🌴 Sync 2026-03-05 23:51:42

luci-app-homeproxy/root/etc/homeproxy/scripts/clean_log.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2022-2023 ImmortalWrt.org
+
+NAME="homeproxy"
+
+log_max_size="50" #KB
+main_log_file="/var/run/$NAME/$NAME.log"
+singc_log_file="/var/run/$NAME/sing-box-c.log"
+sings_log_file="/var/run/$NAME/sing-box-s.log"
+
+while true; do
+	sleep 180
+	for i in "$main_log_file" "$singc_log_file" "$sings_log_file"; do
+		[ -s "$i" ] || continue
+		[ "$(( $(ls -l "$i" | awk -F ' ' '{print $5}') / 1024 >= log_max_size))" -eq "0" ] || echo "" > "$i"
+	done
+done

luci-app-homeproxy/root/etc/homeproxy/scripts/firewall_post.ut

@@ -0,0 +1,665 @@
+#!/usr/bin/utpl -S
+
+{%-
+import { readfile } from 'fs';
+import { cursor } from 'uci';
+import { isEmpty } from '/etc/homeproxy/scripts/homeproxy.uc';
+
+const fw4 = require('fw4');
+
+function array_to_nftarr(array) {
+	if (type(array) !== 'array')
+		return null;
+
+	return `{ ${join(', ', uniq(array))} }`;
+}
+
+function resolve_ipv6(str) {
+	if (isEmpty(str))
+		return null;
+
+	let ipv6 = fw4.parse_subnet(str)?.[0];
+	if (!ipv6 || ipv6.family !== 6)
+		return null;
+
+	if (ipv6.bits > -1)
+		return `${ipv6.addr}/${ipv6.bits}`;
+	else
+		return `& ${ipv6.mask} == ${ipv6.addr}`;
+}
+
+function resolve_mark(str) {
+	if (isEmpty(str))
+		return null;
+
+	let mark = fw4.parse_mark(str);
+	if (isEmpty(mark))
+		return null;
+
+	if (mark.mask === 0xffffffff)
+		return fw4.hex(mark.mark);
+	else if (mark.mark === 0)
+		return `mark and ${fw4.hex(~mark.mask & 0xffffffff)}`;
+	else if (mark.mark === mark.mask)
+		return `mark or ${fw4.hex(mark.mark)}`;
+	else if (mark.mask === 0)
+		return `mark xor ${fw4.hex(mark.mark)}`;
+	else
+		return `mark and ${fw4.hex(~mark.mask & 0xffffffff)} xor ${fw4.hex(mark.mark)}`;
+}
+
+/* Misc config */
+const resources_dir = '/etc/homeproxy/resources';
+
+/* UCI config start */
+const cfgname = 'homeproxy';
+const uci = cursor();
+uci.load(cfgname);
+
+const routing_mode = uci.get(cfgname, 'config', 'routing_mode') || 'bypass_mainland_china';
+let outbound_node, outbound_udp_node, china_dns_server, bypass_cn_traffic;
+
+if (routing_mode !== 'custom') {
+	outbound_node = uci.get(cfgname, 'config', 'main_node') || 'nil';
+	outbound_udp_node = uci.get(cfgname, 'config', 'main_udp_node') || 'nil';
+	china_dns_server = uci.get(cfgname, 'config', 'china_dns_server');
+} else {
+	outbound_node = uci.get(cfgname, 'routing', 'default_outbound') || 'nil';
+	bypass_cn_traffic = uci.get(cfgname, 'routing', 'bypass_cn_traffic') || '0';
+}
+
+let routing_port = uci.get(cfgname, 'config', 'routing_port');
+if (routing_port === 'common')
+	routing_port = uci.get(cfgname, 'infra', 'common_port') || '22,53,80,143,443,465,587,853,873,993,995,8080,8443,9418';
+
+const proxy_mode = uci.get(cfgname, 'config', 'proxy_mode') || 'redirect_tproxy',
+      ipv6_support = uci.get(cfgname, 'config', 'ipv6_support') || '0';
+
+let self_mark, redirect_port,
+    tproxy_port, tproxy_mark,
+    tun_name, tun_mark;
+
+if (match(proxy_mode, /redirect/)) {
+	self_mark = uci.get(cfgname, 'infra', 'self_mark') || '100';
+	redirect_port = uci.get(cfgname, 'infra', 'redirect_port') || '5331';
+}
+if (match(proxy_mode, /tproxy/))
+	if (outbound_udp_node !== 'nil' || routing_mode === 'custom') {
+		tproxy_port = uci.get(cfgname, 'infra', 'tproxy_port') || '5332';
+		tproxy_mark = resolve_mark(uci.get(cfgname, 'infra', 'tproxy_mark') || '101');
+	}
+if (match(proxy_mode, /tun/)) {
+	tun_name = uci.get(cfgname, 'infra', 'tun_name') || 'singtun0';
+	tun_mark = resolve_mark(uci.get(cfgname, 'infra', 'tun_mark') || '102');
+}
+
+const control_options = [
+	"listen_interfaces", "lan_proxy_mode",
+	"lan_direct_mac_addrs", "lan_direct_ipv4_ips", "lan_direct_ipv6_ips",
+	"lan_proxy_mac_addrs", "lan_proxy_ipv4_ips", "lan_proxy_ipv6_ips",
+	"lan_gaming_mode_mac_addrs", "lan_gaming_mode_ipv4_ips", "lan_gaming_mode_ipv6_ips",
+	"lan_global_proxy_mac_addrs", "lan_global_proxy_ipv4_ips", "lan_global_proxy_ipv6_ips",
+	"wan_proxy_ipv4_ips", "wan_proxy_ipv6_ips",
+	"wan_direct_ipv4_ips", "wan_direct_ipv6_ips"
+];
+const control_info = {};
+
+for (let i in control_options)
+	control_info[i] = uci.get(cfgname, 'control', i);
+
+const dns_redirect = uci.get(cfgname, 'infra', 'dns_redirect') || '1';
+const dns_hijacked = uci.get('dhcp', '@dnsmasq[0]', 'dns_redirect') || '0',
+      dns_port = uci.get('dhcp', '@dnsmasq[0]', 'port') || '53';
+/* UCI config end */
+-%}
+
+{# Reserved addresses -#}
+set homeproxy_local_addr_v4 {
+	type ipv4_addr
+	flags interval
+	auto-merge
+	elements = {
+		0.0.0.0/8,
+		10.0.0.0/8,
+		100.64.0.0/10,
+		127.0.0.0/8,
+		169.254.0.0/16,
+		172.16.0.0/12,
+		192.0.0.0/24,
+		192.0.2.0/24,
+		192.31.196.0/24,
+		192.52.193.0/24,
+		192.88.99.0/24,
+		192.168.0.0/16,
+		192.175.48.0/24,
+		198.18.0.0/15,
+		198.51.100.0/24,
+		203.0.113.0/24,
+		224.0.0.0/4,
+		240.0.0.0/4
+	}
+}
+{% if (ipv6_support === '1'): %}
+set homeproxy_local_addr_v6 {
+	type ipv6_addr
+	flags interval
+	auto-merge
+	elements = {
+		::/128,
+		::1/128,
+		::ffff:0:0/96,
+		100::/64,
+		64:ff9b::/96,
+		2001::/32,
+		2001:10::/28,
+		2001:20::/28,
+		2001:db8::/28,
+		2002::/16,
+		fc00::/7,
+		fe80::/10,
+		ff00::/8
+	}
+}
+{% endif %}
+
+{% if (routing_mode === 'gfwlist'): %}
+set homeproxy_gfw_list_v4 {
+	type ipv4_addr
+	flags interval
+	auto-merge
+}
+{% if (ipv6_support === '1'): %}
+set homeproxy_gfw_list_v6 {
+	type ipv6_addr
+	flags interval
+	auto-merge
+}
+{% endif /* ipv6_support */ %}
+{% elif (match(routing_mode, /mainland_china/) || bypass_cn_traffic === '1'): %}
+set homeproxy_mainland_addr_v4 {
+	type ipv4_addr
+	flags interval
+	auto-merge
+	elements = {
+		{% for (let cnip4 in split(trim(readfile(resources_dir + '/china_ip4.txt')), /[\r\n]/)): %}
+		{{ cnip4 }},
+		{% endfor %}
+	}
+}
+{% if ((ipv6_support === '1') || china_dns_server): %}
+set homeproxy_mainland_addr_v6 {
+	type ipv6_addr
+	flags interval
+	auto-merge
+	elements = {
+		{% for (let cnip6 in split(trim(readfile(resources_dir + '/china_ip6.txt')), /[\r\n]/)): %}
+		{{ cnip6 }},
+		{% endfor %}
+	}
+}
+{% endif /* ipv6_support */ %}
+{% endif /* routing_mode */ %}
+
+{# WAN ACL addresses #}
+set homeproxy_wan_proxy_addr_v4 {
+	type ipv4_addr
+	flags interval
+	auto-merge
+{% if (control_info.wan_proxy_ipv4_ips): %}
+	elements = { {{ join(', ', control_info.wan_proxy_ipv4_ips) }} }
+{% endif %}
+}
+
+{% if (ipv6_support === '1'): %}
+set homeproxy_wan_proxy_addr_v6 {
+	type ipv6_addr
+	flags interval
+	auto-merge
+{% if (control_info.wan_proxy_ipv6_ips): %}
+	elements = { {{ join(', ', control_info.wan_proxy_ipv6_ips) }} }
+{% endif /* wan_proxy_ipv6_ips*/ %}
+}
+{% endif /* ipv6_support */ %}
+
+set homeproxy_wan_direct_addr_v4 {
+	type ipv4_addr
+	flags interval
+	auto-merge
+{% if (control_info.wan_direct_ipv4_ips): %}
+	elements = { {{ join(', ', control_info.wan_direct_ipv4_ips) }} }
+{% endif %}
+}
+
+{% if (ipv6_support === '1'): %}
+set homeproxy_wan_direct_addr_v6 {
+	type ipv6_addr
+	flags interval
+	auto-merge
+{% if (control_info.wan_direct_ipv6_ips): %}
+	elements = { {{ join(', ', control_info.wan_direct_ipv6_ips) }} }
+{% endif /* wan_direct_ipv6_ips */ %}
+}
+{% endif /* ipv6_support */ %}
+
+{% if (routing_port): %}
+set homeproxy_routing_port {
+	type inet_service
+	flags interval
+	auto-merge
+	elements = { {{ join(', ', split(routing_port, ',')) }} }
+}
+{% endif %}
+
+{# DNS hijack & TCP redirect #}
+chain dstnat {
+{% if ((dns_redirect === '1') && (dns_hijacked !== '1')): %}
+	{% if (control_info.listen_interfaces): %}
+	meta iifname {{ array_to_nftarr(control_info.listen_interfaces) }}
+	{%- endif /* listen_interfaces */ %}
+	meta nfproto { ipv4, ipv6 } udp dport 53 counter redirect to :{{ dns_port }} comment "!{{ cfgname }}: DNS hijack"
+{% endif /* dns_hijacked */ %}
+{% if (match(proxy_mode, /redirect/)): %}
+	meta nfproto { {{ (ipv6_support === '1') ? 'ipv4, ipv6' : 'ipv4' }} } meta l4proto tcp jump homeproxy_redirect_lanac
+{% endif /* proxy_mode */ %}
+}
+
+{# TCP redirect #}
+{% if (match(proxy_mode, /redirect/)): %}
+chain homeproxy_redirect_proxy {
+	meta l4proto tcp counter redirect to :{{ redirect_port }}
+}
+
+chain homeproxy_redirect_proxy_port {
+	{% if (routing_port): %}
+	tcp dport != @homeproxy_routing_port counter return
+	{% endif %}
+	goto homeproxy_redirect_proxy
+}
+
+chain homeproxy_redirect_lanac {
+	{% if (control_info.listen_interfaces): %}
+	meta iifname != {{ array_to_nftarr(control_info.listen_interfaces) }} counter return
+	{% endif %}
+	meta mark {{ self_mark }} counter return
+
+	{% if (control_info.lan_proxy_mode === 'listed_only'): %}
+	{% if (!isEmpty(control_info.lan_proxy_ipv4_ips)): %}
+	ip saddr {{ array_to_nftarr(control_info.lan_proxy_ipv4_ips) }} counter goto homeproxy_redirect
+	{% endif /* lan_proxy_ipv4_ips */ %}
+	{% for (let ipv6 in control_info.lan_proxy_ipv6_ips): %}
+	ip6 saddr {{ resolve_ipv6(ipv6) }} counter goto homeproxy_redirect
+	{% endfor /* lan_proxy_ipv6_ips */ %}
+	{% if (!isEmpty(control_info.lan_proxy_mac_addrs)): %}
+	ether saddr {{ array_to_nftarr(control_info.lan_proxy_mac_addrs) }} counter goto homeproxy_redirect
+	{% endif /* lan_proxy_mac_addrs */ %}
+	{% elif (control_info.lan_proxy_mode === 'except_listed'): %}
+	{% if (!isEmpty(control_info.lan_direct_ipv4_ips)): %}
+	ip saddr {{ array_to_nftarr(control_info.lan_direct_ipv4_ips) }} counter return
+	{% endif /* lan_direct_ipv4_ips */ %}
+	{% for (let ipv6 in control_info.lan_direct_ipv6_ips): %}
+	ip6 saddr {{ resolve_ipv6(ipv6) }} counter return
+	{% endfor /* lan_direct_ipv6_ips */ %}
+	{% if (!isEmpty(control_info.lan_direct_mac_addrs)): %}
+	ether saddr {{ array_to_nftarr(control_info.lan_direct_mac_addrs) }} counter return
+	{% endif /* lan_direct_mac_addrs */ %}
+	{% endif /* lan_proxy_mode */ %}
+
+	{% if (control_info.lan_proxy_mode !== 'listed_only'): %}
+	counter goto homeproxy_redirect
+	{% endif %}
+}
+
+chain homeproxy_redirect {
+	meta mark {{ self_mark }} counter return
+
+	ip daddr @homeproxy_wan_proxy_addr_v4 counter goto homeproxy_redirect_proxy_port
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_wan_proxy_addr_v6 counter goto homeproxy_redirect_proxy_port
+	{% endif %}
+
+	ip daddr @homeproxy_local_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_local_addr_v6 counter return
+	{% endif %}
+
+	{% if (routing_mode !== 'custom'): %}
+	{% if (!isEmpty(control_info.lan_global_proxy_ipv4_ips)): %}
+	ip saddr {{ array_to_nftarr(control_info.lan_global_proxy_ipv4_ips) }} counter goto homeproxy_redirect_proxy_port
+	{% endif /* lan_global_proxy_ipv4_ips */ %}
+	{% for (let ipv6 in control_info.lan_global_proxy_ipv6_ips): %}
+	ip6 saddr {{ resolve_ipv6(ipv6) }} counter goto homeproxy_redirect_proxy_port
+	{% endfor /* lan_global_proxy_ipv6_ips */ %}
+	{% if (!isEmpty(control_info.lan_global_proxy_mac_addrs)): %}
+	ether saddr {{ array_to_nftarr(control_info.lan_global_proxy_mac_addrs) }} counter goto homeproxy_redirect_proxy_port
+	{% endif /* lan_global_proxy_mac_addrs */ %}
+	{% endif /* routing_mode */ %}
+
+	ip daddr @homeproxy_wan_direct_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_wan_direct_addr_v6 counter return
+	{% endif /* ipv6_support */ %}
+
+	{% if (routing_mode === 'gfwlist'): %}
+	ip daddr != @homeproxy_gfw_list_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr != @homeproxy_gfw_list_v6 counter return
+	{% endif /* ipv6_support */ %}
+	{% elif (routing_mode === 'bypass_mainland_china' || bypass_cn_traffic === '1'): %}
+	ip daddr @homeproxy_mainland_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_mainland_addr_v6 counter return
+	{% endif /* ipv6_support */ %}
+	{% elif (routing_mode === 'proxy_mainland_china'): %}
+	ip daddr != @homeproxy_mainland_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr != @homeproxy_mainland_addr_v6 counter return
+	{% endif /* ipv6_support */ %}
+	{% endif /* routing_mode */ %}
+
+	{% if (!isEmpty(control_info.lan_gaming_mode_ipv4_ips)): %}
+	ip saddr {{ array_to_nftarr(control_info.lan_gaming_mode_ipv4_ips) }} counter goto homeproxy_redirect_proxy
+	{% endif /* lan_gaming_mode_ipv4_ips */ %}
+	{% for (let ipv6 in control_info.lan_gaming_mode_ipv6_ips): %}
+	ip6 saddr {{ resolve_ipv6(ipv6) }} counter goto homeproxy_redirect_proxy
+	{% endfor /* lan_gaming_mode_ipv6_ips */ %}
+	{% if (!isEmpty(control_info.lan_gaming_mode_mac_addrs)): %}
+	ether saddr {{ array_to_nftarr(control_info.lan_gaming_mode_mac_addrs) }} counter goto homeproxy_redirect_proxy
+	{% endif /* lan_gaming_mode_mac_addrs */ %}
+
+	counter goto homeproxy_redirect_proxy_port
+}
+
+chain homeproxy_output_redir {
+	type nat hook output priority filter -105; policy accept
+	meta nfproto { {{ (ipv6_support === '1') ? 'ipv4, ipv6' : 'ipv4' }} } meta l4proto tcp jump homeproxy_redirect
+}
+{% endif %}
+
+{# UDP tproxy #}
+{% if (match(proxy_mode, /tproxy/) && (outbound_udp_node !== 'nil' || routing_mode === 'custom')): %}
+chain homeproxy_mangle_tproxy {
+	meta l4proto udp meta mark set {{ tproxy_mark }} tproxy ip to 127.0.0.1:{{ tproxy_port }} counter accept
+	{% if (ipv6_support === '1'): %}
+	meta l4proto udp meta mark set {{ tproxy_mark }} tproxy ip6 to [::1]:{{ tproxy_port }} counter accept
+	{% endif %}
+}
+
+chain homeproxy_mangle_tproxy_port {
+	{% if (routing_port): %}
+	udp dport != @homeproxy_routing_port counter return
+	{% endif %}
+	goto homeproxy_mangle_tproxy
+}
+
+chain homeproxy_mangle_mark {
+	{% if (routing_port): %}
+	udp dport != @homeproxy_routing_port counter return
+	{% endif %}
+	meta l4proto udp meta mark set {{ tproxy_mark }} counter accept
+}
+
+chain homeproxy_mangle_lanac {
+	{% if (control_info.listen_interfaces): %}
+	meta iifname != {{ array_to_nftarr(uniq([...control_info.listen_interfaces, ...['lo']])) }} counter return
+	{% endif %}
+	meta iifname != lo udp dport 53 counter return
+	meta mark {{ self_mark }} counter return
+
+	{% if (control_info.lan_proxy_mode === 'listed_only'): %}
+	{% if (!isEmpty(control_info.lan_proxy_ipv4_ips)): %}
+	ip saddr {{ array_to_nftarr(control_info.lan_proxy_ipv4_ips) }} counter goto homeproxy_mangle_prerouting
+	{% endif /* lan_proxy_ipv4_ips */ %}
+	{% for (let ipv6 in control_info.lan_proxy_ipv6_ips): %}
+	ip6 saddr {{ resolve_ipv6(ipv6) }} counter goto homeproxy_mangle_prerouting
+	{% endfor /* lan_proxy_ipv6_ips */ %}
+	{% if (!isEmpty(control_info.lan_proxy_mac_addrs)): %}
+	ether saddr {{ array_to_nftarr(control_info.lan_proxy_mac_addrs) }} counter goto homeproxy_mangle_prerouting
+	{% endif /* lan_proxy_mac_addrs */ %}
+	{% elif (control_info.lan_proxy_mode === 'except_listed'): %}
+	{% if (!isEmpty(control_info.lan_direct_ipv4_ips)): %}
+	ip saddr {{ array_to_nftarr(control_info.lan_direct_ipv4_ips) }} counter return
+	{% endif /* lan_direct_ipv4_ips */ %}
+	{% for (let ipv6 in control_info.lan_direct_ipv6_ips): %}
+	ip6 saddr {{ resolve_ipv6(ipv6) }} counter return
+	{% endfor /* lan_direct_ipv6_ips */ %}
+	{% if (!isEmpty(control_info.lan_direct_mac_addrs)): %}
+	ether saddr {{ array_to_nftarr(control_info.lan_direct_mac_addrs) }} counter return
+	{% endif /* lan_direct_mac_addrs */ %}
+	{% endif /* lan_proxy_mode */ %}
+
+	{% if (control_info.lan_proxy_mode !== 'listed_only'): %}
+	counter goto homeproxy_mangle_prerouting
+	{% endif %}
+}
+
+chain homeproxy_mangle_prerouting {
+	ip daddr @homeproxy_wan_proxy_addr_v4 counter goto homeproxy_mangle_tproxy_port
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_wan_proxy_addr_v6 counter goto homeproxy_mangle_tproxy_port
+	{% endif %}
+
+	ip daddr @homeproxy_local_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_local_addr_v6 counter return
+	{% endif %}
+
+	{% if (routing_mode !== 'custom'): %}
+	{% if (!isEmpty(control_info.lan_global_proxy_ipv4_ips)): %}
+	ip saddr {{ array_to_nftarr(control_info.lan_global_proxy_ipv4_ips) }} counter goto homeproxy_mangle_tproxy_port
+	{% endif /* lan_global_proxy_ipv4_ips */ %}
+	{% for (let ipv6 in control_info.lan_global_proxy_ipv6_ips): %}
+	ip6 saddr {{ resolve_ipv6(ipv6) }} counter goto homeproxy_mangle_tproxy_port
+	{% endfor /* lan_global_proxy_ipv6_ips */ %}
+	{% if (!isEmpty(control_info.lan_global_proxy_mac_addrs)): %}
+	ether saddr {{ array_to_nftarr(control_info.lan_global_proxy_mac_addrs) }} counter goto homeproxy_mangle_tproxy_port
+	{% endif /* lan_global_proxy_mac_addrs */ %}
+	{% endif /* routing_mode */ %}
+
+	ip daddr @homeproxy_wan_direct_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_wan_direct_addr_v6 counter return
+	{% endif /* ipv6_support */ %}
+
+	{% if (routing_mode === 'gfwlist'): %}
+	ip daddr != @homeproxy_gfw_list_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr != @homeproxy_gfw_list_v6 counter return
+	{% endif /* ipv6_support */ %}
+	udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: Fuck you QUIC"
+	{% elif (routing_mode === 'bypass_mainland_china' || bypass_cn_traffic === '1'): %}
+	ip daddr @homeproxy_mainland_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_mainland_addr_v6 counter return
+	{% endif /* ipv6_support */ %}
+	{% if (routing_mode !== 'custom'): %}
+	udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: Fuck you QUIC"
+	{% endif /* routing_mode */ %}
+	{% elif (routing_mode === 'proxy_mainland_china'): %}
+	ip daddr != @homeproxy_mainland_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr != @homeproxy_mainland_addr_v6 counter return
+	{% endif /* ipv6_support */ %}
+	{% endif /* routing_mode */ %}
+
+	{% if (!isEmpty(control_info.lan_gaming_mode_ipv4_ips)): %}
+	ip saddr {{ array_to_nftarr(control_info.lan_gaming_mode_ipv4_ips) }} counter goto homeproxy_mangle_tproxy
+	{% endif /* lan_gaming_mode_ipv4_ips */ %}
+	{% for (let ipv6 in control_info.lan_gaming_mode_ipv6_ips): %}
+	ip6 saddr {{ resolve_ipv6(ipv6) }} counter goto homeproxy_mangle_tproxy
+	{% endfor /* lan_gaming_mode_ipv6_ips */ %}
+	{% if (!isEmpty(control_info.lan_gaming_mode_mac_addrs)): %}
+	ether saddr {{ array_to_nftarr(control_info.lan_gaming_mode_mac_addrs) }} counter goto homeproxy_mangle_tproxy
+	{% endif /* lan_gaming_mode_mac_addrs */ %}
+
+	counter goto homeproxy_mangle_tproxy_port
+}
+
+chain homeproxy_mangle_output {
+	meta mark {{ self_mark }} counter return
+
+	ip daddr @homeproxy_wan_proxy_addr_v4 counter goto homeproxy_mangle_mark
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_wan_proxy_addr_v6 counter goto homeproxy_mangle_mark
+	{% endif %}
+
+	ip daddr @homeproxy_local_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_local_addr_v6 counter return
+	{% endif %}
+
+	ip daddr @homeproxy_wan_direct_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_wan_direct_addr_v6 counter return
+	{% endif /* ipv6_support */ %}
+
+	{% if (routing_mode === 'gfwlist'): %}
+	ip daddr != @homeproxy_gfw_list_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr != @homeproxy_gfw_list_v6 counter return
+	{% endif /* ipv6_support */ %}
+	{% elif (routing_mode === 'bypass_mainland_china' || bypass_cn_traffic === '1'): %}
+	ip daddr @homeproxy_mainland_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_mainland_addr_v6 counter return
+	{% endif /* ipv6_support */ %}
+	{% elif (routing_mode === 'proxy_mainland_china'): %}
+	ip daddr != @homeproxy_mainland_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr != @homeproxy_mainland_addr_v6 counter return
+	{% endif /* ipv6_support */ %}
+	{% endif /* routing_mode */ %}
+
+	counter goto homeproxy_mangle_mark
+}
+
+chain mangle_prerouting {
+	meta nfproto { {{ (ipv6_support === '1') ? 'ipv4, ipv6' : 'ipv4' }} } meta l4proto udp jump homeproxy_mangle_lanac
+}
+
+chain mangle_output {
+	meta nfproto { {{ (ipv6_support === '1') ? 'ipv4, ipv6' : 'ipv4' }} } meta l4proto udp jump homeproxy_mangle_output
+}
+{% endif %}
+
+{# TUN #}
+{% if (match(proxy_mode, /tun/)): %}
+chain homeproxy_mangle_lanac {
+	iifname {{ tun_name }} counter return
+	udp dport 53 counter return
+
+	{% if (control_info.listen_interfaces): %}
+	meta iifname != {{ array_to_nftarr(control_info.listen_interfaces) }} counter return
+	{% endif %}
+
+	{% if (control_info.lan_proxy_mode === 'listed_only'): %}
+	{% if (!isEmpty(control_info.lan_proxy_ipv4_ips)): %}
+	ip saddr {{ array_to_nftarr(control_info.lan_proxy_ipv4_ips) }} counter goto homeproxy_mangle_tun
+	{% endif /* lan_proxy_ipv4_ips */ %}
+	{% for (let ipv6 in control_info.lan_proxy_ipv6_ips): %}
+	ip6 saddr {{ resolve_ipv6(ipv6) }} counter goto homeproxy_mangle_tun
+	{% endfor /* lan_proxy_ipv6_ips */ %}
+	{% if (!isEmpty(control_info.lan_proxy_mac_addrs)): %}
+	ether saddr {{ array_to_nftarr(control_info.lan_proxy_mac_addrs) }} counter goto homeproxy_mangle_tun
+	{% endif /* lan_proxy_mac_addrs */ %}
+	{% elif (control_info.lan_proxy_mode === 'except_listed'): %}
+	{% if (!isEmpty(control_info.lan_direct_ipv4_ips)): %}
+	ip saddr {{ array_to_nftarr(control_info.lan_direct_ipv4_ips) }} counter return
+	{% endif /* lan_direct_ipv4_ips */ %}
+	{% for (let ipv6 in control_info.lan_direct_ipv6_ips): %}
+	ip6 saddr {{ resolve_ipv6(ipv6) }} counter return
+	{% endfor /* lan_direct_ipv6_ips */ %}
+	{% if (!isEmpty(control_info.lan_direct_mac_addrs)): %}
+	ether saddr {{ array_to_nftarr(control_info.lan_direct_mac_addrs) }} counter return
+	{% endif /* lan_direct_mac_addrs */ %}
+	{% endif /* lan_proxy_mode */ %}
+
+	{% if (control_info.lan_proxy_mode !== 'listed_only'): %}
+	counter goto homeproxy_mangle_tun
+	{% endif %}
+}
+
+chain homeproxy_mangle_tun_mark {
+	{% if (routing_port): %}
+	{% if (proxy_mode === 'tun'): %}
+	tcp dport != @homeproxy_routing_port counter return
+	{% endif /* proxy_mode */ %}
+	udp dport != @homeproxy_routing_port counter return
+	{% endif /* routing_port */ %}
+
+	counter meta mark set {{ tun_mark }}
+}
+
+chain homeproxy_mangle_tun {
+	iifname {{ tun_name }} counter return
+
+	ip daddr @homeproxy_wan_proxy_addr_v4 counter goto homeproxy_mangle_tun_mark
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_wan_proxy_addr_v6 counter goto homeproxy_mangle_tun_mark
+	{% endif %}
+
+	ip daddr @homeproxy_local_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_local_addr_v6 counter return
+	{% endif %}
+
+	{% if (routing_mode !== 'custom'): %}
+	{% if (!isEmpty(control_info.lan_global_proxy_ipv4_ips)): %}
+	ip saddr {{ array_to_nftarr(control_info.lan_global_proxy_ipv4_ips) }} counter goto homeproxy_mangle_tun_mark
+	{% endif /* lan_global_proxy_ipv4_ips */ %}
+	{% for (let ipv6 in control_info.lan_global_proxy_ipv6_ips): %}
+	ip6 saddr {{ resolve_ipv6(ipv6) }} counter goto homeproxy_mangle_tun_mark
+	{% endfor /* lan_global_proxy_ipv6_ips */ %}
+	{% if (!isEmpty(control_info.lan_global_proxy_mac_addrs)): %}
+	ether saddr {{ array_to_nftarr(control_info.lan_global_proxy_mac_addrs) }} counter goto homeproxy_mangle_tun_mark
+	{% endif /* lan_global_proxy_mac_addrs */ %}
+	{% endif /* routing_mode */ %}
+
+	{% if (control_info.wan_direct_ipv4_ips): %}
+	ip daddr {{ array_to_nftarr(control_info.wan_direct_ipv4_ips) }} counter return
+	{% endif /* wan_direct_ipv4_ips */ %}
+	{% if (control_info.wan_direct_ipv6_ips): %}
+	ip6 daddr {{ array_to_nftarr(control_info.wan_direct_ipv6_ips) }} counter return
+	{% endif /* wan_direct_ipv6_ips */ %}
+
+	{% if (routing_mode === 'gfwlist'): %}
+	ip daddr != @homeproxy_gfw_list_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr != @homeproxy_gfw_list_v6 counter return
+	{% endif /* ipv6_support */ %}
+	udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: Fuck you QUIC"
+	{% elif (routing_mode === 'bypass_mainland_china' || bypass_cn_traffic === '1'): %}
+	ip daddr @homeproxy_mainland_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr @homeproxy_mainland_addr_v6 counter return
+	{% endif /* ipv6_support */ %}
+	{% if (routing_mode !== 'custom'): %}
+	udp dport { 80, 443 } counter reject comment "!{{ cfgname }}: Fuck you QUIC"
+	{% endif /* routing_mode */ %}
+	{% elif (routing_mode === 'proxy_mainland_china'): %}
+	ip daddr != @homeproxy_mainland_addr_v4 counter return
+	{% if (ipv6_support === '1'): %}
+	ip6 daddr != @homeproxy_mainland_addr_v6 counter return
+	{% endif /* ipv6_support */ %}
+	{% endif /* routing_mode */ %}
+
+	{% if (!isEmpty(control_info.lan_gaming_mode_ipv4_ips)): %}
+	ip saddr {{ array_to_nftarr(control_info.lan_gaming_mode_ipv4_ips) }} counter meta mark set {{ tun_mark }}
+	{% endif /* lan_gaming_mode_ipv4_ips */ %}
+	{% for (let ipv6 in control_info.lan_gaming_mode_ipv6_ips): %}
+	ip6 saddr {{ resolve_ipv6(ipv6) }} counter meta mark set {{ tun_mark }}
+	{% endfor /* lan_gaming_mode_ipv6_ips */ %}
+	{% if (!isEmpty(control_info.lan_gaming_mode_mac_addrs)): %}
+	ether saddr {{ array_to_nftarr(control_info.lan_gaming_mode_mac_addrs) }} counter meta mark set {{ tun_mark }}
+	{% endif /* lan_gaming_mode_mac_addrs */ %}
+
+	counter goto homeproxy_mangle_tun_mark
+}
+
+chain mangle_prerouting {
+	meta nfproto { {{ (ipv6_support === '1') ? 'ipv4, ipv6' : 'ipv4' }} } meta l4proto { {{ (proxy_mode === 'tun') ? 'tcp, udp' : 'udp' }} } jump homeproxy_mangle_lanac
+}
+
+chain mangle_output {
+	meta nfproto { {{ (ipv6_support === '1') ? 'ipv4, ipv6' : 'ipv4' }} } meta l4proto { {{ (proxy_mode === 'tun') ? 'tcp, udp' : 'udp' }} } jump homeproxy_mangle_tun
+}
+{% endif %}

luci-app-homeproxy/root/etc/homeproxy/scripts/firewall_pre.uc

@@ -0,0 +1,51 @@
+#!/usr/bin/ucode
+
+'use strict';
+
+import { writefile } from 'fs';
+import { cursor } from 'uci';
+import { isEmpty, RUN_DIR } from 'homeproxy';
+
+const cfgname = 'homeproxy';
+const uci = cursor();
+uci.load(cfgname);
+
+const routing_mode = uci.get(cfgname, 'config', 'routing_mode') || 'bypass_mainland_china',
+      proxy_mode = uci.get(cfgname, 'config', 'proxy_mode') || 'redirect_tproxy';
+
+let outbound_node, tun_name;
+if (match(proxy_mode, /tun/)) {
+	if (routing_mode === 'custom')
+		outbound_node = uci.get(cfgname, 'routing', 'default_outbound') || 'nil';
+	else
+		outbound_node = uci.get(cfgname, 'config', 'main_node') || 'nil';
+
+	if (outbound_node !== 'nil')
+		tun_name = uci.get(cfgname, 'infra', 'tun_name') || 'singtun0';
+}
+
+const server_enabled = uci.get(cfgname, 'server', 'enabled');
+
+let forward = [],
+    input = [];
+
+if (tun_name) {
+	push(forward, `oifname ${tun_name} counter accept comment "!${cfgname}: accept tun forward"`);
+	push(input ,`iifname ${tun_name} counter accept comment "!${cfgname}: accept tun input"`);
+}
+
+if (server_enabled === '1') {
+	uci.foreach(cfgname, 'server', (s) => {
+		if (s.enabled !== '1' || s.firewall !== '1')
+			return;
+
+		let proto = s.network || '{ tcp, udp }';
+		push(input, `meta l4proto ${proto} th dport ${s.port} counter accept comment "!${cfgname}: accept server ${s['.name']}"`);
+	});
+}
+
+if (!isEmpty(forward))
+	writefile(RUN_DIR + '/fw4_forward.nft', join('\n', forward) + '\n');
+
+if (!isEmpty(input))
+	writefile(RUN_DIR + '/fw4_input.nft', join('\n', input) + '\n');

luci-app-homeproxy/root/etc/homeproxy/scripts/generate_client.uc

@@ -0,0 +1,975 @@
+#!/usr/bin/ucode
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (C) 2023-2025 ImmortalWrt.org
+ */
+
+'use strict';
+
+import { readfile, writefile } from 'fs';
+import { isnan } from 'math';
+import { connect } from 'ubus';
+import { cursor } from 'uci';
+
+import {
+	isEmpty, parseURL, strToBool, strToInt, strToTime,
+	removeBlankAttrs, validation, HP_DIR, RUN_DIR
+} from 'homeproxy';
+
+const ubus = connect();
+
+/* const features = ubus.call('luci.homeproxy', 'singbox_get_features') || {}; */
+
+/* UCI config start */
+const uci = cursor();
+
+const uciconfig = 'homeproxy';
+uci.load(uciconfig);
+
+const uciinfra = 'infra',
+      ucimain = 'config',
+      ucicontrol = 'control';
+
+const ucidnssetting = 'dns',
+      ucidnsserver = 'dns_server',
+      ucidnsrule = 'dns_rule';
+
+const uciroutingsetting = 'routing',
+      uciroutingnode = 'routing_node',
+      uciroutingrule = 'routing_rule';
+
+const ucinode = 'node';
+const uciruleset = 'ruleset';
+
+const routing_mode = uci.get(uciconfig, ucimain, 'routing_mode') || 'bypass_mainland_china';
+
+let wan_dns = ubus.call('network.interface', 'status', {'interface': 'wan'})?.['dns-server']?.[0];
+if (!wan_dns)
+	wan_dns = (routing_mode in ['proxy_mainland_china', 'global']) ? '8.8.8.8' : '223.5.5.5';
+
+const dns_port = uci.get(uciconfig, uciinfra, 'dns_port') || '5333';
+
+const ntp_server = uci.get(uciconfig, uciinfra, 'ntp_server') || 'time.apple.com';
+
+const ipv6_support = uci.get(uciconfig, ucimain, 'ipv6_support') || '0';
+
+let main_node, main_udp_node, dedicated_udp_node, default_outbound, default_outbound_dns,
+    domain_strategy, sniff_override, dns_server, china_dns_server, dns_default_strategy,
+    dns_default_server, dns_disable_cache, dns_disable_cache_expire, dns_independent_cache,
+    dns_client_subnet, cache_file_store_rdrc, cache_file_rdrc_timeout, direct_domain_list,
+    proxy_domain_list;
+
+if (routing_mode !== 'custom') {
+	main_node = uci.get(uciconfig, ucimain, 'main_node') || 'nil';
+	main_udp_node = uci.get(uciconfig, ucimain, 'main_udp_node') || 'nil';
+	dedicated_udp_node = !isEmpty(main_udp_node) && !(main_udp_node in ['same', main_node]);
+
+	dns_server = uci.get(uciconfig, ucimain, 'dns_server');
+	if (isEmpty(dns_server) || dns_server === 'wan')
+		dns_server = wan_dns;
+
+	if (routing_mode === 'bypass_mainland_china') {
+		china_dns_server = uci.get(uciconfig, ucimain, 'china_dns_server');
+		if (isEmpty(china_dns_server) || type(china_dns_server) !== 'string' || china_dns_server === 'wan')
+			china_dns_server = wan_dns;
+	}
+	dns_default_strategy = (ipv6_support !== '1') ? 'ipv4_only' : null;
+
+	direct_domain_list = trim(readfile(HP_DIR + '/resources/direct_list.txt'));
+	if (direct_domain_list)
+		direct_domain_list = split(direct_domain_list, /[\r\n]/);
+
+	proxy_domain_list = trim(readfile(HP_DIR + '/resources/proxy_list.txt'));
+	if (proxy_domain_list)
+		proxy_domain_list = split(proxy_domain_list, /[\r\n]/);
+
+	sniff_override = uci.get(uciconfig, uciinfra, 'sniff_override') || '1';
+} else {
+	/* DNS settings */
+	dns_default_strategy = uci.get(uciconfig, ucidnssetting, 'default_strategy');
+	dns_default_server = uci.get(uciconfig, ucidnssetting, 'default_server');
+	dns_disable_cache = uci.get(uciconfig, ucidnssetting, 'disable_cache');
+	dns_disable_cache_expire = uci.get(uciconfig, ucidnssetting, 'disable_cache_expire');
+	dns_independent_cache = uci.get(uciconfig, ucidnssetting, 'independent_cache');
+	dns_client_subnet = uci.get(uciconfig, ucidnssetting, 'client_subnet');
+	cache_file_store_rdrc = uci.get(uciconfig, ucidnssetting, 'cache_file_store_rdrc'),
+	cache_file_rdrc_timeout = uci.get(uciconfig, ucidnssetting, 'cache_file_rdrc_timeout');
+
+	/* Routing settings */
+	default_outbound = uci.get(uciconfig, uciroutingsetting, 'default_outbound') || 'nil';
+	default_outbound_dns = uci.get(uciconfig, uciroutingsetting, 'default_outbound_dns') || 'default-dns';
+	domain_strategy = uci.get(uciconfig, uciroutingsetting, 'domain_strategy');
+	sniff_override = uci.get(uciconfig, uciroutingsetting, 'sniff_override');
+}
+
+const proxy_mode = uci.get(uciconfig, ucimain, 'proxy_mode') || 'redirect_tproxy',
+      default_interface = uci.get(uciconfig, ucicontrol, 'bind_interface');
+
+const mixed_port = uci.get(uciconfig, uciinfra, 'mixed_port') || '5330';
+
+let self_mark, redirect_port, tproxy_port, tun_name,
+    tun_addr4, tun_addr6, tun_mtu, tcpip_stack,
+    endpoint_independent_nat, udp_timeout;
+
+if (routing_mode === 'custom')
+	udp_timeout = uci.get(uciconfig, uciroutingsetting, 'udp_timeout');
+else
+	udp_timeout = uci.get(uciconfig, 'infra', 'udp_timeout');
+
+if (match(proxy_mode, /redirect/)) {
+	self_mark = uci.get(uciconfig, 'infra', 'self_mark') || '100';
+	redirect_port = uci.get(uciconfig, 'infra', 'redirect_port') || '5331';
+}
+if (match(proxy_mode), /tproxy/)
+	if (main_udp_node !== 'nil' || routing_mode === 'custom')
+		tproxy_port = uci.get(uciconfig, 'infra', 'tproxy_port') || '5332';
+if (match(proxy_mode), /tun/) {
+	tun_name = uci.get(uciconfig, uciinfra, 'tun_name') || 'singtun0';
+	tun_addr4 = uci.get(uciconfig, uciinfra, 'tun_addr4') || '172.19.0.1/30';
+	tun_addr6 = uci.get(uciconfig, uciinfra, 'tun_addr6') || 'fdfe:dcba:9876::1/126';
+	tun_mtu = uci.get(uciconfig, uciinfra, 'tun_mtu') || '9000';
+	tcpip_stack = 'system';
+	if (routing_mode === 'custom') {
+		tcpip_stack = uci.get(uciconfig, uciroutingsetting, 'tcpip_stack') || 'system';
+		endpoint_independent_nat = uci.get(uciconfig, uciroutingsetting, 'endpoint_independent_nat');
+	}
+}
+
+const log_level = uci.get(uciconfig, ucimain, 'log_level') || 'warn';
+/* UCI config end */
+
+/* Config helper start */
+function parse_port(strport) {
+	if (type(strport) !== 'array' || isEmpty(strport))
+		return null;
+
+	let ports = [];
+	for (let i in strport)
+		push(ports, int(i));
+
+	return ports;
+
+}
+
+function parse_dnsserver(server_addr, default_protocol) {
+	if (isEmpty(server_addr))
+		return null;
+
+	if (!match(server_addr, /:\/\//))
+		server_addr = (default_protocol || 'udp') + '://' + (validation('ip6addr', server_addr) ? `[${server_addr}]` : server_addr);
+	server_addr = parseURL(server_addr);
+
+	return {
+		type: server_addr.protocol,
+		server: server_addr.hostname,
+		server_port: strToInt(server_addr.port),
+		path: (server_addr.pathname !== '/') ? server_addr.pathname : null,
+	}
+}
+
+function parse_dnsquery(strquery) {
+	if (type(strquery) !== 'array' || isEmpty(strquery))
+		return null;
+
+	let querys = [];
+	for (let i in strquery)
+		isnan(int(i)) ? push(querys, i) : push(querys, int(i));
+
+	return querys;
+
+}
+
+function generate_endpoint(node) {
+	if (type(node) !== 'object' || isEmpty(node))
+		return null;
+
+	const endpoint = {
+		type: node.type,
+		tag: 'cfg-' + node['.name'] + '-out',
+		address: node.wireguard_local_address,
+		mtu: strToInt(node.wireguard_mtu),
+		private_key: node.wireguard_private_key,
+		peers: (node.type === 'wireguard') ? [
+			{
+				address: node.address,
+				port: strToInt(node.port),
+				allowed_ips: [
+					'0.0.0.0/0',
+					'::/0'
+				],
+				persistent_keepalive_interval: strToInt(node.wireguard_persistent_keepalive_interval),
+				public_key: node.wireguard_peer_public_key,
+				pre_shared_key: node.wireguard_pre_shared_key,
+				reserved: parse_port(node.wireguard_reserved),
+			}
+		] : null,
+		system: (node.type === 'wireguard') ? false : null,
+		tcp_fast_open: strToBool(node.tcp_fast_open),
+		tcp_multi_path: strToBool(node.tcp_multi_path),
+		udp_fragment: strToBool(node.udp_fragment)
+	};
+
+	return endpoint;
+}
+
+function generate_outbound(node) {
+	if (type(node) !== 'object' || isEmpty(node))
+		return null;
+
+	const outbound = {
+		type: node.type,
+		tag: 'cfg-' + node['.name'] + '-out',
+		routing_mark: strToInt(self_mark),
+
+		server: node.address,
+		server_port: strToInt(node.port),
+		/* Hysteria(2) */
+		server_ports: node.hysteria_hopping_port,
+
+		username: (node.type !== 'ssh') ? node.username : null,
+		user: (node.type === 'ssh') ? node.username : null,
+		password: node.password,
+
+		/* Direct */
+		override_address: node.override_address,
+		override_port: strToInt(node.override_port),
+		proxy_protocol: strToInt(node.proxy_protocol),
+		/* AnyTLS */
+		idle_session_check_interval: strToTime(node.anytls_idle_session_check_interval),
+		idle_session_timeout: strToTime(node.anytls_idle_session_timeout),
+		min_idle_session: strToInt(node.anytls_min_idle_session),
+		/* Hysteria (2) */
+		hop_interval: strToTime(node.hysteria_hop_interval),
+		up_mbps: strToInt(node.hysteria_up_mbps),
+		down_mbps: strToInt(node.hysteria_down_mbps),
+		obfs: node.hysteria_obfs_type ? {
+			type: node.hysteria_obfs_type,
+			password: node.hysteria_obfs_password
+		} : node.hysteria_obfs_password,
+		auth: (node.hysteria_auth_type === 'base64') ? node.hysteria_auth_payload : null,
+		auth_str: (node.hysteria_auth_type === 'string') ? node.hysteria_auth_payload : null,
+		recv_window_conn: strToInt(node.hysteria_recv_window_conn),
+		recv_window: strToInt(node.hysteria_revc_window),
+		disable_mtu_discovery: strToBool(node.hysteria_disable_mtu_discovery),
+		/* Shadowsocks */
+		method: node.shadowsocks_encrypt_method,
+		plugin: node.shadowsocks_plugin,
+		plugin_opts: node.shadowsocks_plugin_opts,
+		/* ShadowTLS / Socks */
+		version: (node.type === 'shadowtls') ? strToInt(node.shadowtls_version) : ((node.type === 'socks') ? node.socks_version : null),
+		/* SSH */
+		client_version: node.ssh_client_version,
+		host_key: node.ssh_host_key,
+		host_key_algorithms: node.ssh_host_key_algo,
+		private_key: node.ssh_priv_key,
+		private_key_passphrase: node.ssh_priv_key_pp,
+		/* Tuic */
+		uuid: node.uuid,
+		congestion_control: node.tuic_congestion_control,
+		udp_relay_mode: node.tuic_udp_relay_mode,
+		udp_over_stream: strToBool(node.tuic_udp_over_stream),
+		zero_rtt_handshake: strToBool(node.tuic_enable_zero_rtt),
+		heartbeat: strToTime(node.tuic_heartbeat),
+		/* VLESS / VMess */
+		flow: node.vless_flow,
+		alter_id: strToInt(node.vmess_alterid),
+		security: node.vmess_encrypt,
+		global_padding: strToBool(node.vmess_global_padding),
+		authenticated_length: strToBool(node.vmess_authenticated_length),
+		packet_encoding: node.packet_encoding,
+
+		multiplex: (node.multiplex === '1') ? {
+			enabled: true,
+			protocol: node.multiplex_protocol,
+			max_connections: strToInt(node.multiplex_max_connections),
+			min_streams: strToInt(node.multiplex_min_streams),
+			max_streams: strToInt(node.multiplex_max_streams),
+			padding: strToBool(node.multiplex_padding),
+			brutal: (node.multiplex_brutal === '1') ? {
+				enabled: true,
+				up_mbps: strToInt(node.multiplex_brutal_up),
+				down_mbps: strToInt(node.multiplex_brutal_down)
+			} : null
+		} : null,
+		tls: (node.tls === '1') ? {
+			enabled: true,
+			server_name: node.tls_sni,
+			insecure: strToBool(node.tls_insecure),
+			alpn: node.tls_alpn,
+			min_version: node.tls_min_version,
+			max_version: node.tls_max_version,
+			cipher_suites: node.tls_cipher_suites,
+			certificate_path: node.tls_cert_path,
+			ech: (node.tls_ech === '1') ? {
+				enabled: true,
+				config: node.tls_ech_config,
+				config_path: node.tls_ech_config_path
+			} : null,
+			utls: !isEmpty(node.tls_utls) ? {
+				enabled: true,
+				fingerprint: node.tls_utls
+			} : null,
+			reality: (node.tls_reality === '1') ? {
+				enabled: true,
+				public_key: node.tls_reality_public_key,
+				short_id: node.tls_reality_short_id
+			} : null
+		} : null,
+		transport: !isEmpty(node.transport) ? {
+			type: node.transport,
+			host: node.http_host || node.httpupgrade_host,
+			path: node.http_path || node.ws_path,
+			headers: node.ws_host ? {
+				Host: node.ws_host
+			} : null,
+			method: node.http_method,
+			max_early_data: strToInt(node.websocket_early_data),
+			early_data_header_name: node.websocket_early_data_header,
+			service_name: node.grpc_servicename,
+			idle_timeout: (node.http_idle_timeout),
+			ping_timeout: (node.http_ping_timeout),
+			permit_without_stream: strToBool(node.grpc_permit_without_stream)
+		} : null,
+		udp_over_tcp: (node.udp_over_tcp === '1') ? {
+			enabled: true,
+			version: strToInt(node.udp_over_tcp_version)
+		} : null,
+		tcp_fast_open: strToBool(node.tcp_fast_open),
+		tcp_multi_path: strToBool(node.tcp_multi_path),
+		udp_fragment: strToBool(node.udp_fragment)
+	};
+
+	return outbound;
+}
+
+function get_outbound(cfg) {
+	if (isEmpty(cfg))
+		return null;
+
+	if (type(cfg) === 'array') {
+		if ('any-out' in cfg)
+			return 'any';
+
+		let outbounds = [];
+		for (let i in cfg)
+			push(outbounds, get_outbound(i));
+		return outbounds;
+	} else {
+		switch (cfg) {
+		case 'block-out':
+		case 'direct-out':
+			return cfg;
+		default:
+			const node = uci.get(uciconfig, cfg, 'node');
+			if (isEmpty(node))
+				die(sprintf("%s's node is missing, please check your configuration.", cfg));
+			else if (node === 'urltest')
+				return 'cfg-' + cfg + '-out';
+			else
+				return 'cfg-' + node + '-out';
+		}
+	}
+}
+
+function get_resolver(cfg) {
+	if (isEmpty(cfg))
+		return null;
+
+	switch (cfg) {
+	case 'default-dns':
+	case 'system-dns':
+		return cfg;
+	default:
+		return 'cfg-' + cfg + '-dns';
+	}
+}
+
+function get_ruleset(cfg) {
+	if (isEmpty(cfg))
+		return null;
+
+	let rules = [];
+	for (let i in cfg)
+		push(rules, isEmpty(i) ? null : 'cfg-' + i + '-rule');
+	return rules;
+}
+/* Config helper end */
+
+const config = {};
+
+/* Log */
+config.log = {
+	disabled: false,
+	level: log_level,
+	output: RUN_DIR + '/sing-box-c.log',
+	timestamp: true
+};
+
+/* NTP */
+if (!isEmpty(ntp_server))
+	config.ntp = {
+		enabled: true,
+		server: ntp_server,
+		detour: 'direct-out',
+		domain_resolver: 'default-dns',
+	};
+
+/* DNS start */
+/* Default settings */
+config.dns = {
+	servers: [
+		{
+			tag: 'default-dns',
+			type: 'udp',
+			server: wan_dns,
+			detour: self_mark ? 'direct-out' : null
+		},
+		{
+			tag: 'system-dns',
+			type: 'local',
+			detour: self_mark ? 'direct-out' : null
+		}
+	],
+	rules: [],
+	strategy: dns_default_strategy,
+	disable_cache: strToBool(dns_disable_cache),
+	disable_expire: strToBool(dns_disable_cache_expire),
+	independent_cache: strToBool(dns_independent_cache),
+	client_subnet: dns_client_subnet
+};
+
+if (!isEmpty(main_node)) {
+	/* Main DNS */
+	push(config.dns.servers, {
+		tag: 'main-dns',
+		domain_resolver: {
+			server: 'default-dns',
+			strategy: (ipv6_support !== '1') ? 'ipv4_only' : null
+		},
+		detour: 'main-out',
+		...parse_dnsserver(dns_server, 'tcp')
+	});
+	config.dns.final = 'main-dns';
+
+	if (length(direct_domain_list))
+		push(config.dns.rules, {
+			rule_set: 'direct-domain',
+			action: 'route',
+			server: (routing_mode === 'bypass_mainland_china') ? 'china-dns' : 'default-dns'
+		});
+
+	/* Filter out SVCB/HTTPS queries for "exquisite" Apple devices */
+	if (routing_mode === 'gfwlist' || length(proxy_domain_list))
+		push(config.dns.rules, {
+			rule_set: (routing_mode !== 'gfwlist') ? 'proxy-domain' : null,
+			query_type: [64, 65],
+			action: 'reject'
+		});
+
+	if (routing_mode === 'bypass_mainland_china') {
+		push(config.dns.servers, {
+			tag: 'china-dns',
+			domain_resolver: {
+				server: 'default-dns',
+				strategy: 'prefer_ipv6'
+			},
+			detour: self_mark ? 'direct-out' : null,
+			...parse_dnsserver(china_dns_server)
+		});
+
+		if (length(proxy_domain_list))
+			push(config.dns.rules, {
+				rule_set: 'proxy-domain',
+				action: 'route',
+				server: 'main-dns'
+			});
+
+		push(config.dns.rules, {
+			rule_set: 'geosite-cn',
+			action: 'route',
+			server: 'china-dns',
+			strategy: 'prefer_ipv6'
+		});
+		push(config.dns.rules, {
+			type: 'logical',
+			mode: 'and',
+			rules: [
+				{
+					rule_set: 'geosite-noncn',
+					invert: true
+				},
+				{
+					rule_set: 'geoip-cn'
+				}
+			],
+			action: 'route',
+			server: 'china-dns',
+			strategy: 'prefer_ipv6'
+		});
+	}
+} else if (!isEmpty(default_outbound)) {
+	/* DNS servers */
+	uci.foreach(uciconfig, ucidnsserver, (cfg) => {
+		if (cfg.enabled !== '1')
+			return;
+
+		let outbound = get_outbound(cfg.outbound);
+		if (outbound === 'direct-out' && isEmpty(self_mark))
+			outbound = null;
+
+		push(config.dns.servers, {
+			tag: 'cfg-' + cfg['.name'] + '-dns',
+			type: cfg.type,
+			server: cfg.server,
+			server_port: strToInt(cfg.server_port),
+			path: cfg.path,
+			headers: cfg.headers,
+			tls: cfg.tls_sni ? {
+				enabled: true,
+				server_name: cfg.tls_sni
+			} : null,
+			domain_resolver: (cfg.address_resolver || cfg.address_strategy) ? {
+				server: get_resolver(cfg.address_resolver || dns_default_server),
+				strategy: cfg.address_strategy
+			} : null,
+			detour: outbound
+		});
+	});
+
+	/* DNS rules */
+	uci.foreach(uciconfig, ucidnsrule, (cfg) => {
+		if (cfg.enabled !== '1')
+			return;
+
+		push(config.dns.rules, {
+			ip_version: strToInt(cfg.ip_version),
+			query_type: parse_dnsquery(cfg.query_type),
+			network: cfg.network,
+			protocol: cfg.protocol,
+			domain: cfg.domain,
+			domain_suffix: cfg.domain_suffix,
+			domain_keyword: cfg.domain_keyword,
+			domain_regex: cfg.domain_regex,
+			port: parse_port(cfg.port),
+			port_range: cfg.port_range,
+			source_ip_cidr: cfg.source_ip_cidr,
+			source_ip_is_private: strToBool(cfg.source_ip_is_private),
+			ip_cidr: cfg.ip_cidr,
+			ip_is_private: strToBool(cfg.ip_is_private),
+			source_port: parse_port(cfg.source_port),
+			source_port_range: cfg.source_port_range,
+			process_name: cfg.process_name,
+			process_path: cfg.process_path,
+			process_path_regex: cfg.process_path_regex,
+			user: cfg.user,
+			rule_set: get_ruleset(cfg.rule_set),
+			rule_set_ip_cidr_match_source: strToBool(cfg.rule_set_ip_cidr_match_source),
+			invert: strToBool(cfg.invert),
+			outbound: get_outbound(cfg.outbound),
+			action: cfg.action,
+			server: get_resolver(cfg.server),
+			strategy: cfg.domain_strategy,
+			disable_cache: strToBool(cfg.dns_disable_cache),
+			rewrite_ttl: strToInt(cfg.rewrite_ttl),
+			client_subnet: cfg.client_subnet,
+			method: cfg.reject_method,
+			no_drop: strToBool(cfg.reject_no_drop),
+			rcode: cfg.predefined_rcode,
+			answer: cfg.predefined_answer,
+			ns: cfg.predefined_ns,
+			extra: cfg.predefined_extra
+		});
+	});
+
+	if (isEmpty(config.dns.rules))
+		config.dns.rules = null;
+
+	config.dns.final = get_resolver(dns_default_server);
+}
+/* DNS end */
+
+/* Inbound start */
+config.inbounds = [];
+
+push(config.inbounds, {
+	type: 'direct',
+	tag: 'dns-in',
+	listen: '::',
+	listen_port: int(dns_port)
+});
+
+push(config.inbounds, {
+	type: 'mixed',
+	tag: 'mixed-in',
+	listen: '::',
+	listen_port: int(mixed_port),
+	udp_timeout: strToTime(udp_timeout),
+	sniff: true,
+	sniff_override_destination: strToBool(sniff_override),
+	set_system_proxy: false
+});
+
+if (match(proxy_mode, /redirect/))
+	push(config.inbounds, {
+		type: 'redirect',
+		tag: 'redirect-in',
+
+		listen: '::',
+		listen_port: int(redirect_port),
+		sniff: true,
+		sniff_override_destination: strToBool(sniff_override)
+	});
+if (match(proxy_mode, /tproxy/))
+	push(config.inbounds, {
+		type: 'tproxy',
+		tag: 'tproxy-in',
+
+		listen: '::',
+		listen_port: int(tproxy_port),
+		network: 'udp',
+		udp_timeout: strToTime(udp_timeout),
+		sniff: true,
+		sniff_override_destination: strToBool(sniff_override)
+	});
+if (match(proxy_mode, /tun/))
+	push(config.inbounds, {
+		type: 'tun',
+		tag: 'tun-in',
+
+		interface_name: tun_name,
+		address: (ipv6_support === '1') ? [tun_addr4, tun_addr6] : [tun_addr4],
+		mtu: strToInt(tun_mtu),
+		auto_route: false,
+		endpoint_independent_nat: strToBool(endpoint_independent_nat),
+		udp_timeout: strToTime(udp_timeout),
+		stack: tcpip_stack,
+		sniff: true,
+		sniff_override_destination: strToBool(sniff_override)
+	});
+/* Inbound end */
+
+/* Outbound start */
+config.endpoints = [];
+
+/* Default outbounds */
+config.outbounds = [
+	{
+		type: 'direct',
+		tag: 'direct-out',
+		routing_mark: strToInt(self_mark)
+	},
+	{
+		type: 'block',
+		tag: 'block-out'
+	}
+];
+
+/* Main outbounds */
+if (!isEmpty(main_node)) {
+	let urltest_nodes = [];
+
+	if (main_node === 'urltest') {
+		const main_urltest_nodes = uci.get(uciconfig, ucimain, 'main_urltest_nodes') || [];
+		const main_urltest_interval = uci.get(uciconfig, ucimain, 'main_urltest_interval');
+		const main_urltest_tolerance = uci.get(uciconfig, ucimain, 'main_urltest_tolerance');
+
+		push(config.outbounds, {
+			type: 'urltest',
+			tag: 'main-out',
+			outbounds: map(main_urltest_nodes, (k) => `cfg-${k}-out`),
+			interval: strToTime(main_urltest_interval),
+			tolerance: strToInt(main_urltest_tolerance),
+			idle_timeout: (strToInt(main_urltest_interval) > 1800) ? `${main_urltest_interval * 2}s` : null,
+		});
+		urltest_nodes = main_urltest_nodes;
+	} else {
+		const main_node_cfg = uci.get_all(uciconfig, main_node) || {};
+		if (main_node_cfg.type === 'wireguard') {
+			push(config.endpoints, generate_endpoint(main_node_cfg));
+			config.endpoints[length(config.endpoints)-1].tag = 'main-out';
+		} else {
+			push(config.outbounds, generate_outbound(main_node_cfg));
+			config.outbounds[length(config.outbounds)-1].tag = 'main-out';
+		}
+	}
+
+	if (main_udp_node === 'urltest') {
+		const main_udp_urltest_nodes = uci.get(uciconfig, ucimain, 'main_udp_urltest_nodes') || [];
+		const main_udp_urltest_interval = uci.get(uciconfig, ucimain, 'main_udp_urltest_interval');
+		const main_udp_urltest_tolerance = uci.get(uciconfig, ucimain, 'main_udp_urltest_tolerance');
+
+		push(config.outbounds, {
+			type: 'urltest',
+			tag: 'main-udp-out',
+			outbounds: map(main_udp_urltest_nodes, (k) => `cfg-${k}-out`),
+			interval: strToTime(main_udp_urltest_interval),
+			tolerance: strToInt(main_udp_urltest_tolerance),
+			idle_timeout: (strToInt(main_udp_urltest_interval) > 1800) ? `${main_udp_urltest_interval * 2}s` : null,
+		});
+		urltest_nodes = [...urltest_nodes, ...filter(main_udp_urltest_nodes, (l) => !~index(urltest_nodes, l))];
+	} else if (dedicated_udp_node) {
+		const main_udp_node_cfg = uci.get_all(uciconfig, main_udp_node) || {};
+		if (main_udp_node_cfg.type === 'wireguard') {
+			push(config.endpoints, generate_endpoint(main_udp_node_cfg));
+			config.endpoints[length(config.endpoints)-1].tag = 'main-udp-out';
+		} else {
+			push(config.outbounds, generate_outbound(main_udp_node_cfg));
+			config.outbounds[length(config.outbounds)-1].tag = 'main-udp-out';
+		}
+	}
+
+	for (let i in urltest_nodes) {
+		const urltest_node = uci.get_all(uciconfig, i) || {};
+		if (urltest_node.type === 'wireguard') {
+			push(config.endpoints, generate_endpoint(urltest_node));
+			config.endpoints[length(config.endpoints)-1].tag = 'cfg-' + i + '-out';
+		} else {
+			push(config.outbounds, generate_outbound(urltest_node));
+			config.outbounds[length(config.outbounds)-1].tag = 'cfg-' + i + '-out';
+		}
+	}
+} else if (!isEmpty(default_outbound)) {
+	let urltest_nodes = [],
+	    routing_nodes = [];
+
+	uci.foreach(uciconfig, uciroutingnode, (cfg) => {
+		if (cfg.enabled !== '1')
+			return;
+
+		if (cfg.node === 'urltest') {
+			push(config.outbounds, {
+				type: 'urltest',
+				tag: 'cfg-' + cfg['.name'] + '-out',
+				outbounds: map(cfg.urltest_nodes, (k) => `cfg-${k}-out`),
+				url: cfg.urltest_url,
+				interval: strToTime(cfg.urltest_interval),
+				tolerance: strToInt(cfg.urltest_tolerance),
+				idle_timeout: strToTime(cfg.urltest_idle_timeout),
+				interrupt_exist_connections: strToBool(cfg.urltest_interrupt_exist_connections)
+			});
+			urltest_nodes = [...urltest_nodes, ...filter(cfg.urltest_nodes, (l) => !~index(urltest_nodes, l))];
+		} else {
+			const outbound = uci.get_all(uciconfig, cfg.node) || {};
+			if (outbound.type === 'wireguard') {
+				push(config.endpoints, generate_endpoint(outbound));
+				config.endpoints[length(config.endpoints)-1].bind_interface = cfg.bind_interface;
+				config.endpoints[length(config.endpoints)-1].detour = get_outbound(cfg.outbound);
+				if (cfg.domain_resolver)
+					config.endpoints[length(config.endpoints)-1].domain_resolver = {
+						server: get_resolver(cfg.domain_resolver),
+						strategy: cfg.domain_strategy
+					};
+			} else {
+				push(config.outbounds, generate_outbound(outbound));
+				config.outbounds[length(config.outbounds)-1].bind_interface = cfg.bind_interface;
+				config.outbounds[length(config.outbounds)-1].detour = get_outbound(cfg.outbound);
+				if (cfg.domain_resolver)
+					config.outbounds[length(config.outbounds)-1].domain_resolver = {
+						server: get_resolver(cfg.domain_resolver),
+						strategy: cfg.domain_strategy
+					};
+			}
+			push(routing_nodes, cfg.node);
+		}
+	});
+
+	for (let i in filter(urltest_nodes, (l) => !~index(routing_nodes, l))) {
+		const urltest_node = uci.get_all(uciconfig, i) || {};
+		if (urltest_node.type === 'wireguard')
+			push(config.endpoints, generate_endpoint(urltest_node));
+		else
+			push(config.outbounds, generate_outbound(urltest_node));
+	}
+}
+
+if (isEmpty(config.endpoints))
+	config.endpoints = null;
+/* Outbound end */
+
+/* Routing rules start */
+/* Default settings */
+config.route = {
+	rules: [
+		{
+			inbound: 'dns-in',
+			action: 'hijack-dns'
+		}
+		/*
+		 * leave for sing-box 1.13.0
+		 * {
+		 * 	action: 'sniff'
+		 * }
+		 */
+	],
+	rule_set: [],
+	auto_detect_interface: isEmpty(default_interface) ? true : null,
+	default_interface: default_interface
+};
+
+/* Routing rules */
+if (!isEmpty(main_node)) {
+	/* Avoid DNS loop */
+	config.route.default_domain_resolver = {
+		action: 'route',
+		server: (routing_mode === 'bypass_mainland_china') ? 'china-dns' : 'default-dns',
+		strategy: (ipv6_support !== '1') ? 'prefer_ipv4' : null
+	};
+
+	/* Direct list */
+	if (length(direct_domain_list))
+		push(config.route.rules, {
+			rule_set: 'direct-domain',
+			action: 'route',
+			outbound: 'direct-out'
+		});
+
+	/* Main UDP out */
+	if (dedicated_udp_node)
+		push(config.route.rules, {
+			network: 'udp',
+			action: 'route',
+			outbound: 'main-udp-out'
+		});
+
+	config.route.final = 'main-out';
+
+	/* Rule set */
+	/* Direct list */
+	if (length(direct_domain_list))
+		push(config.route.rule_set, {
+			type: 'inline',
+			tag: 'direct-domain',
+			rules: [
+				{
+					domain_keyword: direct_domain_list,
+				}
+			]
+		});
+
+	/* Proxy list */
+	if (length(proxy_domain_list))
+		push(config.route.rule_set, {
+			type: 'inline',
+			tag: 'proxy-domain',
+			rules: [
+				{
+					domain_keyword: proxy_domain_list,
+				}
+			]
+		});
+
+	if (routing_mode === 'bypass_mainland_china') {
+		push(config.route.rule_set, {
+			type: 'remote',
+			tag: 'geoip-cn',
+			format: 'binary',
+			url: 'https://fastly.jsdelivr.net/gh/1715173329/IPCIDR-CHINA@rule-set/cn.srs',
+			download_detour: 'main-out'
+		});
+		push(config.route.rule_set, {
+			type: 'remote',
+			tag: 'geosite-cn',
+			format: 'binary',
+			url: 'https://fastly.jsdelivr.net/gh/1715173329/sing-geosite@rule-set-unstable/geosite-geolocation-cn.srs',
+			download_detour: 'main-out'
+		});
+		push(config.route.rule_set, {
+			type: 'remote',
+			tag: 'geosite-noncn',
+			format: 'binary',
+			url: 'https://fastly.jsdelivr.net/gh/1715173329/sing-geosite@rule-set-unstable/geosite-geolocation-!cn.srs',
+			download_detour: 'main-out'
+		});
+	}
+
+	if (isEmpty(config.route.rule_set))
+		config.route.rule_set = null;
+} else if (!isEmpty(default_outbound)) {
+	config.route.default_domain_resolver = {
+		action: 'resolve',
+		server: get_resolver(default_outbound_dns)
+	};
+
+	if (domain_strategy)
+		push(config.route.rules, {
+			action: 'resolve',
+			strategy: domain_strategy
+		});
+
+	uci.foreach(uciconfig, uciroutingrule, (cfg) => {
+		if (cfg.enabled !== '1')
+			return null;
+
+		push(config.route.rules, {
+			ip_version: strToInt(cfg.ip_version),
+			protocol: cfg.protocol,
+			network: cfg.network,
+			domain: cfg.domain,
+			domain_suffix: cfg.domain_suffix,
+			domain_keyword: cfg.domain_keyword,
+			domain_regex: cfg.domain_regex,
+			source_ip_cidr: cfg.source_ip_cidr,
+			source_ip_is_private: strToBool(cfg.source_ip_is_private),
+			ip_cidr: cfg.ip_cidr,
+			ip_is_private: strToBool(cfg.ip_is_private),
+			source_port: parse_port(cfg.source_port),
+			source_port_range: cfg.source_port_range,
+			port: parse_port(cfg.port),
+			port_range: cfg.port_range,
+			process_name: cfg.process_name,
+			process_path: cfg.process_path,
+			process_path_regex: cfg.process_path_regex,
+			user: cfg.user,
+			rule_set: get_ruleset(cfg.rule_set),
+			rule_set_ip_cidr_match_source: strToBool(cfg.rule_set_ip_cidr_match_source),
+			rule_set_ip_cidr_accept_empty: strToBool(cfg.rule_set_ip_cidr_accept_empty),
+			invert: strToBool(cfg.invert),
+			action: cfg.action,
+			outbound: get_outbound(cfg.outbound),
+			override_address: cfg.override_address,
+			override_port: strToInt(cfg.override_port),
+			udp_disable_domain_unmapping: strToBool(cfg.udp_disable_domain_unmapping),
+			udp_connect: strToBool(cfg.udp_connect),
+			udp_timeout: strToTime(cfg.udp_timeout),
+			tls_fragment: strToBool(cfg.tls_fragment),
+			tls_fragment_fallback_delay: strToTime(cfg.tls_fragment_fallback_delay),
+			tls_record_fragment: strToBool(cfg.tls_record_fragment)
+		});
+	});
+
+	config.route.final = get_outbound(default_outbound);
+
+	/* Rule set */
+	uci.foreach(uciconfig, uciruleset, (cfg) => {
+		if (cfg.enabled !== '1')
+			return null;
+
+		push(config.route.rule_set, {
+			type: cfg.type,
+			tag: 'cfg-' + cfg['.name'] + '-rule',
+			format: cfg.format,
+			path: cfg.path,
+			url: cfg.url,
+			download_detour: get_outbound(cfg.outbound),
+			update_interval: cfg.update_interval
+		});
+	});
+}
+/* Routing rules end */
+
+/* Experimental start */
+if (routing_mode in ['bypass_mainland_china', 'custom']) {
+	config.experimental = {
+		cache_file: {
+			enabled: true,
+			path: RUN_DIR + '/cache.db',
+			store_rdrc: strToBool(cache_file_store_rdrc),
+			rdrc_timeout: strToTime(cache_file_rdrc_timeout),
+		}
+	};
+}
+/* Experimental end */
+
+system('mkdir -p ' + RUN_DIR);
+writefile(RUN_DIR + '/sing-box-c.json', sprintf('%.J\n', removeBlankAttrs(config)));

luci-app-homeproxy/root/etc/homeproxy/scripts/generate_server.uc

@@ -0,0 +1,185 @@
+#!/usr/bin/ucode
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (C) 2023 ImmortalWrt.org
+ */
+
+'use strict';
+
+import { writefile } from 'fs';
+import { cursor } from 'uci';
+
+import {
+	isEmpty, strToBool, strToInt, strToTime,
+	removeBlankAttrs, HP_DIR, RUN_DIR
+} from 'homeproxy';
+
+/* UCI config start */
+const uci = cursor();
+
+const uciconfig = 'homeproxy';
+uci.load(uciconfig);
+
+const uciserver = 'server';
+
+const log_level = uci.get(uciconfig, uciserver, 'log_level') || 'warn';
+/* UCI config end */
+
+const config = {};
+
+/* Log */
+config.log = {
+	disabled: false,
+	level: log_level,
+	output: RUN_DIR + '/sing-box-s.log',
+	timestamp: true
+};
+
+config.inbounds = [];
+
+uci.foreach(uciconfig, uciserver, (cfg) => {
+	if (cfg.enabled !== '1')
+		return;
+
+	push(config.inbounds, {
+		type: cfg.type,
+		tag: 'cfg-' + cfg['.name'] + '-in',
+
+		listen: cfg.address || '::',
+		listen_port: strToInt(cfg.port),
+		bind_interface: cfg.bind_interface,
+		reuse_addr: strToBool(cfg.reuse_addr),
+		tcp_fast_open: strToBool(cfg.tcp_fast_open),
+		tcp_multi_path: strToBool(cfg.tcp_multi_path),
+		udp_fragment: strToBool(cfg.udp_fragment),
+		udp_timeout: strToTime(cfg.udp_timeout),
+		network: cfg.network,
+
+		/* AnyTLS */
+		padding_scheme: cfg.anytls_padding_scheme,
+
+		/* Hysteria */
+		up_mbps: strToInt(cfg.hysteria_up_mbps),
+		down_mbps: strToInt(cfg.hysteria_down_mbps),
+		obfs: cfg.hysteria_obfs_type ? {
+			type: cfg.hysteria_obfs_type,
+			password: cfg.hysteria_obfs_password
+		} : cfg.hysteria_obfs_password,
+		recv_window_conn: strToInt(cfg.hysteria_recv_window_conn),
+		recv_window_client: strToInt(cfg.hysteria_revc_window_client),
+		max_conn_client: strToInt(cfg.hysteria_max_conn_client),
+		disable_mtu_discovery: strToBool(cfg.hysteria_disable_mtu_discovery),
+		ignore_client_bandwidth: strToBool(cfg.hysteria_ignore_client_bandwidth),
+		masquerade: cfg.hysteria_masquerade,
+
+		/* Shadowsocks */
+		method: (cfg.type === 'shadowsocks') ? cfg.shadowsocks_encrypt_method : null,
+		password: (cfg.type in ['shadowsocks', 'shadowtls']) ? cfg.password : null,
+
+		/* Tuic */
+		congestion_control: cfg.tuic_congestion_control,
+		auth_timeout: strToTime(cfg.tuic_auth_timeout),
+		zero_rtt_handshake: strToBool(cfg.tuic_enable_zero_rtt),
+		heartbeat: strToTime(cfg.tuic_heartbeat),
+
+		/* AnyTLS / HTTP / Hysteria (2) / Mixed / Socks / Trojan / Tuic / VLESS / VMess */
+		users: (cfg.type !== 'shadowsocks') ? [
+			{
+				name: !(cfg.type in ['http', 'mixed', 'naive', 'socks']) ? 'cfg-' + cfg['.name'] + '-server' : null,
+				username: cfg.username,
+				password: cfg.password,
+
+				/* Hysteria */
+				auth: (cfg.hysteria_auth_type === 'base64') ? cfg.hysteria_auth_payload : null,
+				auth_str: (cfg.hysteria_auth_type === 'string') ? cfg.hysteria_auth_payload : null,
+
+				/* Tuic */
+				uuid: cfg.uuid,
+
+				/* VLESS / VMess */
+				flow: cfg.vless_flow,
+				alterId: strToInt(cfg.vmess_alterid)
+			}
+		] : null,
+
+		multiplex: (cfg.multiplex === '1') ? {
+			enabled: true,
+			padding: strToBool(cfg.multiplex_padding),
+			brutal: (cfg.multiplex_brutal === '1') ? {
+				enabled: true,
+				up_mbps: strToInt(cfg.multiplex_brutal_up),
+				down_mbps: strToInt(cfg.multiplex_brutal_down)
+			} : null
+		} : null,
+
+		tls: (cfg.tls === '1') ? {
+			enabled: true,
+			server_name: cfg.tls_sni,
+			alpn: cfg.tls_alpn,
+			min_version: cfg.tls_min_version,
+			max_version: cfg.tls_max_version,
+			cipher_suites: cfg.tls_cipher_suites,
+			certificate_path: cfg.tls_cert_path,
+			key_path: cfg.tls_key_path,
+			acme: (cfg.tls_acme === '1') ? {
+				domain: cfg.tls_acme_domain,
+				data_directory: HP_DIR + '/certs',
+				default_server_name: cfg.tls_acme_dsn,
+				email: cfg.tls_acme_email,
+				provider: cfg.tls_acme_provider,
+				disable_http_challenge: strToBool(cfg.tls_acme_dhc),
+				disable_tls_alpn_challenge: (cfg.tls_acme_dtac),
+				alternative_http_port: strToInt(cfg.tls_acme_ahp),
+				alternative_tls_port: strToInt(cfg.tls_acme_atp),
+				external_account: (cfg.tls_acme_external_account === '1') ? {
+					key_id: cfg.tls_acme_ea_keyid,
+					mac_key: cfg.tls_acme_ea_mackey
+				} : null,
+				dns01_challenge: (cfg.tls_dns01_challenge === '1') ? {
+					provider: cfg.tls_dns01_provider,
+					access_key_id: cfg.tls_dns01_ali_akid,
+					access_key_secret: cfg.tls_dns01_ali_aksec,
+					region_id: cfg.tls_dns01_ali_rid,
+					api_token: cfg.tls_dns01_cf_api_token
+				} : null
+			} : null,
+			ech: (cfg.tls_ech_key) ? {
+				enabled: true,
+				key: split(cfg.tls_ech_key, '\n'),
+				// config: split(cfg.tls_ech_config, '\n')
+			} : null,
+			reality: (cfg.tls_reality === '1') ? {
+				enabled: true,
+				private_key: cfg.tls_reality_private_key,
+				short_id: cfg.tls_reality_short_id,
+				max_time_difference: strToTime(cfg.tls_reality_max_time_difference),
+				handshake: {
+					server: cfg.tls_reality_server_addr,
+					server_port: strToInt(cfg.tls_reality_server_port)
+					}
+			} : null
+		} : null,
+
+		transport: !isEmpty(cfg.transport) ? {
+			type: cfg.transport,
+			host: cfg.http_host || cfg.httpupgrade_host,
+			path: cfg.http_path || cfg.ws_path,
+			headers: cfg.ws_host ? {
+				Host: cfg.ws_host
+			} : null,
+			method: cfg.http_method,
+			max_early_data: strToInt(cfg.websocket_early_data),
+			early_data_header_name: cfg.websocket_early_data_header,
+			service_name: cfg.grpc_servicename,
+			idle_timeout: strToTime(cfg.http_idle_timeout),
+			ping_timeout: strToTime(cfg.http_ping_timeout)
+		} : null
+	});
+});
+
+if (length(config.inbounds) === 0)
+	exit(1);
+
+system('mkdir -p ' + RUN_DIR);
+writefile(RUN_DIR + '/sing-box-s.json', sprintf('%.J\n', removeBlankAttrs(config)));

luci-app-homeproxy/root/etc/homeproxy/scripts/homeproxy.uc

@@ -0,0 +1,230 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (C) 2023 ImmortalWrt.org
+ */
+
+import { mkstemp } from 'fs';
+import { urldecode_params } from 'luci.http';
+
+/* Global variables start */
+export const HP_DIR = '/etc/homeproxy';
+export const RUN_DIR = '/var/run/homeproxy';
+/* Global variables end */
+
+/* Utilities start */
+/* Kanged from luci-app-commands */
+export function shellQuote(s) {
+	return `'${replace(s, "'", "'\\''")}'`;
+};
+
+export function isBinary(str) {
+	for (let off = 0, byte = ord(str); off < length(str); byte = ord(str, ++off))
+		if (byte <= 8 || (byte >= 14 && byte <= 31))
+			return true;
+
+	return false;
+};
+
+export function executeCommand(...args) {
+	let outfd = mkstemp();
+	let errfd = mkstemp();
+
+	const exitcode = system(`${join(' ', args)} >&${outfd.fileno()} 2>&${errfd.fileno()}`);
+
+	outfd.seek(0);
+	errfd.seek(0);
+
+	const stdout = outfd.read(1024 * 512) ?? '';
+	const stderr = errfd.read(1024 * 512) ?? '';
+
+	outfd.close();
+	errfd.close();
+
+	const binary = isBinary(stdout);
+
+	return {
+		command: join(' ', args),
+		stdout: binary ? null : stdout,
+		stderr,
+		exitcode,
+		binary
+	};
+};
+
+export function getTime(epoch) {
+	const local_time = localtime(epoch);
+	return replace(replace(sprintf(
+		'%d-%2d-%2d@%2d:%2d:%2d',
+		local_time.year,
+		local_time.mon,
+		local_time.mday,
+		local_time.hour,
+		local_time.min,
+		local_time.sec
+	), ' ', '0'), '@', ' ');
+
+};
+
+export function wGET(url, ua) {
+	if (!url || type(url) !== 'string')
+		return null;
+
+	if (!ua)
+		ua = 'Wget/1.21 (HomeProxy, like v2rayN)';
+
+	const output = executeCommand(`/usr/bin/wget -qO- --user-agent ${shellQuote(ua)} --timeout=10 ${shellQuote(url)}`) || {};
+	return trim(output.stdout);
+};
+/* Utilities end */
+
+/* String helper start */
+export function isEmpty(res) {
+	return !res || res === 'nil' || (type(res) in ['array', 'object'] && length(res) === 0);
+};
+
+export function strToBool(str) {
+	return (str === '1') || null;
+};
+
+export function strToInt(str) {
+	return !isEmpty(str) ? (int(str) || null) : null;
+};
+
+export function strToTime(str) {
+	return !isEmpty(str) ? (str + 's') : null;
+};
+
+export function removeBlankAttrs(res) {
+	let content;
+
+	if (type(res) === 'object') {
+		content = {};
+		map(keys(res), (k) => {
+			if (type(res[k]) in ['array', 'object'])
+				content[k] = removeBlankAttrs(res[k]);
+			else if (res[k] !== null && res[k] !== '')
+				content[k] = res[k];
+		});
+	} else if (type(res) === 'array') {
+		content = [];
+		map(res, (k, i) => {
+			if (type(k) in ['array', 'object'])
+				push(content, removeBlankAttrs(k));
+			else if (k !== null && k !== '')
+				push(content, k);
+		});
+	} else
+		return res;
+
+	return content;
+};
+
+export function validateHostname(hostname) {
+	return (match(hostname, /^[a-zA-Z0-9_]+$/) != null ||
+		(match(hostname, /^[a-zA-Z0-9_][a-zA-Z0-9_%-.]*[a-zA-Z0-9]$/) &&
+			match(hostname, /[^0-9.]/)));
+};
+
+export function validation(datatype, data) {
+	if (!datatype || !data)
+		return null;
+
+	const ret = system(`/sbin/validate_data ${shellQuote(datatype)} ${shellQuote(data)} 2>/dev/null`);
+	return (ret === 0);
+};
+/* String helper end */
+
+/* String parser start */
+export function decodeBase64Str(str) {
+	if (isEmpty(str))
+		return null;
+
+	str = trim(str);
+	str = replace(str, '_', '/');
+	str = replace(str, '-', '+');
+
+	const padding = length(str) % 4;
+	if (padding)
+		str = str + substr('====', padding);
+
+	return b64dec(str);
+};
+
+export function parseURL(url) {
+	if (type(url) !== 'string')
+		return null;
+
+	const services = {
+		http: '80',
+		https: '443'
+	};
+
+	const objurl = {};
+
+	objurl.href = url;
+
+	url = replace(url, /#(.+)$/, (_, val) => {
+		objurl.hash = val;
+		return '';
+	});
+
+	url = replace(url, /^(\w[A-Za-z0-9\+\-\.]+):/, (_, val) => {
+		objurl.protocol = val;
+		return '';
+	});
+
+	url = replace(url, /\?(.+)/, (_, val) => {
+		objurl.search = val;
+		objurl.searchParams = urldecode_params(val);
+		return '';
+	});
+
+	url = replace(url, /^\/\/([^\/]+)/, (_, val) => {
+		val = replace(val, /^([^@]+)@/, (_, val) => {
+			objurl.userinfo = val;
+			return '';
+		});
+
+		val = replace(val, /:(\d+)$/, (_, val) => {
+			objurl.port = val;
+			return '';
+		});
+
+		if (validation('ip4addr', val) ||
+		    validation('ip6addr', replace(val, /\[|\]/g, '')) ||
+		    validation('hostname', val))
+			objurl.hostname = val;
+
+		return '';
+	});
+
+	objurl.pathname = url || '/';
+
+	if (!objurl.protocol || !objurl.hostname)
+		return null;
+
+	if (objurl.userinfo) {
+		objurl.userinfo = replace(objurl.userinfo, /:(.+)$/, (_, val) => {
+			objurl.password = val;
+			return '';
+		});
+
+		if (match(objurl.userinfo, /^[A-Za-z0-9\+\-\_\.]+$/)) {
+			objurl.username = objurl.userinfo;
+			delete objurl.userinfo;
+		} else {
+			delete objurl.userinfo;
+			delete objurl.password;
+		}
+	};
+
+	if (!objurl.port)
+		objurl.port = services[objurl.protocol];
+
+	objurl.host = objurl.hostname + (objurl.port ? `:${objurl.port}` : '');
+	objurl.origin = `${objurl.protocol}://${objurl.host}`;
+
+	return objurl;
+};
+/* String parser end */

luci-app-homeproxy/root/etc/homeproxy/scripts/migrate_config.uc

@@ -0,0 +1,263 @@
+#!/usr/bin/ucode
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (C) 2025 ImmortalWrt.org
+ */
+
+'use strict';
+
+import { cursor } from 'uci';
+import { isEmpty, parseURL } from 'homeproxy';
+
+const uci = cursor();
+
+const uciconfig = 'homeproxy';
+uci.load(uciconfig);
+
+const uciinfra = 'infra',
+      ucimigration = 'migration',
+      ucimain = 'config',
+      ucinode = 'node',
+      ucidns = 'dns',
+      ucidnsserver = 'dns_server',
+      ucidnsrule = 'dns_rule',
+      ucirouting = 'routing',
+      uciroutingnode = 'routing_node',
+      uciroutingrule = 'routing_rule',
+      uciserver = 'server';
+
+/* chinadns-ng has been removed */
+if (uci.get(uciconfig, uciinfra, 'china_dns_port'))
+	uci.delete(uciconfig, uciinfra, 'china_dns_port');
+
+/* chinadns server now only accepts single server */
+const china_dns_server = uci.get(uciconfig, ucimain, 'china_dns_server');
+if (type(china_dns_server) === 'array') {
+	uci.set(uciconfig, ucimain, 'china_dns_server', china_dns_server[0]);
+} else {
+	if (china_dns_server === 'wan_114')
+		uci.set(uciconfig, ucimain, 'china_dns_server', '114.114.114.114');
+	else if (match(china_dns_server, /,/))
+		uci.set(uciconfig, ucimain, 'china_dns_server', split(china_dns_server, ',')[0]);
+}
+
+/* github_token option has been moved to config section */
+const github_token = uci.get(uciconfig, uciinfra, 'github_token');
+if (github_token) {
+	uci.set(uciconfig, ucimain, 'github_token', github_token);
+	uci.delete(uciconfig, uciinfra, 'github_token')
+}
+
+/* ntp_server was introduced */
+if (!uci.get(uciconfig, uciinfra, 'ntp_server'))
+	uci.set(uciconfig, uciinfra, 'ntp_server', 'nil');
+
+/* tun_gso was deprecated in sb 1.11 */
+if (!isEmpty(uci.get(uciconfig, uciinfra, 'tun_gso')))
+	uci.delete(uciconfig, uciinfra, 'tun_gso');
+
+/* create migration section */
+if (!uci.get(uciconfig, ucimigration))
+	uci.set(uciconfig, ucimigration, uciconfig);
+
+/* delete old crontab command */
+const migration_crontab = uci.get(uciconfig, ucimigration, 'crontab');
+if (!migration_crontab) {
+	system('sed -i "/update_crond.sh/d" "/etc/crontabs/root" 2>"/dev/null"');
+	uci.set(uciconfig, ucimigration, 'crontab', '1');
+}
+
+/* log_level was introduced */
+if (isEmpty(uci.get(uciconfig, ucimain, 'log_level')))
+	uci.set(uciconfig, ucimain, 'log_level', 'warn');
+
+if (isEmpty(uci.get(uciconfig, uciserver, 'log_level')))
+	uci.set(uciconfig, uciserver, 'log_level', 'warn');
+
+/* empty value defaults to all ports now */
+if (uci.get(uciconfig, ucimain, 'routing_port') === 'all')
+	uci.delete(uciconfig, ucimain, 'routing_port');
+
+/* experimental section was removed */
+if (uci.get(uciconfig, 'experimental'))
+	uci.delete(uciconfig, 'experimental');
+
+/* block-dns was removed from built-in dns servers */
+const default_dns_server = uci.get(uciconfig, ucidns, 'default_server');
+if (default_dns_server === 'block-dns') {
+	/* append a rule at last to block all DNS queries */
+	uci.set(uciconfig, '_migration_dns_final_block', ucidnsrule);
+	uci.set(uciconfig, '_migration_dns_final_block', 'label', 'migration_final_block_dns');
+	uci.set(uciconfig, '_migration_dns_final_block', 'enabled', '1');
+	uci.set(uciconfig, '_migration_dns_final_block', 'mode', 'default');
+	uci.set(uciconfig, '_migration_dns_final_block', 'action', 'reject');
+	uci.set(uciconfig, ucidns, 'default_server', 'default-dns');
+}
+
+const dns_server_migration = {};
+/* DNS servers options */
+uci.foreach(uciconfig, ucidnsserver, (cfg) => {
+	/* legacy format was deprecated in sb 1.12 */
+	if (cfg.address) {
+		const addr = parseURL((!match(cfg.address, /:\/\//) ? 'udp://' : '') + (validation('ip6addr', cfg.address) ? `[${cfg.address}]` : cfg.address));
+		/* RCode was moved into DNS rules */
+		if (addr.protocol === 'rcode') {
+			dns_server_migration[cfg['.name']] = { action: 'predefined' };
+			switch (addr.hostname) {
+			case 'success':
+				dns_server_migration[cfg['.name']].rcode = 'NOERROR';
+				break;
+			case 'format_error':
+				dns_server_migration[cfg['.name']].rcode = 'FORMERR';
+				break;
+			case 'server_failure':
+				dns_server_migration[cfg['.name']].rcode = 'SERVFAIL';
+				break;
+			case 'name_error':
+				dns_server_migration[cfg['.name']].rcode = 'NXDOMAIN';
+				break;
+			case 'not_implemented':
+				dns_server_migration[cfg['.name']].rcode = 'NOTIMP';
+				break;
+			case 'refused':
+			default:
+				dns_server_migration[cfg['.name']].rcode = 'REFUSED';
+				break;
+			}
+
+			uci.delete(uciconfig, cfg['.name']);
+			return;
+		}
+		uci.set(uciconfig, cfg['.name'], 'type', addr.protocol);
+		uci.set(uciconfig, cfg['.name'], 'server', addr.hostname);
+		uci.set(uciconfig, cfg['.name'], 'server_port', addr.port);
+		uci.set(uciconfig, cfg['.name'], 'path', (addr.pathname !== '/') ? addr.pathname : null);
+		uci.delete(uciconfig, cfg['.name'], 'address');
+	}
+
+	if (cfg.strategy) {
+		if (cfg['.name'] === default_dns_server)
+			uci.set(uciconfig, ucidns, 'default_strategy', cfg.strategy);
+		dns_server_migration[cfg['.name']] = { strategy: cfg.strategy };
+		uci.delete(uciconfig, cfg['.name'], 'strategy');
+	}
+
+	if (cfg.client_subnet) {
+		if (cfg['.name'] === default_dns_server)
+			uci.set(uciconfig, ucidns, 'client_subnet', cfg.client_subnet);
+
+		if (isEmpty(dns_server_migration[cfg['.name']]))
+			dns_server_migration[cfg['.name']] = {};
+		dns_server_migration[cfg['.name']].client_subnet = cfg.client_subnet;
+		uci.delete(uciconfig, cfg['.name'], 'client_subnet');
+	}
+});
+
+/* DNS rules options */
+uci.foreach(uciconfig, ucidnsrule, (cfg) => {
+	/* outbound was removed in sb 1.12 */
+	if (cfg.outbound) {
+		uci.delete(uciconfig, cfg['.name']);
+		if (!cfg.enabled)
+			return;
+
+		map(cfg.outbound, (outbound) => {
+			switch (outbound) {
+			case 'direct-out':
+			case 'block-out':
+				break;
+			case 'any-out':
+				uci.set(uciconfig, ucirouting, 'default_outbound_dns', cfg.server);
+				break;
+			default:
+				uci.set(uciconfig, cfg.outbound, 'domain_resolver', cfg.server);
+				break;
+			}
+		});
+
+		return;
+	}
+
+	/* rule_set_ipcidr_match_source was renamed in sb 1.10 */
+	if (cfg.rule_set_ipcidr_match_source === '1')
+		uci.rename(uciconfig, cfg['.name'], 'rule_set_ipcidr_match_source', 'rule_set_ip_cidr_match_source');
+
+	/* block-dns was moved into action in sb 1.11 */
+	if (cfg.server === 'block-dns') {
+		uci.set(uciconfig, cfg['.name'], 'action', 'reject');
+		uci.delete(uciconfig, cfg['.name'], 'server');
+	} else if (!cfg.action) {
+		/* add missing 'action' field */
+		uci.set(uciconfig, cfg['.name'], 'action', 'route');
+	}
+
+	/* strategy and client_subnet were moved into dns rules */
+	if (dns_server_migration[cfg.server]) {
+		if (dns_server_migration[cfg.server].strategy)
+			uci.set(uciconfig, cfg['.name'], 'strategy', dns_server_migration[cfg.server].strategy);
+
+		if (dns_server_migration[cfg.server].client_subnet)
+			uci.set(uciconfig, cfg['.name'], 'client_subnet', dns_server_migration[cfg.server].client_subnet);
+
+		if (dns_server_migration[cfg.server].rcode) {
+			uci.set(uciconfig, cfg['.name'], 'action', 'predefined');
+			uci.set(uciconfig, cfg['.name'], 'rcode', dns_server_migration[cfg.server].rcode);
+			uci.delete(uciconfig, cfg['.name'], 'server');
+		}
+	}
+});
+
+/* nodes options */
+uci.foreach(uciconfig, ucinode, (cfg) => {
+	/* tls_ech_tls_disable_drs is useless and deprecated in sb 1.12 */
+	if (!isEmpty(cfg.tls_ech_tls_disable_drs))
+		uci.delete(uciconfig, cfg['.name'], 'tls_ech_tls_disable_drs');
+
+	/* tls_ech_enable_pqss is useless and deprecated in sb 1.12 */
+	if (!isEmpty(cfg.tls_ech_enable_pqss))
+		uci.delete(uciconfig, cfg['.name'], 'tls_ech_enable_pqss');
+
+	/* wireguard_gso was deprecated in sb 1.11 */
+	if (!isEmpty(cfg.wireguard_gso))
+		uci.delete(uciconfig, cfg['.name'], 'wireguard_gso');
+});
+
+/* routing rules options */
+uci.foreach(uciconfig, uciroutingrule, (cfg) => {
+	/* rule_set_ipcidr_match_source was renamed in sb 1.10 */
+	if (cfg.rule_set_ipcidr_match_source === '1')
+		uci.rename(uciconfig, cfg['.name'], 'rule_set_ipcidr_match_source', 'rule_set_ip_cidr_match_source');
+
+	/* block-out was moved into action in sb 1.11 */
+	if (cfg.outbound === 'block-out') {
+		uci.set(uciconfig, cfg['.name'], 'action', 'reject');
+		uci.delete(uciconfig, cfg['.name'], 'outbound');
+	} else if (!cfg.action) {
+		/* add missing 'action' field */
+		uci.set(uciconfig, cfg['.name'], 'action', 'route');
+	}
+});
+
+/* server options */
+/* auto_firewall was moved into server options */
+const auto_firewall = uci.get(uciconfig, uciserver, 'auto_firewall');
+if (!isEmpty(auto_firewall))
+	uci.delete(uciconfig, uciserver, 'auto_firewall');
+
+uci.foreach(uciconfig, uciserver, (cfg) => {
+	/* auto_firewall was moved into server options */
+	if (auto_firewall === '1')
+		uci.set(uciconfig, cfg['.name'], 'firewall' , '1');
+
+	/* sniff_override was deprecated in sb 1.11 */
+	if (!isEmpty(cfg.sniff_override))
+		uci.delete(uciconfig, cfg['.name'], 'sniff_override');
+
+	/* domain_strategy is now pointless without sniff override */
+	if (!isEmpty(cfg.domain_strategy))
+		uci.delete(uciconfig, cfg['.name'], 'domain_strategy');
+});
+
+if (!isEmpty(uci.changes(uciconfig)))
+	uci.commit(uciconfig);

luci-app-homeproxy/root/etc/homeproxy/scripts/update_crond.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2023 ImmortalWrt.org
+
+SCRIPTS_DIR="/etc/homeproxy/scripts"
+
+for i in "china_ip4" "china_ip6" "gfw_list" "china_list"; do
+	"$SCRIPTS_DIR"/update_resources.sh "$i"
+done
+
+"$SCRIPTS_DIR"/update_subscriptions.uc

luci-app-homeproxy/root/etc/homeproxy/scripts/update_resources.sh

@@ -0,0 +1,87 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2022-2025 ImmortalWrt.org
+
+NAME="homeproxy"
+
+RESOURCES_DIR="/etc/$NAME/resources"
+mkdir -p "$RESOURCES_DIR"
+
+RUN_DIR="/var/run/$NAME"
+LOG_PATH="$RUN_DIR/$NAME.log"
+mkdir -p "$RUN_DIR"
+
+log() {
+	echo -e "$(date "+%Y-%m-%d %H:%M:%S") $*" >> "$LOG_PATH"
+}
+
+to_upper() {
+	echo -e "$1" | tr "[a-z]" "[A-Z]"
+}
+
+check_list_update() {
+	local listtype="$1"
+	local listrepo="$2"
+	local listref="$3"
+	local listname="$4"
+	local lock="$RUN_DIR/update_resources-$listtype.lock"
+	local github_token="$(uci -q get homeproxy.config.github_token)"
+	local wget="wget --timeout=10 -q"
+
+	exec 200>"$lock"
+	if ! flock -n 200 &> "/dev/null"; then
+		log "[$(to_upper "$listtype")] A task is already running."
+		return 2
+	fi
+
+	[ -z "$github_token" ] || github_token="--header=Authorization: Bearer $github_token"
+	local list_info="$($wget "${github_token:--q}" -O- "https://api.github.com/repos/$listrepo/commits?sha=$listref&path=$listname&per_page=1")"
+	local list_sha="$(echo -e "$list_info" | jsonfilter -qe "@[0].sha")"
+	local list_ver="$(echo -e "$list_info" | jsonfilter -qe "@[0].commit.message" | grep -Eo "[0-9-]+" | tr -d '-')"
+	if [ -z "$list_sha" ] || [ -z "$list_ver" ]; then
+		log "[$(to_upper "$listtype")] Failed to get the latest version, please retry later."
+		return 1
+	fi
+
+	local local_list_ver="$(cat "$RESOURCES_DIR/$listtype.ver" 2>"/dev/null" || echo "NOT FOUND")"
+	if [ "$local_list_ver" = "$list_ver" ]; then
+		log "[$(to_upper "$listtype")] Current version: $list_ver."
+		log "[$(to_upper "$listtype")] You're already at the latest version."
+		return 3
+	else
+		log "[$(to_upper "$listtype")] Local version: $local_list_ver, latest version: $list_ver."
+	fi
+
+	if ! $wget "https://fastly.jsdelivr.net/gh/$listrepo@$list_sha/$listname" -O "$RUN_DIR/$listname" || [ ! -s "$RUN_DIR/$listname" ]; then
+		rm -f "$RUN_DIR/$listname"
+		log "[$(to_upper "$listtype")] Update failed."
+		return 1
+	fi
+
+	mv -f "$RUN_DIR/$listname" "$RESOURCES_DIR/$listtype.${listname##*.}"
+	echo -e "$list_ver" > "$RESOURCES_DIR/$listtype.ver"
+	log "[$(to_upper "$listtype")] Successfully updated."
+
+	return 0
+}
+
+case "$1" in
+"china_ip4")
+	check_list_update "$1" "1715173329/IPCIDR-CHINA" "master" "ipv4.txt"
+	;;
+"china_ip6")
+	check_list_update "$1" "1715173329/IPCIDR-CHINA" "master" "ipv6.txt"
+	;;
+"gfw_list")
+	check_list_update "$1" "Loyalsoldier/v2ray-rules-dat" "release" "gfw.txt"
+	;;
+"china_list")
+	check_list_update "$1" "Loyalsoldier/v2ray-rules-dat" "release" "direct-list.txt" && \
+		sed -i -e "s/full://g" -e "/:/d" "$RESOURCES_DIR/china_list.txt"
+	;;
+*)
+	echo -e "Usage: $0 <china_ip4 / china_ip6 / gfw_list / china_list>"
+	exit 1
+	;;
+esac

luci-app-homeproxy/root/etc/homeproxy/scripts/update_subscriptions.uc

@@ -0,0 +1,669 @@
+#!/usr/bin/ucode
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (C) 2023 ImmortalWrt.org
+ */
+
+'use strict';
+
+import { md5 } from 'digest';
+import { open } from 'fs';
+import { connect } from 'ubus';
+import { cursor } from 'uci';
+
+import { urldecode, urlencode } from 'luci.http';
+import { init_action } from 'luci.sys';
+
+import {
+	wGET, decodeBase64Str, getTime, isEmpty, parseURL,
+	validation, HP_DIR, RUN_DIR
+} from 'homeproxy';
+
+/* UCI config start */
+const uci = cursor();
+
+const uciconfig = 'homeproxy';
+uci.load(uciconfig);
+
+const ucimain = 'config',
+      ucinode = 'node',
+      ucisubscription = 'subscription';
+
+const allow_insecure = uci.get(uciconfig, ucisubscription, 'allow_insecure') || '0',
+      filter_mode = uci.get(uciconfig, ucisubscription, 'filter_nodes') || 'disabled',
+      filter_keywords = uci.get(uciconfig, ucisubscription, 'filter_keywords') || [],
+      packet_encoding = uci.get(uciconfig, ucisubscription, 'packet_encoding') || 'xudp',
+      subscription_urls = uci.get(uciconfig, ucisubscription, 'subscription_url') || [],
+      user_agent = uci.get(uciconfig, ucisubscription, 'user_agent'),
+      via_proxy = uci.get(uciconfig, ucisubscription, 'update_via_proxy') || '0';
+
+const routing_mode = uci.get(uciconfig, ucimain, 'routing_mode') || 'bypass_mainalnd_china';
+let main_node, main_udp_node;
+if (routing_mode !== 'custom') {
+	main_node = uci.get(uciconfig, ucimain, 'main_node') || 'nil';
+	main_udp_node = uci.get(uciconfig, ucimain, 'main_udp_node') || 'nil';
+}
+/* UCI config end */
+
+/* String helper start */
+function filter_check(name) {
+	if (isEmpty(name) || filter_mode === 'disabled' || isEmpty(filter_keywords))
+		return false;
+
+	let ret = false;
+	for (let i in filter_keywords) {
+		const patten = regexp(i);
+		if (match(name, patten))
+			ret = true;
+	}
+	if (filter_mode === 'whitelist')
+		ret = !ret;
+
+	return ret;
+}
+/* String helper end */
+
+/* Common var start */
+const node_cache = {},
+      node_result = [];
+
+const ubus = connect();
+const sing_features = ubus.call('luci.homeproxy', 'singbox_get_features', {}) || {};
+/* Common var end */
+
+/* Log */
+system(`mkdir -p ${RUN_DIR}`);
+function log(...args) {
+	const logfile = open(`${RUN_DIR}/homeproxy.log`, 'a');
+	logfile.write(`${getTime()} [SUBSCRIBE] ${join(' ', args)}\n`);
+	logfile.close();
+}
+
+function parse_uri(uri) {
+	let config, url, params;
+
+	if (type(uri) === 'object') {
+		if (uri.nodetype === 'sip008') {
+			/* https://shadowsocks.org/guide/sip008.html */
+			config = {
+				label: uri.remarks,
+				type: 'shadowsocks',
+				address: uri.server,
+				port: uri.server_port,
+				shadowsocks_encrypt_method: uri.method,
+				password: uri.password,
+				shadowsocks_plugin: uri.plugin,
+				shadowsocks_plugin_opts: uri.plugin_opts
+			};
+		}
+	} else if (type(uri) === 'string') {
+		uri = split(trim(uri), '://');
+
+		switch (uri[0]) {
+		case 'anytls':
+			/* https://github.com/anytls/anytls-go/blob/v0.0.8/docs/uri_scheme.md */
+			url = parseURL('http://' + uri[1]) || {};
+			params = url.searchParams || {};
+
+			config = {
+				label: url.hash ? urldecode(url.hash) : null,
+				type: 'anytls',
+				address: url.hostname,
+				port: url.port,
+				password: urldecode(url.username),
+				tls: '1',
+				tls_sni: params.sni,
+				tls_insecure: (params.insecure === '1') ? '1' : '0'
+			};
+
+			break;
+		case 'http':
+		case 'https':
+			url = parseURL('http://' + uri[1]) || {};
+
+			config = {
+				label: url.hash ? urldecode(url.hash) : null,
+				type: 'http',
+				address: url.hostname,
+				port: url.port,
+				username: url.username ? urldecode(url.username) : null,
+				password: url.password ? urldecode(url.password) : null,
+				tls: (uri[0] === 'https') ? '1' : '0'
+			};
+
+			break;
+		case 'hysteria':
+			/* https://github.com/HyNetwork/hysteria/wiki/URI-Scheme */
+			url = parseURL('http://' + uri[1]) || {};
+			params = url.searchParams;
+
+			if (!sing_features.with_quic || (params.protocol && params.protocol !== 'udp')) {
+				log(sprintf('Skipping unsupported %s node: %s.', uri[0], urldecode(url.hash) || url.hostname));
+				if (!sing_features.with_quic)
+					log(sprintf('Please rebuild sing-box with %s support!', 'QUIC'));
+
+				return null;
+			}
+
+			config = {
+				label: url.hash ? urldecode(url.hash) : null,
+				type: 'hysteria',
+				address: url.hostname,
+				port: url.port,
+				hysteria_protocol: params.protocol || 'udp',
+				hysteria_auth_type: params.auth ? 'string' : null,
+				hysteria_auth_payload: params.auth,
+				hysteria_obfs_password: params.obfsParam,
+				hysteria_down_mbps: params.downmbps,
+				hysteria_up_mbps: params.upmbps,
+				tls: '1',
+				tls_insecure: (params.insecure in ['true', '1']) ? '1' : '0',
+				tls_sni: params.peer,
+				tls_alpn: params.alpn
+			};
+
+			break;
+		case 'hysteria2':
+		case 'hy2':
+			/* https://v2.hysteria.network/docs/developers/URI-Scheme/ */
+			url = parseURL('http://' + uri[1]) || {};
+			params = url.searchParams;
+
+			if (!sing_features.with_quic) {
+				log(sprintf('Skipping unsupported %s node: %s.', uri[0], urldecode(url.hash) || url.hostname));
+				log(sprintf('Please rebuild sing-box with %s support!', 'QUIC'));
+				return null;
+			}
+
+			config = {
+				label: url.hash ? urldecode(url.hash) : null,
+				type: 'hysteria2',
+				address: url.hostname,
+				port: url.port,
+				password: url.username ? (
+					urldecode(url.username + (url.password ? (':' + url.password) : ''))
+				) : null,
+				hysteria_obfs_type: params.obfs,
+				hysteria_obfs_password: params['obfs-password'],
+				tls: '1',
+				tls_insecure: (params.insecure === '1') ? '1' : '0',
+				tls_sni: params.sni
+			};
+
+			break;
+		case 'socks':
+		case 'socks4':
+		case 'socks4a':
+		case 'socsk5':
+		case 'socks5h':
+			url = parseURL('http://' + uri[1]) || {};
+
+			config = {
+				label: url.hash ? urldecode(url.hash) : null,
+				type: 'socks',
+				address: url.hostname,
+				port: url.port,
+				username: url.username ? urldecode(url.username) : null,
+				password: url.password ? urldecode(url.password) : null,
+				socks_version: (match(uri[0], /4/)) ? '4' : '5'
+			};
+
+			break;
+		case 'ss':
+			/* "Lovely" Shadowrocket format */
+			const ss_suri = split(uri[1], '#');
+			let ss_slabel = '';
+			if (length(ss_suri) <= 2) {
+				if (length(ss_suri) === 2)
+					ss_slabel = '#' + urlencode(ss_suri[1]);
+				if (decodeBase64Str(ss_suri[0]))
+					uri[1] = decodeBase64Str(ss_suri[0]) + ss_slabel;
+			}
+
+			/* Legacy format is not supported, it should be never appeared in modern subscriptions */
+			/* https://github.com/shadowsocks/shadowsocks-org/commit/78ca46cd6859a4e9475953ed34a2d301454f579e */
+
+			/* SIP002 format https://shadowsocks.org/guide/sip002.html */
+			url = parseURL('http://' + uri[1]) || {};
+
+			let ss_userinfo = {};
+			if (url.username && url.password)
+				/* User info encoded with URIComponent */
+				ss_userinfo = [url.username, urldecode(url.password)];
+			else if (url.username)
+				/* User info encoded with base64 */
+				ss_userinfo = split(decodeBase64Str(urldecode(url.username)), ':', 2);
+
+			let ss_plugin, ss_plugin_opts;
+			if (url.search && url.searchParams.plugin) {
+				const ss_plugin_info = split(url.searchParams.plugin, ';', 2);
+				ss_plugin = ss_plugin_info[0];
+				if (ss_plugin === 'simple-obfs')
+					/* Fix non-standard plugin name */
+					ss_plugin = 'obfs-local';
+				ss_plugin_opts = ss_plugin_info[1];
+			}
+
+			config = {
+				label: url.hash ? urldecode(url.hash) : null,
+				type: 'shadowsocks',
+				address: url.hostname,
+				port: url.port,
+				shadowsocks_encrypt_method: ss_userinfo[0],
+				password: ss_userinfo[1],
+				shadowsocks_plugin: ss_plugin,
+				shadowsocks_plugin_opts: ss_plugin_opts
+			};
+
+			break;
+		case 'trojan':
+			/* https://p4gefau1t.github.io/trojan-go/developer/url/ */
+			url = parseURL('http://' + uri[1]) || {};
+			params = url.searchParams || {};
+
+			config = {
+				label: url.hash ? urldecode(url.hash) : null,
+				type: 'trojan',
+				address: url.hostname,
+				port: url.port,
+				password: urldecode(url.username),
+				transport: (params.type !== 'tcp') ? params.type : null,
+				tls: '1',
+				tls_sni: params.sni
+			};
+			switch(params.type) {
+			case 'grpc':
+				config.grpc_servicename = params.serviceName;
+				break;
+			case 'ws':
+				config.ws_host = params.host ? urldecode(params.host) : null;
+				config.ws_path = params.path ? urldecode(params.path) : null;
+				if (config.ws_path && match(config.ws_path, /\?ed=/)) {
+					config.websocket_early_data_header = 'Sec-WebSocket-Protocol';
+					config.websocket_early_data = split(config.ws_path, '?ed=')[1];
+					config.ws_path = split(config.ws_path, '?ed=')[0];
+				}
+				break;
+			}
+
+			break;
+		case 'tuic':
+			/* https://github.com/daeuniverse/dae/discussions/182 */
+			url = parseURL('http://' + uri[1]) || {};
+			params = url.searchParams || {};
+
+			if (!sing_features.with_quic) {
+				log(sprintf('Skipping unsupported %s node: %s.', uri[0], urldecode(url.hash) || url.hostname));
+				log(sprintf('Please rebuild sing-box with %s support!', 'QUIC'));
+
+				return null;
+			}
+
+			config = {
+				label: url.hash ? urldecode(url.hash) : null,
+				type: 'tuic',
+				address: url.hostname,
+				port: url.port,
+				uuid: url.username,
+				password: url.password ? urldecode(url.password) : null,
+				tuic_congestion_control: params.congestion_control,
+				tuic_udp_relay_mode: params.udp_relay_mode,
+				tls: '1',
+				tls_sni: params.sni,
+				tls_alpn: params.alpn ? split(urldecode(params.alpn), ',') : null,
+			};
+
+			break;
+		case 'vless':
+			/* https://github.com/XTLS/Xray-core/discussions/716 */
+			url = parseURL('http://' + uri[1]) || {};
+			params = url.searchParams;
+
+			/* Unsupported protocol */
+			if (params.type === 'kcp') {
+				log(sprintf('Skipping sunsupported %s node: %s.', uri[0], urldecode(url.hash) || url.hostname));
+				return null;
+			} else if (params.type === 'quic' && ((params.quicSecurity && params.quicSecurity !== 'none') || !sing_features.with_quic)) {
+				log(sprintf('Skipping sunsupported %s node: %s.', uri[0], urldecode(url.hash) || url.hostname));
+				if (!sing_features.with_quic)
+					log(sprintf('Please rebuild sing-box with %s support!', 'QUIC'));
+
+				return null;
+			}
+
+			config = {
+				label: url.hash ? urldecode(url.hash) : null,
+				type: 'vless',
+				address: url.hostname,
+				port: url.port,
+				uuid: url.username,
+				transport: (params.type !== 'tcp') ? params.type : null,
+				tls: (params.security in ['tls', 'xtls', 'reality']) ? '1' : '0',
+				tls_sni: params.sni,
+				tls_alpn: params.alpn ? split(urldecode(params.alpn), ',') : null,
+				tls_reality: (params.security === 'reality') ? '1' : '0',
+				tls_reality_public_key: params.pbk ? urldecode(params.pbk) : null,
+				tls_reality_short_id: params.sid,
+				tls_utls: sing_features.with_utls ? params.fp : null,
+				vless_flow: (params.security in ['tls', 'reality']) ? params.flow : null
+			};
+			switch(params.type) {
+			case 'grpc':
+				config.grpc_servicename = params.serviceName;
+				break;
+			case 'http':
+			case 'tcp':
+				if (params.type === 'http' || params.headerType === 'http') {
+					config.http_host = params.host ? split(urldecode(params.host), ',') : null;
+					config.http_path = params.path ? urldecode(params.path) : null;
+				}
+				break;
+			case 'httpupgrade':
+				config.httpupgrade_host = params.host ? urldecode(params.host) : null;
+				config.http_path = params.path ? urldecode(params.path) : null;
+				break;
+			case 'ws':
+				config.ws_host = params.host ? urldecode(params.host) : null;
+				config.ws_path = params.path ? urldecode(params.path) : null;
+				if (config.ws_path && match(config.ws_path, /\?ed=/)) {
+					config.websocket_early_data_header = 'Sec-WebSocket-Protocol';
+					config.websocket_early_data = split(config.ws_path, '?ed=')[1];
+					config.ws_path = split(config.ws_path, '?ed=')[0];
+				}
+				break;
+			}
+
+			break;
+		case 'vmess':
+			/* "Lovely" shadowrocket format */
+			if (match(uri, /&/)) {
+				log(sprintf('Skipping unsupported %s format.', uri[0]));
+				return null;
+			}
+
+			/* https://github.com/2dust/v2rayN/wiki/Description-of-VMess-share-link */
+			try {
+				uri = json(decodeBase64Str(uri[1])) || {};
+			} catch(e) {
+				log(sprintf('Skipping unsupported %s format.', uri[0]));
+				return null;
+			}
+
+			if (uri.v != '2') {
+				log(sprintf('Skipping unsupported %s format.', uri[0]));
+				return null;
+			/* Unsupported protocol */
+			} else if (uri.net === 'kcp') {
+				log(sprintf('Skipping unsupported %s node: %s.', uri[0], uri.ps || uri.add));
+				return null;
+			} else if (uri.net === 'quic' && ((uri.type && uri.type !== 'none') || uri.path || !sing_features.with_quic)) {
+				log(sprintf('Skipping unsupported %s node: %s.', uri[0], uri.ps || uri.add));
+				if (!sing_features.with_quic)
+					log(sprintf('Please rebuild sing-box with %s support!', 'QUIC'));
+
+				return null;
+			}
+			/*
+			 * https://www.v2fly.org/config/protocols/vmess.html#vmess-md5-%E8%AE%A4%E8%AF%81%E4%BF%A1%E6%81%AF-%E6%B7%98%E6%B1%B0%E6%9C%BA%E5%88%B6
+			 * else if (uri.aid && int(uri.aid) !== 0) {
+			 * 	log(sprintf('Skipping unsupported %s node: %s.', uri[0], uri.ps || uri.add));
+			 * 	return null;
+			 * }
+			 */
+
+			config = {
+				label: uri.ps ? urldecode(uri.ps) : null,
+				type: 'vmess',
+				address: uri.add,
+				port: uri.port,
+				uuid: uri.id,
+				vmess_alterid: uri.aid,
+				vmess_encrypt: uri.scy || 'auto',
+				vmess_global_padding: '1',
+				transport: (uri.net !== 'tcp') ? uri.net : null,
+				tls: (uri.tls === 'tls') ? '1' : '0',
+				tls_sni: uri.sni || uri.host,
+				tls_alpn: uri.alpn ? split(uri.alpn, ',') : null,
+				tls_utls: sing_features.with_utls ? uri.fp : null
+			};
+			switch (uri.net) {
+			case 'grpc':
+				config.grpc_servicename = uri.path;
+				break;
+			case 'h2':
+			case 'tcp':
+				if (uri.net === 'h2' || uri.type === 'http') {
+					config.transport = 'http';
+					config.http_host = uri.host ? split(uri.host, ',') : null;
+					config.http_path = uri.path;
+				}
+				break;
+			case 'httpupgrade':
+				config.httpupgrade_host = uri.host;
+				config.http_path = uri.path;
+				break;
+			case 'ws':
+				config.ws_host = uri.host;
+				config.ws_path = uri.path;
+				if (config.ws_path && match(config.ws_path, /\?ed=/)) {
+					config.websocket_early_data_header = 'Sec-WebSocket-Protocol';
+					config.websocket_early_data = split(config.ws_path, '?ed=')[1];
+					config.ws_path = split(config.ws_path, '?ed=')[0];
+				}
+				break;
+			}
+
+			break;
+		}
+	}
+
+	if (!isEmpty(config)) {
+		if (config.address)
+			config.address = replace(config.address, /\[|\]/g, '');
+
+		if (!validation('host', config.address) || !validation('port', config.port)) {
+			log(sprintf('Skipping invalid %s node: %s.', config.type, config.label || 'NULL'));
+			return null;
+		} else if (!config.label)
+			config.label = (validation('ip6addr', config.address) ?
+				`[${config.address}]` : config.address) + ':' + config.port;
+	}
+
+	return config;
+}
+
+function main() {
+	if (via_proxy !== '1') {
+		log('Stopping service...');
+		init_action('homeproxy', 'stop');
+	}
+
+	for (let url in subscription_urls) {
+		url = replace(url, /#.*$/, '');
+		const groupHash = md5(url);
+		node_cache[groupHash] = {};
+
+		const res = wGET(url, user_agent);
+		if (isEmpty(res)) {
+			log(sprintf('Failed to fetch resources from %s.', url));
+			continue;
+		}
+
+		let nodes;
+		try {
+			nodes = json(res).servers || json(res);
+
+			/* Shadowsocks SIP008 format */
+			if (nodes[0].server && nodes[0].method)
+				map(nodes, (_, i) => nodes[i].nodetype = 'sip008');
+		} catch(e) {
+			nodes = decodeBase64Str(res);
+			nodes = nodes ? split(trim(replace(nodes, / /g, '_')), '\n') : [];
+		}
+
+		let count = 0;
+		for (let node in nodes) {
+			let config;
+			if (!isEmpty(node))
+				config = parse_uri(node);
+			if (isEmpty(config))
+				continue;
+
+			const label = config.label;
+			config.label = null;
+			const confHash = md5(sprintf('%J', config)),
+			      nameHash = md5(label);
+			config.label = label;
+
+			if (filter_check(config.label))
+				log(sprintf('Skipping blacklist node: %s.', config.label));
+			else if (node_cache[groupHash][confHash] || node_cache[groupHash][nameHash])
+				log(sprintf('Skipping duplicate node: %s.', config.label));
+			else {
+				if (config.tls === '1' && allow_insecure === '1')
+					config.tls_insecure = '1';
+				if (config.type in ['vless', 'vmess'])
+					config.packet_encoding = packet_encoding;
+
+				config.grouphash = groupHash;
+				push(node_result, []);
+				push(node_result[length(node_result)-1], config);
+				node_cache[groupHash][confHash] = config;
+				node_cache[groupHash][nameHash] = config;
+
+				count++;
+			}
+		}
+
+		if (count == 0)
+			log(sprintf('No valid node found in %s.', url));
+		else
+			log(sprintf('Successfully fetched %s nodes of total %s from %s.', count, length(nodes), url));
+	}
+
+	if (isEmpty(node_result)) {
+		log('Failed to update subscriptions: no valid node found.');
+
+		if (via_proxy !== '1') {
+			log('Starting service...');
+			init_action('homeproxy', 'start');
+		}
+
+		return false;
+	}
+
+	let added = 0, removed = 0;
+	uci.foreach(uciconfig, ucinode, (cfg) => {
+		/* Nodes created by the user */
+		if (!cfg.grouphash)
+			return null;
+
+		/* Empty object - failed to fetch nodes */
+		if (length(node_cache[cfg.grouphash]) === 0)
+			return null;
+
+		if (!node_cache[cfg.grouphash] || !node_cache[cfg.grouphash][cfg['.name']]) {
+			uci.delete(uciconfig, cfg['.name']);
+			removed++;
+
+			log(sprintf('Removing node: %s.', cfg.label || cfg['name']));
+		} else {
+			map(keys(cfg), (v) => {
+				if (v in node_cache[cfg.grouphash][cfg['.name']])
+					uci.set(uciconfig, cfg['.name'], v, node_cache[cfg.grouphash][cfg['.name']][v]);
+				else
+					uci.delete(uciconfig, cfg['.name'], v);
+			});
+			node_cache[cfg.grouphash][cfg['.name']].isExisting = true;
+		}
+	});
+	for (let nodes in node_result)
+		map(nodes, (node) => {
+			if (node.isExisting)
+				return null;
+
+			const nameHash = md5(node.label);
+			uci.set(uciconfig, nameHash, 'node');
+			map(keys(node), (v) => uci.set(uciconfig, nameHash, v, node[v]));
+
+			added++;
+			log(sprintf('Adding node: %s.', node.label));
+		});
+	uci.commit(uciconfig);
+
+	let need_restart = (via_proxy !== '1');
+	if (!isEmpty(main_node)) {
+		const first_server = uci.get_first(uciconfig, ucinode);
+		if (first_server) {
+			let main_urltest_nodes;
+			if (main_node === 'urltest') {
+				main_urltest_nodes = filter(uci.get(uciconfig, ucimain, 'main_urltest_nodes'), (v) => {
+					if (!uci.get(uciconfig, v)) {
+						log(sprintf('Node %s is gone, removing from urltest list.', v));
+						return false;
+					}
+					return true;
+				});
+			}
+
+			if ((main_node === 'urltest') ? !length(main_urltest_nodes) : !uci.get(uciconfig, main_node)) {
+				uci.set(uciconfig, ucimain, 'main_node', first_server);
+				uci.commit(uciconfig);
+				need_restart = true;
+
+				log('Main node is gone, switching to the first node.');
+			}
+
+			if (!isEmpty(main_udp_node) && main_udp_node !== 'same') {
+				let main_udp_urltest_nodes;
+				if (main_udp_node === 'urltest') {
+					main_udp_urltest_nodes = filter(uci.get(uciconfig, ucimain, 'main_udp_urltest_nodes'), (v) => {
+						if (!uci.get(uciconfig, v)) {
+							log(sprintf('Node %s is gone, removing from urltest list.', v));
+							return false;
+						}
+						return true;
+					});
+				}
+
+				if ((main_udp_node === 'urltest') ? !length(main_udp_urltest_nodes) : !uci.get(uciconfig, main_udp_node)) {
+					uci.set(uciconfig, ucimain, 'main_udp_node', first_server);
+					uci.commit(uciconfig);
+					need_restart = true;
+
+					log('Main UDP node is gone, switching to the first node.');
+				}
+			}
+		} else {
+			uci.set(uciconfig, ucimain, 'main_node', 'nil');
+			uci.set(uciconfig, ucimain, 'main_udp_node', 'nil');
+			uci.commit(uciconfig);
+			need_restart = true;
+
+			log('No available node, disable tproxy.');
+		}
+	}
+
+	if (need_restart) {
+		log('Restarting service...');
+		init_action('homeproxy', 'stop');
+		init_action('homeproxy', 'start');
+	}
+
+	log(sprintf('%s nodes added, %s removed.', added, removed));
+	log('Successfully updated subscriptions.');
+}
+
+if (!isEmpty(subscription_urls))
+	try {
+		call(main);
+	} catch(e) {
+		log('[FATAL ERROR] An error occurred during updating subscriptions:');
+		log(sprintf('%s: %s', e.type, e.message));
+		log(e.stacktrace[0].context);
+
+		log('Restarting service...');
+		init_action('homeproxy', 'stop');
+		init_action('homeproxy', 'start');
+	}