Update README.md

2026-01-22 03:33:13 +03:00 · 2026-01-22 03:26:34 +03:00 · 2026-01-22 03:19:50 +03:00 · 2026-01-22 03:17:37 +03:00 · 2026-01-22 03:14:39 +03:00 · 2026-01-22 03:13:08 +03:00
21 changed files with 2352 additions and 1706 deletions
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -10,8 +10,8 @@ env:
  CARGO_TERM_COLOR: always

 jobs:
-  build-and-test:
-    name: Build & Test
+  build:
+    name: Build
    runs-on: ubuntu-latest

    steps:
--- a/README.md
+++ b/README.md
@@ -2,16 +2,29 @@

 **Telemt** is a fast, secure, and feature-rich server written in Rust: it fully implements the official Telegram proxy algo and adds many production-ready improvements such as connection pooling, replay protection, detailed statistics, masking from "prying" eyes

+💥 The configuration structure has changed since version 1.1.0.0, change it in your environment!
+
+⚓ Our implementation of **TLS-fronting** is one of the most deeply debugged, focused, advanced and *almost* **"behaviorally consistent to real"**:  we are confident we have it right - [see evidence on our validation and traces](#recognizability-for-dpi-and-crawler) 
+
 # GOTO
 - [Features](#features)
 - [Quick Start Guide](#quick-start-guide)
-  - [Build](#build)
 - [How to use?](#how-to-use)
  - [Systemd Method](#telemt-via-systemd)
+- [Configuration](#configuration)
+  - [Minimal Configuration](#minimal-configuration-for-first-start)
+  - [Advanced](#advanced)
+    - [Adtag](#adtag)
+    - [Listening and Announce IPs](#listening-and-announce-ips)
+    - [Upstream Manager](#upstream-manager)
+      - [IP](#bind-on-ip)
+      - [SOCKS](#socks45-as-upstream)
 - [FAQ](#faq)
+  - [Recognizability for DPI + crawler](#recognizability-for-dpi-and-crawler)
  - [Telegram Calls](#telegram-calls-via-mtproxy)
  - [DPI](#how-does-dpi-see-mtproxy-tls)
  - [Whitelist on Network Level](#whitelist-on-ip)
+- [Build](#build)
 - [Why Rust?](#why-rust)

 ## Features
@@ -27,25 +40,27 @@
 - Extensive logging via `trace` and `debug` with `RUST_LOG` method

 ## Quick Start Guide
-
-### Build
+**This software is designed for Debian-based OS: in addition to Debian, these are Ubuntu, Mint, Kali, MX and many other Linux**
+1. Download release
 ```bash
-# Cloning repo
-git clone https://github.com/telemt/telemt 
-# Changing Directory to telemt
-cd telemt
-# Starting Release Build
-cargo build --release
-# Move to /bin
-mv ./target/release/telemt /bin
-# Make executable
-chmod +x /bin/telemt
-# Lets go!
-telemt config.toml
+wget https://github.com/telemt/telemt/releases/latest/download/telemt
 ```
+2. Move to Bin Folder
+```bash
+mv telemt /bin
+```
+4. Make Executable
+```bash
+chmod +x /bin/telemt
+```
+5. Go to [How to use?](#how-to-use) section for for further steps

 ## How to use?
 ### Telemt via Systemd
+**This instruction "assume" that you:**
+- logged in as root or executed `su -` / `sudo su`
+- you already have an assembled and executable `telemt` in /bin folder as a result of the [Quick Start Guide](#quick-start-guide) or [Build](#build)
+
 **0. Check port and generate secrets**

 The port you have selected for use should be MISSING from the list, when:
@@ -57,6 +72,14 @@ Generate 16 bytes/32 characters HEX with OpenSSL or another way:
 ```bash
 openssl rand -hex 16
 ```
+OR
+```bash
+xxd -l 16 -p /dev/urandom
+```
+OR
+```bash
+python3 -c 'import os; print(os.urandom(16).hex())'
+```

 **1. Place your config to /etc/telemt.toml**

@@ -64,28 +87,8 @@ Open nano
 ```bash
 nano /etc/telemt.toml
 ```
-```bash
-port = 443                              # Listening port
+paste your config from [Configuration](#configuration) section

-[users]
-hello = "00000000000000000000000000000000" # Replace the secret with one generated before
-
-[modes]
-classic = false                         # Plain obfuscated mode
-secure = false                          # dd-prefix mode
-tls = true                              # Fake TLS - ee-prefix
-
-tls_domain = "petrovich.ru"             # Domain for ee-secret and masking
-mask = true                             # Enable masking of bad traffic
-mask_host = "petrovich.ru"              # Optional override for mask destination
-mask_port = 443                         # Port for masking
-
-prefer_ipv6 = false                     # Try IPv6 DCs first if true
-fast_mode = true                        # Use "fast" obfuscation variant
-
-client_keepalive = 600                  # Seconds
-client_ack_timeout = 300                # Seconds
-```
 then Ctrl+X -> Y -> Enter to save

 **2. Create service on /etc/systemd/system/telemt.service**
@@ -117,9 +120,224 @@ then Ctrl+X -> Y -> Enter to save

 **5.** In Shell type `systemctl enable telemt` - then telemt will start with system startup, after the network is up

+## Configuration
+### Minimal Configuration for First Start
+```toml
+# === UI ===
+# Users to show in the startup log (tg:// links)
+show_link = ["hello"]
+
+# === General Settings ===
+[general]
+prefer_ipv6 = false
+fast_mode = true
+use_middle_proxy = false
+# ad_tag = "..."
+
+[general.modes]
+classic = false
+secure = false
+tls = true
+
+# === Server Binding ===
+[server]
+port = 443
+listen_addr_ipv4 = "0.0.0.0"
+listen_addr_ipv6 = "::"
+# metrics_port = 9090
+# metrics_whitelist = ["127.0.0.1", "::1"]
+
+# Listen on multiple interfaces/IPs (overrides listen_addr_*)
+[[server.listeners]]
+ip = "0.0.0.0"
+# announce_ip = "1.2.3.4" # Optional: Public IP for tg:// links
+
+[[server.listeners]]
+ip = "::"
+
+# === Timeouts (in seconds) ===
+[timeouts]
+client_handshake = 15
+tg_connect = 10
+client_keepalive = 60
+client_ack = 300
+
+# === Anti-Censorship & Masking ===
+[censorship]
+tls_domain = "petrovich.ru"
+mask = true
+mask_port = 443
+# mask_host = "petrovich.ru" # Defaults to tls_domain if not set
+fake_cert_len = 2048
+
+# === Access Control & Users ===
+# username "hello" is used for example
+[access]
+replay_check_len = 65536
+ignore_time_skew = false
+
+[access.users]
+# format: "username" = "32_hex_chars_secret"
+hello = "00000000000000000000000000000000"
+
+# [access.user_max_tcp_conns]
+# hello = 50
+
+# [access.user_data_quota]
+# hello = 1073741824 # 1 GB
+
+# === Upstreams & Routing ===
+# By default, direct connection is used, but you can add SOCKS proxy
+
+# Direct - Default
+[[upstreams]]
+type = "direct"
+enabled = true
+weight = 10
+
+# SOCKS5
+# [[upstreams]]
+# type = "socks5"
+# address = "127.0.0.1:9050"
+# enabled = false
+# weight = 1
+```
+### Advanced
+#### Adtag
+To use channel advertising and usage statistics from Telegram, get Adtag from [@mtproxybot](https://t.me/mtproxybot), add this parameter to section `[General]`
+```toml
+ad_tag = "00000000000000000000000000000000" # Replace zeros to your adtag from @mtproxybot
+```
+#### Listening and Announce IPs
+To specify listening address and/or address in links, add to section `[[server.listeners]]` of config.toml:
+```toml
+[[server.listeners]]
+ip = "0.0.0.0"          # 0.0.0.0 = all IPs; your IP = specific listening
+announce_ip = "1.2.3.4" # IP in links; comment with # if not used
+```
+#### Upstream Manager
+To specify upstream, add to section `[[upstreams]]` of config.toml:
+##### Bind on IP
+```toml
+[[upstreams]]
+type = "direct"
+weight = 1
+enabled = true
+interface = "192.168.1.100" # Change to your outgoing IP
+```
+##### SOCKS4/5 as Upstream
+- Without Auth:
+```toml
+[[upstreams]]
+type = "socks5"            # Specify SOCKS4 or SOCKS5
+address = "1.2.3.4:1234"   # SOCKS-server Address
+weight = 1                 # Set Weight for Scenarios
+enabled = true
+```
+
+- With Auth:
+```toml
+[[upstreams]]
+type = "socks5"            # Specify SOCKS4 or SOCKS5
+address = "1.2.3.4:1234"   # SOCKS-server Address
+username = "user"          # Username for Auth on SOCKS-server
+password = "pass"          # Password for Auth on SOCKS-server
+weight = 1                 # Set Weight for Scenarios
+enabled = true
+```
+
 ## FAQ
+### Recognizability for DPI and crawler
+Since version 1.1.0.0, we have debugged masking perfectly: for all clients without "presenting" a key, 
+we transparently direct traffic to the target host!
+
+- We consider this a breakthrough aspect, which has no stable analogues today
+- Based on this: if `telemt` configured correctly, **TLS mode is completely identical to real-life handshake + communication** with a specified host
+- Here is our evidence:
+    - 212.220.88.77 - "dummy" host, running `telemt`
+    - `petrovich.ru` - `tls` + `masking` host, in HEX: `706574726f766963682e7275`
+    - **No MITM + No Fake Certificates/Crypto** = pure transparent *TCP Splice* to "best" upstream: MTProxy or tls/mask-host:
+      - DPI see legitimate HTTPS to `tls_host`, including *valid chain-of-trust* and entropy
+      - Crawlers completely satisfied receiving responses from `mask_host`
+  #### Client WITH secret-key accesses the MTProxy resource:
+  
+  <img width="360" height="439" alt="telemt" src="https://github.com/user-attachments/assets/39352afb-4a11-4ecc-9d91-9e8cfb20607d" />
+  
+  #### Client WITHOUT secret-key gets transparent access to the specified resource:
+    - with trusted certificate
+    - with original handshake
+    - with full request-response way
+    - with low-latency overhead
+```bash
+root@debian:~/telemt# curl -v -I --resolve petrovich.ru:443:212.220.88.77 https://petrovich.ru/
+* Added petrovich.ru:443:212.220.88.77 to DNS cache
+* Hostname petrovich.ru was found in DNS cache
+*   Trying 212.220.88.77:443...
+* Connected to petrovich.ru (212.220.88.77) port 443 (#0)
+* ALPN: offers h2,http/1.1
+* TLSv1.3 (OUT), TLS handshake, Client hello (1):
+*  CAfile: /etc/ssl/certs/ca-certificates.crt
+*  CApath: /etc/ssl/certs
+* TLSv1.3 (IN), TLS handshake, Server hello (2):
+* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
+* TLSv1.3 (IN), TLS handshake, Certificate (11):
+* TLSv1.3 (IN), TLS handshake, CERT verify (15):
+* TLSv1.3 (IN), TLS handshake, Finished (20):
+* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
+* TLSv1.3 (OUT), TLS handshake, Finished (20):
+* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
+* ALPN: server did not agree on a protocol. Uses default.
+* Server certificate:
+*  subject: C=RU; ST=Saint Petersburg; L=Saint Petersburg; O=STD Petrovich; CN=*.petrovich.ru
+*  start date: Jan 28 11:21:01 2025 GMT
+*  expire date: Mar  1 11:21:00 2026 GMT
+*  subjectAltName: host "petrovich.ru" matched cert's "petrovich.ru"
+*  issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign RSA OV SSL CA 2018
+*  SSL certificate verify ok.
+* using HTTP/1.x
+> HEAD / HTTP/1.1
+> Host: petrovich.ru
+> User-Agent: curl/7.88.1
+> Accept: */*
+> 
+* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
+* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
+* old SSL session ID is stale, removing
+< HTTP/1.1 200 OK
+HTTP/1.1 200 OK
+< Server: Variti/0.9.3a
+Server: Variti/0.9.3a
+< Date: Thu, 01 Jan 2026 00:0000 GMT
+Date: Thu, 01 Jan 2026 00:0000 GMT
+< Access-Control-Allow-Origin: *
+Access-Control-Allow-Origin: *
+< Content-Type: text/html
+Content-Type: text/html
+< Cache-Control: no-store
+Cache-Control: no-store
+< Expires: Thu, 01 Jan 2026 00:0000 GMT
+Expires: Thu, 01 Jan 2026 00:0000 GMT
+< Pragma: no-cache
+Pragma: no-cache
+< Set-Cookie: ipp_uid=XXXXX/XXXXX/XXXXX==; Expires=Tue, 31 Dec 2040 23:59:59 GMT; Domain=.petrovich.ru; Path=/
+Set-Cookie: ipp_uid=XXXXX/XXXXX/XXXXX==; Expires=Tue, 31 Dec 2040 23:59:59 GMT; Domain=.petrovich.ru; Path=/
+< Content-Type: text/html
+Content-Type: text/html
+< Content-Length: 31253
+Content-Length: 31253
+< Connection: keep-alive
+Connection: keep-alive
+< Keep-Alive: timeout=60
+Keep-Alive: timeout=60
+
+< 
+* Connection #0 to host petrovich.ru left intact
+
+```
+- We challenged ourselves, we kept trying and we didn't only *beat the air*: now, we have something to show you
+  - Do not just take our word for it? - This is great and we respect that: you can build your own `telemt` or download a build and check it right now
 ### Telegram Calls via MTProxy
- Telegram architecture does **NOT allow calls via MTProxy**, but only via SOCKS5, which cannot be obfuscated
+- Telegram architecture **does NOT allow calls via MTProxy**, but only via SOCKS5, which cannot be obfuscated
 ### How does DPI see MTProxy TLS?
 - DPI sees MTProxy in Fake TLS (ee) mode as TLS 1.3
 - the SNI you specify sends both the client and the server;
@@ -127,11 +345,34 @@ then Ctrl+X -> Y -> Enter to save
 - high entropy, which is normal for AES-encrypted traffic;
 ### Whitelist on IP
 - MTProxy cannot work when there is: 
-  - no IP connectivity to the target host
+  - no IP connectivity to the target host: Russian Whitelist on Mobile Networks - "Белый список"
  - OR all TCP traffic is blocked
-  - OR all TLS traffic is blocked,
+  - OR high entropy/encrypted traffic is blocked: content filters at universities and critical infrastructure
+  - OR all TLS traffic is blocked
+  - OR specified port is blocked: use 443 to make it "like real"
+  - OR provided SNI is blocked: use "officially approved"/innocuous name
 - like most protocols on the Internet; 
- this situation is observed in China behind the Great Chinese Firewall and in Russia on mobile networks
+- these situations are observed:
+  - in China behind the Great Firewall
+  - in Russia on mobile networks, less in wired networks
+  - in Iran during "activity"
+
+
+## Build
+```bash
+# Cloning repo
+git clone https://github.com/telemt/telemt 
+# Changing Directory to telemt
+cd telemt
+# Starting Release Build
+cargo build --release
+# Move to /bin
+mv ./target/release/telemt /bin
+# Make executable
+chmod +x /bin/telemt
+# Lets go!
+telemt config.toml
+```

 ## Why Rust?
 - Long-running reliability and idempotent behavior
@@ -140,6 +381,10 @@ then Ctrl+X -> Y -> Enter to save
 - Memory safety and reduced attack surface
 - Tokio's asynchronous architecture

+## Issues
+- ✅ [SOCKS5 as Upstream](https://github.com/telemt/telemt/issues/1) -> added Upstream Management
+- ✅ [iOS - Media Upload Hanging-in-Loop](https://github.com/telemt/telemt/issues/2)
+
 ## Roadmap
 - Public IP in links
 - Config Reload-on-fly
--- a/config.toml
+++ b/config.toml
@@ -1,13 +1,78 @@
-port = 443
+# === UI ===
+# Users to show in the startup log (tg:// links)
+show_link = ["hello"]

-[users]
-user1 = "00000000000000000000000000000000"
+# === General Settings ===
+[general]
+prefer_ipv6 = false
+fast_mode = true
+use_middle_proxy = false
+# ad_tag = "..."

-[modes]
-classic = true
-secure = true
+[general.modes]
+classic = false
+secure = false
 tls = true

-tls_domain = "www.github.com"
-fast_mode = true
-prefer_ipv6 = false
+# === Server Binding ===
+[server]
+port = 443
+listen_addr_ipv4 = "0.0.0.0"
+listen_addr_ipv6 = "::"
+# metrics_port = 9090
+# metrics_whitelist = ["127.0.0.1", "::1"]
+
+# Listen on multiple interfaces/IPs (overrides listen_addr_*)
+[[server.listeners]]
+ip = "0.0.0.0"
+# announce_ip = "1.2.3.4" # Optional: Public IP for tg:// links
+
+[[server.listeners]]
+ip = "::"
+
+# === Timeouts (in seconds) ===
+[timeouts]
+client_handshake = 15
+tg_connect = 10
+client_keepalive = 60
+client_ack = 300
+
+# === Anti-Censorship & Masking ===
+[censorship]
+tls_domain = "petrovich.ru"
+mask = true
+mask_port = 443
+# mask_host = "petrovich.ru" # Defaults to tls_domain if not set
+fake_cert_len = 2048
+
+# === Access Control & Users ===
+# username "hello" is used for example
+[access]
+replay_check_len = 65536
+ignore_time_skew = false
+
+[access.users]
+# format: "username" = "32_hex_chars_secret"
+hello = "00000000000000000000000000000000"
+
+# [access.user_max_tcp_conns]
+# hello = 50
+
+# [access.user_data_quota]
+# hello = 1073741824 # 1 GB
+
+# === Upstreams & Routing ===
+# By default, direct connection is used, but you can add SOCKS proxy
+
+# Direct - Default
+[[upstreams]]
+type = "direct"
+enabled = true
+weight = 10
+
+# SOCKS5
+# [[upstreams]]
+# type = "socks5"
+# address = "127.0.0.1:9050"
+# enabled = false
+# weight = 1
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -7,6 +7,29 @@ use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use crate::error::{ProxyError, Result};

+// ============= Helper Defaults =============
+
+fn default_true() -> bool { true }
+fn default_port() -> u16 { 443 }
+fn default_tls_domain() -> String { "www.google.com".to_string() }
+fn default_mask_port() -> u16 { 443 }
+fn default_replay_check_len() -> usize { 65536 }
+fn default_handshake_timeout() -> u64 { 15 }
+fn default_connect_timeout() -> u64 { 10 }
+fn default_keepalive() -> u64 { 60 }
+fn default_ack_timeout() -> u64 { 300 }
+fn default_listen_addr() -> String { "0.0.0.0".to_string() }
+fn default_fake_cert_len() -> usize { 2048 }
+fn default_weight() -> u16 { 1 }
+fn default_metrics_whitelist() -> Vec<IpAddr> {
+    vec![
+        "127.0.0.1".parse().unwrap(),
+        "::1".parse().unwrap(),
+    ]
+}
+
+// ============= Sub-Configs =============
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ProxyModes {
    #[serde(default)]
@@ -17,8 +40,6 @@ pub struct ProxyModes {
    pub tls: bool,
 }

-fn default_true() -> bool { true }
-
 impl Default for ProxyModes {
    fn default() -> Self {
        Self { classic: true, secure: true, tls: true }
@@ -26,31 +47,10 @@ impl Default for ProxyModes {
 }

 #[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ProxyConfig {
-    #[serde(default = "default_port")]
-    pub port: u16,
-    
-    #[serde(default)]
-    pub users: HashMap<String, String>,
-    
-    #[serde(default)]
-    pub ad_tag: Option<String>,
-    
+pub struct GeneralConfig {
    #[serde(default)]
    pub modes: ProxyModes,
    
-    #[serde(default = "default_tls_domain")]
-    pub tls_domain: String,
-    
-    #[serde(default = "default_true")]
-    pub mask: bool,
-    
-    #[serde(default)]
-    pub mask_host: Option<String>,
-    
-    #[serde(default = "default_mask_port")]
-    pub mask_port: u16,
-    
    #[serde(default)]
    pub prefer_ipv6: bool,
    
@@ -59,34 +59,28 @@ pub struct ProxyConfig {
    
    #[serde(default)]
    pub use_middle_proxy: bool,
-    
+
    #[serde(default)]
-    pub user_max_tcp_conns: HashMap<String, usize>,
-    
-    #[serde(default)]
-    pub user_expirations: HashMap<String, DateTime<Utc>>,
-    
-    #[serde(default)]
-    pub user_data_quota: HashMap<String, u64>,
-    
-    #[serde(default = "default_replay_check_len")]
-    pub replay_check_len: usize,
-    
-    #[serde(default)]
-    pub ignore_time_skew: bool,
-    
-    #[serde(default = "default_handshake_timeout")]
-    pub client_handshake_timeout: u64,
-    
-    #[serde(default = "default_connect_timeout")]
-    pub tg_connect_timeout: u64,
-    
-    #[serde(default = "default_keepalive")]
-    pub client_keepalive: u64,
-    
-    #[serde(default = "default_ack_timeout")]
-    pub client_ack_timeout: u64,
-    
+    pub ad_tag: Option<String>,
+}
+
+impl Default for GeneralConfig {
+    fn default() -> Self {
+        Self {
+            modes: ProxyModes::default(),
+            prefer_ipv6: false,
+            fast_mode: true,
+            use_middle_proxy: false,
+            ad_tag: None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ServerConfig {
+    #[serde(default = "default_port")]
+    pub port: u16,
+
    #[serde(default = "default_listen_addr")]
    pub listen_addr_ipv4: String,
    
@@ -101,65 +95,187 @@ pub struct ProxyConfig {
    
    #[serde(default = "default_metrics_whitelist")]
    pub metrics_whitelist: Vec<IpAddr>,
-    
-    #[serde(default = "default_fake_cert_len")]
-    pub fake_cert_len: usize,
+
+    #[serde(default)]
+    pub listeners: Vec<ListenerConfig>,
 }

-fn default_port() -> u16 { 443 }
-fn default_tls_domain() -> String { "www.google.com".to_string() }
-fn default_mask_port() -> u16 { 443 }
-fn default_replay_check_len() -> usize { 65536 }
-fn default_handshake_timeout() -> u64 { 10 }
-fn default_connect_timeout() -> u64 { 10 }
-fn default_keepalive() -> u64 { 600 }
-fn default_ack_timeout() -> u64 { 300 }
-fn default_listen_addr() -> String { "0.0.0.0".to_string() }
-fn default_fake_cert_len() -> usize { 2048 }
-
-fn default_metrics_whitelist() -> Vec<IpAddr> {
-    vec![
-        "127.0.0.1".parse().unwrap(),
-        "::1".parse().unwrap(),
-    ]
-}
-
-impl Default for ProxyConfig {
+impl Default for ServerConfig {
    fn default() -> Self {
-        let mut users = HashMap::new();
-        users.insert("default".to_string(), "00000000000000000000000000000000".to_string());
-        
        Self {
            port: default_port(),
-            users,
-            ad_tag: None,
-            modes: ProxyModes::default(),
-            tls_domain: default_tls_domain(),
-            mask: true,
-            mask_host: None,
-            mask_port: default_mask_port(),
-            prefer_ipv6: false,
-            fast_mode: true,
-            use_middle_proxy: false,
-            user_max_tcp_conns: HashMap::new(),
-            user_expirations: HashMap::new(),
-            user_data_quota: HashMap::new(),
-            replay_check_len: default_replay_check_len(),
-            ignore_time_skew: false,
-            client_handshake_timeout: default_handshake_timeout(),
-            tg_connect_timeout: default_connect_timeout(),
-            client_keepalive: default_keepalive(),
-            client_ack_timeout: default_ack_timeout(),
            listen_addr_ipv4: default_listen_addr(),
            listen_addr_ipv6: Some("::".to_string()),
            listen_unix_sock: None,
            metrics_port: None,
            metrics_whitelist: default_metrics_whitelist(),
+            listeners: Vec::new(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct TimeoutsConfig {
+    #[serde(default = "default_handshake_timeout")]
+    pub client_handshake: u64,
+    
+    #[serde(default = "default_connect_timeout")]
+    pub tg_connect: u64,
+    
+    #[serde(default = "default_keepalive")]
+    pub client_keepalive: u64,
+    
+    #[serde(default = "default_ack_timeout")]
+    pub client_ack: u64,
+}
+
+impl Default for TimeoutsConfig {
+    fn default() -> Self {
+        Self {
+            client_handshake: default_handshake_timeout(),
+            tg_connect: default_connect_timeout(),
+            client_keepalive: default_keepalive(),
+            client_ack: default_ack_timeout(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AntiCensorshipConfig {
+    #[serde(default = "default_tls_domain")]
+    pub tls_domain: String,
+    
+    #[serde(default = "default_true")]
+    pub mask: bool,
+    
+    #[serde(default)]
+    pub mask_host: Option<String>,
+    
+    #[serde(default = "default_mask_port")]
+    pub mask_port: u16,
+
+    #[serde(default = "default_fake_cert_len")]
+    pub fake_cert_len: usize,
+}
+
+impl Default for AntiCensorshipConfig {
+    fn default() -> Self {
+        Self {
+            tls_domain: default_tls_domain(),
+            mask: true,
+            mask_host: None,
+            mask_port: default_mask_port(),
            fake_cert_len: default_fake_cert_len(),
        }
    }
 }

+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AccessConfig {
+    #[serde(default)]
+    pub users: HashMap<String, String>,
+
+    #[serde(default)]
+    pub user_max_tcp_conns: HashMap<String, usize>,
+    
+    #[serde(default)]
+    pub user_expirations: HashMap<String, DateTime<Utc>>,
+    
+    #[serde(default)]
+    pub user_data_quota: HashMap<String, u64>,
+
+    #[serde(default = "default_replay_check_len")]
+    pub replay_check_len: usize,
+    
+    #[serde(default)]
+    pub ignore_time_skew: bool,
+}
+
+impl Default for AccessConfig {
+    fn default() -> Self {
+        let mut users = HashMap::new();
+        users.insert("default".to_string(), "00000000000000000000000000000000".to_string());
+        Self {
+            users,
+            user_max_tcp_conns: HashMap::new(),
+            user_expirations: HashMap::new(),
+            user_data_quota: HashMap::new(),
+            replay_check_len: default_replay_check_len(),
+            ignore_time_skew: false,
+        }
+    }
+}
+
+// ============= Aux Structures =============
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(tag = "type", rename_all = "lowercase")]
+pub enum UpstreamType {
+    Direct {
+        #[serde(default)]
+        interface: Option<String>,
+    },
+    Socks4 {
+        address: String,
+        #[serde(default)]
+        interface: Option<String>,
+        #[serde(default)]
+        user_id: Option<String>,
+    },
+    Socks5 {
+        address: String,
+        #[serde(default)]
+        interface: Option<String>,
+        #[serde(default)]
+        username: Option<String>,
+        #[serde(default)]
+        password: Option<String>,
+    },
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct UpstreamConfig {
+    #[serde(flatten)]
+    pub upstream_type: UpstreamType,
+    #[serde(default = "default_weight")]
+    pub weight: u16,
+    #[serde(default = "default_true")]
+    pub enabled: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ListenerConfig {
+    pub ip: IpAddr,
+    #[serde(default)]
+    pub announce_ip: Option<IpAddr>,
+}
+
+// ============= Main Config =============
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ProxyConfig {
+    #[serde(default)]
+    pub general: GeneralConfig,
+
+    #[serde(default)]
+    pub server: ServerConfig,
+
+    #[serde(default)]
+    pub timeouts: TimeoutsConfig,
+
+    #[serde(default)]
+    pub censorship: AntiCensorshipConfig,
+
+    #[serde(default)]
+    pub access: AccessConfig,
+
+    #[serde(default)]
+    pub upstreams: Vec<UpstreamConfig>,
+
+    #[serde(default)]
+    pub show_link: Vec<String>,
+}
+
 impl ProxyConfig {
    pub fn load<P: AsRef<Path>>(path: P) -> Result<Self> {
        let content = std::fs::read_to_string(path)
@@ -169,7 +285,7 @@ impl ProxyConfig {
            .map_err(|e| ProxyError::Config(e.to_string()))?;
        
        // Validate secrets
-        for (user, secret) in &config.users {
+        for (user, secret) in &config.access.users {
            if !secret.chars().all(|c| c.is_ascii_hexdigit()) || secret.len() != 32 {
                return Err(ProxyError::InvalidSecret {
                    user: user.clone(),
@@ -178,50 +294,72 @@ impl ProxyConfig {
            }
        }
        
-        // Default mask_host
-        if config.mask_host.is_none() {
-            config.mask_host = Some(config.tls_domain.clone());
+        // Validate tls_domain
+        if config.censorship.tls_domain.is_empty() {
+            return Err(ProxyError::Config("tls_domain cannot be empty".to_string()));
+        }
+        
+        // Warn if using default tls_domain
+        if config.censorship.tls_domain == "www.google.com" {
+            tracing::warn!("Using default tls_domain (www.google.com). Consider setting a custom domain in config.toml");
+        }
+        
+        // Default mask_host to tls_domain if not set
+        if config.censorship.mask_host.is_none() {
+            tracing::info!("mask_host not set, using tls_domain ({}) for masking", config.censorship.tls_domain);
+            config.censorship.mask_host = Some(config.censorship.tls_domain.clone());
        }
        
        // Random fake_cert_len
        use rand::Rng;
-        config.fake_cert_len = rand::thread_rng().gen_range(1024..4096);
+        config.censorship.fake_cert_len = rand::thread_rng().gen_range(1024..4096);
+        
+        // Migration: Populate listeners if empty
+        if config.server.listeners.is_empty() {
+            if let Ok(ipv4) = config.server.listen_addr_ipv4.parse::<IpAddr>() {
+                config.server.listeners.push(ListenerConfig {
+                    ip: ipv4,
+                    announce_ip: None,
+                });
+            }
+            if let Some(ipv6_str) = &config.server.listen_addr_ipv6 {
+                 if let Ok(ipv6) = ipv6_str.parse::<IpAddr>() {
+                    config.server.listeners.push(ListenerConfig {
+                        ip: ipv6,
+                        announce_ip: None,
+                    });
+                }
+            }
+        }
+
+        // Migration: Populate upstreams if empty (Default Direct)
+        if config.upstreams.is_empty() {
+             config.upstreams.push(UpstreamConfig {
+                upstream_type: UpstreamType::Direct { interface: None },
+                weight: 1,
+                enabled: true,
+            });
+        }
        
        Ok(config)
    }
    
    pub fn validate(&self) -> Result<()> {
-        if self.users.is_empty() {
+        if self.access.users.is_empty() {
            return Err(ProxyError::Config("No users configured".to_string()));
        }
        
-        if !self.modes.classic && !self.modes.secure && !self.modes.tls {
+        if !self.general.modes.classic && !self.general.modes.secure && !self.general.modes.tls {
            return Err(ProxyError::Config("No modes enabled".to_string()));
        }
        
+        // Validate tls_domain format (basic check)
+        if self.censorship.tls_domain.contains(' ') || self.censorship.tls_domain.contains('/') {
+            return Err(ProxyError::Config(
+                format!("Invalid tls_domain: '{}'. Must be a valid domain name", self.censorship.tls_domain)
+            ));
+        }
+        
        Ok(())
    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    
-    #[test]
-    fn test_default_config() {
-        let config = ProxyConfig::default();
-        assert_eq!(config.port, 443);
-        assert!(config.modes.tls);
-        assert_eq!(config.client_keepalive, 600);
-        assert_eq!(config.client_ack_timeout, 300);
-    }
-    
-    #[test]
-    fn test_config_validate() {
-        let mut config = ProxyConfig::default();
-        assert!(config.validate().is_ok());
-        
-        config.users.clear();
-        assert!(config.validate().is_err());
-    }
 }
--- a/src/error.rs
+++ b/src/error.rs
@@ -235,6 +235,9 @@ pub enum ProxyError {
    #[error("Invalid proxy protocol header")]
    InvalidProxyProtocol,
    
+    #[error("Proxy error: {0}")]
+    Proxy(String),
+    
    // ============= Config Errors =============
    
    #[error("Config error: {0}")]
@@ -294,16 +297,16 @@ pub type StreamResult<T> = std::result::Result<T, StreamError>;

 /// Result with optional bad client handling
 #[derive(Debug)]
-pub enum HandshakeResult<T> {
+pub enum HandshakeResult<T, R, W> {
    /// Handshake succeeded
    Success(T),
-    /// Client failed validation, needs masking
-    BadClient,
+    /// Client failed validation, needs masking. Returns ownership of streams.
+    BadClient { reader: R, writer: W },
    /// Error occurred
    Error(ProxyError),
 }

-impl<T> HandshakeResult<T> {
+impl<T, R, W> HandshakeResult<T, R, W> {
    /// Check if successful
    pub fn is_success(&self) -> bool {
        matches!(self, HandshakeResult::Success(_))
@@ -311,49 +314,32 @@ impl<T> HandshakeResult<T> {
    
    /// Check if bad client
    pub fn is_bad_client(&self) -> bool {
-        matches!(self, HandshakeResult::BadClient)
-    }
-    
-    /// Convert to Result, treating BadClient as error
-    pub fn into_result(self) -> Result<T> {
-        match self {
-            HandshakeResult::Success(v) => Ok(v),
-            HandshakeResult::BadClient => Err(ProxyError::InvalidHandshake("Bad client".into())),
-            HandshakeResult::Error(e) => Err(e),
-        }
+        matches!(self, HandshakeResult::BadClient { .. })
    }
    
    /// Map the success value
-    pub fn map<U, F: FnOnce(T) -> U>(self, f: F) -> HandshakeResult<U> {
+    pub fn map<U, F: FnOnce(T) -> U>(self, f: F) -> HandshakeResult<U, R, W> {
        match self {
            HandshakeResult::Success(v) => HandshakeResult::Success(f(v)),
-            HandshakeResult::BadClient => HandshakeResult::BadClient,
+            HandshakeResult::BadClient { reader, writer } => HandshakeResult::BadClient { reader, writer },
            HandshakeResult::Error(e) => HandshakeResult::Error(e),
        }
    }
-    
-    /// Convert success to Option
-    pub fn ok(self) -> Option<T> {
-        match self {
-            HandshakeResult::Success(v) => Some(v),
-            _ => None,
-        }
-    }
 }

-impl<T> From<ProxyError> for HandshakeResult<T> {
+impl<T, R, W> From<ProxyError> for HandshakeResult<T, R, W> {
    fn from(err: ProxyError) -> Self {
        HandshakeResult::Error(err)
    }
 }

-impl<T> From<std::io::Error> for HandshakeResult<T> {
+impl<T, R, W> From<std::io::Error> for HandshakeResult<T, R, W> {
    fn from(err: std::io::Error) -> Self {
        HandshakeResult::Error(ProxyError::Io(err))
    }
 }

-impl<T> From<StreamError> for HandshakeResult<T> {
+impl<T, R, W> From<StreamError> for HandshakeResult<T, R, W> {
    fn from(err: StreamError) -> Self {
        HandshakeResult::Error(ProxyError::Stream(err))
    }
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,158 +1,210 @@
 //! Telemt - MTProxy on Rust

-use std::sync::Arc;
 use std::net::SocketAddr;
+use std::sync::Arc;
+use std::time::Duration;
 use tokio::net::TcpListener;
 use tokio::signal;
-use tracing::{info, error, Level};
-use tracing_subscriber::{FmtSubscriber, EnvFilter};
+use tracing::{info, error, warn};
+use tracing_subscriber::{fmt, EnvFilter};

-mod error;
+mod config;
 mod crypto;
+mod error;
 mod protocol;
+mod proxy;
+mod stats;
 mod stream;
 mod transport;
-mod proxy;
-mod config;
-mod stats;
 mod util;

-use config::ProxyConfig;
-use stats::{Stats, ReplayChecker};
-use transport::ConnectionPool;
-use proxy::ClientHandler;
+use crate::config::ProxyConfig;
+use crate::proxy::ClientHandler;
+use crate::stats::{Stats, ReplayChecker};
+use crate::transport::{create_listener, ListenOptions, UpstreamManager};
+use crate::util::ip::detect_ip;
+use crate::stream::BufferPool;

 #[tokio::main]
-async fn main() -> std::result::Result<(), Box<dyn std::error::Error>> {
-    // Initialize logging with env filter
-    // Use RUST_LOG=debug or RUST_LOG=trace for more details
-    let filter = EnvFilter::try_from_default_env()
-        .unwrap_or_else(|_| EnvFilter::new("info"));
-    
-    let subscriber = FmtSubscriber::builder()
-        .with_env_filter(filter)
-        .with_target(true)
-        .with_thread_ids(false)
-        .with_file(false)
-        .with_line_number(false)
-        .finish();
-    
-    tracing::subscriber::set_global_default(subscriber)?;
-    
-    // Load configuration
-    let config_path = std::env::args()
-        .nth(1)
-        .unwrap_or_else(|| "config.toml".to_string());
-    
-    info!("Loading configuration from {}", config_path);
-    
-    let config = ProxyConfig::load(&config_path).unwrap_or_else(|e| {
-        error!("Failed to load config: {}", e);
-        info!("Using default configuration");
-        ProxyConfig::default()
-    });
-    
-    if let Err(e) = config.validate() {
-        error!("Invalid configuration: {}", e);
-        std::process::exit(1);
-    }
-    
-    let config = Arc::new(config);
-    
-    info!("Starting MTProto Proxy on port {}", config.port);
-    info!("Fast mode: {}", config.fast_mode);
-    info!("Modes: classic={}, secure={}, tls={}", 
-        config.modes.classic, config.modes.secure, config.modes.tls);
-    
-    // Initialize components
-    let stats = Arc::new(Stats::new());
-    let replay_checker = Arc::new(ReplayChecker::new(config.replay_check_len));
-    let pool = Arc::new(ConnectionPool::new());
-    
-    // Create handler
-    let handler = Arc::new(ClientHandler::new(
-        Arc::clone(&config),
-        Arc::clone(&stats),
-        Arc::clone(&replay_checker),
-        Arc::clone(&pool),
-    ));
-    
-    // Start listener
-    let addr: SocketAddr = format!("{}:{}", config.listen_addr_ipv4, config.port)
-        .parse()?;
-    
-    let listener = TcpListener::bind(addr).await?;
-    info!("Listening on {}", addr);
-    
-    // Print proxy links
-    print_proxy_links(&config);
-    
-    info!("Use RUST_LOG=debug or RUST_LOG=trace for more detailed logging");
-    
-    // Main accept loop
-    let accept_loop = async {
-        loop {
-            match listener.accept().await {
-                Ok((stream, peer)) => {
-                    let handler = Arc::clone(&handler);
-                    tokio::spawn(async move {
-                        handler.handle(stream, peer).await;
-                    });
-                }
-                Err(e) => {
-                    error!("Accept error: {}", e);
-                }
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    // Initialize logging
+    fmt()
+        .with_env_filter(EnvFilter::from_default_env().add_directive("info".parse().unwrap()))
+        .init();
+
+    // Load config
+    let config_path = std::env::args().nth(1).unwrap_or_else(|| "config.toml".to_string());
+    let config = match ProxyConfig::load(&config_path) {
+        Ok(c) => c,
+        Err(e) => {
+            // If config doesn't exist, try to create default
+            if std::path::Path::new(&config_path).exists() {
+                error!("Failed to load config: {}", e);
+                std::process::exit(1);
+            } else {
+                let default = ProxyConfig::default();
+                let toml = toml::to_string_pretty(&default).unwrap();
+                std::fs::write(&config_path, toml).unwrap();
+                info!("Created default config at {}", config_path);
+                default
            }
        }
    };
    
-    // Graceful shutdown
-    tokio::select! {
-        _ = accept_loop => {}
-        _ = signal::ctrl_c() => {
-            info!("Shutting down...");
-        }
-    }
+    config.validate()?;
    
-    // Cleanup
-    pool.close_all().await;
+    // Log loaded configuration for debugging
+    info!("=== Configuration Loaded ===");
+    info!("TLS Domain: {}", config.censorship.tls_domain);
+    info!("Mask enabled: {}", config.censorship.mask);
+    info!("Mask host: {}", config.censorship.mask_host.as_deref().unwrap_or(&config.censorship.tls_domain));
+    info!("Mask port: {}", config.censorship.mask_port);
+    info!("Modes: classic={}, secure={}, tls={}", 
+        config.general.modes.classic, 
+        config.general.modes.secure, 
+        config.general.modes.tls
+    );
+    info!("============================");
    
-    info!("Goodbye!");
-    Ok(())
-}
+    let config = Arc::new(config);
+    let stats = Arc::new(Stats::new());
+    
+    // Initialize global ReplayChecker
+    // Using sharded implementation for better concurrency
+    let replay_checker = Arc::new(ReplayChecker::new(config.access.replay_check_len));
+    
+    // Initialize Upstream Manager
+    let upstream_manager = Arc::new(UpstreamManager::new(config.upstreams.clone()));
+    
+    // Initialize Buffer Pool
+    // 16KB buffers, max 4096 buffers (~64MB total cached)
+    let buffer_pool = Arc::new(BufferPool::with_config(16 * 1024, 4096));
+    
+    // Start Health Checks
+    let um_clone = upstream_manager.clone();
+    tokio::spawn(async move {
+        um_clone.run_health_checks().await;
+    });

-fn print_proxy_links(config: &ProxyConfig) {
-    println!("\n=== Proxy Links ===\n");
+    // Detect public IP if needed (once at startup)
+    let detected_ip = detect_ip().await;
+
+    // Start Listeners
+    let mut listeners = Vec::new();
    
-    for (user, secret) in &config.users {
-        if config.modes.tls {
-            let tls_secret = format!(
-                "ee{}{}",
-                secret,
-                hex::encode(config.tls_domain.as_bytes())
-            );
-            println!(
-                "{} (TLS): tg://proxy?server=IP&port={}&secret={}",
-                user, config.port, tls_secret
-            );
-        }
+    for listener_conf in &config.server.listeners {
+        let addr = SocketAddr::new(listener_conf.ip, config.server.port);
+        let options = ListenOptions {
+            ipv6_only: listener_conf.ip.is_ipv6(),
+            ..Default::default()
+        };
        
-        if config.modes.secure {
-            println!(
-                "{} (Secure): tg://proxy?server=IP&port={}&secret=dd{}",
-                user, config.port, secret
-            );
+        match create_listener(addr, &options) {
+            Ok(socket) => {
+                let listener = TcpListener::from_std(socket.into())?;
+                info!("Listening on {}", addr);
+                
+                // Determine public IP for tg:// links
+                let public_ip = if let Some(ip) = listener_conf.announce_ip {
+                    ip
+                } else if listener_conf.ip.is_unspecified() {
+                    if listener_conf.ip.is_ipv4() {
+                        detected_ip.ipv4.unwrap_or(listener_conf.ip)
+                    } else {
+                        detected_ip.ipv6.unwrap_or(listener_conf.ip)
+                    }
+                } else {
+                    listener_conf.ip
+                };
+
+                // Show links for configured users
+                if !config.show_link.is_empty() {
+                    info!("--- Proxy Links for {} ---", public_ip);
+                    for user_name in &config.show_link {
+                        if let Some(secret) = config.access.users.get(user_name) {
+                            info!("User: {}", user_name);
+
+                            if config.general.modes.classic {
+                                info!("  Classic: tg://proxy?server={}&port={}&secret={}", 
+                                    public_ip, config.server.port, secret);
+                            }
+
+                            if config.general.modes.secure {
+                                info!("  DD:      tg://proxy?server={}&port={}&secret=dd{}", 
+                                    public_ip, config.server.port, secret);
+                            }
+
+                            if config.general.modes.tls {
+                                let domain_hex = hex::encode(&config.censorship.tls_domain);
+                                info!("  EE-TLS:  tg://proxy?server={}&port={}&secret=ee{}{}", 
+                                    public_ip, config.server.port, secret, domain_hex);
+                            }
+                        } else {
+                            warn!("User '{}' specified in show_link not found in users list", user_name);
+                        }
+                    }
+                    info!("-----------------------------------");
+                }
+                
+                listeners.push(listener);
+            },
+            Err(e) => {
+                error!("Failed to bind to {}: {}", addr, e);
+            }
        }
-        
-        if config.modes.classic {
-            println!(
-                "{} (Classic): tg://proxy?server=IP&port={}&secret={}",
-                user, config.port, secret
-            );
-        }
-        
-        println!();
    }
    
-    println!("===================\n");
+    if listeners.is_empty() {
+        error!("No listeners could be started. Exiting.");
+        std::process::exit(1);
+    }
+
+    // Accept loop
+    for listener in listeners {
+        let config = config.clone();
+        let stats = stats.clone();
+        let upstream_manager = upstream_manager.clone();
+        let replay_checker = replay_checker.clone();
+        let buffer_pool = buffer_pool.clone();
+        
+        tokio::spawn(async move {
+            loop {
+                match listener.accept().await {
+                    Ok((stream, peer_addr)) => {
+                        let config = config.clone();
+                        let stats = stats.clone();
+                        let upstream_manager = upstream_manager.clone();
+                        let replay_checker = replay_checker.clone();
+                        let buffer_pool = buffer_pool.clone();
+                        
+                        tokio::spawn(async move {
+                            if let Err(e) = ClientHandler::new(
+                                stream, 
+                                peer_addr, 
+                                config, 
+                                stats,
+                                upstream_manager,
+                                replay_checker,
+                                buffer_pool
+                            ).run().await {
+                                // Log only relevant errors
+                            }
+                        });
+                    }
+                    Err(e) => {
+                        error!("Accept error: {}", e);
+                        tokio::time::sleep(Duration::from_millis(100)).await;
+                    }
+                }
+            }
+        });
+    }
+
+    // Wait for signal
+    match signal::ctrl_c().await {
+        Ok(()) => info!("Shutting down..."),
+        Err(e) => error!("Signal error: {}", e),
+    }
+
+    Ok(())
 }
--- a/src/protocol/constants.rs
+++ b/src/protocol/constants.rs
@@ -167,7 +167,10 @@ pub const DEFAULT_ACK_TIMEOUT_SECS: u64 = 300;
 // ============= Buffer Sizes =============

 /// Default buffer size
-pub const DEFAULT_BUFFER_SIZE: usize = 65536;
+/// CHANGED: Reduced from 64KB to 16KB to match TLS record size and align with
+/// the new buffering strategy for better iOS upload performance.
+pub const DEFAULT_BUFFER_SIZE: usize = 16384;
+
 /// Small buffer size for bad client handling
 pub const SMALL_BUFFER_SIZE: usize = 8192;

--- a/src/proxy/client.rs
+++ b/src/proxy/client.rs
@@ -13,102 +13,125 @@ use crate::error::{ProxyError, Result, HandshakeResult};
 use crate::protocol::constants::*;
 use crate::protocol::tls;
 use crate::stats::{Stats, ReplayChecker};
-use crate::transport::{ConnectionPool, configure_client_socket};
-use crate::stream::{CryptoReader, CryptoWriter, FakeTlsReader, FakeTlsWriter};
+use crate::transport::{configure_client_socket, UpstreamManager};
+use crate::stream::{CryptoReader, CryptoWriter, FakeTlsReader, FakeTlsWriter, BufferPool};
 use crate::crypto::AesCtr;

-use super::handshake::{
+// Use absolute paths to avoid confusion
+use crate::proxy::handshake::{
    handle_tls_handshake, handle_mtproto_handshake, 
    HandshakeSuccess, generate_tg_nonce, encrypt_tg_nonce,
 };
-use super::relay::relay_bidirectional;
-use super::masking::handle_bad_client;
+use crate::proxy::relay::relay_bidirectional;
+use crate::proxy::masking::handle_bad_client;

-/// Client connection handler
-pub struct ClientHandler {
+/// Client connection handler (builder struct)
+pub struct ClientHandler;
+
+/// Running client handler with stream and context
+pub struct RunningClientHandler {
+    stream: TcpStream,
+    peer: SocketAddr,
    config: Arc<ProxyConfig>,
    stats: Arc<Stats>,
    replay_checker: Arc<ReplayChecker>,
-    pool: Arc<ConnectionPool>,
+    upstream_manager: Arc<UpstreamManager>,
+    buffer_pool: Arc<BufferPool>,
 }

 impl ClientHandler {
-    /// Create new client handler
+    /// Create new client handler instance
    pub fn new(
+        stream: TcpStream,
+        peer: SocketAddr,
        config: Arc<ProxyConfig>,
        stats: Arc<Stats>,
+        upstream_manager: Arc<UpstreamManager>,
        replay_checker: Arc<ReplayChecker>,
-        pool: Arc<ConnectionPool>,
-    ) -> Self {
-        Self {
+        buffer_pool: Arc<BufferPool>,
+    ) -> RunningClientHandler {
+        RunningClientHandler {
+            stream,
+            peer,
            config,
            stats,
            replay_checker,
-            pool,
+            upstream_manager,
+            buffer_pool,
        }
    }
-    
-    /// Handle a client connection
-    pub async fn handle(&self, stream: TcpStream, peer: SocketAddr) {
+}
+
+impl RunningClientHandler {
+    /// Run the client handler
+    pub async fn run(mut self) -> Result<()> {
        self.stats.increment_connects_all();
        
+        let peer = self.peer;
        debug!(peer = %peer, "New connection");
        
        // Configure socket
        if let Err(e) = configure_client_socket(
-            &stream,
-            self.config.client_keepalive,
-            self.config.client_ack_timeout,
+            &self.stream,
+            self.config.timeouts.client_keepalive,
+            self.config.timeouts.client_ack,
        ) {
            debug!(peer = %peer, error = %e, "Failed to configure client socket");
        }
        
        // Perform handshake with timeout
-        let handshake_timeout = Duration::from_secs(self.config.client_handshake_timeout);
+        let handshake_timeout = Duration::from_secs(self.config.timeouts.client_handshake);
+        
+        // Clone stats for error handling block
+        let stats = self.stats.clone();
        
        let result = timeout(
            handshake_timeout,
-            self.do_handshake(stream, peer)
+            self.do_handshake()
        ).await;
        
        match result {
            Ok(Ok(())) => {
                debug!(peer = %peer, "Connection handled successfully");
+                Ok(())
            }
            Ok(Err(e)) => {
                debug!(peer = %peer, error = %e, "Handshake failed");
+                Err(e)
            }
            Err(_) => {
-                self.stats.increment_handshake_timeouts();
+                stats.increment_handshake_timeouts();
                debug!(peer = %peer, "Handshake timeout");
+                Err(ProxyError::TgHandshakeTimeout)
            }
        }
    }
    
    /// Perform handshake and relay
-    async fn do_handshake(&self, mut stream: TcpStream, peer: SocketAddr) -> Result<()> {
+    async fn do_handshake(mut self) -> Result<()> {
        // Read first bytes to determine handshake type
        let mut first_bytes = [0u8; 5];
-        stream.read_exact(&mut first_bytes).await?;
+        self.stream.read_exact(&mut first_bytes).await?;
        
        let is_tls = tls::is_tls_handshake(&first_bytes[..3]);
+        let peer = self.peer;
        
        debug!(peer = %peer, is_tls = is_tls, first_bytes = %hex::encode(&first_bytes), "Handshake type detected");
        
        if is_tls {
-            self.handle_tls_client(stream, peer, first_bytes).await
+            self.handle_tls_client(first_bytes).await
        } else {
-            self.handle_direct_client(stream, peer, first_bytes).await
+            self.handle_direct_client(first_bytes).await
        }
    }
    
    /// Handle TLS-wrapped client
    async fn handle_tls_client(
-        &self,
-        mut stream: TcpStream,
-        peer: SocketAddr,
+        mut self,
        first_bytes: [u8; 5],
    ) -> Result<()> {
+        let peer = self.peer;
+        
        // Read TLS handshake length
        let tls_len = u16::from_be_bytes([first_bytes[3], first_bytes[4]]) as usize;
        
@@ -117,17 +140,25 @@ impl ClientHandler {
        if tls_len < 512 {
            debug!(peer = %peer, tls_len = tls_len, "TLS handshake too short");
            self.stats.increment_connects_bad();
-            handle_bad_client(stream, &first_bytes, &self.config).await;
+            // FIX: Split stream into reader/writer for handle_bad_client
+            let (reader, writer) = self.stream.into_split();
+            handle_bad_client(reader, writer, &first_bytes, &self.config).await;
            return Ok(());
        }
        
        // Read full TLS handshake
        let mut handshake = vec![0u8; 5 + tls_len];
        handshake[..5].copy_from_slice(&first_bytes);
-        stream.read_exact(&mut handshake[5..]).await?;
+        self.stream.read_exact(&mut handshake[5..]).await?;
+        
+        // Extract fields before consuming self.stream
+        let config = self.config.clone();
+        let replay_checker = self.replay_checker.clone();
+        let stats = self.stats.clone();
+        let buffer_pool = self.buffer_pool.clone();
        
        // Split stream for reading/writing
-        let (read_half, write_half) = stream.into_split();
+        let (read_half, write_half) = self.stream.into_split();
        
        // Handle TLS handshake
        let (mut tls_reader, tls_writer, _tls_user) = match handle_tls_handshake(
@@ -135,12 +166,13 @@ impl ClientHandler {
            read_half,
            write_half,
            peer,
-            &self.config,
-            &self.replay_checker,
+            &config,
+            &replay_checker,
        ).await {
            HandshakeResult::Success(result) => result,
-            HandshakeResult::BadClient => {
-                self.stats.increment_connects_bad();
+            HandshakeResult::BadClient { reader, writer } => {
+                stats.increment_connects_bad();
+                handle_bad_client(reader, writer, &handshake, &config).await;
                return Ok(());
            }
            HandshakeResult::Error(e) => return Err(e),
@@ -158,44 +190,61 @@ impl ClientHandler {
            tls_reader,
            tls_writer,
            peer,
-            &self.config,
-            &self.replay_checker,
+            &config,
+            &replay_checker,
            true,
        ).await {
            HandshakeResult::Success(result) => result,
-            HandshakeResult::BadClient => {
-                self.stats.increment_connects_bad();
+            HandshakeResult::BadClient { reader, writer } => {
+                stats.increment_connects_bad();
+                // Valid TLS but invalid MTProto - drop
+                debug!(peer = %peer, "Valid TLS but invalid MTProto handshake - dropping");
                return Ok(());
            }
            HandshakeResult::Error(e) => return Err(e),
        };
        
-        // Handle authenticated client
-        self.handle_authenticated_inner(crypto_reader, crypto_writer, success).await
+        Self::handle_authenticated_static(
+            crypto_reader, 
+            crypto_writer, 
+            success, 
+            self.upstream_manager, 
+            self.stats, 
+            self.config,
+            buffer_pool
+        ).await
    }
    
    /// Handle direct (non-TLS) client
    async fn handle_direct_client(
-        &self,
-        mut stream: TcpStream,
-        peer: SocketAddr,
+        mut self,
        first_bytes: [u8; 5],
    ) -> Result<()> {
+        let peer = self.peer;
+        
        // Check if non-TLS modes are enabled
-        if !self.config.modes.classic && !self.config.modes.secure {
+        if !self.config.general.modes.classic && !self.config.general.modes.secure {
            debug!(peer = %peer, "Non-TLS modes disabled");
            self.stats.increment_connects_bad();
-            handle_bad_client(stream, &first_bytes, &self.config).await;
+            // FIX: Split stream into reader/writer for handle_bad_client
+            let (reader, writer) = self.stream.into_split();
+            handle_bad_client(reader, writer, &first_bytes, &self.config).await;
            return Ok(());
        }
        
        // Read rest of handshake
        let mut handshake = [0u8; HANDSHAKE_LEN];
        handshake[..5].copy_from_slice(&first_bytes);
-        stream.read_exact(&mut handshake[5..]).await?;
+        self.stream.read_exact(&mut handshake[5..]).await?;
+        
+        // Extract fields
+        let config = self.config.clone();
+        let replay_checker = self.replay_checker.clone();
+        let stats = self.stats.clone();
+        let buffer_pool = self.buffer_pool.clone();
        
        // Split stream
-        let (read_half, write_half) = stream.into_split();
+        let (read_half, write_half) = self.stream.into_split();
        
        // Handle MTProto handshake
        let (crypto_reader, crypto_writer, success) = match handle_mtproto_handshake(
@@ -203,27 +252,39 @@ impl ClientHandler {
            read_half,
            write_half,
            peer,
-            &self.config,
-            &self.replay_checker,
+            &config,
+            &replay_checker,
            false,
        ).await {
            HandshakeResult::Success(result) => result,
-            HandshakeResult::BadClient => {
-                self.stats.increment_connects_bad();
+            HandshakeResult::BadClient { reader, writer } => {
+                stats.increment_connects_bad();
+                handle_bad_client(reader, writer, &handshake, &config).await;
                return Ok(());
            }
            HandshakeResult::Error(e) => return Err(e),
        };
        
-        self.handle_authenticated_inner(crypto_reader, crypto_writer, success).await
+        Self::handle_authenticated_static(
+            crypto_reader, 
+            crypto_writer, 
+            success, 
+            self.upstream_manager, 
+            self.stats, 
+            self.config,
+            buffer_pool
+        ).await
    }
    
-    /// Handle authenticated client - connect to Telegram and relay
-    async fn handle_authenticated_inner<R, W>(
-        &self,
+    /// Static version of handle_authenticated_inner
+    async fn handle_authenticated_static<R, W>(
        client_reader: CryptoReader<R>,
        client_writer: CryptoWriter<W>,
        success: HandshakeSuccess,
+        upstream_manager: Arc<UpstreamManager>,
+        stats: Arc<Stats>,
+        config: Arc<ProxyConfig>,
+        buffer_pool: Arc<BufferPool>,
    ) -> Result<()>
    where
        R: AsyncRead + Unpin + Send + 'static,
@@ -232,13 +293,13 @@ impl ClientHandler {
        let user = &success.user;
        
        // Check user limits
-        if let Err(e) = self.check_user_limits(user) {
+        if let Err(e) = Self::check_user_limits_static(user, &config, &stats) {
            warn!(user = %user, error = %e, "User limit exceeded");
            return Err(e);
        }
        
        // Get datacenter address
-        let dc_addr = self.get_dc_addr(success.dc_idx)?;
+        let dc_addr = Self::get_dc_addr_static(success.dc_idx, &config)?;
        
        info!(
            user = %user,
@@ -246,39 +307,41 @@ impl ClientHandler {
            dc = success.dc_idx,
            dc_addr = %dc_addr,
            proto = ?success.proto_tag,
-            fast_mode = self.config.fast_mode,
+            fast_mode = config.general.fast_mode,
            "Connecting to Telegram"
        );
        
-        // Connect to Telegram
-        let tg_stream = self.pool.get(dc_addr).await?;
+        // Connect to Telegram via UpstreamManager
+        let tg_stream = upstream_manager.connect(dc_addr).await?;
        
        debug!(peer = %success.peer, dc_addr = %dc_addr, "Connected to Telegram, performing handshake");
        
        // Perform Telegram handshake and get crypto streams
-        let (tg_reader, tg_writer) = self.do_tg_handshake(
+        let (tg_reader, tg_writer) = Self::do_tg_handshake_static(
            tg_stream, 
            &success,
+            &config,
        ).await?;
        
        debug!(peer = %success.peer, "Telegram handshake complete, starting relay");
        
        // Update stats
-        self.stats.increment_user_connects(user);
-        self.stats.increment_user_curr_connects(user);
+        stats.increment_user_connects(user);
+        stats.increment_user_curr_connects(user);
        
-        // Relay traffic - передаём Arc::clone(&self.stats)
+        // Relay traffic using buffer pool
        let relay_result = relay_bidirectional(
            client_reader,
            client_writer,
            tg_reader,
            tg_writer,
            user,
-            Arc::clone(&self.stats),
+            Arc::clone(&stats),
+            buffer_pool,
        ).await;
        
        // Update stats
-        self.stats.decrement_user_curr_connects(user);
+        stats.decrement_user_curr_connects(user);
        
        match &relay_result {
            Ok(()) => debug!(user = %user, peer = %success.peer, "Relay completed normally"),
@@ -288,26 +351,26 @@ impl ClientHandler {
        relay_result
    }
    
-    /// Check user limits (expiration, connection count, data quota)
-    fn check_user_limits(&self, user: &str) -> Result<()> {
+    /// Check user limits (static version)
+    fn check_user_limits_static(user: &str, config: &ProxyConfig, stats: &Stats) -> Result<()> {
        // Check expiration
-        if let Some(expiration) = self.config.user_expirations.get(user) {
+        if let Some(expiration) = config.access.user_expirations.get(user) {
            if chrono::Utc::now() > *expiration {
                return Err(ProxyError::UserExpired { user: user.to_string() });
            }
        }
        
        // Check connection limit
-        if let Some(limit) = self.config.user_max_tcp_conns.get(user) {
-            let current = self.stats.get_user_curr_connects(user);
+        if let Some(limit) = config.access.user_max_tcp_conns.get(user) {
+            let current = stats.get_user_curr_connects(user);
            if current >= *limit as u64 {
                return Err(ProxyError::ConnectionLimitExceeded { user: user.to_string() });
            }
        }
        
        // Check data quota
-        if let Some(quota) = self.config.user_data_quota.get(user) {
-            let used = self.stats.get_user_total_octets(user);
+        if let Some(quota) = config.access.user_data_quota.get(user) {
+            let used = stats.get_user_total_octets(user);
            if used >= *quota {
                return Err(ProxyError::DataQuotaExceeded { user: user.to_string() });
            }
@@ -316,11 +379,11 @@ impl ClientHandler {
        Ok(())
    }
    
-    /// Get datacenter address by index
-    fn get_dc_addr(&self, dc_idx: i16) -> Result<SocketAddr> {
+    /// Get datacenter address by index (static version)
+    fn get_dc_addr_static(dc_idx: i16, config: &ProxyConfig) -> Result<SocketAddr> {
        let idx = (dc_idx.abs() - 1) as usize;
        
-        let datacenters = if self.config.prefer_ipv6 {
+        let datacenters = if config.general.prefer_ipv6 {
            &*TG_DATACENTERS_V6
        } else {
            &*TG_DATACENTERS_V4
@@ -333,19 +396,18 @@ impl ClientHandler {
            ))
    }
    
-    /// Perform handshake with Telegram server
-    /// Returns crypto reader and writer for TG connection
-    async fn do_tg_handshake(
-        &self,
+    /// Perform handshake with Telegram server (static version)
+    async fn do_tg_handshake_static(
        mut stream: TcpStream,
        success: &HandshakeSuccess,
+        config: &ProxyConfig,
    ) -> Result<(CryptoReader<tokio::net::tcp::OwnedReadHalf>, CryptoWriter<tokio::net::tcp::OwnedWriteHalf>)> {
        // Generate nonce with keys for TG
        let (nonce, tg_enc_key, tg_enc_iv, tg_dec_key, tg_dec_iv) = generate_tg_nonce(
            success.proto_tag,
            &success.dec_key,  // Client's dec key
            success.dec_iv,
-            self.config.fast_mode,
+            config.general.fast_mode,
        );
        
        // Encrypt nonce
--- a/src/proxy/handshake.rs
+++ b/src/proxy/handshake.rs
@@ -42,7 +42,7 @@ pub async fn handle_tls_handshake<R, W>(
    peer: SocketAddr,
    config: &ProxyConfig,
    replay_checker: &ReplayChecker,
-) -> HandshakeResult<(FakeTlsReader<R>, FakeTlsWriter<W>, String)>
+) -> HandshakeResult<(FakeTlsReader<R>, FakeTlsWriter<W>, String), R, W>
 where
    R: AsyncRead + Unpin,
    W: AsyncWrite + Unpin,
@@ -52,7 +52,7 @@ where
    // Check minimum length
    if handshake.len() < tls::TLS_DIGEST_POS + tls::TLS_DIGEST_LEN + 1 {
        debug!(peer = %peer, "TLS handshake too short");
-        return HandshakeResult::BadClient;
+        return HandshakeResult::BadClient { reader, writer };
    }
    
    // Extract digest for replay check
@@ -61,36 +61,38 @@ where
    
    // Check for replay
    if replay_checker.check_tls_digest(digest_half) {
-        warn!(peer = %peer, "TLS replay attack detected");
-        return HandshakeResult::BadClient;
+        warn!(peer = %peer, "TLS replay attack detected (duplicate digest)");
+        return HandshakeResult::BadClient { reader, writer };
    }
    
    // Build secrets list
-    let secrets: Vec<(String, Vec<u8>)> = config.users.iter()
+    let secrets: Vec<(String, Vec<u8>)> = config.access.users.iter()
        .filter_map(|(name, hex)| {
            hex::decode(hex).ok().map(|bytes| (name.clone(), bytes))
        })
        .collect();
    
-    debug!(peer = %peer, num_users = secrets.len(), "Validating TLS handshake against users");
-    
    // Validate handshake
    let validation = match tls::validate_tls_handshake(
        handshake,
        &secrets,
-        config.ignore_time_skew,
+        config.access.ignore_time_skew,
    ) {
        Some(v) => v,
        None => {
-            debug!(peer = %peer, "TLS handshake validation failed - no matching user");
-            return HandshakeResult::BadClient;
+            debug!(
+                peer = %peer, 
+                ignore_time_skew = config.access.ignore_time_skew,
+                "TLS handshake validation failed - no matching user or time skew"
+            );
+            return HandshakeResult::BadClient { reader, writer };
        }
    };
    
    // Get secret for response
    let secret = match secrets.iter().find(|(name, _)| *name == validation.user) {
        Some((_, s)) => s,
-        None => return HandshakeResult::BadClient,
+        None => return HandshakeResult::BadClient { reader, writer },
    };
    
    // Build and send response
@@ -98,20 +100,22 @@ where
        secret,
        &validation.digest,
        &validation.session_id,
-        config.fake_cert_len,
+        config.censorship.fake_cert_len,
    );
    
    debug!(peer = %peer, response_len = response.len(), "Sending TLS ServerHello");
    
    if let Err(e) = writer.write_all(&response).await {
+        warn!(peer = %peer, error = %e, "Failed to write TLS ServerHello");
        return HandshakeResult::Error(ProxyError::Io(e));
    }
    
    if let Err(e) = writer.flush().await {
+        warn!(peer = %peer, error = %e, "Failed to flush TLS ServerHello");
        return HandshakeResult::Error(ProxyError::Io(e));
    }
    
-    // Record for replay protection
+    // Record for replay protection only after successful handshake
    replay_checker.add_tls_digest(digest_half);
    
    info!(
@@ -136,7 +140,7 @@ pub async fn handle_mtproto_handshake<R, W>(
    config: &ProxyConfig,
    replay_checker: &ReplayChecker,
    is_tls: bool,
-) -> HandshakeResult<(CryptoReader<R>, CryptoWriter<W>, HandshakeSuccess)>
+) -> HandshakeResult<(CryptoReader<R>, CryptoWriter<W>, HandshakeSuccess), R, W>
 where
    R: AsyncRead + Unpin + Send,
    W: AsyncWrite + Unpin + Send,
@@ -146,23 +150,17 @@ where
    // Extract prekey and IV
    let dec_prekey_iv = &handshake[SKIP_LEN..SKIP_LEN + PREKEY_LEN + IV_LEN];
    
-    debug!(
-        peer = %peer,
-        dec_prekey_iv = %hex::encode(dec_prekey_iv),
-        "Extracted prekey+IV from handshake"
-    );
-    
    // Check for replay
    if replay_checker.check_handshake(dec_prekey_iv) {
        warn!(peer = %peer, "MTProto replay attack detected");
-        return HandshakeResult::BadClient;
+        return HandshakeResult::BadClient { reader, writer };
    }
    
    // Reversed for encryption direction
    let enc_prekey_iv: Vec<u8> = dec_prekey_iv.iter().rev().copied().collect();
    
    // Try each user's secret
-    for (user, secret_hex) in &config.users {
+    for (user, secret_hex) in &config.access.users {
        let secret = match hex::decode(secret_hex) {
            Ok(s) => s,
            Err(_) => continue,
@@ -183,13 +181,6 @@ where
        let mut decryptor = AesCtr::new(&dec_key, dec_iv);
        let decrypted = decryptor.decrypt(handshake);
        
-        trace!(
-            peer = %peer,
-            user = %user,
-            decrypted_tail = %hex::encode(&decrypted[PROTO_TAG_POS..]),
-            "Decrypted handshake tail"
-        );
-        
        // Check protocol tag
        let tag_bytes: [u8; 4] = decrypted[PROTO_TAG_POS..PROTO_TAG_POS + 4]
            .try_into()
@@ -197,20 +188,15 @@ where
        
        let proto_tag = match ProtoTag::from_bytes(tag_bytes) {
            Some(tag) => tag,
-            None => {
-                trace!(peer = %peer, user = %user, tag = %hex::encode(tag_bytes), "Invalid proto tag");
-                continue;
-            }
+            None => continue,
        };
        
-        debug!(peer = %peer, user = %user, proto = ?proto_tag, "Found valid proto tag");
-        
        // Check if mode is enabled
        let mode_ok = match proto_tag {
            ProtoTag::Secure => {
-                if is_tls { config.modes.tls } else { config.modes.secure }
+                if is_tls { config.general.modes.tls } else { config.general.modes.secure }
            }
-            ProtoTag::Intermediate | ProtoTag::Abridged => config.modes.classic,
+            ProtoTag::Intermediate | ProtoTag::Abridged => config.general.modes.classic,
        };
        
        if !mode_ok {
@@ -270,13 +256,10 @@ where
    }
    
    debug!(peer = %peer, "MTProto handshake: no matching user found");
-    HandshakeResult::BadClient
+    HandshakeResult::BadClient { reader, writer }
 }

 /// Generate nonce for Telegram connection
-/// 
-/// In FAST MODE: we use the same keys for TG as for client, but reversed.
-/// This means: client's enc_key becomes TG's dec_key and vice versa.
 pub fn generate_tg_nonce(
    proto_tag: ProtoTag, 
    client_dec_key: &[u8; 32],
@@ -287,39 +270,22 @@ pub fn generate_tg_nonce(
        let bytes = SECURE_RANDOM.bytes(HANDSHAKE_LEN);
        let mut nonce: [u8; HANDSHAKE_LEN] = bytes.try_into().unwrap();
        
-        // Check reserved patterns
-        if RESERVED_NONCE_FIRST_BYTES.contains(&nonce[0]) {
-            continue;
-        }
+        if RESERVED_NONCE_FIRST_BYTES.contains(&nonce[0]) { continue; }
        
        let first_four: [u8; 4] = nonce[..4].try_into().unwrap();
-        if RESERVED_NONCE_BEGINNINGS.contains(&first_four) {
-            continue;
-        }
+        if RESERVED_NONCE_BEGINNINGS.contains(&first_four) { continue; }
        
        let continue_four: [u8; 4] = nonce[4..8].try_into().unwrap();
-        if RESERVED_NONCE_CONTINUES.contains(&continue_four) {
-            continue;
-        }
+        if RESERVED_NONCE_CONTINUES.contains(&continue_four) { continue; }
        
-        // Set protocol tag
        nonce[PROTO_TAG_POS..PROTO_TAG_POS + 4].copy_from_slice(&proto_tag.to_bytes());
        
-        // Fast mode: copy client's dec_key+iv (this becomes TG's enc direction)
-        // In fast mode, we make TG use the same keys as client but swapped:
-        // - What we decrypt FROM TG = what we encrypt TO client (so no re-encryption needed)
-        // - What we encrypt TO TG = what we decrypt FROM client
        if fast_mode {
-            // Put client's dec_key + dec_iv into nonce[8:56]
-            // This will be used by TG for encryption TO us
            nonce[SKIP_LEN..SKIP_LEN + KEY_LEN].copy_from_slice(client_dec_key);
            nonce[SKIP_LEN + KEY_LEN..SKIP_LEN + KEY_LEN + IV_LEN]
                .copy_from_slice(&client_dec_iv.to_be_bytes());
        }
        
-        // Now compute what keys WE will use for TG connection
-        // enc_key_iv = nonce[8:56] (for encrypting TO TG)
-        // dec_key_iv = nonce[8:56] reversed (for decrypting FROM TG)
        let enc_key_iv = &nonce[SKIP_LEN..SKIP_LEN + KEY_LEN + IV_LEN];
        let dec_key_iv: Vec<u8> = enc_key_iv.iter().rev().copied().collect();
        
@@ -329,44 +295,22 @@ pub fn generate_tg_nonce(
        let tg_dec_key: [u8; 32] = dec_key_iv[..KEY_LEN].try_into().unwrap();
        let tg_dec_iv = u128::from_be_bytes(dec_key_iv[KEY_LEN..].try_into().unwrap());
        
-        debug!(
-            fast_mode = fast_mode,
-            tg_enc_key = %hex::encode(&tg_enc_key[..8]),
-            tg_dec_key = %hex::encode(&tg_dec_key[..8]),
-            "Generated TG nonce"
-        );
-        
        return (nonce, tg_enc_key, tg_enc_iv, tg_dec_key, tg_dec_iv);
    }
 }

 /// Encrypt nonce for sending to Telegram
-/// 
-/// Only the part from PROTO_TAG_POS onwards is encrypted.
-/// The encryption key is derived from enc_key_iv in the nonce itself.
 pub fn encrypt_tg_nonce(nonce: &[u8; HANDSHAKE_LEN]) -> Vec<u8> {
-    // enc_key_iv is at nonce[8:56]
    let enc_key_iv = &nonce[SKIP_LEN..SKIP_LEN + KEY_LEN + IV_LEN];
-    
-    // Key for encrypting is just the first 32 bytes of enc_key_iv
    let key: [u8; 32] = enc_key_iv[..KEY_LEN].try_into().unwrap();
    let iv = u128::from_be_bytes(enc_key_iv[KEY_LEN..].try_into().unwrap());
    
    let mut encryptor = AesCtr::new(&key, iv);
-    
-    // Encrypt the entire nonce first, then take only the encrypted tail
    let encrypted_full = encryptor.encrypt(nonce);
    
-    // Result: unencrypted head + encrypted tail
    let mut result = nonce[..PROTO_TAG_POS].to_vec();
    result.extend_from_slice(&encrypted_full[PROTO_TAG_POS..]);
    
-    trace!(
-        original = %hex::encode(&nonce[PROTO_TAG_POS..]),
-        encrypted = %hex::encode(&result[PROTO_TAG_POS..]),
-        "Encrypted nonce tail"
-    );
-    
    result
 }

--- a/src/proxy/masking.rs
+++ b/src/proxy/masking.rs
@@ -1,35 +1,73 @@
 //! Masking - forward unrecognized traffic to mask host

 use std::time::Duration;
+use std::str;
 use tokio::net::TcpStream;
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::io::{AsyncRead, AsyncWrite, AsyncReadExt, AsyncWriteExt};
 use tokio::time::timeout;
 use tracing::debug;
 use crate::config::ProxyConfig;
-use crate::transport::set_linger_zero;

 const MASK_TIMEOUT: Duration = Duration::from_secs(5);
 const MASK_BUFFER_SIZE: usize = 8192;

+/// Detect client type based on initial data
+fn detect_client_type(data: &[u8]) -> &'static str {
+    // Check for HTTP request
+    if data.len() > 4 {
+        if data.starts_with(b"GET ") || data.starts_with(b"POST") ||
+           data.starts_with(b"HEAD") || data.starts_with(b"PUT ") ||
+           data.starts_with(b"DELETE") || data.starts_with(b"OPTIONS") {
+            return "HTTP";
+        }
+    }
+    
+    // Check for TLS ClientHello (0x16 = handshake, 0x03 0x01-0x03 = TLS version)
+    if data.len() > 3 && data[0] == 0x16 && data[1] == 0x03 {
+        return "TLS-scanner";
+    }
+    
+    // Check for SSH
+    if data.starts_with(b"SSH-") {
+        return "SSH";
+    }
+    
+    // Port scanner (very short data)
+    if data.len() < 10 {
+        return "port-scanner";
+    }
+    
+    "unknown"
+}
+
 /// Handle a bad client by forwarding to mask host
-pub async fn handle_bad_client(
-    mut client: TcpStream,
+pub async fn handle_bad_client<R, W>(
+    mut reader: R,
+    mut writer: W,
    initial_data: &[u8],
    config: &ProxyConfig,
-) {
-    if !config.mask {
+) 
+where 
+    R: AsyncRead + Unpin + Send + 'static,
+    W: AsyncWrite + Unpin + Send + 'static,
+{
+    if !config.censorship.mask {
        // Masking disabled, just consume data
-        consume_client_data(client).await;
+        consume_client_data(reader).await;
        return;
    }
    
-    let mask_host = config.mask_host.as_deref()
-        .unwrap_or(&config.tls_domain);
-    let mask_port = config.mask_port;
+    let client_type = detect_client_type(initial_data);
+    
+    let mask_host = config.censorship.mask_host.as_deref()
+        .unwrap_or(&config.censorship.tls_domain);
+    let mask_port = config.censorship.mask_port;
    
    debug!(
+        client_type = client_type,
        host = %mask_host,
        port = mask_port,
+        data_len = initial_data.len(),
        "Forwarding bad client to mask host"
    );
    
@@ -40,33 +78,32 @@ pub async fn handle_bad_client(
        TcpStream::connect(&mask_addr)
    ).await;
    
-    let mut mask_stream = match connect_result {
+    let mask_stream = match connect_result {
        Ok(Ok(s)) => s,
        Ok(Err(e)) => {
            debug!(error = %e, "Failed to connect to mask host");
-            consume_client_data(client).await;
+            consume_client_data(reader).await;
            return;
        }
        Err(_) => {
            debug!("Timeout connecting to mask host");
-            consume_client_data(client).await;
+            consume_client_data(reader).await;
            return;
        }
    };
    
+    let (mut mask_read, mut mask_write) = mask_stream.into_split();
+    
    // Send initial data to mask host
-    if mask_stream.write_all(initial_data).await.is_err() {
+    if mask_write.write_all(initial_data).await.is_err() {
        return;
    }
    
    // Relay traffic
-    let (mut client_read, mut client_write) = client.into_split();
-    let (mut mask_read, mut mask_write) = mask_stream.into_split();
-    
    let c2m = tokio::spawn(async move {
        let mut buf = vec![0u8; MASK_BUFFER_SIZE];
        loop {
-            match client_read.read(&mut buf).await {
+            match reader.read(&mut buf).await {
                Ok(0) | Err(_) => {
                    let _ = mask_write.shutdown().await;
                    break;
@@ -85,11 +122,11 @@ pub async fn handle_bad_client(
        loop {
            match mask_read.read(&mut buf).await {
                Ok(0) | Err(_) => {
-                    let _ = client_write.shutdown().await;
+                    let _ = writer.shutdown().await;
                    break;
                }
                Ok(n) => {
-                    if client_write.write_all(&buf[..n]).await.is_err() {
+                    if writer.write_all(&buf[..n]).await.is_err() {
                        break;
                    }
                }
@@ -105,9 +142,9 @@ pub async fn handle_bad_client(
 }

 /// Just consume all data from client without responding
-async fn consume_client_data(mut client: TcpStream) {
+async fn consume_client_data<R: AsyncRead + Unpin>(mut reader: R) {
    let mut buf = vec![0u8; MASK_BUFFER_SIZE];
-    while let Ok(n) = client.read(&mut buf).await {
+    while let Ok(n) = reader.read(&mut buf).await {
        if n == 0 {
            break;
        }
--- a/src/proxy/relay.rs
+++ b/src/proxy/relay.rs
@@ -1,13 +1,17 @@
 //! Bidirectional Relay

 use std::sync::Arc;
+use std::time::Duration;
 use tokio::io::{AsyncRead, AsyncWrite, AsyncReadExt, AsyncWriteExt};
-use tracing::{debug, trace, warn};
+use tokio::time::Instant;
+use tracing::{debug, trace, warn, info};
 use crate::error::Result;
 use crate::stats::Stats;
+use crate::stream::BufferPool;
 use std::sync::atomic::{AtomicU64, Ordering};

-const BUFFER_SIZE: usize = 65536;
+// Activity timeout for iOS compatibility (30 minutes)
+const ACTIVITY_TIMEOUT_SECS: u64 = 1800;

 /// Relay data bidirectionally between client and server
 pub async fn relay_bidirectional<CR, CW, SR, SW>(
@@ -17,6 +21,7 @@ pub async fn relay_bidirectional<CR, CW, SR, SW>(
    mut server_writer: SW,
    user: &str,
    stats: Arc<Stats>,
+    buffer_pool: Arc<BufferPool>,
 ) -> Result<()>
 where
    CR: AsyncRead + Unpin + Send + 'static,
@@ -27,7 +32,6 @@ where
    let user_c2s = user.to_string();
    let user_s2c = user.to_string();
    
-    // Используем Arc::clone вместо stats.clone()
    let stats_c2s = Arc::clone(&stats);
    let stats_s2c = Arc::clone(&stats);
    
@@ -36,15 +40,47 @@ where
    let c2s_bytes_clone = Arc::clone(&c2s_bytes);
    let s2c_bytes_clone = Arc::clone(&s2c_bytes);
    
+    let activity_timeout = Duration::from_secs(ACTIVITY_TIMEOUT_SECS);
+    
+    let pool_c2s = buffer_pool.clone();
+    let pool_s2c = buffer_pool.clone();
+    
    // Client -> Server task
    let c2s = tokio::spawn(async move {
-        let mut buf = vec![0u8; BUFFER_SIZE];
+        // Get buffer from pool
+        let mut pooled_buf = pool_c2s.get();
+        // CRITICAL FIX: BytesMut from pool has len 0. We must resize it to be usable as &mut [u8].
+        // We use the full capacity.
+        let cap = pooled_buf.capacity();
+        pooled_buf.resize(cap, 0);
+        
        let mut total_bytes = 0u64;
+        let mut prev_total_bytes = 0u64;
        let mut msg_count = 0u64;
+        let mut last_activity = Instant::now();
+        let mut last_log = Instant::now();
        
        loop {
-            match client_reader.read(&mut buf).await {
-                Ok(0) => {
+            // Read with timeout
+            let read_result = tokio::time::timeout(
+                activity_timeout,
+                client_reader.read(&mut pooled_buf)
+            ).await;
+            
+            match read_result {
+                Err(_) => {
+                    warn!(
+                        user = %user_c2s,
+                        total_bytes = total_bytes,
+                        msgs = msg_count,
+                        idle_secs = last_activity.elapsed().as_secs(),
+                        "Activity timeout (C->S) - no data received"
+                    );
+                    let _ = server_writer.shutdown().await;
+                    break;
+                }
+                
+                Ok(Ok(0)) => {
                    debug!(
                        user = %user_c2s, 
                        total_bytes = total_bytes,
@@ -54,9 +90,11 @@ where
                    let _ = server_writer.shutdown().await;
                    break;
                }
-                Ok(n) => {
+                
+                Ok(Ok(n)) => {
                    total_bytes += n as u64;
                    msg_count += 1;
+                    last_activity = Instant::now();
                    c2s_bytes_clone.store(total_bytes, Ordering::Relaxed);
                    
                    stats_c2s.add_user_octets_from(&user_c2s, n as u64);
@@ -66,11 +104,28 @@ where
                        user = %user_c2s,
                        bytes = n,
                        total = total_bytes,
-                        data_preview = %hex::encode(&buf[..n.min(32)]),
                        "C->S data"
                    );
                    
-                    if let Err(e) = server_writer.write_all(&buf[..n]).await {
+                    // Log activity every 10 seconds with correct rate
+                    let elapsed = last_log.elapsed();
+                    if elapsed > Duration::from_secs(10) {
+                        let delta = total_bytes - prev_total_bytes;
+                        let rate = delta as f64 / elapsed.as_secs_f64();
+                        
+                        debug!(
+                            user = %user_c2s,
+                            total_bytes = total_bytes,
+                            msgs = msg_count,
+                            rate_kbps = (rate / 1024.0) as u64,
+                            "C->S transfer in progress"
+                        );
+                        
+                        last_log = Instant::now();
+                        prev_total_bytes = total_bytes;
+                    }
+                    
+                    if let Err(e) = server_writer.write_all(&pooled_buf[..n]).await {
                        debug!(user = %user_c2s, error = %e, "Failed to write to server");
                        break;
                    }
@@ -79,7 +134,8 @@ where
                        break;
                    }
                }
-                Err(e) => {
+                
+                Ok(Err(e)) => {
                    debug!(user = %user_c2s, error = %e, total_bytes = total_bytes, "Client read error");
                    break;
                }
@@ -89,13 +145,38 @@ where
    
    // Server -> Client task
    let s2c = tokio::spawn(async move {
-        let mut buf = vec![0u8; BUFFER_SIZE];
+        // Get buffer from pool
+        let mut pooled_buf = pool_s2c.get();
+        // CRITICAL FIX: Resize buffer
+        let cap = pooled_buf.capacity();
+        pooled_buf.resize(cap, 0);
+
        let mut total_bytes = 0u64;
+        let mut prev_total_bytes = 0u64;
        let mut msg_count = 0u64;
+        let mut last_activity = Instant::now();
+        let mut last_log = Instant::now();
        
        loop {
-            match server_reader.read(&mut buf).await {
-                Ok(0) => {
+            let read_result = tokio::time::timeout(
+                activity_timeout,
+                server_reader.read(&mut pooled_buf)
+            ).await;
+            
+            match read_result {
+                Err(_) => {
+                    warn!(
+                        user = %user_s2c,
+                        total_bytes = total_bytes,
+                        msgs = msg_count,
+                        idle_secs = last_activity.elapsed().as_secs(),
+                        "Activity timeout (S->C) - no data received"
+                    );
+                    let _ = client_writer.shutdown().await;
+                    break;
+                }
+                
+                Ok(Ok(0)) => {
                    debug!(
                        user = %user_s2c,
                        total_bytes = total_bytes,
@@ -105,9 +186,11 @@ where
                    let _ = client_writer.shutdown().await;
                    break;
                }
-                Ok(n) => {
+                
+                Ok(Ok(n)) => {
                    total_bytes += n as u64;
                    msg_count += 1;
+                    last_activity = Instant::now();
                    s2c_bytes_clone.store(total_bytes, Ordering::Relaxed);
                    
                    stats_s2c.add_user_octets_to(&user_s2c, n as u64);
@@ -117,11 +200,27 @@ where
                        user = %user_s2c,
                        bytes = n,
                        total = total_bytes,
-                        data_preview = %hex::encode(&buf[..n.min(32)]),
                        "S->C data"
                    );
                    
-                    if let Err(e) = client_writer.write_all(&buf[..n]).await {
+                    let elapsed = last_log.elapsed();
+                    if elapsed > Duration::from_secs(10) {
+                        let delta = total_bytes - prev_total_bytes;
+                        let rate = delta as f64 / elapsed.as_secs_f64();
+                        
+                        debug!(
+                            user = %user_s2c,
+                            total_bytes = total_bytes,
+                            msgs = msg_count,
+                            rate_kbps = (rate / 1024.0) as u64,
+                            "S->C transfer in progress"
+                        );
+                        
+                        last_log = Instant::now();
+                        prev_total_bytes = total_bytes;
+                    }
+                    
+                    if let Err(e) = client_writer.write_all(&pooled_buf[..n]).await {
                        debug!(user = %user_s2c, error = %e, "Failed to write to client");
                        break;
                    }
@@ -130,7 +229,8 @@ where
                        break;
                    }
                }
-                Err(e) => {
+                
+                Ok(Err(e)) => {
                    debug!(user = %user_s2c, error = %e, total_bytes = total_bytes, "Server read error");
                    break;
                }
--- a/src/stats/mod.rs
+++ b/src/stats/mod.rs
@@ -4,9 +4,11 @@ use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::Arc;
 use std::time::Instant;
 use dashmap::DashMap;
-use parking_lot::RwLock;
+use parking_lot::{RwLock, Mutex};
 use lru::LruCache;
 use std::num::NonZeroUsize;
+use std::hash::{Hash, Hasher};
+use std::collections::hash_map::DefaultHasher;

 /// Thread-safe statistics
 #[derive(Default)]
@@ -141,37 +143,57 @@ impl Stats {
    }
 }

-// Arc<Stats> Hightech Stats :D
-
-/// Replay attack checker using LRU cache
+/// Sharded Replay attack checker using LRU cache
+/// Uses multiple independent LRU caches to reduce lock contention
 pub struct ReplayChecker {
-    handshakes: RwLock<LruCache<Vec<u8>, ()>>,
-    tls_digests: RwLock<LruCache<Vec<u8>, ()>>,
+    shards: Vec<Mutex<LruCache<Vec<u8>, ()>>>,
+    shard_mask: usize,
 }

 impl ReplayChecker {
-    pub fn new(capacity: usize) -> Self {
-        let cap = NonZeroUsize::new(capacity.max(1)).unwrap();
+    /// Create new replay checker with specified capacity per shard
+    /// Total capacity = capacity * num_shards
+    pub fn new(total_capacity: usize) -> Self {
+        // Use 64 shards for good concurrency
+        let num_shards = 64;
+        let shard_capacity = (total_capacity / num_shards).max(1);
+        let cap = NonZeroUsize::new(shard_capacity).unwrap();
+        
+        let mut shards = Vec::with_capacity(num_shards);
+        for _ in 0..num_shards {
+            shards.push(Mutex::new(LruCache::new(cap)));
+        }
+        
        Self {
-            handshakes: RwLock::new(LruCache::new(cap)),
-            tls_digests: RwLock::new(LruCache::new(cap)),
+            shards,
+            shard_mask: num_shards - 1,
        }
    }
    
+    fn get_shard(&self, key: &[u8]) -> usize {
+        let mut hasher = DefaultHasher::new();
+        key.hash(&mut hasher);
+        (hasher.finish() as usize) & self.shard_mask
+    }
+    
    pub fn check_handshake(&self, data: &[u8]) -> bool {
-        self.handshakes.read().contains(&data.to_vec())
+        let shard_idx = self.get_shard(data);
+        self.shards[shard_idx].lock().contains(&data.to_vec())
    }
    
    pub fn add_handshake(&self, data: &[u8]) {
-        self.handshakes.write().put(data.to_vec(), ());
+        let shard_idx = self.get_shard(data);
+        self.shards[shard_idx].lock().put(data.to_vec(), ());
    }
    
    pub fn check_tls_digest(&self, data: &[u8]) -> bool {
-        self.tls_digests.read().contains(&data.to_vec())
+        let shard_idx = self.get_shard(data);
+        self.shards[shard_idx].lock().contains(&data.to_vec())
    }
    
    pub fn add_tls_digest(&self, data: &[u8]) {
-        self.tls_digests.write().put(data.to_vec(), ());
+        let shard_idx = self.get_shard(data);
+        self.shards[shard_idx].lock().put(data.to_vec(), ());
    }
 }

@@ -183,7 +205,6 @@ mod tests {
    fn test_stats_shared_counters() {
        let stats = Arc::new(Stats::new());
        
-        // Симулируем использование из разных "задач"
        let stats1 = Arc::clone(&stats);
        let stats2 = Arc::clone(&stats);
        
@@ -191,33 +212,20 @@ mod tests {
        stats2.increment_connects_all();
        stats1.increment_connects_all();
        
-        // Все инкременты должны быть видны
        assert_eq!(stats.get_connects_all(), 3);
    }
    
    #[test]
-    fn test_user_stats_shared() {
-        let stats = Arc::new(Stats::new());
+    fn test_replay_checker_sharding() {
+        let checker = ReplayChecker::new(100);
+        let data1 = b"test1";
+        let data2 = b"test2";
        
-        let stats1 = Arc::clone(&stats);
-        let stats2 = Arc::clone(&stats);
+        checker.add_handshake(data1);
+        assert!(checker.check_handshake(data1));
+        assert!(!checker.check_handshake(data2));
        
-        stats1.add_user_octets_from("user1", 100);
-        stats2.add_user_octets_from("user1", 200);
-        stats1.add_user_octets_to("user1", 50);
-        
-        assert_eq!(stats.get_user_total_octets("user1"), 350);
-    }
-    
-    #[test]
-    fn test_concurrent_user_connects() {
-        let stats = Arc::new(Stats::new());
-        
-        stats.increment_user_curr_connects("user1");
-        stats.increment_user_curr_connects("user1");
-        assert_eq!(stats.get_user_curr_connects("user1"), 2);
-        
-        stats.decrement_user_curr_connects("user1");
-        assert_eq!(stats.get_user_curr_connects("user1"), 1);
+        checker.add_handshake(data2);
+        assert!(checker.check_handshake(data2));
    }
 }
--- a/src/stream/buffer_pool.rs
+++ b/src/stream/buffer_pool.rs
@@ -11,8 +11,9 @@ use std::sync::Arc;

 // ============= Configuration =============

-/// Default buffer size (64KB - good for MTProto)
-pub const DEFAULT_BUFFER_SIZE: usize = 64 * 1024;
+/// Default buffer size
+/// CHANGED: Reduced from 64KB to 16KB to match TLS record size and prevent bufferbloat.
+pub const DEFAULT_BUFFER_SIZE: usize = 16 * 1024;

 /// Default maximum number of pooled buffers
 pub const DEFAULT_MAX_BUFFERS: usize = 1024;
--- a/src/stream/crypto_stream.rs
+++ b/src/stream/crypto_stream.rs
--- a/src/stream/frame.rs
+++ b/src/stream/frame.rs
@@ -149,9 +149,9 @@ pub trait FrameCodec: Send + Sync {
 /// Create a frame codec for the given protocol tag
 pub fn create_codec(proto_tag: ProtoTag) -> Box<dyn FrameCodec> {
    match proto_tag {
-        ProtoTag::Abridged => Box::new(super::frame_codec::AbridgedCodec::new()),
-        ProtoTag::Intermediate => Box::new(super::frame_codec::IntermediateCodec::new()),
-        ProtoTag::Secure => Box::new(super::frame_codec::SecureCodec::new()),
+        ProtoTag::Abridged => Box::new(crate::stream::frame_codec::AbridgedCodec::new()),
+        ProtoTag::Intermediate => Box::new(crate::stream::frame_codec::IntermediateCodec::new()),
+        ProtoTag::Secure => Box::new(crate::stream::frame_codec::SecureCodec::new()),
    }
 }

--- a/src/stream/tls_stream.rs
+++ b/src/stream/tls_stream.rs
--- a/src/transport/mod.rs
+++ b/src/transport/mod.rs
@@ -3,7 +3,11 @@
 pub mod pool;
 pub mod proxy_protocol;
 pub mod socket;
+pub mod socks;
+pub mod upstream;

 pub use pool::ConnectionPool;
 pub use proxy_protocol::{ProxyProtocolInfo, parse_proxy_protocol};
-pub use socket::*;
+pub use socket::*;
+pub use socks::*;
+pub use upstream::UpstreamManager;
--- a/src/transport/socket.rs
+++ b/src/transport/socket.rs
@@ -1,7 +1,7 @@
 //! TCP Socket Configuration

 use std::io::Result;
-use std::net::SocketAddr;
+use std::net::{SocketAddr, IpAddr};
 use std::time::Duration;
 use tokio::net::TcpStream;
 use socket2::{Socket, TcpKeepalive, Domain, Type, Protocol};
@@ -30,20 +30,13 @@ pub fn configure_tcp_socket(
        socket.set_tcp_keepalive(&keepalive)?;
    }
    
-    // Set buffer sizes
-    set_buffer_sizes(&socket, 65536, 65536)?;
+    // CHANGED: Removed manual buffer size setting (was 256KB).
+    // Allowing the OS kernel to handle TCP window scaling (Autotuning) is critical
+    // for mobile clients to avoid bufferbloat and stalled connections during uploads.
    
    Ok(())
 }

-/// Set socket buffer sizes
-fn set_buffer_sizes(socket: &socket2::SockRef, recv: usize, send: usize) -> Result<()> {
-    // These may fail on some systems, so we ignore errors
-    let _ = socket.set_recv_buffer_size(recv);
-    let _ = socket.set_send_buffer_size(send);
-    Ok(())
-}
-
 /// Configure socket for accepting client connections
 pub fn configure_client_socket(
    stream: &TcpStream,
@@ -65,6 +58,8 @@ pub fn configure_client_socket(
    socket.set_tcp_keepalive(&keepalive)?;
    
    // Set TCP user timeout (Linux only)
+    // NOTE: iOS does not support TCP_USER_TIMEOUT - application-level timeout 
+    // is implemented in relay_bidirectional instead
    #[cfg(target_os = "linux")]
    {
        use std::os::unix::io::AsRawFd;
@@ -93,6 +88,11 @@ pub fn set_linger_zero(stream: &TcpStream) -> Result<()> {

 /// Create a new TCP socket for outgoing connections
 pub fn create_outgoing_socket(addr: SocketAddr) -> Result<Socket> {
+    create_outgoing_socket_bound(addr, None)
+}
+
+/// Create a new TCP socket for outgoing connections, optionally bound to a specific interface
+pub fn create_outgoing_socket_bound(addr: SocketAddr, bind_addr: Option<IpAddr>) -> Result<Socket> {
    let domain = if addr.is_ipv4() {
        Domain::IPV4
    } else {
@@ -106,10 +106,17 @@ pub fn create_outgoing_socket(addr: SocketAddr) -> Result<Socket> {
    
    // Disable Nagle
    socket.set_nodelay(true)?;
+
+    if let Some(bind_ip) = bind_addr {
+        let bind_sock_addr = SocketAddr::new(bind_ip, 0);
+        socket.bind(&bind_sock_addr.into())?;
+        debug!("Bound outgoing socket to {}", bind_ip);
+    }
    
    Ok(socket)
 }

+
 /// Get local address of a socket
 pub fn get_local_addr(stream: &TcpStream) -> Option<SocketAddr> {
    stream.local_addr().ok()
--- a/src/transport/socks.rs
+++ b/src/transport/socks.rs
@@ -0,0 +1,145 @@
+//! SOCKS4/5 Client Implementation
+
+use std::net::{IpAddr, SocketAddr};
+use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
+use tokio::net::TcpStream;
+use crate::error::{ProxyError, Result};
+
+pub async fn connect_socks4(
+    stream: &mut TcpStream,
+    target: SocketAddr,
+    user_id: Option<&str>,
+) -> Result<()> {
+    let ip = match target.ip() {
+        IpAddr::V4(ip) => ip,
+        IpAddr::V6(_) => return Err(ProxyError::Proxy("SOCKS4 does not support IPv6".to_string())),
+    };
+    
+    let port = target.port();
+    let user = user_id.unwrap_or("").as_bytes();
+    
+    // VN (4) | CD (1) | DSTPORT (2) | DSTIP (4) | USERID (variable) | NULL (1)
+    let mut buf = Vec::with_capacity(9 + user.len());
+    buf.push(4); // VN
+    buf.push(1); // CD (CONNECT)
+    buf.extend_from_slice(&port.to_be_bytes());
+    buf.extend_from_slice(&ip.octets());
+    buf.extend_from_slice(user);
+    buf.push(0); // NULL
+    
+    stream.write_all(&buf).await.map_err(|e| ProxyError::Io(e))?;
+    
+    // Response: VN (1) | CD (1) | DSTPORT (2) | DSTIP (4)
+    let mut resp = [0u8; 8];
+    stream.read_exact(&mut resp).await.map_err(|e| ProxyError::Io(e))?;
+    
+    if resp[1] != 90 {
+        return Err(ProxyError::Proxy(format!("SOCKS4 request rejected: code {}", resp[1])));
+    }
+    
+    Ok(())
+}
+
+pub async fn connect_socks5(
+    stream: &mut TcpStream,
+    target: SocketAddr,
+    username: Option<&str>,
+    password: Option<&str>,
+) -> Result<()> {
+    // 1. Auth negotiation
+    // VER (1) | NMETHODS (1) | METHODS (variable)
+    let mut methods = vec![0u8]; // No auth
+    if username.is_some() {
+        methods.push(2u8); // Username/Password
+    }
+    
+    let mut buf = vec![5u8, methods.len() as u8];
+    buf.extend_from_slice(&methods);
+    
+    stream.write_all(&buf).await.map_err(|e| ProxyError::Io(e))?;
+    
+    let mut resp = [0u8; 2];
+    stream.read_exact(&mut resp).await.map_err(|e| ProxyError::Io(e))?;
+    
+    if resp[0] != 5 {
+        return Err(ProxyError::Proxy("Invalid SOCKS5 version".to_string()));
+    }
+    
+    match resp[1] {
+        0 => {}, // No auth
+        2 => {
+            // Username/Password auth
+            if let (Some(u), Some(p)) = (username, password) {
+                let u_bytes = u.as_bytes();
+                let p_bytes = p.as_bytes();
+                
+                let mut auth_buf = Vec::with_capacity(3 + u_bytes.len() + p_bytes.len());
+                auth_buf.push(1); // VER
+                auth_buf.push(u_bytes.len() as u8);
+                auth_buf.extend_from_slice(u_bytes);
+                auth_buf.push(p_bytes.len() as u8);
+                auth_buf.extend_from_slice(p_bytes);
+                
+                stream.write_all(&auth_buf).await.map_err(|e| ProxyError::Io(e))?;
+                
+                let mut auth_resp = [0u8; 2];
+                stream.read_exact(&mut auth_resp).await.map_err(|e| ProxyError::Io(e))?;
+                
+                if auth_resp[1] != 0 {
+                    return Err(ProxyError::Proxy("SOCKS5 authentication failed".to_string()));
+                }
+            } else {
+                return Err(ProxyError::Proxy("SOCKS5 server requires authentication".to_string()));
+            }
+        },
+        _ => return Err(ProxyError::Proxy("Unsupported SOCKS5 auth method".to_string())),
+    }
+    
+    // 2. Connection request
+    // VER (1) | CMD (1) | RSV (1) | ATYP (1) | DST.ADDR (variable) | DST.PORT (2)
+    let mut req = vec![5u8, 1u8, 0u8]; // CONNECT
+    
+    match target {
+        SocketAddr::V4(v4) => {
+            req.push(1u8); // IPv4
+            req.extend_from_slice(&v4.ip().octets());
+        },
+        SocketAddr::V6(v6) => {
+            req.push(4u8); // IPv6
+            req.extend_from_slice(&v6.ip().octets());
+        },
+    }
+    
+    req.extend_from_slice(&target.port().to_be_bytes());
+    
+    stream.write_all(&req).await.map_err(|e| ProxyError::Io(e))?;
+    
+    // Response
+    let mut head = [0u8; 4];
+    stream.read_exact(&mut head).await.map_err(|e| ProxyError::Io(e))?;
+    
+    if head[1] != 0 {
+        return Err(ProxyError::Proxy(format!("SOCKS5 request failed: code {}", head[1])));
+    }
+    
+    // Skip address part of response
+    match head[3] {
+        1 => { // IPv4
+            let mut addr = [0u8; 4 + 2];
+            stream.read_exact(&mut addr).await.map_err(|e| ProxyError::Io(e))?;
+        },
+        3 => { // Domain
+            let mut len = [0u8; 1];
+            stream.read_exact(&mut len).await.map_err(|e| ProxyError::Io(e))?;
+            let mut addr = vec![0u8; len[0] as usize + 2];
+            stream.read_exact(&mut addr).await.map_err(|e| ProxyError::Io(e))?;
+        },
+        4 => { // IPv6
+            let mut addr = [0u8; 16 + 2];
+            stream.read_exact(&mut addr).await.map_err(|e| ProxyError::Io(e))?;
+        },
+        _ => return Err(ProxyError::Proxy("Invalid address type in SOCKS5 response".to_string())),
+    }
+    
+    Ok(())
+}
--- a/src/transport/upstream.rs
+++ b/src/transport/upstream.rs
@@ -0,0 +1,259 @@
+//! Upstream Management
+
+use std::net::{SocketAddr, IpAddr};
+use std::sync::Arc;
+use std::time::Duration;
+use tokio::net::TcpStream;
+use tokio::sync::RwLock;
+use rand::Rng;
+use tracing::{debug, warn, error, info};
+
+use crate::config::{UpstreamConfig, UpstreamType};
+use crate::error::{Result, ProxyError};
+use crate::transport::socket::create_outgoing_socket_bound;
+use crate::transport::socks::{connect_socks4, connect_socks5};
+
+#[derive(Debug)]
+struct UpstreamState {
+    config: UpstreamConfig,
+    healthy: bool,
+    fails: u32,
+    last_check: std::time::Instant,
+}
+
+#[derive(Clone)]
+pub struct UpstreamManager {
+    upstreams: Arc<RwLock<Vec<UpstreamState>>>,
+}
+
+impl UpstreamManager {
+    pub fn new(configs: Vec<UpstreamConfig>) -> Self {
+        let states = configs.into_iter()
+            .filter(|c| c.enabled)
+            .map(|c| UpstreamState {
+                config: c,
+                healthy: true, // Optimistic start
+                fails: 0,
+                last_check: std::time::Instant::now(),
+            })
+            .collect();
+            
+        Self {
+            upstreams: Arc::new(RwLock::new(states)),
+        }
+    }
+    
+    /// Select an upstream using Weighted Round Robin (simplified)
+    async fn select_upstream(&self) -> Option<usize> {
+        let upstreams = self.upstreams.read().await;
+        if upstreams.is_empty() {
+            return None;
+        }
+
+        let healthy_indices: Vec<usize> = upstreams.iter()
+            .enumerate()
+            .filter(|(_, u)| u.healthy)
+            .map(|(i, _)| i)
+            .collect();
+            
+        if healthy_indices.is_empty() {
+            // If all unhealthy, try any random one
+            return Some(rand::thread_rng().gen_range(0..upstreams.len()));
+        }
+        
+        // Weighted selection
+        let total_weight: u32 = healthy_indices.iter()
+            .map(|&i| upstreams[i].config.weight as u32)
+            .sum();
+            
+        if total_weight == 0 {
+            return Some(healthy_indices[rand::thread_rng().gen_range(0..healthy_indices.len())]);
+        }
+        
+        let mut choice = rand::thread_rng().gen_range(0..total_weight);
+        
+        for &idx in &healthy_indices {
+            let weight = upstreams[idx].config.weight as u32;
+            if choice < weight {
+                return Some(idx);
+            }
+            choice -= weight;
+        }
+        
+        Some(healthy_indices[0])
+    }
+    
+    pub async fn connect(&self, target: SocketAddr) -> Result<TcpStream> {
+        let idx = self.select_upstream().await
+            .ok_or_else(|| ProxyError::Config("No upstreams available".to_string()))?;
+            
+        let upstream = {
+            let guard = self.upstreams.read().await;
+            guard[idx].config.clone()
+        };
+        
+        match self.connect_via_upstream(&upstream, target).await {
+            Ok(stream) => {
+                // Mark success
+                let mut guard = self.upstreams.write().await;
+                if let Some(u) = guard.get_mut(idx) {
+                    if !u.healthy {
+                        debug!("Upstream recovered: {:?}", u.config);
+                    }
+                    u.healthy = true;
+                    u.fails = 0;
+                }
+                Ok(stream)
+            },
+            Err(e) => {
+                // Mark failure
+                let mut guard = self.upstreams.write().await;
+                if let Some(u) = guard.get_mut(idx) {
+                    u.fails += 1;
+                    warn!("Failed to connect via upstream {:?}: {}. Fails: {}", u.config, e, u.fails);
+                    if u.fails > 3 {
+                        u.healthy = false;
+                        warn!("Upstream disabled due to failures: {:?}", u.config);
+                    }
+                }
+                Err(e)
+            }
+        }
+    }
+    
+    async fn connect_via_upstream(&self, config: &UpstreamConfig, target: SocketAddr) -> Result<TcpStream> {
+        match &config.upstream_type {
+            UpstreamType::Direct { interface } => {
+                let bind_ip = interface.as_ref()
+                    .and_then(|s| s.parse::<IpAddr>().ok());
+                
+                let socket = create_outgoing_socket_bound(target, bind_ip)?;
+                
+                // Non-blocking connect logic
+                socket.set_nonblocking(true)?;
+                match socket.connect(&target.into()) {
+                    Ok(()) => {},
+                    Err(err) if err.raw_os_error() == Some(115) || err.kind() == std::io::ErrorKind::WouldBlock => {},
+                    Err(err) => return Err(ProxyError::Io(err)),
+                }
+                
+                let std_stream: std::net::TcpStream = socket.into();
+                let stream = TcpStream::from_std(std_stream)?;
+                
+                // Wait for connection to complete
+                stream.writable().await?;
+                if let Some(e) = stream.take_error()? {
+                    return Err(ProxyError::Io(e));
+                }
+                
+                Ok(stream)
+            },
+            UpstreamType::Socks4 { address, interface, user_id } => {
+                info!("Connecting to target {} via SOCKS4 proxy {}", target, address);
+                
+                let proxy_addr: SocketAddr = address.parse()
+                    .map_err(|_| ProxyError::Config("Invalid SOCKS4 address".to_string()))?;
+                    
+                let bind_ip = interface.as_ref()
+                    .and_then(|s| s.parse::<IpAddr>().ok());
+                
+                let socket = create_outgoing_socket_bound(proxy_addr, bind_ip)?;
+                
+                // Non-blocking connect logic
+                socket.set_nonblocking(true)?;
+                match socket.connect(&proxy_addr.into()) {
+                    Ok(()) => {},
+                    Err(err) if err.raw_os_error() == Some(115) || err.kind() == std::io::ErrorKind::WouldBlock => {},
+                    Err(err) => return Err(ProxyError::Io(err)),
+                }
+                
+                let std_stream: std::net::TcpStream = socket.into();
+                let mut stream = TcpStream::from_std(std_stream)?;
+                
+                // Wait for connection to complete
+                stream.writable().await?;
+                if let Some(e) = stream.take_error()? {
+                    return Err(ProxyError::Io(e));
+                }
+                
+                connect_socks4(&mut stream, target, user_id.as_deref()).await?;
+                Ok(stream)
+            },
+            UpstreamType::Socks5 { address, interface, username, password } => {
+                info!("Connecting to target {} via SOCKS5 proxy {}", target, address);
+                
+                let proxy_addr: SocketAddr = address.parse()
+                    .map_err(|_| ProxyError::Config("Invalid SOCKS5 address".to_string()))?;
+                    
+                let bind_ip = interface.as_ref()
+                    .and_then(|s| s.parse::<IpAddr>().ok());
+                
+                let socket = create_outgoing_socket_bound(proxy_addr, bind_ip)?;
+                
+                // Non-blocking connect logic
+                socket.set_nonblocking(true)?;
+                match socket.connect(&proxy_addr.into()) {
+                    Ok(()) => {},
+                    Err(err) if err.raw_os_error() == Some(115) || err.kind() == std::io::ErrorKind::WouldBlock => {},
+                    Err(err) => return Err(ProxyError::Io(err)),
+                }
+                
+                let std_stream: std::net::TcpStream = socket.into();
+                let mut stream = TcpStream::from_std(std_stream)?;
+                
+                // Wait for connection to complete
+                stream.writable().await?;
+                if let Some(e) = stream.take_error()? {
+                    return Err(ProxyError::Io(e));
+                }
+                
+                connect_socks5(&mut stream, target, username.as_deref(), password.as_deref()).await?;
+                Ok(stream)
+            },
+        }
+    }
+    
+    /// Background task to check health
+    pub async fn run_health_checks(&self) {
+        // Simple TCP connect check to a known stable DC (e.g. 149.154.167.50:443 - DC2)
+        let check_target: SocketAddr = "149.154.167.50:443".parse().unwrap();
+        
+        loop {
+            tokio::time::sleep(Duration::from_secs(60)).await;
+            
+            let count = self.upstreams.read().await.len();
+            for i in 0..count {
+                let config = {
+                    let guard = self.upstreams.read().await;
+                    guard[i].config.clone()
+                };
+                
+                let result = tokio::time::timeout(
+                    Duration::from_secs(10),
+                    self.connect_via_upstream(&config, check_target)
+                ).await;
+                
+                let mut guard = self.upstreams.write().await;
+                let u = &mut guard[i];
+                
+                match result {
+                    Ok(Ok(_stream)) => {
+                        if !u.healthy {
+                            debug!("Upstream recovered: {:?}", u.config);
+                        }
+                        u.healthy = true;
+                        u.fails = 0;
+                    }
+                    Ok(Err(e)) => {
+                        debug!("Health check failed for {:?}: {}", u.config, e);
+                        // Don't mark unhealthy immediately in background check
+                    }
+                    Err(_) => {
+                        debug!("Health check timeout for {:?}", u.config);
+                    }
+                }
+                u.last_check = std::time::Instant::now();
+            }
+        }
+    }
+}
--- a/src/util/ip.rs
+++ b/src/util/ip.rs
@@ -1,6 +1,6 @@
 //! IP Addr Detect

-use std::net::IpAddr;
+use std::net::{IpAddr, SocketAddr, UdpSocket};
 use std::time::Duration;
 use tracing::{debug, warn};

@@ -40,28 +40,74 @@ const IPV6_URLS: &[&str] = &[
    "http://api6.ipify.org/",
 ];

+/// Detect local IP address by connecting to a public DNS
+/// This does not actually send any packets
+fn get_local_ip(target: &str) -> Option<IpAddr> {
+    let socket = UdpSocket::bind("0.0.0.0:0").ok()?;
+    socket.connect(target).ok()?;
+    socket.local_addr().ok().map(|addr| addr.ip())
+}
+
+fn get_local_ipv6(target: &str) -> Option<IpAddr> {
+    let socket = UdpSocket::bind("[::]:0").ok()?;
+    socket.connect(target).ok()?;
+    socket.local_addr().ok().map(|addr| addr.ip())
+}
+
 /// Detect public IP addresses
 pub async fn detect_ip() -> IpInfo {
    let mut info = IpInfo::default();
+
+    // Try to get local interface IP first (default gateway interface)
+    // We connect to Google DNS to find out which interface is used for routing
+    if let Some(ip) = get_local_ip("8.8.8.8:80") {
+        if ip.is_ipv4() && !ip.is_loopback() {
+             info.ipv4 = Some(ip);
+             debug!(ip = %ip, "Detected local IPv4 address via routing");
+        }
+    }
+
+    if let Some(ip) = get_local_ipv6("[2001:4860:4860::8888]:80") {
+        if ip.is_ipv6() && !ip.is_loopback() {
+            info.ipv6 = Some(ip);
+            debug!(ip = %ip, "Detected local IPv6 address via routing");
+        }
+    }
    
-    // Detect IPv4
-    for url in IPV4_URLS {
-        if let Some(ip) = fetch_ip(url).await {
-            if ip.is_ipv4() {
-                info.ipv4 = Some(ip);
-                debug!(ip = %ip, "Detected IPv4 address");
-                break;
+    // If local detection failed or returned private IP (and we want public), 
+    // or just as a fallback/verification, we might want to check external services.
+    // However, the requirement is: "if IP for listening is not set... it should be IP from interface... 
+    // if impossible - request external resources".
+    
+    // So if we found a local IP, we might be good. But often servers are behind NAT.
+    // If the local IP is private, we probably want the public IP for the tg:// link.
+    // Let's check if the detected IPs are private.
+    
+    let need_external_v4 = info.ipv4.map_or(true, |ip| is_private_ip(ip));
+    let need_external_v6 = info.ipv6.map_or(true, |ip| is_private_ip(ip));
+
+    if need_external_v4 {
+        debug!("Local IPv4 is private or missing, checking external services...");
+        for url in IPV4_URLS {
+            if let Some(ip) = fetch_ip(url).await {
+                if ip.is_ipv4() {
+                    info.ipv4 = Some(ip);
+                    debug!(ip = %ip, "Detected public IPv4 address");
+                    break;
+                }
            }
        }
    }
    
-    // Detect IPv6
-    for url in IPV6_URLS {
-        if let Some(ip) = fetch_ip(url).await {
-            if ip.is_ipv6() {
-                info.ipv6 = Some(ip);
-                debug!(ip = %ip, "Detected IPv6 address");
-                break;
+    if need_external_v6 {
+        debug!("Local IPv6 is private or missing, checking external services...");
+        for url in IPV6_URLS {
+            if let Some(ip) = fetch_ip(url).await {
+                if ip.is_ipv6() {
+                    info.ipv6 = Some(ip);
+                    debug!(ip = %ip, "Detected public IPv6 address");
+                    break;
+                }
            }
        }
    }
@@ -73,6 +119,17 @@ pub async fn detect_ip() -> IpInfo {
    info
 }

+fn is_private_ip(ip: IpAddr) -> bool {
+    match ip {
+        IpAddr::V4(ipv4) => {
+            ipv4.is_private() || ipv4.is_loopback() || ipv4.is_link_local()
+        }
+        IpAddr::V6(ipv6) => {
+            ipv6.is_loopback() || (ipv6.segments()[0] & 0xfe00) == 0xfc00 // Unique Local
+        }
+    }
+}
+
 /// Fetch IP from URL
 async fn fetch_ip(url: &str) -> Option<IpAddr> {
    let client = reqwest::Client::builder()
Author	SHA1	Message	Date
Alexey	94750a2749	Update README.md	2026-01-22 03:33:13 +03:00
Alexey	cf4b240913	Update README.md	2026-01-22 03:26:34 +03:00
Alexey	1424fbb1d5	Update README.md	2026-01-22 03:19:50 +03:00
Alexey	97f4c0d3b7	Update README.md	2026-01-22 03:17:37 +03:00
Alexey	806536fab6	Update README.md	2026-01-22 03:14:39 +03:00
Alexey	df8cfe462b	Update README.md	2026-01-22 03:13:08 +03:00
Alexey	a5f1521d71	Update README.md	2026-01-22 03:07:38 +03:00
Alexey	8de7b7adc0	Update README.md	2026-01-22 03:03:19 +03:00
Alexey	cde1b15ef0	Update config.toml	2026-01-22 02:45:30 +03:00
Alexey	46e4c06ba6	Update README.md	2026-01-22 01:59:18 +03:00
Alexey	b7673daf0f	Update README.md	2026-01-22 01:57:44 +03:00
Alexey	397ed8f193	Update README.md	2026-01-22 01:56:42 +03:00
Alexey	d90b2fd300	Update README.md	2026-01-22 01:55:31 +03:00
Alexey	d62136d9fa	Update README.md	2026-01-22 01:53:05 +03:00
Alexey	0f8933b908	Update README.md	2026-01-22 01:48:37 +03:00
Alexey	0ec87974d1	Update README.md	2026-01-22 01:47:43 +03:00
Alexey	c8446c32d1	Update README.md	2026-01-22 01:46:28 +03:00
Alexey	f79a2eb097	Update README.md	2026-01-22 01:26:36 +03:00
Alexey	dea1a3b5de	Update README.md	2026-01-22 01:16:46 +03:00
Alexey	97ce235ae4	Update README.md	2026-01-22 01:16:35 +03:00
Alexey	d04757eb9c	Update README.md	2026-01-20 11:13:33 +03:00
Alexey	2d7901a978	Update README.md	2026-01-20 11:09:24 +03:00
Alexey	3881ba9bed	1.1.1.0	2026-01-20 02:09:56 +03:00
Alexey	5ac9089ccb	Update README.md	2026-01-20 01:39:59 +03:00
Alexey	eb8b991818	Update README.md	2026-01-20 01:32:39 +03:00
Alexey	2ce8fbb2cc	1.1.0.0	2026-01-20 01:20:02 +03:00
Alexey	038f0cd5d1	Update README.md	2026-01-19 23:52:31 +03:00
Alexey	efea3f981d	Update README.md	2026-01-19 23:51:43 +03:00
Alexey	42ce9dd671	Update README.md	2026-01-12 22:11:21 +03:00
Alexey	4fa6867056	Merge pull request #7 from telemt/1.0.3.0 1.0.3.0	2026-01-12 00:49:31 +03:00
Alexey	54ea6efdd0	Global rewrite of AES-CTR + Upstream Pending + to_accept selection	2026-01-12 00:46:51 +03:00
brekotis	27ac32a901	Fixes in TLS for iOS	2026-01-12 00:32:42 +03:00
Alexey	829f53c123	Fixes for iOS	2026-01-11 22:59:51 +03:00
Alexey	43eae6127d	Update README.md	2026-01-10 22:17:03 +03:00
Alexey	a03212c8cc	Update README.md	2026-01-10 22:15:02 +03:00
Alexey	2613969a7c	Update rust.yml	2026-01-09 23:15:52 +03:00
Alexey	be1b2db867	Update README.md	2026-01-08 02:10:34 +03:00
Alexey	8fbee8701b	Update README.md	2026-01-08 02:10:02 +03:00
Alexey	952d160870	Update README.md	2026-01-08 02:03:30 +03:00
Alexey	91ae6becde	Update README.md	2026-01-08 02:01:50 +03:00
Alexey	e1f576e4fe	Update README.md	2026-01-08 02:00:27 +03:00
Alexey	a7556cabdc	Update README.md	2026-01-07 19:12:16 +03:00
Alexey	b2e8d16bb1	Update README.md	2026-01-07 19:10:04 +03:00
Alexey	d95e762812	Update README.md	2026-01-07 19:07:08 +03:00
Alexey	384f927fc3	Update README.md	2026-01-07 19:06:28 +03:00
Alexey	1b7c09ae18	Update README.md	2026-01-07 18:54:44 +03:00
Alexey	85cb4092d5	1.0.2.0	2026-01-07 18:16:01 +03:00
Alexey	5016160ac3	1.0.1.2	2026-01-07 17:42:30 +03:00
Alexey	4f007f3128	1.0.1.1 Drafting Upstreams and SOCKS	2026-01-07 17:22:10 +03:00
Alexey	7746a1177c	Update README.md	2026-01-06 15:10:14 +03:00
Alexey	2bb2a2983f	Update README.md	2026-01-06 14:57:52 +03:00