. Special handling for Apple Screen Sharing is now built in and works without any configuration. Rule Sets - Removed the 1,000,000 entry limit on rule sets and domain sets. Surge VM - [Mac] New "Disable UDP Fast Path" option in the gateway settings. When a device creates many UDP flows in a short time (for example, P2P downloads), Surge VM normally moves it to the UDP Fast Path. That path forwards its UDP traffic directly at L3 without applying rules. Turn this option on to stop using the fast path for all devices, so all UDP traffic always goes through your rules. Fixes - Fixed iCloud Drive sync no longer pulling changes from other devices. Local changes were still uploaded. The problem came from a lock file with missing write permission left behind by older versions. Surge now repairs that file automatically.

Beta Updates SOCKS5 UDP - The built-in SOCKS5 proxy server now supports UDP ASSOCIATE. SOCKS5 clients can send UDP traffic through Surge, and it goes through your rules and policies the same way as TCP. The first datagram of each association is matched against your rules, and later datagrams use the same policy. Peer Access Passthrough - New peer-access-passthrough option for Tailscale and WireGuard policies. It is on by default when accept-incoming / allow-peer-access is enabled.- Incoming connections to this device's tunnel address are handed to the local service directly, so the service sees the peer's real address and port. - Traffic this device sends to a peer address goes straight into the tunnel. - Rules and the request list do not apply to these flows. - This is needed by protocols that connect back to the peer address they see, such as the high-performance mode of Apple Screen Sharing. - Set peer-access-passthrough = false to keep the previous behavior. Incoming connections then go through Surge with rules and request records. - UDP forwarded through Tailscale or WireGuard now keeps the client's source port when that port is free. QUIC Block Mode - [iOS] The global block-quic setting can now be changed in the proxy list editor on iOS, as on Mac. Improvements - Tailscale: the admin console no longer shows an update warning for devices running Surge. - Tailscale: a DERP connection that receives no data for 120 seconds is now treated as dead and reconnected. Before, a silently dropped connection could lose all relayed traffic until Surge restarted. - Ponte: a device is no longer wrongly treated as being on the same LAN when both sides have the same virtual machine bridge address (OrbStack, Parallels, UTM and similar). - Ponte: when a LAN connection attempt fails, Surge now falls back to Internet mode and refreshes the device record, instead of ending in a ping timeout. - Ponte: device records in logs no longer include the PSK or controller key. - Traffic statistics: Tailscale MagicDNS hosts (*.ts.net) are now shown by their full hostname instead of all being grouped under ts.net. The per-host report now adds up entries for the same host instead of keeping only one of them. - HTTP proxy: the Proxy-Authorization header is no longer forwarded to the upstream server. It carries the credentials for Surge's own proxy. - HTTP/2: a malformed request now resets only its own stream instead of the whole connection. - HTTP/2: when the upstream server closes the connection in the middle of a response, Surge now reports it as truncated instead of as a complete response. - $httpClient: percent-encoded usernames and passwords in the URL are now decoded before they are sent as Basic auth. A response body that cannot be decoded is now reported as an error. Fixes - [iOS] Fixed Map Local data files larger than 2 MB being rejected on iOS. The limit is now 15 MB, as the manual says. - Fixed HTTP/2 responses with no body (304, 204, or a response to HEAD) not being handled correctly when both a response script and a body rewrite rule matched. - Fixed $surge.retestGroup failing in scripts that use the WebView engine when no policy list was returned. - Fixed pipelined HTTP/1 requests sent after a chunked request body being forwarded as part of that body instead of being handled as separate requests. - Fixed several edge cases in HTTP/1 connection reuse and closing that could mix up responses or leave connections open.

Security Advisory: eMudhra Intermediate CA Compromise A serious security incident involving eMudhra's Intermediate Certificate Authorities (CAs) has recently been disclosed. The compromise of CA private keys could allow attackers to issue seemingly legitimate TLS certificates for arbitrary domains, potentially enabling man-in-the-middle (MITM) attacks against HTTPS connections. Major platform vendors, including Apple, Google, Microsoft, and Mozilla, have taken measures to distrust the affected CA certificates. No action is required for Surge users. Although Surge uses its own TLS protocol stack and MITM engine, it strictly relies on the operating system's certificate trust evaluation mechanisms to validate certificate chains. As a result, Surge benefits from the same certificate trust and revocation protections enforced by the operating system. Security Reminder: Unless explicitly required, do not enable the skip-server-cert-verify parameter in your MITM configuration. Enabling this option bypasses TLS certificate validation for upstream servers and may expose your connections to MITM attacks.

Dashboard Issue on macOS 27.2 Surge Mac users on macOS 27.2: you may find that Surge Dashboard quits immediately after launch. Surge itself and all network features are not affected. This is caused by a system issue in macOS 27.2 that can affect other apps as well. We reported it to Apple, and Apple has confirmed the fix, which will ship with the next macOS update. In the meantime: • If your update subscription is active, update to Surge Mac 6.10.0 or later, which already works around the issue. • If your subscription has expired, we've released Surge Dashboard Patcher, a free tool that replaces only the bundled Dashboard with a fixed build. Surge and your profiles are left untouched. • Alternatively, you can simply wait for the next macOS update, which will resolve the issue. Details and download: https://kb.nssurge.com/surge-knowledge-base/faq/mac-dashboard-crash

Surge tvOS Beta - You can now control Surge tvOS directly on the Apple TV. While Surge is running, the start screen has a new column with: - An outbound mode button. Its menu also turns MitM, Rewrite and Scripting on or off. - A policy group page. You can select policies, override auto groups, run latency tests and see smart group usage. Group icons set with icon-url show the same way as on iOS. - An external resource page. You can update resources one at a time or all at once. - Please note that before using the new tvOS version, you need to redeploy using the latest Surge iOS TestFlight version, otherwise it cannot be enabled.

Snell 6.0.0 Snell 6.0.0 RC2 has been released as the final 6.0.0 version, and the download links have been updated. Additionally, a macOS arm64 binary has been added. Please check: https://kb.nssurge.com/surge-knowledge-base/release-notes/snell

Beta Updates Incoming Connections for Tailscale and WireGuard - The old parameter accept-incoming has been renamed to allow-peer-access, but it will still be read for compatibility. - Fixed the issue where incoming UDP packets could not be forwarded when the destination address is the local machine. - Please note that due to its unusual communication mechanism, Apple Screen Sharing's high-performance mode cannot be used even if allow-peer-access is enabled. We are looking into a dedicated workaround for this. Ruleset Editor - You can now disable individual rules in a ruleset with the Enable/Disable swipe action. Disabled rules are saved as commented-out lines. Improvements - Snell v6: UDP data is now sent right after the tunnel command, without waiting a round trip for the server's response. QUIC over Snell v6 connects noticeably faster. This requires a v6 server. - Adaptive QUIC Block: detection now starts only on new QUIC handshakes. Before, packets from QUIC connections that already existed (for example, ones opened before Surge started) could be wrongly remembered as allowed. They are now blocked so that the app starts a new handshake. - DTLS, WireGuard, STUN and other non-QUIC UDP traffic on port 443 is no longer treated as QUIC, so block-quic no longer affects it. - When a SOCKS5 proxy rejects a connection, Surge now shows the reason the server gave (such as connection refused or host unreachable) instead of an "invalid response" error. - Ponte: a device no longer stays stuck in "LAN-only mode" when its record was captured while its remote channels were restarting. Surge refreshes the device list before giving up, and the error message now explains why. - [Mac] Resolved the issue of needing to repeatedly reactivate when using multiple users or multiple operating systems on the same device. For details, please refer to the knowledge base licensing FAQ to learn about the corresponding methods. Fixes - Fixed requests failing with 503 when a server sends a body after a 304 or another response that should have no body (for example, ASUSWRT-Merlin routers). - [iOS] Fixed high memory use on MITM HTTP/2 connections when the client reads slowly. This could push the network extension past its memory limit. - [iOS] Fixed a possible network extension crash when viewing the Logbook with very large script records. - [iOS] Fixed the external resource view sometimes being presented twice. - [iOS] Fixed text fields in sheets being covered by the keyboard in some sheet sizes, and the space left for the keyboard not always being removed after it was dismissed. - [iOS] Optimized the keyboard layout for iPhone Duo.

Incoming Connections for Tailscale and WireGuard Surge can now accept connections that come in through Tailscale and WireGuard, not just send traffic out. Incoming requests are handled like any other request: they go through your rules and policies and show up in the request list. Tailscale - accept-incoming = true: other devices on your tailnet can connect to this device through its tailnet address. For example, they can use Surge's HTTP/SOCKS5 proxy or other services running on this device. - advertise-exit-node = true: offer this device as an exit node. Other tailnet devices that select it send all their internet traffic through Surge's rules. - advertise-routes = 192.168.1.0/24, ...: offer this device as a subnet router for the listed networks. - Exit nodes and subnet routes take effect after you approve them in the Tailscale admin console. WireGuard - accept-incoming = true: the peer side can open connections to this device through an existing tunnel. - listen-port = 51820: Surge acts as a WireGuard server that phones, laptops, and other clients can connect to. A peer can leave out endpoint; Surge learns the client's address when it connects and keeps up when the address changes. - Clients can set Surge's tunnel address as their DNS server, and Surge's DNS will answer their queries. Note: Surge does not apply your Tailscale access control policy to incoming connections. Use rules such as SRC-IP to limit who can reach which destination. Requires iOS 5.24.0+ / Mac 6.11.0+. See the Tailscale and WireGuard pages in the manual for details and example configurations.

Beta Updates Adaptive QUIC Block - Added block-quic=adaptive for proxy policies. Surge blocks QUIC at first so the app falls back to HTTPS over TCP. If the app does not fall back within 1 second, as with apps that only support QUIC, QUIC is allowed for that host. Results are remembered per host. The option is also available in the proxy editor on Mac and iOS. - block-quic=auto now uses adaptive mode for every policy except DIRECT, so QUIC-only apps keep working through proxies. Policies that cannot relay UDP still block QUIC. - QUIC hostname detection now works when the TLS ClientHello spans several packets, which is common in recent browsers using post-quantum key exchange. QUIC v2 and draft-29 are now supported as well. Rules, MITM and request records can now see the hostname of more QUIC connections. HTTP API - GET /v1/policies of the HTTP API now accepts the include_external=true query parameter. The response then contains an additional external-policies field that lists the policies loaded from external policy groups (policy-path). Each entry includes the policy name, the group it belongs to, and an identifier. Pass the identifier as the policy option of $httpClient to send a request through that policy, since external policies cannot be referenced by name.

We’re pleased to announce that Surge Mac 6.10.0, Surge iOS 5.23.0, and Surge tvOS 5.23.0 are now available. VS Code Extension (Mac) Added support for the Surge Language Support extension for VS Code, providing syntax highlighting and real-time diagnostics for profiles, modules, and rule sets. Includes automatic file detection and validation of policy references in detached configurations when the main profile is open. This extension relies on the Surge application package and requires Surge Mac 6.10.0 or later. Its profile parsing capabilities are automatically updated when Surge is upgraded. https://marketplace.visualstudio.com/items?itemName=SurgeNetworks.surge-language-support IP Rewrite Added the [IP Rewrite] section, which handles packets entering Surge VIF at the IP layer based on their destination address, before they reach any rule or policy. This can provide on-device loopback functionality for certain iOS developer toolchains. Available actions: - reflect: Swaps the source and destination addresses and sends the packet back to its sender. - reject: Responds with a TCP RST to connection attempts and with an ICMP administratively prohibited message to other packets, so the sender fails immediately. - drop: Silently discards the packet. Other New Features - Added a category parameter to policy groups for grouped display, useful when there are many policy groups. - All test-url parameters now support HTTPS URLs. The result still measures the latency of a single HTTP round trip, but TLS handshakes may significantly increase the overall test duration when there are many policies. - Added an option to proactively update the configuration of a linked profile. URL-based linked profiles can now be updated manually. - Added external resource management and other helper endpoints to the HTTP API. - Added a device communication takeover option for Include All mode. (iOS) UI and Rules - Updated UI layouts and details for iPhone Duo support. (iOS) - Improved the Add Rule page: domain rules can now be created from SNI-sniffed requests, and rule-specific options can be selected directly. - Inline rule sets with the same name now merge across the main profile and modules instead of replacing one another, preserving the rules contributed by each source. - Fixed logical rules incorrectly parsing policy names containing parentheses. Networking and Reliability - Improved Tailscale and WireGuard behavior when switching networks. - Improved UDP test diagnostics for peer-to-peer Tailscale and WireGuard policies without Internet egress, reporting unsupported tests instead of waiting for a timeout. - The previous version strengthened MITM security by generating a separate key pair for each distinct domain, which caused noticeable delays when intercepting many different domains concurrently. After evaluation, this change has been reverted. - Removed an erroneous Ponte notification when using a Ponte policy in a policy group. - Fixed a scripting-engine compatibility issue. - Added a workaround for a system bug in macOS 27.2 beta to prevent Dashboard from crashing. (Mac) - Improved performance and memory usage, fixed rare crashes, and resolved other minor issues.

VS Code Extension Added support for the Surge Language Support extension for VS Code, providing syntax highlighting and real-time diagnostics for profiles, modules, and rule sets. Includes automatic file detection and validation of policy references in detached configurations when the main profile is open. This extension relies on the Surge application package and requires Surge Mac 6.10.0 or later. Its profile parsing capabilities are automatically updated when Surge is upgraded. https://marketplace.visualstudio.com/items?itemName=SurgeNetworks.surge-language-support

Beta Updates New Features - IP Rewrite - Added the [IP Rewrite] section, which handles packets entering Surge VIF at the IP layer based on their destination address, before they reach any rule or policy. Available actions:- reflect: Swaps the source and destination addresses and sends the packet back to its sender. - reject: Responds with a TCP RST to connection attempts and with an ICMP administratively prohibited message to other packets, so the sender fails immediately. - drop: Silently discards the packet. For example, you can use the following module to make Surge work as LocalDevVPN, allowing you to use certain developer toolchains on iOS devices.

#!name=Local Device Loopback
#!desc=Reflect 10.7.0.1 back to this device for on-device developer tools.
[General]
ipv6-vif = disabled // Some tools only recognize utun interfaces without an IPv6 address.
tun-included-routes = %INSERT% 10.7.0.1/32

[IP Rewrite]
10.7.0.1 = reflect

A new guide has been added to the Surge Knowledge Base, covering how to remotely manage a Surge instance. https://kb.nssurge.com/surge-knowledge-base/guidelines/remote-management

Beta Updates - A category parameter has been added to policy groups for grouped display. It can be used when there are many policy groups. - All test-url parameters now support configuring HTTPS URLs for testing. The test result remains the latency of a single HTTP RTT, but due to the TLS handshake, the test duration may increase significantly when there are many policies. - In the previous version, MITM security was strengthened by generating a separate key pair for each distinct domain name. This caused noticeable delays when performing MITM concurrently on a large number of different domains. After evaluation, this change has been reverted.

Surge Mac 6.9.1 & Surge iOS 5.22.1 are now available. New Features - [iOS] Policy group widgets now support the extra-large size on iOS 27. - [iOS] Added a medium-sized iOS widget with start/stop controls, running status, and one-tap switching between Rule-Based Proxy, Direct Outbound, and Global Proxy. - Added UNKNOWN support to GEOIP and IP-ASN rules, allowing IP addresses without matching country or ASN database entries to be matched. This works in both individual rules and rule sets. Fixes and Improvements - Fixed lower-than-expected results under extreme throughput performance testing. - Fixed failed cellular backup connections in Wi-Fi Assist or Hybrid mode prematurely aborting an ongoing Wi-Fi connection attempt. - Fixed Pre-Matching remaining enabled after changing a rule to a non-reject policy or unsupported rule type. - Fixed Hysteria UDP forwarding with servers where HTTP/3 Datagram negotiation interfered with UDP traffic. - Fixed missing traffic statistics for UDP connections through proxies and tunnels, including WireGuard and Tailscale. - Fixed a rare issue where closing a UDP proxy connection during packet reception could stall other Surge traffic. - Fixed SF Symbol policy-group icons not responding correctly to appearance changes on iOS. - [iOS] Improved resource updates on iOS: pending automatic updates resume when the app becomes active, duplicate downloads are avoided, and stale errors are cleared after a successful background refresh. - [Mac] Fixed macOS Smart policy group context menus showing outdated usage or incorrect priority adjustments. - [Mac] Fixed unnecessary Surge Helper installation or upgrade alerts at startup when the enabled features do not require the helper.

* [Host] domain aliases can specify a dedicated DNS server. * Updated the IPv6 fake-IP range to avoid unnecessary browser local-network permission prompts. * Fixed rare crashes when proxy or QUIC connections close synchronously during data processing. * Fixed recursive HTTP/3 timer processing that could cause a stack overflow. * Fixed QUIC connections stalling after receive-side backpressure. * Fixed long-running Ponte and Vector sessions eventually exhausting their ability to open relayed streams. * Fixed rare deadlocks involving cron-script shutdown and Vector UDP connections. * Improved stability during heavy connection churn and local-port exhaustion. * Improved MITM certificate generation and certificate-chain handling. * Fixed several additional crashes and minor issues.

Surge iOS 5.22.0 is now available on the App Store. New Features * Added a full-featured Terminal to Surge iOS, providing CLI-based diagnostics, rule explanations, policy-group inspection, command completion, and command history. * Added MASQUE proxy support using HTTP/3 CONNECT and CONNECT-UDP. * HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. * TrustTunnel can now use HTTP/3 transport with h3=true. * Added group-level proxy chaining. Policy groups can connect concrete proxy members through an underlying proxy. * Added a Prometheus-compatible /metrics endpoint to the HTTP Controller. * Added a graphical Policy Priority editor for Smart Groups. * Added event-script support for engine-started and profile-reloaded. * Added notification controls for proxy clients, scripts, and rule matches. * Added Arctic and Pulse app icons. Tailscale * Added peer-relay support through eligible tailnet devices, with Direct → Peer Relay → DERP priority and runtime latency information. * Interactive sign-in now supports tailnets that require administrator device approval. * Improved recovery from interrupted sign-in by reconnecting and continuing the existing authorization flow. * Improved compatibility with the Tailscale administration console and version-gated operations. * Fixed connectivity issues after the control server assigns a new tailnet address. * Improved recovery after network changes, UDP binding failures, expired connections, and in multi-peer configurations. Profiles, Includes, and Rulesets * #include directives can now be freely combined with regular section content. * Sections using multiple or mixed includes are presented as read-only when their write-back destination is ambiguous. * Added wildcard detached-section includes for [Ruleset *], [WireGuard *], and [Tailscale *]. * Added DEVICE_NAME to the profile environment for use in #!REQUIREMENT. * Added diagnostics for missing WireGuard and Tailscale configuration sections and clarified named-include behavior. * Local and inline rulesets can now be edited graphically on macOS and iOS. * Rulesets can reference other inline rulesets as well as external RULE-SET or DOMAIN-SET sources. * Circular ruleset references are rejected with a clear reference chain. * The ruleset editor now better preserves blank lines, comments, disabled rules, and source locations. * Fixed rules created inside rulesets or logical rules retaining an unintended hidden policy value. * Improved selection of the appropriate write-back target when mixed includes are used. * Fixed [General] values containing #, //, or ; being altered after saving. * Profiles changed on disk or through iCloud now reload automatically, while invalid updates leave the working configuration active. * Module installation state is no longer governed directly by iCloud. * Cloud synchronization now excludes .git and node_modules. UI and Editing * The bottom tab bar remains visible during navigation to avoid UIKit transition glitches. * The Script Editor now uses a dedicated modal interface with an improved toolbar and keyboard layout. * Remote Controller and Ponte Diagnostics are available for all Ponte devices, including shared devices. * Improved policy-group icon handling across themes and profile reloads. * Improved iOS 26 context menus, previews, and module presentation. * Virtual IP records and search results now use self-sizing rows. * Fixed policy groups using an underlying proxy being unavailable from the UI. * Improved module error reporting for download, parsing, writing, and installation failures. Networking and Reliability

Surge Mac 6.9.0 is Now Available * MASQUE & HTTP/3 — Added MASQUE proxy support with HTTP/3 CONNECT and CONNECT-UDP, plus HTTP/3 transport for TrustTunnel. * Tailscale Peer Relay — Added Peer Relay support with Direct → Peer Relay → DERP path selection, plus improved sign-in and connectivity recovery. * Surge CLI — Significantly expanded the CLI with rule explanations, DNS tracing, HTTP probing, runtime diagnostics, VM Gateway inspection, and more. * Proxy Chaining — Policy groups can now route their proxy members through an underlying proxy. * Profile System — #!include can now be freely mixed with inline content, with wildcard includes for Ruleset, WireGuard, and Tailscale sections. * New Editors — Redesigned major configuration interfaces and added graphical editors for rulesets and Port Forwarding. * Prometheus Metrics — Added a Prometheus-compatible /metrics endpoint for runtime and traffic monitoring. * Gateway & Reliability — Improved IPv6 Gateway Mode and reliability across QUIC, DNS, Ponte, Vector, and high-connection-load scenarios. For the complete release notes, please visit: https://nssurge.com/support/mac/release-notes

Beta Updates Improved - Nested rulesets now work reliably: inline rulesets can reference other inline rulesets or external RULE-SET and DOMAIN-SET sources. Circular references are rejected with a clear reference chain instead of causing recursive matching. - The local ruleset editor now preserves blank lines, standalone and trailing comments, and disabled rules more accurately. Invalid entries report their source file and line number, while comment rows use the same readable presentation as the main rule editor. - Virtual IP records and search results on iOS now use self-sizing rows, preventing longer domains and usage details from being clipped. Fixed - Fixed rules added inside a ruleset or logical rule on iOS incorrectly retaining a hidden policy value when saved.