Documentation space

Appearance

WireSock Secure Connect PRO - 3.8.2.1 ​

Release date: 2026-11-03

We are excited to announce the release of WireSock Secure Connect PRO 3.8.2.1

This release improves fragmented-traffic handling, SOCKS5 routing, network-lock reliability and connection diagnostics.

Upgrading from Version 2.x ​

Important for v2 Users

WireSock Secure Connect PRO version 3.x requires a new license key.

Your license key should be delivered to your email address or available in your account at wiresock.net/account.

If you have not received your license key, please contact us at support@wiresock.net.

What's New ​

Version 3.8.2.1 ​

Improvements ​

  • Improved outbound IPv4 and IPv6 fragment routing under per-application rules and DNS redirection.
  • Strengthened network-lock enforcement in virtual-adapter mode, including profiles without a default route or an address for one IP family. Traffic selected for tunnelling is blocked when the profile cannot carry that family.
  • Improved SOCKS5 routing for handshakes, keepalives, data and AmneziaWG junk and imitation packets.
  • Improved packet handling during virtual-adapter tunnel restarts, discarding queued traffic that can no longer be safely delivered.
  • Improved network-lock preservation during failed reconnects, tunnel teardown and adapter changes.
  • Driver and filter cleanup failures are now reported, with unfinished cleanup retained for retry. New connections cannot proceed over an unresolved filter reset failure.
  • Terminal configuration errors now stop repeated connection attempts and remain visible until the next explicit connection attempt. The command-line client reports the terminal status once.

Bug Fixes ​

  • Corrected an inbound IPv4 fragmentation checksum error after address translation that could prevent traffic from reaching applications.
  • Corrected handling of other applications' traffic to the VPN server or SOCKS5 relay, including replies previously mistaken for WireSock's own traffic.
  • Corrected kill-switch setting changes while connections are queued, connecting or retrying. Both enabling and disabling are applied through the connection worker.
  • Corrected reconnect handling of IPv6 endpoints and configured ports. Cached addresses now follow profile changes; the legacy service can reuse previously resolved addresses when a retained network lock blocks DNS.

Configuration Changes When Upgrading ​

  • A SOCKS5 proxy must resolve to a supported address in the same IP family as the VPN endpoint. Unsupported configurations report an error instead of connecting without the proxy.
  • A configured ListenPort must be available in both IPv4 and IPv6. WireSock now uses an exclusive dual-stack endpoint socket, which requires IPv6 socket support even for IPv4 VPN endpoints.
  • SOCKS5 "all traffic" mode reserves MTU space for proxy headers. Oversized handshakes that cannot be carried through the proxy are dropped.
  • Changing an endpoint or proxy hostname while retaining network lock may require restoring DNS access before reconnecting.
  • With network lock disabled, virtual-adapter mode retains its existing route-based split-tunnelling behavior.

Known Limitations ​

  • Under specific packet-loss and fragment-identifier collision conditions, later fragments can still inherit an earlier direct-routing decision within a window of up to two seconds. This remains a security limitation.
  • Inbound fragmented IPv6 DNS translation and virtual-adapter steering are not fully addressed.
  • Some out-of-order, oversized or three-or-more-fragment replies from the VPN server or relay remain unsupported in single-tunnel mode.
  • Protected UDP traffic exceeding the tunnel's supported size can still be undeliverable. Heavy fragmented traffic can also cause some bypassed fragments to be dropped.

Download ​

Major Features and Improvements for version 3.x ​

1. New Architecture ​

  • A dedicated separated layer for better performance and security isolation.
  • A UI client for connection control, settings configuration, and profile management. The VPN connection operates independently of the UI: the UI client can be fully closed while the connection remains active.
  • Support for establishing the VPN connection during Windows startup, before user logon.
  • The Virtual Adapter Mode and TCP Socket Termination settings no longer require running the application with administrator privileges.

2. KillSwitch (Network Lock) ​

  • KillSwitch can be configured to block all traffic when the VPN connection is lost, preventing any data leaks.

3. Global Split Tunneling Settings ​

  • Split tunneling can now be configured once globally and applied to all profiles in the application.

4. New DPI Protection Options ​

  • Added advanced DPI protection using QUIC and DNS packet emulation.

  • AmneziaWG 2.0 support* for enhanced stealth connectivity and bypassing network restrictions.

  • DPI protection can be configured either globally or individually per profile.

    * Note: Standard AWG 1.5 I1–I5 parameters are not supported. WireSock uses its own method for configuring simulation settings in both the configuration file and the UI. See Documentation

5. New User Interface for Creating and Editing Profiles ​

  • Supports editing profiles in a text-based format.

6. New Command-Line Interface (CLI) ​

  • Introduced a new command-line interface supporting core commands: connect, disconnect, import, export, and delete profile.
  • The CLI enables full operation of the application without the UI.

7. New Language Support ​

  • Arabic
  • Portuguese
  • Korean
  • Vietnamese
  • Bangla (Bangladesh)
  • Bangla (India)
  • Hindi
  • Indonesian
  • Urdu
  • Amharic
  • Afaan Oromo

PRO-Exclusive Features ​

Config Encryption ​

  • Encrypt WireGuard profile files at rest on the file system to protect credentials.

Controlled UI Mode ​

  • Prevent users from disconnecting, switching profiles, or modifying settings — ideal for managed corporate deployments.

Scripted Installation & Automation ​

  • Silent MSI installation with pre-configured settings for enterprise deployment scenarios.