fix: added single space trim to country search in apiCountryModel.cpp

fix: changed color of backbutton area on api countries page
fix(ui): keep back button pinned in top overlay at countries selection api page
2026-05-08 14:33:23 +00:00 · 2026-03-06 15:25:23 +04:00 · 2026-03-06 15:17:54 +04:00 · 2026-03-02 15:48:33 +04:00 · 2026-02-27 18:07:54 +04:00 · 2026-02-23 16:41:42 +04:00
78 changed files with 1680 additions and 760 deletions
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,10 +10,10 @@ env:

 jobs:
  Build-Linux-Ubuntu:
-    runs-on: 4-core
+    runs-on: android-runner

    env:
-      QT_VERSION: 6.8.3
+      QT_VERSION: 6.10.1
      QIF_VERSION: 4.7
      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
@@ -58,7 +58,7 @@ jobs:

    - name: 'Build project'
      run: |
-        sudo apt-get install libxkbcommon-x11-0
+        sudo apt-get install libxkbcommon-x11-0 libsecret-1-dev
        export QT_BIN_DIR=${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/gcc_64/bin
        export QIF_BIN_DIR=${{ runner.temp }}/Qt/Tools/QtInstallerFramework/${{ env.QIF_VERSION }}/bin
        bash deploy/build_linux.sh
@@ -537,7 +537,7 @@ jobs:
 # ------------------------------------------------------

  Build-Android:
-    runs-on: 4-core
+    runs-on: android-runner

    env:
      ANDROID_BUILD_PLATFORM: android-36
--- a/.github/workflows/tag-upload.yml
+++ b/.github/workflows/tag-upload.yml
@@ -24,7 +24,7 @@ jobs:
      - name: Verify git tag
        run: |
          TAG_NAME=${{ inputs.RELEASE_VERSION }}
-          CMAKE_TAG=$(grep 'project.*VERSION' CMakeLists.txt | sed -E 's/.* ([0-9]+.[0-9]+.[0-9]+.[0-9]+)$/\1/')
+          CMAKE_TAG=$(grep 'set(AMNEZIAVPN_VERSION' CMakeLists.txt | sed -E 's/.*AMNEZIAVPN_VERSION ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*/\1/')
          if [[ "$TAG_NAME" == "$CMAKE_TAG" ]]; then
            echo "Git tag ($TAG_NAME) matches CMakeLists.txt version ($CMAKE_TAG)."
          else
--- a/.gitignore
+++ b/.gitignore
@@ -140,3 +140,6 @@ ios-ne-build.sh
 macos-ne-build.sh
 macos-signed-build.sh
 macos-with-sign-build.sh
+DeveloperIdApplicationCertificate.p12
+DeveloperIdInstallerCertificate.p12
+
--- a/.gitmodules
+++ b/.gitmodules
@@ -14,3 +14,7 @@
 [submodule "client/3rd/QSimpleCrypto"]
 	path = client/3rd/QSimpleCrypto
 	url = https://github.com/amnezia-vpn/QSimpleCrypto.git
+[submodule "client/3rd/qtgamepad"]
+	path = client/3rd/qtgamepad
+	url = https://github.com/amnezia-vpn/qtgamepad.git
+	branch = 6.6
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.25.0 FATAL_ERROR)

 set(PROJECT AmneziaVPN)
-set(AMNEZIAVPN_VERSION 4.8.12.8)
+set(AMNEZIAVPN_VERSION 4.8.13.0)

 project(${PROJECT} VERSION ${AMNEZIAVPN_VERSION}
        DESCRIPTION "AmneziaVPN"
@@ -12,7 +12,7 @@ string(TIMESTAMP CURRENT_DATE "%Y-%m-%d")
 set(RELEASE_DATE "${CURRENT_DATE}")

 set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
-set(APP_ANDROID_VERSION_CODE 2104)
+set(APP_ANDROID_VERSION_CODE 2106)

 if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
    set(MZ_PLATFORM_NAME "linux")
--- a/client/3rd-prebuilt
+++ b/client/3rd-prebuilt
--- a/client/3rd/qtgamepad
+++ b/client/3rd/qtgamepad
--- a/client/CMakeLists.txt
+++ b/client/CMakeLists.txt
@@ -59,7 +59,6 @@ target_include_directories(${PROJECT} PUBLIC
 if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))
    qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_interface.rep)
    qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_process_interface.rep)
-    qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_process_tun2socks.rep)
 endif()

 qt6_add_resources(QRC ${QRC} ${CMAKE_CURRENT_LIST_DIR}/resources.qrc)
@@ -228,4 +227,13 @@ if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
 endif()

 target_sources(${PROJECT} PRIVATE ${SOURCES} ${HEADERS} ${RESOURCES} ${QRC} ${I18NQRC})
-qt_finalize_target(${PROJECT})
+
+# Finalize the executable so Qt can gather/deploy QML modules and plugins correctly (Android needs this).
+if(COMMAND qt_import_qml_plugins)
+    qt_import_qml_plugins(${PROJECT})
+endif()
+if(COMMAND qt_finalize_executable)
+    qt_finalize_executable(${PROJECT})
+else()
+    qt_finalize_target(${PROJECT})
+endif()
--- a/client/android/src/org/amnezia/vpn/AmneziaActivity.kt
+++ b/client/android/src/org/amnezia/vpn/AmneziaActivity.kt
@@ -26,6 +26,8 @@ import android.os.ParcelFileDescriptor
 import android.os.SystemClock
 import android.provider.OpenableColumns
 import android.provider.Settings
+import android.view.InputDevice
+import android.view.KeyEvent
 import android.view.MotionEvent
 import android.view.View
 import android.view.ViewGroup
@@ -88,6 +90,10 @@ class AmneziaActivity : QtActivity() {

    private val actionResultHandlers = mutableMapOf<Int, ActivityResultHandler>()
    private val permissionRequestHandlers = mutableMapOf<Int, PermissionRequestHandler>()
+    
+    private var isActivityResumed = false
+    private var hasWindowFocus = false
+    private val resumeHandler = Handler(Looper.getMainLooper())

    private val vpnServiceEventHandler: Handler by lazy(NONE) {
        object : Handler(Looper.getMainLooper()) {
@@ -260,6 +266,10 @@ class AmneziaActivity : QtActivity() {
    }

    override fun onStop() {
+        isActivityResumed = false
+        hasWindowFocus = false
+        // Cancel all pending operations when activity stops
+        resumeHandler.removeCallbacksAndMessages(null)
        Log.d(TAG, "Stop Amnezia activity")
        doUnbindService()
        mainScope.launch {
@@ -271,35 +281,91 @@ class AmneziaActivity : QtActivity() {

    override fun onWindowFocusChanged(hasFocus: Boolean) {
        super.onWindowFocusChanged(hasFocus)
+        hasWindowFocus = hasFocus
        Log.d(TAG, "Window focus changed: hasFocus=$hasFocus")
+        
+        // Cancel pending operations if window loses focus
+        if (!hasFocus) {
+            resumeHandler.removeCallbacksAndMessages(null)
+        }
    }

+    override fun dispatchKeyEvent(event: KeyEvent): Boolean {
+        val deviceId = event.deviceId
+        val keyCode = event.keyCode
+        val pressed = event.action == KeyEvent.ACTION_DOWN
+        val source = event.source
+
+        if (deviceId < 0 && pressed) {
+            when (keyCode) {
+                KeyEvent.KEYCODE_BUTTON_A,
+                KeyEvent.KEYCODE_BUTTON_B,
+                KeyEvent.KEYCODE_BUTTON_X,
+                KeyEvent.KEYCODE_BUTTON_Y,
+                KeyEvent.KEYCODE_BUTTON_START,
+                KeyEvent.KEYCODE_BUTTON_SELECT,
+                KeyEvent.KEYCODE_DPAD_CENTER -> {
+                    nativeGamepadKeyEvent(0, keyCode, true)
+                    nativeGamepadKeyEvent(0, keyCode, false)
+                    return true
+                }
+            }
+        }
+
+        // Real gamepad events (deviceId >= 0)
+        if (deviceId >= 0) {
+            val isGamepad = (source and InputDevice.SOURCE_GAMEPAD) == InputDevice.SOURCE_GAMEPAD
+            val isJoystick = (source and InputDevice.SOURCE_JOYSTICK) == InputDevice.SOURCE_JOYSTICK
+            val isDpad = (source and InputDevice.SOURCE_DPAD) == InputDevice.SOURCE_DPAD
+            if (isGamepad || isJoystick || isDpad) {
+                nativeGamepadKeyEvent(deviceId, keyCode, pressed)
+                return true
+            }
+        }
+
+        return super.dispatchKeyEvent(event)
+    }
+
+    private external fun nativeGamepadKeyEvent(deviceId: Int, keyCode: Int, pressed: Boolean)
+
    override fun onPause() {
        super.onPause()
+        isActivityResumed = false
+        // Cancel all pending operations when activity pauses
+        resumeHandler.removeCallbacksAndMessages(null)
        Log.d(TAG, "Pause Amnezia activity")
    }

    override fun onResume() {
        super.onResume()
-       /* if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+        isActivityResumed = true
+        Log.d(TAG, "Resume Amnezia activity")
+
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
            window.decorView.apply {
                invalidate()

-                postDelayed({
-                    sendTouch(1f, 1f)
+                resumeHandler.postDelayed({
+                    // Check if activity is still resumed and has focus before executing
+                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
+                        sendTouch(1f, 1f)
+                    }
                }, 100)
                
-                postDelayed({
-                    sendTouch(2f, 2f)
+                resumeHandler.postDelayed({
+                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
+                        sendTouch(2f, 2f)
+                    }
                }, 200)
                
-                postDelayed({
-                    requestLayout()
-                    invalidate()
+                resumeHandler.postDelayed({
+                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
+                        requestLayout()
+                        invalidate()
+                    }
                }, 250)
            }
-        }  */      
-        Log.d(TAG, "Resume Amnezia activity")
+        }
    }

    private fun configureWindowForEdgeToEdge() {
@@ -362,6 +428,10 @@ class AmneziaActivity : QtActivity() {
    }

    override fun onDestroy() {
+        isActivityResumed = false
+        hasWindowFocus = false
+        // Cancel all pending operations when activity is destroyed
+        resumeHandler.removeCallbacksAndMessages(null)
        Log.d(TAG, "Destroy Amnezia activity")
        unregisterBroadcastReceiver(notificationStateReceiver)
        notificationStateReceiver = null
--- a/client/android/src/org/amnezia/vpn/TvFilePicker.kt
+++ b/client/android/src/org/amnezia/vpn/TvFilePicker.kt
@@ -1,7 +1,10 @@
 package org.amnezia.vpn

 import android.content.ActivityNotFoundException
+import android.content.Context
 import android.content.Intent
+import android.content.pm.PackageManager
+import android.os.Build
 import android.os.Bundle
 import androidx.activity.ComponentActivity
 import androidx.activity.result.contract.ActivityResultContracts
@@ -11,7 +14,25 @@ private const val TAG = "TvFilePicker"

 class TvFilePicker : ComponentActivity() {

-    private val fileChooseResultLauncher = registerForActivityResult(ActivityResultContracts.GetContent()) {
+    private val fileChooseResultLauncher = registerForActivityResult(object : ActivityResultContracts.OpenDocument() {
+        override fun createIntent(context: Context, input: Array<String>): Intent {
+            val intent = super.createIntent(context, input)
+
+            val activitiesToResolveIntent = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                context.packageManager.queryIntentActivities(intent, PackageManager.ResolveInfoFlags.of(PackageManager.MATCH_DEFAULT_ONLY.toLong()))
+            } else {
+                @Suppress("DEPRECATION")
+                context.packageManager.queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY)
+            }
+            if (activitiesToResolveIntent.all {
+                    val name = it.activityInfo.packageName
+                    name.startsWith("com.google.android.tv.frameworkpackagestubs") || name.startsWith("com.android.tv.frameworkpackagestubs")
+                }) {
+                throw ActivityNotFoundException()
+            }
+            return intent
+        }
+    }) {
        setResult(RESULT_OK, Intent().apply { data = it })
        finish()
    }
@@ -31,7 +52,7 @@ class TvFilePicker : ComponentActivity() {
    private fun getFile() {
        try {
            Log.v(TAG, "getFile")
-            fileChooseResultLauncher.launch("*/*")
+            fileChooseResultLauncher.launch(arrayOf("*/*"))
        } catch (_: ActivityNotFoundException) {
            Log.w(TAG, "Activity not found")
            setResult(RESULT_CANCELED, Intent().apply { putExtra("activityNotFound", true) })
--- a/client/cmake/3rdparty.cmake
+++ b/client/cmake/3rdparty.cmake
@@ -83,6 +83,26 @@ add_compile_definitions(_WINSOCKAPI_)
 set(BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE)
 set(BUILD_WITH_QT6 ON)
 add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtkeychain)
+
+if(ANDROID)
+    # Use qtgamepad from amnezia-vpn/qtgamepad repository
+    # Only if Qt6CorePrivate is available (required by qtgamepad)
+    find_package(Qt6CorePrivate CONFIG QUIET)
+    if(Qt6CorePrivate_FOUND)
+        add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtgamepad)
+        # Link both the C++ module and QML plugin
+        if(TARGET GamepadLegacy)
+            target_link_libraries(${PROJECT} PRIVATE GamepadLegacy)
+        endif()
+        if(TARGET GamepadLegacyQuickPrivate)
+            target_link_libraries(${PROJECT} PRIVATE GamepadLegacyQuickPrivate)
+        endif()
+        message(STATUS "Gamepad support enabled for Android")
+    else()
+        message(STATUS "Qt6CorePrivate not found. Gamepad support disabled for Android.")
+    endif()
+endif()
+
 set(LIBS ${LIBS} qt6keychain)

 include_directories(
--- a/client/cmake/sources.cmake
+++ b/client/cmake/sources.cmake
@@ -181,7 +181,6 @@ if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))

    set(HEADERS ${HEADERS}
        ${CLIENT_ROOT_DIR}/core/ipcclient.h
-        ${CLIENT_ROOT_DIR}/core/privileged_process.h
        ${CLIENT_ROOT_DIR}/ui/systemtray_notificationhandler.h
        ${CLIENT_ROOT_DIR}/protocols/openvpnprotocol.h
        ${CLIENT_ROOT_DIR}/protocols/openvpnovercloakprotocol.h
@@ -194,7 +193,6 @@ if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))

    set(SOURCES ${SOURCES}
        ${CLIENT_ROOT_DIR}/core/ipcclient.cpp
-        ${CLIENT_ROOT_DIR}/core/privileged_process.cpp
        ${CLIENT_ROOT_DIR}/mozilla/localsocketcontroller.cpp
        ${CLIENT_ROOT_DIR}/ui/systemtray_notificationhandler.cpp
        ${CLIENT_ROOT_DIR}/protocols/openvpnprotocol.cpp
--- a/client/core/controllers/serverController.cpp
+++ b/client/core/controllers/serverController.cpp
@@ -419,6 +419,18 @@ ErrorCode ServerController::installDockerWorker(const ServerCredentials &credent
                      cbReadStdOut, cbReadStdErr);

    qDebug().noquote() << "ServerController::installDockerWorker" << stdOut;
+    if (container == DockerContainer::Awg2) {
+        QRegularExpression regex(R"(Linux\s+(\d+)\.(\d+)[^\d]*)");
+        QRegularExpressionMatch match = regex.match(stdOut);
+        if (match.hasMatch()) {
+            int majorVersion = match.captured(1).toInt();
+            int minorVersion = match.captured(2).toInt();
+
+            if (majorVersion < 4 || (majorVersion == 4 && minorVersion < 14)) {
+                return ErrorCode::ServerLinuxKernelTooOld;
+            }
+        }
+    }
    if (stdOut.contains("lock"))
        return ErrorCode::ServerPacketManagerError;
    if (stdOut.contains("command not found"))
--- a/client/core/defs.h
+++ b/client/core/defs.h
@@ -61,6 +61,7 @@ namespace amnezia
        ServerDockerOnCgroupsV2 = 211,
        ServerCgroupMountpoint = 212,
        DockerPullRateLimit = 213,
+        ServerLinuxKernelTooOld = 214,

        // Ssh connection errors
        SshRequestDeniedError = 300,
--- a/client/core/errorstrings.cpp
+++ b/client/core/errorstrings.cpp
@@ -29,6 +29,7 @@ QString errorString(ErrorCode code) {
    case(ErrorCode::ServerDockerOnCgroupsV2): errorMessage = QObject::tr("Docker error: runc doesn't work on cgroups v2"); break;
    case(ErrorCode::ServerCgroupMountpoint): errorMessage = QObject::tr("Server error: cgroup mountpoint does not exist"); break;
    case(ErrorCode::DockerPullRateLimit): errorMessage = QObject::tr("Docker error: The pull rate limit has been reached"); break;
+    case(ErrorCode::ServerLinuxKernelTooOld): errorMessage = QObject::tr("Server error: Linux kernel is too old"); break;

    // Libssh errors
    case(ErrorCode::SshRequestDeniedError): errorMessage = QObject::tr("SSH request was denied"); break;
--- a/client/core/ipcclient.cpp
+++ b/client/core/ipcclient.cpp
@@ -7,7 +7,6 @@ IpcClient::IpcClient(QObject *parent) : QObject(parent)
 {
    m_node.connectToNode(QUrl("local:" + amnezia::getIpcServiceUrl()));
    m_interface.reset(m_node.acquire<IpcInterfaceReplica>());
-    m_tun2socks.reset(m_node.acquire<IpcProcessTun2SocksReplica>());
 }

 IpcClient& IpcClient::Instance()
@@ -33,68 +32,43 @@ QSharedPointer<IpcInterfaceReplica> IpcClient::Interface()
    return rep;
 }

-QSharedPointer<IpcProcessTun2SocksReplica> IpcClient::InterfaceTun2Socks()
+QSharedPointer<IpcProcessInterfaceReplica> IpcClient::CreatePrivilegedProcess()
 {
-    QSharedPointer<IpcProcessTun2SocksReplica> rep = Instance().m_tun2socks;
-    if (rep.isNull()) {
-        qCritical() << "IpcClient::InterfaceTun2Socks: Replica is undefined";
-        return nullptr;
-    }
-    if (!rep->waitForSource(1000)) {
-        qCritical() << "IpcClient::InterfaceTun2Socks: Failed to initialize replica";
-        return nullptr;
-    }
-    if (!rep->isReplicaValid()) {
-        qWarning() << "IpcClient::InterfaceTun2Socks(): Replica is invalid";
-    }
-    return rep;
-}
-
-QSharedPointer<PrivilegedProcess> IpcClient::CreatePrivilegedProcess()
-{
-    QSharedPointer<IpcInterfaceReplica> rep = Interface();
-    if (!rep) {
-        qCritical() << "IpcClient::createPrivilegedProcess: Replica is invalid";
-        return nullptr;
-    }
-
-    QRemoteObjectPendingReply<int> pidReply = rep->createPrivilegedProcess();
-    if (!pidReply.waitForFinished(5000)){
-        qCritical() << "IpcClient::createPrivilegedProcess: Failed to execute RO createPrivilegedProcess call";
-        return nullptr;
-    }
-
-    int pid = pidReply.returnValue();
-    QSharedPointer<ProcessDescriptor> pd(new ProcessDescriptor());
-
-    pd->localSocket.reset(new QLocalSocket(pd->replicaNode.data()));
-
-    connect(pd->localSocket.data(), &QLocalSocket::connected, pd->replicaNode.data(), [pd]() {
-        pd->replicaNode->addClientSideConnection(pd->localSocket.data());
-
-        IpcProcessInterfaceReplica *repl = pd->replicaNode->acquire<IpcProcessInterfaceReplica>();
-        // TODO: rework the unsafe cast below
-        PrivilegedProcess *priv = static_cast<PrivilegedProcess *>(repl);
-        pd->ipcProcess.reset(priv);
-        if (!pd->ipcProcess) {
-            qWarning() << "Acquire PrivilegedProcess failed";
-        } else {
-            pd->ipcProcess->waitForSource(1000);
-            if (!pd->ipcProcess->isReplicaValid()) {
-                qWarning() << "PrivilegedProcess replica is not connected!";
-            }
-
-            QObject::connect(pd->ipcProcess.data(), &PrivilegedProcess::destroyed, pd->ipcProcess.data(),
-                             [pd]() { pd->replicaNode->deleteLater(); });
+    return withInterface([](QSharedPointer<IpcInterfaceReplica> &iface) -> QSharedPointer<IpcProcessInterfaceReplica> {
+        auto createPrivilegedProcess = iface->createPrivilegedProcess();
+        if (!createPrivilegedProcess.waitForFinished()) {
+            qCritical() << "Failed to create privileged process";
+            return nullptr;
        }
-    });

-    pd->localSocket->connectToServer(amnezia::getIpcProcessUrl(pid));
-    if (!pd->localSocket->waitForConnected()) {
-        qCritical() << "IpcClient::createPrivilegedProcess: Failed to connect to process' socket";
+        const int pid = createPrivilegedProcess.returnValue();
+
+        auto* node = new QRemoteObjectNode();
+        node->connectToNode(QUrl(QString("local:%1").arg(amnezia::getIpcProcessUrl(pid))));
+
+        QSharedPointer<IpcProcessInterfaceReplica> rep(
+            node->acquire<IpcProcessInterfaceReplica>(),
+            [node] (IpcProcessInterfaceReplica *ptr) {
+                delete ptr;
+                node->deleteLater();
+            }
+        );
+        if (rep.isNull()) {
+            qCritical() << "IpcClient::CreatePrivilegedProcess(): Failed to acquire replica";
+            return nullptr;
+        }
+        if (!rep->waitForSource()) {
+            qCritical() << "IpcClient::CreatePrivilegedProcess(): Failed to initialize replica";
+            return nullptr;
+        }
+        if (!rep->isReplicaValid()) {
+            qCritical() << "IpcClient::CreatePrivilegedProcess(): Replica is invalid";
+            return nullptr;
+        }
+
+        return rep;
+    },
+    []() -> QSharedPointer<IpcProcessInterfaceReplica> {
        return nullptr;
-    }
-
-    auto processReplica = QSharedPointer<PrivilegedProcess>(pd->ipcProcess);
-    return processReplica;
+    });
 }
--- a/client/core/ipcclient.h
+++ b/client/core/ipcclient.h
@@ -5,9 +5,7 @@
 #include <QObject>

 #include "rep_ipc_interface_replica.h"
-#include "rep_ipc_process_tun2socks_replica.h"
-
-#include "privileged_process.h"
+#include "rep_ipc_process_interface_replica.h"

 class IpcClient : public QObject
 {
@@ -18,8 +16,7 @@ public:
    static IpcClient& Instance();

    static QSharedPointer<IpcInterfaceReplica> Interface();
-    static QSharedPointer<IpcProcessTun2SocksReplica> InterfaceTun2Socks();
-    static QSharedPointer<PrivilegedProcess> CreatePrivilegedProcess();
+    static QSharedPointer<IpcProcessInterfaceReplica> CreatePrivilegedProcess();

    template <typename Func>
    static auto withInterface(Func func)
@@ -54,18 +51,6 @@ signals:
 private:
    QRemoteObjectNode m_node;
    QSharedPointer<IpcInterfaceReplica> m_interface;
-    QSharedPointer<IpcProcessTun2SocksReplica> m_tun2socks;
-
-    struct ProcessDescriptor {
-        ProcessDescriptor () {
-            replicaNode = QSharedPointer<QRemoteObjectNode>(new QRemoteObjectNode());
-            ipcProcess = QSharedPointer<PrivilegedProcess>();
-            localSocket = QSharedPointer<QLocalSocket>();
-        }
-        QSharedPointer<PrivilegedProcess> ipcProcess;
-        QSharedPointer<QRemoteObjectNode> replicaNode;
-        QSharedPointer<QLocalSocket> localSocket;
-    };
 };

 #endif // IPCCLIENT_H
--- a/client/core/privileged_process.cpp
+++ b/client/core/privileged_process.cpp
@@ -1,27 +0,0 @@
-#include "privileged_process.h"
-
-PrivilegedProcess::PrivilegedProcess() :
-    IpcProcessInterfaceReplica()
-{
-}
-
-PrivilegedProcess::~PrivilegedProcess()
-{
-    qDebug() << "PrivilegedProcess::~PrivilegedProcess()";
-}
-
-void PrivilegedProcess::waitForFinished(int msecs)
-{
-    QSharedPointer<QEventLoop> loop(new QEventLoop);
-    connect(this, &PrivilegedProcess::finished, this, [this, loop](int exitCode, QProcess::ExitStatus exitStatus) mutable{
-        loop->quit();
-        loop.clear();
-    });
-
-    QTimer::singleShot(msecs, this, [this, loop]() mutable {
-        loop->quit();
-        loop.clear();
-    });
-
-    loop->exec();
-}
--- a/client/core/privileged_process.h
+++ b/client/core/privileged_process.h
@@ -1,24 +0,0 @@
-#ifndef PRIVILEGED_PROCESS_H
-#define PRIVILEGED_PROCESS_H
-
-#include <QObject>
-
-#include "rep_ipc_process_interface_replica.h"
-// This class is dangerous - instance of this class casted from base class,
-// so it support only functions
-// Do not add any members into it
-//
-class PrivilegedProcess : public IpcProcessInterfaceReplica
-{
-    Q_OBJECT
-public:
-    PrivilegedProcess();
-    ~PrivilegedProcess() override;
-
-    void waitForFinished(int msecs);
-
-};
-
-#endif // PRIVILEGED_PROCESS_H
-
-
--- a/client/mozilla/localsocketcontroller.cpp
+++ b/client/mozilla/localsocketcontroller.cpp
@@ -270,12 +270,7 @@ void LocalSocketController::activate(const QJsonObject &rawConfig) {
             && !wgConfig.value(amnezia::config_key::initPacketMagicHeader).isUndefined()
             && !wgConfig.value(amnezia::config_key::responsePacketMagicHeader).isUndefined()
             && !wgConfig.value(amnezia::config_key::underloadPacketMagicHeader).isUndefined()
-             && !wgConfig.value(amnezia::config_key::transportPacketMagicHeader).isUndefined()
-             && !wgConfig.value(amnezia::config_key::specialJunk1).isUndefined()
-             && !wgConfig.value(amnezia::config_key::specialJunk2).isUndefined()
-             && !wgConfig.value(amnezia::config_key::specialJunk3).isUndefined()
-             && !wgConfig.value(amnezia::config_key::specialJunk4).isUndefined()
-             && !wgConfig.value(amnezia::config_key::specialJunk5).isUndefined()) {
+             && !wgConfig.value(amnezia::config_key::transportPacketMagicHeader).isUndefined()) {
    json.insert(amnezia::config_key::junkPacketCount, wgConfig.value(amnezia::config_key::junkPacketCount));
    json.insert(amnezia::config_key::junkPacketMinSize, wgConfig.value(amnezia::config_key::junkPacketMinSize));
    json.insert(amnezia::config_key::junkPacketMaxSize, wgConfig.value(amnezia::config_key::junkPacketMaxSize));
--- a/client/platforms/windows/daemon/windowsdaemon.cpp
+++ b/client/platforms/windows/daemon/windowsdaemon.cpp
@@ -62,6 +62,9 @@ void WindowsDaemon::prepareActivation(const InterfaceConfig& config, int inetAda
 }

 void WindowsDaemon::activateSplitTunnel(const InterfaceConfig& config, int vpnAdapterIndex) {
+    if (m_splitTunnelManager == nullptr)
+        return;
+
  if (config.m_vpnDisabledApps.length() > 0) {
      m_splitTunnelManager->start(m_inetAdapterIndex, vpnAdapterIndex);
      m_splitTunnelManager->excludeApps(config.m_vpnDisabledApps);
--- a/client/protocols/openvpnprotocol.cpp
+++ b/client/protocols/openvpnprotocol.cpp
@@ -232,12 +232,6 @@ ErrorCode OpenVpnProtocol::start()
        return ErrorCode::AmneziaServiceConnectionFailed;
    }

-    m_openVpnProcess->waitForSource(5000);
-    if (!m_openVpnProcess->isInitialized()) {
-        qWarning() << "IpcProcess replica is not connected!";
-        setLastError(ErrorCode::AmneziaServiceConnectionFailed);
-        return ErrorCode::AmneziaServiceConnectionFailed;
-    }
    m_openVpnProcess->setProgram(PermittedProcess::OpenVPN);
    QStringList arguments({
            "--config", configPath(), "--management", m_managementHost, QString::number(mgmtPort),
@@ -246,13 +240,13 @@ ErrorCode OpenVpnProtocol::start()
    m_openVpnProcess->setArguments(arguments);

    qDebug() << arguments.join(" ");
-    connect(m_openVpnProcess.data(), &PrivilegedProcess::errorOccurred,
+    connect(m_openVpnProcess.data(), &IpcProcessInterfaceReplica::errorOccurred,
            [&](QProcess::ProcessError error) { qDebug() << "PrivilegedProcess errorOccurred" << error; });

-    connect(m_openVpnProcess.data(), &PrivilegedProcess::stateChanged,
+    connect(m_openVpnProcess.data(), &IpcProcessInterfaceReplica::stateChanged,
            [&](QProcess::ProcessState newState) { qDebug() << "PrivilegedProcess stateChanged" << newState; });

-    connect(m_openVpnProcess.data(), &PrivilegedProcess::finished, this,
+    connect(m_openVpnProcess.data(), &IpcProcessInterfaceReplica::finished, this,
            [&]() { setConnectionState(Vpn::ConnectionState::Disconnected); });

    m_openVpnProcess->start();
--- a/client/protocols/openvpnprotocol.h
+++ b/client/protocols/openvpnprotocol.h
@@ -53,7 +53,7 @@ private:
    void updateRouteGateway(QString line);
    void updateVpnGateway(const QString &line);

-    QSharedPointer<PrivilegedProcess> m_openVpnProcess;
+    QSharedPointer<IpcProcessInterfaceReplica> m_openVpnProcess;
 };

 #endif // OPENVPNPROTOCOL_H
--- a/client/protocols/protocols_defs.h
+++ b/client/protocols/protocols_defs.h
@@ -233,7 +233,7 @@ namespace amnezia
            constexpr char defaultResponsePacketMagicHeader[] = "3288052141";
            constexpr char defaultTransportPacketMagicHeader[] = "2528465083";
            constexpr char defaultUnderloadPacketMagicHeader[] = "1766607858";
-            constexpr char defaultSpecialJunk1[] = "<b 0x084481800001000300000000077469636b65747306776964676574096b696e6f706f69736b0272750000010001c00c0005000100000039001806776964676574077469636b6574730679616e646578c025c0390005000100000039002b1765787465726e616c2d7469636b6574732d776964676574066166697368610679616e646578036e657400c05d000100010000001c000457fafe25>";
+            constexpr char defaultSpecialJunk1[] = "<r 2><b 0x858000010001000000000669636c6f756403636f6d0000010001c00c000100010000105a00044d583737>";
            constexpr char defaultSpecialJunk2[] = "";
            constexpr char defaultSpecialJunk3[] = "";
            constexpr char defaultSpecialJunk4[] = "";
--- a/client/protocols/xrayprotocol.cpp
+++ b/client/protocols/xrayprotocol.cpp
@@ -1,6 +1,7 @@
 #include "xrayprotocol.h"

 #include "core/ipcclient.h"
+#include "ipc.h"
 #include "utilities.h"
 #include "core/networkUtilities.h"

@@ -9,14 +10,37 @@
 #include <QJsonObject>
 #include <QNetworkInterface>
 #include <QJsonDocument>
+#include <QtCore/qlogging.h>
+#include <QtCore/qobjectdefs.h>
+#include <QtCore/qprocess.h>
+
+#ifdef Q_OS_MACOS
+static const QString tunName = "utun22";
+#else
+static const QString tunName = "tun2";
+#endif

 XrayProtocol::XrayProtocol(const QJsonObject &configuration, QObject *parent) : VpnProtocol(configuration, parent)
 {
-    readXrayConfiguration(configuration);
-    m_routeGateway = NetworkUtilities::getGatewayAndIface().first;
    m_vpnGateway = amnezia::protocols::xray::defaultLocalAddr;
    m_vpnLocalAddress = amnezia::protocols::xray::defaultLocalAddr;
-    m_t2sProcess = IpcClient::InterfaceTun2Socks();
+    m_routeGateway = NetworkUtilities::getGatewayAndIface().first;
+
+    m_routeMode = static_cast<Settings::RouteMode>(configuration.value(amnezia::config_key::splitTunnelType).toInt());
+    m_remoteAddress = NetworkUtilities::getIPAddress(m_rawConfig.value(amnezia::config_key::hostName).toString());
+
+    const QString primaryDns = configuration.value(amnezia::config_key::dns1).toString();
+    m_dnsServers.push_back(QHostAddress(primaryDns));
+    if (primaryDns != amnezia::protocols::dns::amneziaDnsIp) {
+        const QString secondaryDns = configuration.value(amnezia::config_key::dns2).toString();
+        m_dnsServers.push_back(QHostAddress(secondaryDns));
+    }
+
+    QJsonObject xrayConfiguration = configuration.value(ProtocolProps::key_proto_config_data(Proto::Xray)).toObject();
+    if (xrayConfiguration.isEmpty()) {
+        xrayConfiguration = configuration.value(ProtocolProps::key_proto_config_data(Proto::SSXray)).toObject();
+    }
+    m_xrayConfig = xrayConfiguration;
 }

 XrayProtocol::~XrayProtocol()
@@ -28,117 +52,197 @@ XrayProtocol::~XrayProtocol()
 ErrorCode XrayProtocol::start()
 {
    qDebug() << "XrayProtocol::start()";
+    setConnectionState(Vpn::ConnectionState::Connecting);

-    const ErrorCode err = IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
-        iface->xrayStart(QJsonDocument(m_xrayConfig).toJson());
-        return ErrorCode::NoError;
+    return IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        auto xrayStart = iface->xrayStart(QJsonDocument(m_xrayConfig).toJson());
+        if (!xrayStart.waitForFinished() || !xrayStart.returnValue()) {
+            qCritical() << "Failed to start xray";
+            return ErrorCode::XrayExecutableCrashed;
+        }
+        return startTun2Socks();
    }, [] () {
        return ErrorCode::AmneziaServiceConnectionFailed;
    });
-    if (err != ErrorCode::NoError)
-        return err;
-
-    setConnectionState(Vpn::ConnectionState::Connecting);
-    return startTun2Sock();
-}
-
-ErrorCode XrayProtocol::startTun2Sock()
-{
-    m_t2sProcess->start();
-
-    connect(m_t2sProcess.data(), &IpcProcessTun2SocksReplica::stateChanged, this,
-            [&](QProcess::ProcessState newState) { qDebug() << "PrivilegedProcess stateChanged" << newState; });
-
-    connect(m_t2sProcess.data(), &IpcProcessTun2SocksReplica::setConnectionState, this, [&](int vpnState) {
-        qDebug() << "PrivilegedProcess setConnectionState " << vpnState;
-        IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
-            if (vpnState == Vpn::ConnectionState::Connected) {
-                setConnectionState(Vpn::ConnectionState::Connecting);
-                QList<QHostAddress> dnsAddr;
-
-                dnsAddr.push_back(QHostAddress(m_primaryDNS));
-                // We don't use secondary DNS if primary DNS is AmneziaDNS
-                if (!m_primaryDNS.contains(amnezia::protocols::dns::amneziaDnsIp)) {
-                    dnsAddr.push_back(QHostAddress(m_secondaryDNS));
-                }
-    #ifdef Q_OS_WIN
-                QThread::msleep(8000);
-    #endif
-    #ifdef Q_OS_MACOS
-                QThread::msleep(5000);
-                iface->createTun("utun22", amnezia::protocols::xray::defaultLocalAddr);
-                iface->updateResolvers("utun22", dnsAddr);
-    #endif
-    #ifdef Q_OS_LINUX
-                QThread::msleep(1000);
-                iface->createTun("tun2", amnezia::protocols::xray::defaultLocalAddr);
-                iface->updateResolvers("tun2", dnsAddr);
-    #endif
-                if (m_routeMode == Settings::RouteMode::VpnAllSites) {
-                    iface->routeAddList(m_vpnGateway, QStringList() << "1.0.0.0/8" << "2.0.0.0/7" << "4.0.0.0/6" << "8.0.0.0/5" << "16.0.0.0/4" << "32.0.0.0/3" << "64.0.0.0/2" << "128.0.0.0/1");
-                }
-                iface->StopRoutingIpv6();
-    #ifdef Q_OS_WIN
-                iface->updateResolvers("tun2", dnsAddr);
-    #endif
-                setConnectionState(Vpn::ConnectionState::Connected);
-            }
-    #if !defined(Q_OS_MACOS)
-            if (vpnState == Vpn::ConnectionState::Disconnected) {
-                setConnectionState(Vpn::ConnectionState::Disconnected);
-                iface->deleteTun("tun2");
-                iface->StartRoutingIpv6();
-                iface->clearSavedRoutes();
-            }
-#endif
-        });
-    });
-
-    return ErrorCode::NoError;
 }

 void XrayProtocol::stop()
 {
    qDebug() << "XrayProtocol::stop()";
+    setConnectionState(Vpn::ConnectionState::Disconnecting);

    IpcClient::withInterface([](QSharedPointer<IpcInterfaceReplica> iface) {
-#ifdef AMNEZIA_DESKTOP
-        QRemoteObjectPendingReply<bool> StartRoutingIpv6Resp = iface->StartRoutingIpv6();
-        if (!StartRoutingIpv6Resp.waitForFinished(1000)) {
-            qWarning() << "XrayProtocol::stop(): Failed to start routing ipv6";
-        }
+        auto disableKillSwitch = iface->disableKillSwitch();
+        if (!disableKillSwitch.waitForFinished() || !disableKillSwitch.returnValue())
+            qWarning() << "Failed to disable killswitch";

-        QRemoteObjectPendingReply<bool> restoreResolvers = iface->restoreResolvers();
-        if (!restoreResolvers.waitForFinished(1000)) {
-            qWarning() << "XrayProtocol::stop(): Failed to restore resolvers";
-        }
+        auto StartRoutingIpv6 = iface->StartRoutingIpv6();
+        if (!StartRoutingIpv6.waitForFinished() || !StartRoutingIpv6.returnValue())
+            qWarning() << "Failed to start routing ipv6";

-    #if !defined(Q_OS_MACOS)
-        QRemoteObjectPendingReply<bool> deleteTunResp = iface->deleteTun("tun2");
-        if (!deleteTunResp.waitForFinished(1000)) {
-            qWarning() << "XrayProtocol::stop(): Failed to delete tun";
-        }
-    #endif
-#endif
-        iface->xrayStop();
+        auto restoreResolvers = iface->restoreResolvers();
+        if (!restoreResolvers.waitForFinished() || !restoreResolvers.returnValue())
+            qWarning() << "Failed to restore resolvers";
+
+        auto deleteTun = iface->deleteTun(tunName);
+        if (!deleteTun.waitForFinished() || !deleteTun.returnValue())
+            qWarning() << "Failed to delete tun";
+
+        auto xrayStop = iface->xrayStop();
+        if (!xrayStop.waitForFinished() || !xrayStop.returnValue())
+            qWarning() << "Failed to stop xray";
    });

-    if (m_t2sProcess) {
-        m_t2sProcess->stop();
-        QThread::msleep(200);
+    if (m_tun2socksProcess) {
+        m_tun2socksProcess->blockSignals(true);
+
+#ifndef Q_OS_WIN
+        m_tun2socksProcess->terminate();
+        auto waitForFinished = m_tun2socksProcess->waitForFinished(1000);
+        if (!waitForFinished.waitForFinished() || !waitForFinished.returnValue()) {
+            qWarning() << "Failed to terminate tun2socks. Killing the process...";
+            m_tun2socksProcess->kill();
+        }
+#else
+        // terminate does not do anything useful on Windows
+        // so just kill the process
+        m_tun2socksProcess->kill();
+#endif
+
+        m_tun2socksProcess->close();
+        m_tun2socksProcess.reset();
    }

    setConnectionState(Vpn::ConnectionState::Disconnected);
 }

-void XrayProtocol::readXrayConfiguration(const QJsonObject &configuration)
+ErrorCode XrayProtocol::startTun2Socks()
 {
-    QJsonObject xrayConfiguration = configuration.value(ProtocolProps::key_proto_config_data(Proto::Xray)).toObject();
-    if (xrayConfiguration.isEmpty()) {
-        xrayConfiguration = configuration.value(ProtocolProps::key_proto_config_data(Proto::SSXray)).toObject();
+    m_tun2socksProcess = IpcClient::CreatePrivilegedProcess();
+    if (!m_tun2socksProcess->waitForSource()) {
+        return ErrorCode::AmneziaServiceConnectionFailed;
    }
-    m_xrayConfig = xrayConfiguration;
-    m_routeMode = static_cast<Settings::RouteMode>(configuration.value(amnezia::config_key::splitTunnelType).toInt());
-    m_primaryDNS = configuration.value(amnezia::config_key::dns1).toString();
-    m_secondaryDNS = configuration.value(amnezia::config_key::dns2).toString();
+
+    m_tun2socksProcess->setProgram(PermittedProcess::Tun2Socks);
+    m_tun2socksProcess->setArguments({"-device", QString("tun://%1").arg(tunName), "-proxy", "socks5://127.0.0.1:10808" });
+
+    connect(m_tun2socksProcess.data(), &IpcProcessInterfaceReplica::readyReadStandardOutput, this, [this]() {
+        auto readAllStandardOutput = m_tun2socksProcess->readAllStandardOutput();
+        if (!readAllStandardOutput.waitForFinished()) {
+            qWarning() << "Failed to read output from tun2socks";
+            return;
+        }
+
+        const QString line = readAllStandardOutput.returnValue();
+
+        if (!line.contains("[TCP]") && !line.contains("[UDP]"))
+            qDebug() << "[tun2socks]:" << line;
+        
+        if (line.contains("[STACK] tun://") && line.contains("<-> socks5://127.0.0.1")) {
+            disconnect(m_tun2socksProcess.data(), &IpcProcessInterfaceReplica::readyReadStandardOutput, this, nullptr);
+
+            if (ErrorCode res = setupRouting(); res != ErrorCode::NoError) {
+                stop();
+                setLastError(res);
+            } else {
+                setConnectionState(Vpn::ConnectionState::Connected);
+            }
+        }
+    }, Qt::QueuedConnection);
+
+    connect(m_tun2socksProcess.data(), &IpcProcessInterfaceReplica::finished, this, [this](int exitCode, QProcess::ExitStatus exitStatus) {
+        if (exitStatus == QProcess::ExitStatus::CrashExit) {
+            qCritical() << "Tun2socks process crashed!";
+        } else {
+            qCritical() << QString("Tun2socks process was closed with %1 exit code").arg(exitCode);
+        }
+        stop();
+        setLastError(ErrorCode::Tun2SockExecutableCrashed);
+    }, Qt::QueuedConnection);
+
+    m_tun2socksProcess->start();
+    return ErrorCode::NoError;
+}
+
+ErrorCode XrayProtocol::setupRouting() {
+    return IpcClient::withInterface([this](QSharedPointer<IpcInterfaceReplica> iface) -> ErrorCode {
+#ifdef Q_OS_WIN
+        const int inetAdapterIndex = NetworkUtilities::AdapterIndexTo(QHostAddress(m_remoteAddress));
+#endif
+        auto createTun = iface->createTun(tunName, amnezia::protocols::xray::defaultLocalAddr);
+        if (!createTun.waitForFinished() || !createTun.returnValue()) {
+            qCritical() << "Failed to assign IP address for TUN";
+            return ErrorCode::InternalError;
+        }
+
+        auto updateResolvers = iface->updateResolvers(tunName, m_dnsServers);
+        if (!updateResolvers.waitForFinished() || !updateResolvers.returnValue()) {
+            qCritical() << "Failed to set DNS resolvers for TUN";
+            return ErrorCode::InternalError;
+        }
+
+#ifdef Q_OS_WIN
+        int vpnAdapterIndex = -1;
+        QList<QNetworkInterface> netInterfaces = QNetworkInterface::allInterfaces();
+        for (auto& netInterface : netInterfaces) {
+            for (auto& address : netInterface.addressEntries()) {
+                if (m_vpnLocalAddress == address.ip().toString())
+                    vpnAdapterIndex = netInterface.index();
+            }
+        }
+#else
+        static const int vpnAdapterIndex = 0;
+#endif
+        const bool killSwitchEnabled = QVariant(m_rawConfig.value(config_key::killSwitchOption).toString()).toBool();
+        if (killSwitchEnabled) {
+            if (vpnAdapterIndex != -1) {
+                QJsonObject config = m_rawConfig;
+                config.insert("vpnServer", m_remoteAddress);
+
+                auto enableKillSwitch = IpcClient::Interface()->enableKillSwitch(config, vpnAdapterIndex);
+                if (!enableKillSwitch.waitForFinished() || !enableKillSwitch.returnValue()) {
+                    qCritical() << "Failed to enable killswitch";
+                    return ErrorCode::InternalError;
+                }
+            } else
+                qWarning() << "Failed to get vpnAdapterIndex. Killswitch disabled";
+        }
+
+        if (m_routeMode == Settings::RouteMode::VpnAllSites) {
+            static const QStringList subnets = { "1.0.0.0/8", "2.0.0.0/7", "4.0.0.0/6", "8.0.0.0/5", "16.0.0.0/4", "32.0.0.0/3", "64.0.0.0/2", "128.0.0.0/1" };
+
+            auto routeAddList =  iface->routeAddList(m_vpnGateway, subnets);
+            if (!routeAddList.waitForFinished() || routeAddList.returnValue() != subnets.count()) {
+                qCritical() << "Failed to set routes for TUN";
+                return ErrorCode::InternalError;
+            }
+        }
+
+        auto StopRoutingIpv6 = iface->StopRoutingIpv6();
+        if (!StopRoutingIpv6.waitForFinished() || !StopRoutingIpv6.returnValue()) {
+            qCritical() << "Failed to disable IPv6 routing";
+            return ErrorCode::InternalError;
+        }
+
+#ifdef Q_OS_WIN
+        if (inetAdapterIndex != -1 && vpnAdapterIndex != -1) {
+            QJsonObject config = m_rawConfig;
+            config.insert("inetAdapterIndex", inetAdapterIndex);
+            config.insert("vpnAdapterIndex", vpnAdapterIndex);
+            config.insert("vpnGateway", m_vpnGateway);
+            config.insert("vpnServer", m_remoteAddress);
+
+            auto enablePeerTraffic = iface->enablePeerTraffic(config);
+            if (!enablePeerTraffic.waitForFinished() || !enablePeerTraffic.returnValue()) {
+                qCritical() << "Failed to enable peer traffic";
+                return ErrorCode::InternalError;
+            }
+        } else
+            qWarning() << "Failed to get adapter indexes. Split-tunneling disabled";
+#endif
+        return ErrorCode::NoError;
+    },
+    [] () {
+        return ErrorCode::AmneziaServiceConnectionFailed;
+    });
 }
--- a/client/protocols/xrayprotocol.h
+++ b/client/protocols/xrayprotocol.h
@@ -6,6 +6,7 @@
 #include "core/ipcclient.h"
 #include "vpnprotocol.h"
 #include "settings.h"
+#include <QtCore/qsharedpointer.h>

 class XrayProtocol : public VpnProtocol
 {
@@ -14,19 +15,18 @@ public:
    virtual ~XrayProtocol() override;

    ErrorCode start() override;
-    ErrorCode startTun2Sock();
    void stop() override;

 private:
-    void readXrayConfiguration(const QJsonObject &configuration);
-    
+    ErrorCode setupRouting();
+    ErrorCode startTun2Socks();
+
    QJsonObject m_xrayConfig;
    Settings::RouteMode m_routeMode;
-    QString m_primaryDNS;
-    QString m_secondaryDNS;
-#ifndef Q_OS_IOS
-    QSharedPointer<IpcProcessTun2SocksReplica> m_t2sProcess;
-#endif
+    QList<QHostAddress> m_dnsServers;
+    QString m_remoteAddress;
+
+    QSharedPointer<IpcProcessInterfaceReplica> m_tun2socksProcess;
 };

 #endif // XRAYPROTOCOL_H
--- a/client/resources.qrc
+++ b/client/resources.qrc
@@ -129,6 +129,7 @@
        <file>ui/qml/Components/AdLabel.qml</file>
        <file>ui/qml/Components/ConnectButton.qml</file>
        <file>ui/qml/Components/ConnectionTypeSelectionDrawer.qml</file>
+        <file>ui/qml/Components/GamepadLoader.qml</file>
        <file>ui/qml/Components/HomeContainersListView.qml</file>
        <file>ui/qml/Components/HomeSplitTunnelingDrawer.qml</file>
        <file>ui/qml/Components/InstalledAppsDrawer.qml</file>
--- a/client/server_scripts/install_docker.sh
+++ b/client/server_scripts/install_docker.sh
@@ -21,4 +21,5 @@ if [ "$(systemctl is-active docker)" != "active" ]; then \
  sleep 5; sudo systemctl start docker; sleep 5;\
 fi;\
 if ! command -v sudo > /dev/null 2>&1; then echo "Failed to install sudo, command not found"; exit 1; fi;\
-docker --version
+docker --version;\
+uname -sr
--- a/client/settings.h
+++ b/client/settings.h
@@ -94,6 +94,15 @@ public:
        setValue("Conf/startMinimized", enabled);
    }

+    bool isNewsNotifications() const
+    {
+        return value("Conf/newsNotifications", true).toBool();
+    }
+    void setNewsNotifications(bool enabled)
+    {
+        setValue("Conf/newsNotifications", enabled);
+    }
+
    bool isSaveLogs() const
    {
        return value("Conf/saveLogs", false).toBool();
--- a/client/ui/controllers/api/apiConfigsController.cpp
+++ b/client/ui/controllers/api/apiConfigsController.cpp
@@ -382,6 +382,51 @@ bool ApiConfigsController::fillAvailableServices()
    }

    QJsonObject data = QJsonDocument::fromJson(responseBody).object();
+    
+#if defined(Q_OS_IOS) || defined(MACOS_NE)
+    QEventLoop waitProducts;
+    bool productsFetched = false;
+    QString productPrice;
+    QString productCurrency;
+    
+    IosController::Instance()->fetchProducts(QStringList() << QStringLiteral("amnezia_premium_6_month"),
+                                             [&](const QList<QVariantMap> &products,
+                                                 const QStringList &invalidIds,
+                                                 const QString &errorString) {
+                                                 if (!errorString.isEmpty() || products.isEmpty()) {
+                                                     qWarning().noquote() << "[IAP] Failed to fetch product price:" << errorString;
+                                                 } else {
+                                                     const auto &product = products.first();
+                                                     productPrice = product.value("price").toString();
+                                                     productCurrency = product.value("currencyCode").toString();
+                                                     productsFetched = true;
+                                                     qInfo().noquote() << "[IAP] Fetched product price:" << productPrice << productCurrency;
+                                                 }
+                                                 waitProducts.quit();
+                                             });
+    waitProducts.exec();
+    
+    if (productsFetched && !productPrice.isEmpty()) {
+        QJsonArray services = data.value("services").toArray();
+        for (int i = 0; i < services.size(); ++i) {
+            QJsonObject service = services[i].toObject();
+            if (service.value(configKey::serviceType).toString() == serviceType::amneziaPremium) {
+                QJsonObject serviceInfo = service.value(configKey::serviceInfo).toObject();
+                QString formattedPrice = productPrice;
+                if (!productCurrency.isEmpty()) {
+                    formattedPrice += " " + productCurrency;
+                }
+                serviceInfo["price"] = formattedPrice;
+                service[configKey::serviceInfo] = serviceInfo;
+                services[i] = service;
+                data["services"] = services;
+                qInfo().noquote() << "[IAP] Updated premium service price in data:" << formattedPrice;
+                break;
+            }
+        }
+    }
+#endif
+    
    m_apiServicesModel->updateModel(data);
    if (m_apiServicesModel->rowCount() > 0) {
        m_apiServicesModel->setServiceIndex(0);
--- a/client/ui/controllers/importController.cpp
+++ b/client/ui/controllers/importController.cpp
@@ -291,6 +291,8 @@ void ImportController::processNativeWireGuardConfig()
        clientProtocolConfig[config_key::cookieReplyPacketJunkSize] = "0";
        clientProtocolConfig[config_key::transportPacketJunkSize] = "0";

+        clientProtocolConfig[config_key::specialJunk1] = protocols::awg::defaultSpecialJunk1;
+
        clientProtocolConfig[config_key::isObfuscationEnabled] = true;

        serverProtocolConfig[config_key::last_config] = QString(QJsonDocument(clientProtocolConfig).toJson());
--- a/client/ui/controllers/settingsController.cpp
+++ b/client/ui/controllers/settingsController.cpp
@@ -308,6 +308,15 @@ void SettingsController::toggleStartMinimized(bool enable)
    emit startMinimizedChanged();
 }

+bool SettingsController::isNewsNotificationsEnabled()
+{
+    return m_settings->isNewsNotifications();
+}
+void SettingsController::toggleNewsNotificationsEnabled(bool enable)
+{
+    m_settings->setNewsNotifications(enable);
+}
+
 bool SettingsController::isScreenshotsEnabled()
 {
    return m_settings->isScreenshotsEnabled();
--- a/client/ui/controllers/settingsController.h
+++ b/client/ui/controllers/settingsController.h
@@ -73,6 +73,9 @@ public slots:
    bool isStartMinimizedEnabled();
    void toggleStartMinimized(bool enable);

+    bool isNewsNotificationsEnabled();
+    void toggleNewsNotificationsEnabled(bool enable);
+
    bool isScreenshotsEnabled();
    void toggleScreenshotsEnabled(bool enable);

--- a/client/ui/models/api/apiCountryModel.cpp
+++ b/client/ui/models/api/apiCountryModel.cpp
@@ -1,6 +1,8 @@
 #include "apiCountryModel.h"

 #include <QJsonObject>
+#include <QSettings>
+#include <utility>

 #include "core/api/apiDefs.h"
 #include "logger.h"
@@ -8,14 +10,143 @@
 namespace
 {
    Logger logger("ApiCountryModel");
-
    constexpr QLatin1String countryConfig("country_config");
+    constexpr QLatin1String regionEurope("Europe");
+    constexpr QLatin1String regionAmerica("America");
+    constexpr QLatin1String regionAsia("Asia");
+    constexpr QLatin1String regionOceaniaAfrica("Oceania and Africa");
+    constexpr QLatin1String regionOther("Other");
+
+    struct RegionRowData
+    {
+        bool isRegionHeader = false;
+        QString regionName;
+        bool isExpanded = true;
+        int sourceIndex = -1;
+        QString countryName;
+        QString sourceCountryName;
+        QString countryCode;
+        QString countryImageCode;
+    };
+
+    QString resolveRegionByIsoCode(const QString &isoCode)
+    {
+        static const QHash<QString, QString> isoToRegion = {
+            {"BE", regionEurope},
+            {"EE", regionEurope},
+            {"FI", regionEurope},
+            {"FR", regionEurope},
+            {"GE", regionEurope},
+            {"DE", regionEurope},
+            {"NL", regionEurope},
+            {"PL", regionEurope},
+            {"RU", regionEurope},
+            {"ES", regionEurope},
+            {"SE", regionEurope},
+            {"CH", regionEurope},
+            {"TR", regionEurope},
+            {"BR", regionAmerica},
+            {"CA", regionAmerica},
+            {"US", regionAmerica},
+            {"AE", regionAsia},
+            {"JP", regionAsia},
+            {"KZ", regionAsia},
+            {"KR", regionAsia},
+            {"SG", regionAsia},
+            {"AU", regionOceaniaAfrica},
+            {"NZ", regionOceaniaAfrica},
+            {"ZA", regionOceaniaAfrica},
+        };
+
+        return isoToRegion.value(isoCode, regionOther);
+    }
 }

-ApiCountryModel::ApiCountryModel(QObject *parent) : QAbstractListModel(parent)
+class ApiCountryModel::RegionRowsModel : public QAbstractListModel
 {
+public:
+    enum Roles {
+        RowTypeRole = Qt::UserRole + 1,
+        RegionNameRole,
+        IsExpandedRole,
+        SourceIndexRole,
+        CountryNameRole,
+        SourceCountryNameRole,
+        CountryCodeRole,
+        CountryImageCodeRole
+    };
+
+    explicit RegionRowsModel(QObject *parent = nullptr) : QAbstractListModel(parent) {}
+
+    int rowCount(const QModelIndex &parent = QModelIndex()) const override
+    {
+        Q_UNUSED(parent)
+        return m_rows.size();
+    }
+
+    QVariant data(const QModelIndex &index, int role = Qt::DisplayRole) const override
+    {
+        if (!index.isValid() || index.row() < 0 || index.row() >= m_rows.size()) {
+            return QVariant();
+        }
+
+        const RegionRowData &row = m_rows.at(index.row());
+        switch (role) {
+        case RowTypeRole:
+            return row.isRegionHeader ? "region" : "country";
+        case RegionNameRole:
+            return row.regionName;
+        case IsExpandedRole:
+            return row.isExpanded;
+        case SourceIndexRole:
+            return row.sourceIndex;
+        case CountryNameRole:
+            return row.countryName;
+        case SourceCountryNameRole:
+            return row.sourceCountryName;
+        case CountryCodeRole:
+            return row.countryCode;
+        case CountryImageCodeRole:
+            return row.countryImageCode;
+        default:
+            return QVariant();
+        }
+    }
+
+    QHash<int, QByteArray> roleNames() const override
+    {
+        QHash<int, QByteArray> roles;
+        roles[RowTypeRole] = "rowType";
+        roles[RegionNameRole] = "regionName";
+        roles[IsExpandedRole] = "isExpanded";
+        roles[SourceIndexRole] = "sourceIndex";
+        roles[CountryNameRole] = "countryName";
+        roles[SourceCountryNameRole] = "sourceCountryName";
+        roles[CountryCodeRole] = "countryCode";
+        roles[CountryImageCodeRole] = "countryImageCode";
+        return roles;
+    }
+
+    void setRows(QVector<RegionRowData> &&rows)
+    {
+        beginResetModel();
+        m_rows = std::move(rows);
+        endResetModel();
+    }
+
+private:
+    QVector<RegionRowData> m_rows;
+};
+
+ApiCountryModel::ApiCountryModel(QObject *parent)
+    : QAbstractListModel(parent), m_regionRowsModel(std::make_unique<RegionRowsModel>(this))
+{
+    loadRegionExpansionState();
+    rebuildGroupedRegions();
 }

+ApiCountryModel::~ApiCountryModel() = default;
+
 int ApiCountryModel::rowCount(const QModelIndex &parent) const
 {
    Q_UNUSED(parent)
@@ -24,32 +155,28 @@ int ApiCountryModel::rowCount(const QModelIndex &parent) const

 QVariant ApiCountryModel::data(const QModelIndex &index, int role) const
 {
-    if (!index.isValid() || index.row() < 0 || index.row() >= static_cast<int>(rowCount()))
+    if (!index.isValid() || index.row() < 0 || index.row() >= static_cast<int>(rowCount())) {
        return QVariant();
+    }

-    CountryInfo countryInfo = m_countries.at(index.row());
-    IssuedConfigInfo issuedConfigInfo = m_issuedConfigs.value(countryInfo.countryCode);
-    bool isIssued = issuedConfigInfo.sourceType == countryConfig;
+    const CountryInfo &countryInfo = m_countries.at(index.row());
+    const IssuedConfigInfo issuedConfigInfo = m_issuedConfigs.value(countryInfo.countryCode);
+    const bool isIssued = issuedConfigInfo.sourceType == countryConfig;

    switch (role) {
-    case CountryCodeRole: {
+    case CountryCodeRole:
        return countryInfo.countryCode;
-    }
-    case CountryNameRole: {
+    case CountryNameRole:
        return countryInfo.countryName;
-    }
-    case CountryImageCodeRole: {
+    case CountryImageCodeRole:
        return countryInfo.countryCode.toUpper();
-    }
-    case IsIssuedRole: {
+    case IsIssuedRole:
        return isIssued;
-    }
-    case IsWorkerExpiredRole: {
+    case IsWorkerExpiredRole:
        return issuedConfigInfo.lastDownloaded < issuedConfigInfo.workerLastUpdated;
+    default:
+        return QVariant();
    }
-    }
-
-    return QVariant();
 }

 void ApiCountryModel::updateModel(const QJsonArray &countries, const QString &currentCountryCode)
@@ -57,9 +184,9 @@ void ApiCountryModel::updateModel(const QJsonArray &countries, const QString &cu
    beginResetModel();

    m_countries.clear();
-    for (int i = 0; i < countries.size(); i++) {
+    for (int i = 0; i < countries.size(); ++i) {
        CountryInfo countryInfo;
-        QJsonObject countryObject = countries.at(i).toObject();
+        const QJsonObject countryObject = countries.at(i).toObject();

        countryInfo.countryName = countryObject.value(apiDefs::key::serverCountryName).toString();
        countryInfo.countryCode = countryObject.value(apiDefs::key::serverCountryCode).toString();
@@ -72,6 +199,7 @@ void ApiCountryModel::updateModel(const QJsonArray &countries, const QString &cu
    }

    endResetModel();
+    rebuildGroupedRegions();
 }

 void ApiCountryModel::updateIssuedConfigsInfo(const QJsonArray &issuedConfigs)
@@ -79,9 +207,9 @@ void ApiCountryModel::updateIssuedConfigsInfo(const QJsonArray &issuedConfigs)
    beginResetModel();

    m_issuedConfigs.clear();
-    for (int i = 0; i < issuedConfigs.size(); i++) {
+    for (int i = 0; i < issuedConfigs.size(); ++i) {
        IssuedConfigInfo issuedConfigInfo;
-        QJsonObject issuedConfigObject = issuedConfigs.at(i).toObject();
+        const QJsonObject issuedConfigObject = issuedConfigs.at(i).toObject();

        if (issuedConfigObject.value(apiDefs::key::sourceType).toString() != countryConfig) {
            continue;
@@ -110,6 +238,52 @@ void ApiCountryModel::setCurrentIndex(const int i)
    emit currentIndexChanged(m_currentIndex);
 }

+QString ApiCountryModel::searchText() const
+{
+    return m_searchText;
+}
+
+void ApiCountryModel::setSearchText(const QString &text)
+{
+    if (m_searchText == text) {
+        return;
+    }
+
+    m_searchText = text;
+    emit searchTextChanged();
+    rebuildGroupedRegions();
+}
+
+QAbstractListModel *ApiCountryModel::regionRowsModel() const
+{
+    return m_regionRowsModel.get();
+}
+
+bool ApiCountryModel::hasVisibleRegions() const
+{
+    return m_regionRowsModel && m_regionRowsModel->rowCount() > 0;
+}
+
+bool ApiCountryModel::isRegionExpanded(const QString &regionName) const
+{
+    if (isSearchActive()) {
+        return true;
+    }
+    return m_regionsExpanded.contains(regionName) ? m_regionsExpanded.value(regionName) : true;
+}
+
+void ApiCountryModel::toggleRegionExpanded(const QString &regionName)
+{
+    if (regionName.isEmpty() || isSearchActive()) {
+        return;
+    }
+
+    const bool currentValue = isRegionExpanded(regionName);
+    m_regionsExpanded.insert(regionName, !currentValue);
+    saveRegionExpansionState();
+    rebuildGroupedRegions();
+}
+
 QHash<int, QByteArray> ApiCountryModel::roleNames() const
 {
    QHash<int, QByteArray> roles;
@@ -120,3 +294,168 @@ QHash<int, QByteArray> ApiCountryModel::roleNames() const
    roles[IsWorkerExpiredRole] = "isWorkerExpired";
    return roles;
 }
+
+QString ApiCountryModel::normalizeCountryCode(const QString &countryCode) const
+{
+    return countryCode.trimmed().toUpper();
+}
+
+QString ApiCountryModel::extractCountryIsoCode(const QString &countryCode) const
+{
+    const QString normalizedCode = normalizeCountryCode(countryCode);
+    for (int i = 0; i + 1 < normalizedCode.size(); ++i) {
+        const QChar first = normalizedCode.at(i);
+        const QChar second = normalizedCode.at(i + 1);
+        if (first.isUpper() && second.isUpper()) {
+            return normalizedCode.mid(i, 2);
+        }
+    }
+    return normalizedCode;
+}
+
+QString ApiCountryModel::normalizeCountryName(const QString &countryName) const
+{
+    return countryName.trimmed().toLower();
+}
+
+QString ApiCountryModel::normalizeSearchComparableText(const QString &textValue) const
+{
+    QString normalizedText = normalizeCountryName(textValue);
+    normalizedText.replace(QChar(0x0451), QChar(0x0435)); // ё -> е
+    normalizedText.replace(QChar(0x0439), QChar(0x0438)); // й -> и
+
+    QString result;
+    result.reserve(normalizedText.size());
+    for (int i = 0; i < normalizedText.size(); ++i) {
+        const QChar currentChar = normalizedText.at(i);
+        if (currentChar.isSpace()) {
+            const QChar prevChar = i > 0 ? normalizedText.at(i - 1) : QChar();
+            const QChar nextChar = i + 1 < normalizedText.size() ? normalizedText.at(i + 1) : QChar();
+            const bool hasSpaceNeighbor = prevChar.isSpace() || nextChar.isSpace();
+            if (hasSpaceNeighbor) {
+                result.append(currentChar);
+            }
+            continue;
+        }
+        const bool isSeparator = currentChar == '.' || currentChar == '-';
+
+        if (!isSeparator) {
+            result.append(currentChar);
+            continue;
+        }
+
+        const QChar prevChar = i > 0 ? normalizedText.at(i - 1) : QChar();
+        const QChar nextChar = i + 1 < normalizedText.size() ? normalizedText.at(i + 1) : QChar();
+        const bool hasSeparatorNeighbor = prevChar == '.' || prevChar == '-' || nextChar == '.' || nextChar == '-';
+        if (hasSeparatorNeighbor) {
+            result.append(currentChar);
+        }
+    }
+
+    return result;
+}
+
+bool ApiCountryModel::isCountryMatchingSearch(const QString &countryName, const QString &sourceCountryCode,
+                                              const QString &normalizedSearchText) const
+{
+    if (normalizedSearchText.isEmpty()) {
+        return true;
+    }
+
+    const QString normalizedCountryName = normalizeSearchComparableText(countryName);
+    const QString normalizedSourceCountryCode = normalizeCountryCode(sourceCountryCode).toLower();
+
+    return normalizedCountryName.startsWith(normalizedSearchText) || normalizedSourceCountryCode.startsWith(normalizedSearchText);
+}
+
+QString ApiCountryModel::getDisplayCountryName(const QString &countryName) const
+{
+    const QString p2pPrefix = "[P2P] ";
+    if (countryName.startsWith(p2pPrefix)) {
+        return countryName.mid(p2pPrefix.size()) + " [P2P]";
+    }
+    return countryName;
+}
+
+void ApiCountryModel::rebuildGroupedRegions()
+{
+    QVector<RegionRowData> rows;
+    const QString normalizedSearchText = normalizeSearchComparableText(m_searchText);
+    const QStringList orderedRegions = {
+        regionEurope,
+        regionAmerica,
+        regionAsia,
+        regionOceaniaAfrica,
+        regionOther,
+    };
+
+    QHash<QString, QVector<RegionRowData>> groupedCountries;
+    for (int sourceIndex = 0; sourceIndex < m_countries.size(); ++sourceIndex) {
+        const CountryInfo &sourceCountry = m_countries.at(sourceIndex);
+        if (!isCountryMatchingSearch(sourceCountry.countryName, sourceCountry.countryCode, normalizedSearchText)) {
+            continue;
+        }
+
+        const QString regionName = resolveRegionByIsoCode(extractCountryIsoCode(sourceCountry.countryCode));
+        RegionRowData countryRow;
+        countryRow.isRegionHeader = false;
+        countryRow.regionName = regionName;
+        countryRow.sourceIndex = sourceIndex;
+        countryRow.countryName = getDisplayCountryName(sourceCountry.countryName);
+        countryRow.sourceCountryName = sourceCountry.countryName;
+        countryRow.countryCode = sourceCountry.countryCode;
+        countryRow.countryImageCode = extractCountryIsoCode(sourceCountry.countryCode);
+        groupedCountries[regionName].push_back(std::move(countryRow));
+    }
+
+    for (const QString &regionName : orderedRegions) {
+        QVector<RegionRowData> countries = groupedCountries.value(regionName);
+        if (countries.isEmpty()) {
+            continue;
+        }
+
+        const bool expanded = isRegionExpanded(regionName);
+
+        RegionRowData headerRow;
+        headerRow.isRegionHeader = true;
+        headerRow.regionName = regionName;
+        headerRow.isExpanded = expanded;
+        rows.push_back(std::move(headerRow));
+
+        if (expanded) {
+            for (RegionRowData &countryRow : countries) {
+                countryRow.isExpanded = expanded;
+                rows.push_back(std::move(countryRow));
+            }
+        }
+    }
+
+    m_regionRowsModel->setRows(std::move(rows));
+    emit regionRowsChanged();
+}
+
+void ApiCountryModel::loadRegionExpansionState()
+{
+    QSettings settings;
+    const QVariantMap stored = settings.value("PageSettingsApiAvailableCountries/regionsExpanded").toMap();
+    m_regionsExpanded.clear();
+    for (auto it = stored.constBegin(); it != stored.constEnd(); ++it) {
+        m_regionsExpanded.insert(it.key(), it.value().toBool());
+    }
+}
+
+void ApiCountryModel::saveRegionExpansionState() const
+{
+    QVariantMap stored;
+    for (auto it = m_regionsExpanded.constBegin(); it != m_regionsExpanded.constEnd(); ++it) {
+        stored.insert(it.key(), it.value());
+    }
+
+    QSettings settings;
+    settings.setValue("PageSettingsApiAvailableCountries/regionsExpanded", stored);
+}
+
+bool ApiCountryModel::isSearchActive() const
+{
+    return !normalizeSearchComparableText(m_searchText).isEmpty();
+}
--- a/client/ui/models/api/apiCountryModel.h
+++ b/client/ui/models/api/apiCountryModel.h
@@ -4,6 +4,7 @@
 #include <QAbstractListModel>
 #include <QHash>
 #include <QJsonArray>
+#include <memory>

 class ApiCountryModel : public QAbstractListModel
 {
@@ -19,12 +20,16 @@ public:
    };

    explicit ApiCountryModel(QObject *parent = nullptr);
+    ~ApiCountryModel() override;

    int rowCount(const QModelIndex &parent = QModelIndex()) const override;

    QVariant data(const QModelIndex &index, int role = Qt::DisplayRole) const override;

    Q_PROPERTY(int currentIndex READ getCurrentIndex WRITE setCurrentIndex NOTIFY currentIndexChanged)
+    Q_PROPERTY(QString searchText READ searchText WRITE setSearchText NOTIFY searchTextChanged)
+    Q_PROPERTY(QAbstractListModel *regionRowsModel READ regionRowsModel CONSTANT)
+    Q_PROPERTY(bool hasVisibleRegions READ hasVisibleRegions NOTIFY regionRowsChanged)

 public slots:
    void updateModel(const QJsonArray &countries, const QString &currentCountryCode);
@@ -32,9 +37,17 @@ public slots:

    int getCurrentIndex();
    void setCurrentIndex(const int i);
+    QString searchText() const;
+    void setSearchText(const QString &text);
+    QAbstractListModel *regionRowsModel() const;
+    bool hasVisibleRegions() const;
+    Q_INVOKABLE bool isRegionExpanded(const QString &regionName) const;
+    Q_INVOKABLE void toggleRegionExpanded(const QString &regionName);

 signals:
    void currentIndexChanged(const int index);
+    void searchTextChanged();
+    void regionRowsChanged();

 protected:
    QHash<int, QByteArray> roleNames() const override;
@@ -57,7 +70,23 @@ private:

    QVector<CountryInfo> m_countries;
    QHash<QString, IssuedConfigInfo> m_issuedConfigs;
-    int m_currentIndex;
+    int m_currentIndex = -1;
+    QString m_searchText;
+    QHash<QString, bool> m_regionsExpanded;
+    class RegionRowsModel;
+    std::unique_ptr<RegionRowsModel> m_regionRowsModel;
+
+    QString normalizeCountryCode(const QString &countryCode) const;
+    QString extractCountryIsoCode(const QString &countryCode) const;
+    QString normalizeCountryName(const QString &countryName) const;
+    QString normalizeSearchComparableText(const QString &textValue) const;
+    bool isCountryMatchingSearch(const QString &countryName, const QString &sourceCountryCode,
+                                 const QString &normalizedSearchText) const;
+    QString getDisplayCountryName(const QString &countryName) const;
+    void rebuildGroupedRegions();
+    void loadRegionExpansionState();
+    void saveRegionExpansionState() const;
+    bool isSearchActive() const;
 };

 #endif // APICOUNTRYMODEL_H
--- a/client/ui/models/api/apiServicesModel.cpp
+++ b/client/ui/models/api/apiServicesModel.cpp
@@ -112,7 +112,11 @@ QVariant ApiServicesModel::data(const QModelIndex &index, int role) const
        if (price == "free") {
            return tr("Free");
        }
+#if defined(Q_OS_IOS) || defined(MACOS_NE)
+        return tr("%1 $").arg(price);
+#else
        return tr("%1 $/month").arg(price);
+#endif
    }
    case EndDateRole: {
        return QDateTime::fromString(apiServiceData.subscription.endDate, Qt::ISODate).toLocalTime().toString("d MMM yyyy");
--- a/client/ui/qml/Components/GamepadLoader.qml
+++ b/client/ui/qml/Components/GamepadLoader.qml
@@ -0,0 +1,38 @@
+import QtQuick
+import QtGamepadLegacy
+
+Item {
+    id: root
+    
+    property alias gamepad: gamepad
+    property alias gamepadKeyNav: gamepadKeyNav
+    
+    Gamepad {
+        id: gamepad
+        deviceId: GamepadManager.connectedGamepads.length > 0 ? GamepadManager.connectedGamepads[0] : -1
+
+        onButtonStartChanged: {
+            if (buttonStart) {
+                ServersModel.setProcessedServerIndex(ServersModel.defaultIndex)
+                ConnectionController.connectButtonClicked()
+            }
+        }
+    }
+
+    GamepadKeyNavigation {
+        id: gamepadKeyNav
+        gamepad: gamepad
+        active: true
+    }
+
+    Connections {
+        target: GamepadManager
+        function onConnectedGamepadsChanged() {
+            if (GamepadManager.connectedGamepads.length > 0) {
+                gamepad.deviceId = GamepadManager.connectedGamepads[0]
+            } else {
+                gamepad.deviceId = -1
+            }
+        }
+    }
+}
--- a/client/ui/qml/Controls2/BasicButtonType.qml
+++ b/client/ui/qml/Controls2/BasicButtonType.qml
@@ -111,11 +111,11 @@ Button {
                color: {
                    if (root.enabled) {
                        if (root.pressed) {
-                            return pressedColor
+                            return root.pressedColor
                        }
-                        return root.hovered ? hoveredColor : defaultColor
+                        return root.hovered ? root.hoveredColor : root.defaultColor
                    } else {
-                        return disabledColor
+                        return root.disabledColor
                    }
                }

--- a/client/ui/qml/Controls2/DrawerType2.qml
+++ b/client/ui/qml/Controls2/DrawerType2.qml
@@ -49,6 +49,55 @@ Item {
        return drawerContent.state === stateName
    }

+    function isDrawerType2(obj) {
+        return obj && typeof obj.drawerExpandedStateName !== "undefined" && 
+               typeof obj.drawerCollapsedStateName !== "undefined"
+    }
+
+    function isDescendantOfDrawer(obj) {
+        var current = obj
+        while (current && current !== root.parent) {
+            if (isDrawerType2(current)) {
+                return true
+            }
+            current = current.parent
+        }
+        return false
+    }
+
+    function findComponent(obj, typeCtor) {
+        if (!obj)
+            return null
+
+        if (isDrawerType2(obj) || isDescendantOfDrawer(obj))
+            return null
+
+        if (obj instanceof typeCtor)
+            return obj
+
+        if (obj.children && obj.children.length > 0) {
+            for (var i = 0; i < obj.children.length; i++) {
+                var matchingChildren = findComponent(obj.children[i], typeCtor)
+                if (matchingChildren) return matchingChildren
+            }
+        }
+
+        if (obj.contentItem) {
+            var matchingContentItem = findComponent(obj.contentItem, typeCtor)
+            if (matchingContentItem) return matchingContentItem
+        }
+
+        return null
+    }
+
+    function setParentInteractive(value) {
+        var flickableType = findComponent(root.parent, Flickable)
+        var listViewType = findComponent(root.parent, ListView)
+
+        if (flickableType) flickableType.interactive = value
+        if (listViewType) listViewType.interactive = value
+    }
+
    Connections {
        target: Qt.application

@@ -93,6 +142,8 @@ Item {

            aboutToHide()

+            setParentInteractive(true)
+
            closed()
        }

@@ -118,6 +169,8 @@ Item {

            root.aboutToShow()

+            setParentInteractive(false)
+
            root.opened()
        }

--- a/client/ui/qml/Controls2/LabelWithButtonType.qml
+++ b/client/ui/qml/Controls2/LabelWithButtonType.qml
@@ -71,6 +71,8 @@ Item {
    implicitHeight: content.implicitHeight + content.anchors.leftMargin + content.anchors.rightMargin

    MouseArea {
+        id: mouseArea
+
        anchors.fill: parent
        cursorShape: Qt.PointingHandCursor
        hoverEnabled: root.enabled
@@ -296,13 +298,13 @@ Item {
    }

    Keys.onEnterPressed: {
-        if (clickedFunction && typeof clickedFunction === "function") {
+        if (!rightImageSource && clickedFunction && typeof clickedFunction === "function") {
            clickedFunction()
        }
    }

    Keys.onReturnPressed: {
-        if (clickedFunction && typeof clickedFunction === "function") {
+        if (!rightImageSource && clickedFunction && typeof clickedFunction === "function") {
            clickedFunction()
        }
    }
--- a/client/ui/qml/Controls2/TextFieldWithHeaderType.qml
+++ b/client/ui/qml/Controls2/TextFieldWithHeaderType.qml
@@ -19,9 +19,6 @@ Item {

    property string buttonText
    property string buttonImageSource
-    property string buttonImageColor: AmneziaStyle.color.midnightBlack
-    property string buttonBackgroundColor: AmneziaStyle.color.paleGray
-    property string buttonHoveredColor: AmneziaStyle.color.lightGray
    property var clickedFunc

    property alias textField: textField
@@ -70,7 +67,7 @@ Item {
            border.width: 1

            Behavior on border.color {
-                PropertyAnimation { duration: 100 }
+                PropertyAnimation { duration: 200 }
            }

            RowLayout {
@@ -124,7 +121,7 @@ Item {

                        background: Rectangle {
                            anchors.fill: parent
-                            color: root.enabled ? root.backgroundColor : root.backgroundDisabledColor
+                            color: root.backgroundDisabledColor
                        }

                        onTextChanged: {
@@ -189,14 +186,6 @@ Item {
        focusPolicy: Qt.NoFocus
        text: root.buttonText
        leftImageSource: root.buttonImageSource
-        leftImageColor: root.buttonImageColor
-
-        defaultColor: root.buttonBackgroundColor
-        hoveredColor: root.buttonHoveredColor
-        pressedColor: root.buttonHoveredColor
-        disabledColor: AmneziaStyle.color.transparent
-
-        borderWidth: 0

        anchors.top: content.top
        anchors.bottom: content.bottom
@@ -204,7 +193,7 @@ Item {

        height: content.implicitHeight
        width: content.implicitHeight
-        squareLeftSide: false
+        squareLeftSide: true

        clickedFunc: function() {
            if (root.clickedFunc && typeof root.clickedFunc === "function") {
--- a/client/ui/qml/Pages2/PageProtocolCloakSettings.qml
+++ b/client/ui/qml/Pages2/PageProtocolCloakSettings.qml
@@ -140,6 +140,16 @@ PageType {
                        ListElement { name : "aes-128-gcm" }
                    }

+                    function updateSelectedIndex() {
+                        cipherDropDown.text = cipher
+                        for (var i = 0; i < cipherListView.model.count; i++) {
+                            if (cipherListView.model.get(i).name === cipher) {
+                                selectedIndex = i
+                                break
+                            }
+                        }
+                    }
+
                    clickedFunction: function() {
                        cipherDropDown.text = selectedText
                        cipher = cipherDropDown.text
@@ -147,13 +157,14 @@ PageType {
                    }

                    Component.onCompleted: {
-                        cipherDropDown.text = cipher
+                        updateSelectedIndex()
+                    }
+                }

-                        for (var i = 0; i < cipherListView.model.count; i++) {
-                            if (cipherListView.model.get(i).name === cipherDropDown.text) {
-                                selectedIndex = i
-                            }
-                        }
+                Connections {
+                    target: listView.model
+                    function onDataChanged() {
+                        cipherListView.updateSelectedIndex()
                    }
                }
            }
--- a/client/ui/qml/Pages2/PageProtocolOpenVpnSettings.qml
+++ b/client/ui/qml/Pages2/PageProtocolOpenVpnSettings.qml
@@ -192,6 +192,16 @@ PageType {
                        ListElement { name : qsTr("SHA1") }
                    }

+                    function updateSelectedIndex() {
+                        hashDropDown.text = hash
+                        for (var i = 0; i < hashListView.model.count; i++) {
+                            if (hashListView.model.get(i).name === hash) {
+                                selectedIndex = i
+                                break
+                            }
+                        }
+                    }
+
                    clickedFunction: function() {
                        hashDropDown.text = selectedText
                        hash = hashDropDown.text
@@ -199,13 +209,14 @@ PageType {
                    }

                    Component.onCompleted: {
-                        hashDropDown.text = hash
+                        updateSelectedIndex()
+                    }
+                }

-                        for (var i = 0; i < hashListView.model.count; i++) {
-                            if (hashListView.model.get(i).name === hashDropDown.text) {
-                                currentIndex = i
-                            }
-                        }
+                Connections {
+                    target: listView.model
+                    function onDataChanged() {
+                        hashListView.updateSelectedIndex()
                    }
                }
            }
@@ -242,6 +253,16 @@ PageType {
                        ListElement { name : qsTr("none") }
                    }

+                    function updateSelectedIndex() {
+                        cipherDropDown.text = cipher
+                        for (var i = 0; i < cipherListView.model.count; i++) {
+                            if (cipherListView.model.get(i).name === cipher) {
+                                selectedIndex = i
+                                break
+                            }
+                        }
+                    }
+
                    clickedFunction: function() {
                        cipherDropDown.text = selectedText
                        cipher = cipherDropDown.text
@@ -249,13 +270,14 @@ PageType {
                    }

                    Component.onCompleted: {
-                        cipherDropDown.text = cipher
+                        updateSelectedIndex()
+                    }
+                }

-                        for (var i = 0; i < cipherListView.model.count; i++) {
-                            if (cipherListView.model.get(i).name === cipherDropDown.text) {
-                                currentIndex = i
-                            }
-                        }
+                Connections {
+                    target: listView.model
+                    function onDataChanged() {
+                        cipherListView.updateSelectedIndex()
                    }
                }
            }
--- a/client/ui/qml/Pages2/PageProtocolShadowSocksSettings.qml
+++ b/client/ui/qml/Pages2/PageProtocolShadowSocksSettings.qml
@@ -109,6 +109,16 @@ PageType {
                        ListElement { name : "aes-128-gcm" }
                    }

+                    function updateSelectedIndex() {
+                        cipherDropDown.text = cipher
+                        for (var i = 0; i < cipherListView.model.count; i++) {
+                            if (cipherListView.model.get(i).name === cipher) {
+                                selectedIndex = i
+                                break
+                            }
+                        }
+                    }
+
                    clickedFunction: function() {
                        cipherDropDown.text = selectedText
                        cipher = cipherDropDown.text
@@ -116,13 +126,14 @@ PageType {
                    }

                    Component.onCompleted: {
-                        cipherDropDown.text = cipher
+                        updateSelectedIndex()
+                    }
+                }

-                        for (var i = 0; i < cipherListView.model.count; i++) {
-                            if (cipherListView.model.get(i).name === cipherDropDown.text) {
-                                currentIndex = i
-                            }
-                        }
+                Connections {
+                    target: listView.model
+                    function onDataChanged() {
+                        cipherListView.updateSelectedIndex()
                    }
                }
            }
--- a/client/ui/qml/Pages2/PageSettings.qml
+++ b/client/ui/qml/Pages2/PageSettings.qml
@@ -148,7 +148,7 @@ PageType {
        id: news

        property string title: qsTr("News & Notifications")
-        readonly property string leftImagePath: NewsModel.hasUnread ? "qrc:/images/controls/news-unread.svg" : "qrc:/images/controls/news.svg"
+        readonly property string leftImagePath: NewsModel.hasUnread && SettingsController.isNewsNotificationsEnabled() ? "qrc:/images/controls/news-unread.svg" : "qrc:/images/controls/news.svg"
        property bool isVisible: ServersModel.hasServersFromGatewayApi
        readonly property var clickedHandler: function() {
            if (!ServersModel.hasServersFromGatewayApi) {
--- a/client/ui/qml/Pages2/PageSettingsApiAvailableCountries.qml
+++ b/client/ui/qml/Pages2/PageSettingsApiAvailableCountries.qml
@@ -1,7 +1,6 @@
 import QtQuick
 import QtQuick.Controls
 import QtQuick.Layouts
-import QtQuick.Dialogs

 import SortFilterProxyModel 0.2

@@ -18,6 +17,7 @@ PageType {
    id: root

    property var processedServer
+    readonly property int topBarHeight: 20 + SettingsController.safeAreaTopMargin + backButton.implicitHeight + 12

    Connections {
        target: ServersModel
@@ -44,12 +44,38 @@ PageType {
        }
    }

+    Rectangle {
+        id: topBar
+        anchors.top: parent.top
+        anchors.left: parent.left
+        anchors.right: parent.right
+        height: root.topBarHeight
+        color: AmneziaStyle.color.midnightBlack
+        z: 10
+
+        MouseArea {
+            anchors.fill: parent
+            acceptedButtons: Qt.AllButtons
+        }
+
+        BackButtonType {
+            id: backButton
+            objectName: "backButton"
+
+            anchors.top: parent.top
+            anchors.left: parent.left
+            anchors.topMargin: 20 + SettingsController.safeAreaTopMargin
+            anchors.leftMargin: 16
+            z: 1
+        }
+    }
+
    ListViewType {
        id: menuContent

        anchors.fill: parent

-        model: ApiCountryModel
+        model: ApiCountryModel.regionRowsModel

        currentIndex: 0

@@ -62,13 +88,6 @@ PageType {

            spacing: 4

-            BackButtonType {
-                id: backButton
-                objectName: "backButton"
-
-                Layout.topMargin: 20 + SettingsController.safeAreaTopMargin
-            }
-
            HeaderTypeWithButton {
                id: headerContent
                objectName: "headerContent"
@@ -76,6 +95,7 @@ PageType {
                Layout.fillWidth: true
                Layout.leftMargin: 16
                Layout.rightMargin: 16
+                Layout.topMargin: topBar.height + 4
                Layout.bottomMargin: 10

                actionButtonImage: "qrc:/images/controls/settings.svg"
@@ -94,76 +114,238 @@ PageType {
                    PageController.goToPage(PageEnum.PageSettingsApiServerInfo)
                }
            }
+
+            Rectangle {
+                Layout.fillWidth: true
+                Layout.leftMargin: 16
+                Layout.rightMargin: 16
+                Layout.bottomMargin: 10
+
+                implicitHeight: 56
+                radius: 16
+
+                color: AmneziaStyle.color.onyxBlack
+                border.color: searchField.activeFocus ? AmneziaStyle.color.paleGray : AmneziaStyle.color.slateGray
+                border.width: 1
+
+                Behavior on border.color {
+                    PropertyAnimation { duration: 200 }
+                }
+
+                RowLayout {
+                    anchors.fill: parent
+                    anchors.leftMargin: 16
+                    anchors.rightMargin: 8
+                    spacing: 8
+
+                    Image {
+                        source: "qrc:/images/controls/search.svg"
+                    }
+
+                    TextField {
+                        id: searchField
+
+                        Layout.fillWidth: true
+
+                        color: AmneziaStyle.color.paleGray
+                        placeholderText: "country or country code"
+                        placeholderTextColor: AmneziaStyle.color.charcoalGray
+
+                        selectionColor: AmneziaStyle.color.richBrown
+                        selectedTextColor: AmneziaStyle.color.paleGray
+
+                        font.pixelSize: 16
+                        font.weight: 400
+                        font.family: "PT Root UI VF"
+
+                        inputMethodHints: Qt.ImhNoAutoUppercase | Qt.ImhNoPredictiveText
+
+                        topPadding: 0
+                        rightPadding: 0
+                        leftPadding: 0
+                        bottomPadding: 0
+
+                        background: Rectangle {
+                            color: AmneziaStyle.color.transparent
+                        }
+
+                        onTextChanged: {
+                            const shouldRestoreFocus = activeFocus
+                            const previousCursorPosition = cursorPosition
+
+                            ApiCountryModel.searchText = text
+
+                            if (shouldRestoreFocus) {
+                                Qt.callLater(function() {
+                                    searchField.forceActiveFocus()
+                                    searchField.cursorPosition = Math.min(previousCursorPosition, searchField.text.length)
+                                })
+                            }
+                        }
+
+                        Keys.onEscapePressed: {
+                            searchField.text = ""
+                        }
+
+                        ContextMenu.menu: ContextMenuType {
+                            textObj: searchField
+                        }
+                    }
+
+                    ImageButtonType {
+                        visible: searchField.text !== ""
+
+                        implicitWidth: 40
+                        implicitHeight: 40
+
+                        hoverEnabled: true
+                        image: "qrc:/images/controls/close.svg"
+                        imageColor: AmneziaStyle.color.paleGray
+
+                        onClicked: {
+                            searchField.text = ""
+                        }
+                        Keys.onEnterPressed: {
+                            searchField.text = ""
+                        }
+                        Keys.onReturnPressed: {
+                            searchField.text = ""
+                        }
+                    }
+                }
+            }
        }

-        delegate: ColumnLayout {
-            id: content
-
+        footer: Item {
            width: menuContent.width
-            height: content.implicitHeight
+            height: ApiCountryModel.hasVisibleRegions ? 0 : emptyStateText.implicitHeight + 32

-            RowLayout {
-                VerticalRadioButton {
-                    id: containerRadioButton
+            CaptionTextType {
+                id: emptyStateText

-                    Layout.fillWidth: true
-                    Layout.leftMargin: 16
+                anchors.left: parent.left
+                anchors.right: parent.right
+                anchors.leftMargin: 16
+                anchors.rightMargin: 16
+                anchors.top: parent.top
+                anchors.topMargin: 16

-                    text: countryName
+                visible: !ApiCountryModel.hasVisibleRegions
+                color: AmneziaStyle.color.mutedGray

-                    ButtonGroup.group: containersRadioButtonGroup
+                font.pixelSize: 15
+                horizontalAlignment: Text.AlignLeft
+                wrapMode: Text.WordWrap
+                text: "Nothing found. Try a different spelling or switch keyboard layout."
+            }
+        }

-                    imageSource: "qrc:/images/controls/download.svg"
+        delegate: Item {
+            width: menuContent.width
+            implicitHeight: rowType === "region" ? 44 : 88

-                    checked: index === ApiCountryModel.currentIndex
-                    checkable: !ConnectionController.isConnected
+            Item {
+                anchors.fill: parent
+                visible: rowType === "region"

-                    onClicked: {
-                        if (ConnectionController.isConnectionInProgress) {
-                            PageController.showNotificationMessage(qsTr("Unable change server location while trying to make an active connection"))
-                            return
-                        }
-                        if (ConnectionController.isConnected) {
-                            PageController.showNotificationMessage(qsTr("Unable change server location while there is an active connection"))
-                            return
-                        }
+                RowLayout {
+                    anchors.fill: parent
+                    anchors.leftMargin: 16
+                    anchors.rightMargin: 16
+                    anchors.topMargin: 12
+                    anchors.bottomMargin: 8
+                    spacing: 8

-                        if (index !== ApiCountryModel.currentIndex) {
-                            PageController.showBusyIndicator(true)
-                            var prevIndex = ApiCountryModel.currentIndex
-                            ApiCountryModel.currentIndex = index
-                            if (!ApiConfigsController.updateServiceFromGateway(ServersModel.defaultIndex, countryCode, countryName)) {
-                                ApiCountryModel.currentIndex = prevIndex
-                            }
-                            PageController.showBusyIndicator(false)
-                        }
+                    CaptionTextType {
+                        Layout.fillWidth: true
+                        color: AmneziaStyle.color.mutedGray
+                        text: regionName
+                        horizontalAlignment: Text.AlignLeft
+                        verticalAlignment: Text.AlignVCenter
                    }

-                    Keys.onEnterPressed: {
-                        if (checkable) {
-                            checked = true
-                        }
-                        containerRadioButton.clicked()
-                    }
-                    Keys.onReturnPressed: {
-                        if (checkable) {
-                            checked = true
-                        }
-                        containerRadioButton.clicked()
+                    Image {
+                        source: isExpanded ? "qrc:/images/controls/chevron-up.svg"
+                                           : "qrc:/images/controls/chevron-down.svg"
                    }
                }

-                Image {
-                    Layout.rightMargin: 32
-                    Layout.alignment: Qt.AlignRight
-
-                    source: "qrc:/countriesFlags/images/flagKit/" + countryImageCode + ".svg"
+                MouseArea {
+                    anchors.fill: parent
+                    cursorShape: Qt.PointingHandCursor
+                    onClicked: {
+                        ApiCountryModel.toggleRegionExpanded(regionName)
+                    }
                }
            }

-            DividerType {
-                Layout.fillWidth: true
+            ColumnLayout {
+                anchors.fill: parent
+                visible: rowType === "country"
+                spacing: 0
+
+                RowLayout {
+                    Layout.fillWidth: true
+
+                    VerticalRadioButton {
+                        id: containerRadioButton
+                        Layout.fillWidth: true
+                        Layout.leftMargin: 16
+
+                        text: countryName
+                        ButtonGroup.group: containersRadioButtonGroup
+                        imageSource: "qrc:/images/controls/download.svg"
+
+                        checked: sourceIndex >= 0 && sourceIndex === ApiCountryModel.currentIndex
+                        checkable: !ConnectionController.isConnected
+
+                        onClicked: {
+                            if (ConnectionController.isConnectionInProgress) {
+                                PageController.showNotificationMessage(qsTr("Unable change server location while trying to make an active connection"))
+                                return
+                            }
+                            if (ConnectionController.isConnected) {
+                                PageController.showNotificationMessage(qsTr("Unable change server location while there is an active connection"))
+                                return
+                            }
+
+                            if (sourceIndex !== ApiCountryModel.currentIndex) {
+                                PageController.showBusyIndicator(true)
+                                var prevIndex = ApiCountryModel.currentIndex
+                                ApiCountryModel.currentIndex = sourceIndex
+                                if (!ApiConfigsController.updateServiceFromGateway(ServersModel.defaultIndex, countryCode, sourceCountryName)) {
+                                    ApiCountryModel.currentIndex = prevIndex
+                                }
+                                PageController.showBusyIndicator(false)
+                            }
+                        }
+
+                        Keys.onEnterPressed: {
+                            if (checkable) {
+                                checked = true
+                            }
+                            containerRadioButton.clicked()
+                        }
+                        Keys.onReturnPressed: {
+                            if (checkable) {
+                                checked = true
+                            }
+                            containerRadioButton.clicked()
+                        }
+                    }
+
+                    Image {
+                        Layout.rightMargin: 32
+                        Layout.alignment: Qt.AlignRight
+                        source: "qrc:/countriesFlags/images/flagKit/" + countryImageCode + ".svg"
+                    }
+                }
+
+                DividerType {
+                    Layout.fillWidth: true
+                }
            }
        }
    }
+
 }
--- a/client/ui/qml/Pages2/PageSettingsAppSplitTunneling.qml
+++ b/client/ui/qml/Pages2/PageSettingsAppSplitTunneling.qml
@@ -224,7 +224,6 @@ PageType {
        height: addAppButton.implicitHeight + 48 + SettingsController.safeAreaBottomMargin
        
        color: AmneziaStyle.color.midnightBlack
-        opacity: 0.8
        
        RowLayout {
            id: addAppButton
--- a/client/ui/qml/Pages2/PageSettingsApplication.qml
+++ b/client/ui/qml/Pages2/PageSettingsApplication.qml
@@ -168,6 +168,29 @@ PageType {
            DividerType {
                visible: !GC.isMobile()
            }
+
+            SwitcherType {
+                id: switcherNewsNotificationEnabled
+
+                visible: ServersModel.hasServersFromGatewayApi
+
+                Layout.fillWidth: true
+                Layout.margins: 16
+
+                text: qsTr("News Notification")
+                descriptionText: qsTr("Show notification icon when has unread news")
+
+                checked: SettingsController.isNewsNotificationsEnabled()
+                onToggled: function() {
+                    if (checked !== SettingsController.isNewsNotificationsEnabled()) {
+                        SettingsController.toggleNewsNotificationsEnabled(checked)
+                    }
+                }
+            }
+
+            DividerType {
+                visible: !GC.isMobile()
+            }
        }

        footer: ColumnLayout {
--- a/client/ui/qml/Pages2/PageSettingsSplitTunneling.qml
+++ b/client/ui/qml/Pages2/PageSettingsSplitTunneling.qml
@@ -240,7 +240,6 @@ PageType {
        height: addSiteButton.implicitHeight + 48
        
        color: AmneziaStyle.color.midnightBlack
-        opacity: 0.8
        
        RowLayout {
            id: addSiteButton
--- a/client/ui/qml/Pages2/PageSetupWizardApiServiceInfo.qml
+++ b/client/ui/qml/Pages2/PageSetupWizardApiServiceInfo.qml
@@ -97,16 +97,32 @@ PageType {
                }
            }

+            ParagraphTextType {
+                Layout.fillWidth: true
+                Layout.topMargin: 16
+                Layout.leftMargin: 16
+                Layout.rightMargin: 16
+
+                visible: (Qt.platform.os === "ios" || IsMacOsNeBuild) && ApiServicesModel.getSelectedServiceType() === "amnezia-premium"
+
+                horizontalAlignment: Text.AlignHCenter
+                textFormat: Text.PlainText
+                color: AmneziaStyle.color.mutedGray
+                font.pixelSize: 12
+
+                text: qsTr("Charged to your Apple ID at confirmation. Renews automatically unless auto-renew is turned off at least 24 hours before period end. Manage in Apple ID settings.")
+            }
+
            BasicButtonType {
                id: continueButton

                Layout.fillWidth: true
                Layout.topMargin: 32
-                Layout.bottomMargin: 32
+                Layout.bottomMargin: 16
                Layout.leftMargin: 16
                Layout.rightMargin: 16

-                text: qsTr("Connect")
+                text: ApiServicesModel.getSelectedServiceType() === "amnezia-premium" ? qsTr("Subscribe Now") : qsTr("Connect")

                clickedFunc: function() {
                    PageController.showBusyIndicator(true)
@@ -121,6 +137,37 @@ PageType {
                    }
                }
            }
+
+            ParagraphTextType {
+                Layout.fillWidth: true
+                Layout.topMargin: 16
+                Layout.leftMargin: 16
+                Layout.rightMargin: 16
+                Layout.bottomMargin: 32
+
+                visible: (Qt.platform.os === "ios" || IsMacOsNeBuild) && ApiServicesModel.getSelectedServiceType() === "amnezia-premium"
+
+                horizontalAlignment: Text.AlignHCenter
+                textFormat: Text.RichText
+                color: AmneziaStyle.color.mutedGray
+                font.pixelSize: 12
+
+                text: {
+                    var termsUrl = "https://www.apple.com/legal/internet-services/itunes/dev/stdeula/"
+                    var privacyUrl = LanguageModel.getCurrentSiteUrl("policy")
+                    return qsTr("By continuing, you agree to the <a href=\"%1\" style=\"color: #FBB26A;\">Terms of Use</a> and <a href=\"%2\" style=\"color: #FBB26A;\">Privacy Policy</a>").arg(termsUrl).arg(privacyUrl)
+                }
+
+                onLinkActivated: function(link) {
+                    Qt.openUrlExternally(link)
+                }
+
+                MouseArea {
+                    anchors.fill: parent
+                    acceptedButtons: Qt.NoButton
+                    cursorShape: parent.hoveredLink ? Qt.PointingHandCursor : Qt.ArrowCursor
+                }
+            }
        }
    }

--- a/client/ui/qml/Pages2/PageSetupWizardEasy.qml
+++ b/client/ui/qml/Pages2/PageSetupWizardEasy.qml
@@ -107,6 +107,7 @@ PageType {

                onClicked: function() {
                    isEasySetup = true
+                    checked = true
                    var defaultContainerProto =  ContainerProps.defaultProtocol(dockerContainer)

                    listView.dockerContainer = dockerContainer
--- a/client/ui/qml/Pages2/PageStart.qml
+++ b/client/ui/qml/Pages2/PageStart.qml
@@ -383,7 +383,7 @@ PageType {
            objectName: "settingsTabButton"

            isSelected: tabBar.currentIndex === 2
-            image: (ServersModel.hasServersFromGatewayApi && NewsModel.hasUnread) ? "qrc:/images/controls/settings-news.svg" : "qrc:/images/controls/settings.svg"
+            image: (ServersModel.hasServersFromGatewayApi && NewsModel.hasUnread && SettingsController.isNewsNotificationsEnabled()) ? "qrc:/images/controls/settings-news.svg" : "qrc:/images/controls/settings.svg"
            Binding {
                target: settingsTabButton
                property: "defaultColor"
--- a/client/ui/qml/main2.qml
+++ b/client/ui/qml/main2.qml
@@ -83,6 +83,11 @@ Window  {
        }
    }

+    Loader {
+        active: Qt.platform.os === "android"
+        source: Qt.platform.os === "android" ? "Components/GamepadLoader.qml" : ""
+    }
+
    Connections {
        objectName: "pageControllerConnections"

--- a/client/vpnconnection.cpp
+++ b/client/vpnconnection.cpp
@@ -99,21 +99,7 @@ void VpnConnection::onConnectionStateChanged(Vpn::ConnectionState state)
                    }
                }
            }
-
-            if (container != DockerContainer::Ipsec) {
-                if (startNetworkCheckIfReady()) {
-                    m_pendingNetworkCheck = false;
-                } else {
-                    m_pendingNetworkCheck = true;
-                    qWarning() << "Deferring startNetworkCheck; missing gateway/local address"
-                               << m_vpnProtocol->vpnGateway() << m_vpnProtocol->vpnLocalAddress();
-                }
-            } else {
-                m_pendingNetworkCheck = false;
-            }
-
        } else if (state == Vpn::ConnectionState::Error) {
-            m_pendingNetworkCheck = false;
            iface->flushDns();

            if (m_settings->isSitesSplitTunnelingEnabled()) {
@@ -121,12 +107,6 @@ void VpnConnection::onConnectionStateChanged(Vpn::ConnectionState state)
                    iface->clearSavedRoutes();
                }
            }
-        } else if (state == Vpn::ConnectionState::Connecting) {
-
-        } else if (state == Vpn::ConnectionState::Disconnected) {
-            m_pendingNetworkCheck = false;
-            auto result = iface->stopNetworkCheck();
-            result.waitForFinished(3000);
        }
    });
 #endif
@@ -265,7 +245,7 @@ ErrorCode VpnConnection::lastError() const
 void VpnConnection::connectToVpn(int serverIndex, const ServerCredentials &credentials, DockerContainer container,
                                 const QJsonObject &vpnConfiguration)
 {
-    qDebug() << QString("ConnectToVpn, Server index is %1, container is %2, route mode is")
+    qDebug() << QString("Trying to connect to VPN, server index is %1, container is %2, route mode is")
                        .arg(serverIndex)
                        .arg(ContainerProps::containerToString(container))
             << m_settings->routeMode();
@@ -273,11 +253,7 @@ void VpnConnection::connectToVpn(int serverIndex, const ServerCredentials &crede
    m_remoteAddress = NetworkUtilities::getIPAddress(credentials.hostName);
    emit connectionStateChanged(Vpn::ConnectionState::Connecting);

-    m_pendingNetworkCheck = false;
    m_vpnConfiguration = vpnConfiguration;
-    m_serverIndex = serverIndex;
-    m_serverCredentials = credentials;
-    m_dockerContainer = container;

 #ifdef AMNEZIA_DESKTOP
    if (m_vpnProtocol) {
@@ -316,71 +292,12 @@ void VpnConnection::connectToVpn(int serverIndex, const ServerCredentials &crede
        emit connectionStateChanged(Vpn::ConnectionState::Error);
 }

-void VpnConnection::restartConnection()
-{
-    // Only reconnect if VPN was connected before sleep/network change
-    if (!m_wasConnectedBeforeSleep) {
-        qDebug() << "VPN was not connected before sleep/network change, skipping reconnection";
-        return;
-    }
-    
-    qDebug() << "VPN was connected before sleep/network change, attempting reconnection";
-    this->disconnectFromVpn();
-#ifdef Q_OS_LINUX
-    QThread::msleep(5000);
-#endif
-    this->connectToVpn(m_serverIndex, m_serverCredentials, m_dockerContainer, m_vpnConfiguration);
-    
-    // Reset the flag after reconnection attempt
-    m_wasConnectedBeforeSleep = false;
-}
-
 void VpnConnection::createProtocolConnections()
 {
    connect(m_vpnProtocol.data(), &VpnProtocol::protocolError, this, &VpnConnection::vpnProtocolError);
    connect(m_vpnProtocol.data(), SIGNAL(connectionStateChanged(Vpn::ConnectionState)), this,
            SLOT(onConnectionStateChanged(Vpn::ConnectionState)));
    connect(m_vpnProtocol.data(), SIGNAL(bytesChanged(quint64, quint64)), this, SLOT(onBytesChanged(quint64, quint64)));
-
-#ifdef AMNEZIA_DESKTOP
-    if (m_connectionLoseHandle)
-        disconnect(m_connectionLoseHandle);
-    if (m_networkChangeHandle)
-        disconnect(m_networkChangeHandle);
-    m_connectionLoseHandle = QMetaObject::Connection();
-    m_networkChangeHandle = QMetaObject::Connection();
-
-    // TODO: replace unsafe IpcClient::Interface() calls
-    m_connectionLoseHandle = connect(IpcClient::Interface().data(), &IpcInterfaceReplica::connectionLose,
-            this, [this]() {
-                qDebug() << "Connection Lose";
-                auto result = IpcClient::Interface()->stopNetworkCheck();
-                result.waitForFinished(3000);
-                // Track VPN state before connection loss
-                m_wasConnectedBeforeSleep = isConnected();
-                qDebug() << "VPN was connected before connection loss:" << m_wasConnectedBeforeSleep;
-                this->restartConnection();
-            });
-    m_networkChangeHandle = connect(IpcClient::Interface().data(), &IpcInterfaceReplica::networkChange,
-            this, [this]() {
-                qDebug() << "Network change";
-                // Track VPN state before network change (including sleep/wake)
-                m_wasConnectedBeforeSleep = isConnected();
-                qDebug() << "VPN was connected before network change:" << m_wasConnectedBeforeSleep;
-                this->restartConnection();
-            });
-    connect(m_vpnProtocol.data(), &VpnProtocol::tunnelAddressesUpdated,
-            this, [this](const QString& gateway, const QString& localAddress) {
-                Q_UNUSED(gateway)
-                Q_UNUSED(localAddress)
-                if (connectionState() != Vpn::ConnectionState::Connected) {
-                    return;
-                }
-                if (startNetworkCheckIfReady()) {
-                    m_pendingNetworkCheck = false;
-                }
-            });
-#endif
 }

 void VpnConnection::appendKillSwitchConfig()
@@ -482,28 +399,13 @@ void VpnConnection::appendSplitTunnelingConfig()

    m_vpnConfiguration.insert(config_key::appSplitTunnelType, appsRouteMode);
    m_vpnConfiguration.insert(config_key::splitTunnelApps, appsJsonArray);
-}

-bool VpnConnection::startNetworkCheckIfReady()
-{
-#ifdef AMNEZIA_DESKTOP
-    if (!m_vpnProtocol || m_dockerContainer == DockerContainer::Ipsec) {
-        return false;
-    }
-
-    const QString gateway = m_vpnProtocol->vpnGateway();
-    const QString localAddress = m_vpnProtocol->vpnLocalAddress();
-    if (gateway.isEmpty() || localAddress.isEmpty()) {
-        return false;
-    }
-
-    return IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
-        QRemoteObjectPendingReply<bool> reply = iface->startNetworkCheck(gateway, localAddress);
-        return reply.waitForFinished() && reply.returnValue();
-    });
-#else
-    return false;
-#endif
+    qDebug() << QString("Site split tunneling is %1, route mode is %2")
+                        .arg(m_settings->isSitesSplitTunnelingEnabled() ? "enabled" : "disabled")
+                        .arg(routeMode);
+    qDebug() << QString("App split tunneling is %1, route mode is %2")
+                        .arg(m_settings->isAppsSplitTunnelingEnabled() ? "enabled" : "disabled")
+                        .arg(appsRouteMode);
 }

 #ifdef Q_OS_ANDROID
--- a/client/vpnconnection.h
+++ b/client/vpnconnection.h
@@ -52,7 +52,6 @@ public slots:
    const ServerCredentials &credentials, DockerContainer container, const QJsonObject &vpnConfiguration);

    void disconnectFromVpn();
-    void restartConnection();

    void addRoutes(const QStringList &ips);
    void deleteRoutes(const QStringList &ips);
@@ -73,8 +72,6 @@ protected slots:

 protected:
    QSharedPointer<VpnProtocol> m_vpnProtocol;
-    QMetaObject::Connection m_connectionLoseHandle;
-    QMetaObject::Connection m_networkChangeHandle;

 private:
    std::shared_ptr<Settings> m_settings;
@@ -82,14 +79,6 @@ private:
    QJsonObject m_routeMode;
    QString m_remoteAddress;

-    ServerCredentials m_serverCredentials;
-    int m_serverIndex;
-    DockerContainer m_dockerContainer;
-    
-    // Track VPN state before sleep for smart reconnection
-    bool m_wasConnectedBeforeSleep = false;
-    bool m_pendingNetworkCheck = false;
-
    // Only for iOS for now, check counters
    QTimer m_checkTimer;

@@ -104,7 +93,6 @@ private:

   void appendSplitTunnelingConfig();
   void appendKillSwitchConfig();
-   bool startNetworkCheckIfReady();
 };

 #endif // VPNCONNECTION_H
--- a/deploy/build_windows.bat
+++ b/deploy/build_windows.bat
@@ -31,6 +31,7 @@ set SCRIPT_DIR=%PROJECT_DIR:"=%\deploy
 set WORK_DIR=%SCRIPT_DIR:"=%\build_%BUILD_ARCH:"=%
 set APP_NAME=AmneziaVPN
 set APP_FILENAME=%APP_NAME:"=%.exe
+set SERVICE_FILENAME=%APP_NAME:"=%-service.exe
 set APP_DOMAIN=org.amneziavpn.package
 set OUT_APP_DIR=%WORK_DIR:"=%\client\release
 set PREBILT_DEPLOY_DATA_DIR=%PROJECT_DIR:"=%\client\3rd-prebuilt\deploy-prebuilt\windows\x%BUILD_ARCH:"=%
@@ -43,6 +44,7 @@ set STAGE_DIR=%WORK_DIR:"=%\stage
 echo "Environment:"
 echo "WORK_DIR:             %WORK_DIR%"
 echo "APP_FILENAME:         %APP_FILENAME%"
+echo "SERVICE_FILENAME:     %SERVICE_FILENAME%"
 echo "PROJECT_DIR:          %PROJECT_DIR%"
 echo "SCRIPT_DIR:           %SCRIPT_DIR%"
 echo "OUT_APP_DIR:          %OUT_APP_DIR%"
@@ -74,7 +76,7 @@ if %errorlevel% neq 0 exit /b %errorlevel%
 echo "Deploying..."

 mkdir "%OUT_APP_DIR%"
-copy "%WORK_DIR%\service\server\release\%APP_NAME%-service.exe" "%OUT_APP_DIR%"
+copy "%WORK_DIR%\service\server\release\%SERVICE_FILENAME%" "%OUT_APP_DIR%"
 rem copy "%WORK_DIR%\client\%APP_FILENAME%" "%OUT_APP_DIR%"

 copy /Y "%PROJECT_DIR%\client\images\app.ico" "%OUT_APP_DIR%\AmneziaVPN.ico" >nul
@@ -83,7 +85,8 @@ echo "Signing exe"
 cd %OUT_APP_DIR%
 signtool sign /v /n "Privacy Technologies OU" /fd sha256 /tr http://timestamp.comodoca.com/?td=sha256 /td sha256 *.exe

-"%QT_BIN_DIR:"=%\windeployqt" --release --qmldir "%PROJECT_DIR:"=%\client"  --force --no-translations "%OUT_APP_DIR:"=%\%APP_FILENAME:"=%"
+"%QT_BIN_DIR:"=%\windeployqt" --release --qmldir "%PROJECT_DIR:"=%\client"  --force --no-translations --force-openssl "%OUT_APP_DIR:"=%\%APP_FILENAME:"=%"
+"%QT_BIN_DIR:"=%\windeployqt" --release "%OUT_APP_DIR:"=%\%SERVICE_FILENAME:"=%"

 signtool sign /v /n "Privacy Technologies OU" /fd sha256 /tr http://timestamp.comodoca.com/?td=sha256 /td sha256 *.dll

--- a/deploy/data/macos/AmneziaVPN.plist
+++ b/deploy/data/macos/AmneziaVPN.plist
@@ -10,6 +10,8 @@
    </array>
    <key>KeepAlive</key>
    <true/>
+    <key>RunAtLoad</key>
+    <true/>
    <key>Sockets</key>
 	<dict>
 	    <key>Listeners</key>
--- a/deploy/data/macos/post_install.sh
+++ b/deploy/data/macos/post_install.sh
@@ -7,42 +7,54 @@ LOG_FOLDER=/var/log/$APP_NAME
 LOG_FILE="$LOG_FOLDER/post-install.log"
 APP_PATH=/Applications/$APP_NAME.app

+rm -rf "$LOG_FOLDER"
+mkdir -p "$LOG_FOLDER"
+echo "`date` Script started" > "$LOG_FILE"
+
+log() {
+  echo "`date` $*" >> "$LOG_FILE"
+}
+
+run_cmd() {
+  log "CMD: $*"
+  "$@" >> "$LOG_FILE" 2>&1
+  local ec=$?
+  log "EXIT: $ec"
+  return $ec
+}
+
 # Handle new installations unpacked into localized folder
 if [ -d "/Applications/${APP_NAME}.localized" ]; then
-  echo "`date` Detected ${APP_NAME}.localized, migrating to standard path" >> $LOG_FILE
-  sudo rm -rf "$APP_PATH"
-  sudo mv "/Applications/${APP_NAME}.localized/${APP_NAME}.app" "$APP_PATH"
-  sudo rm -rf "/Applications/${APP_NAME}.localized"
+  log "Detected ${APP_NAME}.localized, migrating to standard path"
+  run_cmd sudo rm -rf "$APP_PATH"
+  run_cmd sudo mv "/Applications/${APP_NAME}.localized/${APP_NAME}.app" "$APP_PATH"
+  run_cmd sudo rm -rf "/Applications/${APP_NAME}.localized"
 fi

-if launchctl list "$APP_NAME-service" &> /dev/null; then
-    launchctl unload "$LAUNCH_DAEMONS_PLIST_NAME"
-    rm -f "$LAUNCH_DAEMONS_PLIST_NAME"
-fi
+run_cmd launchctl bootout system "$LAUNCH_DAEMONS_PLIST_NAME" || run_cmd launchctl unload "$LAUNCH_DAEMONS_PLIST_NAME"
+run_cmd rm -f "$LAUNCH_DAEMONS_PLIST_NAME"

-sudo chmod -R a-w "$APP_PATH/"
-sudo chown -R root "$APP_PATH/"
-sudo chgrp -R wheel "$APP_PATH/"
+run_cmd sudo chmod -R a-w "$APP_PATH/"
+run_cmd sudo chown -R root "$APP_PATH/"
+run_cmd sudo chgrp -R wheel "$APP_PATH/"

-rm -rf	$LOG_FOLDER
-mkdir -p $LOG_FOLDER
-
-echo "`date` Script started" > $LOG_FILE
-
-echo "Requesting ${APP_NAME} to quit gracefully" >> "$LOG_FILE"
-osascript -e 'tell application "AmneziaVPN" to quit'
+log "Requesting ${APP_NAME} to quit gracefully"
+run_cmd osascript -e 'tell application "AmneziaVPN" to quit' || true

 PLIST_SOURCE="$APP_PATH/Contents/Resources/$PLIST_NAME"
 if [ -f "$PLIST_SOURCE" ]; then
-  mv -f "$PLIST_SOURCE" "$LAUNCH_DAEMONS_PLIST_NAME" 2>> $LOG_FILE
+  run_cmd mv -f "$PLIST_SOURCE" "$LAUNCH_DAEMONS_PLIST_NAME"
 else
-  echo "`date` ERROR: service plist not found at $PLIST_SOURCE" >> $LOG_FILE
+  log "ERROR: service plist not found at $PLIST_SOURCE"
 fi

-chown root:wheel "$LAUNCH_DAEMONS_PLIST_NAME"
-launchctl load "$LAUNCH_DAEMONS_PLIST_NAME"
-echo "`date` Launching ${APP_NAME} application" >> $LOG_FILE
-open -a "$APP_PATH" 2>> $LOG_FILE || true
+run_cmd chown root:wheel "$LAUNCH_DAEMONS_PLIST_NAME"
+run_cmd chmod 644 "$LAUNCH_DAEMONS_PLIST_NAME"
+run_cmd launchctl bootstrap system "$LAUNCH_DAEMONS_PLIST_NAME" || run_cmd launchctl load "$LAUNCH_DAEMONS_PLIST_NAME"
+run_cmd launchctl enable "system/$APP_NAME-service" || true
+run_cmd launchctl kickstart -k "system/$APP_NAME-service" || true
+run_cmd launchctl print "system/$APP_NAME-service" || true
+log "Launching ${APP_NAME} application"
+run_cmd open -a "$APP_PATH" || true

-echo "`date` Service status: $?" >> $LOG_FILE
-echo "`date` Script finished" >> $LOG_FILE
+log "Script finished"
--- a/deploy/data/macos/post_uninstall.sh
+++ b/deploy/data/macos/post_uninstall.sh
@@ -29,7 +29,7 @@ fi

 # Unload the service if loaded and remove its plist file regardless
 if launchctl list "${APP_NAME}-service" &> /dev/null; then
-    sudo launchctl unload "$LAUNCH_DAEMONS_PLIST_NAME"
+    sudo launchctl bootout system "$LAUNCH_DAEMONS_PLIST_NAME" || sudo launchctl unload "$LAUNCH_DAEMONS_PLIST_NAME"
 fi
 sudo rm -f "$LAUNCH_DAEMONS_PLIST_NAME"

--- a/deploy/deploy_s3.sh
+++ b/deploy/deploy_s3.sh
@@ -1,9 +1,9 @@
-#!/bin/sh
+#!/bin/bash
 set -e

 VERSION=$1

-if [[ $VERSION = '' ]]; then
+if [[ -z "$VERSION" ]]; then
    echo '::error::VERSION does not set. Exiting with error...'
    exit 1
 fi
@@ -14,25 +14,39 @@ cd dist

 echo $VERSION >> VERSION
 curl -s https://api.github.com/repos/amnezia-vpn/amnezia-client/releases/tags/$VERSION | jq -r .body | tr -d '\r' > CHANGELOG
+curl -s https://api.github.com/repos/amnezia-vpn/amnezia-client/releases/tags/$VERSION | jq -r .published_at > RELEASE_DATE

 if [[ $(cat CHANGELOG) = null ]]; then
 	echo '::error::Release does not exists. Exiting with error...'
 	exit 1
 fi

-wget -q https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android8+_arm64-v8a.apk
-wget -q https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android8+_armeabi-v7a.apk
-wget -q https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android8+_x86.apk
-wget -q https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android8+_x86_64.apk
-wget -q https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android_7_arm64-v8a.apk
-wget -q https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android_7_armeabi-v7a.apk
-wget -q https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android_7_x86.apk
-wget -q https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android_7_x86_64.apk
-wget -q https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_linux_x64.tar.zip
-wget -q https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_macos.dmg
-wget -q https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_macos_old.dmg
-wget -q https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_windows_x64.exe 
+# Download files with error handling
+download_file() {
+    local url=$1
+    local filename=$(basename "$url")
+    echo "Downloading $filename..."
+    if ! wget -q "$url"; then
+        echo "::error::Failed to download $filename from $url"
+        exit 8
+    fi
+    echo "Successfully downloaded $filename"
+}
+
+download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android9+_arm64-v8a.apk
+download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android9+_armeabi-v7a.apk
+download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android9+_x86.apk
+download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android9+_x86_64.apk
+download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_linux_x64.tar
+download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_macos.pkg
+download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_x64.exe 

 cd ../

-rclone sync ./dist/ r2:/updates/
+echo "Syncing to R2..."
+if ! rclone sync ./dist/ r2:/updates/; then
+    echo "::error::Failed to sync files to R2"
+    exit 8
+fi
+
+echo "Deployment completed successfully!"
--- a/ipc/ipc.h
+++ b/ipc/ipc.h
@@ -11,6 +11,7 @@
 namespace amnezia {

 enum PermittedProcess {
+    Invalid,
    OpenVPN,
    Wireguard,
    Tun2Socks,
@@ -19,16 +20,18 @@ enum PermittedProcess {

 inline QString permittedProcessPath(PermittedProcess pid)
 {
-    if (pid == PermittedProcess::OpenVPN) {
-        return Utils::openVpnExecPath();
-    } else if (pid == PermittedProcess::Wireguard) {
-        return Utils::wireguardExecPath();
-    } else if (pid == PermittedProcess::CertUtil) {
-        return Utils::certUtilPath();
-    } else if (pid == PermittedProcess::Tun2Socks) {
-        return Utils::tun2socksPath();
+    switch (pid) {
+        case PermittedProcess::OpenVPN:
+            return Utils::openVpnExecPath();
+        case PermittedProcess::Wireguard:
+            return Utils::wireguardExecPath();
+        case PermittedProcess::CertUtil:
+            return Utils::certUtilPath();
+        case PermittedProcess::Tun2Socks:
+            return Utils::tun2socksPath();
+        default:
+            return "";
    }
-    return "";
 }


@@ -48,6 +51,51 @@ inline QString getIpcProcessUrl(int pid) {
 #endif
 }

+inline QStringList sanitizeArguments(PermittedProcess proc, const QStringList &args) {
+    using Validator = std::function<bool(const QString&)>;
+    QMap<QString, Validator> namedArgs;
+    QList<Validator> positionalArgs;
+
+    switch (proc) {
+    case Tun2Socks:
+        namedArgs["-device"] = [](const QString& v) { return v.startsWith("tun://"); };
+        namedArgs["-proxy"] = [](const QString& v) { return v.startsWith("socks5://"); };
+        break;
+    default:
+        //FIXME
+        return args;
+    }
+
+
+    QStringList sanitized;
+
+    for (int i = 0, pos = 0; i < args.size(); i++) {
+        const auto& key = args[i];
+
+        if (const auto found = namedArgs.find(key); found != namedArgs.end()) {
+            const auto validator = found.value();
+
+            if (validator) {
+                if (i + 1 < args.size()) {
+                    const auto& value = args[i+1];
+                    if (validator(value)) {
+                        sanitized << key << value;
+                        i++;
+                    }
+                }
+            } else {
+                sanitized << key;
+            }
+        } else if (pos < positionalArgs.size()) {
+            if (const auto validator = positionalArgs[pos]; validator && validator(key)) {
+                sanitized << key;
+                pos++;
+            }
+        }
+    }
+
+    return sanitized;
+}

 } // namespace amnezia

--- a/ipc/ipc_interface.rep
+++ b/ipc/ipc_interface.rep
@@ -38,8 +38,8 @@ class IpcInterface
    SLOT( bool updateResolvers(const QString& ifname, const QList<QHostAddress>& resolvers) );
    SLOT( bool restoreResolvers() );

-    SLOT(void xrayStart(const QString &config));
-    SLOT(void xrayStop());
+    SLOT(bool xrayStart(const QString &config));
+    SLOT(bool xrayStop());

    SLOT( bool startNetworkCheck(const QString& serverIpv4Gateway, const QString& deviceIpv4Address) );
    SLOT( bool stopNetworkCheck() );
--- a/ipc/ipc_process_interface.rep
+++ b/ipc/ipc_process_interface.rep
@@ -4,6 +4,8 @@
 class IpcProcessInterface
 {
    SLOT( start() );
+    SLOT( terminate() );
+    SLOT( kill() );
    SLOT( close() );

    SLOT( setArguments(const QStringList &arguments) );
@@ -17,6 +19,11 @@ class IpcProcessInterface
    SLOT( QByteArray readAllStandardError() );
    SLOT( QByteArray readAllStandardOutput() );

+    SLOT( bool waitForFinished() );
+    SLOT( bool waitForFinished(int msecs) );
+    SLOT( bool waitForStarted() );
+    SLOT( bool waitForStarted(int msecs) );
+

    SIGNAL( errorOccurred(QProcess::ProcessError error) );
    SIGNAL( finished(int exitCode, QProcess::ExitStatus exitStatus) );
--- a/ipc/ipc_process_tun2socks.rep
+++ b/ipc/ipc_process_tun2socks.rep
@@ -1,11 +0,0 @@
-#include <QtCore>
-#include <QString>
-
-class IpcProcessTun2Socks
-{
-    SLOT( start() );
-    SLOT( stop() );
-
-    SIGNAL( setConnectionState(int state) );
-    SIGNAL( stateChanged(QProcess::ProcessState newState) );
-};
--- a/ipc/ipcserver.cpp
+++ b/ipc/ipcserver.cpp
@@ -304,7 +304,7 @@ bool IpcServer::refreshKillSwitch(bool enabled)
    return KillSwitch::instance()->refresh(enabled);
 }

-void IpcServer::xrayStart(const QString& cfg)
+bool IpcServer::xrayStart(const QString& cfg)
 {
 #ifdef MZ_DEBUG
    qDebug() << "IpcServer::xrayStart";
@@ -313,7 +313,7 @@ void IpcServer::xrayStart(const QString& cfg)
    return Xray::getInstance().startXray(cfg);
 }

-void IpcServer::xrayStop()
+bool IpcServer::xrayStop()
 {
 #ifdef MZ_DEBUG
    qDebug() << "IpcServer::xrayStop";
--- a/ipc/ipcserver.h
+++ b/ipc/ipcserver.h
@@ -10,10 +10,8 @@

 #include "ipc.h"
 #include "ipcserverprocess.h"
-#include "ipctun2socksprocess.h"

 #include "rep_ipc_interface_source.h"
-#include "rep_ipc_process_tun2socks_source.h"

 class IpcServer : public IpcInterfaceSource
 {
@@ -44,8 +42,8 @@ public:
    virtual bool refreshKillSwitch( bool enabled ) override;
    virtual bool updateResolvers(const QString& ifname, const QList<QHostAddress>& resolvers) override;
    virtual bool restoreResolvers() override;
-    virtual void xrayStart(const QString& cfg) override;
-    virtual void xrayStop() override;
+    virtual bool xrayStart(const QString& cfg) override;
+    virtual bool xrayStop() override;
    virtual bool startNetworkCheck(const QString& serverIpv4Gateway, const QString& deviceIpv4Address) override;
    virtual bool stopNetworkCheck() override;

@@ -56,12 +54,10 @@ private:
        ProcessDescriptor (QObject *parent = nullptr) {
            serverNode = QSharedPointer<QRemoteObjectHost>(new QRemoteObjectHost(parent));
            ipcProcess = QSharedPointer<IpcServerProcess>(new IpcServerProcess(parent));
-            tun2socksProcess = QSharedPointer<IpcProcessTun2Socks>(new IpcProcessTun2Socks(parent));
            localServer = QSharedPointer<QLocalServer>(new QLocalServer(parent));
        }

        QSharedPointer<IpcServerProcess> ipcProcess;
-        QSharedPointer<IpcProcessTun2Socks> tun2socksProcess;
        QSharedPointer<QRemoteObjectHost> serverNode;
        QSharedPointer<QLocalServer> localServer;
    };
--- a/ipc/ipcserverprocess.cpp
+++ b/ipc/ipcserverprocess.cpp
@@ -40,6 +40,14 @@ void IpcServerProcess::start()
    m_process->waitForStarted();
 }

+void IpcServerProcess::terminate() {
+    m_process->terminate();
+}
+
+void IpcServerProcess::kill() {
+    m_process->kill();
+}
+
 void IpcServerProcess::close()
 {
    m_process->close();
@@ -47,7 +55,7 @@ void IpcServerProcess::close()

 void IpcServerProcess::setArguments(const QStringList &arguments)
 {
-    m_process->setArguments(arguments);
+    m_process->setArguments(amnezia::sanitizeArguments(m_program, arguments));
 }

 void IpcServerProcess::setInputChannelMode(QProcess::InputChannelMode mode)
@@ -69,7 +77,9 @@ void IpcServerProcess::setProcessChannelMode(QProcess::ProcessChannelMode mode)

 void IpcServerProcess::setProgram(int programId)
 {
-    m_process->setProgram(amnezia::permittedProcessPath(static_cast<amnezia::PermittedProcess>(programId)));
+    m_program = static_cast<amnezia::PermittedProcess>(programId);
+    m_process->setProgram(amnezia::permittedProcessPath(m_program));
+    m_process->setArguments({});
 }

 void IpcServerProcess::setWorkingDirectory(const QString &dir)
@@ -92,4 +102,20 @@ QByteArray IpcServerProcess::readAllStandardOutput()
    return m_process->readAllStandardOutput();
 }

+bool IpcServerProcess::waitForStarted() {
+    return m_process->waitForStarted();
+}
+
+bool IpcServerProcess::waitForStarted(int msecs) {
+    return m_process->waitForStarted(msecs);
+}
+
+bool IpcServerProcess::waitForFinished() {
+    return m_process->waitForFinished();
+}
+
+bool IpcServerProcess::waitForFinished(int msecs) {
+    return m_process->waitForFinished(msecs);
+}
+
 #endif
--- a/ipc/ipcserverprocess.h
+++ b/ipc/ipcserverprocess.h
@@ -1,6 +1,7 @@
 #ifndef IPCSERVERPROCESS_H
 #define IPCSERVERPROCESS_H

+#include "ipc.h"
 #include <QObject>

 #ifndef Q_OS_IOS
@@ -14,6 +15,8 @@ public:
    virtual ~IpcServerProcess();

    void start() override;
+    void terminate() override;
+    void kill() override;
    void close() override;

    void setArguments(const QStringList &arguments) override;
@@ -27,9 +30,15 @@ public:
    QByteArray readAllStandardError() override;
    QByteArray readAllStandardOutput() override;

+    bool waitForStarted() override;
+    bool waitForStarted(int msecs) override;
+    bool waitForFinished() override;
+    bool waitForFinished(int msecs) override;
+
 signals:

 private:
+    amnezia::PermittedProcess m_program = amnezia::PermittedProcess::Invalid;
    QSharedPointer<QProcess> m_process;
 };

--- a/ipc/ipctun2socksprocess.cpp
+++ b/ipc/ipctun2socksprocess.cpp
@@ -1,79 +0,0 @@
-#include "ipctun2socksprocess.h"
-#include "ipc.h"
-#include <QProcess>
-#include <QString>
-
-#include "../protocols/protocols_defs.h"
-
-#ifndef Q_OS_IOS
-
-IpcProcessTun2Socks::IpcProcessTun2Socks(QObject *parent) :
-    IpcProcessTun2SocksSource(parent),
-    m_t2sProcess(QSharedPointer<QProcess>(new QProcess()))
-{
-    qDebug() << "IpcProcessTun2Socks::IpcProcessTun2Socks()";
-
-}
-
-IpcProcessTun2Socks::~IpcProcessTun2Socks()
-{
-    qDebug() << "IpcProcessTun2Socks::~IpcProcessTun2Socks()";
-}
-
-void IpcProcessTun2Socks::start()
-{
-    connect(m_t2sProcess.data(), &QProcess::stateChanged, this, &IpcProcessTun2Socks::stateChanged);
-    qDebug() << "IpcProcessTun2Socks::start()";
-    m_t2sProcess->setProgram(amnezia::permittedProcessPath(static_cast<amnezia::PermittedProcess>(amnezia::PermittedProcess::Tun2Socks)));
-
-    QString XrayConStr = "socks5://127.0.0.1:10808";
-
-#ifdef Q_OS_WIN
-    QStringList arguments({"-device", "tun://tun2?guid={081A8A84-8D12-4DF5-B8C4-396D5B0053E4}", "-proxy", XrayConStr, "-tun-post-up",
-                           QString("cmd /c netsh interface ip set address name=\"tun2\" static %1 255.255.255.255")
-                               .arg(amnezia::protocols::xray::defaultLocalAddr)});
-#endif
-#ifdef Q_OS_LINUX
-    QStringList arguments({"-device", "tun://tun2", "-proxy", XrayConStr});
-#endif
-#ifdef Q_OS_MAC
-    QStringList arguments({"-device", "utun22", "-proxy", XrayConStr});
-#endif
-
-    m_t2sProcess->setArguments(arguments);
-
-    if (Utils::processIsRunning(Utils::executable("tun2socks", false))) {
-        qDebug().noquote() << "kill previos tun2socks";
-        Utils::killProcessByName(Utils::executable("tun2socks", false));
-    }
-
-    m_t2sProcess->start();
-
-    connect(m_t2sProcess.data(), &QProcess::readyReadStandardOutput, this, [this]() {
-        QString line = m_t2sProcess.data()->readAllStandardOutput();
-        if (line.contains("[STACK] tun://") && line.contains("<-> socks5://127.0.0.1")) {
-            emit setConnectionState(Vpn::ConnectionState::Connected);
-        }
-    });
-
-    connect(m_t2sProcess.data(), QOverload<int, QProcess::ExitStatus>::of(&QProcess::finished), this, [this](int exitCode, QProcess::ExitStatus exitStatus) {
-        qDebug().noquote() << "tun2socks finished, exitCode, exiStatus" << exitCode << exitStatus;
-        emit setConnectionState(Vpn::ConnectionState::Disconnected);
-        if ((exitStatus != QProcess::NormalExit) || (exitCode != 0)) {
-            emit setConnectionState(Vpn::ConnectionState::Error);
-        }
-
-    });
-
-    m_t2sProcess->start();
-    m_t2sProcess->waitForStarted();
-}
-
-void IpcProcessTun2Socks::stop()
-{
-    qDebug() << "IpcProcessTun2Socks::stop()";
-    m_t2sProcess->disconnect();
-    m_t2sProcess->kill();
-    m_t2sProcess->waitForFinished(3000);
-}
-#endif
--- a/ipc/ipctun2socksprocess.h
+++ b/ipc/ipctun2socksprocess.h
@@ -1,52 +0,0 @@
-#ifndef IPCTUN2SOCKSPROCESS_H
-#define IPCTUN2SOCKSPROCESS_H
-
-#include <QObject>
-
-#ifndef Q_OS_IOS
-#include "rep_ipc_process_tun2socks_source.h"
-
-namespace Vpn
-{
-Q_NAMESPACE
-    enum ConnectionState {
-        Unknown,
-        Disconnected,
-        Preparing,
-        Connecting,
-        Connected,
-        Disconnecting,
-        Reconnecting,
-        Error
-    };
-Q_ENUM_NS(ConnectionState)
-}
-
-
-class IpcProcessTun2Socks : public IpcProcessTun2SocksSource
-{
-    Q_OBJECT
-public:
-    explicit IpcProcessTun2Socks(QObject *parent = nullptr);
-    virtual ~IpcProcessTun2Socks();
-
-    void start() override;
-    void stop() override;
-
-signals:
-
-private:
-    QSharedPointer<QProcess> m_t2sProcess;
-};
-
-#else
-class IpcProcessTun2Socks : public QObject
-{
-    Q_OBJECT
-
-public:
-    explicit IpcProcessTun2Socks(QObject *parent = nullptr);
-};
-#endif
-
-#endif // IPCTUN2SOCKSPROCESS_H
--- a/service/server/CMakeLists.txt
+++ b/service/server/CMakeLists.txt
@@ -6,7 +6,7 @@ project(${PROJECT} VERSION ${AMNEZIAVPN_VERSION})
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)

-find_package(Qt6 REQUIRED COMPONENTS DBus Core Network Widgets RemoteObjects Core5Compat)
+find_package(Qt6 REQUIRED COMPONENTS DBus Core Network Widgets RemoteObjects Core5Compat Concurrent)
 qt_standard_project_setup()


@@ -75,7 +75,6 @@ set(HEADERS
    ${CMAKE_CURRENT_LIST_DIR}/../../ipc/ipc.h
    ${CMAKE_CURRENT_LIST_DIR}/../../ipc/ipcserver.h
    ${CMAKE_CURRENT_LIST_DIR}/../../ipc/ipcserverprocess.h
-    ${CMAKE_CURRENT_LIST_DIR}/../../ipc/ipctun2socksprocess.h
    ${CMAKE_CURRENT_LIST_DIR}/localserver.h
    ${CMAKE_CURRENT_LIST_DIR}/../../common/logger/logger.h
    ${CMAKE_CURRENT_LIST_DIR}/router.h
@@ -97,7 +96,6 @@ set(SOURCES
    ${CMAKE_CURRENT_LIST_DIR}/../../client/core/networkUtilities.cpp
    ${CMAKE_CURRENT_LIST_DIR}/../../ipc/ipcserver.cpp
    ${CMAKE_CURRENT_LIST_DIR}/../../ipc/ipcserverprocess.cpp
-    ${CMAKE_CURRENT_LIST_DIR}/../../ipc/ipctun2socksprocess.cpp
    ${CMAKE_CURRENT_LIST_DIR}/localserver.cpp
    ${CMAKE_CURRENT_LIST_DIR}/../../common/logger/logger.cpp
    ${CMAKE_CURRENT_LIST_DIR}/main.cpp
@@ -353,7 +351,7 @@ include_directories(


 add_executable(${PROJECT} ${SOURCES} ${HEADERS} ${RESOURCES})
-target_link_libraries(${PROJECT} PRIVATE Qt6::Core Qt6::Widgets Qt6::Network Qt6::RemoteObjects Qt6::Core5Compat Qt6::DBus ${LIBS})
+target_link_libraries(${PROJECT} PRIVATE Qt6::Core Qt6::Widgets Qt6::Network Qt6::RemoteObjects Qt6::Core5Compat Qt6::DBus Qt6::Concurrent ${LIBS})
 target_compile_definitions(${PROJECT} PRIVATE "MZ_$<UPPER_CASE:${MZ_PLATFORM_NAME}>")

 if(CMAKE_BUILD_TYPE STREQUAL "Debug")
@@ -389,7 +387,6 @@ endif()

 qt_add_repc_sources(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../../ipc/ipc_interface.rep)
 qt_add_repc_sources(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../../ipc/ipc_process_interface.rep)
-qt_add_repc_sources(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../../ipc/ipc_process_tun2socks.rep)

 # copy deploy artifacts required to run the application to the debug build folder
 if(WIN32)
--- a/service/server/localserver.cpp
+++ b/service/server/localserver.cpp
@@ -40,7 +40,6 @@ LocalServer::LocalServer(QObject *parent) : QObject(parent),
        if (!m_isRemotingEnabled) {
            m_isRemotingEnabled = true;
            m_serverNode.enableRemoting(&m_ipcServer);
-            m_serverNode.enableRemoting(&m_tun2socks);
        }
    });

--- a/service/server/localserver.h
+++ b/service/server/localserver.h
@@ -38,7 +38,6 @@ public:
    ~LocalServer();
    QSharedPointer<QLocalServer> m_server;
    IpcServer m_ipcServer;
-    IpcProcessTun2Socks m_tun2socks;
    QRemoteObjectHost m_serverNode;
    bool m_isRemotingEnabled = false;

--- a/service/server/router.cpp
+++ b/service/server/router.cpp
@@ -66,6 +66,9 @@ void Router::resetIpStack()

 bool Router::createTun(const QString &dev, const QString &subnet)
 {
+#ifdef Q_OS_WIN
+    return RouterWin::Instance().createTun(dev, subnet);
+#endif
 #ifdef Q_OS_LINUX
    return RouterLinux::Instance().createTun(dev, subnet);
 #endif
--- a/service/server/router_win.cpp
+++ b/service/server/router_win.cpp
@@ -5,6 +5,7 @@
 #include <tchar.h>

 #include <QProcess>
+#include <QtConcurrent>

 #include <core/networkUtilities.h>

@@ -308,6 +309,77 @@ void RouterWin::resetIpStack()
    }
 }

+bool RouterWin::createTun(const QString &dev, const QString &subnet)
+{
+    NET_LUID luid;
+    DWORD res = ConvertInterfaceAliasToLuid(reinterpret_cast<const wchar_t*>(dev.utf16()), &luid);
+    if (res != NO_ERROR) {
+        qCritical() << "Failed to convert luid: " << res;
+        return false;
+    }
+
+    HANDLE hEvent = CreateEvent(nullptr, true, false, nullptr);
+    if (!hEvent) {
+        qCritical() << "Failed to allocate event object";
+        return false;
+    }
+    auto _guardEvent = qScopeGuard([hEvent](){ CloseHandle(hEvent); });
+
+    struct {
+        HANDLE hEvent;
+        NET_LUID luid;
+        const QString &subnet;
+        bool found;
+    } ctx = { .hEvent = hEvent, .luid = luid, .subnet = subnet, .found = false };
+
+    auto cb = [](void *priv, MIB_UNICASTIPADDRESS_ROW *row, MIB_NOTIFICATION_TYPE NotificationType) {
+        auto* c = reinterpret_cast<decltype(ctx)*>(priv);
+        if (row != nullptr && row->InterfaceLuid.Value == c->luid.Value && row->Address.si_family == AF_INET) {
+            char ip[INET_ADDRSTRLEN];
+            inet_ntop(row->Address.Ipv4.sin_family, &row->Address.Ipv4.sin_addr, ip, INET_ADDRSTRLEN);
+            if (c->subnet == ip) {
+                c->found = true;
+                SetEvent(c->hEvent);
+            }
+        }
+    };
+
+    HANDLE hNotif;
+    res = NotifyUnicastIpAddressChange(AF_INET, cb, &ctx, false, &hNotif);
+    if (res != NO_ERROR) {
+        qCritical() << "Failed to subscribe to interface change";
+        return false;
+    }
+    auto _guardNotif = qScopeGuard([hNotif](){ CancelMibChangeNotify2(hNotif); });
+
+    MIB_UNICASTIPADDRESS_ROW row;
+    InitializeUnicastIpAddressEntry(&row);
+
+    row.InterfaceLuid = luid;
+    row.Address.si_family = AF_INET;
+
+    inet_pton(AF_INET, subnet.toStdString().c_str(), &row.Address.Ipv4.sin_addr);
+
+    row.OnLinkPrefixLength = 32;
+    row.ValidLifetime = 0xffffffff;
+    row.PreferredLifetime = 0xffffffff;
+    row.DadState = IpDadStatePreferred;
+
+    res = CreateUnicastIpAddressEntry(&row);
+    if (res != NO_ERROR && res != ERROR_OBJECT_ALREADY_EXISTS) {
+        qDebug() << "Failed to create IP address:" << res;
+        return false;
+    }
+
+    res = WaitForSingleObject(hEvent, 10000);
+    if (res == WAIT_TIMEOUT) {
+        qCritical() << "Timeout of waiting for IP assignment for " << dev << " device";
+        return false;
+    }
+
+    return ctx.found;
+}
+
 void RouterWin::suspendWcmSvc(bool suspend)
 {
    if (suspend == m_suspended) return;
@@ -465,11 +537,19 @@ bool RouterWin::StopRoutingIpv6()
    qDebug() << "RouterWin::StopRoutingIpv6";

    if (auto loopback = findLoopbackIface(); loopback.isValid()) {
-        for (auto subnet : kIpv6Subnets) {
-            QProcess{}.execute("netsh", { "interface", "ipv6", "add", "route", subnet, QString("interface=%1").arg(loopback.index()), "metric=0", "store=active" });
-        }
+        QFuture<bool> res = QtConcurrent::mappedReduced(kIpv6Subnets, [loopback](const QString &subnet) -> bool {
+            int res = QProcess::execute("netsh", { "interface", "ipv6", "add", "route", subnet, QString("interface=%1").arg(loopback.index()), "metric=0", "store=active" });
+            return res == 0;
+        },
+        [](bool &result, bool success) {
+            result = result && success;
+        }, true);
+
+        res.waitForFinished();
+        return res.result();
    }
-    return true;
+
+    return false;
 }

 bool RouterWin::StartRoutingIpv6()
@@ -477,9 +557,14 @@ bool RouterWin::StartRoutingIpv6()
    qDebug() << "RouterWin::StartRoutingIpv6";

    if (auto loopback = findLoopbackIface(); loopback.isValid()) {
-        for (auto subnet : kIpv6Subnets) {
-            QProcess{}.execute("netsh", { "interface", "ipv6", "delete", "route", subnet, QString("interface=%1").arg(loopback.index()) });
-        }
+        QFuture<bool> res = QtConcurrent::mappedReduced(kIpv6Subnets, [loopback](const QString &subnet) -> bool {
+            int res = QProcess::execute("netsh", { "interface", "ipv6", "delete", "route", subnet, QString("interface=%1").arg(loopback.index()) });
+            return res == 0;
+        },
+        [](bool &result, bool success) {
+            result = result && success;
+        }, true);
    }
-    return true;
+
+    return false;
 }
--- a/service/server/router_win.h
+++ b/service/server/router_win.h
@@ -45,6 +45,7 @@ public:
    bool StartRoutingIpv6();
    bool StopRoutingIpv6();

+    bool createTun(const QString &dev, const QString &subnet);
    void suspendWcmSvc(bool suspend);
    bool updateResolvers(const QString& ifname, const QList<QHostAddress>& resolvers);
    bool restoreResolvers();
--- a/service/server/xray.cpp
+++ b/service/server/xray.cpp
@@ -27,7 +27,7 @@
    #include <sys/socket.h>
 #endif

-void Xray::startXray(const QString &cfg)
+bool Xray::startXray(const QString &cfg)
 {
    qDebug() << "Xray::startXray()";

@@ -40,34 +40,38 @@ void Xray::startXray(const QString &cfg)

    if (auto err = amnezia_xray_setsockcallback(ctxSockCallback, this); err != nullptr) {
        qDebug() << "[xray] sockopt failed: " << err;
-        free(err);
-        return;
-    }
-
-    QByteArray bytes = cfg.toUtf8();
-    if (auto err = amnezia_xray_configure(bytes.data()); err != nullptr) {
-        qDebug() << "[xray] configuration failed: " << err;
-        free(err);
-        return;
+        amnezia_xray_free(err);
+        return false;
    }

    amnezia_xray_setloghandler(ctxLogHandler, this);

+    QByteArray bytes = cfg.toUtf8();
+    if (auto err = amnezia_xray_configure(bytes.data()); err != nullptr) {
+        qDebug() << "[xray] configuration failed: " << err;
+        amnezia_xray_free(err);
+        return false;
+    }
+
    if (auto err = amnezia_xray_start(); err != nullptr) {
        qDebug() << "[xray] failed to start: " << err;
-        free(err);
-        return;
+        amnezia_xray_free(err);
+        return false;
    }
+
+    return true;
 }

-void Xray::stopXray()
+bool Xray::stopXray()
 {
    qDebug() << "Xray::stopXray()";
    if (auto err = amnezia_xray_stop(); err != nullptr) {
        qDebug() << "[xray] failed to stop: " << err;
-        free(err);
-        return;
+        amnezia_xray_free(err);
+        return false;
    }
+
+    return true;
 }

 void Xray::logHandler(char* str)
--- a/service/server/xray.h
+++ b/service/server/xray.h
@@ -12,8 +12,8 @@ public:
        return instance;
    }

-    void startXray(const QString& cfg);
-    void stopXray();
+    bool startXray(const QString& cfg);
+    bool stopXray();

 private:
    static void ctxSockCallback(uintptr_t fd, void* ctx) {
Author	SHA1	Message	Date
Mitternacht822	532a2b49b5	fix: added single space trim to country search in apiCountryModel.cpp	2026-03-06 15:25:23 +04:00
Mitternacht822	a685548b30	fix: changed color of backbutton area on api countries page	2026-03-06 15:17:54 +04:00
Mitternacht822	4c4d5a62ce	fix(ui): keep back button pinned in top overlay at countries selection api page	2026-03-02 15:48:33 +04:00
Mitternacht822	38c48c86e4	refactor: removed regionDefinitions and built regions from backend country data	2026-02-27 18:07:54 +04:00
Mitternacht822	0540cd0818	fix: returned logger to apiCountryModel	2026-02-23 16:41:42 +04:00
Mitternacht822	8e75da27ea	refactor: replace groupedRegions with internal list model	2026-02-23 16:38:14 +04:00
Mitternacht822	5938abb605	refactor: moved premium countries/regions model from qml to ApiCountriesRegionModel	2026-02-20 14:12:56 +04:00
Mitternacht822	1f14af1d22	feat(ui): redesign premium countries page with collapsible regions lists	2026-02-19 22:33:05 +04:00
Mitternacht822	e00bf7d591	feat(ui):added ability to search countries on premium countries page by russian country name translation	2026-02-19 21:42:41 +04:00
Mitternacht822	d474d251bf	feat(ui): added ability to search countries on premium countries page by country code	2026-02-19 21:28:15 +04:00
Mitternacht822	1414f0ee84	feat: added search field to the page with country list	2026-02-18 22:52:34 +04:00
Mitternacht822	47f4a83983	refactor: refactored ui for countries and locations for premium server	2026-02-18 20:35:51 +04:00
Mitternacht822	a9175f8dfc	feat(ui): group premium server countries into collapsible sections by region	2026-02-17 15:08:42 +04:00
vkamn	d78416835c	chore: change default i1 value (#2216 )	2026-02-13 17:10:10 +08:00
vkamn	40e6c6aae3	feat: native wg with obfuscation (#2209 ) * chore: change default i1 value * feat: add i1 to native wg with obfuscation	2026-02-12 11:34:52 +08:00
Yaroslav Gurov	911a999c64	fix: xray stability and split-tunneling (#2187 ) * fix: xray heap corruption * fix: use proper configuration for split-tunneled apps * chore: enable killswitch * chore: xray windows split-tunneling cleanup * chore: proper xray killswitch log * feat: add wait for the tun device * chore: update amnezia_xray deps for macos * fix: add nullptr check for split-tunnel on win * fix: modernize vpnAdapter grabbing function * fix: remove network watcher due to its fragileness * chore: xrayprotocol cleanup * fix: correct wrong iface index on win * chore: move tun2socks implementation to the client from the service * chore: xrayprotocol cleanup * chore: more xrayprotocol cleanup * fix: consistent tun device with GUID specified * chore: tun2socks logs * chore: PrivilegedProcess cleanup * better error handling in establishment phase * terminate&kill ops for remote process * fix: straighforward killing the process on windows * fix: finally remove GUID setting from tun2socks due to instability * fix: add sanitizer to ipc process * chore: do not collect sensitive info from tun2socks	2026-02-11 23:47:28 +08:00
MrMirDan	b4f4184aa6	fix: returned mentioned lines (#2205 )	2026-02-11 23:44:11 +08:00
NickVs2015	5c6db4b7a4	fix OpenGl error (#2185 )	2026-02-10 11:15:31 +08:00
vkamn	f6277cdbb2	fix: native wg obfuscation (#2199 ) * chore: bump version * fix: fixed native wg obfuscation	2026-02-09 10:54:30 +08:00
NickVs2015	99312e61d3	fix: allow start Gamepad only Android (#2198 )	2026-02-09 10:40:48 +08:00
NickVs2015	9f0ae75a2f	feat: add gamepad buttons support android (#2066 ) * feat: add support gamepad buttons * feat: add support gamepad with github repo * feat: add gitmodules dependency * feat: add submodule qtgamepad * chore: update qtgamepad submodule to commit 4e57142e563b931766056b4c7507c16892260222 * fix: update qtgamepad with standard CMake and private headers support Update qtgamepad to commit f72b3e0 which: - Replaces qt_add_library with standard add_library to avoid Qt 6.10 macro conflicts - Copies private headers to build include tree for Android backend - Creates Qt:: and Qt6:: namespace aliases for proper linking	2026-02-05 22:57:15 +08:00
vkamn	7960d8015d	feat: add EULA and policy on IAP page (#2189 )	2026-02-05 20:23:06 +08:00
vkamn	5dcc64e5e5	fix: deploy qopensslbackend on windows (#2190 )	2026-02-05 20:22:47 +08:00
MrMirDan	964436ad43	fix: placeholder color, hide button image transparency, removed some lines (#2123 ) * fix: placeholder color, hide button image transparency, removed unneccessary lines * update: removed opacity on tunneling page * update: remove opacity on app tunneling page	2026-02-05 12:56:41 +08:00
ik	4fc3900fd5	Merge pull request #2184 from amnezia-vpn/chore/add-release-date-upload chore: add sending of release_date to s3	2026-02-04 12:20:23 +03:00
irvinklause	8f5e42dd61	chore: add sending of release_date to s3	2026-02-04 07:38:44 +00:00
Yaroslav Gurov	24895752c1	fix: added enablePeerTraffic call to xray (#2179 ) * fix: add enablePeerTraffic call to xray * chore: remove unnecessary steps during xray TUN setup phase * chore: move tun init from tun2socks code to ipcserver * chore: rework xray routing * get rid of redundant delays * check if remote calls are successful * chore: xray routing fine-tuning * fix: add service qt deps to deployment build	2026-02-04 12:35:53 +08:00
vkamn	87eccfb4ca	fix: fix scrolling on drawers (#2183 )	2026-02-04 12:35:17 +08:00
ik	a983d0504e	fix: add checks for script components to find out where it can fall (#2169 )	2026-01-30 14:43:30 +08:00
vkamn	d0b8535395	fix: update tag deploy (#2168 )	2026-01-30 13:15:50 +08:00
dpamnezia	f84480cf56	chore: fix artifacts upload (#1961 )	2026-01-30 12:43:21 +08:00
MrMirDan	de7a026ec1	fix: change drawer parents interactivity (#2004 ) * fix: change drawer parents interactivity * update: better vars names	2026-01-30 12:42:53 +08:00
MrMirDan	a128c7d247	fix: keyboard navigation (#2023 ) * fix: self-hosted easy install card * fix: label double click when enter/return pressed	2026-01-30 12:42:29 +08:00
MrMirDan	f316f0e25a	feat: news notifications switch (#2126 ) * feat: news notifications switch * update: text changes * fix: notifications enabled by default	2026-01-30 12:19:50 +08:00
NickVs2015	ea5242e29b	fix: fixed cipher selection (#2110 )	2026-01-30 12:18:54 +08:00
NickVs2015	b31a62c55f	feat: add support open files by atv (#2082 )	2026-01-30 12:11:26 +08:00
yyy-amnezia	02e3107a23	feat: implement service kickstart and improve macos post install script (#2131 )	2026-01-30 12:05:20 +08:00
lunardunno	1862850108	feat: checking linux kernel version when installing amneziawg-go (#2098 ) * Checking Linux kernel version when installing amneziawg-go print the Linux kernel version to stdOut for subsequent checking by the server controller. * Add error for old linux kernel Add error 214 ServerLinuxKernelTooOld * Add case for old linux kernel Add case for error 214 ServerLinuxKernelTooOld * Added kernel check for Awg2 Added Linux kernel version check and introduced corresponding ServerLinuxKernelTooOld error for Awg2.	2026-01-30 12:04:27 +08:00
vkamn	f73792844c	chore: revoke #2148 (#2160 )	2026-01-26 19:39:47 +08:00
Yaroslav Gurov	a7199ca6f5	fix: add +x permissions to wireguard-go on linux (#2159 )	2026-01-26 19:16:39 +08:00
vkamn	5e757cdd3b	chore: bump qt version for linux build (#2157 )	2026-01-25 21:35:16 +08:00
vkamn	92af1f3268	chore: runners (#2150 ) * chore: change runner for linux and android * chore: add libsecret to linux build * chore: bump version	2026-01-23 12:05:31 +08:00
Yaroslav Gurov	aad9d6dae2	chore: remove redundant gateway (#2148 )	2026-01-22 18:21:15 +08:00
Yaroslav Gurov	423fe3fd4f	fix: remove redundant gateway from xrayprotocol (#2147 )	2026-01-22 18:03:36 +08:00