🔥 Sync 2026-07-19 20:20:12

daed/Makefile

@@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=daed
 PKG_VERSION:=2026.07.17
-PKG_RELEASE:=24
+PKG_RELEASE:=25
 
 PKG_SOURCE:=daed-src-2026.07.17-1e3ce69d866f.tar.gz
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-daede/releases/download/daed-src

daed/files/daed-cleanup.sh

@@ -15,9 +15,13 @@ daed_cleanup_runtime() {
 	fi
 
 	if ! ip netns del daens 2>/dev/null; then
-		umount /run/netns/daens 2>/dev/null
+		umount -l /run/netns/daens 2>/dev/null
 		rm -f /run/netns/daens
 	fi
 
 	ip link del dae0 2>/dev/null || true
+
+	[ ! -e /run/netns/daens ] || return 1
+	! ip netns list 2>/dev/null | awk '$1 == "daens" { found=1 } END { exit !found }' || return 1
+	! ip link show dae0 >/dev/null 2>&1 || return 1
 }

daed/files/daed-guard

@@ -2,5 +2,8 @@
 
 . /usr/share/daed/cleanup.sh
 
-daed_cleanup_runtime
+if ! daed_cleanup_runtime; then
+	echo "daed: stale network state could not be removed" >&2
+	exit 1
+fi
 exec /usr/bin/daed "$@"

daed/patches/0005-bound-startup-network-wait.patch

@@ -0,0 +1,51 @@
+From: kenzok8 <kenzok8@noreply>
+Date: 2026-07-19
+Subject: [PATCH] daed: bound startup network wait
+
+Purge stale dae filters before probing the network and stop waiting after 60
+seconds so the dashboard remains available for recovery.
+---
+--- a/dae/utils.go
++++ b/dae/utils.go
+@@ -97 +97 @@
+-func WaitForNetwork(log *logrus.Logger) {
++func WaitForNetwork(log *logrus.Logger) error {
+@@ -98,0 +99 @@
++	deadline := time.Now().Add(60 * time.Second)
+@@ -117,0 +119,3 @@
++		if time.Now().After(deadline) {
++			return fmt.Errorf("network unavailable after 60 seconds")
++		}
+@@ -136,0 +141 @@
++	return nil
+--- a/dae/run.go
++++ b/dae/run.go
+@@ -35 +35,2 @@
+-var onceWaitingNetwork sync.Once
++var waitingNetworkMu sync.Mutex
++var networkReady bool
+@@ -54,0 +56,13 @@
++func waitForNetwork(log *logrus.Logger) error {
++	waitingNetworkMu.Lock()
++	defer waitingNetworkMu.Unlock()
++	if networkReady {
++		return nil
++	}
++	if err := WaitForNetwork(log); err != nil {
++		return err
++	}
++	networkReady = true
++	return nil
++}
++
+@@ -223,0 +238,3 @@
++	if bpf == nil {
++		control.PurgeStaleTCFilters(log)
++	}
+@@ -231,3 +248,3 @@
+-		onceWaitingNetwork.Do(func() {
+-			WaitForNetwork(log)
+-		})
++		if err = waitForNetwork(log); err != nil {
++			return nil, err
++		}

luci-app-daede/Makefile

@@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-daede
 PKG_VERSION:=1.14.7
-PKG_RELEASE:=33
+PKG_RELEASE:=34
 PKG_MAINTAINER:=kenzok8
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)
 

luci-app-daede/htdocs/luci-static/resources/view/daede/daed.js

@@ -99,7 +99,7 @@ function renderDaedSettings() {
 					const err = (res.stderr || res.stdout || ('exit ' + res.code)).trim().split('\n')[0];
 					flash(_('Subscription update failed: %s').format(err), 'err', 9000);
 				} else {
-					flash(_('Subscriptions updated (daed restarted)'), 'ok');
+					flash(_('Subscriptions updated and applied'), 'ok');
 				}
 			}).catch(function(e) {
 				flash(_('Subscription update failed: %s').format(e.message || e), 'err', 9000);

luci-app-daede/htdocs/luci-static/resources/view/daede/log.js

@@ -9,6 +9,14 @@
 
 const MAX_LINES = 5000;
 
+function execChecked(command, args) {
+	return fs.exec(command, args || []).then(function(res) {
+		if (res && res.code !== 0)
+			throw new Error((res.stderr || res.stdout || ('exit ' + res.code)).trim());
+		return res;
+	});
+}
+
 const CSS = [
 	'.dd-log-wrap{padding:4px 0;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI","PingFang SC",sans-serif}',
 	'.dd-log-card{border:1px solid rgba(0,0,0,.06);border-radius:10px;padding:10px 14px;margin-bottom:10px;box-shadow:0 2px 8px rgba(0,0,0,.03);background:rgba(255,255,255,.02)}',
@@ -20,6 +28,7 @@ const CSS = [
 	'.dd-log-toolbar input[type="text"]{font-size:11.5px;padding:4px 8px;border-radius:5px;border:1px solid rgba(128,128,128,.28);background:transparent;color:inherit;min-width:160px}',
 	'.dd-log-toolbar .dd-log-btn{font-size:11.5px;line-height:1.4;min-height:0;height:auto;padding:4px 12px;border-radius:5px;border:1px solid rgba(128,128,128,.28);background:transparent;color:inherit;cursor:pointer}',
 	'.dd-log-toolbar .dd-log-btn:hover{background:rgba(128,128,128,.1)}',
+	'.dd-log-toolbar .dd-log-stop{color:#d9534f;border-color:rgba(217,83,79,.45)}',
 	'.dd-log-toolbar .dd-log-meta{margin-left:auto;font-size:10.5px;opacity:.55;font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace}',
 	'.dd-log-pane{height:60vh;min-height:360px;overflow:auto;padding:8px 10px;border:1px solid rgba(0,0,0,.08);border-radius:7px;background:#1a1d21;color:#d8dde6;font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono",monospace;font-size:11.5px;line-height:1.55;white-space:pre-wrap;word-break:break-all}',
 	'.dd-log-pane .dd-line{padding:1px 4px;border-radius:3px;display:block}',
@@ -192,6 +201,25 @@ return view.extend({
 			}).catch(function() {});
 		});
 
+		let btnStop = null;
+		if (ctx.name === 'daed') {
+			btnStop = E('button', { 'class': 'dd-log-btn dd-log-stop' }, _('Stop daed'));
+			btnStop.addEventListener('click', function() {
+				if (!confirm(_('Stop daed now?')))
+					return;
+				btnStop.disabled = true;
+				execChecked('/sbin/uci', ['set', 'daed.config.enabled=0'])
+					.then(function() { return execChecked('/sbin/uci', ['commit', 'daed']); })
+					.then(function() { return execChecked('/etc/init.d/daed', ['disable']); })
+					.then(function() { return execChecked('/etc/init.d/daed', ['stop']); })
+					.then(function() { btnStop.textContent = _('daed stopped'); })
+					.catch(function(e) {
+						btnStop.disabled = false;
+						ui.addNotification(null, E('p', {}, _('Failed to stop daed: %s').format(e.message || e)), 'error');
+					});
+			});
+		}
+
 		function applyFilter() {
 			const f = state.filter;
 			pane.querySelectorAll('.dd-line').forEach(function(el) {
@@ -281,15 +309,17 @@ return view.extend({
 		poll.add(tick);
 		tick();
 
-		const toolbar = E('div', { 'class': 'dd-log-toolbar' }, [
+		const toolbarItems = [
 			E('label', {}, [ cbAuto, _('Auto-scroll') ]),
 			E('label', {}, [ cbPause, _('Pause') ]),
 			selFilter,
 			btnClear,
 			btnDownload,
-			btnTruncate,
+			btnTruncate
-			meta
+		];
-		]);
+		if (btnStop) toolbarItems.push(btnStop);
+		toolbarItems.push(meta);
+		const toolbar = E('div', { 'class': 'dd-log-toolbar' }, toolbarItems);
 
 		return E('div', { 'class': 'dd-log-wrap' }, [
 			E('style', {}, CSS),

luci-app-daede/po/templates/daede.pot

@@ -388,6 +388,18 @@ msgstr ""
 msgid "Download"
 msgstr ""
 
+msgid "Stop daed"
+msgstr ""
+
+msgid "Stop daed now?"
+msgstr ""
+
+msgid "daed stopped"
+msgstr ""
+
+msgid "Failed to stop daed: %s"
+msgstr ""
+
 #: dae.js
 msgid "One node share link per line — ss, vmess, vless, trojan, tuic, hysteria2, socks5."
 msgstr ""
@@ -464,6 +476,9 @@ msgstr ""
 msgid "Subscriptions updated (dae reloaded)"
 msgstr ""
 
+msgid "Subscriptions updated and applied"
+msgstr ""
+
 #: dae.js
 msgid "Save manual config"
 msgstr ""

luci-app-daede/po/zh-cn/daede.po

@@ -400,6 +400,18 @@ msgstr "清空文件"
 msgid "Download"
 msgstr "下载"
 
+msgid "Stop daed"
+msgstr "停止 daed"
+
+msgid "Stop daed now?"
+msgstr "立即停止 daed？"
+
+msgid "daed stopped"
+msgstr "daed 已停止"
+
+msgid "Failed to stop daed: %s"
+msgstr "停止 daed 失败：%s"
+
 # ---- config.js: Subscription Card ----
 msgid "Subscription Management"
 msgstr "订阅管理"
@@ -628,8 +640,8 @@ msgstr "更新失败：%s"
 msgid "Subscriptions updated (dae reloaded)"
 msgstr "订阅已更新（dae 已重载）"
 
-msgid "Subscriptions updated (daed restarted)"
+msgid "Subscriptions updated and applied"
-msgstr "订阅已更新，daed 已重启"
+msgstr "订阅已更新并应用"
 
 msgid "Section"
 msgstr "区块"

luci-app-daede/po/zh_Hans/daede.po

@@ -400,6 +400,18 @@ msgstr "清空文件"
 msgid "Download"
 msgstr "下载"
 
+msgid "Stop daed"
+msgstr "停止 daed"
+
+msgid "Stop daed now?"
+msgstr "立即停止 daed？"
+
+msgid "daed stopped"
+msgstr "daed 已停止"
+
+msgid "Failed to stop daed: %s"
+msgstr "停止 daed 失败：%s"
+
 # ---- config.js: Subscription Card ----
 msgid "Subscription Management"
 msgstr "订阅管理"
@@ -628,8 +640,8 @@ msgstr "更新失败：%s"
 msgid "Subscriptions updated (dae reloaded)"
 msgstr "订阅已更新（dae 已重载）"
 
-msgid "Subscriptions updated (daed restarted)"
+msgid "Subscriptions updated and applied"
-msgstr "订阅已更新，daed 已重启"
+msgstr "订阅已更新并应用"
 
 msgid "Section"
 msgstr "区块"

luci-app-daede/root/usr/share/luci-app-daede/daed-sub-update.sh

@@ -121,9 +121,12 @@ if [ "$fail" -ne 0 ]; then
 fi
 
 if [ "$count" -gt 0 ] && [ "$ok" -gt 0 ] && /bin/pidof daed >/dev/null 2>&1; then
-	log "restarting daed to apply updated subscriptions"
+	run_body="$TMPDIR/run.json"
-	if ! /etc/init.d/daed restart >>"$LOG" 2>&1; then
+	run_resp="$TMPDIR/run.out"
-		fail 8 "daed restart failed after subscription update"
+	printf '{"query":"mutation Run($dry:Boolean!){run(dry:$dry)}","variables":{"dry":false}}' > "$run_body"
+	log "applying updated subscriptions"
+	if ! post_graphql "$run_body" "$run_resp" "$token" || grep -q '"errors"' "$run_resp"; then
+		fail 8 "failed to apply updated subscriptions: $(cat "$run_resp" 2>/dev/null)"
 	fi
 fi
 

luci-app-daede/root/usr/share/luci-app-daede/update-geo.sh

@@ -61,10 +61,15 @@ fi
 		rc=1
 	else
 		size=$(wc -c < "$TMP" 2>/dev/null || echo 0)
-		if [ "$size" -lt 102400 ]; then
+		magic=$(hexdump -n 1 -e '1/1 "%02x"' "$TMP" 2>/dev/null)
+		if [ "$size" -lt 1024 ]; then
 			echo "$(date '+%F %T') file too small ($size bytes)"
 			rm -f "$TMP"
 			rc=2
+		elif [ "$magic" != "0a" ]; then
+			echo "$(date '+%F %T') invalid geodata format"
+			rm -f "$TMP"
+			rc=3
 		else
 			mv "$TMP" "$DEST"
 			echo "$(date '+%F %T') updated $DEST ($size bytes)"

luci-app-passwall/Makefile

@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=26.7.16
-PKG_RELEASE:=186
+PKG_RELEASE:=187
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \

luci-app-passwall/root/usr/share/passwall/app.sh

@@ -53,11 +53,11 @@ check_run_environment() {
 		if [ "$USE_TABLES" = "iptables" ]; then
 			dep_list="iptables-mod-tproxy iptables-mod-socket iptables-mod-iprange iptables-mod-conntrack-extra kmod-ipt-nat"
 		else
-			dep_list="kmod-nft-socket kmod-nft-tproxy kmod-nft-nat"
+			dep_list="kmod-nft-socket kmod-nft-tproxy kmod-nft-nat kmod-nf-reject kmod-nf-reject6"
 			nftflag=1
 			local v_num=$(echo "$dnsmasq_ver" | tr -cd '0-9')
-			if [ "${v_num:-0}" -lt 290 ]; then
+			if [ "${v_num:-0}" -lt 292 ]; then
-				echolog "提示：Dnsmasq ($dnsmasq_ver) 低于 2.90，建议升级以增强稳定性。"
+				echolog "提示：Dnsmasq ($dnsmasq_ver) 低于 2.92，建议升级以增强稳定性。"
 			fi
 		fi
 		local pkg

luci-app-passwall/root/usr/share/passwall/iptables.sh

@@ -34,8 +34,10 @@ FWMARK="0x50535731"
 ipt=$(command -v iptables-legacy || command -v iptables)
 ip6t=$(command -v ip6tables-legacy || command -v ip6tables)
 
+ipt_f="$ipt -w"
 ipt_n="$ipt -t nat -w"
 ipt_m="$ipt -t mangle -w"
+ip6t_f="$ip6t -w"
 ip6t_n="$ip6t -t nat -w"
 ip6t_m="$ip6t -t mangle -w"
 [ -z "$ip6t" ] || [ -z "$(lsmod | grep 'ip6table_nat')" ] && ip6t_n="eval #$ip6t_n"
@@ -404,48 +406,53 @@ load_acl() {
 				fi
 
 				[ -n "$tcp_port" ] || [ -n "$udp_port" ] && {
-					[ "${use_block_list}" = "1" ] && $ipt_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_BLOCK) -j DROP
+					[ "${use_block_list}" = "1" ] && $ipt_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_BLOCK) -j MARK --set-mark 88
 					[ "${use_direct_list}" = "1" ] && $ipt_tmp -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_WHITE) -j RETURN
 					[ "$PROXY_IPV6" = "1" ] && [ "$_ipv4" != "1" ] && {
-						[ "${use_block_list}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_BLOCK6) -j DROP 2>/dev/null
+						[ "${use_block_list}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_BLOCK6) -j MARK --set-mark 88 2>/dev/null
 						[ "${use_direct_list}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_WHITE6) -j RETURN 2>/dev/null
 					}
 
 					[ "$tcp_proxy_drop_ports" != "disable" ] && {
 						[ "$PROXY_IPV6" = "1" ] && [ "$_ipv4" != "1" ] && {
-							[ "${use_fakedns}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-d $FAKE_IP_6 -j DROP" 2>/dev/null
+							[ "${use_fakedns}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-d $FAKE_IP_6 -j MARK --set-mark 88" 2>/dev/null
-							[ "${use_proxy_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $black6_set_name) -j DROP" 2>/dev/null
+							[ "${use_proxy_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $black6_set_name) -j MARK --set-mark 88" 2>/dev/null
-							[ "${use_gfw_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $gfw6_set_name) -j DROP" 2>/dev/null
+							[ "${use_gfw_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $gfw6_set_name) -j MARK --set-mark 88" 2>/dev/null
-							[ "${chn_list}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j DROP")" 2>/dev/null
+							[ "${chn_list}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j MARK --set-mark 88")" 2>/dev/null
-							[ "${use_shunt_tcp}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $shunt6_set_name) -j DROP" 2>/dev/null
+							[ "${use_shunt_tcp}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $shunt6_set_name) -j MARK --set-mark 88" 2>/dev/null
-							[ "${tcp_proxy_mode}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-j DROP" 2>/dev/null
+							[ "${tcp_proxy_mode}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-j MARK --set-mark 88" 2>/dev/null
 						}
-						[ "${use_fakedns}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-d $FAKE_IP -j DROP"
+						[ "${use_fakedns}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-d $FAKE_IP -j MARK --set-mark 88"
-						[ "${use_proxy_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $black_set_name) -j DROP"
+						[ "${use_proxy_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $black_set_name) -j MARK --set-mark 88"
-						[ "${use_gfw_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $gfw_set_name) -j DROP"
+						[ "${use_gfw_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $gfw_set_name) -j MARK --set-mark 88"
-						[ "${chn_list}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $IPSET_CHN) $(get_jump_ipt ${chn_list} "-j DROP")"
+						[ "${chn_list}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $IPSET_CHN) $(get_jump_ipt ${chn_list} "-j MARK --set-mark 88")"
-						[ "${use_shunt_tcp}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $shunt_set_name) -j DROP"
+						[ "${use_shunt_tcp}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $shunt_set_name) -j MARK --set-mark 88"
-						[ "${tcp_proxy_mode}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-j DROP"
+						[ "${tcp_proxy_mode}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-j MARK --set-mark 88"
 						echolog "     - ${msg}屏蔽代理 TCP 端口[${tcp_proxy_drop_ports}]"
 					}
 
 					[ "$udp_proxy_drop_ports" != "disable" ] && {
 						[ "$PROXY_IPV6" = "1" ] && [ "$_ipv4" != "1" ] && {
-							[ "${use_fakedns}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-d $FAKE_IP_6 -j DROP" 2>/dev/null
+							[ "${use_fakedns}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-d $FAKE_IP_6 -j MARK --set-mark 88" 2>/dev/null
-							[ "${use_proxy_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $black6_set_name) -j DROP" 2>/dev/null
+							[ "${use_proxy_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $black6_set_name) -j MARK --set-mark 88" 2>/dev/null
-							[ "${use_gfw_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $gfw6_set_name) -j DROP" 2>/dev/null
+							[ "${use_gfw_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $gfw6_set_name) -j MARK --set-mark 88" 2>/dev/null
-							[ "${chn_list}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j DROP")" 2>/dev/null
+							[ "${chn_list}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j MARK --set-mark 88")" 2>/dev/null
-							[ "${use_shunt_udp}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $shunt6_set_name) -j DROP" 2>/dev/null
+							[ "${use_shunt_udp}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $shunt6_set_name) -j MARK --set-mark 88" 2>/dev/null
-							[ "${udp_proxy_mode}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-j DROP" 2>/dev/null
+							[ "${udp_proxy_mode}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-j MARK --set-mark 88" 2>/dev/null
 						}
-						[ "${use_fakedns}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-d $FAKE_IP -j DROP"
+						[ "${use_fakedns}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-d $FAKE_IP -j MARK --set-mark 88"
-						[ "${use_proxy_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $black_set_name) -j DROP"
+						[ "${use_proxy_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $black_set_name) -j MARK --set-mark 88"
-						[ "${use_gfw_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $gfw_set_name) -j DROP"
+						[ "${use_gfw_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $gfw_set_name) -j MARK --set-mark 88"
-						[ "${chn_list}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $IPSET_CHN) $(get_jump_ipt ${chn_list} "-j DROP")"
+						[ "${chn_list}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $IPSET_CHN) $(get_jump_ipt ${chn_list} "-j MARK --set-mark 88")"
-						[ "${use_shunt_udp}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $shunt_set_name) -j DROP"
+						[ "${use_shunt_udp}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $shunt_set_name) -j MARK --set-mark 88"
-						[ "${udp_proxy_mode}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-j DROP"
+						[ "${udp_proxy_mode}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-j MARK --set-mark 88"
 						echolog "     - ${msg}屏蔽代理 UDP 端口[${udp_proxy_drop_ports}]"
 					}
+
+					$ipt_m -A PSW $(comment "$remarks") ${_ipt_source} -m mark --mark 88 -j ACCEPT 2>/dev/null
+					[ "$PROXY_IPV6" = "1" ] && {
+						$ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} -m mark --mark 88 -j ACCEPT 2>/dev/null
+					}
 				}
 				
 				[ -n "$tcp_port" ] && {
@@ -587,48 +594,53 @@ load_acl() {
 		fi
 
 		[ -n "${TCP_PROXY_MODE}" ] || [ -n "${UDP_PROXY_MODE}" ] && {
-			[ "${USE_BLOCK_LIST}" = "1" ] && $ipt_m -A PSW $(comment "默认") $(dst $IPSET_BLOCK) -j DROP
+			[ "${USE_BLOCK_LIST}" = "1" ] && $ipt_m -A PSW $(comment "默认") $(dst $IPSET_BLOCK) -j MARK --set-mark 88
 			[ "${USE_DIRECT_LIST}" = "1" ] && $ipt_tmp -A PSW $(comment "默认") $(dst $IPSET_WHITE) -j RETURN
 			[ "$PROXY_IPV6" = "1" ] && {
-				[ "${USE_BLOCK_LIST}" = "1" ] && $ip6t_m -A PSW $(comment "默认") $(dst $IPSET_BLOCK6) -j DROP 2>/dev/null
+				[ "${USE_BLOCK_LIST}" = "1" ] && $ip6t_m -A PSW $(comment "默认") $(dst $IPSET_BLOCK6) -j MARK --set-mark 88 2>/dev/null
 				[ "${USE_DIRECT_LIST}" = "1" ] && $ip6t_m -A PSW $(comment "默认") $(dst $IPSET_WHITE6) -j RETURN 2>/dev/null
 			}
 			
 			[ "$TCP_PROXY_DROP_PORTS" != "disable" ] && {
 				[ "$PROXY_IPV6" = "1" ] && {
-					[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP_6 -j DROP"
+					[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP_6 -j MARK --set-mark 88"
-					[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK6) -j DROP"
+					[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK6) -j MARK --set-mark 88"
-					[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW6) -j DROP"
+					[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW6) -j MARK --set-mark 88"
-					[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
+					[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j MARK --set-mark 88")"
-					[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT6) -j DROP"
+					[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT6) -j MARK --set-mark 88"
-					[ "${TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-j DROP"
+					[ "${TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
 				}
-				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
+				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP -j MARK --set-mark 88"
-				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j DROP"
+				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j MARK --set-mark 88"
-				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j DROP"
+				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j MARK --set-mark 88"
-				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
+				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j MARK --set-mark 88")"
-				[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS $(dst $IPSET_SHUNT) "-j DROP"
+				[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS $(dst $IPSET_SHUNT) "-j MARK --set-mark 88"
-				[ "${TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-j DROP"
+				[ "${TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
 				echolog "     - ${msg}屏蔽代理 TCP 端口[${TCP_PROXY_DROP_PORTS}]"
 			}
 			
 			[ "$UDP_PROXY_DROP_PORTS" != "disable" ] && {
 				[ "$PROXY_IPV6" = "1" ] && {
-					[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP_6 -j DROP"
+					[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP_6 -j MARK --set-mark 88"
-					[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK6) -j DROP"
+					[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK6) -j MARK --set-mark 88"
-					[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW6) -j DROP"
+					[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW6) -j MARK --set-mark 88"
-					[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
+					[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j MARK --set-mark 88")"
-					[ "${USE_SHUNT_UDP}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT6) -j DROP"
+					[ "${USE_SHUNT_UDP}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT6) -j MARK --set-mark 88"
-					[ "${UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-j DROP"
+					[ "${UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
 				}
-				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
+				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j MARK --set-mark 88"
-				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j DROP"
+				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j MARK --set-mark 88"
-				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j DROP"
+				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j MARK --set-mark 88"
-				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
+				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j MARK --set-mark 88")"
-				[ "${USE_SHUNT_UDP}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j DROP"
+				[ "${USE_SHUNT_UDP}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j MARK --set-mark 88"
-				[ "${UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-j DROP"
+				[ "${UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
 				echolog "     - ${msg}屏蔽代理 UDP 端口[${UDP_PROXY_DROP_PORTS}]"
 			}
+
+			$ipt_m -A PSW $(comment "默认") -m mark --mark 88 -j ACCEPT 2>/dev/null
+			[ "$PROXY_IPV6" = "1" ] && {
+				$ip6t_m -A PSW $(comment "默认") -m mark --mark 88 -j ACCEPT 2>/dev/null
+			}
 		}
 
 		#  加载TCP默认代理模式
@@ -1016,6 +1028,9 @@ add_firewall_rule() {
 		is_tproxy="TPROXY"
 	fi
 
+	$ipt_f -I FORWARD $(comment "PSW_REJECT") -m mark --mark 88 -p tcp -j REJECT --reject-with tcp-reset
+	$ipt_f -I FORWARD $(comment "PSW_REJECT") -m mark --mark 88 -p udp -j REJECT
+
 	$ipt_n -N PSW
 	$ipt_n -A PSW $(dst $IPSET_LAN) -j RETURN
 	$ipt_n -A PSW $(dst $IPSET_VPS) -j RETURN
@@ -1081,7 +1096,7 @@ add_firewall_rule() {
 		done
 	}
 
-	[ "${USE_BLOCK_LIST}" = "1" ] && $ipt_m -A PSW_OUTPUT $(dst $IPSET_BLOCK) -j DROP
+	[ "${USE_BLOCK_LIST}" = "1" ] && $ipt_m -A PSW_OUTPUT $(dst $IPSET_BLOCK) -j MARK --set-mark 88
 	[ "${USE_DIRECT_LIST}" = "1" ] && $ipt_m -A PSW_OUTPUT $(dst $IPSET_WHITE) -j RETURN
 	$ipt_m -A PSW_OUTPUT -m conntrack --ctdir REPLY -j RETURN
 	$ipt_m -A PSW_OUTPUT -m mark --mark 255 -j RETURN
@@ -1121,6 +1136,9 @@ add_firewall_rule() {
 	$ip6t_m -A PSW_RULE -p udp -m conntrack --ctstate NEW,RELATED -j MARK --set-xmark ${FWMARK}
 	$ip6t_m -A PSW_RULE -j CONNMARK --save-mark
 
+	$ip6t_f -I FORWARD $(comment "PSW_REJECT") -m mark --mark 88 -p tcp -j REJECT --reject-with tcp-reset
+	$ip6t_f -I FORWARD $(comment "PSW_REJECT") -m mark --mark 88 -p udp -j REJECT
+
 	$ip6t_m -N PSW
 	$ip6t_m -A PSW $(dst $IPSET_LAN6) -j RETURN
 	$ip6t_m -A PSW $(dst $IPSET_VPS6) -j RETURN
@@ -1136,7 +1154,7 @@ add_firewall_rule() {
 	$ip6t_m -A PSW_OUTPUT -m mark --mark 255 -j RETURN
 	$ip6t_m -A PSW_OUTPUT $(dst $IPSET_LAN6) -j RETURN
 	$ip6t_m -A PSW_OUTPUT $(dst $IPSET_VPS6) -j RETURN
-	[ "${USE_BLOCK_LIST}" = "1" ] && $ip6t_m -A PSW_OUTPUT $(dst $IPSET_BLOCK6) -j DROP
+	[ "${USE_BLOCK_LIST}" = "1" ] && $ip6t_m -A PSW_OUTPUT $(dst $IPSET_BLOCK6) -j MARK --set-mark 88
 	[ "${USE_DIRECT_LIST}" = "1" ] && $ip6t_m -A PSW_OUTPUT $(dst $IPSET_WHITE6) -j RETURN
 	$ip6t_m -A PSW_OUTPUT -m conntrack --ctdir REPLY -j RETURN
 
@@ -1188,22 +1206,22 @@ add_firewall_rule() {
 
 		[ -n "${LOCALHOST_TCP_PROXY_MODE}" ] || [ -n "${LOCALHOST_UDP_PROXY_MODE}" ] && {
 			[ "$TCP_PROXY_DROP_PORTS" != "disable" ] && {
-				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
+				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP -j MARK --set-mark 88"
-				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j DROP"
+				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j MARK --set-mark 88"
-				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j DROP"
+				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j MARK --set-mark 88"
-				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
+				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j MARK --set-mark 88")"
-				[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j DROP"
+				[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j MARK --set-mark 88"
-				[ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "-j DROP"
+				[ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
 				echolog "  - ${msg}屏蔽代理 TCP 端口[${TCP_PROXY_DROP_PORTS}]"
 			}
 			
 			[ "$UDP_PROXY_DROP_PORTS" != "disable" ] && {
-				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
+				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j MARK --set-mark 88"
-				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j DROP"
+				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j MARK --set-mark 88"
-				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j DROP"
+				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j MARK --set-mark 88"
-				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
+				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j MARK --set-mark 88")"
-				[ "${USE_SHUNT_UDP}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j DROP"
+				[ "${USE_SHUNT_UDP}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j MARK --set-mark 88"
-				[ "${LOCALHOST_UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "-j DROP"
+				[ "${LOCALHOST_UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
 				echolog "  - ${msg}屏蔽代理 UDP 端口[${UDP_PROXY_DROP_PORTS}]"
 			}
 		}
@@ -1378,6 +1396,14 @@ del_firewall_rule() {
 			$ipt -X $chain 2>/dev/null
 		done
 	done
+	for ipt in "$ipt_f" "$ip6t_f"; do
+		for chain in "FORWARD" "INPUT" "OUTPUT"; do
+			for i in $(seq 1 $($ipt -nL $chain | grep -c PSW)); do
+				local index=$($ipt --line-number -nL $chain | grep PSW | head -1 | awk '{print $1}')
+				$ipt -D $chain $index 2>/dev/null
+			done
+		done
+	done
 
 	ip rule del fwmark ${FWMARK} 2>/dev/null
 	ip route del local 0.0.0.0/0 dev lo table 999 2>/dev/null

luci-app-passwall/root/usr/share/passwall/rules/chnroute

@@ -206,7 +206,8 @@
 103.130.160.0/23
 103.131.138.0/23
 103.131.152.0/22
-103.131.168.0/23
+103.131.168.0/24
+103.131.176.0/22
 103.132.212.0/23
 103.132.22.0/23
 103.133.128.0/23
@@ -224,7 +225,6 @@
 103.140.14.0/23
 103.141.10.0/23
 103.142.234.0/23
-103.142.82.0/23
 103.142.96.0/23
 103.143.16.0/22
 103.143.228.0/23
@@ -320,6 +320,8 @@
 103.200.144.0/21
 103.200.220.0/22
 103.200.224.0/24
+103.200.228.0/24
+103.200.232.0/24
 103.201.192.0/24
 103.201.196.0/24
 103.201.200.0/24
@@ -357,6 +359,7 @@
 103.212.2.0/24
 103.212.4.0/22
 103.212.48.0/23
+103.212.50.0/24
 103.213.132.0/22
 103.213.144.0/23
 103.213.148.0/22
@@ -402,6 +405,7 @@
 103.224.220.0/22
 103.224.232.0/22
 103.226.57.0/24
+103.226.59.0/24
 103.227.120.0/22
 103.227.136.0/22
 103.227.228.0/22
@@ -443,6 +447,7 @@
 103.235.220.0/22
 103.235.224.0/19
 103.235.85.0/24
+103.236.116.0/23
 103.236.120.0/22
 103.236.244.0/22
 103.236.248.0/21
@@ -471,8 +476,7 @@
 103.238.96.0/23
 103.238.98.0/24
 103.239.152.0/22
-103.239.184.0/23
+103.239.184.0/22
-103.239.186.0/24
 103.239.192.0/22
 103.239.204.0/22
 103.239.224.0/22
@@ -499,7 +503,6 @@
 103.244.64.0/22
 103.244.80.0/22
 103.245.128.0/22
-103.245.23.0/24
 103.246.152.0/22
 103.247.168.0/22
 103.247.176.0/22
@@ -598,7 +601,6 @@
 103.39.224.0/21
 103.39.232.0/22
 103.39.64.0/22
-103.4.56.0/22
 103.40.12.0/22
 103.40.173.0/24
 103.40.174.0/23
@@ -736,6 +738,7 @@
 103.83.44.0/22
 103.83.64.0/22
 103.83.72.0/22
+103.84.136.0/22
 103.84.170.0/23
 103.85.147.0/24
 103.85.164.0/22
@@ -832,7 +835,8 @@
 106.3.32.0/20
 106.3.80.0/22
 106.3.88.0/21
-106.3.96.0/22
+106.3.96.0/23
+106.3.99.0/24
 106.32.0.0/12
 106.4.0.0/14
 106.48.16.0/21
@@ -850,7 +854,6 @@
 106.80.0.0/13
 106.88.0.0/14
 106.92.0.0/16
-107.158.37.0/24
 108.165.168.0/24
 108.165.240.0/24
 109.244.0.0/16
@@ -968,7 +971,6 @@
 113.194.0.0/15
 113.197.101.0/24
 113.197.103.0/24
-113.197.104.0/23
 113.200.0.0/15
 113.204.0.0/14
 113.208.112.0/21
@@ -2051,7 +2053,6 @@
 150.138.0.0/15
 150.158.0.0/16
 150.223.0.0/16
-150.242.120.0/22
 150.242.156.0/23
 150.242.168.0/22
 150.242.184.0/22
@@ -2064,7 +2065,9 @@
 150.242.80.0/22
 150.242.96.0/22
 150.255.0.0/16
+151.158.14.0/23
 151.246.165.0/24
+151.246.184.0/24
 151.247.148.0/23
 152.104.128.0/17
 152.136.0.0/16
@@ -2105,7 +2108,7 @@
 155.102.198.0/24
 155.102.2.0/24
 155.102.20.0/24
-155.102.201.0/24
+155.102.200.0/23
 155.102.202.0/24
 155.102.205.0/24
 155.102.206.0/23
@@ -2130,8 +2133,9 @@
 155.102.70.0/24
 155.102.72.0/21
 155.102.8.0/21
+155.102.86.0/24
 155.102.91.0/24
-155.102.92.0/22
+155.102.92.0/24
 155.102.98.0/23
 155.126.176.0/23
 156.107.160.0/23
@@ -2187,6 +2191,7 @@
 162.14.0.0/16
 163.0.0.0/16
 163.125.0.0/16
+163.128.254.0/23
 163.142.0.0/16
 163.177.0.0/16
 163.179.0.0/16
@@ -2241,14 +2246,13 @@
 163.181.26.0/24
 163.181.32.0/21
 163.181.40.0/24
-163.181.42.0/24
+163.181.42.0/23
 163.181.44.0/22
 163.181.48.0/21
 163.181.56.0/22
 163.181.60.0/23
 163.181.63.0/24
 163.181.66.0/23
-163.181.69.0/24
 163.181.71.0/24
 163.181.72.0/23
 163.181.74.0/24
@@ -2282,6 +2286,7 @@
 163.61.202.0/23
 163.61.214.0/23
 164.163.236.0/22
+164.37.202.0/23
 165.101.208.0/23
 165.101.70.0/23
 166.111.0.0/16
@@ -2293,7 +2298,6 @@
 168.160.158.0/23
 168.160.160.0/21
 168.160.168.0/24
-168.160.224.0/19
 170.33.98.0/24
 171.104.0.0/13
 171.112.0.0/12
@@ -2394,6 +2398,7 @@
 180.91.192.0/20
 180.95.128.0/17
 180.96.0.0/11
+181.41.212.0/24
 182.128.0.0/12
 182.144.0.0/13
 182.157.0.0/16
@@ -2440,6 +2445,7 @@
 183.81.180.0/22
 183.84.0.0/15
 183.91.144.0/20
+183.91.37.0/24
 183.91.39.0/24
 183.91.40.0/21
 183.91.48.0/21
@@ -2452,15 +2458,18 @@
 185.75.173.0/24
 185.75.174.0/24
 188.131.128.0/17
+188.220.127.0/24
+188.221.14.0/24
 188.221.99.0/24
 189.12.48.0/24
+189.31.222.0/24
 189.73.18.0/24
 189.75.185.0/24
 189.75.186.0/24
 191.217.175.0/24
 191.219.18.0/24
 191.222.242.0/24
-191.222.244.0/24
+191.222.244.0/23
 191.222.43.0/24
 191.44.18.0/24
 192.140.160.0/19
@@ -2477,7 +2486,6 @@
 194.138.245.0/24
 194.179.146.0/24
 194.231.140.0/24
-195.162.246.0/24
 195.40.157.0/24
 195.40.158.0/24
 198.208.112.0/23
@@ -2595,9 +2603,10 @@
 202.46.232.0/23
 202.47.104.0/21
 202.55.0.0/19
-202.57.192.0/24
+202.57.192.0/23
 202.57.196.0/22
 202.57.200.0/23
+202.57.202.0/24
 202.57.204.0/23
 202.59.213.0/24
 202.59.214.0/23
@@ -2640,7 +2649,9 @@
 203.100.92.0/22
 203.104.32.0/20
 203.107.1.0/24
-203.107.116.0/22
+203.107.112.0/21
+203.107.120.0/22
+203.107.124.0/23
 203.107.13.0/24
 203.107.2.0/24
 203.107.20.0/22
@@ -2672,6 +2683,7 @@
 203.119.83.0/24
 203.12.91.0/24
 203.12.93.0/24
+203.12.95.0/24
 203.129.12.0/22
 203.13.81.0/24
 203.130.32.0/22
@@ -2737,7 +2749,8 @@
 203.2.64.0/21
 203.201.181.0/24
 203.202.236.0/23
-203.205.88.0/24
+203.205.88.0/23
+203.205.90.0/24
 203.207.104.0/22
 203.207.112.0/20
 203.207.128.0/18
@@ -2928,6 +2941,7 @@
 203.95.128.0/23
 203.95.2.0/24
 203.95.4.0/22
+203.99.18.0/24
 203.99.20.0/22
 203.99.24.0/21
 204.14.76.0/24
@@ -3014,7 +3028,6 @@
 210.78.128.0/24
 210.78.134.0/23
 210.78.139.0/24
-210.78.144.0/23
 210.79.224.0/19
 210.82.0.0/15
 210.87.128.0/18
@@ -3058,7 +3071,8 @@
 211.144.96.0/23
 211.145.0.0/18
 211.145.64.0/20
-211.146.0.0/16
+211.146.0.0/19
+211.146.32.0/21
 211.147.0.0/18
 211.147.128.0/19
 211.147.208.0/20
@@ -3161,7 +3175,8 @@
 211.167.64.0/18
 211.64.0.0/13
 211.80.0.0/13
-211.88.0.0/15
+211.88.0.0/16
+211.89.230.0/23
 211.90.0.0/17
 211.90.128.0/18
 211.90.192.0/20
@@ -3195,7 +3210,12 @@
 211.95.0.0/17
 211.95.128.0/19
 211.95.192.0/18
-211.96.0.0/15
+211.96.0.0/16
+211.97.0.0/17
+211.97.128.0/19
+211.97.160.0/21
+211.97.176.0/20
+211.97.192.0/18
 211.98.0.0/16
 211.99.128.0/18
 211.99.16.0/23
@@ -3209,6 +3229,7 @@
 212.189.97.0/24
 212.64.0.0/17
 213.210.55.0/24
+216.75.141.0/24
 218.0.0.0/11
 218.100.88.0/21
 218.104.0.0/15
@@ -3458,7 +3479,7 @@
 223.0.16.0/24
 223.0.2.0/24
 223.0.30.0/24
-223.0.40.0/23
+223.0.41.0/24
 223.0.8.0/22
 223.128.0.0/15
 223.144.0.0/12
@@ -3486,7 +3507,7 @@
 223.202.0.0/24
 223.202.131.0/24
 223.202.132.0/24
-223.202.134.0/23
+223.202.135.0/24
 223.202.211.0/24
 223.202.212.0/24
 223.202.67.0/24
@@ -3577,16 +3598,14 @@
 38.105.24.0/24
 38.105.26.0/23
 38.105.28.0/22
-38.134.56.0/24
 38.134.58.0/23
-38.247.24.0/22
+38.247.24.0/24
-38.247.32.0/23
+38.247.27.0/24
-38.247.35.0/24
+38.247.38.0/24
-38.247.36.0/22
 38.84.220.0/24
 38.95.118.0/23
 38.95.121.0/24
-38.95.122.0/23
+38.95.122.0/24
 38.95.124.0/22
 39.104.0.0/14
 39.108.0.0/16
@@ -3657,39 +3676,40 @@
 43.102.144.0/20
 43.109.0.0/23
 43.109.10.0/24
-43.109.100.0/23
+43.109.100.0/22
-43.109.102.0/24
 43.109.105.0/24
-43.109.107.0/24
+43.109.106.0/23
 43.109.108.0/22
 43.109.112.0/24
 43.109.114.0/23
 43.109.116.0/23
 43.109.118.0/24
 43.109.12.0/22
+43.109.120.0/24
 43.109.133.0/24
 43.109.134.0/23
 43.109.136.0/22
+43.109.140.0/23
 43.109.143.0/24
 43.109.144.0/23
 43.109.146.0/24
-43.109.148.0/24
+43.109.148.0/23
+43.109.150.0/24
 43.109.156.0/24
 43.109.16.0/22
 43.109.160.0/22
-43.109.164.0/24
+43.109.164.0/23
 43.109.167.0/24
-43.109.169.0/24
+43.109.168.0/21
-43.109.170.0/24
+43.109.176.0/24
-43.109.172.0/22
 43.109.184.0/23
-43.109.191.0/24
+43.109.190.0/23
 43.109.192.0/21
 43.109.2.0/24
 43.109.200.0/23
 43.109.202.0/24
 43.109.206.0/24
-43.109.208.0/24
+43.109.208.0/23
 43.109.21.0/24
 43.109.22.0/24
 43.109.223.0/24
@@ -3700,8 +3720,7 @@
 43.109.30.0/23
 43.109.32.0/23
 43.109.34.0/24
-43.109.37.0/24
+43.109.36.0/22
-43.109.38.0/23
 43.109.4.0/23
 43.109.40.0/22
 43.109.44.0/23
@@ -3722,7 +3741,7 @@
 43.109.83.0/24
 43.109.84.0/22
 43.109.88.0/22
-43.109.93.0/24
+43.109.92.0/23
 43.109.94.0/24
 43.109.96.0/23
 43.136.0.0/13
@@ -3791,7 +3810,7 @@
 43.231.46.0/23
 43.231.96.0/20
 43.239.120.0/22
-43.239.172.0/24
+43.239.172.0/23
 43.240.0.0/22
 43.240.124.0/22
 43.240.128.0/22
@@ -3903,9 +3922,14 @@
 44.30.120.0/24
 44.30.130.0/23
 44.30.152.0/24
+44.30.164.0/24
+44.30.169.0/24
+44.30.171.0/24
+44.31.212.0/24
 44.31.216.0/24
 44.31.28.0/24
 44.31.43.0/24
+44.32.185.0/24
 44.32.191.0/24
 44.32.69.0/24
 45.112.232.0/22
@@ -3944,6 +3968,7 @@
 45.124.68.0/22
 45.124.76.0/22
 45.124.80.0/22
+45.125.25.0/24
 45.125.44.0/22
 45.125.56.0/22
 45.126.112.0/22
@@ -4030,6 +4055,7 @@
 49.120.0.0/14
 49.140.0.0/15
 49.208.0.0/14
+49.213.62.0/23
 49.221.128.0/19
 49.221.26.0/23
 49.221.64.0/19
@@ -4050,6 +4076,10 @@
 5.10.140.0/24
 5.10.143.0/24
 50.114.121.0/24
+51.146.239.0/24
+51.194.210.0/24
+51.241.139.0/24
+51.241.143.0/24
 52.130.0.0/15
 52.80.0.0/15
 52.82.0.0/17
@@ -4218,10 +4248,13 @@
 63.140.0.0/24
 63.140.3.0/24
 65.86.192.0/24
+65.86.204.0/24
 66.102.240.0/21
 66.102.248.0/22
 66.102.252.0/24
 66.102.254.0/23
+68.166.193.0/24
+68.166.209.0/24
 68.79.0.0/18
 69.163.104.0/24
 69.163.106.0/24
@@ -4230,10 +4263,12 @@
 69.231.128.0/18
 69.234.192.0/18
 69.235.128.0/18
+69.33.203.0/24
 71.131.192.0/18
 71.132.0.0/18
 71.136.64.0/18
 71.137.0.0/18
+78.105.125.0/24
 78.105.147.0/24
 78.105.182.0/23
 78.154.108.0/24
@@ -4258,11 +4293,12 @@
 8.150.64.0/23
 8.152.0.0/13
 8.160.0.0/15
-8.162.0.0/18
+8.162.0.0/17
-8.162.64.0/19
 8.163.0.0/16
 8.164.0.0/14
 8.168.0.0/15
+8.176.0.0/17
+8.176.128.0/19
 8.25.82.0/24
 8.38.121.0/24
 8.45.176.0/24
@@ -4284,4 +4320,5 @@
 87.76.221.0/24
 87.76.222.0/24
 87.83.2.0/24
+92.118.189.0/24
 94.191.0.0/17

luci-app-passwall/root/usr/share/passwall/rules/chnroute6

@@ -4,7 +4,11 @@
 2001:4510:1480::/41
 2001:4510:400::/40
 2001:4511:1480::/41
+2001:678:10d0::/48
+2001:678:120::/48
 2001:678:53c::/48
+2001:67c:c28::/48
+2001:67c:ebc::/48
 2001:c68::/32
 2001:cc0::/32
 2001:da8::/32
@@ -12,6 +16,7 @@
 2001:daa:2::/47
 2001:daa:4::/47
 2001:daa:6::/48
+2001:daa:9::/48
 2001:dc7::/32
 2001:dd8:1::/48
 2001:dd9::/48
@@ -21,7 +26,6 @@
 2400:3200::/32
 2400:5280:f803::/48
 2400:5a00::/32
-2400:5a60:2::/48
 2400:6000::/32
 2400:6600::/32
 2400:6e60:1301::/48
@@ -75,12 +79,14 @@
 2400:9380:9260::/48
 2400:9380:9271::/48
 2400:9380:9280::/47
+2400:9380:9282::/48
 2400:9380:92b1::/48
 2400:9380:92b2::/47
 2400:9380:92b4::/46
 2400:95e0::/48
 2400:9600:8800::/48
 2400:9620::/32
+2400:a040::/32
 2400:a860:1::/48
 2400:a860:2::/47
 2400:a860:4::/47
@@ -181,7 +187,7 @@
 2401:ec00::/32
 2401:f860:100::/40
 2401:f860:85::/48
-2401:f860:88::/47
+2401:f860:88::/48
 2401:f860:90::/48
 2401:f860:92::/47
 2401:f860:94::/48
@@ -208,8 +214,10 @@
 2402:4440:a000::/39
 2402:4440:a800::/46
 2402:4440:a810::/46
+2402:4820::/32
 2402:4b80::/32
 2402:4e00::/32
+2402:5920::/48
 2402:5e40::/32
 2402:5ec0::/32
 2402:6e80::/32
@@ -280,36 +288,151 @@
 2403:b400::/32
 2403:c80::/32
 2403:c980::/32
+2403:cec0::/32
 2403:d400::/32
 2403:e7c0:3::/48
 2403:f4c0::/48
 2403:ffc0:1100::/40
 2403:ffc0:1200::/39
+2404:1c40:503::/48
 2404:1c80::/32
 2404:2280:105::/48
-2404:2280:10b::/48
+2404:2280:106::/47
+2404:2280:109::/48
+2404:2280:10a::/47
 2404:2280:10d::/48
-2404:2280:112::/48
+2404:2280:10f::/48
+2404:2280:112::/47
 2404:2280:115::/48
-2404:2280:11c::/48
+2404:2280:116::/48
+2404:2280:11a::/47
+2404:2280:11c::/46
 2404:2280:123::/48
-2404:2280:127::/48
+2404:2280:125::/48
-2404:2280:12b::/48
+2404:2280:126::/47
+2404:2280:128::/46
 2404:2280:12e::/48
+2404:2280:130::/48
+2404:2280:134::/48
+2404:2280:136::/47
 2404:2280:138::/48
+2404:2280:13b::/48
+2404:2280:13c::/47
 2404:2280:142::/48
+2404:2280:147::/48
+2404:2280:14f::/48
 2404:2280:150::/48
+2404:2280:154::/48
 2404:2280:156::/47
-2404:2280:17b::/48
+2404:2280:159::/48
+2404:2280:15d::/48
+2404:2280:15e::/47
+2404:2280:160::/48
+2404:2280:170::/48
+2404:2280:177::/48
+2404:2280:17a::/47
+2404:2280:17c::/46
 2404:2280:180::/47
 2404:2280:183::/48
-2404:2280:18a::/48
+2404:2280:187::/48
-2404:2280:18d::/48
+2404:2280:18a::/47
-2404:2280:18e::/47
+2404:2280:18c::/46
+2404:2280:190::/48
+2404:2280:193::/48
 2404:2280:196::/48
-2404:2280:19a::/47
+2404:2280:198::/45
-2404:2280:19c::/48
+2404:2280:1a4::/46
-2404:2280:277::/48
+2404:2280:1a8::/47
+2404:2280:1b0::/48
+2404:2280:1b2::/48
+2404:2280:1b4::/46
+2404:2280:1b8::/47
+2404:2280:1ba::/48
+2404:2280:1bf::/48
+2404:2280:1c1::/48
+2404:2280:1c2::/47
+2404:2280:1c4::/46
+2404:2280:1c8::/48
+2404:2280:1cb::/48
+2404:2280:1cc::/48
+2404:2280:1cf::/48
+2404:2280:1d0::/47
+2404:2280:1d3::/48
+2404:2280:1d4::/48
+2404:2280:1d6::/47
+2404:2280:1d8::/45
+2404:2280:1e0::/45
+2404:2280:1e8::/46
+2404:2280:1ec::/47
+2404:2280:1ee::/48
+2404:2280:1f0::/45
+2404:2280:1f8::/46
+2404:2280:1fe::/48
+2404:2280:201::/48
+2404:2280:202::/47
+2404:2280:205::/48
+2404:2280:206::/47
+2404:2280:208::/46
+2404:2280:20c::/47
+2404:2280:20e::/48
+2404:2280:210::/46
+2404:2280:214::/48
+2404:2280:216::/47
+2404:2280:218::/46
+2404:2280:21d::/48
+2404:2280:21e::/48
+2404:2280:221::/48
+2404:2280:226::/47
+2404:2280:259::/48
+2404:2280:25a::/47
+2404:2280:25c::/48
+2404:2280:265::/48
+2404:2280:266::/47
+2404:2280:268::/45
+2404:2280:270::/44
+2404:2280:282::/47
+2404:2280:284::/47
+2404:2280:288::/46
+2404:2280:28c::/48
+2404:2280:291::/48
+2404:2280:292::/48
+2404:2280:296::/47
+2404:2280:298::/46
+2404:2280:29c::/47
+2404:2280:2a0::/47
+2404:2280:2a3::/48
+2404:2280:2a4::/46
+2404:2280:2a9::/48
+2404:2280:2aa::/48
+2404:2280:2ad::/48
+2404:2280:2ae::/47
+2404:2280:2b1::/48
+2404:2280:2b2::/47
+2404:2280:2b5::/48
+2404:2280:2b6::/47
+2404:2280:2b8::/47
+2404:2280:2ba::/48
+2404:2280:2bc::/46
+2404:2280:2c2::/47
+2404:2280:2c5::/48
+2404:2280:2c6::/47
+2404:2280:2c8::/46
+2404:2280:2cd::/48
+2404:2280:2ce::/47
+2404:2280:2da::/47
+2404:2280:2dc::/47
+2404:2280:2df::/48
+2404:2280:2f1::/48
+2404:2280:2f2::/48
+2404:2280:2f6::/47
+2404:2280:2f8::/47
+2404:2280:2fb::/48
+2404:2280:2fc::/48
+2404:2280:308::/46
+2404:2280:30d::/48
+2404:2280:313::/48
+2404:2280:314::/48
+2404:2280:317::/48
 2404:3700::/48
 2404:4dc0::/32
 2404:6380:1000::/48
@@ -332,6 +455,8 @@
 2404:7240::/33
 2404:7600::/32
 2404:7940::/32
+2404:8d02:28c8::/48
+2404:8d02:4881::/48
 2404:bc0:1::/48
 2404:bc0:4000::/43
 2404:bc0:4100::/43
@@ -339,6 +464,7 @@
 2404:bc0:4300::/44
 2404:bc0:4400::/43
 2404:bc0:4500::/43
+2404:bc0:4620::/44
 2404:bc0:4f00::/43
 2404:c2c0:240::/44
 2404:c2c0:280::/44
@@ -355,10 +481,12 @@
 2404:c940::/48
 2404:e280::/47
 2404:e8c0::/32
+2404:eb80::/48
 2404:f4c0:f000::/44
 2405:1480:1000::/48
 2405:1480:2000::/48
 2405:1480:3000::/47
+2405:1640:6::/48
 2405:3140:11::/48
 2405:3140:21::/48
 2405:3140:31::/48
@@ -450,7 +578,7 @@
 2406:840:981a::/48
 2406:840:981c::/46
 2406:840:9962::/47
-2406:840:9966::/48
+2406:840:9966::/47
 2406:840:996c::/48
 2406:840:9970::/44
 2406:840:a10::/48
@@ -463,16 +591,14 @@
 2406:840:e0cf::/48
 2406:840:e0e0::/46
 2406:840:e0e4::/47
-2406:840:e0e8::/48
 2406:840:e10f::/48
 2406:840:e14f::/48
 2406:840:e280::/44
 2406:840:e301::/48
-2406:840:e302::/48
+2406:840:e302::/47
 2406:840:e304::/48
 2406:840:e306::/48
 2406:840:e330::/44
-2406:840:e57e::/48
 2406:840:e600::/44
 2406:840:e620::/47
 2406:840:e80f::/48
@@ -488,6 +614,7 @@
 2406:840:ee4b::/48
 2406:840:ee4d::/48
 2406:840:eee5::/48
+2406:840:eff0::/44
 2406:840:f0a1::/48
 2406:840:f0aa::/48
 2406:840:f380::/44
@@ -500,49 +627,19 @@
 2406:840:f86c::/48
 2406:840:f889::/48
 2406:840:fa01::/48
+2406:840:fa40::/48
 2406:840:fa60::/44
-2406:840:fc10::/47
+2406:840:fc10::/44
-2406:840:fc12::/48
+2406:840:fc20::/43
-2406:840:fc20::/47
+2406:840:fc40::/42
-2406:840:fc22::/48
+2406:840:fc90::/44
-2406:840:fc30::/47
+2406:840:fca0::/43
-2406:840:fc32::/48
-2406:840:fc40::/47
-2406:840:fc42::/48
-2406:840:fc50::/47
-2406:840:fc52::/48
-2406:840:fc60::/47
-2406:840:fc62::/48
-2406:840:fc70::/47
-2406:840:fc72::/48
-2406:840:fc90::/47
-2406:840:fc92::/48
-2406:840:fca0::/47
-2406:840:fca2::/48
-2406:840:fcb0::/47
-2406:840:fcb2::/48
 2406:840:fcd0::/48
 2406:840:fcf0::/46
 2406:840:fcf4::/47
 2406:840:fd30::/44
-2406:840:fd40::/48
+2406:840:fd40::/42
-2406:840:fd46::/47
+2406:840:fd80::/43
-2406:840:fd48::/48
-2406:840:fd50::/48
-2406:840:fd56::/47
-2406:840:fd58::/48
-2406:840:fd60::/48
-2406:840:fd66::/47
-2406:840:fd68::/48
-2406:840:fd70::/48
-2406:840:fd76::/47
-2406:840:fd78::/48
-2406:840:fd80::/48
-2406:840:fd86::/47
-2406:840:fd88::/48
-2406:840:fd90::/47
-2406:840:fd92::/48
-2406:840:fd9f::/48
 2406:840:fda0::/48
 2406:840:fda7::/48
 2406:840:fdb0::/48
@@ -1276,8 +1373,10 @@
 2602:f92a:a462::/48
 2602:f92a:a468::/48
 2602:f92a:a46d::/48
+2602:f92a:a470::/48
 2602:f92a:a474::/48
 2602:f92a:a47d::/48
+2602:f92a:dead::/48
 2602:f9ba:10c::/48
 2602:f9f6:400::/47
 2602:f9f6:402::/48
@@ -1305,6 +1404,8 @@
 2605:9d80:9092::/48
 2804:1e48:9001::/48
 2804:1e48:9002::/48
+2a01:e281:a400::/48
+2a01:e281:a410::/44
 2a04:3e00:1002::/48
 2a04:f580:8010::/47
 2a04:f580:8090::/48
@@ -1336,25 +1437,55 @@
 2a06:3600:fc00::/38
 2a06:3605::/32
 2a06:3606::/31
+2a06:9801:74c::/48
+2a06:9f81:4600::/42
+2a06:9f81:4640::/43
+2a06:9f81:4660::/44
+2a06:a005:2040::/44
 2a06:a005:260::/43
 2a06:a005:280::/43
 2a06:a005:2a0::/44
+2a06:a005:e50::/44
+2a06:a005:e70::/44
 2a07:54c1:2200::/46
 2a07:54c1:2205::/48
+2a0a:6040:6c40::/44
+2a0a:6040:c700::/42
+2a0a:6040:c770::/44
+2a0a:6040:c7a0::/48
+2a0a:6040:d600::/44
+2a0a:6040:d610::/46
+2a0a:6040:d615::/48
+2a0a:6040:d616::/48
+2a0a:6040:d618::/47
+2a0a:6040:d623::/48
+2a0a:6040:d624::/48
+2a0a:6040:d629::/48
+2a0a:6040:e541::/48
+2a0a:6040:e543::/48
+2a0a:6040:e544::/48
+2a0a:6040:e54c::/48
 2a0a:d680:8100::/47
 2a0a:d680:a31::/48
 2a0a:d681:e000::/40
 2a0a:d681:fb00::/40
 2a0a:d681:fc00::/38
-2a0a:d685:1ff::/48
+2a0a:d685:1fe::/47
-2a0a:d685:200::/48
+2a0a:d685:200::/47
+2a0a:d685:300::/40
 2a0a:d687:f001::/48
+2a0a:d687:f004::/47
+2a0a:d687:f007::/48
 2a0a:d687:f008::/48
 2a0b:4340:90::/48
 2a0b:4340:97::/48
+2a0b:4e07:b8::/47
 2a0c:b641:570::/47
 2a0c:b641:573::/48
 2a0d:c7c7:400::/38
+2a0e:4005:ff13::/48
+2a0e:4005:ff20::/48
+2a0e:97c0:5ef::/48
 2a0e:aa06:400::/44
 2a0e:aa06:440::/48
 2a0e:aa06:450::/44
@@ -1364,6 +1495,7 @@
 2a0e:aa07:e144::/48
 2a0e:aa07:e146::/48
 2a0e:aa07:e148::/48
+2a0e:aa07:e1a0::/44
 2a0e:aa07:e280::/47
 2a0e:aa07:e284::/46
 2a0e:aa07:e288::/46
@@ -1375,6 +1507,7 @@
 2a0e:aa07:f0de::/47
 2a0e:b107:14a0::/44
 2a0e:b107:1522::/48
+2a0e:b107:1a40::/46
 2a0e:b107:2440::/44
 2a0e:b107:740::/44
 2a0e:b107:da0::/44
@@ -1385,15 +1518,16 @@
 2a0f:1cc5:1041::/48
 2a0f:1cc5:110::/44
 2a0f:1cc5:130::/44
+2a0f:1cc5:1310::/44
 2a0f:1cc5:140::/42
 2a0f:1cc5:14::/46
 2a0f:1cc5:1600::/44
+2a0f:1cc5:1901::/48
 2a0f:1cc5:1c00::/47
 2a0f:1cc5:1c02::/48
 2a0f:1cc5:1c20::/48
 2a0f:1cc5:1c30::/48
 2a0f:1cc5:1cc0::/48
-2a0f:1cc5:1d10::/47
 2a0f:1cc5:1f::/48
 2a0f:1cc5:2000::/40
 2a0f:1cc5:2510::/44
@@ -1402,32 +1536,50 @@
 2a0f:1cc5:2680::/42
 2a0f:1cc5:2d01::/48
 2a0f:1cc5:2d03::/48
-2a0f:1cc5:3203::/48
-2a0f:1cc5:3222::/48
 2a0f:1cc5:3700::/43
 2a0f:1cc5:40::/48
+2a0f:1cc5:4508::/46
+2a0f:1cc5:450c::/47
+2a0f:1cc5:45ff::/48
+2a0f:1cc5:4700::/40
 2a0f:1cc5:600::/47
 2a0f:1cc5:603::/48
+2a0f:1cc5:642::/48
 2a0f:1cc5:661::/48
 2a0f:1cc5:662::/48
 2a0f:1cc5:6a0::/48
-2a0f:1cc5:f01::/48
+2a0f:1cc5:a00::/48
-2a0f:1cc5:f02::/47
+2a0f:1cc5:c01::/48
-2a0f:1cc5:f04::/46
+2a0f:1cc5:f00::/45
 2a0f:1cc5:f08::/47
 2a0f:1cc5:fff::/48
 2a0f:1cc6:b110::/47
 2a0f:1cc6:b210::/47
 2a0f:1cc6:b212::/48
 2a0f:2706::/32
+2a0f:6280:1400::/44
+2a0f:6280:1430::/44
+2a0f:6280:1440::/43
+2a0f:6280:1460::/44
+2a0f:6280:1480::/44
+2a0f:6284:4c00::/43
+2a0f:6284:4c20::/44
+2a0f:6284:4c30::/48
+2a0f:6284:4c40::/43
+2a0f:6284:4c60::/44
+2a0f:6284:4c80::/43
+2a0f:6284:4ca0::/44
+2a0f:6284:4cc0::/43
 2a0f:85c1:bfe::/48
 2a0f:9400:6110::/48
 2a10:ccc0:cc1::/48
 2a10:ccc0:cc2::/48
 2a10:ccc0:ccc::/48
+2a12:3fc2:aa40::/44
 2a12:cb41:1200::/44
-2a12:cb41:1300::/44
+2a12:cb41:1300::/43
 2a12:cb41:13f0::/44
+2a12:cb41:600::/44
 2a12:cb41::/44
 2a12:cb46::/36
 2a12:cb47:ffff::/48
@@ -1439,23 +1591,50 @@
 2a13:1801:200::/44
 2a13:1802::/43
 2a13:8c87::/32
+2a13:9500:194::/47
 2a13:a5c3:f000::/40
 2a13:a5c3:ff41::/48
 2a13:a5c3:ff50::/44
 2a13:a5c5::/48
+2a13:aac4:f000::/44
 2a13:b487:1200::/42
-2a14:67c1:b500::/48
+2a13:b487:1330::/47
+2a14:67c1:70::/48
+2a14:67c1:74::/47
+2a14:67c1:a020::/48
+2a14:67c1:a023::/48
+2a14:67c1:a024::/48
+2a14:67c1:a02a::/48
+2a14:67c1:a02f::/48
+2a14:67c1:a110::/44
+2a14:67c1:a123::/48
+2a14:67c1:a125::/48
+2a14:67c1:a128::/48
+2a14:67c1:a144::/48
+2a14:67c1:b100::/46
+2a14:67c1:b105::/48
+2a14:67c1:b107::/48
+2a14:67c1:b110::/48
+2a14:67c1:b130::/46
+2a14:67c1:b134::/48
+2a14:67c1:b136::/48
+2a14:67c1:b141::/48
+2a14:67c1:b142::/47
+2a14:67c1:b146::/47
+2a14:67c1:b148::/48
 2a14:67c1:b511::/48
 2a14:67c1:b514::/48
 2a14:67c1:b530::/44
 2a14:67c1:b563::/48
 2a14:67c1:b578::/48
+2a14:67c1:b582::/48
 2a14:67c1:b586::/47
 2a14:67c1:b588::/47
 2a14:67c1:b590::/48
-2a14:67c1:b599::/48
 2a14:67c1:b5e0::/44
-2a14:67c2:519::/48
+2a14:67c1:c300::/40
+2a14:67c1:c600::/40
+2a14:67c2:500::/40
 2a14:67c2:a10::/47
 2a14:67c2:a21::/48
 2a14:67c2:a22::/47
@@ -1466,9 +1645,19 @@
 2a14:67c2:a70::/47
 2a14:67c2:a80::/47
 2a14:67c2:a90::/48
-2a14:67c3:1100::/47
+2a14:67c2:aa1::/48
+2a14:67c2:c05::/48
+2a14:67c2:c08::/47
+2a14:67c2:c0c::/47
+2a14:67c3:190::/47
+2a14:67c3:192::/48
+2a14:67c3:30::/44
+2a14:67c3:360::/48
 2a14:67c3:9990::/44
 2a14:67c3:c0::/48
+2a14:67c3:caf0::/44
+2a14:67c3:fff0::/44
+2a14:7580:730::/44
 2a14:7580:740::/44
 2a14:7580:d00::/43
 2a14:7580:d20::/46
@@ -1476,15 +1665,22 @@
 2a14:7580:d42::/47
 2a14:7580:dff::/48
 2a14:7580:fffa::/48
-2a14:7581:3810::/47
+2a14:7581:30b6::/48
+2a14:7581:3100::/40
+2a14:7581:3810::/48
 2a14:7581:3814::/48
 2a14:7581:ffb::/48
+2a14:7583:efff::/48
 2a14:7583:f220::/43
 2a14:7583:f240::/42
+2a14:7583:f300::/46
+2a14:7583:f304::/47
+2a14:7583:f306::/48
 2a14:7583:f411::/48
-2a14:7583:f4f0::/48
+2a14:7583:f4f0::/47
 2a14:7583:f4f4::/48
 2a14:7583:f4fe::/48
+2a14:7583:f500::/48
 2a14:7583:f701::/48
 2a14:7583:f703::/48
 2a14:7583:f704::/46
@@ -1495,13 +1691,15 @@
 2a14:7583:f764::/48
 2a14:7586:6100::/47
 2a14:7586:6103::/48
-2a14:7586:6104::/47
+2a14:7586:6104::/46
-2a14:7586:6106::/48
+2a14:7586:6108::/48
 2a14:7586:6110::/48
 2a14:7586:6113::/48
 2a14:7586:6300::/44
 2a14:7586:6500::/48
 2a14:7dc0:506::/48
+2a14:7dc0:520::/48
+2a14:7dc0:52f::/48
 2a14:ae00:50::/44
 2c0f:f7a8:8011::/48
 2c0f:f7a8:8050::/48

luci-app-passwall/root/usr/share/passwall/rules/gfwlist

@@ -131,6 +131,7 @@ aiosearch.com
 aiph.net
 airconsole.com
 airitilibrary.com
+airuniversity.af.edu
 airvpn.org
 ait.org.tw
 aiweiweiblog.com
@@ -870,6 +871,7 @@ crazypool.org
 crazyshit.com
 crbug.com
 crchina.org
+creader.com
 creaders.net
 creativelab5.com
 cristyli.com
@@ -1161,6 +1163,7 @@ expatshield.com
 expecthim.com
 expekt.com
 exploader.net
+expressnews.com
 expressvpn.com
 exrates.me
 extmatrix.com
@@ -1403,6 +1406,7 @@ gaoming.net
 gaopi.net
 gartlive.com
 garudalinux.org
+gate.com
 gate.io
 gatecoin.com
 gather.com
@@ -1423,6 +1427,7 @@ generated.photos
 genius.com
 geph.io
 get.app
+get.dappcdn.com
 get.dev
 get.how
 get.page
@@ -1779,6 +1784,7 @@ gtv.org
 gtv1.org
 gu-chu-sum.org
 guaguass.com
+guangming.com.my
 guishan.org
 gumroad.com
 gunsamerica.com
@@ -1869,6 +1875,7 @@ hkgolden.com
 hkgpao.com
 hklts.org.hk
 hkmap.live
+hkong.hk
 hkopentv.com
 hkpeanut.com
 hkreporter.com
@@ -2173,6 +2180,7 @@ kenengba.com
 kepard.com
 kex.com
 keycdn.com
+kfor.com
 khatrimaza.org
 kichiku-doujinko.com
 kik.com
@@ -2425,6 +2433,7 @@ mfxmedia.com
 mgoon.com
 mgstage.com
 mh4u.org
+mhwindow.org
 microvpn.com
 mihua.org
 mij.rip
@@ -2809,6 +2818,7 @@ pbs.org
 pbworks.com
 pbxes.com
 pbxes.org
+pcgamesn.com
 pcgamestorrents.com
 pcij.org
 pct.org.tw
@@ -2827,6 +2837,7 @@ peoplenews.tw
 peopo.org
 perfect-privacy.com
 periscope.tv
+perma.cc
 perplexity.ai
 pewresearch.org
 phayul.com
@@ -3075,6 +3086,7 @@ rentry.co
 renyurenquan.org
 resilio.com
 resistchina.org
+restofworld.org
 retweetrank.com
 reuters.com
 reutersmedia.net
@@ -3310,6 +3322,7 @@ southmongolia.org
 southnews.com.tw
 southpark.cc.com
 sowers.org.hk
+spaceforce.mil
 spaces.hightail.com
 spacex.com
 spankbang.com
@@ -3401,6 +3414,7 @@ superpages.com
 supervpn.net
 superzooi.com
 support.futunn.com
+supremecourt.gov
 suprememastertv.com
 surfeasy.com
 surfeasy.com.au
@@ -3511,6 +3525,7 @@ thehansindia.com
 thehindu.com
 thehun.net
 theinitium.com
+theintercept.com
 thenewslens.com
 thepiratebay.org
 theporndude.com
@@ -3668,6 +3683,7 @@ trendsmap.com
 tronscan.org
 trouw.nl
 trt.net.tr
+trtworld.com
 truebuddha-md.org
 trustwallet.com
 truthsocial.com
@@ -3763,6 +3779,7 @@ twitturk.com
 twitturly.com
 twkan.com
 twreporter.org
+twstalker.com
 twt.tl
 twtkr.com
 twttr.com
@@ -3977,6 +3994,7 @@ wanz-factory.com
 warroom.org
 waselpro.com
 washingtonpost.com
+washingtontimes.com
 watchinese.com
 watchmygf.net
 watchout.tw
@@ -3995,6 +4013,7 @@ webmproject.org
 webpkgcache.com
 webrtc.org
 websdr.org
+webshare.io
 website.new
 webwarper.net
 wechatlawsuit.com
@@ -4197,6 +4216,7 @@ xskywalker.com
 xt.com
 xt.pub
 xtube.com
+xuan.com.my
 xuchao.net
 xuchao.org
 xuehua.us

luci-theme-aurora/.dev/.env.example

@@ -1,4 +1,4 @@
-# Optional — run `pnpm setup` once and you usually don't need a .env at all.
+# Optional — run `pnpm setup:router` once and it writes/updates every value below.
 
 # OpenWrt router address — bare IP/hostname; the web proxy target and the
 # .ut-sync ssh target both derive from it (ssh key selection etc. belongs

luci-theme-aurora/.dev/.npmrc

@@ -0,0 +1,4 @@
+# Fail `pnpm install` early with a clear message on unsupported Node versions
+# (the range in package.json `engines` mirrors Vite 7's requirement) instead
+# of letting the install die somewhere deep inside a dependency.
+engine-strict=true

luci-theme-aurora/.dev/docs/DEVELOPMENT.md

@@ -4,7 +4,7 @@ This guide covers the complete development workflow for the Aurora theme, from e
 
 ## Prerequisites
 
-- **[Node.js v20.19+](https://nodejs.org/en/download)** - JavaScript runtime
+- **[Node.js 20.19+ / 22.12+](https://nodejs.org/en/download)** - JavaScript runtime (mirrors Vite 7's support range — odd releases like 21.x don't qualify; enforced at `pnpm install` time via `engines` + `engine-strict`, so an unsupported Node fails fast with a clear message)
 - **pnpm** - Package manager (managed via [Corepack](https://github.com/nodejs/corepack))
 - **Tailwind CSS knowledge** - Required for styling. See [Tailwind CSS Documentation](https://tailwindcss.com/docs)
 - **Network access** - Development machine must be on the same network as your OpenWrt router
@@ -28,11 +28,29 @@ pnpm install
 ### 2. Configure Environment
 
 ```bash
-# One-shot wizard: asks for the router IP, generates/installs an SSH key
+# One-shot wizard: asks for every .env value (router IP, dev-server host/port,
-# (one router-password prompt), and writes .env
+# current .env entries as defaults), generates/installs an SSH key (one
-pnpm setup
+# router-password prompt), verifies template sync end-to-end, and writes .env
+pnpm setup:router
+
+# Non-interactive: pass the IP directly (no prompts; dev-server values keep
+# their saved .env entries or defaults)
+pnpm setup:router 192.168.2.1
 ```
 
+> The script is named `setup:router` (not `setup`) because `pnpm setup` resolves to pnpm's own built-in setup command and would never run a package script.
+
+**What it does** (`scripts/setup.js`), in order:
+
+1. **Collects the `.env` values.** With no argument it prompts for each variable in turn, showing the current `.env` entry as the default (an empty answer keeps it). With an IP argument it takes that as `VITE_OPENWRT_HOST` non-interactively and leaves the dev-server values alone. Nothing is written yet — `.env` is only updated once every step below has succeeded.
+2. **Pre-flights the connection.** A raw TCP probe of `<host>:22` with a 2s timeout, so an unreachable device or one with SSH disabled fails immediately with a clear message instead of hanging inside ssh.
+3. **Finds or generates an SSH key.** It looks for `~/.ssh/id_ed25519.pub`, `id_rsa.pub`, `id_ecdsa.pub` in that order and reuses the first one present — an existing key is never overwritten. **If you have no key at all, it generates one** (`ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_ed25519`). The empty passphrase is deliberate: `.ut` sync has to run unattended for the whole `pnpm dev` session.
+4. **Installs the public key on the router.** It first tests whether passwordless SSH already works (`ssh -o BatchMode=yes … echo ok`) and skips the install if so — after a full reflash that wipes the key, the test fails and the install simply runs again. Otherwise it appends the key to `/etc/dropbear/authorized_keys` over one interactive SSH session; the append is guarded by `grep -qxF`, so re-running never duplicates the entry. **This is the only step that asks for the router's root password, and it asks once.** Afterwards it re-tests passwordless auth and classifies any failure (wrong password / host unreachable / other). On a device running openssh rather than dropbear the key belongs in `/root/.ssh/authorized_keys` instead — install it manually there and this step detects it and skips.
+5. **Verifies the sync end-to-end.** Rather than trusting `echo ok`, it pushes `ucode/template/themes/aurora/` through the exact `tar -cf - | ssh … tar -xf -` pipeline the `ut-sync` plugin uses (see [Template (`.ut`) Live Sync](#template-ut-live-sync)). If this passes, `pnpm dev`'s template sync will too.
+6. **Writes `.env`.** Managed keys are rewritten in place so surrounding comments keep their meaning, missing ones are appended, and any other line passes through untouched.
+
+> The password prompt in step 4 comes from the **local** ssh client, which reads it straight from `/dev/tty` rather than stdin — so it shows up normally even though the script pipes ssh's stderr in order to classify errors. It does mean the step needs a controlling terminal **on the development machine** (the router side is unaffected): run it from a normal shell, not from CI, `nohup`, or an editor task pane, where ssh has no way to ask and the run fails at authentication. Check with `tty` if unsure; in such an environment, install the key by hand instead.
+
 If the router is at the default `192.168.1.1` and passwordless SSH already works, no `.env` is needed at all — every value below has a working default.
 
 **Environment Variables** (all optional):
@@ -182,11 +200,11 @@ For LuCI-specific JavaScript development, refer to the official API documentatio
 
 - **CSS changes**: Trigger full page reload via custom HMR handler
 - **JS changes**: Trigger full page reload via custom HMR handler
-- **Template changes** (`.ut` files): Auto-synced to router over SSH and trigger full page reload (one-time `pnpm setup` required, see below)
+- **Template changes** (`.ut` files): Auto-synced to router over SSH and trigger full page reload (one-time `pnpm setup:router` required, see below)
 
 ### Template (`.ut`) Live Sync
 
-The `.ut` template files are rendered server-side on the OpenWrt device, so unlike CSS/JS they can't be served locally — the dev server pushes them to the router instead. Run `pnpm setup` once to configure passwordless SSH; after that it's fully automatic:
+The `.ut` template files are rendered server-side on the OpenWrt device, so unlike CSS/JS they can't be served locally — the dev server pushes them to the router instead. Run `pnpm setup:router` once to configure passwordless SSH; after that it's fully automatic:
 
 - **On startup**, the whole template directory is pushed (as one tarball over ssh stdin — Dropbear has no SFTP server for scp), so edits made while the dev server was down never leave the router stale.
 - **On save**, changes are debounced and the directory is pushed again, then the browser reloads.
@@ -195,7 +213,7 @@ The `.ut` template files are rendered server-side on the OpenWrt device, so unli
 **Troubleshooting** — sync errors are printed with the fix:
 
 - **Host key mismatch** (device was reflashed): Run `ssh-keygen -R <device-ip>`, then restart the dev server
-- **Authentication failed** (public key not on device): Run `pnpm setup`
+- **Authentication failed** (public key not on device, e.g. after a reflash): Run `pnpm setup:router`
 - **Connection refused/timed out**: Check that the device is online and SSH is enabled
 
 A failed sync is retried on the next `.ut` change; CSS/JS dev features work normally without SSH.
@@ -271,7 +289,8 @@ luci-theme-aurora/
 │   │   └── images/                 # Theme images + PWA icons
 │   ├── scripts/                    # Build scripts
 │   │   ├── clean.js                # Build cleanup utility
-│   │   └── gen-tokens.js           # Regenerates src/media/_tokens.css from @eamonxg/aurora-tokens
+│   │   ├── gen-tokens.js           # Regenerates src/media/_tokens.css from @eamonxg/aurora-tokens
+│   │   └── setup.js                # pnpm setup:router — .env wizard + passwordless SSH to the router
 │   ├── src/                        # Source code
 │   │   ├── assets/icons/           # SVG icons
 │   │   ├── media/                  # CSS source (Tailwind CSS v4)

luci-theme-aurora/.dev/package.json

@@ -4,12 +4,15 @@
 	"type": "module",
 	"scripts": {
 		"dev": "vite",
-		"setup": "node scripts/setup.js",
+		"setup:router": "node scripts/setup.js",
 		"build": "npm run clean && npm run gen:tokens && vite build",
 		"clean": "node scripts/clean.js",
 		"gen:tokens": "node scripts/gen-tokens.js",
 		"test": "node --test tests/*.test.js"
 	},
+	"engines": {
+		"node": "^20.19.0 || >=22.12.0"
+	},
 	"devDependencies": {
 		"@eamonxg/aurora-tokens": "^1.2.0",
 		"@tailwindcss/vite": "^4.1.11",

luci-theme-aurora/.dev/scripts/setup.js

@@ -1,12 +1,19 @@
 /**
- * One-shot dev environment setup: writes .env and installs an SSH key on the
+ * Router connection setup: writes .env and installs an SSH key on the router
- * router so ut-sync works without any manual ssh configuration.
+ * so ut-sync works without any manual ssh configuration.
  *
- * Usage: pnpm setup  (asks for the router IP, then one router password prompt)
+ * Usage: pnpm setup:router [ip]
+ *   ip       router address; omit for the interactive wizard, which asks for
+ *            every .env value (router IP, dev-server host/port) with the
+ *            current .env entries as defaults
+ *
+ * (The script is named `setup:router` because plain `pnpm setup` resolves to
+ * pnpm's own built-in setup command, never a package.json script.)
  */
 
-import { spawnSync } from "node:child_process";
+import { execSync, spawnSync } from "node:child_process";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { connect } from "node:net";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
@@ -18,22 +25,121 @@ const SSH_OPTS = [
   "UserKnownHostsFile=/dev/null",
 ];
 
+// Must match the ut-sync plugin in vite.config.ts — the final push below is a
+// real template sync, so setup only succeeds if `pnpm dev` sync will too.
+const UT_TEMPLATE_DIR = resolve(
+  process.cwd(),
+  "../ucode/template/themes/aurora",
+);
+const UT_REMOTE_DIR = "/usr/share/ucode/luci/template/themes/aurora";
+
 function canAuth(host) {
   return (
     spawnSync(
       "ssh",
-      [...SSH_OPTS, "-o", "BatchMode=yes", "-o", "ConnectTimeout=5", host, "echo ok"],
+      [
+        ...SSH_OPTS,
+        "-o",
+        "BatchMode=yes",
+        "-o",
+        "ConnectTimeout=5",
+        host,
+        "echo ok",
+      ],
       { stdio: "ignore" },
     ).status === 0
   );
 }
 
-const rl = createInterface({ input: process.stdin, output: process.stdout });
+function canReachSsh(hostname, timeout = 2000) {
-const ip =
+  return new Promise((done) => {
-  (await rl.question("Router IP [192.168.1.1]: ")).trim() || "192.168.1.1";
+    const sock = connect({ host: hostname, port: 22, timeout });
-rl.close();
+    const finish = (ok) => {
+      sock.destroy();
+      done(ok);
+    };
+    sock.once("connect", () => finish(true));
+    sock.once("timeout", () => finish(false));
+    sock.once("error", () => finish(false));
+  });
+}
+
+console.log("Aurora router setup — passwordless SSH + .env for `pnpm dev`\n");
+
+const args = process.argv.slice(2);
+const argIp = args.find((a) => !a.startsWith("-"));
+
+// Every variable the wizard manages (the full .env surface, see
+// .env.example); any other lines in .env pass through untouched.
+const ENV_VARS = [
+  { key: "VITE_OPENWRT_HOST", label: "Router IP", fallback: "192.168.1.1" },
+  { key: "VITE_DEV_HOST", label: "Dev server host", fallback: "127.0.0.1" },
+  { key: "VITE_DEV_PORT", label: "Dev server port", fallback: "5173" },
+];
+
+const envPath = resolve(process.cwd(), ".env");
+const envLines = existsSync(envPath)
+  ? readFileSync(envPath, "utf-8").split("\n")
+  : [];
+const savedValue = (key) =>
+  envLines
+    .find((l) => l.startsWith(`${key}=`))
+    ?.slice(key.length + 1)
+    .trim();
+const values = Object.fromEntries(
+  ENV_VARS.map(({ key, fallback }) => [key, savedValue(key) || fallback]),
+);
+
+if (argIp) {
+  // Arg mode is non-interactive: take the IP from argv and keep the saved
+  // (or default) dev-server values.
+  values.VITE_OPENWRT_HOST = argIp;
+} else {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  // Answers come through the async iterator — unlike rl.question, it buffers
+  // lines, so piped input (`printf 'ip\nhost\nport\n' | …`) is not dropped
+  // between questions, and EOF just leaves the remaining defaults in place.
+  const lines = rl[Symbol.asyncIterator]();
+  for (const { key, label } of ENV_VARS) {
+    rl.setPrompt(`${label} [${values[key]}]: `);
+    rl.prompt();
+    const { value, done } = await lines.next();
+    if (done) {
+      console.log();
+      break;
+    }
+    const answer = value.trim();
+    if (answer) values[key] = answer;
+  }
+  rl.close();
+}
+
+if (!/^\d+$/.test(values.VITE_DEV_PORT)) {
+  console.log(
+    `  Ignoring invalid port "${values.VITE_DEV_PORT}" — using 5173.`,
+  );
+  values.VITE_DEV_PORT = "5173";
+}
+
+const ip = values.VITE_OPENWRT_HOST;
+
+// Accept the same forms vite.config.ts does (bare IP, host:port, http:// URL);
+// ssh always targets the bare hostname — port/key overrides live in ~/.ssh/config.
+const hostname = new URL(/^https?:\/\//.test(ip) ? ip : `http://${ip}`)
+  .hostname;
+const host = `root@${hostname}`;
+
+if (!(await canReachSsh(hostname))) {
+  console.error(`✗ Cannot reach ${hostname}:22 (2s timeout).`);
+  console.error(
+    "  Check that the device is powered on, on the same network, and has SSH enabled.",
+  );
+  console.error(
+    "  (If it listens on a non-standard port, add a Host block to ~/.ssh/config.)",
+  );
+  process.exit(1);
+}
 
-const host = `root@${ip}`;
 const sshDir = join(homedir(), ".ssh");
 
 let pubKeyPath = ["id_ed25519.pub", "id_rsa.pub", "id_ecdsa.pub"]
@@ -55,39 +161,93 @@ if (!pubKeyPath) {
 }
 
 if (canAuth(host)) {
-  console.log(`✓ Passwordless SSH to ${host} already works.`);
+  console.log(
+    `✓ Passwordless SSH to ${host} already works (checked: ssh echo).`,
+  );
 } else {
   console.log(
     `Installing ${pubKeyPath} on the router (enter the router password once):`,
   );
   const pubKey = readFileSync(pubKeyPath, "utf-8").trim();
+  // stderr is piped so failures can be classified below; ssh's password prompt
+  // goes straight to the tty, so interactive login still works.
   const install = spawnSync(
     "ssh",
     [
       ...SSH_OPTS,
+      "-o",
+      "ConnectTimeout=5",
       host,
-      `mkdir -p /etc/dropbear && echo '${pubKey}' >> /etc/dropbear/authorized_keys && chmod 600 /etc/dropbear/authorized_keys`,
+      `mkdir -p /etc/dropbear && touch /etc/dropbear/authorized_keys && (grep -qxF '${pubKey}' /etc/dropbear/authorized_keys || echo '${pubKey}' >> /etc/dropbear/authorized_keys) && chmod 600 /etc/dropbear/authorized_keys`,
     ],
-    { stdio: "inherit" },
+    { stdio: ["inherit", "inherit", "pipe"], encoding: "utf-8" },
   );
-  if (install.status !== 0 || !canAuth(host)) {
+  if (install.status !== 0) {
+    const stderr = (install.stderr || "").trim();
+    if (/Permission denied|Authentication failed/i.test(stderr)) {
+      console.error(
+        "✗ Authentication failed — likely a wrong password. Re-run pnpm setup:router.",
+      );
+      console.error(
+        "  (If the device runs openssh instead of dropbear, keys belong in /root/.ssh/authorized_keys.)",
+      );
+    } else if (
+      /timed out|No route to host|Connection refused|Could not resolve/i.test(
+        stderr,
+      )
+    ) {
+      console.error(`✗ ${hostname} did not respond as an SSH host.`);
+      console.error(
+        "  Check the IP and that SSH is enabled on the device. (A VPN/proxy in TUN mode can also intercept the connection.)",
+      );
+    } else {
+      console.error("✗ Key install failed:");
+    }
+    if (stderr) console.error(`  ${stderr.replace(/\n/g, "\n  ")}`);
+    process.exit(1);
+  }
+  if (!canAuth(host)) {
+    console.error("✗ Key installed, but passwordless SSH still fails.");
     console.error(
-      `✗ Key install failed. Check that the device at ${ip} is reachable and the password is correct, then re-run pnpm setup.`,
+      "  Check the dropbear config on the device (PubkeyAuth) and /etc/dropbear/authorized_keys.",
     );
     process.exit(1);
   }
   console.log("✓ Passwordless SSH configured.");
 }
 
-const envPath = resolve(process.cwd(), ".env");
+// End-to-end check: push the templates through the exact pipeline ut-sync uses.
-const kept = existsSync(envPath)
+// `ssh echo ok` alone can pass while the real tar-over-ssh sync would not.
-  ? readFileSync(envPath, "utf-8")
+const started = Date.now();
-      .split("\n")
+try {
-      .filter((l) => l && !l.startsWith("VITE_OPENWRT_HOST="))
+  execSync(
-  : [];
+    `tar -C "${UT_TEMPLATE_DIR}" -cf - . | ssh ${SSH_OPTS.join(" ")} -o BatchMode=yes -o ConnectTimeout=5 "${host}" "mkdir -p '${UT_REMOTE_DIR}' && tar -xf - -C '${UT_REMOTE_DIR}'"`,
-writeFileSync(
+    { stdio: ["ignore", "pipe", "pipe"] },
-  envPath,
+  );
-  [`VITE_OPENWRT_HOST=${ip}`, ...kept].join("\n") + "\n",
+  console.log(
+    `✓ Templates pushed to ${host}:${UT_REMOTE_DIR} (${Date.now() - started}ms) — dev sync verified.`,
+  );
+} catch (err) {
+  console.error(
+    "✗ Template push failed — `pnpm dev` template sync will not work:",
+  );
+  console.error(`  ${String(err?.stderr || err?.message || err).trim()}`);
+  process.exit(1);
+}
+
+// Update managed keys in place so surrounding comments keep their meaning,
+// then append any the file does not have yet; other lines pass through.
+const out = envLines.map((l) => {
+  const managed = ENV_VARS.find(({ key }) => l.startsWith(`${key}=`));
+  return managed ? `${managed.key}=${values[managed.key]}` : l;
+});
+while (out.length && !out[out.length - 1]) out.pop();
+for (const { key } of ENV_VARS) {
+  if (!out.some((l) => l.startsWith(`${key}=`)))
+    out.push(`${key}=${values[key]}`);
+}
+writeFileSync(envPath, out.join("\n") + "\n");
+console.log(
+  `✓ Wrote .env (${ENV_VARS.map(({ key }) => `${key}=${values[key]}`).join(", ")})`,
 );
-console.log(`✓ Wrote .env (VITE_OPENWRT_HOST=${ip})`);
 console.log("Done — run `pnpm dev`.");

luci-theme-aurora/.dev/vite.config.ts

@@ -185,7 +185,7 @@ function reportSshError(err: any, sshHost: string): void {
   ) {
     console.error(`\n${utTag()} SSH authentication failed for ${sshHost}.`);
     console.error(
-      `${utTag()} Run \`pnpm setup\` to configure passwordless login.\n`,
+      `${utTag()} Run \`pnpm setup:router\` to configure passwordless login.\n`,
     );
   } else if (
     stderr.includes("Connection refused") ||

luci-theme-aurora/CLAUDE.md

@@ -8,7 +8,7 @@ All dev commands run from `.dev/`:
 
 ```bash
 cd .dev/
-pnpm setup      # One-shot dev setup: router IP → .env, installs SSH key on device
+pnpm setup:router  # One-shot dev setup: all .env values (router IP, dev host/port) → .env, installs SSH key on device ([ip] to run non-interactively; safe to re-run after a reflash)
 pnpm dev        # Start Vite dev server (proxies to OpenWrt device)
 pnpm build      # Clean + regenerate tokens + build production assets to htdocs/luci-static/
 pnpm gen:tokens # Regenerate src/media/_tokens.css from tokens/ (also runs as part of build)

luci-theme-aurora/Makefile

@@ -9,7 +9,7 @@ LUCI_TITLE:=Aurora Theme (A modern browser theme built with Vite and Tailwind CS
 LUCI_DEPENDS:=+luci-base
 
 PKG_VERSION:=1.1.0
-PKG_RELEASE:=49
+PKG_RELEASE:=50
 PKG_LICENSE:=Apache-2.0
 
 LUCI_MINIFY_CSS:=

natflow/Makefile

@@ -10,12 +10,12 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=natflow
 PKG_VERSION:=20260531
-PKG_RELEASE:=50
+PKG_RELEASE:=51
 
 PKG_SOURCE:=$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://github.com/ptpt52/natflow.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=18b46f71fc2a6ed6d9b6acceb2b5c2ebaf287cf2
+PKG_SOURCE_VERSION:=37544bcdb66633d841f9a0b077643dc092e1d897
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
 PKG_MAINTAINER:=Chen Minqiang <ptpt52@gmail.com>
 PKG_LICENSE:=GPL-2.0

openwrt-go-stun/Makefile

@@ -8,11 +8,11 @@ PKG_NAME:=go-stun
 PKG_UPSTREAM_VERSION:=0.1.4
 PKG_UPSTREAM_GITHASH:=d32c135f5e509d278e95ba9945849903f966a91f
 PKG_VERSION:=$(PKG_UPSTREAM_VERSION)~$(call version_abbrev,$(PKG_UPSTREAM_GITHASH))
-PKG_RELEASE:=4
+PKG_RELEASE:=5
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/ccding/go-stun.git
-PKG_SOURCE_VERSION:=d32c135f5e509d278e95ba9945849903f966a91f
+PKG_SOURCE_VERSION:=c6f6521d99a27227538c3bd8a7729f8b2f2a69dd
 PKG_MIRROR_HASH:=skip
 
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_UPSTREAM_VERSION)