AdGuard v7.13 for Windows: Encrypted ClientHello support and more

It's been a long time since we've had a blog post about AdGuard for Windows. It's finally time for a change, and for a good reason: we've released a new version, and it boasts significant improvements that are worth telling you about.

Experimental Encrypted ClientHello support

With this release, AdGuard for Windows gained 17(!) new low-level settings. Now, however, we will focus on only one of them: Use Encrypted ClientHello. Enabling this experimental feature will make your connection even more secure.

ClientHello is the very first packet of an encrypted connection which contains the name of the server you are communicating with. This packet remains unencrypted, allowing the ISP to track which website you are accessing. Encrypted ClientHello (ECH) is a new technology that should solve this problem and encrypt the very last unencrypted bit of information.

AdGuard's Encrypted ClientHello support implementation

For the Use Encrypted ClientHello feature to work, Block ECH must be disabled and DNS Protection — enabled. And this is the main reason why we've enabled DNS Protection by default for all users, new and old ones. The thing is that ECH relies on data obtained through DNS, so in order for AdGuard to receive this data and enable ECH globally for users, DNS filtering is necessary.

Upon running AdGuard for Windows after a clean installation, DNS protection will be turned on with the system DNS server and AdGuard DNS filter enabled. The same will happen if you update the app with the DNS module disabled. However, if you update the app with the DNS module already enabled and configured, no changes will occur.

Note that Encrypted ClientHello technology can only work when supported on both client and server sides. Today, ECH support is implemented in a limited number of apps. Chrome and Firefox, for example, are in the process of adding it. Here we have no choice but to wait. But thanks to AdGuard, ECH support will automatically work in all apps and browsers on your device. As the Use Encrypted ClientHello feature is experimental, it may also lower your browsing speed a bit. But, we're currently working on solving this issue.

How to make sure ECH is working

1. Enable the Use Encrypted ClientHello feature
2. Go to https://crypto.cloudflare.com/cdn-cgi/trace/ and see if it says sni=encrypted

3. Or go to https://defo.ie/ech-check.php and check if it says SSL_ECH_STATUS: success

New Advanced settings

We've already mentioned that the latest AdGuard for Windows update features a bunch of new low-level settings. Not all of them will be of use to you, but check them out so that you know what else AdGuard can do to make your Internet experience even safer.

All new advanced features can be divided into six groups:

• Anti DPI options allow to modify packets at a low level during filtering to prevent tracking via deep packet inspection

  • Adjust size of fragmentation of initial TLS packet
  • Add an extra space to the plain HTTP request
  • Plain HTTP request fragment size

• Keepalive settings allow to configure settings to work with keepalive connections

  • Enable TCP keepalive
  • TCP keepalive interval
  • TCP keepalive timeout

• Filtering exclusion settings allow to exclude both Wi-Fi networks and particular subnets (specified in the CIDR notation) from DNS filtering

  • Exclude specified IP ranges from filtering
  • IP ranges excluded from filtering
  • Exclude specified Wi-Fi network names (SSID) from DNS filtering

• DNS-related options allow to fine-tune DNS settings

  • Use fallback DNS upstreams
  • Use HTTP/3 for DNS-over-HTTPS
  • Query DNS upstreams in parallel
  • Always respond to failed DNS queries

• Certificate security options allow to check certificates of websites and web services

  • Check websites' certificate transparency
  • Enable SSL/TLS certificate revocation checks

• Enable filtering at system start-up. Now by default, AdGuard for Windows does not filter traffic after OS startup. If you want filtering to be performed even if AdGuard is not launched, you should enable this option.

For details on all Advanced settings, new and old ones, check out our Knowledge base.

In addition to the changes described above, we have done a lot of work: updated CoreLibs, DnsLibs, Scriplets, WFP and TDI drivers, fixed different issues and improved various features. The full changelog of AdGuard v7.13 for Windows is available on GitHub.