Surge Knowledge Base
English
Ask or search…
⌃K
Comment on page

Surge Mac

Version 5.4.1

Rule Engine Optimizations

  • The implementation of RULE-SET and DOMAIN-SET has been completely rewritten. Now, Surge automatically preprocesses and indexes rule sets during resource updates, significantly increasing the matching speed.
    1. 1.
      There is no longer any difference in performance and memory usage between RULE-SET and DOMAIN-SET types of rule sets, allowing flexible usage.
    2. 2.
      There is no longer a restriction in DOMAIN-SET rule sets that prevents the use of eTLDs.
    3. 3.
      The matching speed for DOMAIN, DOMAIN-SUFFIX, IP-CIDR, and IP-CIDR6 rules in RULE-SET has been greatly improved.
    4. 4.
      A DOMAIN/DOMAIN-SUFFIX rule set with approximately 100,000 entries used to take 100ms for a single match in the old version; now, it only takes single-digit ms.
    5. 5.
      An IP-CIDR rule set with approximately 10,000 entries used to take about 0.1ms for a single match in the old version. The new version only needs 0.0002ms, an improvement of about 500 times. The performance improvement for IP-CIDR6 rules is even greater.
  • Main ruleset matching efficiency has been slightly optimized.
  • The efficiency of IP-CIDR6 rules has been significantly improved even in non-indexed situations.
  • RULE-SET rules can now be configured directly with parameters no-resolve and extended-matching, which are equivalent to configuring all sub-rules with these parameters.
  • DOMAIN-SET rule sets also support configuration with extended-matching.

Minor Optimizations

  • Now, when performing MITM, the certificate used for signing will be sent to the client together, to support using intermediate certificates for MITM.
  • All comments (at the beginning and end of lines) can now use #, //, ; three common comment symbols.
  • Profile error message prompt optimization, now it can give the exact line number where the error occurred more accurately.
  • Optimize Surge Ponte error handling process, correct the issue where device information is not automatically updated under certain errors.
  • Bug fixes.

Version 5.4.0

New Features

  • Protocol sniffing
    Requests to port 80 and 443 will wait for the client to send the first packet, then extract the SNI and other information for the rule system to judge.
    • DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD rules add an optional parameter called extended-matching. When this parameter is enabled, the rule will try to match both the SNI and the HTTP Host Header (or :authority).
    • Added a parameter called always-raw-tcp-hosts, used to forcibly turn off active protocol detection for specific hostnames.
  • New proxy protocol support: Hysteria 2
    Hysteria 2 is a proxy protocol optimized for unstable and packet-loss-prone network environments, based on UDP/QUIC.
  • Automatic QUIC blocking
    Since most proxy protocols are not suitable for forwarding QUIC traffic, Surge will now automatically block QUIC traffic to make it fallback to HTTPS/TCP protocol, ensuring performance. For QUIC traffic that hits the MITM hostname, it will also be automatically rejected.
  • ECN (Explicit Congestion Notification) support for QUIC-based protocols
    Significantly improved the performance of the Vector(Surge Ponte)/TUIC/Hysteria 2 protocol.

Optimizations

  • Reworked HTTP capture functionality
    • The related settings are no longer stored in the configuration, the [Replica] section has been deprecated.
    • Added an automatic shut-off setting after turning on the capture switch, which can automatically stop capturing based on time, size, or the number of requests.
    • Added automatic activation of MITM after turning on the capture switch, which can be additionally turned on for specific hostnames. (Even if the main MITM switch is off).
    • Added an option to only save HTTP/HTTPS requests after turning on the capture switch.
  • Improved compatibility with some non-standard protocols.
  • When testing the Ponte policy, the test URL has been changed from proxy-test-url to internet-test-url.
  • Following the WireGuard protocol standard recommendation, WireGuard handshake packets will now be tagged with 0x88 (AF41) DSCP to increase the success rate.
  • When forwarding UDP packets via WireGuard, it supports retaining the TOS(DSCP/ECN) tag of packets inside the tunnel.
  • Based on the WireGuard protocol standard recommendation, Surge will copy the ECN tag from packets inside the tunnel to packets outside. When receiving packets with an ECN tag, they will be strictly merged according to RFC6040. (ecn=true must be set for the policy).
  • UDP NAT can close the UDP session early based on ICMP messages.
  • Improved PMTU support for QUIC.

Bug Fixes

  • Fixed the issue where the external resources of rule sets needed to be reloaded to take effect after updates.
  • After a network switch, it will forcefully break the original long connection of DoH/DoQ/DoH3 to avoid obtaining results that are not suitable for the current network environment.
  • Fixed the issue where invalid certificates might cause the key store interface to crash.
  • When performing MITM on HTTPS requests that directly connect using an IP address, the IP address should not be sent as SNI, as this might cause compatibility issues.
  • Other bug fixes.

Version 5.3.2

  • Surge Mac is now ready for macOS Sonoma.
  • External resources can now be remotely managed and updated by Surge iOS.
  • Fixed the issue where the location permission request could not be correctly triggered.
  • Surge Web Dashboard upgraded to version 2.0.4.
  • Other improvements.
https://dl.nssurge.com/mac/v5/Surge-5.3.2-2393-f4b3e5e9a7bc5b73106ace7b0776eefe.zip

Version 5.3.1

  • Surge Dashboard now can directly create temporary rules for local and remote Surge instances.
  • Surge Web Dashboard now upgraded to version 2.0.
  • Added Inline Ruleset, which allows the Ruleset to be written directly in the main profile
  • Module enhanced. Modules can now operate [WireGuard *] and [Ruleset *] sections.
  • Added an HTTP API for obtaining CA certificates (DER format): GET /v1/mitm/ca.
  • Fixed that MITM failed records could not be correctly generated.
https://dl.nssurge.com/mac/v5/Surge-5.3.1-2383-066f883d96a472655c9ea7be50475b8b.zip

Version 5.3.0

  • You can now directly access the Remote Dashboard of registered devices through Surge Ponte.
  • The Surge Dashboard can now operate the policy group and outbound options of remote devices.
  • macOS Sonoma now requires location permissions to obtain the SSID. If related rules and subnet settings are used, Surge will prompt for location permissions.
  • Fixed a bug that the override of a policy group cannot be canceled remotely.
  • Corrected the compatibility issue between VIF and specific devices.
  • Surge Ponte improvments.
  • Minor bug fixes.
https://dl.nssurge.com/mac/v5/Surge-5.3.0-2375-bc1b4791973df9aba493c3190a7b0050.zip

Version 5.2.3

  • You can now create a new modifiable profile based on an existing profile. In this new profile, the selected sections will reference the corresponding content in the original profile and will automatically synchronize with the original profile. At the same time, unselected sections in the new profile can be modified freely without being affected by the original profile. (The UI for the detached profile feature.)
  • The detached profile now can include the Enterprise profile.
  • Fixed the issue that it was impossible to connect when the SSH server configured a banner.
  • You can now use the UI to edit ShadowTLS parameters.
  • Optimize performance in VIF v1 mode for ARM64 architecture. When the VIF mode is set to automatic, the new version will automatically use the v1 engine under M1/M2 processors, with a maximum performance of ~8Gbps, thereby avoiding compatibility and stability issues.
  • Correct the issue where the opening position of the Dashboard main window may be incorrect.
https://dl.nssurge.com/mac/v5/Surge-5.2.3-2354-ce8606235be8df196c0e9619a9c8cbbd.zip

Version 5.2.2

  • Fixed the problem where there might be incorrect prompts about system proxy settings being modified by other applications when there is no valid network.
  • Fixed some issues that may occur when using TUIC v5 as the underlying-proxy.
  • Fixed the issue where if WebSocket is enabled, it cannot correctly construct a WebSocket request when directly using an IPv6 address as the vmess hostname.
  • Provide clearer error prompts when the SOCKS5 server does not support UDP relay.
  • Bug fixes.
https://dl.nssurge.com/mac/v5/Surge-5.2.2-2340-74b1e55a52888040394976468a61d973.zip

Version 5.2.1

  • Surge Ponte now can work in LAN-only mode when NAT type doesn't meet the requirement. Devices on same LAN can still access.
  • The connection limiter mechanism added in the previous version has been temporarily removed.
  • Optimize the logic of setting as system proxy function.
  • Fixed a memory leak issue.
  • Bug fixes.
https://dl.nssurge.com/mac/v5/Surge-5.2.1-2333-ef97cd79e935d838387dc99712fb38b3.zip

Version 5.2.0

  • Due to the fixed size of macOS network stack memory, when the network stack buffer is exhausted, the kernel will automatically close the program with the highest occupancy to release resources. This problem may occur when using Surge to take over P2P downloaders. This version will automatically check for this issue and enter safe mode automatically.
  • Surge VIF engine has been upgraded to v3, no longer relying on Packet Filter (pf), solving compatibility issues with virtual machines and network sharing functions. At the same time, connection number limits have been added to avoid system resource exhaustion caused by excessive concurrent requests.
  • Add a connection limiter for single processes and single devices to avoid consuming large amounts of resources for individual devices.
  • Support for QUIC's PMTU discovery, which improves the performance of Surge Ponte and TUIC protocols.
  • Optimize error handling logic of QUIC-based protocols.
  • When forwarding UDP packets using TUIC v5, follow the DF flag of the IP packet. Avoid the issue that can occur when visiting the QUIC website with TUIC v5.
  • Other bug fixes and optimizations.
https://dl.nssurge.com/mac/v5/Surge-5.2.0-2302-721d7db5429609c5a54af922f045a509.zip

Version 5.1.1

  • Added support for TUIC v5 protocol.
  • Optimized the performance of Surge Ponte/TUIC.
  • Optimized the request Note recording when the strategy group is abnormal.
  • Fixed the problem that connection reuse was not done correctly under MITM H2 mode.
  • Fixed the problem that the request of $httpClient/DoH may sometimes be accidentally cancelled.
  • Adjusted the traffic characteristics of Snell v4 protocol.
  • Other bug fixes and optimizations.
https://dl.nssurge.com/mac/v5/Surge-5.1.1-2264-6f04d8ac1bbf1c91178a09124e45e37e.zip

Version 5.1.0

Surge Ponte

  • Surge Ponte supports cross-iCloud account sharing.
  • Fixed issues that might occur when accessing HTTP/1.0 servers via Surge Ponte or TUIC protocol. (e.g. ASUS router management page)

Interface

  • Icon Library: You can now select icons for your device from a library of about 7000 icons.
  • Fixed an issue that the reuse feature could not work properly under Snell V4.
  • SSH protocol now supports server public key fingerprint pinning, see the manual for usage.

Scripts

  • $httpClient supports binary mode.
    • The body of the request supports TypedArray.
    • Passing in binary-mode: true in the request parameters allows the return result to be returned as TypedArray.
  • Fixed the problem that http-request type scripts could not use binary data directly as response.

Others

  • Policy group adds parameter external-policy-modifier, which can be used to adjust external policies.
  • Optimized the request log system
    • Added category marks to the logs.
    • Rule system adds more output for DNS and rulesets.
  • Other bug fixes and optimizations.
https://dl.nssurge.com/mac/v5/Surge-5.1.0-2216-82115a08df678cfa87137a506f7df061.zip

Version 5.0.3

  • Added UDP relay support for the VMess protocol
    • Since the VMess server-side supports UDP forwarding by default, there's no need to add extra parameters to use it.
    • Due to design flaws in the VMess protocol, when using VMess to forward UDP traffic, P2P scenarios may not work, such as voice calls, online gaming, etc. Therefore, it is not recommended to use the VMess protocol.
  • SSH protocol now supports specifying the server's public key fingerprint. Check the manual for more information.
  • The external IP address is now obtained through the STUN protocol and no longer relies on api.my-ip.io.
  • The DDNS now uses the secured IPv6 address instead if a temporary one, when IPv6 is selected.
  • Bug fixes.
https://dl.nssurge.com/mac/v5/Surge-5.0.3-2199-c241935acf37b3ec7f7fa4f5120e8690.zip

Version 5.0.2

  • Due to the new privacy restrictions on macOS, if the Wi-Fi BSSID-related features are used, Surge will request location service permissions to read the Wi-Fi BSSID.
  • Shadow TLS v3 is now supported. Append shadow-tls-version=3 to enable it.
  • Surge Mac now supports Adaptive TLS Fingerprint. For more information, please check the community thread.
  • Supports a new parameter external-policy-modifier for groups to modify the parameters of external policies.
  • The new proxy client notification will only be prompted when a real request is received and will no longer be displayed when being port scanned.
  • Bug fixes.
https://dl.nssurge.com/mac/v5/Surge-5.0.2-2186-2ab1aba0dc49688683b2e4d43200e468.zip

Version 5.0.1

  • The registered Ponte device view is now available when the Ponte switch in off.
  • Fixed a crash while using Surge Dashboard via USB.
  • $httpClient now supports binary mode.
  • Bug fixes.
https://dl.nssurge.com/mac/v5/Surge-5.0.1-2162-22743a4d2f1e0aeb0b872e8f544c2e69.zip
Release Notes - Previous
Surge Mac 5.0
Next - Release Notes
Surge iOS Release Notes
Last modified 17d ago