# New Features (vs upstream)

## 1. L3 VPN Tunnel (Network)

Full IP tunnel over QUIC. A TUN interface is created on the server, clients get an IP from a pool, and all L3 traffic is routed through the encrypted QUIC connection.

### Server config (config.json)

```json
{
  "network": {
    "enabled": true,
    "listen": ":5199",
    "token": "mysecret",
    "tun": {
      "name": "hynt0",
      "mtu": 1400
    },
    "pool": "10.10.0.0/24"
  }
}
```

Parameters:
- `enabled` — enable the tunnel
- `listen` — QUIC listener address (default `:5199`)
- `token` — shared secret for client authentication
- `tun.name` — TUN interface name on the server
- `tun.mtu` — TUN interface MTU
- `pool` — CIDR subnet for assigning IPs to clients

### Client config (client.json)

```json
{
  "network": {
    "server": "your.server.com:5199",
    "token": "mysecret",
    "tun": {
      "name": "hynt0_c",
      "mtu": 1400
    }
  }
}
```

Parameters:
- `server` — server address (required)
- `token` — shared secret (must match the server)
- `tun.name` — TUN interface name on the client
- `tun.mtu` — TUN interface MTU

---

## 2. FileMask Noise

New obfuscation layer that masks traffic as downloading encrypted files. It works on top of the existing obfuscation (Salamander/Gecko). The server sends the client random chunks of real files from disk, simulating an active download.

### Server config

```json
{
  "noise": {
    "type": "filemask",
    "filemask": {
      "dir": "/path/to/files",
      "maxRate": "512 kbps",
      "minPacketSize": 512,
      "maxPacketSize": 1400,
      "idleThreshold": "3s"
    }
  }
}
```

Parameters:
- `type` — `"filemask"` to enable; `"none"` or empty to disable
- `filemask.dir` — **required**, directory containing files used to mask traffic
- `filemask.maxRate` — max noise rate (default `"512 kbps"`)
- `filemask.minPacketSize` — minimum noise packet size
- `filemask.maxPacketSize` — maximum noise packet size
- `filemask.idleThreshold` — client idle timeout before noise generation starts

Files from the specified directory are encrypted with AES-GCM on the fly and sent to the client.

---

## 3. Hysteria Outbound

Ability to use another Hysteria server as an upstream/outbound node. Allows building chains: client -> server A -> server B (via hysteria outbound).

### Server config

```json
{
  "outbounds": [
    {
      "name": "upstream-hy2",
      "type": "hysteria",
      "hysteria": {
        "server": "upstream.example.com:443",
        "auth": "mypassword",
        "tls": {
          "sni": "upstream.example.com",
          "insecure": false,
          "pinSHA256": "abc123...",
          "ca": "/path/to/ca.pem"
        },
        "quic": {
          "initStreamReceiveWindow": 8388608,
          "maxStreamReceiveWindow": 8388608,
          "initConnReceiveWindow": 20971520,
          "maxConnReceiveWindow": 20971520,
          "maxIdleTimeout": "30s",
          "disablePathMTUDiscovery": false
        },
        "bandwidth": {
          "up": "100 mbps",
          "down": "200 mbps"
        },
        "congestion": {
          "type": "bbr",
          "bbrProfile": "auto"
        },
        "obfs": {
          "type": "salamander",
          "salamander": {
            "password": "obfspass"
          }
        },
        "transport": {
          "type": "udp",
          "udp": {
            "hopInterval": "5s"
          }
        },
        "fastOpen": true
      }
    }
  ]
}
```

Supported parameters inside `hysteria`:
- `server` — target Hysteria server address (required)
- `auth` — authentication password (required)
- `tls` — TLS settings (SNI, insecure, pinSHA256, CA)
- `quic` — QUIC settings (receive windows, timeouts)
- `bandwidth` — bandwidth limits
- `congestion` — congestion control algorithm (bbr/cubic/brutal)
- `obfs` — obfuscation for the upstream connection (salamander/gecko)
- `transport` — transport (udp, with optional port hopping)
- `fastOpen` — enable fast open

Used in the `outbounds` section alongside `direct`, `socks5`, `http`.