Documentation space

Appearance

WireSock Secure Connect - 3.8.2.1 ​

Release date: 2026-11-03

We are excited to announce the release of WireSock Secure Connect SDK 3.8.2.1

This release improves fragmented-traffic handling, SOCKS5 routing, network-lock reliability and connection diagnostics.

What's New ​

Version 3.8.2.1 ​

Improvements ​

  • Improved outbound IPv4 and IPv6 fragment routing under per-application rules and DNS redirection.
  • Strengthened network-lock enforcement in virtual-adapter mode, including profiles without a default route or an address for one IP family. Traffic selected for tunnelling is blocked when the profile cannot carry that family.
  • Improved SOCKS5 routing for handshakes, keepalives, data and AmneziaWG junk and imitation packets.
  • Improved packet handling during virtual-adapter tunnel restarts, discarding queued traffic that can no longer be safely delivered.
  • Improved network-lock preservation during failed reconnects, tunnel teardown and adapter changes.
  • Driver and filter cleanup failures are now reported, with unfinished cleanup retained for retry. New connections cannot proceed over an unresolved filter reset failure.
  • Terminal configuration errors now stop repeated connection attempts and remain visible until the next explicit connection attempt. The command-line client reports the terminal status once.

Bug Fixes ​

  • Corrected an inbound IPv4 fragmentation checksum error after address translation that could prevent traffic from reaching applications.
  • Corrected handling of other applications' traffic to the VPN server or SOCKS5 relay, including replies previously mistaken for WireSock's own traffic.
  • Corrected kill-switch setting changes while connections are queued, connecting or retrying. Both enabling and disabling are applied through the connection worker.
  • Corrected reconnect handling of IPv6 endpoints and configured ports. Cached addresses now follow profile changes; the legacy service can reuse previously resolved addresses when a retained network lock blocks DNS.

Configuration Changes When Upgrading ​

  • A SOCKS5 proxy must resolve to a supported address in the same IP family as the VPN endpoint. Unsupported configurations report an error instead of connecting without the proxy.
  • A configured ListenPort must be available in both IPv4 and IPv6. WireSock now uses an exclusive dual-stack endpoint socket, which requires IPv6 socket support even for IPv4 VPN endpoints.
  • SOCKS5 "all traffic" mode reserves MTU space for proxy headers. Oversized handshakes that cannot be carried through the proxy are dropped.
  • Changing an endpoint or proxy hostname while retaining network lock may require restoring DNS access before reconnecting.
  • With network lock disabled, virtual-adapter mode retains its existing route-based split-tunnelling behavior.

Known Limitations ​

  • Under specific packet-loss and fragment-identifier collision conditions, later fragments can still inherit an earlier direct-routing decision within a window of up to two seconds. This remains a security limitation.
  • Inbound fragmented IPv6 DNS translation and virtual-adapter steering are not fully addressed.
  • Some out-of-order, oversized or three-or-more-fragment replies from the VPN server or relay remain unsupported in single-tunnel mode.
  • Protected UDP traffic exceeding the tunnel's supported size can still be undeliverable. Heavy fragmented traffic can also cause some bypassed fragments to be dropped.

Download ​

Previous versions: ​

Version 3.8.1.1 ​

New Features ​
  • DNS search domains: connection profiles now support DNS search domains, with validation in the profile editor.
  • Connection warnings in the tray: connection errors and timeouts are now reported as warning balloons from the tray icon.
Improvements ​
  • Faster and more reliable per-application traffic classification under heavy connection load: process lookups no longer stall packet processing, which could delay LAN traffic and occasionally route traffic of closing connections through the wrong path.
  • Clearer connection timeout messages: an error that changes cause is reported with the current reason, and stale statuses are cleared on recovery.
  • More robust DNS configuration: apply failures are reported and retried, settings are cleaned up on disconnect, and invalid DNS entries are handled consistently.
  • Updated bundled .NET runtime to 10.0.12 and third-party libraries.
Bug Fixes ​
  • 32-bit Windows: the x86 installer now ships a 32-bit command-line tool (wiresock-connect-cli.exe); previously it included a 64-bit build that could not start.
  • Windows 7 (32-bit): fixed a .NET runtime crash in the application, the services and the CLI.
  • Windows 7: "entry point not found" error dialogs no longer appear when an error is logged.
  • DNS: IPv6 DNS responses are no longer discarded by Windows when queries are redirected, so name resolution no longer falls back to IPv4 with a delay.
  • Kill Switch: fixed high CPU usage when the tunnel kept failing to connect without a network route (for example, with Wi-Fi off); improved network lock filtering around the WireGuard endpoint and SOCKS5 relay, and the lock state is preserved across sleep and disconnect.
  • Dual-tunnel: fixed egress-selection races that could send malformed frames.
  • Fixed resource leaks and race conditions on failed start, stop, restart and watchdog recovery that could leave the tunnel stuck or terminate the process.