GitHub Release: center2055/OnionHop v3.8 (21.08.2026)

Closes a DNS leak in hybrid (split tunnelling) mode, and makes hybrid mode explain itself.

Fixed

• Hybrid mode no longer leaks the DNS of the apps you route through Tor. The tunnel's DNS section carried no rules at all, so every process resolved through the direct resolver. An app you had put on the Tor list took Tor for its traffic, but the lookup that came first went straight out, handing your ISP and that resolver the domain of everything that app visited. Split tunnelling was leaking the very thing you had asked it to protect.

  Lookups now follow the traffic:

  • Apps routed through Tor resolve over Tor. With DNS-over-HTTPS on, the resolver's own bootstrap lookup goes through Tor as well, since resolving cloudflare-dns.com directly would leak the fact and timing of every Tor-side query.
  • Apps you deliberately put on the bypass list keep the fast direct resolver. They never touch Tor, so sending their lookups through it would only be slow and would contradict your own bypass list.
  • With Route all web traffic through Tor on, everything not explicitly bypassed resolves over Tor too.

  Full-tunnel mode already sent every lookup through Tor and is unchanged.

  This came in as a report of "IP and DNS leaks" against 3.7.12. To be straight about what did and did not change: it was not a 3.7.12 regression, the behaviour is considerably older than that, but it was a real weakness and the report was right to call it out.

Added

• Hybrid routing now tells you what it does when you connect. Proxy Mode has carried a privacy notice for a while; hybrid had none. So you could enable split tunnelling, run a leak test in a browser you never added to the Tor list, and see your real IP and your own ISP's resolver with nothing on screen to explain why. The log now says plainly that only the apps you listed use Tor, that everything else connects directly with your real IP, and that full-tunnel mode is what you want if you need a single result with no direct traffic at all.

Downloads