Grbit

Release Notes

Newest first. The 1.0 notes describe the first App Store build and publish with that submit.

Unreleased

First App Store release

1.0

Grbit is a Personal VPN / Packet Tunnel client and network utility for iPhone. It does not operate, sell, or provide any proxy or VPN service. You bring the servers.

Packet Tunnel

iOS only hands device traffic to apps through Network Extension. Grbit uses a packet-tunnel provider so rule matching and forwarding happen on the device, toward servers you configured.

  • Starting the connection shows the system VPN permission prompt. That prompt is the system tunnel, not a service we run.
  • If the engine, Geo database, or a required capability is missing or inconsistent, the tunnel fails closed instead of running a partial configuration.
  • Production configurations cannot enable skip-verify / insecure TLS. A broken certificate is a failed connection, not a silent downgrade.

Protocols

The full-device tunnel enables a deliberate subset of what the frozen engine build validates. Importing a URI or subscription does not mean that node can be selected for the tunnel.

Supported in this release: Shadowsocks and Shadowsocks 2022; VLESS over raw TCP / TLS / REALITY, with the REALITY borrow site configured by you; Trojan (raw TCP transport only); Hysteria2; TUIC; AnyTLS; MASQUE (CONNECT-UDP and CONNECT-IP).

  • VMess is not enabled for the full-device tunnel. It may appear in an imported list as unsupported.
  • XHTTP is not enabled for the full-device tunnel in this release. Imported XHTTP nodes show as unsupported.
  • VLESS and Trojan over WebSocket or HTTPUpgrade can be imported, but are marked unsupported for the tunnel.
  • Legacy ciphers and transport combinations outside the lists above are rejected rather than approximated.

If a combination you rely on is missing, email hello@grbit.app with an example (secrets removed).

Profiles and subscriptions

Third-party files are import sources, not the runtime format. Surge, Loon, Clash/Mihomo, sing-box, and URI lists can be snapshotted; the tunnel only loads a native Grbit profile.

  • Refreshing a subscription replaces that source snapshot. It does not silently rewrite a profile that is already running.
  • Generating a Grbit profile freezes a verified snapshot. Later source changes are marked for confirmation.
  • Credentials stay in the Keychain. The public profile stores secret references, not passwords or UUIDs.
  • Compile failure leaves the last known-good tunnel configuration in place.

Policy and DNS

  • Rule actions: proxy, direct, reject, with a final catch-all.
  • Policy groups: select, url-test, fallback, load-balance, and Grbit-native adaptive. Adaptive is not url-test.
  • GeoIP / GeoSite matching uses the bundled Geo database. A missing or damaged database fails closed for rules that need it.
  • Fake-IP is off by default in this release.
  • Encrypted resolvers: DNS over TLS, DNS over HTTPS, and DNS over QUIC. DoQ resolves directly only — QUIC cannot use the tunnel's stream egress, so a DoQ resolver set to "through the proxy" is rejected when you save it rather than quietly resolving direct. iOS has no system-level DoQ setting either, so keep a DoT or DoH resolver alongside it.
  • Static host overrides pin an exact hostname to an IPv4 address, answered locally without reaching upstream. Matching is exact — no wildcards, no subdomains. An overridden name is no longer visible to domain-based routing rules, because the data plane only sees the address you pinned.

Inspecting your own traffic

These tools are off by default and each needs an explicit action from you before it does anything. Nothing they produce leaves the device — there is no server of ours to send it to.

  • HTTPS inspection decrypts traffic only for hostnames you add to a list, and only after you install the certificate Grbit generates and switch it on yourself in Settings → General → About → Certificate Trust Settings. iOS requires that second step separately and no app can do it for you. The private key is generated on device and stays in the Keychain. You can delete the profile at any time.
  • Request rewriting changes headers, redirects a request, or returns content you typed into the rule (up to 64 KB). It works on the decrypted stream, so it does nothing unless HTTPS inspection is fully enabled. It does not alter response bodies from the server.
  • Packet capture writes a standard .pcap of tunnel traffic into the app's container for you to export.

On the Home Screen and in Control Center

  • A widget shows connection state and elapsed time. It reads the system VPN state directly, so it stays correct even when the app is not running.
  • An iOS 18 Control Center toggle starts and stops the tunnel. On iOS 17 the widget is available without the Control Center control.
  • A Shortcuts action sets the connection on or off, so you can put it in an automation.
  • Connect on demand can bring the tunnel back after it drops. It only ever reconnects; it never disconnects you, and turning the tunnel off by hand stays off.

Your own servers

You can add a node by subscription, file, or manual parameters. If you already administer a VPS, Grbit can register it over SSH and install a matching inbound you choose. Adding a machine only means it is registered; it does not mean a protocol is listening until you install one.

Not in this release

  • No accounts, iCloud sync, or analytics.
  • No proxy bandwidth or node list sold by us.
  • No script engine and no script marketplace — Grbit does not bundle JavaScript.
  • No Mac gateway mode, no tvOS client.
  • The China App Store storefront is closed for this release.

App 1.0 (build published with the submit IPA). The About screen shows the same 1.0 (build) string; the frozen engine commit (dirty=false) is recorded in the project changelog and the build provenance record.