diff --git a/net/pichi/Makefile b/net/pichi/Makefile
index 87c3db07330f..1082644264d7 100644
--- a/net/pichi/Makefile
+++ b/net/pichi/Makefile
@@ -1,72 +1,89 @@
 PORTNAME=	pichi
-DISTVERSION=	1.4.0
-PORTREVISION=	3
+DISTVERSION=	1.5.0
 CATEGORIES=	net
 
 MAINTAINER=	pichi@elude.in
 COMMENT=	Flexible rule-based proxy
 WWW=		https://github.com/pichi-router/pichi
 
 LICENSE=	BSD3CLAUSE
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
-BROKEN=		fails to build
-
 BUILD_DEPENDS=	rapidjson>=1.1.0:devel/rapidjson
 
 USES=		cmake compiler:c++17-lang cpe
 CPE_VENDOR=	${PORTNAME}_project
 
 USE_GITHUB=	yes
 GH_ACCOUNT=	pichi-router
 
 USE_RC_SUBR=	pichi
 PLIST_SUB=	DISTVERSION=${DISTVERSION}
 
 CMAKE_BUILD_TYPE=	MinSizeRel
 CMAKE_ARGS=		-DVERSION=${DISTVERSION}
 CMAKE_ON=		BUILD_SERVER BUILD_TEST
+CMAKE_OFF=	ENABLE_CONAN TRANSPARENT_IPTABLES
 INSTALL_TARGET=		install/strip
 TEST_TARGET=		test
 
-OPTIONS_DEFINE=		DEVEL STATIC
+OPTIONS_DEFINE=		DEVEL STATIC TLS_FINGERPRINT TRANSPARENT
 OPTIONS_SUB=		yes
 
 STATIC_DESC=		Static linking
-STATIC_CMAKE_BOOL=	STATIC_LINK
+STATIC_CMAKE_BOOL_OFF=	BUILD_SHARED_LIBS
 STATIC_BUILD_DEPENDS=	boost-libs>=1.67.0:devel/boost-libs \
 			libmaxminddb>=1.3.0:net/libmaxminddb \
 			libsodium>=1.0.12:security/libsodium \
 			mbedtls>=2.7.0:security/mbedtls
 STATIC_LIB_DEPENDS_OFF=	libboost_context.so:devel/boost-libs \
 			libboost_filesystem.so:devel/boost-libs \
 			libboost_program_options.so:devel/boost-libs \
 			libboost_system.so:devel/boost-libs \
 			libmaxminddb.so:net/libmaxminddb \
 			libmbedcrypto.so:security/mbedtls \
 			libmbedtls.so:security/mbedtls \
 			libmbedx509.so:security/mbedtls \
 			libsodium.so:security/libsodium
 STATIC_USE_OFF=		LDCONFIG=yes
 
 DEVEL_DESC=		Install development files
 DEVEL_CMAKE_BOOL=	INSTALL_DEVEL
 
+TLS_FINGERPRINT_DESC=		Simulate TLS fingerprint of Google Chrome
+TLS_FINGERPRINT_CMAKE_BOOL=	TLS_FINGERPRINT
+
+TRANSPARENT_DESC=		Enable transparent ingress feature
+TRANSPARENT_CMAKE_BOOL=		TRANSPARENT_PF
+
 .include <bsd.port.options.mk>
 
+.if ${PORT_OPTIONS:MTLS_FINGERPRINT}
+.if ${PORT_OPTIONS:MSTATIC}
+BUILD_DEPENDS+=	brotli>=1.0.0:archivers/brotli \
+			boringssl>=0.0.0.0.2022.12.22.01:security/boringssl
+.else
+LIB_DEPENDS+=	libbrotlicommon.so:archivers/brotli \
+			libbrotlidec.so:security/boringssl \
+			libbrotlienc.so:security/boringssl \
+			libssl.so:security/boringssl \
+			libcrypto.so:security/boringssl
+.endif
+.else
 .if ${PORT_OPTIONS:MSTATIC}
 USES+=		ssl:build
 .else
 USES+=		ssl
 .endif
+.endif
 
 post-install:
 	${MKDIR} ${STAGEDIR}${ETCDIR}
 	${INSTALL_DATA} ${WRKSRC}/test/geo.mmdb ${STAGEDIR}${ETCDIR}/geo.mmdb
 	${INSTALL_DATA} ${WRKSRC}/server/pichi.json.default ${STAGEDIR}${ETCDIR}/pichi.json.sample
 
 post-install-DEVEL-on:
 	${MKDIR} ${STAGEDIR}${PREFIX}/include
 	${INSTALL_DATA} ${WRKSRC}/include/pichi.h ${STAGEDIR}${PREFIX}/include/pichi.h
 
 .include <bsd.port.mk>
diff --git a/net/pichi/distinfo b/net/pichi/distinfo
index 7d56493b4644..aaa112e1acaa 100644
--- a/net/pichi/distinfo
+++ b/net/pichi/distinfo
@@ -1,3 +1,3 @@
 TIMESTAMP = 1627466281
-SHA256 (pichi-router-pichi-1.4.0_GH0.tar.gz) = 9b6cfadb57f80af516fb8a7d6d1199ad1c03f1c5ba0378a223c0733b12b27482
-SIZE (pichi-router-pichi-1.4.0_GH0.tar.gz) = 2081661
+SHA256 (pichi-router-pichi-1.5.0_GH0.tar.gz) = b6b69ec74572dcf31484ecad850d809b5f38e7d3978a952951344aff496d3398
+SIZE (pichi-router-pichi-1.5.0_GH0.tar.gz) = 2124092
diff --git a/net/pichi/files/patch-include_pichi_common_config.hpp.in b/net/pichi/files/patch-include_pichi_common_config.hpp.in
deleted file mode 100644
index fcc42ad57a0e..000000000000
--- a/net/pichi/files/patch-include_pichi_common_config.hpp.in
+++ /dev/null
@@ -1,79 +0,0 @@
---- include/pichi/common/config.hpp.in.orig
-+++ include/pichi/common/config.hpp.in
-@@ -15,48 +15,39 @@
- #cmakedefine HAS_SETSID
- #cmakedefine HAS_CLOSE
- 
--#cmakedefine NO_IGNORED_ATTRIBUTES_FOR_SODIUM
--#cmakedefine DEPRECATED_RFC2818_CLASS
-+#ifdef __GNUC__
- 
--#cmakedefine DISABLE_SHORTEN_64_TO_32_WARNING
--#if defined(DISABLE_SHORTEN_64_TO_32_WARNING) && defined(__clang__)
--#pragma clang diagnostic push
--#pragma clang diagnostic ignored "-Wshorten-64-to-32"
--#include <boost/asio/basic_socket.hpp>
--#include <boost/asio/ssl/impl/context.ipp>
--#include <boost/beast/zlib/detail/deflate_stream.ipp>
--#pragma clang diagnostic pop
--#endif  // DISABLE_SHORTEN_64_TO_32_WARNING && __clang__
-+#if __GNUC__ >= 8
-+#pragma GCC diagnostic ignored "-Wclass-memaccess"
-+#endif  // __GNUC__ >= 8
- 
--#ifdef _MSC_VER
--#pragma warning(push)
--#pragma warning(disable : 4702)
--#include <boost/beast/http/fields.hpp>
--#pragma warning(pop)
--#endif  // _MSC_VER
-+#cmakedefine DISABLE_GCC_IGNORED_ATTRIBUTES
-+#ifdef DISABLE_GCC_IGNORED_ATTRIBUTES
-+#pragma GCC diagnostic ignored "-Wignored-attributes"
-+#endif  // DISABLE_GCC_IGNORED_ATTRIBUTES
- 
--#cmakedefine HAS_SP_COUNTED_BASE_CLANG_HPP
--#if defined(HAS_SP_COUNTED_BASE_CLANG_HPP) && defined(__clang__)
--#if !__has_feature(c_atomic)
--#pragma clang diagnostic push
--#pragma clang diagnostic ignored "-Wc11-extensions"
--#include <boost/smart_ptr/detail/sp_counted_base_clang.hpp>
--#pragma clang diagnostic pop
--#endif  // !__has_feature(c_atomic)
--#endif  // HAS_SP_COUNTED_BASE_CLANG_HPP && __clang__
-+#endif  // __GNUC__
- 
--#cmakedefine DEPRECATED_ALLOCATOR_VOID
--#if defined(DEPRECATED_ALLOCATOR_VOID) && defined(__clang__)
--#pragma clang diagnostic push
-+#ifdef __clang__
-+
-+#if (defined(__APPLE__) && __clang_major__ >= 12) || __clang_major__ >= 11
- #pragma clang diagnostic ignored "-Wdeprecated-declarations"
--#include <boost/asio/associated_allocator.hpp>
--#include <boost/asio/impl/compose.hpp>
--#include <boost/asio/impl/executor.hpp>
--#include <boost/asio/io_context.hpp>
--#include <boost/asio/strand.hpp>
--#include <boost/beast/core/async_base.hpp>
--#pragma clang diagnostic pop
--#endif  // DEPRECATED_ALLOCATOR_VOID && __clang__
-+#endif
-+
-+#cmakedefine DISABLE_CLANG_C11_EXTENTIONS
-+#if !__has_feature(c_atomic) && defined(DISABLE_CLANG_C11_EXTENTIONS)
-+#pragma clang diagnostic ignored "-Wc11-extensions"
-+#endif  // !__has_feature(c_atomic) && defined(DISABLE_CLANG_C11_EXTENTIONS)
-+
-+#endif  // __clang__
-+
-+#ifdef _MSC_VER
-+
-+#pragma warning(disable : 4459)
-+#pragma warning(disable : 4646)
-+#pragma warning(disable : 4702)
-+
-+#endif  // _MSC_VER
- 
- #cmakedefine CMAKE_INSTALL_PREFIX "@CMAKE_INSTALL_PREFIX@"
- 
diff --git a/net/pichi/files/patch-src_net_adapter.cpp b/net/pichi/files/patch-src_net_adapter.cpp
deleted file mode 100644
index 359dc4ee1bff..000000000000
--- a/net/pichi/files/patch-src_net_adapter.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
---- src/net/adapter.cpp.orig
-+++ src/net/adapter.cpp
-@@ -27,11 +27,12 @@
- #include <pichi/vo/messages.hpp>
- #include <pichi/vo/options.hpp>
- 
--#ifdef DEPRECATED_RFC2818_CLASS
-+#include <boost/version.hpp>
-+#if BOOST_VERSION >= 107300
- #include <boost/asio/ssl/host_name_verification.hpp>
--#else  // DEPRECATED_RFC2818_CLASS
-+#else  // BOOST_VERSION >= 107300
- #include <boost/asio/ssl/rfc2818_verification.hpp>
--#endif  // DEPRECATED_RFC2818_CLASS
-+#endif  // BOOST_VERSION >= 107300
- 
- using namespace std;
- namespace asio = boost::asio;
-@@ -67,11 +68,11 @@ static auto createTlsContext(vo::TlsEgressOption const
-     ctx.load_verify_file(*option.caFile_);
-   else {
-     ctx.set_default_verify_paths();
--#ifdef DEPRECATED_RFC2818_CLASS
-+#if BOOST_VERSION >= 107300
-     ctx.set_verify_callback(ssl::host_name_verification{option.serverName_.value_or(serverName)});
--#else   // DEPRECATED_RFC2818_CLASS
-+#else   // BOOST_VERSION >= 107300
-     ctx.set_verify_callback(ssl::rfc2818_verification{option.serverName_.value_or(serverName)});
--#endif  // DEPRECATED_RFC2818_CLASS
-+#endif  // BOOST_VERSION >= 107300
-   }
-   return ctx;
- }
-@@ -95,16 +96,10 @@ unique_ptr<Ingress> makeShadowsocksIngress(Socket&& s,
-   psk = {container,
-          crypto::generateKey(option.method_, ConstBuffer<uint8_t>{option.password_}, container)};
-   switch (option.method_) {
--#if MBEDTLS_VERSION_MAJOR < 3
-   case CryptoMethod::RC4_MD5:
-     return make_unique<SSStreamAdapter<CryptoMethod::RC4_MD5, Socket>>(psk, forward<Socket>(s));
-   case CryptoMethod::BF_CFB:
-     return make_unique<SSStreamAdapter<CryptoMethod::BF_CFB, Socket>>(psk, forward<Socket>(s));
--#else   // MBEDTLS_VERSION_MAJOR < 3
--  case CryptoMethod::RC4_MD5:
--  case CryptoMethod::BF_CFB:
--    fail(PichiError::SEMANTIC_ERROR, vo::msg::DEPRECATED_METHOD);
--#endif  // MBEDTLS_VERSION_MAJOR < 3
-   case CryptoMethod::AES_128_CTR:
-     return make_unique<SSStreamAdapter<CryptoMethod::AES_128_CTR, Socket>>(psk, forward<Socket>(s));
-   case CryptoMethod::AES_192_CTR:
-@@ -158,16 +153,10 @@ static unique_ptr<Egress> makeShadowsocksEgress(vo::Sh
-   auto psk = MutableBuffer<uint8_t>{container, len};
- 
-   switch (option.method_) {
--#if MBEDTLS_VERSION_MAJOR < 3
-   case CryptoMethod::RC4_MD5:
-     return make_unique<SSStreamAdapter<CryptoMethod::RC4_MD5, TCPSocket>>(psk, io);
-   case CryptoMethod::BF_CFB:
-     return make_unique<SSStreamAdapter<CryptoMethod::BF_CFB, TCPSocket>>(psk, io);
--#else   // MBEDTLS_VERSION_MAJOR < 3
--  case CryptoMethod::RC4_MD5:
--  case CryptoMethod::BF_CFB:
--    fail(PichiError::SEMANTIC_ERROR, vo::msg::DEPRECATED_METHOD);
--#endif  // MBEDTLS_VERSION_MAJOR < 3
-   case CryptoMethod::AES_128_CTR:
-     return make_unique<SSStreamAdapter<CryptoMethod::AES_128_CTR, TCPSocket>>(psk, io);
-   case CryptoMethod::AES_192_CTR:
diff --git a/net/pichi/files/patch-src_net_http.cpp b/net/pichi/files/patch-src_net_http.cpp
new file mode 100644
index 000000000000..eccacb97c8ca
--- /dev/null
+++ b/net/pichi/files/patch-src_net_http.cpp
@@ -0,0 +1,11 @@
+--- src/net/http.cpp.orig	2022-12-12 17:06:47 UTC
++++ src/net/http.cpp
+@@ -365,7 +365,7 @@ template <typename Stream> Endpoint HttpIngress<Stream
+      * relative_path specified;
+      *     - relative_path will be forwarded without any change.
+      */
+-    auto target = req.target().to_string();
++    auto target = string{cbegin(req.target()), cend(req.target())};
+     assertFalse(target.empty(), PichiError::BAD_PROTO, "Empty path");
+     if (target[0] != '/') {
+       // absolute_path specified, so convert it to relative one.
diff --git a/net/pichi/pkg-plist b/net/pichi/pkg-plist
index a534d9e883fb..cb403c53ba8f 100644
--- a/net/pichi/pkg-plist
+++ b/net/pichi/pkg-plist
@@ -1,59 +1,62 @@
 bin/pichi
 %%ETCDIR%%/geo.mmdb
 @sample %%ETCDIR%%/pichi.json.sample
 %%NO_STATIC%%lib/libpichi.so.%%DISTVERSION%%
 %%NO_STATIC%%lib/libpichi.so
 %%STATIC%%%%DEVEL%%lib/libpichi.a
 %%DEVEL%%include/boost/asio/spawn2.hpp
 %%DEVEL%%include/pichi/api/balancer.hpp
 %%DEVEL%%include/pichi/api/egress_manager.hpp
 %%DEVEL%%include/pichi/api/ingress_holder.hpp
 %%DEVEL%%include/pichi/api/ingress_manager.hpp
 %%DEVEL%%include/pichi/api/rest.hpp
 %%DEVEL%%include/pichi/api/router.hpp
 %%DEVEL%%include/pichi/api/server.hpp
 %%DEVEL%%include/pichi/api/session.hpp
 %%DEVEL%%include/pichi/common/adapter.hpp
 %%DEVEL%%include/pichi/common/asserts.hpp
 %%DEVEL%%include/pichi/common/buffer.hpp
 %%DEVEL%%include/pichi/common/config.hpp
 %%DEVEL%%include/pichi/common/constants.hpp
 %%DEVEL%%include/pichi/common/endpoint.hpp
 %%DEVEL%%include/pichi/common/enumerations.hpp
-%%DEVEL%%include/pichi/common/exception.hpp
+%%DEVEL%%include/pichi/common/error.hpp
 %%DEVEL%%include/pichi/common/literals.hpp
 %%DEVEL%%include/pichi/common/uri.hpp
 %%DEVEL%%include/pichi/crypto/aead.hpp
 %%DEVEL%%include/pichi/crypto/base64.hpp
+%%DEVEL%%include/pichi/crypto/brotli.hpp
+%%DEVEL%%include/pichi/crypto/fingerprint.hpp
 %%DEVEL%%include/pichi/crypto/hash.hpp
 %%DEVEL%%include/pichi/crypto/key.hpp
 %%DEVEL%%include/pichi/crypto/method.hpp
 %%DEVEL%%include/pichi/crypto/stream.hpp
 %%DEVEL%%include/pichi/net/adapter.hpp
 %%DEVEL%%include/pichi/net/direct.hpp
 %%DEVEL%%include/pichi/net/helper.hpp
 %%DEVEL%%include/pichi/net/http.hpp
 %%DEVEL%%include/pichi/net/reject.hpp
 %%DEVEL%%include/pichi/net/socks5.hpp
 %%DEVEL%%include/pichi/net/spawn.hpp
 %%DEVEL%%include/pichi/net/ssaead.hpp
 %%DEVEL%%include/pichi/net/ssstream.hpp
+%%DEVEL%%include/pichi/net/transparent.hpp
 %%DEVEL%%include/pichi/net/trojan.hpp
 %%DEVEL%%include/pichi/net/tunnel.hpp
 %%DEVEL%%include/pichi/stream/test.hpp
 %%DEVEL%%include/pichi/stream/tls.hpp
 %%DEVEL%%include/pichi/stream/traits.hpp
 %%DEVEL%%include/pichi/stream/websocket.hpp
 %%DEVEL%%include/pichi/vo/credential.hpp
 %%DEVEL%%include/pichi/vo/egress.hpp
 %%DEVEL%%include/pichi/vo/error.hpp
 %%DEVEL%%include/pichi/vo/ingress.hpp
 %%DEVEL%%include/pichi/vo/iterator.hpp
 %%DEVEL%%include/pichi/vo/keys.hpp
 %%DEVEL%%include/pichi/vo/messages.hpp
 %%DEVEL%%include/pichi/vo/options.hpp
 %%DEVEL%%include/pichi/vo/parse.hpp
 %%DEVEL%%include/pichi/vo/route.hpp
 %%DEVEL%%include/pichi/vo/rule.hpp
 %%DEVEL%%include/pichi/vo/to_json.hpp
 %%DEVEL%%include/pichi.h