Surge 5

Surge is an advanced network toolbox and proxy utility. It is designed for developers and therefore requires professional knowledge to use.

These four capabilities form the core workflow of Surge:

• Takeover: Take over the network connections sent by the device. Surge supports both proxy service and virtual NIC takeover, capturing HTTP, HTTPS, TCP, and UDP traffic from any app — even those ignoring proxy settings. All features work on the cellular network.
• Processing: Modify the requests and responses that have been taken over: URL rewrite, header and body rewrite, local file mapping, custom DNS answers, and JavaScript-based modification.
• Forwarding: Forward requests to proxy servers, either globally or driven by a flexible rule system. Policy groups select the best server automatically by latency, availability, or learned connection quality.
• Intercept: Record and inspect requests and responses, including headers and bodies, and decrypt HTTPS traffic with MITM.

Highlighted Features

• Proxy protocols: HTTP/HTTPS, SOCKS5, SOCKS5-TLS, HTTP2 CONNECT, TrustTunnel, Shadowsocks, Snell, Trojan, Hysteria 2, AnyTLS, and SSH, with UDP relay support.
• Used as a WireGuard or Tailscale client, converting the L3 VPN into a proxy policy.
• Rules based on domain match/suffix/keyword/wildcard, CIDR IP range, GeoIP, ASN, protocol, port, and logical combinations; reusable rule sets hosted locally or remotely.
• Policy groups: manual selection, automatic latency testing, fallback, load balancing, and the self-learning Smart group.
• Complete DNS suite: DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, DNS-over-TLS, and concurrent queries for the fastest answer.
• Local DNS mapping (equivalent to /etc/hosts) with wildcards, aliases, and per-domain DNS servers. Switch your app between production and development environments without changing any code.
• Decrypt HTTPS traffic with Man-in-the-Middle and a built-in CA certificate generator.
• Record and display HTTP requests and responses with JSON, text, image, and video viewers for the captured body; album mode for the request list; pre-filter for capturing.
• Raw L3 packet capture.
• Scripting: extend Surge with JavaScript — modify requests and responses, write custom rules, customize DNS answers, and run scheduled tasks.
• Block unwanted requests by rules with high-performance pre-matching.
• Measure traffic usage and network speed on Wi-Fi, cellular, and proxy connections.
• Remote Dashboard: observe and debug traffic in real time from a Mac via Wi-Fi or USB, including cellular traffic.
• Surge Ponte: access your home or office network remotely via your own devices, with no third-party service involved.
• HTTPS proxy protocol supports client-side TLS certificate validation.
• Safari extension to add rules; widgets and Information Panel for quick control.
• Sync profiles across devices with iCloud Drive or Dropbox.
• Full IPv6 support, TLS 1.3, HTTP/2, and QUIC.
• High performance and industrial-grade stability, suitable for intensive use.

Surge does not provide any proxy or VPN service; you need to configure your own servers.

You may read the online manual for more information: https://nssurge.com/support

Terms and Conditions: https://nssurge.com/legal/terms
Privacy Policy: https://nssurge.com/legal/privacy

New Features

• Added the `[IP Rewrite]` section to process packets entering Surge VIF by destination address before rule matching. Supported actions include `reflect`, `reject`, and `drop`. This can provide on-device loopback functionality for certain iOS developer toolchains.
• Added a `category` parameter to policy groups for grouped display.
• All `test-url` parameters now support HTTPS URLs. Results still measure a single HTTP round-trip latency, although TLS handshakes may increase overall testing time.
• Added a device communication takeover option for Include All mode.
• Added external resource management and other helper endpoints to the HTTP API.
• URL-based linked profiles can now be updated manually.

UI and Rules

• Updated UI layouts and details for iPhone Duo support.
• Improved the Add Rule page: domain rules can now be created from SNI-sniffed requests, and rule-specific options can be selected directly.
• Inline rulesets with the same name now merge across the main profile and modules, preserving rules from each source.
• Fixed logical rules incorrectly parsing policy names containing parentheses.

Networking and Reliability

• Improved Tailscale and WireGuard behavior when switching networks.
• Improved UDP test diagnostics for peer-to-peer Tailscale and WireGuard policies without Internet egress, reporting unsupported tests instead of waiting for a timeout.
• Removed an erroneous Ponte notification when using a Ponte policy in a policy group.
• Reverted per-domain MITM key-pair generation to address noticeable delays when intercepting many different domains concurrently.
• Fixed a scripting-engine compatibility issue.
• Improved performance and memory usage, fixed rare crashes, and resolved other minor issues.