projects/start-tunnel/release-notes/1.3.0.md

Rama master · réplica de lectura del repositorio original.

**StartTunnel 1.3.0 closes a tracking vector in its UPnP endpoints, serves hostname routes to devices that can only reach it over UPnP, and works as a gateway for ordinary UPnP clients.**

## Highlights

- **Security — the UPnP device description no longer answers web pages.** It named the product and a stable identifier derived from the tunnel's WireGuard key to anyone who could reach it, so a malicious site could rebind its own domain to the gateway and read that from any tunneled phone or laptop — re-identifying the same visitor from any network. Every UPnP endpoint now refuses requests whose `Host` is not an IP address, which a real client always sends and a rebinding page never can.
- **Devices can claim a hostname on a shared port over UPnP, not only PCP.** Where an intermediate device filters the protocol StartOS prefers, it now falls back automatically instead of quietly keeping its port forwards while losing hostname routing. These routes always carry a lease, so a vanished device cannot squat a hostname against its owner.
- **Third-party UPnP clients can use the tunnel as a gateway.** Torrent clients and consumer apps built on the common UPnP library rejected it outright with "no valid UPnP Internet Gateway Device found", or created a mapping and then reported it failed because they could not read it back. StartOS was unaffected.
- **An automatic port forward with a time limit now expires when that time runs out**, rather than being held as though permanent until the tunnel next restarted.
- **`start-tunnel` reaches a daemon that listens on a wildcard address.** A tunnel server binds `0.0.0.0` by nature, and the CLI was left dialling `https://0.0.0.0` with no token attached.
- **`subnet <SUBNET> set-wan` and `subnet <SUBNET> set-ipv6` can be run.** Both asked for the subnet a second time and no invocation satisfied that; they now take it once from the parent command, as the documentation shows.
- **Generated WireGuard configs mark the gateway as accepting inbound connections**, while keeping their StartTunnel header for older StartOS versions.