diff --git a/cloudreve/Makefile b/cloudreve/Makefile
index 6b07dea7..c7da9617 100644
--- a/cloudreve/Makefile
+++ b/cloudreve/Makefile
@@ -6,11 +6,11 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cloudreve
 PKG_VERSION:=4.15.0
-PKG_RELEASE:=4
+PKG_RELEASE:=5
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/cloudreve/Cloudreve.git
-PKG_SOURCE_VERSION:=5994f7864f419813ba4cb5d260bd9e784a764599
+PKG_SOURCE_VERSION:=34874071319e6d668a170471302fe9d5d22ace17
 PKG_MIRROR_HASH:=skip
 
 PKG_LICENSE:=GPL-3.0-only
diff --git a/luci-app-amlogic/Makefile b/luci-app-amlogic/Makefile
index fc72a218..89dcd4c5 100644
--- a/luci-app-amlogic/Makefile
+++ b/luci-app-amlogic/Makefile
@@ -16,8 +16,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-amlogic
-PKG_VERSION:=3.1.290
-PKG_RELEASE:=6
+PKG_VERSION:=3.1.295
+PKG_RELEASE:=7
 
 PKG_LICENSE:=GPL-2.0 License
 PKG_MAINTAINER:=ophub <https://github.com/ophub/luci-app-amlogic>
diff --git a/luci-app-amlogic/luasrc/controller/amlogic.lua b/luci-app-amlogic/luasrc/controller/amlogic.lua
index 17be9233..bef1b1e6 100644
--- a/luci-app-amlogic/luasrc/controller/amlogic.lua
+++ b/luci-app-amlogic/luasrc/controller/amlogic.lua
@@ -31,6 +31,7 @@ function index()
 	entry({ "admin", "system", "amlogic", "poweroff" }, form("amlogic/amlogic_poweroff"), _("PowerOff"), 9).leaf = true
 	entry({ "admin", "system", "amlogic", "check_firmware" }, call("action_check_firmware"))
 	entry({ "admin", "system", "amlogic", "check_plugin" }, call("action_check_plugin"))
+	entry({ "admin", "system", "amlogic", "check_plugin_download" }, call("action_check_plugin_download")).leaf = true
 	entry({ "admin", "system", "amlogic", "check_kernel" }, call("action_check_kernel"))
 	entry({ "admin", "system", "amlogic", "refresh_log" }, call("action_refresh_log"))
 	entry({ "admin", "system", "amlogic", "del_log" }, call("action_del_log"))
@@ -266,10 +267,20 @@ function start_snapshot_restore()
 	return state
 end
 
---Check the plugin
+--Check the plugin (phase 1: query latest version, output Download button to log)
 function action_check_plugin()
 	luci.sys.exec("chmod +x /usr/share/amlogic/amlogic_check_plugin.sh >/dev/null 2>&1")
-	return luci.sys.call("/usr/share/amlogic/amlogic_check_plugin.sh >/dev/null 2>&1")
+	return luci.sys.call("/usr/share/amlogic/amlogic_check_plugin.sh -c >/dev/null 2>&1")
+end
+
+--Check the plugin (phase 2: download the given version, output Update button to log)
+function action_check_plugin_download()
+	luci.sys.exec("chmod +x /usr/share/amlogic/amlogic_check_plugin.sh >/dev/null 2>&1")
+	local plugin_options = luci.http.formvalue("plugin_options") or ""
+	luci.http.prepare_content("application/json")
+	luci.http.write_json({
+		check_plugin_status = luci.sys.call("/usr/share/amlogic/amlogic_check_plugin.sh -d " .. plugin_options .. " >/dev/null 2>&1");
+	})
 end
 
 --Check and download the kernel
diff --git a/luci-app-amlogic/luasrc/model/cbi/amlogic/amlogic_config.lua b/luci-app-amlogic/luasrc/model/cbi/amlogic/amlogic_config.lua
index ab533fe3..7bc80d43 100644
--- a/luci-app-amlogic/luasrc/model/cbi/amlogic/amlogic_config.lua
+++ b/luci-app-amlogic/luasrc/model/cbi/amlogic/amlogic_config.lua
@@ -131,7 +131,15 @@ local default_kernel_branch = luci.sys.exec("uname -r | grep -oE '^[1-9].[0-9]{1
 kernel_branch.default = trim(default_kernel_branch)
 kernel_branch.rmempty = false
 
---8.Restore configuration
+--8.Set plugin branch
+plugin_branch = o:option(Value, "amlogic_plugin_branch", translate("Set plugin branch:"))
+plugin_branch.description = translate("Set the branch of the luci-app-amlogic plugin used in [Only update Amlogic Service]. Default (empty) uses the main (Lua) branch.")
+plugin_branch:value("", translate("main [Lua version]"))
+plugin_branch:value("js", translate("js [JavaScript version]"))
+plugin_branch.default = ""
+plugin_branch.rmempty = true
+
+--9.Restore configuration
 firmware_config = o:option(Flag, "amlogic_firmware_config", translate("Keep config update:"))
 firmware_config.description = translate("Set whether to keep the current config during [Online Download Update] and [Manually Upload Update].")
 firmware_config.default = "1"
diff --git a/luci-app-amlogic/luasrc/view/amlogic/other_check.htm b/luci-app-amlogic/luasrc/view/amlogic/other_check.htm
index 9d404a2b..83edf394 100644
--- a/luci-app-amlogic/luasrc/view/amlogic/other_check.htm
+++ b/luci-app-amlogic/luasrc/view/amlogic/other_check.htm
@@ -124,21 +124,39 @@
 		return false;
 	}
 
-	function b_check_plugin(btn)
+	// b_check_plugin handles both phases:
+	//   Phase 1 (check):    called with no second arg — queries latest version, log shows Download button
+	//   Phase 2 (download): called with 'download_VERSION' — downloads the package, log shows Update button
+	function b_check_plugin(btn, plugin_options)
 	{
 		btn.disabled = true;
-		btn.value = '<%:Checking...%>';
-		XHR.get('<%=luci.dispatcher.build_url("admin", "system", "amlogic", "check_plugin")%>', null, function(x, status) {
-		if ( x && x.status == 200 ) {
-			btn.disabled = false;
-			btn.value = '<%:Only update Amlogic Service%>';
-		}
-		else {
-			btn.disabled = false;
-			btn.value = '<%:Only update Amlogic Service%>';
+		if (plugin_options && plugin_options.indexOf('download_') === 0) {
+			// Phase 2: download the specified version
+			btn.value = '<%:Downloading...%>';
+			XHR.get('<%=luci.dispatcher.build_url("admin", "system", "amlogic", "check_plugin_download")%>',
+				{ plugin_options: plugin_options },
+				function(x, status) {
+					btn.disabled = false;
+					btn.value = '<%:Only update Amlogic Service%>';
+				}
+			);
+		} else {
+			// Phase 1: check for new version
+			btn.value = '<%:Checking...%>';
+			XHR.get('<%=luci.dispatcher.build_url("admin", "system", "amlogic", "check_plugin")%>', null,
+				function(x, status) {
+					btn.disabled = false;
+					btn.value = '<%:Only update Amlogic Service%>';
+				}
+			);
 		}
 		return false;
-		});
+	}
+
+	// Called from the log-injected Download button (two-phase new script)
+	function b_check_plugin_download(btn, plugin_options)
+	{
+		return b_check_plugin(btn, plugin_options);
 	}
 
 	function b_check_kernel(btn,kernel_options)
diff --git a/luci-app-amlogic/po/ru/amlogic.po b/luci-app-amlogic/po/ru/amlogic.po
index 722813a0..d9df8e6a 100644
--- a/luci-app-amlogic/po/ru/amlogic.po
+++ b/luci-app-amlogic/po/ru/amlogic.po
@@ -422,6 +422,18 @@ msgstr "Ветка версии:"
 msgid "Set the version branch of the OpenWrt files and kernel selected in [Online Download Update]."
 msgstr "Укажите ветку версии для файлов OpenWrt и ядра в разделе [Обновление через интернет]."
 
+msgid "Set plugin branch:"
+msgstr "Ветка плагина:"
+
+msgid "Set the branch of the luci-app-amlogic plugin used in [Only update Amlogic Service]. Default (empty) uses the main (Lua) branch."
+msgstr "Укажите ветку плагина luci-app-amlogic для раздела [Только обновить сервис Amlogic]. По умолчанию (пусто) используется ветка main (Lua)."
+
+msgid "main [Lua version]"
+msgstr "main [Lua версия]"
+
+msgid "js [JavaScript version]"
+msgstr "js [JavaScript версия]"
+
 msgid "Keep config update:"
 msgstr "Сохранять конфигурацию при обновлении:"
 
diff --git a/luci-app-amlogic/po/zh-cn/amlogic.po b/luci-app-amlogic/po/zh-cn/amlogic.po
index 61c1ee5d..2dc89915 100644
--- a/luci-app-amlogic/po/zh-cn/amlogic.po
+++ b/luci-app-amlogic/po/zh-cn/amlogic.po
@@ -422,6 +422,18 @@ msgstr "设置版本分支："
 msgid "Set the version branch of the OpenWrt files and kernel selected in [Online Download Update]."
 msgstr "设置 [在线下载更新] 时 OpenWrt 文件与内核所选用的版本分支。"
 
+msgid "Set plugin branch:"
+msgstr "设置插件分支："
+
+msgid "Set the branch of the luci-app-amlogic plugin used in [Only update Amlogic Service]. Default (empty) uses the main (Lua) branch."
+msgstr "设置 [仅更新晶晨宝盒] 时使用的插件分支。默认（空）使用 main (Lua) 分支。"
+
+msgid "main [Lua version]"
+msgstr "main [Lua 版本]"
+
+msgid "js [JavaScript version]"
+msgstr "js [JavaScript 版本]"
+
 msgid "Keep config update:"
 msgstr "保留配置更新："
 
diff --git a/luci-app-amlogic/root/etc/config/amlogic b/luci-app-amlogic/root/etc/config/amlogic
index a152eb8f..73d7b620 100644
--- a/luci-app-amlogic/root/etc/config/amlogic
+++ b/luci-app-amlogic/root/etc/config/amlogic
@@ -7,6 +7,7 @@ config amlogic 'config'
 	option amlogic_kernel_path 'https://github.com/ophub/kernel'
 	option amlogic_kernel_tags ''
 	option amlogic_kernel_branch ''
+    option amlogic_plugin_branch ''
 	option amlogic_firmware_config '1'
 	option amlogic_write_bootloader '0'
 	option amlogic_shared_fstype 'ext4'
diff --git a/luci-app-amlogic/root/usr/share/amlogic/amlogic_check_plugin.sh b/luci-app-amlogic/root/usr/share/amlogic/amlogic_check_plugin.sh
index 0f18f14c..669b8e72 100755
--- a/luci-app-amlogic/root/usr/share/amlogic/amlogic_check_plugin.sh
+++ b/luci-app-amlogic/root/usr/share/amlogic/amlogic_check_plugin.sh
@@ -13,17 +13,17 @@
 #==================================================================
 
 # Set a fixed value
+check_option="${1}"
+download_version="${2}"
 TMP_CHECK_DIR="/tmp/amlogic"
 AMLOGIC_SOC_FILE="/etc/flippy-openwrt-release"
+AMLOGIC_CONFIG_FILE="/etc/config/amlogic"
 START_LOG="${TMP_CHECK_DIR}/amlogic_check_plugin.log"
 RUNNING_LOG="${TMP_CHECK_DIR}/amlogic_running_script.log"
 LOG_FILE="${TMP_CHECK_DIR}/amlogic.log"
 support_platform=("allwinner" "rockchip" "amlogic" "qemu-aarch64")
 LOGTIME="$(date "+%Y-%m-%d %H:%M:%S")"
-
 [[ -d ${TMP_CHECK_DIR} ]] || mkdir -p ${TMP_CHECK_DIR}
-rm -f ${TMP_CHECK_DIR}/*.ipk 2>/dev/null && sync
-rm -f ${TMP_CHECK_DIR}/sha256sums 2>/dev/null && sync
 
 # Clean the running log
 clean_running() {
@@ -64,102 +64,139 @@ fi
 tolog "PLATFORM: [ ${PLATFORM} ]"
 sleep 2
 
-# 01. Query local version information
-tolog "01. Query current version information."
-
-# If neither opkg nor apk found, set package_manager to empty
-package_manager=""
-current_plugin_v=""
-
-if command -v opkg >/dev/null 2>&1; then
-    # System has opkg
-    package_manager="ipk"
-    # Important: Add cut to handle versions like X.Y.Z-r1, ensuring consistent output
-    current_plugin_v="$(opkg list-installed | grep '^luci-app-amlogic' | awk '{print $3}' | cut -d'-' -f1)"
-elif command -v apk >/dev/null 2>&1; then
-    # System has apk
-    package_manager="apk"
-    current_plugin_v="$(apk list --installed | grep '^luci-app-amlogic' | awk '{print $1}' | cut -d'-' -f4)"
-fi
-
-# Check if we successfully found the plugin
-if [[ -z "${package_manager}" || -z "${current_plugin_v}" ]]; then
-    tolog "01.01 Plugin 'luci-app-amlogic' not found or package manager unknown." "1"
+# Read plugin branch from UCI config; default to "" (main-lua) when missing or empty
+# When amlogic_plugin_branch is missing, add it with empty value (main-lua default)
+if [[ -f "${AMLOGIC_CONFIG_FILE}" ]]; then
+    plugin_branch="$(uci get amlogic.config.amlogic_plugin_branch 2>/dev/null | xargs)"
+    if ! grep -q "amlogic_plugin_branch" "${AMLOGIC_CONFIG_FILE}" 2>/dev/null; then
+        uci set amlogic.config.amlogic_plugin_branch='' 2>/dev/null
+        uci commit amlogic 2>/dev/null
+        plugin_branch=""
+    fi
 else
-    tolog "01.01 Using [${package_manager}]. Current version: ${current_plugin_v}"
+    plugin_branch=""
 fi
-sleep 2
+tolog "Plugin branch: [ ${plugin_branch:-main-lua} ]"
+sleep 1
+get_plugin_info() {
+    package_manager=""
+    current_plugin_v=""
+    if command -v opkg >/dev/null 2>&1; then
+        package_manager="ipk"
+        current_plugin_v="$(opkg list-installed | grep '^luci-app-amlogic ' | awk '{print $3}' | cut -d'-' -f1)"
+    elif command -v apk >/dev/null 2>&1; then
+        package_manager="apk"
+        current_plugin_v="$(apk list --installed | grep '^luci-app-amlogic-' | awk '{print $1}' | cut -d'-' -f4)"
+    fi
+}
 
-# 02. Check the version on the server
-tolog "02. Start querying plugin version..."
-
-# Get the latest version
-latest_version="$(
-    curl -fsSL -m 10 \
-        https://github.com/ophub/luci-app-amlogic/releases |
-        grep -oE 'expanded_assets/[0-9]+.[0-9]+.[0-9]+(-[0-9]+)?' | sed 's|expanded_assets/||g' |
-        sort -urV | head -n 1
-)"
-if [[ -z "${latest_version}" ]]; then
-    tolog "02.01 Query failed, please try again." "1"
-else
-    tolog "02.01 current version: ${current_plugin_v}, Latest version: ${latest_version}"
+# Step 2: Check if there is the latest plugin version
+check_plugin() {
+    tolog "01. Query current version information."
+    get_plugin_info
+    if [[ -z "${package_manager}" || -z "${current_plugin_v}" ]]; then
+        tolog "01.01 Plugin 'luci-app-amlogic' not found or package manager unknown." "1"
+    else
+        tolog "01.01 Using [${package_manager}]. Current version: ${current_plugin_v}"
+    fi
     sleep 2
-fi
 
-# Compare the version and download the latest version
-if [[ "${current_plugin_v}" == "${latest_version}" ]]; then
-    tolog "02.02 Already the latest version, no need to update." "1"
-else
-    tolog "02.03 New version found. Preparing to download for [${package_manager}]..."
+    tolog "02. Start querying plugin version..."
+    if [[ "${plugin_branch}" == "js" ]]; then
+        latest_version="$(
+            curl -fsSL -m 10 \
+                https://github.com/ophub/luci-app-amlogic/releases |
+                grep -oE 'expanded_assets/[0-9]+\.[0-9]+\.[0-9]+-js' | sed 's|expanded_assets/||g' |
+                sort -urV | head -n 1
+        )"
+    else
+        latest_version="$(
+            curl -fsSL -m 10 \
+                https://github.com/ophub/luci-app-amlogic/releases |
+                grep -oE 'expanded_assets/[0-9]+\.[0-9]+\.[0-9]+' | sed 's|expanded_assets/||g' |
+                grep -v '\-js' |
+                sort -urV | head -n 1
+        )"
+    fi
+    if [[ -z "${latest_version}" ]]; then
+        tolog "02.01 Query failed, please try again." "1"
+    fi
+
+    tolog "02.01 Current version: ${current_plugin_v}, Latest version: ${latest_version}"
+    sleep 2
+
+    if [[ "${current_plugin_v}" == "${latest_version}" ]]; then
+        tolog "02.02 Already the latest version, no need to update." "1"
+    else
+        tolog '<input type="button" class="cbi-button cbi-button-reload" value="Download" onclick="return b_check_plugin(this, '"'download_${latest_version}'"')"/> Latest version: '${latest_version}'' "1"
+    fi
+
+    exit 0
+}
+
+# Step 3: Download the latest plugin version
+download_plugin() {
+    tolog "03. Start downloading the plugin file."
+    if [[ "${download_version}" == "download_"* ]]; then
+        tolog "03.01 Start downloading..."
+    else
+        tolog "03.01 Invalid parameter." "1"
+    fi
+
+    # Extract version from parameter (e.g. "download_3.1.290" -> "3.1.290")
+    latest_version="$(echo "${download_version}" | cut -d '_' -f2-)"
+
+    get_plugin_info
+    if [[ -z "${package_manager}" ]]; then
+        tolog "03.02 Package manager not found." "1"
+    fi
+
+    tolog "03.02 Package manager: ${package_manager}, Version to download: ${latest_version}"
+
+    # Clean up previous downloads
+    rm -f ${TMP_CHECK_DIR}/*.ipk 2>/dev/null
+    rm -f ${TMP_CHECK_DIR}/*.apk 2>/dev/null
+    rm -f ${TMP_CHECK_DIR}/sha256sums 2>/dev/null
+    sync
+
     download_repo="https://github.com/ophub/luci-app-amlogic/releases/download"
 
-    # Intelligent File Discovery
-    plugin_file_name=""
-    lang_file_list=""
-
-    # Method 1: Use GitHub API if 'jq' is installed (Preferred Method)
-    if command -v jq >/dev/null 2>&1; then
-        tolog "Using GitHub API with jq to find package files."
-        api_url="https://api.github.com/repos/ophub/luci-app-amlogic/releases/tags/${latest_version}"
-
-        # Fetch all asset names from the API
-        asset_list="$(curl -fsSL -m 15 "${api_url}" | jq -r '.assets[].name' | xargs)"
-
-        if [[ -n "${asset_list}" ]]; then
-            # Discover exact filenames using regular expressions from the asset list
-            plugin_file_name="$(echo "${asset_list}" | tr ' ' '\n' | grep -oE "^luci-app-amlogic.*${package_manager}$" | head -n 1)"
-            lang_file_list=($(echo "${asset_list}" | tr ' ' '\n' | grep -oE "^luci-i18n-amlogic.*${package_manager}$"))
-        else
-            tolog "Warning: Failed to fetch data from GitHub API." "1"
-        fi
-    else
-        tolog "jq not found, Aborting." "1"
+    # Use GitHub API to find exact filenames
+    if ! command -v jq >/dev/null 2>&1; then
+        tolog "03.03 jq not found, cannot query GitHub API." "1"
     fi
 
-    # Validation and Download
-    if [[ -z "${plugin_file_name}" || "${#lang_file_list[@]}" -eq "0" ]]; then
-        tolog "02.03.2 Could not discover plugin(.${package_manager}) in the release. Aborting." "1"
+    tolog "03.03 Querying GitHub API for release assets..."
+    api_url="https://api.github.com/repos/ophub/luci-app-amlogic/releases/tags/${latest_version}"
+    asset_list="$(curl -fsSL -m 15 "${api_url}" | jq -r '.assets[].name' | xargs)"
+    if [[ -z "${asset_list}" ]]; then
+        tolog "03.03 Failed to fetch release assets from GitHub API." "1"
     fi
 
-    tolog "Found plugin file: ${plugin_file_name}"
-    tolog "Found language file: $(echo ${lang_file_list[@]} | xargs)"
+    plugin_file_name="$(echo "${asset_list}" | tr ' ' '\n' | grep -oE "^luci-app-amlogic.*${package_manager}$" | head -n 1)"
+    lang_file_list=($(echo "${asset_list}" | tr ' ' '\n' | grep -oE "^luci-i18n-amlogic.*${package_manager}$"))
+
+    if [[ -z "${plugin_file_name}" ]]; then
+        tolog "03.04 Could not find plugin file (.${package_manager}) in release assets." "1"
+    fi
+
+    tolog "03.04 Plugin file: ${plugin_file_name}"
 
     # Download the main plugin file
     plugin_full_url="${download_repo}/${latest_version}/${plugin_file_name}"
-    tolog "02.04 Downloading main plugin..."
+    tolog "03.05 Downloading main plugin..."
     curl -fsSL "${plugin_full_url}" -o "${TMP_CHECK_DIR}/${plugin_file_name}"
-    [[ "${?}" -ne "0" ]] && tolog "02.04 Plugin [ ${plugin_file_name} ] download failed." "1"
+    [[ "${?}" -ne "0" ]] && tolog "03.05 Plugin [ ${plugin_file_name} ] download failed." "1"
 
     # Download language packs
     for langfile in "${lang_file_list[@]}"; do
         lang_full_url="${download_repo}/${latest_version}/${langfile}"
-        tolog "02.05 Downloading language pack [ ${langfile} ]..."
+        tolog "03.06 Downloading language pack [ ${langfile} ]..."
         curl -fsSL "${lang_full_url}" -o "${TMP_CHECK_DIR}/${langfile}"
-        [[ "${?}" -ne "0" ]] && tolog "02.05 Language pack [ ${langfile} ] download failed." "1"
+        [[ "${?}" -ne "0" ]] && tolog "03.06 Language pack [ ${langfile} ] download failed." "1"
     done
 
-    # The .apk filename is preceded by a tilde (~) instead of a dot (.).
+    # The .apk filename uses tilde (~) instead of dot before the hash suffix
     for file in ${TMP_CHECK_DIR}/*.apk; do
         [[ -f "${file}" ]] || continue
         base_name="$(basename "${file}")"
@@ -170,11 +207,21 @@ else
     done
 
     sync && sleep 2
-fi
 
-tolog "03. The plug is ready, you can update."
-sleep 2
+    tolog "03.07 The plugin is ready, you can update."
+    sleep 2
 
-tolog '<input type="button" class="cbi-button cbi-button-reload" value="Update" onclick="return amlogic_plugin(this)"/> Latest version: '${latest_version}'' "1"
+    tolog '<input type="button" class="cbi-button cbi-button-reload" value="Update" onclick="return amlogic_plugin(this)"/> Latest version: '${latest_version}'' "1"
 
-exit 0
+    exit 0
+}
+
+getopts 'cd' opts
+case "${opts}" in
+c | check)
+    check_plugin
+    ;;
+* | download)
+    download_plugin
+    ;;
+esac
diff --git a/luci-app-passwall/Makefile b/luci-app-passwall/Makefile
index f2f287a4..9bde8218 100644
--- a/luci-app-passwall/Makefile
+++ b/luci-app-passwall/Makefile
@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=26.5.3
-PKG_RELEASE:=116
+PKG_RELEASE:=117
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \
@@ -27,8 +27,6 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_Shadow_TLS \
 	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_Simple_Obfs \
 	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_SingBox \
-	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_Trojan_Plus \
-	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_tuic_client \
 	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_V2ray_Geodata \
 	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_V2ray_Plugin \
 	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_Xray \
@@ -55,8 +53,6 @@ LUCI_DEPENDS:=+coreutils +coreutils-base64 +coreutils-nohup +curl \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_ShadowsocksR_Libev_Server:shadowsocksr-libev-ssr-server \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_Simple_Obfs:simple-obfs-client \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_SingBox:sing-box \
-	+PACKAGE_$(PKG_NAME)_INCLUDE_Trojan_Plus:trojan-plus \
-	+PACKAGE_$(PKG_NAME)_INCLUDE_tuic_client:tuic-client \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_V2ray_Geodata:v2ray-geoip \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_V2ray_Geodata:v2ray-geosite \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_V2ray_Plugin:v2ray-plugin \
@@ -153,16 +149,6 @@ config PACKAGE_$(PKG_NAME)_INCLUDE_SingBox
 	select PACKAGE_sing-box
 	default y if aarch64||i386||x86_64
 
-config PACKAGE_$(PKG_NAME)_INCLUDE_Trojan_Plus
-	bool "Include Trojan-Plus"
-	default y if aarch64||i386||x86_64
-
-config PACKAGE_$(PKG_NAME)_INCLUDE_tuic_client
-	bool "Include tuic-client"
-	depends on aarch64||i386||x86_64
-	select PACKAGE_tuic-client
-	default n
-
 config PACKAGE_$(PKG_NAME)_INCLUDE_V2ray_Geodata
 	bool "Include V2ray_Geodata"
 	select PACKAGE_v2ray-geoip
diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
index 78d8dd63..588c0653 100644
--- a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
+++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
@@ -678,14 +678,6 @@ o:value("info")
 o:value("warning")
 o:value("error")
 
-o = s:taboption("log", ListValue, "trojan_loglevel", "Trojan " ..  translate("Log Level"))
-o.default = "2"
-o:value("0", "all")
-o:value("1", "info")
-o:value("2", "warn")
-o:value("3", "error")
-o:value("4", "fatal")
-
 o = s:taboption("log", Flag, "advanced_log_feature", translate("Advanced log feature"), translate("For professionals only."))
 o.default = "0"
 o = s:taboption("log", Flag, "sys_log", translate("Logging to system log"), translate("Logging to the system log for more advanced functions. For example, send logs to a dedicated log server."))
diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe.lua
index cb31a737..63ff804d 100644
--- a/luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe.lua
+++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe.lua
@@ -3,7 +3,6 @@ local uci = api.uci
 local appname = "passwall"
 local has_ss = api.is_finded("ss-redir")
 local has_ss_rust = api.is_finded("sslocal")
-local has_trojan_plus = api.is_finded("trojan-plus")
 local has_singbox = api.finded_com("sing-box")
 local has_xray = api.finded_com("xray")
 local has_hysteria2 = api.finded_com("hysteria")
@@ -21,10 +20,6 @@ if has_ss_rust then
 	local s = "shadowsocks-rust"
 	table.insert(ss_type, s)
 end
-if has_trojan_plus then
-	local s = "trojan-plus"
-	table.insert(trojan_type, s)
-end
 if has_singbox then
 	local s = "sing-box"
 	table.insert(trojan_type, s)
diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe_config.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe_config.lua
index a779000f..3cbaf4cf 100644
--- a/luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe_config.lua
+++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe_config.lua
@@ -18,7 +18,6 @@ m:append(Template(appname .. "/cbi/nodes_listvalue_com"))
 
 local has_ss = api.is_finded("ss-redir")
 local has_ss_rust = api.is_finded("sslocal")
-local has_trojan_plus = api.is_finded("trojan-plus")
 local has_singbox = api.finded_com("sing-box")
 local has_xray = api.finded_com("xray")
 local has_hysteria2 = api.finded_com("hysteria")
@@ -36,10 +35,6 @@ if has_ss_rust then
 	local s = "shadowsocks-rust"
 	table.insert(ss_type, s)
 end
-if has_trojan_plus then
-	local s = "trojan-plus"
-	table.insert(trojan_type, s)
-end
 if has_singbox then
 	local s = "sing-box"
 	table.insert(trojan_type, s)
diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua
index db2c6d75..7e772dce 100644
--- a/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua
+++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua
@@ -165,25 +165,63 @@ if load_balancing_options then -- [[ Load balancing Start ]]
 
 	-- Fallback Node
 	o = s:option(ListValue, _n("fallback_node"), translate("Fallback Node"))
+	o.group = {"",""}
 	o:value("", translate("Close(Not use)"))
+	o:value("_direct", translate("Direct Connection"))
 	o:depends({ [_n("protocol")] = "_balancing" })
 	o.template = appname .. "/cbi/nodes_listvalue"
-	o.group = {""}
-	local function check_fallback_chain(fb)
-		for k, v in pairs(fallback_list) do
-			if v.fallback == fb then
-				fallback_list[k] = nil
-				check_fallback_chain(v.id)
+	-- 最大 fallback 套娃层数
+	local MAX_FALLBACK_DEPTH = 3
+	-- 检查是否会形成回环
+	local function will_loop(start_id, target_id, depth)
+		depth = depth or 0
+		-- 超过最大深度后停止递归
+		if depth >= MAX_FALLBACK_DEPTH then
+			return false
+		end
+		for _, v in ipairs(fallback_list) do
+			if v.id == target_id then
+				local fb = v.fallback
+				-- 没有 fallback
+				if not fb or fb == "" or fb == "_direct" then
+					return false
+				end
+				-- 检测到回环
+				if fb == start_id then
+					return true
+				end
+				-- 继续递归检查
+				return will_loop(start_id, fb, depth + 1)
 			end
 		end
+		return false
 	end
-	-- 检查fallback链，去掉会形成闭环的balancer节点
-	if is_balancer then
-		check_fallback_chain(arg[1])
+	-- 获取 fallback 链深度
+	local function get_fallback_depth(id, depth)
+		depth = depth or 0
+		if depth >= MAX_FALLBACK_DEPTH then
+			return depth
+		end
+		for _, v in ipairs(fallback_list) do
+			if v.id == id then
+				local fb = v.fallback
+				if not fb or fb == "" or fb == "_direct" then
+					return depth
+				end
+				return get_fallback_depth(fb, depth + 1)
+			end
+		end
+		return depth
 	end
-	for i, v in ipairs(fallback_list) do
-		o:value(v.id, v.remark)
-		o.group[#o.group+1] = (v.group and v.group ~= "") and v.group or translate("default")
+	for _, v in ipairs(fallback_list) do
+		local depth = get_fallback_depth(v.id)
+		-- 超过最大套娃层数后，不允许继续选择 balancer
+		if depth < MAX_FALLBACK_DEPTH
+			and not will_loop(arg[1], v.id)
+		then
+			o:value(v.id, v.remark)
+			o.group[#o.group + 1] = (v.group and v.group ~= "") and v.group or translate("default")
+		end
 	end
 	for k1, v1 in pairs(node_list) do
 		if k1 == "socks_list" or k1 == "normal_list" or k1 == "urltest_list" then
diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/type/trojan-plus.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/type/trojan-plus.lua
deleted file mode 100644
index b95c9488..00000000
--- a/luci-app-passwall/luasrc/model/cbi/passwall/client/type/trojan-plus.lua
+++ /dev/null
@@ -1,61 +0,0 @@
-local m, s = ...
-
-if not api.is_finded("trojan-plus") then
-	return
-end
-
-type_name = "Trojan-Plus"
-
--- [[ Trojan Plus ]]
-
-s.fields["type"]:value(type_name, "Trojan-Plus")
-
-if s.val["type"] ~= type_name then
-	return
-end
-
-local option_prefix = "trojan_plus_"
-
-local function _n(name)
-	return option_prefix .. name
-end
-
-o = s:option(ListValue, _n("del_protocol")) --始终隐藏，用于删除 protocol
-o:depends({ [_n("__hide")] = "1" })
-o.rewrite_option = "protocol"
-
-o = s:option(Value, _n("address"), translate("Address (Support Domain Name)"))
-
-o = s:option(Value, _n("port"), translate("Port"))
-o.datatype = "port"
-
-o = s:option(Value, _n("password"), translate("Password"))
-o.password = true
-
-o = s:option(Flag, _n("tcp_fast_open"), "TCP " .. translate("Fast Open"), translate("Need node support required"))
-o.default = 0
-
-o = s:option(Flag, _n("tls"), translate("TLS"))
-o.default = 0
-o.validate = function(self, value, t)
-	if value then
-		local type = s.fields["type"] and s.fields["type"]:formvalue(t) or ""
-		if value == "0" and type == type_name then
-			return nil, translate("Original Trojan only supported 'tls', please choose 'tls'.")
-		end
-		return value
-	end
-end
-
-o = s:option(Flag, _n("tls_allowInsecure"), translate("allowInsecure"), translate("Whether unsafe connections are allowed. When checked, Certificate validation will be skipped."))
-o.default = "0"
-o:depends({ [_n("tls")] = true })
-
-o = s:option(Value, _n("tls_serverName"), translate("Domain"))
-o:depends({ [_n("tls")] = true })
-
-o = s:option(Flag, _n("tls_sessionTicket"), translate("Session Ticket"))
-o.default = "0"
-o:depends({ [_n("tls")] = true })
-
-api.luci_types(arg[1], m, s, type_name, option_prefix)
diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/type/tuic.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/type/tuic.lua
deleted file mode 100644
index f69ac119..00000000
--- a/luci-app-passwall/luasrc/model/cbi/passwall/client/type/tuic.lua
+++ /dev/null
@@ -1,149 +0,0 @@
-local m, s = ...
-
-if not api.is_finded("tuic-client") then
-	return
-end
-
-type_name = "TUIC"
-
--- [[ TUIC ]]
-
-s.fields["type"]:value(type_name, "TUIC")
-
-if s.val["type"] ~= type_name then
-	return
-end
-
-local option_prefix = "tuic_"
-
-local function _n(name)
-	return option_prefix .. name
-end
-
-o = s:option(ListValue, _n("del_protocol")) --始终隐藏，用于删除 protocol
-o:depends({ [_n("__hide")] = "1" })
-o.rewrite_option = "protocol"
-
-o = s:option(Value, _n("address"), translate("Address (Support Domain Name)"))
-
-o = s:option(Value, _n("port"), translate("Port"))
-o.datatype = "port"
-
-o = s:option(Value, _n("uuid"), translate("ID"))
-o.password = true
-
--- Tuic Password for remote server connect
-o = s:option(Value, _n("password"), translate("TUIC User Password For Connect Remote Server"))
-o.password = true
-o.rmempty = true
-o.default = ""
-o.rewrite_option = o.option
-
---[[
--- Tuic username for local socks connect
-o = s:option(Value, _n("socks_username"), translate("TUIC UserName For Local Socks"))
-o.rmempty = true
-o.default = ""
-o.rewrite_option = o.option
-
--- Tuic Password for local socks connect
-o = s:option(Value, _n("socks_password"), translate("TUIC Password For Local Socks"))
-o.password = true
-o.rmempty = true
-o.default = ""
-o.rewrite_option = o.option
---]]
-
-o = s:option(Value, _n("ip"), translate("Set the TUIC proxy server ip address"))
-o.datatype = "ipaddr"
-o.rmempty = true
-o.rewrite_option = o.option
-
-o = s:option(ListValue, _n("udp_relay_mode"), translate("UDP relay mode"))
-o:value("native", translate("native"))
-o:value("quic", translate("QUIC"))
-o.default = "native"
-o.rmempty = true
-o.rewrite_option = o.option
-
-o = s:option(ListValue, _n("congestion_control"), translate("Congestion control algorithm"))
-o:value("bbr", translate("BBR"))
-o:value("cubic", translate("CUBIC"))
-o:value("new_reno", translate("New Reno"))
-o.default = "cubic"
-o.rmempty = true
-o.rewrite_option = o.option
-
-o = s:option(Value, _n("heartbeat"), translate("Heartbeat interval(second)"))
-o.datatype = "uinteger"
-o.default = "3"
-o.rmempty = true
-o.rewrite_option = o.option
-
-o = s:option(Value, _n("timeout"), translate("Timeout for establishing a connection to server(second)"))
-o.datatype = "uinteger"
-o.default = "8"
-o.rmempty = true
-o.rewrite_option = o.option
-
-o = s:option(Value, _n("gc_interval"), translate("Garbage collection interval(second)"))
-o.datatype = "uinteger"
-o.default = "3"
-o.rmempty = true
-o.rewrite_option = o.option
-
-o = s:option(Value, _n("gc_lifetime"), translate("Garbage collection lifetime(second)"))
-o.datatype = "uinteger"
-o.default = "15"
-o.rmempty = true
-o.rewrite_option = o.option
-
-o = s:option(Value, _n("send_window"), translate("TUIC send window"))
-o.datatype = "uinteger"
-o.default = 20971520
-o.rmempty = true
-o.rewrite_option = o.option
-
-o = s:option(Value, _n("receive_window"), translate("TUIC receive window"))
-o.datatype = "uinteger"
-o.default = 10485760
-o.rmempty = true
-o.rewrite_option = o.option
-
-o = s:option(Value, _n("max_package_size"), translate("TUIC Maximum packet size the socks5 server can receive from external, in bytes"))
-o.datatype = "uinteger"
-o.default = 1500
-o.rmempty = true
-o.rewrite_option = o.option
-
---Tuic settings for the local inbound socks5 server
-o = s:option(Flag, _n("dual_stack"), translate("Set if the listening socket should be dual-stack"))
-o.default = 0
-o.rmempty = true
-o.rewrite_option = o.option
-
-o = s:option(Flag, _n("disable_sni"), translate("Disable SNI"))
-o.default = 0
-o.rmempty = true
-o.rewrite_option = o.option
-
-o = s:option(Flag, _n("zero_rtt_handshake"), translate("Enable 0-RTT QUIC handshake"))
-o.default = 0
-o.rmempty = true
-o.rewrite_option = o.option
-
-o = s:option(ListValue, _n("tls_alpn"), translate("TLS ALPN"))
-o.rmempty = true
-o.default = ""
-o:value("", translate("Default"))
-o:value("h3")
-o:value("h2")
-o:value("h3,h2")
-o:value("http/1.1")
-o:value("h2,http/1.1")
-o:value("h3,h2,http/1.1")
-o:value("spdy/3.1")
-o:value("h3,spdy/3.1")
-o.rewrite_option = o.option
-
-api.luci_types(arg[1], m, s, type_name, option_prefix)
diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/trojan-plus.lua b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/trojan-plus.lua
deleted file mode 100644
index 9581a7a6..00000000
--- a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/trojan-plus.lua
+++ /dev/null
@@ -1,110 +0,0 @@
-local m, s = ...
-
-local api = require "luci.passwall.api"
-
-if not api.is_finded("trojan-plus") then
-	return
-end
-
-local fs = api.fs
-
-local type_name = "Trojan-Plus"
-
-local option_prefix = "trojan_plus_"
-
-local function _n(name)
-	return option_prefix .. name
-end
-
--- [[ Trojan-Plus ]]
-
-s.fields["type"]:value(type_name, "Trojan-Plus")
-
-o = s:option(Value, _n("port"), translate("Listen Port"))
-o.datatype = "port"
-
-o = s:option(DynamicList, _n("uuid"), translate("ID") .. "/" .. translate("Password"))
-for i = 1, 3 do
-	o:value(api.gen_uuid(1))
-end
-
-o = s:option(Flag, _n("tls"), translate("TLS"))
-o.default = 0
-o.validate = function(self, value, t)
-	if value then
-		local type = s.fields["type"] and s.fields["type"]:formvalue(t) or ""
-		if value == "0" and type == type_name then
-			return nil, translate("Original Trojan only supported 'tls', please choose 'tls'.")
-		end
-		if value == "1" then
-			local ca = s.fields[_n("tls_certificateFile")] and s.fields[_n("tls_certificateFile")]:formvalue(t) or ""
-			local key = s.fields[_n("tls_keyFile")] and s.fields[_n("tls_keyFile")]:formvalue(t) or ""
-			if ca == "" or key == "" then
-				return nil, translate("Public key and Private key path can not be empty!")
-			end
-		end
-		return value
-	end
-end
-
-o = s:option(FileUpload, _n("tls_certificateFile"), translate("Public key absolute path"), translate("as:") .. "/etc/ssl/fullchain.pem")
-o.default = m:get(s.section, "tls_certificateFile") or "/etc/config/ssl/" .. arg[1] .. ".pem"
-o:depends({ [_n("tls")] = true })
-o.validate = function(self, value, t)
-	if value and value ~= "" then
-		if not fs.access(value) then
-			return nil, translate("Can't find this file!")
-		else
-			return value
-		end
-	end
-	return nil
-end
-
-o = s:option(FileUpload, _n("tls_keyFile"), translate("Private key absolute path"), translate("as:") .. "/etc/ssl/private.key")
-o.default = m:get(s.section, "tls_keyFile") or "/etc/config/ssl/" .. arg[1] .. ".key"
-o:depends({ [_n("tls")] = true })
-o.validate = function(self, value, t)
-	if value and value ~= "" then
-		if not fs.access(value) then
-			return nil, translate("Can't find this file!")
-		else
-			return value
-		end
-	end
-	return nil
-end
-
-o = s:option(Flag, _n("tls_sessionTicket"), translate("Session Ticket"))
-o.default = "0"
-o:depends({ [_n("tls")] = true })
-
-o = s:option(Flag, _n("tcp_fast_open"), translate("TCP Fast Open"))
-o.default = "0"
-
-o = s:option(Flag, _n("remote_enable"), translate("Enable Remote"), translate("You can forward to Nginx/Caddy/V2ray/Xray WebSocket and more."))
-o.default = "1"
-o.rmempty = false
-
-o = s:option(Value, _n("remote_address"), translate("Remote Address"))
-o.default = "127.0.0.1"
-o:depends({ [_n("remote_enable")] = true })
-
-o = s:option(Value, _n("remote_port"), translate("Remote Port"))
-o.datatype = "port"
-o.default = "80"
-o:depends({ [_n("remote_enable")] = true })
-
-o = s:option(Flag, _n("log"), translate("Log"))
-o.default = "1"
-
-o = s:option(ListValue, _n("loglevel"), translate("Log Level"))
-o.default = "2"
-o:value("0", "all")
-o:value("1", "info")
-o:value("2", "warn")
-o:value("3", "error")
-o:value("4", "fatal")
-o:depends({ [_n("log")] = true })
-
-api.luci_types(arg[1], m, s, type_name, option_prefix)
diff --git a/luci-app-passwall/luasrc/passwall/server_app.lua b/luci-app-passwall/luasrc/passwall/server_app.lua
index 05d48d95..639b7119 100644
--- a/luci-app-passwall/luasrc/passwall/server_app.lua
+++ b/luci-app-passwall/luasrc/passwall/server_app.lua
@@ -188,12 +188,6 @@ local function start()
 					config = require(require_dir .. "util_hysteria2").gen_config_server(user)
 				end
 				bin = ln_run(api.get_app_path("hysteria"), "hysteria", "-c " .. config_file .. " server", log_path)
-			elseif type == "Trojan" then
-				config = require(require_dir .. "util_trojan").gen_config_server(user)
-				bin = ln_run("/usr/sbin/trojan", "trojan", "-c " .. config_file, log_path)
-			elseif type == "Trojan-Plus" then
-				config = require(require_dir .. "util_trojan").gen_config_server(user)
-				bin = ln_run("/usr/sbin/trojan-plus", "trojan-plus", "-c " .. config_file, log_path)
 			end
 
 			if next(config) then
diff --git a/luci-app-passwall/luasrc/passwall/util_trojan.lua b/luci-app-passwall/luasrc/passwall/util_trojan.lua
deleted file mode 100644
index b86b22ba..00000000
--- a/luci-app-passwall/luasrc/passwall/util_trojan.lua
+++ /dev/null
@@ -1,108 +0,0 @@
-module("luci.passwall.util_trojan", package.seeall)
-local api = require "luci.passwall.api"
-local uci = api.uci
-local jsonc = api.jsonc
-
-function gen_config_server(node)
-	local cipher = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
-	local cipher13 = "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384"
-	local config = {
-		run_type = "server",
-		local_addr = "::",
-		local_port = tonumber(node.port),
-		remote_addr = (node.remote_enable == "1" and node.remote_address) and node.remote_address or nil,
-		remote_port = (node.remote_enable == "1" and node.remote_port) and tonumber(node.remote_port) or nil,
-		password = node.uuid,
-		log_level = (node.log and node.log == "1") and tonumber(node.loglevel) or 5,
-		ssl = {
-			cert = node.tls_certificateFile,
-			key = node.tls_keyFile,
-			key_password = "",
-			cipher = cipher,
-			cipher_tls13 = cipher13,
-			prefer_server_cipher = true,
-			reuse_session = true,
-			session_ticket = (node.tls_sessionTicket == "1") and true or false,
-			session_timeout = 600,
-			plain_http_response = "",
-			curves = "",
-			dhparam = ""
-		},
-		tcp = {
-			prefer_ipv4 = false,
-			no_delay = true,
-			keep_alive = true,
-			reuse_port = false,
-			fast_open = (node.tcp_fast_open and node.tcp_fast_open == "1") and true or false,
-			fast_open_qlen = 20
-		}
-	}
-	return config
-end
-
-function gen_config(var)
-	local node_id = var["node"]
-	if not node_id then
-		print("node 不能为空")
-		return
-	end
-	local node = uci:get_all("passwall", node_id)
-	local run_type = var["run_type"]
-	local local_addr = var["local_addr"]
-	local local_port = var["local_port"]
-	local server_host = var["server_host"] or (node.address or ""):lower()
-	local server_port = var["server_port"] or node.port
-	local loglevel = var["loglevel"] or 2
-	local cipher = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
-	local cipher13 = "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384"
-
-	if api.is_ipv6(server_host) then
-		server_host = api.get_ipv6_only(server_host)
-	end
-	local server = server_host
-
-	local trojan = {
-		run_type = run_type,
-		local_addr = local_addr,
-		local_port = tonumber(local_port),
-		remote_addr = server,
-		remote_port = tonumber(server_port),
-		password = {node.password},
-		log_level = tonumber(loglevel),
-		ssl = {
-			verify = (node.tls_allowInsecure ~= "1") and true or false,
-			verify_hostname = true,
-			cert = nil,
-			cipher = cipher,
-			cipher_tls13 = cipher13,
-			sni = node.tls_serverName or server,
-			alpn = {"h2", "http/1.1"},
-			reuse_session = true,
-			session_ticket = (node.tls_sessionTicket and node.tls_sessionTicket == "1") and true or false,
-			curves = ""
-		},
-		udp_timeout = 60,
-		tcp = {
-			use_tproxy = (node.type == "Trojan-Plus" and var["use_tproxy"]) and true or nil,
-			no_delay = true,
-			keep_alive = true,
-			reuse_port = true,
-			fast_open = (node.tcp_fast_open and node.tcp_fast_open == "1") and true or false,
-			fast_open_qlen = 20
-		}
-	}
-	return jsonc.stringify(trojan, 1)
-end
-
-_G.gen_config = gen_config
-
-if arg[1] then
-	local func =_G[arg[1]]
-	if func then
-		local var = nil
-		if arg[2] then
-			var = jsonc.parse(arg[2])
-		end
-		print(func(var))
-	end
-end
diff --git a/luci-app-passwall/luasrc/passwall/util_tuic.lua b/luci-app-passwall/luasrc/passwall/util_tuic.lua
deleted file mode 100644
index d10c4dac..00000000
--- a/luci-app-passwall/luasrc/passwall/util_tuic.lua
+++ /dev/null
@@ -1,68 +0,0 @@
-module("luci.passwall.util_tuic", package.seeall)
-local api = require "luci.passwall.api"
-local uci = api.uci
-local jsonc = api.jsonc
-
-function gen_config(var)
-	local node_id = var["node"]
-	if not node_id then
-		print("node 不能为空")
-		return
-	end
-	local node = uci:get_all("passwall", node_id)
-	local local_addr = var["local_addr"]
-	local local_port = var["local_port"]
-	local server_host = var["server_host"] or (node.address or ""):lower()
-	local server_port = var["server_port"] or node.port
-	local loglevel = var["loglevel"] or "warn"
-
-	local tuic= {
-			relay = {
-				server = server_host .. ":" .. server_port,
-				ip = node.tuic_ip,
-				uuid = node.uuid,
-				password = node.tuic_password,
-				-- certificates = node.tuic_certificate and { node.tuic_certpath } or nil,
-				udp_relay_mode = node.tuic_udp_relay_mode,
-				congestion_control = node.tuic_congestion_control,
-				heartbeat = (tonumber(node.tuic_heartbeat) or 3) .. "s",
-				timeout = (tonumber(node.tuic_timeout) or 8) .. "s",
-				gc_interval = (tonumber(node.tuic_gc_interval) or 3) .. "s",
-				gc_lifetime = (tonumber(node.tuic_gc_lifetime) or 15) .. "s",
-				alpn = (node.tuic_tls_alpn and node.tuic_tls_alpn ~= "") and (function()
-					local alpn = {}
-					string.gsub(node.tuic_tls_alpn, '[^,]+', function(w)
-						table.insert(alpn, w)
-					end)
-					if #alpn > 0 then return alpn end
-					return nil
-				end)() or nil,
-				disable_sni = (node.tuic_disable_sni == "1"),
-				zero_rtt_handshake = (node.tuic_zero_rtt_handshake == "1"),
-				send_window = tonumber(node.tuic_send_window),
-				receive_window = tonumber(node.tuic_receive_window)
-			},
-			["local"] = {
-				server = "[::]:" .. local_port,
-				username = node.tuic_socks_username,
-				password = node.tuic_socks_password,
-				dual_stack = (node.tuic_dual_stack == "1") and true or false,
-				max_packet_size = tonumber(node.tuic_max_package_size)
-			},
-			log_level = loglevel
-	}
-	return jsonc.stringify(tuic, 1)
-end
-
-_G.gen_config = gen_config
-
-if arg[1] then
-	local func =_G[arg[1]]
-	if func then
-		local var = nil
-		if arg[2] then
-			var = jsonc.parse(arg[2])
-		end
-		print(func(var))
-	end
-end
diff --git a/luci-app-passwall/luasrc/passwall/util_xray.lua b/luci-app-passwall/luasrc/passwall/util_xray.lua
index ab4628df..171ab828 100644
--- a/luci-app-passwall/luasrc/passwall/util_xray.lua
+++ b/luci-app-passwall/luasrc/passwall/util_xray.lua
@@ -465,9 +465,9 @@ function gen_config_server(node)
 
 	if node.protocol == "vmess" or node.protocol == "vless" then
 		if node.uuid then
-			local users = {}
+			local clients = {}
 			for i = 1, #node.uuid do
-				users[i] = {
+				clients[i] = {
 					id = node.uuid[i],
 					flow = (node.protocol == "vless"
 					and (node.tls == "1" or (node.decryption and node.decryption ~= "" and node.decryption ~= "none")) 
@@ -475,7 +475,7 @@ function gen_config_server(node)
 				}
 			end
 			settings = {
-				users = users,
+				clients = clients,
 				decryption = (node.protocol == "vless") and ((node.decryption and node.decryption ~= "") and node.decryption or "none") or nil
 			}
 		end
@@ -483,7 +483,7 @@ function gen_config_server(node)
 		settings = {
 			udp = ("1" == node.udp_forward) and true or false,
 			auth = ("1" == node.auth) and "password" or "noauth",
-			users = ("1" == node.auth) and {
+			accounts = ("1" == node.auth) and {
 				{
 					user = node.username,
 					pass = node.password
@@ -493,7 +493,7 @@ function gen_config_server(node)
 	elseif node.protocol == "http" then
 		settings = {
 			allowTransparent = false,
-			users = ("1" == node.auth) and {
+			accounts = ("1" == node.auth) and {
 				{
 					user = node.username,
 					pass = node.password
@@ -511,20 +511,20 @@ function gen_config_server(node)
 		}
 	elseif node.protocol == "trojan" then
 		if node.uuid then
-			local users = {}
+			local clients = {}
 			for i = 1, #node.uuid do
-				users[i] = {
+				clients[i] = {
 					password = node.uuid[i],
 				}
 			end
 			settings = {
-				users = users
+				clients = clients
 			}
 		end
 	elseif node.protocol == "hysteria2" then
 		settings = {
 			version = 2,
-			users = node.hysteria2_auth_password and {
+			clients = node.hysteria2_auth_password and {
 				{ auth = node.hysteria2_auth_password }
 			}
 		}
@@ -888,7 +888,7 @@ function gen_config(var)
 			end
 			if local_socks_username and local_socks_password and local_socks_username ~= "" and local_socks_password ~= "" then
 				inbound.settings.auth = "password"
-				inbound.settings.users = {
+				inbound.settings.accounts = {
 					{
 						user = local_socks_username,
 						pass = local_socks_password
@@ -905,7 +905,7 @@ function gen_config(var)
 				settings = {allowTransparent = false}
 			}
 			if local_http_username and local_http_password and local_http_username ~= "" and local_http_password ~= "" then
-				inbound.settings.users = {
+				inbound.settings.accounts = {
 					{
 						user = local_http_username,
 						pass = local_http_password
@@ -1033,10 +1033,10 @@ function gen_config(var)
 			if #valid_nodes == 0 then return nil end
 
 			-- fallback node
-			local fallback_node_tag = nil
 			local fallback_node_id = _node.fallback_node
-			if not fallback_node_id or fallback_node_id == "" then fallback_node_id = nil end
-			if fallback_node_id then
+			fallback_node_id = (fallback_node_id and fallback_node_id ~= "") and fallback_node_id or nil
+			local fallback_node_tag = (fallback_node_id == "_direct") and "direct" or "blackhole"
+			if fallback_node_id and fallback_node_id ~= "_direct" then
 				local is_new_node = true
 				for _, outbound in ipairs(outbounds) do
 					if string.sub(outbound.tag, 1, #fallback_node_id) == fallback_node_id then
@@ -1963,7 +1963,7 @@ function gen_proto_config(var)
 		}
 		if local_socks_username and local_socks_password and local_socks_username ~= "" and local_socks_password ~= "" then
 			inbound.settings.auth = "password"
-			inbound.settings.users = {
+			inbound.settings.accounts = {
 				{
 					user = local_socks_username,
 					pass = local_socks_password
@@ -1983,7 +1983,7 @@ function gen_proto_config(var)
 			}
 		}
 		if local_http_username and local_http_password and local_http_username ~= "" and local_http_password ~= "" then
-			inbound.settings.users = {
+			inbound.settings.accounts = {
 				{
 					user = local_http_username,
 					pass = local_http_password
diff --git a/luci-app-passwall/luasrc/view/passwall/node_config/link_share_man.htm b/luci-app-passwall/luasrc/view/passwall/node_config/link_share_man.htm
index f3d33278..844bf3d9 100644
--- a/luci-app-passwall/luasrc/view/passwall/node_config/link_share_man.htm
+++ b/luci-app-passwall/luasrc/view/passwall/node_config/link_share_man.htm
@@ -6,13 +6,12 @@ local map = self.map
 
 local has_ss = api.is_finded("ss-redir")
 local has_ss_rust = api.is_finded("sslocal")
-local has_trojan_plus = api.is_finded("trojan-plus")
 local has_singbox = api.finded_com("sing-box")
 local has_xray = api.finded_com("xray")
 local has_hysteria2 = api.finded_com("hysteria")
 
 local ss_type = api.get_core("ss_type", {{has_ss,"shadowsocks-libev"},{has_ss_rust,"shadowsocks-rust"},{has_singbox,"sing-box"},{has_xray,"xray"}})
-local trojan_type = api.get_core("trojan_type", {{has_trojan_plus,"trojan-plus"},{has_singbox,"sing-box"},{has_xray,"xray"}})
+local trojan_type = api.get_core("trojan_type", {{has_singbox,"sing-box"},{has_xray,"xray"}})
 local vmess_type = api.get_core("vmess_type", {{has_xray,"xray"},{has_singbox,"sing-box"}})
 local vless_type = api.get_core("vless_type", {{has_xray,"xray"},{has_singbox,"sing-box"}})
 local hysteria2_type = api.get_core("hysteria2_type", {{has_hysteria2,"hysteria2"},{has_singbox,"sing-box"}, {has_xray,"xray"}})
@@ -175,9 +174,6 @@ local current_node = map:get(section)
 		} else if (v_type === "SSR") {
 			dom_prefix = "ssr_"
 			protocol = "ssr"
-		} else if (v_type === "Trojan-Plus") {
-			dom_prefix = "trojan_plus_"
-			protocol = "trojan"
 		} else if (v_type === "Hysteria2") {
 			dom_prefix = "hysteria2_"
 			protocol = "hysteria2"
@@ -521,7 +517,7 @@ local current_node = map:get(section)
 				params = params.substring(1);
 			}
 			url += params;
-		} else if (v_type === "Trojan-Plus" || ((v_type === "sing-box" || v_type === "Xray") && opt.get(dom_prefix + "protocol").value === "trojan")) {
+		} else if ((v_type === "sing-box" || v_type === "Xray") && opt.get(dom_prefix + "protocol").value === "trojan") {
 			protocol = "trojan"
 			var v_password = opt.get(dom_prefix + "password");
 			var v_port = opt.get(dom_prefix + "port");
@@ -1213,7 +1209,7 @@ local current_node = map:get(section)
 				}
 			}
 		}
-		if (ssu[0] === "trojan" || ssu[0] === "trojan-plus") {
+		if (ssu[0] === "trojan") {
 			if (trojan_type == "sing-box" && has_singbox) {
 				dom_prefix = "singbox_"
 				opt.set('type', "sing-box");
@@ -1222,9 +1218,6 @@ local current_node = map:get(section)
 				dom_prefix = "xray_"
 				opt.set('type', "Xray");
 				opt.set(dom_prefix + 'protocol', "trojan");
-			} else {
-				dom_prefix = "trojan_plus_"
-				opt.set('type', "Trojan-Plus");
 			}
 			var m = parseNodeUrl(ssrurl);
 			var password = m.passwd;
diff --git a/luci-app-passwall/po/zh-cn/passwall.po b/luci-app-passwall/po/zh-cn/passwall.po
index 43c20824..b419fc6f 100644
--- a/luci-app-passwall/po/zh-cn/passwall.po
+++ b/luci-app-passwall/po/zh-cn/passwall.po
@@ -1510,9 +1510,6 @@ msgstr "传输层加密"
 msgid "Whether or not transport layer encryption is enabled, \"none\" for unencrypted, \"tls\" for using TLS, \"xtls\" for using XTLS."
 msgstr "是否启入传输层加密，支持的选项有 \"none\" 表示不加密，\"tls\" 表示使用 TLS，\"xtls\" 表示使用 XTLS。"
 
-msgid "Original Trojan only supported 'tls', please choose 'tls'."
-msgstr "原版Trojan只支持'tls'，请选择'tls'。"
-
 msgid "Transfer mode"
 msgstr "传输模式"
 
@@ -1531,18 +1528,6 @@ msgstr "是否允许不安全连接。当勾选时，将跳过证书验证。"
 msgid "%s Node Use Type"
 msgstr "%s 节点使用类型"
 
-msgid "Set the TUIC proxy server ip address"
-msgstr "指定远程 TUIC 服务器 IP"
-
-msgid "TUIC User Password For Connect Remote Server"
-msgstr "用于远程 TUIC 服务器连接的密码"
-
-msgid "TUIC UserName For Local Socks"
-msgstr "用于本地 Socks 服务器连接的用户名"
-
-msgid "TUIC Password For Local Socks"
-msgstr "用于本地 Socks 服务器连接的密码"
-
 msgid "UDP relay mode"
 msgstr "UDP 中继模式"
 
@@ -1552,33 +1537,12 @@ msgstr "拥塞控制算法"
 msgid "Heartbeat interval(second)"
 msgstr "保活心跳包发送间隔（单位：秒）"
 
-msgid "Timeout for establishing a connection to server(second)"
-msgstr "连接超时时间（单位：秒）"
-
-msgid "Garbage collection interval(second)"
-msgstr "UDP 数据包片残片清理间隔（单位：秒）"
-
-msgid "Garbage collection lifetime(second)"
-msgstr "UDP 数据包残片在服务器的保留时间（单位：秒）"
-
 msgid "Disable SNI"
 msgstr "关闭 SNI 服务器名称指示"
 
 msgid "Enable 0-RTT QUIC handshake"
 msgstr "客户端启用 0-RTT QUIC 连接握手"
 
-msgid "TUIC send window"
-msgstr "发送窗口（无需确认即可发送的最大字节数：默认8Mb*2）"
-
-msgid "TUIC receive window"
-msgstr "接收窗口（无需确认即可接收的最大字节数：默认8Mb）"
-
-msgid "TUIC Maximum packet size the socks5 server can receive from external, in bytes"
-msgstr "TUIC socks5 服务器可以从外部接收的最大数据包大小（以字节为单位）"
-
-msgid "Set if the listening socket should be dual-stack"
-msgstr "设置监听套接字为双栈"
-
 msgid "<br />none: default, no masquerade, data sent is packets with no characteristics.<br />srtp: disguised as an SRTP packet, it will be recognized as video call data (such as FaceTime).<br />utp: packets disguised as uTP will be recognized as bittorrent downloaded data.<br />wechat-video: packets disguised as WeChat video calls.<br />dtls: disguised as DTLS 1.2 packet.<br />wireguard: disguised as a WireGuard packet. (not really WireGuard protocol)<br />dns: Disguising traffic as DNS requests."
 msgstr "<br />none：默认值，不进行伪装，发送的数据是没有特征的数据包。<br />srtp：伪装成 SRTP 数据包，会被识别为视频通话数据（如 FaceTime）。<br />utp：伪装成 uTP 数据包，会被识别为 BT 下载数据。<br />wechat-video：伪装成微信视频通话的数据包。<br />dtls：伪装成 DTLS 1.2 数据包。<br />wireguard：伪装成 WireGuard 数据包。(并不是真正的 WireGuard 协议)<br />dns：把流量伪装成 DNS 请求。"
 
diff --git a/luci-app-passwall/root/usr/share/passwall/0_default_config b/luci-app-passwall/root/usr/share/passwall/0_default_config
index 57144fe3..a3668069 100644
--- a/luci-app-passwall/root/usr/share/passwall/0_default_config
+++ b/luci-app-passwall/root/usr/share/passwall/0_default_config
@@ -24,7 +24,6 @@ config global
 	option log_tcp '0'
 	option log_udp '0'
 	option loglevel 'error'
-	option trojan_loglevel '4'
 	option log_chinadns_ng '0'
 
 config global_haproxy
diff --git a/luci-app-passwall/root/usr/share/passwall/app.sh b/luci-app-passwall/root/usr/share/passwall/app.sh
index 09f5bb6b..94f31194 100755
--- a/luci-app-passwall/root/usr/share/passwall/app.sh
+++ b/luci-app-passwall/root/usr/share/passwall/app.sh
@@ -13,10 +13,8 @@ LUA_UTIL_PATH=/usr/lib/lua/luci/passwall
 UTIL_SINGBOX=$LUA_UTIL_PATH/util_sing-box.lua
 UTIL_SS=$LUA_UTIL_PATH/util_shadowsocks.lua
 UTIL_XRAY=$LUA_UTIL_PATH/util_xray.lua
-UTIL_TROJAN=$LUA_UTIL_PATH/util_trojan.lua
 UTIL_NAIVE=$LUA_UTIL_PATH/util_naiveproxy.lua
 UTIL_HYSTERIA2=$LUA_UTIL_PATH/util_hysteria2.lua
-UTIL_TUIC=$LUA_UTIL_PATH/util_tuic.lua
 SINGBOX_BIN=$(first_type $(config_t_get global_app sing_box_file) sing-box)
 XRAY_BIN=$(first_type $(config_t_get global_app xray_file) xray)
 
@@ -448,13 +446,6 @@ run_socks() {
 		[ -n "$no_run" ] && _args="${_args} no_run=1"
 		run_xray flag=$flag node=$node socks_address=$bind socks_port=$socks_port config_file=$config_file log_file=$log_file ${_args}
 	;;
-	trojan*)
-		json_add_string "run_type" "client"
-		json_add_string "local_addr" "$bind"
-		json_add_string "local_port" "$socks_port"
-		lua $UTIL_TROJAN gen_config "$(json_dump)" > $config_file
-		[ -n "$no_run" ] || ln_run "$(first_type ${type})" "${type}" $log_file -c "$config_file"
-	;;
 	naiveproxy)
 		json_add_string "run_type" "socks"
 		json_add_string "local_addr" "$bind"
@@ -507,12 +498,6 @@ run_socks() {
 		lua $UTIL_HYSTERIA2 gen_config "$(json_dump)" > $config_file
 		[ -n "$no_run" ] || ln_run "$(first_type $(config_t_get global_app hysteria_file))" "hysteria" $log_file -c "$config_file" client
 	;;
-	tuic)
-		json_add_string "local_addr" "$bind"
-		json_add_string "local_port" "$socks_port"
-		lua $UTIL_TUIC gen_config "$(json_dump)" > $config_file
-		[ -n "$no_run" ] || ln_run "$(first_type tuic-client)" "tuic-client" $log_file -c "$config_file"
-	;;
 	esac
 
 	set_cache_var "node_${node}_socks_port" "${socks_port}"
@@ -634,15 +619,6 @@ run_redir() {
 			}
 			run_xray flag=UDP node=$node udp_redir_port=$local_port config_file=$config_file log_file=$log_file
 		;;
-		trojan*)
-			local loglevel=$(config_t_get global trojan_loglevel "2")
-			json_add_string "run_type" "nat"
-			json_add_string "local_addr" "0.0.0.0"
-			json_add_string "local_port" "$local_port"
-			json_add_string "loglevel" "$loglevel"
-			lua $UTIL_TROJAN gen_config "$(json_dump)" > $config_file
-			ln_run "$(first_type ${type})" "${type}" $log_file -c "$config_file"
-		;;
 		naiveproxy)
 			echolog "Naiveproxy不支持UDP转发！"
 		;;
@@ -673,9 +649,6 @@ run_redir() {
 			lua $UTIL_HYSTERIA2 gen_config "$(json_dump)" > $config_file
 			ln_run "$(first_type $(config_t_get global_app hysteria_file))" "hysteria" $log_file -c "$config_file" client
 		;;
-		tuic)
-			echolog "TUIC不支持UDP转发！"
-		;;
 		esac
 	;;
 	TCP)
@@ -755,6 +728,10 @@ run_redir() {
 				if [ ! -s "$geoip_path" ] || [ ! -s "$geosite_path" ]; then
 					echolog "* 缺少Geo规则文件，TCP Sing-Box分流节点无法正常使用！"
 				fi
+				[ "$(config_n_get $node fakedns)" = "1" ] && {
+					USE_FAKEDNS=1
+					GLOBAL_SHUNT_NODE_FAKEDNS=1
+				}
 			}
 
 			[ "${DNS_MODE}" = "sing-box" ] && {
@@ -792,9 +769,10 @@ run_redir() {
 				esac
 				local remote_fakedns=$(config_t_get global remote_fakedns 0)
 				[ "${remote_fakedns}" = "1" ] && {
-					fakedns=1
+					REMOTE_FAKEDNS=1
 					_args="${_args} remote_fakedns=1"
 					resolve_dns_log="${resolve_dns_log} + FakeDNS"
+					USE_FAKEDNS=1
 				}
 				NEXT_DNS_LISTEN_PORT=$(expr $NEXT_DNS_LISTEN_PORT + 1)
 			}
@@ -836,6 +814,10 @@ run_redir() {
 				if [ ! -s "$geoip_path" ] || [ ! -s "$geosite_path" ]; then
 					echolog "* 缺少Geo规则文件，TCP Xray分流节点无法正常使用！"
 				fi
+				[ "$(config_n_get $node fakedns)" = "1" ] && {
+					USE_FAKEDNS=1
+					GLOBAL_SHUNT_NODE_FAKEDNS=1
+				}
 			}
 
 			[ "${DNS_MODE}" = "xray" ] && {
@@ -873,29 +855,15 @@ run_redir() {
 				esac
 				local remote_fakedns=$(config_t_get global remote_fakedns 0)
 				[ "${remote_fakedns}" = "1" ] && {
-					fakedns=1
+					REMOTE_FAKEDNS=1
 					_args="${_args} remote_fakedns=1"
 					resolve_dns_log="${resolve_dns_log} + FakeDNS"
+					USE_FAKEDNS=1
 				}
 				NEXT_DNS_LISTEN_PORT=$(expr $NEXT_DNS_LISTEN_PORT + 1)
 			}
 			run_xray flag=$_flag node=$node tcp_redir_port=$local_port tcp_proxy_way=$TCP_PROXY_WAY config_file=$config_file log_file=$log_file ${_args}
 		;;
-		trojan*)
-			[ "${TCP_PROXY_WAY}" = "tproxy" ] && json_add_string "use_tproxy" "true"
-			[ "$TCP_UDP" = "1" ] && {
-				config_file="${config_file//TCP/TCP_UDP}"
-				UDP_REDIR_PORT=$TCP_REDIR_PORT
-				unset UDP_NODE
-			}
-			local loglevel=$(config_t_get global trojan_loglevel "2")
-			json_add_string "run_type" "nat"
-			json_add_string "local_addr" "0.0.0.0"
-			json_add_string "local_port" "$local_port"
-			json_add_string "loglevel" "$loglevel"
-			lua $UTIL_TROJAN gen_config "$(json_dump)" > $config_file
-			ln_run "$(first_type ${type})" "${type}" $log_file -c "$config_file"
-		;;
 		naiveproxy)
 			json_add_string "run_type" "redir"
 			json_add_string "local_addr" "0.0.0.0"
@@ -1322,6 +1290,12 @@ start_dns() {
 			_args="${_args} direct_dns_query_strategy=${DIRECT_DNS_QUERY_STRATEGY}"
 			_args="${_args} remote_dns_query_strategy=${REMOTE_DNS_QUERY_STRATEGY}"
 			DNSMASQ_FILTER_PROXY_IPV6=0
+			local remote_fakedns=$(config_t_get global remote_fakedns 0)
+			[ "${remote_fakedns}" = "1" ] && {
+				REMOTE_FAKEDNS=1
+				_args="${_args} remote_fakedns=1"
+				USE_FAKEDNS=1
+			}
 			local _remote_dns_client_ip=$(config_t_get global remote_dns_client_ip)
 			[ -n "${_remote_dns_client_ip}" ] && _args="${_args} remote_dns_client_ip=${_remote_dns_client_ip}"
 			TCP_PROXY_DNS=1
@@ -1355,6 +1329,12 @@ start_dns() {
 			_args="${_args} direct_dns_query_strategy=${DIRECT_DNS_QUERY_STRATEGY}"
 			_args="${_args} remote_dns_query_strategy=${REMOTE_DNS_QUERY_STRATEGY}"
 			DNSMASQ_FILTER_PROXY_IPV6=0
+			local remote_fakedns=$(config_t_get global remote_fakedns 0)
+			[ "${remote_fakedns}" = "1" ] && {
+				REMOTE_FAKEDNS=1
+				_args="${_args} remote_fakedns=1"
+				USE_FAKEDNS=1
+			}
 			local _remote_dns_client_ip=$(config_t_get global remote_dns_client_ip)
 			[ -n "${_remote_dns_client_ip}" ] && _args="${_args} remote_dns_client_ip=${_remote_dns_client_ip}"
 			TCP_PROXY_DNS=1
@@ -1431,7 +1411,7 @@ start_dns() {
 			lua $APP_PATH/helper_smartdns_add.lua -FLAG "default" -SMARTDNS_CONF "/tmp/etc/smartdns/$CONFIG.conf" \
 				-LISTEN_PORT ${SMARTDNS_LISTEN_PORT} -LOCAL_PORT ${SMARTDNS_LOCAL_PORT} \
 				-LOCAL_GROUP ${group_domestic:-null} -REMOTE_GROUP "passwall_proxy" -REMOTE_PROXY_SERVER ${TCP_SOCKS_server} -USE_DEFAULT_DNS "${USE_DEFAULT_DNS:-direct}" \
-				-REMOTE_DNS ${smartdns_remote_dns} -DNS_MODE ${DNS_MODE:-socks} -TUN_DNS ${TUN_DNS} -REMOTE_FAKEDNS ${fakedns:-0} \
+				-REMOTE_DNS ${smartdns_remote_dns} -DNS_MODE ${DNS_MODE:-socks} -TUN_DNS ${TUN_DNS} -REMOTE_FAKEDNS ${REMOTE_FAKEDNS:-0} \
 				-USE_DIRECT_LIST "${USE_DIRECT_LIST}" -USE_PROXY_LIST "${USE_PROXY_LIST}" -USE_BLOCK_LIST "${USE_BLOCK_LIST}" -USE_GFW_LIST "${USE_GFW_LIST}" -CHN_LIST "${CHN_LIST}" \
 				-TCP_NODE ${TCP_NODE} -DEFAULT_PROXY_MODE "${TCP_PROXY_MODE}" -NO_PROXY_IPV6 ${FILTER_PROXY_IPV6:-0} -NFTFLAG ${nftflag:-0} \
 				-SUBNET ${subnet_ip:-0} -NO_LOGIC_LOG ${NO_LOGIC_LOG:-0}
@@ -1475,7 +1455,7 @@ start_dns() {
 			_default_tag=$(config_t_get global chinadns_ng_default_tag smart) \
 			_no_logic_log=0 \
 			_tcp_node=${TCP_NODE} \
-			_remote_fakedns=${fakedns:-0} \
+			_remote_fakedns=${REMOTE_FAKEDNS:-0} \
 			_filter_https=$(config_t_get global force_https_soa 0)
 
 		USE_DEFAULT_DNS="chinadns_ng"
@@ -1507,7 +1487,7 @@ start_dns() {
 		lua $APP_PATH/helper_dnsmasq.lua stretch
 		lua $APP_PATH/helper_dnsmasq.lua add_rule -FLAG "default" -TMP_DNSMASQ_PATH ${GLOBAL_DNSMASQ_CONF_PATH} -DNSMASQ_CONF_FILE ${GLOBAL_DNSMASQ_CONF} \
 			-DEFAULT_DNS ${DEFAULT_DNS} -LOCAL_DNS ${LOCAL_DNS} -TUN_DNS ${DNSMASQ_TUN_DNS} \
-			-REMOTE_FAKEDNS ${fakedns:-0} -USE_DEFAULT_DNS "${USE_DEFAULT_DNS:-direct}" -CHINADNS_DNS ${china_ng_listen:-0} \
+			-REMOTE_FAKEDNS ${REMOTE_FAKEDNS:-0} -USE_DEFAULT_DNS "${USE_DEFAULT_DNS:-direct}" -CHINADNS_DNS ${china_ng_listen:-0} \
 			-USE_DIRECT_LIST "${USE_DIRECT_LIST}" -USE_PROXY_LIST "${USE_PROXY_LIST}" -USE_BLOCK_LIST "${USE_BLOCK_LIST}" -USE_GFW_LIST "${USE_GFW_LIST}" -CHN_LIST "${CHN_LIST}" \
 			-TCP_NODE ${TCP_NODE} -DEFAULT_PROXY_MODE ${TCP_PROXY_MODE} -NO_PROXY_IPV6 ${DNSMASQ_FILTER_PROXY_IPV6:-0} -NFTFLAG ${nftflag:-0} \
 			-NO_LOGIC_LOG ${NO_LOGIC_LOG:-0}
@@ -1521,7 +1501,7 @@ start_dns() {
 		GLOBAL_DNSMASQ_CONF_PATH=${GLOBAL_ACL_PATH}/dnsmasq.d
 		lua $APP_PATH/helper_dnsmasq.lua add_rule -FLAG "default" -TMP_DNSMASQ_PATH ${GLOBAL_DNSMASQ_CONF_PATH} -DNSMASQ_CONF_FILE ${GLOBAL_DNSMASQ_CONF} \
 			-LISTEN_PORT ${GLOBAL_DNSMASQ_PORT} -DEFAULT_DNS ${DEFAULT_DNS} -LOCAL_DNS ${LOCAL_DNS} -TUN_DNS ${DNSMASQ_TUN_DNS} \
-			-REMOTE_FAKEDNS ${fakedns:-0} -USE_DEFAULT_DNS "${USE_DEFAULT_DNS:-direct}" -CHINADNS_DNS ${china_ng_listen:-0} \
+			-REMOTE_FAKEDNS ${REMOTE_FAKEDNS:-0} -USE_DEFAULT_DNS "${USE_DEFAULT_DNS:-direct}" -CHINADNS_DNS ${china_ng_listen:-0} \
 			-USE_DIRECT_LIST "${USE_DIRECT_LIST}" -USE_PROXY_LIST "${USE_PROXY_LIST}" -USE_BLOCK_LIST "${USE_BLOCK_LIST}" -USE_GFW_LIST "${USE_GFW_LIST}" -CHN_LIST "${CHN_LIST}" \
 			-TCP_NODE ${TCP_NODE} -DEFAULT_PROXY_MODE ${TCP_PROXY_MODE} -NO_PROXY_IPV6 ${DNSMASQ_FILTER_PROXY_IPV6:-0} -NFTFLAG ${nftflag:-0} \
 			-NO_LOGIC_LOG ${NO_LOGIC_LOG:-0}
@@ -1633,6 +1613,7 @@ acl_app() {
 						set_cache_var "ACL_${sid}_tcp_redir_port" "${GLOBAL_TCP_redir_port}"
 						set_cache_var "ACL_${sid}_dns_port" "${GLOBAL_DNSMASQ_PORT}"
 						set_cache_var "ACL_${sid}_tcp_default" "1"
+						[ "$GLOBAL_SHUNT_NODE_FAKEDNS" = "1" ] && use_fakedns=1
 					else
 						echolog "  - 全局节点未启用，跳过【${remarks}】"
 					fi
@@ -1643,6 +1624,7 @@ acl_app() {
 							set_cache_var "ACL_${sid}_tcp_redir_port" "${GLOBAL_TCP_redir_port}"
 							set_cache_var "ACL_${sid}_dns_port" "${GLOBAL_DNSMASQ_PORT}"
 							set_cache_var "ACL_${sid}_tcp_default" "1"
+							[ "$GLOBAL_SHUNT_NODE_FAKEDNS" = "1" ] && use_fakedns=1
 						else
 							local type protocol
 							if [ "$(config_get_type ${tcp_node#Socks_})" = "socks" ]; then
@@ -1666,6 +1648,10 @@ acl_app() {
 								dns_cache_key="${dns_mode}_${remote_dns_doh:-https://1.1.1.1/dns-query}_${v2ray_dns_mode:-doh}_${remote_dns_client_ip:-0}_${remote_fakedns:-0}"
 							}
 
+							if [ "$remote_fakedns" = "1" ] || ([ "$protocol" = "_shunt" ] && [ "$(config_n_get $tcp_node fakedns)" = "1" ]); then
+								use_fakedns=1
+							fi
+
 							run_dns() {
 								local _dns_port
 								[ -n $1 ] && _dns_port=$1
@@ -1800,6 +1786,7 @@ acl_app() {
 						fi
 					}
 				fi
+				[ "${use_fakedns}" = "1" ] && set_cache_var "ACL_${sid}_fakedns" "1"
 			}
 			[ -n "$udp_node" ] && {
 				[ -n "$tcp_node" ] && {
@@ -1873,7 +1860,7 @@ acl_app() {
 			}
 			unset enabled sid remarks sources interface tcp_no_redir_ports udp_no_redir_ports use_global_config tcp_node udp_node use_direct_list use_proxy_list use_block_list use_gfw_list chn_list tcp_proxy_mode udp_proxy_mode filter_proxy_ipv6 dns_mode remote_dns v2ray_dns_mode remote_dns_doh remote_dns_client_ip
 			unset _ip _mac _iprange _ipset _ip_or_mac source_list tcp_port udp_port config_file _extra_param dns_cache_key
-			unset _china_ng_listen _chinadns_local_dns _direct_dns_mode chinadns_ng_default_tag dnsmasq_filter_proxy_ipv6 remote_fakedns force_https_soa
+			unset _china_ng_listen _chinadns_local_dns _direct_dns_mode chinadns_ng_default_tag dnsmasq_filter_proxy_ipv6 remote_fakedns force_https_soa use_fakedns
 		done
 		unset socks_port redir_port dns_port dnsmasq_port chinadns_port
 	}
@@ -2058,8 +2045,8 @@ get_config() {
 	FILTER_PROXY_IPV6=$(config_t_get global filter_proxy_ipv6 0)
 	DNS_REDIRECT=$(config_t_get global dns_redirect 1)
 
-	REDIRECT_LIST="socks ss ss-rust ssr sing-box xray trojan-plus naiveproxy hysteria2"
-	TPROXY_LIST="socks ss ss-rust ssr sing-box xray trojan-plus hysteria2"
+	REDIRECT_LIST="socks ss ss-rust ssr sing-box xray naiveproxy hysteria2"
+	TPROXY_LIST="socks ss ss-rust ssr sing-box xray hysteria2"
 
 	NEXT_DNS_LISTEN_PORT=15353
 	TUN_DNS="127.0.0.1#${NEXT_DNS_LISTEN_PORT}"
diff --git a/luci-app-passwall/root/usr/share/passwall/iptables.sh b/luci-app-passwall/root/usr/share/passwall/iptables.sh
index 7100a691..560e3b52 100755
--- a/luci-app-passwall/root/usr/share/passwall/iptables.sh
+++ b/luci-app-passwall/root/usr/share/passwall/iptables.sh
@@ -227,6 +227,7 @@ load_acl() {
 			[ -n "$(get_cache_var "ACL_${sid}_udp_node")" ] && udp_node=$(get_cache_var "ACL_${sid}_udp_node")
 			[ -n "$(get_cache_var "ACL_${sid}_udp_redir_port")" ] && udp_port=$(get_cache_var "ACL_${sid}_udp_redir_port")
 			[ -n "$(get_cache_var "ACL_${sid}_dns_port")" ] && dns_redirect_port=$(get_cache_var "ACL_${sid}_dns_port")
+			[ -n "$(get_cache_var "ACL_${sid}_fakedns")" ] && use_fakedns=$(get_cache_var "ACL_${sid}_fakedns")
 			[ -n "$tcp_node" ] && {
 				if is_socks_wrap "$tcp_node"; then
 					tcp_node_remark="Socks 配置($(config_n_get ${tcp_node#Socks_} port) 端口)"
@@ -274,6 +275,7 @@ load_acl() {
 				gfw6_set_name=${IPSET_GFW6}
 				shunt_set_name=${IPSET_SHUNT}
 				shunt6_set_name=${IPSET_SHUNT6}
+				use_fakedns=${USE_FAKEDNS}
 			}
 
 			_acl_list=${TMP_ACL_PATH}/${sid}/source_list
@@ -411,14 +413,14 @@ load_acl() {
 
 					[ "$tcp_proxy_drop_ports" != "disable" ] && {
 						[ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
-							add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-d $FAKE_IP_6 -j DROP" 2>/dev/null
+							[ "${use_fakedns}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-d $FAKE_IP_6 -j DROP" 2>/dev/null
 							[ "${use_proxy_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $black6_set_name) -j DROP" 2>/dev/null
 							[ "${use_gfw_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $gfw6_set_name) -j DROP" 2>/dev/null
 							[ "${chn_list}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j DROP")" 2>/dev/null
 							[ "${use_shunt_tcp}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $shunt6_set_name) -j DROP" 2>/dev/null
 							[ "${tcp_proxy_mode}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-j DROP" 2>/dev/null
 						}
-						add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-d $FAKE_IP -j DROP"
+						[ "${use_fakedns}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-d $FAKE_IP -j DROP"
 						[ "${use_proxy_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $black_set_name) -j DROP"
 						[ "${use_gfw_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $gfw_set_name) -j DROP"
 						[ "${chn_list}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $IPSET_CHN) $(get_jump_ipt ${chn_list} "-j DROP")"
@@ -429,14 +431,14 @@ load_acl() {
 
 					[ "$udp_proxy_drop_ports" != "disable" ] && {
 						[ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
-							add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-d $FAKE_IP_6 -j DROP" 2>/dev/null
+							[ "${use_fakedns}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-d $FAKE_IP_6 -j DROP" 2>/dev/null
 							[ "${use_proxy_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $black6_set_name) -j DROP" 2>/dev/null
 							[ "${use_gfw_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $gfw6_set_name) -j DROP" 2>/dev/null
 							[ "${chn_list}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j DROP")" 2>/dev/null
 							[ "${use_shunt_udp}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $shunt6_set_name) -j DROP" 2>/dev/null
 							[ "${udp_proxy_mode}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-j DROP" 2>/dev/null
 						}
-						add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-d $FAKE_IP -j DROP"
+						[ "${use_fakedns}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-d $FAKE_IP -j DROP"
 						[ "${use_proxy_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $black_set_name) -j DROP"
 						[ "${use_gfw_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $gfw_set_name) -j DROP"
 						[ "${chn_list}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $IPSET_CHN) $(get_jump_ipt ${chn_list} "-j DROP")"
@@ -459,7 +461,7 @@ load_acl() {
 						fi
 						
 						[ "$accept_icmp" = "1" ] && {
-							$ipt_n -A PSW $(comment "$remarks") -p icmp ${_ipt_source} -d $FAKE_IP $(REDIRECT)
+							[ "${use_fakedns}" = "1" ] && $ipt_n -A PSW $(comment "$remarks") -p icmp ${_ipt_source} -d $FAKE_IP $(REDIRECT)
 							[ "${use_proxy_list}" = "1" ] && $ipt_n -A PSW $(comment "$remarks") -p icmp ${_ipt_source} $(dst $black_set_name) $(REDIRECT)
 							[ "${use_gfw_list}" = "1" ] && $ipt_n -A PSW $(comment "$remarks") -p icmp ${_ipt_source} $(dst $gfw_set_name) $(REDIRECT)
 							[ "${chn_list}" != "0" ] && $ipt_n -A PSW $(comment "$remarks") -p icmp ${_ipt_source} $(dst $IPSET_CHN) $(get_jump_ipt ${chn_list})
@@ -468,7 +470,7 @@ load_acl() {
 						}
 						
 						[ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
-							$ip6t_n -A PSW $(comment "$remarks") -p ipv6-icmp ${_ipt_source} -d $FAKE_IP_6 $(REDIRECT) 2>/dev/null
+							[ "${use_fakedns}" = "1" ] && $ip6t_n -A PSW $(comment "$remarks") -p ipv6-icmp ${_ipt_source} -d $FAKE_IP_6 $(REDIRECT) 2>/dev/null
 							[ "${use_proxy_list}" = "1" ] && $ip6t_n -A PSW $(comment "$remarks") -p ipv6-icmp ${_ipt_source} $(dst $black6_set_name) $(REDIRECT) 2>/dev/null
 							[ "${use_gfw_list}" = "1" ] && $ip6t_n -A PSW $(comment "$remarks") -p ipv6-icmp ${_ipt_source} $(dst $gfw6_set_name) $(REDIRECT) 2>/dev/null
 							[ "${chn_list}" != "0" ] && $ip6t_n -A PSW $(comment "$remarks") -p ipv6-icmp ${_ipt_source} $(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list}) 2>/dev/null
@@ -476,7 +478,7 @@ load_acl() {
 							[ "${tcp_proxy_mode}" != "disable" ] && $ip6t_n -A PSW $(comment "$remarks") -p ipv6-icmp ${_ipt_source} $(REDIRECT) 2>/dev/null
 						}
 
-						$ipt_tmp -A PSW $(comment "$remarks") -p tcp ${_ipt_source} -d $FAKE_IP ${ipt_j}
+						[ "${use_fakedns}" = "1" ] && $ipt_tmp -A PSW $(comment "$remarks") -p tcp ${_ipt_source} -d $FAKE_IP ${ipt_j}
 						[ "${use_proxy_list}" = "1" ] && add_port_rules "$ipt_tmp -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_redir_ports "$(dst $black_set_name) ${ipt_j}"
 						[ "${use_gfw_list}" = "1" ] && add_port_rules "$ipt_tmp -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_redir_ports "$(dst $gfw_set_name) ${ipt_j}"
 						[ "${chn_list}" != "0" ] && add_port_rules "$ipt_tmp -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_redir_ports "$(dst $IPSET_CHN) $(get_jump_ipt ${chn_list} "${ipt_j}")"
@@ -485,7 +487,7 @@ load_acl() {
 						[ -n "${is_tproxy}" ] && $ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source} $(REDIRECT $tcp_port TPROXY)
 
 						[ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
-							$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source} -d $FAKE_IP_6 -j PSW_RULE 2>/dev/null
+							[ "${use_fakedns}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source} -d $FAKE_IP_6 -j PSW_RULE 2>/dev/null
 							[ "${use_proxy_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_redir_ports "$(dst $black6_set_name) -j PSW_RULE" 2>/dev/null
 							[ "${use_gfw_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_redir_ports "$(dst $gfw6_set_name) -j PSW_RULE" 2>/dev/null
 							[ "${chn_list}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_redir_ports "$(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j PSW_RULE")" 2>/dev/null
@@ -507,7 +509,7 @@ load_acl() {
 						msg2="${msg}使用 UDP 节点[$udp_node_remark]"
 						msg2="${msg2}(TPROXY:${udp_port})"
 
-						$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source} -d $FAKE_IP -j PSW_RULE
+						[ "${use_fakedns}" = "1" ] && $ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source} -d $FAKE_IP -j PSW_RULE
 						[ "${use_proxy_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_redir_ports "$(dst $black_set_name) -j PSW_RULE"
 						[ "${use_gfw_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_redir_ports "$(dst $gfw_set_name) -j PSW_RULE"
 						[ "${chn_list}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_redir_ports "$(dst $IPSET_CHN) $(get_jump_ipt ${chn_list} "-j PSW_RULE")"
@@ -516,7 +518,7 @@ load_acl() {
 						$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source} $(REDIRECT $udp_port TPROXY)
 
 						[ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
-							$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source} -d $FAKE_IP_6 -j PSW_RULE 2>/dev/null
+							[ "${use_fakedns}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source} -d $FAKE_IP_6 -j PSW_RULE 2>/dev/null
 							[ "${use_proxy_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_redir_ports "$(dst $black6_set_name) -j PSW_RULE" 2>/dev/null
 							[ "${use_gfw_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_redir_ports "$(dst $gfw6_set_name) -j PSW_RULE" 2>/dev/null
 							[ "${chn_list}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_redir_ports "$(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j PSW_RULE")" 2>/dev/null
@@ -534,7 +536,7 @@ load_acl() {
 				unset ipt_tmp ipt_j _ipt_source msg msg2 _ipv4
 			done
 			unset enabled sid remarks sources use_global_config use_direct_list use_proxy_list use_block_list use_gfw_list chn_list tcp_proxy_mode udp_proxy_mode dns_redirect_port tcp_no_redir_ports udp_no_redir_ports tcp_proxy_drop_ports udp_proxy_drop_ports tcp_redir_ports udp_redir_ports tcp_node udp_node interface
-			unset tcp_port udp_port tcp_node_remark udp_node_remark _acl_list use_shunt_tcp use_shunt_udp dns_redirect
+			unset tcp_port udp_port tcp_node_remark udp_node_remark _acl_list use_shunt_tcp use_shunt_udp dns_redirect use_fakedns
 		done
 	}
 	
@@ -594,14 +596,14 @@ load_acl() {
 			
 			[ "$TCP_PROXY_DROP_PORTS" != "disable" ] && {
 				[ "$PROXY_IPV6" == "1" ] && {
-					add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP_6 -j DROP"
+					[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP_6 -j DROP"
 					[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK6) -j DROP"
 					[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW6) -j DROP"
 					[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
 					[ "${USE_SHUNT_TCP}" = "1" ] && $ip6t_m -A PSW $(comment "默认") -p tcp $TCP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT6) -j DROP"
 					[ "${TCP_PROXY_MODE}" != "disable" ] && $ip6t_m -A PSW $(comment "默认") -p tcp $TCP_PROXY_DROP_PORTS "-j DROP"
 				}
-				add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
+				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
 				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j DROP"
 				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j DROP"
 				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
@@ -612,14 +614,14 @@ load_acl() {
 			
 			[ "$UDP_PROXY_DROP_PORTS" != "disable" ] && {
 				[ "$PROXY_IPV6" == "1" ] && {
-					add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP_6 -j DROP"
+					[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP_6 -j DROP"
 					[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK6) -j DROP"
 					[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW6) -j DROP"
 					[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
 					[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT6) -j DROP"
 					[ "${UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-j DROP"
 				}
-				add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
+				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
 				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j DROP"
 				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j DROP"
 				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
@@ -646,7 +648,7 @@ load_acl() {
 				fi
 				
 				[ "$accept_icmp" = "1" ] && {
-					$ipt_n -A PSW $(comment "默认") -p icmp -d $FAKE_IP $(REDIRECT)
+					[ "${USE_FAKEDNS}" = "1" ] && $ipt_n -A PSW $(comment "默认") -p icmp -d $FAKE_IP $(REDIRECT)
 					[ "${USE_PROXY_LIST}" = "1" ] && $ipt_n -A PSW $(comment "默认") -p icmp $(dst $IPSET_BLACK) $(REDIRECT)
 					[ "${USE_GFW_LIST}" = "1" ] && $ipt_n -A PSW $(comment "默认") -p icmp $(dst $IPSET_GFW) $(REDIRECT)
 					[ "${CHN_LIST}" != "0" ] && $ipt_n -A PSW $(comment "默认") -p icmp $(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST})
@@ -655,7 +657,7 @@ load_acl() {
 				}
 				
 				[ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && {
-					$ip6t_n -A PSW $(comment "默认") -p ipv6-icmp -d $FAKE_IP_6 $(REDIRECT)
+					[ "${USE_FAKEDNS}" = "1" ] && $ip6t_n -A PSW $(comment "默认") -p ipv6-icmp -d $FAKE_IP_6 $(REDIRECT)
 					[ "${USE_PROXY_LIST}" = "1" ] && $ip6t_n -A PSW $(comment "默认") -p ipv6-icmp $(dst $IPSET_BLACK6) $(REDIRECT)
 					[ "${USE_GFW_LIST}" = "1" ] && $ip6t_n -A PSW $(comment "默认") -p ipv6-icmp $(dst $IPSET_GFW6) $(REDIRECT)
 					[ "${CHN_LIST}" != "0" ] && $ip6t_n -A PSW $(comment "默认") -p ipv6-icmp $(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST})
@@ -663,7 +665,7 @@ load_acl() {
 					[ "${TCP_PROXY_MODE}" != "disable" ] && $ip6t_n -A PSW $(comment "默认") -p ipv6-icmp $(REDIRECT)
 				}
 
-				$ipt_tmp -A PSW $(comment "默认") -p tcp -d $FAKE_IP ${ipt_j}
+				[ "${USE_FAKEDNS}" = "1" ] && $ipt_tmp -A PSW $(comment "默认") -p tcp -d $FAKE_IP ${ipt_j}
 				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_tmp -A PSW $(comment "默认") -p tcp" $TCP_REDIR_PORTS "$(dst $IPSET_BLACK) ${ipt_j}"
 				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_tmp -A PSW $(comment "默认") -p tcp" $TCP_REDIR_PORTS "$(dst $IPSET_GFW) ${ipt_j}"
 				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_tmp -A PSW $(comment "默认") -p tcp" $TCP_REDIR_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "${ipt_j}")"
@@ -672,7 +674,7 @@ load_acl() {
 				[ -n "${is_tproxy}" ]&& $ipt_tmp -A PSW $(comment "默认") -p tcp $(REDIRECT $TCP_REDIR_PORT TPROXY)
 
 				[ "$PROXY_IPV6" == "1" ] && {
-					$ip6t_m -A PSW $(comment "默认") -p tcp -d $FAKE_IP_6 -j PSW_RULE
+					[ "${USE_FAKEDNS}" = "1" ] && $ip6t_m -A PSW $(comment "默认") -p tcp -d $FAKE_IP_6 -j PSW_RULE
 					[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_REDIR_PORTS "$(dst $IPSET_BLACK6) -j PSW_RULE"
 					[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_REDIR_PORTS "$(dst $IPSET_GFW6) -j PSW_RULE"
 					[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_REDIR_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j PSW_RULE")"
@@ -697,7 +699,7 @@ load_acl() {
 					msg2="${msg}使用 UDP 节点[$(config_n_get $UDP_NODE remarks)](TPROXY:${UDP_REDIR_PORT})"
 				fi
 
-				$ipt_m -A PSW $(comment "默认") -p udp -d $FAKE_IP -j PSW_RULE
+				[ "${USE_FAKEDNS}" = "1" ] && $ipt_m -A PSW $(comment "默认") -p udp -d $FAKE_IP -j PSW_RULE
 				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_REDIR_PORTS "$(dst $IPSET_BLACK) -j PSW_RULE"
 				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_REDIR_PORTS "$(dst $IPSET_GFW) -j PSW_RULE"
 				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_REDIR_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j PSW_RULE")"
@@ -706,7 +708,7 @@ load_acl() {
 				$ipt_m -A PSW $(comment "默认") -p udp $(REDIRECT $UDP_REDIR_PORT TPROXY)
 
 				[ "$PROXY_IPV6" == "1" ] && {
-					$ip6t_m -A PSW $(comment "默认") -p udp -d $FAKE_IP_6 -j PSW_RULE
+					[ "${USE_FAKEDNS}" = "1" ] && $ip6t_m -A PSW $(comment "默认") -p udp -d $FAKE_IP_6 -j PSW_RULE
 					[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_REDIR_PORTS "$(dst $IPSET_BLACK6) -j PSW_RULE"
 					[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_REDIR_PORTS "$(dst $IPSET_GFW6) -j PSW_RULE"
 					[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_REDIR_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j PSW_RULE")"
@@ -1174,7 +1176,7 @@ add_firewall_rule() {
 
 		[ -n "${LOCALHOST_TCP_PROXY_MODE}" -o -n "${LOCALHOST_UDP_PROXY_MODE}" ] && {
 			[ "$TCP_PROXY_DROP_PORTS" != "disable" ] && {
-				add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
+				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
 				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j DROP"
 				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j DROP"
 				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
@@ -1184,7 +1186,7 @@ add_firewall_rule() {
 			}
 			
 			[ "$UDP_PROXY_DROP_PORTS" != "disable" ] && {
-				add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
+				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
 				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j DROP"
 				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j DROP"
 				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
@@ -1226,7 +1228,7 @@ add_firewall_rule() {
 
 			[ "$accept_icmp" = "1" ] && {
 				$ipt_n -A OUTPUT -p icmp -j PSW_OUTPUT
-				$ipt_n -A PSW_OUTPUT -p icmp -d $FAKE_IP $(REDIRECT)
+				[ "${USE_FAKEDNS}" = "1" ] && $ipt_n -A PSW_OUTPUT -p icmp -d $FAKE_IP $(REDIRECT)
 				[ "${USE_PROXY_LIST}" = "1" ] && $ipt_n -A PSW_OUTPUT -p icmp $(dst $IPSET_BLACK) $(REDIRECT)
 				[ "${USE_GFW_LIST}" = "1" ] && $ipt_n -A PSW_OUTPUT -p icmp $(dst $IPSET_GFW) $(REDIRECT)
 				[ "${CHN_LIST}" != "0" ] && $ipt_n -A PSW_OUTPUT -p icmp $(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST})
@@ -1236,7 +1238,7 @@ add_firewall_rule() {
 
 			[ "$accept_icmpv6" = "1" ] && {
 				$ip6t_n -A OUTPUT -p ipv6-icmp -j PSW_OUTPUT
-				$ip6t_n -A PSW_OUTPUT -p ipv6-icmp -d $FAKE_IP_6 $(REDIRECT)
+				[ "${USE_FAKEDNS}" = "1" ] && $ip6t_n -A PSW_OUTPUT -p ipv6-icmp -d $FAKE_IP_6 $(REDIRECT)
 				[ "${USE_PROXY_LIST}" = "1" ] && $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(dst $IPSET_BLACK6) $(REDIRECT)
 				[ "${USE_GFW_LIST}" = "1" ] && $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(dst $IPSET_GFW6) $(REDIRECT)
 				[ "${CHN_LIST}" != "0" ] && $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST})
@@ -1245,7 +1247,7 @@ add_firewall_rule() {
 			}
 
 			[ -n "${LOCALHOST_TCP_PROXY_MODE}" ] && {
-				$ipt_tmp -A PSW_OUTPUT -p tcp -d $FAKE_IP ${ipt_j}
+				[ "${USE_FAKEDNS}" = "1" ] && $ipt_tmp -A PSW_OUTPUT -p tcp -d $FAKE_IP ${ipt_j}
 				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_tmp -A PSW_OUTPUT -p tcp" $TCP_REDIR_PORTS "$(dst $IPSET_BLACK) ${ipt_j}"
 				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_tmp -A PSW_OUTPUT -p tcp" $TCP_REDIR_PORTS "$(dst $IPSET_GFW) ${ipt_j}"
 				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_tmp -A PSW_OUTPUT -p tcp" $TCP_REDIR_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "${ipt_j}")"
@@ -1261,7 +1263,7 @@ add_firewall_rule() {
 
 			[ "$PROXY_IPV6" == "1" ] && {
 				[ -n "${LOCALHOST_TCP_PROXY_MODE}" ] && {
-					$ip6t_m -A PSW_OUTPUT -p tcp -d $FAKE_IP_6 -j PSW_RULE
+					[ "${USE_FAKEDNS}" = "1" ] && $ip6t_m -A PSW_OUTPUT -p tcp -d $FAKE_IP_6 -j PSW_RULE
 					[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW_OUTPUT -p tcp" $TCP_REDIR_PORTS "$(dst $IPSET_BLACK6) -j PSW_RULE"
 					[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW_OUTPUT -p tcp" $TCP_REDIR_PORTS "$(dst $IPSET_GFW6) -j PSW_RULE"
 					[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW_OUTPUT -p tcp" $TCP_REDIR_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j PSW_RULE")"
@@ -1300,7 +1302,7 @@ add_firewall_rule() {
 			}
 			[ -n "${UDP_PROXY_DNS}" ] && hosts_foreach REMOTE_DNS _proxy_udp_access 53
 			[ -n "${LOCALHOST_UDP_PROXY_MODE}" ] && {
-				$ipt_m -A PSW_OUTPUT -p udp -d $FAKE_IP -j PSW_RULE
+				[ "${USE_FAKEDNS}" = "1" ] && $ipt_m -A PSW_OUTPUT -p udp -d $FAKE_IP -j PSW_RULE
 				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_REDIR_PORTS "$(dst $IPSET_BLACK) -j PSW_RULE"
 				[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_REDIR_PORTS "$(dst $IPSET_GFW) -j PSW_RULE"
 				[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_REDIR_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j PSW_RULE")"
@@ -1313,7 +1315,7 @@ add_firewall_rule() {
 
 			[ "$PROXY_IPV6" == "1" ] && {
 				[ -n "$LOCALHOST_UDP_PROXY_MODE" ] && {
-					$ip6t_m -A PSW_OUTPUT -p udp -d $FAKE_IP_6 -j PSW_RULE
+					[ "${USE_FAKEDNS}" = "1" ] && $ip6t_m -A PSW_OUTPUT -p udp -d $FAKE_IP_6 -j PSW_RULE
 					[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW_OUTPUT -p udp" $UDP_REDIR_PORTS "$(dst $IPSET_BLACK6) -j PSW_RULE"
 					[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW_OUTPUT -p udp" $UDP_REDIR_PORTS "$(dst $IPSET_GFW6) -j PSW_RULE"
 					[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW_OUTPUT -p udp" $UDP_REDIR_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j PSW_RULE")"
diff --git a/luci-app-passwall/root/usr/share/passwall/nftables.sh b/luci-app-passwall/root/usr/share/passwall/nftables.sh
index ac1b0a36..7b3dad37 100755
--- a/luci-app-passwall/root/usr/share/passwall/nftables.sh
+++ b/luci-app-passwall/root/usr/share/passwall/nftables.sh
@@ -268,6 +268,7 @@ load_acl() {
 			[ -n "$(get_cache_var "ACL_${sid}_udp_node")" ] && udp_node=$(get_cache_var "ACL_${sid}_udp_node")
 			[ -n "$(get_cache_var "ACL_${sid}_udp_redir_port")" ] && udp_port=$(get_cache_var "ACL_${sid}_udp_redir_port")
 			[ -n "$(get_cache_var "ACL_${sid}_dns_port")" ] && dns_redirect_port=$(get_cache_var "ACL_${sid}_dns_port")
+			[ -n "$(get_cache_var "ACL_${sid}_fakedns")" ] && use_fakedns=$(get_cache_var "ACL_${sid}_fakedns")
 			[ -n "$tcp_node" ] && {
 				if is_socks_wrap "$tcp_node"; then
 					tcp_node_remark="Socks 配置($(config_n_get ${tcp_node#Socks_} port) 端口)"
@@ -314,6 +315,7 @@ load_acl() {
 				gfw6_set_name=${NFTSET_GFW6}
 				shunt_set_name=${NFTSET_SHUNT}
 				shunt6_set_name=${NFTSET_SHUNT6}
+				use_fakedns=${USE_FAKEDNS}
 			}
 
 			_acl_list=${TMP_ACL_PATH}/${sid}/source_list
@@ -443,14 +445,14 @@ load_acl() {
 					
 					[ "$tcp_proxy_drop_ports" != "disable" ] && {
 						[ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
-							nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") ip6 daddr $FAKE_IP_6 counter drop comment \"$remarks\"" 2>/dev/null
+							[ "${use_fakedns}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") ip6 daddr $FAKE_IP_6 counter drop comment \"$remarks\"" 2>/dev/null
 							[ "${use_proxy_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") ip6 daddr @$black6_set_name counter drop comment \"$remarks\"" 2>/dev/null
 							[ "${use_gfw_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") ip6 daddr @$gfw6_set_name counter drop comment \"$remarks\"" 2>/dev/null
 							[ "${chn_list}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") ip6 daddr @$NFTSET_CHN6 $(get_jump_nft ${chn_list} "counter drop") comment \"$remarks\"" 2>/dev/null
 							[ "${use_shunt_tcp}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") ip6 daddr @$shunt6_set_name counter drop comment \"$remarks\"" 2>/dev/null
 							[ "${tcp_proxy_mode}" != "disable" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") counter drop comment \"$remarks\"" 2>/dev/null
 						}
-						nft "add rule $NFTABLE_NAME $nft_prerouting_chain ip protocol tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") ip daddr $FAKE_IP counter drop comment \"$remarks\""
+						[ "${use_fakedns}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_prerouting_chain ip protocol tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") ip daddr $FAKE_IP counter drop comment \"$remarks\""
 						[ "${use_proxy_list}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_prerouting_chain ip protocol tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") ip daddr @$black_set_name counter drop comment \"$remarks\""
 						[ "${use_gfw_list}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_prerouting_chain ip protocol tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") ip daddr @$gfw_set_name counter drop comment \"$remarks\""
 						[ "${chn_list}" != "0" ] && nft "add rule $NFTABLE_NAME $nft_prerouting_chain ip protocol tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") ip daddr @$NFTSET_CHN $(get_jump_nft ${chn_list} "counter drop") comment \"$remarks\""
@@ -461,14 +463,14 @@ load_acl() {
 					
 					[ "$udp_proxy_drop_ports" != "disable" ] && {
 						[ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
-							nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_proxy_drop_ports "udp dport") ip6 daddr $FAKE_IP_6 counter drop comment \"$remarks\"" 2>/dev/null
+							[ "${use_fakedns}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_proxy_drop_ports "udp dport") ip6 daddr $FAKE_IP_6 counter drop comment \"$remarks\"" 2>/dev/null
 							[ "${use_proxy_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_proxy_drop_ports "udp dport") ip6 daddr @$black6_set_name counter drop comment \"$remarks\"" 2>/dev/null
 							[ "${use_gfw_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_proxy_drop_ports "udp dport") ip6 daddr @$gfw6_set_name counter drop comment \"$remarks\"" 2>/dev/null
 							[ "${chn_list}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_proxy_drop_ports "udp dport") ip6 daddr @$NFTSET_CHN6 $(get_jump_nft ${chn_list} "counter drop") comment \"$remarks\"" 2>/dev/null
 							[ "${use_shunt_udp}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_proxy_drop_ports "udp dport") ip6 daddr @$shunt6_set_name counter drop comment \"$remarks\"" 2>/dev/null
 							[ "${udp_proxy_mode}" != "disable" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_proxy_drop_ports "udp dport") counter drop comment \"$remarks\"" 2>/dev/null
 						}
-						nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_proxy_drop_ports "udp dport") ip daddr $FAKE_IP counter drop comment \"$remarks\"" 2>/dev/null
+						[ "${use_fakedns}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_proxy_drop_ports "udp dport") ip daddr $FAKE_IP counter drop comment \"$remarks\"" 2>/dev/null
 						[ "${use_proxy_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_proxy_drop_ports "udp dport") ip daddr @$black_set_name counter drop comment \"$remarks\"" 2>/dev/null
 						[ "${use_gfw_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_proxy_drop_ports "udp dport") ip daddr @$gfw_set_name counter drop comment \"$remarks\"" 2>/dev/null
 						[ "${chn_list}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_proxy_drop_ports "udp dport") ip daddr @$NFTSET_CHN $(get_jump_nft ${chn_list} "counter drop") comment \"$remarks\"" 2>/dev/null
@@ -493,7 +495,7 @@ load_acl() {
 						
 						[ "$accept_icmp" = "1" ] && {
 							[ "${use_direct_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip protocol icmp ${_ipt_source} ip daddr @$NFTSET_WHITE counter return comment \"$remarks\""
-							nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip protocol icmp ${_ipt_source} ip daddr $FAKE_IP $(REDIRECT) comment \"$remarks\""
+							[ "${use_fakedns}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip protocol icmp ${_ipt_source} ip daddr $FAKE_IP $(REDIRECT) comment \"$remarks\""
 							[ "${use_proxy_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip protocol icmp ${_ipt_source} ip daddr @$black_set_name $(REDIRECT) comment \"$remarks\""
 							[ "${use_gfw_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip protocol icmp ${_ipt_source} ip daddr @$gfw_set_name $(REDIRECT) comment \"$remarks\""
 							[ "${chn_list}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip protocol icmp ${_ipt_source} ip daddr @$NFTSET_CHN $(get_jump_nft ${chn_list}) comment \"$remarks\""
@@ -504,7 +506,7 @@ load_acl() {
 
 						[ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
 							[ "${use_direct_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr @$NFTSET_WHITE6 counter return comment \"$remarks\"" 2>/dev/null
-							nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr $FAKE_IP_6 $(REDIRECT) comment \"$remarks\"" 2>/dev/null
+							[ "${use_fakedns}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr $FAKE_IP_6 $(REDIRECT) comment \"$remarks\"" 2>/dev/null
 							[ "${use_proxy_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr @$black6_set_name $(REDIRECT) comment \"$remarks\"" 2>/dev/null
 							[ "${use_gfw_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr @$gfw6_set_name $(REDIRECT) comment \"$remarks\"" 2>/dev/null
 							[ "${chn_list}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr @$NFTSET_CHN6 $(get_jump_nft ${chn_list}) comment \"$remarks\"" 2>/dev/null
@@ -513,7 +515,7 @@ load_acl() {
 							nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} return comment \"$remarks\"" 2>/dev/null
 						}
 
-						nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} ip daddr $FAKE_IP ${nft_j} comment \"$remarks\""
+						[ "${use_fakedns}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} ip daddr $FAKE_IP ${nft_j} comment \"$remarks\""
 						[ "${use_proxy_list}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ip daddr @$black_set_name ${nft_j} comment \"$remarks\" "
 						[ "${use_gfw_list}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ip daddr @$gfw_set_name ${nft_j} comment \"$remarks\" "
 						[ "${chn_list}" != "0" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ip daddr @$NFTSET_CHN $(get_jump_nft ${chn_list} "${nft_j}") comment \"$remarks\" "
@@ -522,7 +524,7 @@ load_acl() {
 						[ -n "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} $(REDIRECT $tcp_port TPROXY4) comment \"$remarks\""
 
 						[ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
-							nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} ip6 daddr $FAKE_IP_6 counter jump PSW_RULE comment \"$remarks\""
+							[ "${use_fakedns}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} ip6 daddr $FAKE_IP_6 counter jump PSW_RULE comment \"$remarks\""
 							[ "${use_proxy_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ip6 daddr @$black6_set_name counter jump PSW_RULE comment \"$remarks\"" 2>/dev/null
 							[ "${use_gfw_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ip6 daddr @$gfw6_set_name counter jump PSW_RULE comment \"$remarks\"" 2>/dev/null
 							[ "${chn_list}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ip6 daddr @$NFTSET_CHN6 $(get_jump_nft ${chn_list} "counter jump PSW_RULE") comment \"$remarks\" "
@@ -544,7 +546,7 @@ load_acl() {
 						msg2="${msg}使用 UDP 节点[$udp_node_remark]"
 						msg2="${msg2}(TPROXY:${udp_port})"
 
-						nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} ip daddr $FAKE_IP counter jump PSW_RULE comment \"$remarks\""
+						[ "${use_fakedns}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} ip daddr $FAKE_IP counter jump PSW_RULE comment \"$remarks\""
 						[ "${use_proxy_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip daddr @$black_set_name counter jump PSW_RULE comment \"$remarks\""
 						[ "${use_gfw_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip daddr @$gfw_set_name counter jump PSW_RULE comment \"$remarks\""
 						[ "${chn_list}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip daddr @$NFTSET_CHN $(get_jump_nft ${chn_list} "counter jump PSW_RULE") comment \"$remarks\""
@@ -553,7 +555,7 @@ load_acl() {
 						nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} $(REDIRECT $udp_port TPROXY4) comment \"$remarks\""
 
 						[ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
-							nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} ip6 daddr $FAKE_IP_6 counter jump PSW_RULE comment \"$remarks\""
+							[ "${use_fakedns}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} ip6 daddr $FAKE_IP_6 counter jump PSW_RULE comment \"$remarks\""
 							[ "${use_proxy_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip6 daddr @$black6_set_name counter jump PSW_RULE comment \"$remarks\"" 2>/dev/null
 							[ "${use_gfw_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip6 daddr @$gfw6_set_name counter jump PSW_RULE comment \"$remarks\"" 2>/dev/null
 							[ "${chn_list}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip6 daddr @$NFTSET_CHN6 $(get_jump_nft ${chn_list} "counter jump PSW_RULE") comment \"$remarks\"" 2>/dev/null
@@ -571,7 +573,7 @@ load_acl() {
 				unset nft_chain nft_j _ipt_source msg msg2 _ipv4
 			done
 			unset enabled sid remarks sources use_global_config use_direct_list use_proxy_list use_block_list use_gfw_list chn_list tcp_proxy_mode udp_proxy_mode dns_redirect_port tcp_no_redir_ports udp_no_redir_ports tcp_proxy_drop_ports udp_proxy_drop_ports tcp_redir_ports udp_redir_ports tcp_node udp_node interface
-			unset tcp_port udp_port tcp_node_remark udp_node_remark _acl_list use_shunt_tcp use_shunt_udp dns_redirect
+			unset tcp_port udp_port tcp_node_remark udp_node_remark _acl_list use_shunt_tcp use_shunt_udp dns_redirect use_fakedns
 		done
 	}
 
@@ -630,7 +632,7 @@ load_acl() {
 			
 			[ "$TCP_PROXY_DROP_PORTS" != "disable" ] && {
 				[ "$PROXY_IPV6" == "1" ] && {
-					nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") ip6 daddr $FAKE_IP_6 counter drop comment \"默认\""
+					[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") ip6 daddr $FAKE_IP_6 counter drop comment \"默认\""
 					[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") ip6 daddr @$NFTSET_BLACK6 counter drop comment \"默认\""
 					[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") ip6 daddr @$NFTSET_GFW6 counter drop comment \"默认\""
 					[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") ip6 daddr @$NFTSET_CHN6 $(get_jump_nft ${CHN_LIST} "counter drop") comment \"默认\""
@@ -638,7 +640,7 @@ load_acl() {
 					[ "${TCP_PROXY_MODE}" != "disable" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") counter drop comment \"默认\""
 				}
 
-				nft "add rule $NFTABLE_NAME $nft_prerouting_chain ip protocol tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") ip daddr $FAKE_IP counter drop comment \"默认\""
+				[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_prerouting_chain ip protocol tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") ip daddr $FAKE_IP counter drop comment \"默认\""
 				[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_prerouting_chain ip protocol tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") ip daddr @$NFTSET_BLACK counter drop comment \"默认\""
 				[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_prerouting_chain ip protocol tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") ip daddr @$NFTSET_GFW counter drop comment \"默认\""
 				[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME $nft_prerouting_chain ip protocol tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") ip daddr @$NFTSET_CHN $(get_jump_nft ${CHN_LIST} "counter drop") comment \"默认\""
@@ -649,14 +651,14 @@ load_acl() {
 			
 			[ "$UDP_PROXY_DROP_PORTS" != "disable" ] && {
 				[ "$PROXY_IPV6" == "1" ] && {
-					nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") ip6 daddr $FAKE_IP_6 counter drop comment \"默认\""
+					[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") ip6 daddr $FAKE_IP_6 counter drop comment \"默认\""
 					[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") ip6 daddr @$NFTSET_BLACK6 counter drop comment \"默认\""
 					[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") ip6 daddr @$NFTSET_GFW6 counter drop comment \"默认\""
 					[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") ip6 daddr @$NFTSET_CHN6 $(get_jump_nft ${CHN_LIST} "counter drop") comment \"默认\""
 					[ "${USE_SHUNT_UDP}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") ip6 daddr @$NFTSET_SHUNT6 counter drop comment \"默认\""
 					[ "${UDP_PROXY_MODE}" != "disable" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") counter drop comment \"默认\""
 				}
-				nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") ip daddr $FAKE_IP counter drop comment \"默认\""
+				[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") ip daddr $FAKE_IP counter drop comment \"默认\""
 				[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") ip daddr @$NFTSET_BLACK counter drop comment \"默认\""
 				[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") ip daddr @$NFTSET_GFW counter drop comment \"默认\""
 				[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") ip daddr @$NFTSET_CHN $(get_jump_nft ${CHN_LIST} "counter drop") comment \"默认\""
@@ -686,7 +688,7 @@ load_acl() {
 				
 				[ "$accept_icmp" = "1" ] && {
 					[ "${USE_DIRECT_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip daddr @$NFTSET_WHITE counter return comment \"默认\""
-					nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip protocol icmp ip daddr $FAKE_IP $(REDIRECT) comment \"默认\""
+					[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip protocol icmp ip daddr $FAKE_IP $(REDIRECT) comment \"默认\""
 					[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip protocol icmp ip daddr @$NFTSET_BLACK $(REDIRECT) comment \"默认\""
 					[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip protocol icmp ip daddr @$NFTSET_GFW $(REDIRECT) comment \"默认\""
 					[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip protocol icmp ip daddr @$NFTSET_CHN $(get_jump_nft ${CHN_LIST}) comment \"默认\""
@@ -697,7 +699,7 @@ load_acl() {
 
 				[ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && {
 					[ "${USE_DIRECT_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT ip6 daddr @$NFTSET_WHITE6 counter return comment \"默认\""
-					nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr $FAKE_IP_6 $(REDIRECT) comment \"默认\""
+					[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr $FAKE_IP_6 $(REDIRECT) comment \"默认\""
 					[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr @$NFTSET_BLACK6 $(REDIRECT) comment \"默认\""
 					[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr @$NFTSET_GFW6 $(REDIRECT) comment \"默认\""
 					[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr @$NFTSET_CHN6 $(get_jump_nft ${CHN_LIST}) comment \"默认\""
@@ -706,7 +708,7 @@ load_acl() {
 					nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT meta l4proto icmpv6 return comment \"默认\""
 				}
 
-				nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr $FAKE_IP ${nft_j} comment \"默认\""
+				[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr $FAKE_IP ${nft_j} comment \"默认\""
 				[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip daddr @$NFTSET_BLACK ${nft_j} comment \"默认\""
 				[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip daddr @$NFTSET_GFW ${nft_j} comment \"默认\""
 				[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip daddr @$NFTSET_CHN $(get_jump_nft ${CHN_LIST} "${nft_j}") comment \"默认\""
@@ -716,7 +718,7 @@ load_acl() {
 				nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp counter return comment \"默认\""
 
 				[ "$PROXY_IPV6" == "1" ] && {
-					nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ip6 daddr $FAKE_IP_6 counter jump PSW_RULE comment \"默认\""
+					[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ip6 daddr $FAKE_IP_6 counter jump PSW_RULE comment \"默认\""
 					[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip6 daddr @$NFTSET_BLACK6 counter jump PSW_RULE comment \"默认\""
 					[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip6 daddr @$NFTSET_GFW6 counter jump PSW_RULE comment \"默认\""
 					[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip6 daddr @$NFTSET_CHN6 $(get_jump_nft ${CHN_LIST} "counter jump PSW_RULE") comment \"默认\""
@@ -739,7 +741,7 @@ load_acl() {
 					msg2="${msg}使用 UDP 节点[$(config_n_get $UDP_NODE remarks)](TPROXY:${UDP_REDIR_PORT})"
 				fi
 
-				nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW_RULE comment \"默认\""
+				[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW_RULE comment \"默认\""
 				[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") ip daddr @$NFTSET_BLACK counter jump PSW_RULE comment \"默认\""
 				[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") ip daddr @$NFTSET_GFW counter jump PSW_RULE comment \"默认\""
 				[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") ip daddr @$NFTSET_CHN $(get_jump_nft ${CHN_LIST} "counter jump PSW_RULE") comment \"默认\""
@@ -749,7 +751,7 @@ load_acl() {
 				nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp counter return comment \"默认\""
 
 				[ "$PROXY_IPV6" == "1" ] && {
-					nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ip6 daddr $FAKE_IP_6 counter jump PSW_RULE comment \"默认\""
+					[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ip6 daddr $FAKE_IP_6 counter jump PSW_RULE comment \"默认\""
 					[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") ip6 daddr @$NFTSET_BLACK6 counter jump PSW_RULE comment \"默认\""
 					[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") ip6 daddr @$NFTSET_GFW6 counter jump PSW_RULE comment \"默认\""
 					[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") ip6 daddr @$NFTSET_CHN6 $(get_jump_nft ${CHN_LIST} "counter jump PSW_RULE") comment \"默认\""
@@ -1235,7 +1237,7 @@ add_firewall_rule() {
 
 		[ -n "${LOCALHOST_TCP_PROXY_MODE}" -o -n "${LOCALHOST_UDP_PROXY_MODE}" ] && {
 			[ "$TCP_PROXY_DROP_PORTS" != "disable" ] && {
-				nft add rule $NFTABLE_NAME $nft_output_chain ip protocol tcp ip daddr $FAKE_IP $(factor $TCP_PROXY_DROP_PORTS "tcp dport") counter drop
+				[ "${USE_FAKEDNS}" = "1" ] && nft add rule $NFTABLE_NAME $nft_output_chain ip protocol tcp ip daddr $FAKE_IP $(factor $TCP_PROXY_DROP_PORTS "tcp dport") counter drop
 				[ "${USE_PROXY_LIST}" = "1" ] && nft add rule $NFTABLE_NAME $nft_output_chain ip protocol tcp ip daddr @$NFTSET_BLACK $(factor $TCP_PROXY_DROP_PORTS "tcp dport") counter drop
 				[ "${USE_GFW_LIST}" = "1" ] && nft add rule $NFTABLE_NAME $nft_output_chain ip protocol tcp ip daddr @$NFTSET_GFW $(factor $TCP_PROXY_DROP_PORTS "tcp dport") counter drop
 				[ "${CHN_LIST}" != "0" ] && nft add rule $NFTABLE_NAME $nft_output_chain ip protocol tcp ip daddr @$NFTSET_CHN $(factor $TCP_PROXY_DROP_PORTS "tcp dport") $(get_jump_nft ${CHN_LIST} "counter drop")
@@ -1245,7 +1247,7 @@ add_firewall_rule() {
 			}
 			
 			[ "$UDP_PROXY_DROP_PORTS" != "disable" ] && {
-				nft add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr $FAKE_IP $(factor $UDP_PROXY_DROP_PORTS "udp dport") counter drop
+				[ "${USE_FAKEDNS}" = "1" ] && nft add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr $FAKE_IP $(factor $UDP_PROXY_DROP_PORTS "udp dport") counter drop
 				[ "${USE_PROXY_LIST}" = "1" ] && nft add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr @$NFTSET_BLACK $(factor $UDP_PROXY_DROP_PORTS "udp dport") counter drop
 				[ "${USE_GFW_LIST}" = "1" ] && nft add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr @$NFTSET_GFW $(factor $UDP_PROXY_DROP_PORTS "udp dport") counter drop
 				[ "${CHN_LIST}" != "0" ] && nft add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr @$NFTSET_CHN $(factor $UDP_PROXY_DROP_PORTS "udp dport") $(get_jump_nft ${CHN_LIST} "counter drop")
@@ -1286,7 +1288,7 @@ add_firewall_rule() {
 			[ "$TCP_PROXY_DNS" == 1 ] && hosts_foreach REMOTE_DNS _proxy_tcp_access 53
 
 			[ "$accept_icmp" = "1" ] && {
-				nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr $FAKE_IP counter redirect"
+				[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr $FAKE_IP counter redirect"
 				[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_BLACK counter redirect"
 				[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_GFW counter redirect"
 				[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_CHN $(get_jump_nft ${CHN_LIST})"
@@ -1296,7 +1298,7 @@ add_firewall_rule() {
 			}
 
 			[ "$accept_icmpv6" = "1" ] && {
-				nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr $FAKE_IP_6 counter redirect"
+				[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr $FAKE_IP_6 counter redirect"
 				[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_BLACK6 counter redirect"
 				[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_GFW6 counter redirect"
 				[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_CHN6 $(get_jump_nft ${CHN_LIST})"
@@ -1314,7 +1316,7 @@ add_firewall_rule() {
 			fi
 
 			[ -n "${LOCALHOST_TCP_PROXY_MODE}" ] && {
-				nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr $FAKE_IP ${nft_j}"
+				[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr $FAKE_IP ${nft_j}"
 				[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr @$NFTSET_BLACK $(factor $TCP_REDIR_PORTS "tcp dport") ${nft_j}"
 				[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr @$NFTSET_GFW $(factor $TCP_REDIR_PORTS "tcp dport") ${nft_j}"
 				[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr @$NFTSET_CHN $(factor $TCP_REDIR_PORTS "tcp dport") $(get_jump_nft ${CHN_LIST} "${nft_j}")"
@@ -1328,7 +1330,7 @@ add_firewall_rule() {
 
 			[ "$PROXY_IPV6" == "1" ] && {
 				[ -n "${LOCALHOST_TCP_PROXY_MODE}" ] && {
-					nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto tcp ip6 daddr $FAKE_IP_6 counter jump PSW_RULE"
+					[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto tcp ip6 daddr $FAKE_IP_6 counter jump PSW_RULE"
 					[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto tcp ip6 daddr @$NFTSET_BLACK6 $(factor $TCP_REDIR_PORTS "tcp dport") counter jump PSW_RULE"
 					[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto tcp ip6 daddr @$NFTSET_GFW6 $(factor $TCP_REDIR_PORTS "tcp dport") counter jump PSW_RULE"
 					[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto tcp ip6 daddr @$NFTSET_CHN6 $(factor $TCP_REDIR_PORTS "tcp dport") $(get_jump_nft ${CHN_LIST} "counter jump PSW_RULE")"
@@ -1366,7 +1368,7 @@ add_firewall_rule() {
 			}
 			[ -n "${UDP_PROXY_DNS}" ] && hosts_foreach REMOTE_DNS _proxy_udp_access 53
 			[ -n "${LOCALHOST_UDP_PROXY_MODE}" ] && {
-				nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW_RULE"
+				[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW_RULE"
 				[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr @$NFTSET_BLACK $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW_RULE"
 				[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr @$NFTSET_GFW $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW_RULE"
 				[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr @$NFTSET_CHN $(factor $UDP_REDIR_PORTS "udp dport") $(get_jump_nft ${CHN_LIST} "counter jump PSW_RULE")"
@@ -1379,7 +1381,7 @@ add_firewall_rule() {
 
 			[ "$PROXY_IPV6" == "1" ] && {
 				[ -n "${LOCALHOST_UDP_PROXY_MODE}" ] && {
-					nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr $FAKE_IP_6 counter jump PSW_RULE"
+					[ "${USE_FAKEDNS}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr $FAKE_IP_6 counter jump PSW_RULE"
 					[ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr @$NFTSET_BLACK6 $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW_RULE"
 					[ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr @$NFTSET_GFW6 $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW_RULE"
 					[ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr @$NFTSET_CHN6 $(factor $UDP_REDIR_PORTS "udp dport") $(get_jump_nft ${CHN_LIST} "counter jump PSW_RULE")"
diff --git a/luci-app-passwall/root/usr/share/passwall/subscribe.lua b/luci-app-passwall/root/usr/share/passwall/subscribe.lua
index e8b4c74d..bf5a2252 100755
--- a/luci-app-passwall/root/usr/share/passwall/subscribe.lua
+++ b/luci-app-passwall/root/usr/share/passwall/subscribe.lua
@@ -27,7 +27,6 @@ local fs = api.fs
 local has_ss = api.is_finded("ss-redir")
 local has_ss_rust = api.is_finded("sslocal")
 local has_ssr = api.is_finded("ssr-local") and api.is_finded("ssr-redir")
-local has_trojan_plus = api.is_finded("trojan-plus")
 local has_singbox = api.finded_com("sing-box")
 local has_xray = api.finded_com("xray")
 local has_hysteria2 = api.finded_com("hysteria")
@@ -37,7 +36,7 @@ local DEFAULT_FILTER_KEYWORD_DISCARD_LIST = uci:get(appname, "@global_subscribe[
 local DEFAULT_FILTER_KEYWORD_KEEP_LIST = uci:get(appname, "@global_subscribe[0]", "filter_keep_list") or {}
 -- 取节点使用core类型（节点订阅页面未设置时，自动取默认）
 local DEFAULT_SS_TYPE = api.get_core("ss_type", {{has_ss,"shadowsocks-libev"},{has_ss_rust,"shadowsocks-rust"},{has_singbox,"sing-box"},{has_xray,"xray"}})
-local DEFAULT_TROJAN_TYPE =  api.get_core("trojan_type", {{has_trojan_plus,"trojan-plus"},{has_singbox,"sing-box"},{has_xray,"xray"}})
+local DEFAULT_TROJAN_TYPE =  api.get_core("trojan_type", {{has_singbox,"sing-box"},{has_xray,"xray"}})
 local DEFAULT_VMESS_TYPE = api.get_core("vmess_type", {{has_xray,"xray"},{has_singbox,"sing-box"}})
 local DEFAULT_VLESS_TYPE = api.get_core("vless_type", {{has_xray,"xray"},{has_singbox,"sing-box"}})
 local DEFAULT_HYSTERIA2_TYPE = api.get_core("hysteria2_type", {{has_hysteria2,"hysteria2"},{has_singbox,"sing-box"},{has_xray,"xray"}})
@@ -46,7 +45,6 @@ local core_has = {
 	["sing-box"] = has_singbox,
 	["shadowsocks-libev"] = has_ss,
 	["shadowsocks-rust"] = has_ss_rust,
-	["trojan-plus"] = has_trojan_plus,
 	["hysteria2"] = has_hysteria2
 }
 -- 判断是否过滤节点关键字
@@ -1008,9 +1006,7 @@ local function processData(szType, content, add_mode, group, sub_cfg)
 			end
 		end
 	elseif szType == "trojan" then
-		if sub_trojan_type == "trojan-plus" and has_trojan_plus then
-			result.type = "Trojan-Plus"
-		elseif sub_trojan_type == "sing-box" and has_singbox then
+		if sub_trojan_type == "sing-box" and has_singbox then
 			result.type = 'sing-box'
 			result.protocol = 'trojan'
 		elseif sub_trojan_type == "xray" and has_xray then
diff --git a/luci-app-qbittorrent/Makefile b/luci-app-qbittorrent/Makefile
index ba9e03d4..5df831bf 100644
--- a/luci-app-qbittorrent/Makefile
+++ b/luci-app-qbittorrent/Makefile
@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 LUCI_TITLE:=LuCI app for qBittorrent
-LUCI_DEPENDS:=+qbittorrent-enhanced-edition
+LUCI_DEPENDS:=+qbittorrent
 LUCI_PKGARCH:=all
 
 include $(TOPDIR)/feeds/luci/luci.mk
diff --git a/luci-app-turboacc/htdocs/luci-static/resources/view/turboacc.js b/luci-app-turboacc/htdocs/luci-static/resources/view/turboacc.js
index b59f8815..4038d13d 100644
--- a/luci-app-turboacc/htdocs/luci-static/resources/view/turboacc.js
+++ b/luci-app-turboacc/htdocs/luci-static/resources/view/turboacc.js
@@ -182,7 +182,8 @@ return view.extend({
 
 		if (features.hasMTKWEDWO) {
 			o = s.option(form.Flag, 'fastpath_mh_eth_hnat_wed', _('MTK WED WO offloading'),
-				_('Requires hardware support, implemented at least for Filogic 8x0'));
+				_('Requires hardware support, implemented at least for Filogic 8x0') + ' ' +
+				_('Takes effect after rebooting the router.'));
 			o.default = o.disabled;
 			o.rmempty = false;
 			o.depends({ 'fastpath': 'flow_offloading', 'fastpath_fo_hw': '1' });
diff --git a/luci-app-turboacc/po/zh_Hans/turboacc.po b/luci-app-turboacc/po/zh_Hans/turboacc.po
index 9fafa21a..f63a28f5 100644
--- a/luci-app-turboacc/po/zh_Hans/turboacc.po
+++ b/luci-app-turboacc/po/zh_Hans/turboacc.po
@@ -135,6 +135,9 @@ msgstr "需要硬件 NAT 支持。目前 mt762x/mt798x 已实现。"
 msgid "Requires hardware support, implemented at least for Filogic 8x0"
 msgstr "需要硬件支持，目前 Filogic 8x0 已实现"
 
+msgid "Takes effect after rebooting the router."
+msgstr "重启路由器后生效。"
+
 #: applications/luci-app-turboacc/htdocs/luci-static/resources/view/turboacc.js:126
 msgid "SFE connection manager"
 msgstr "SFE connection manager"
diff --git a/luci-app-turboacc/root/etc/init.d/turboacc b/luci-app-turboacc/root/etc/init.d/turboacc
index 73c8fecf..bdaf0b14 100755
--- a/luci-app-turboacc/root/etc/init.d/turboacc
+++ b/luci-app-turboacc/root/etc/init.d/turboacc
@@ -21,19 +21,12 @@ start_service() {
 	local kernel_version
 	kernel_version="$(uname -r)"
 
-	find_wed_module() {
+	find_wed_param() {
 		local mod
 
 		for mod in $MTK_WED_MODULES; do
-			lsmod | grep -q "^$mod " && {
-				echo "$mod"
-				return 0
-			}
-		done
-
-		for mod in $MTK_WED_MODULES; do
-			[ -e "/lib/modules/$kernel_version/$mod.ko" ] && {
-				echo "$mod"
+			[ -e "/sys/module/$mod/parameters/wed_enable" ] && {
+				echo "/sys/module/$mod/parameters/wed_enable"
 				return 0
 			}
 		done
@@ -41,58 +34,42 @@ start_service() {
 		return 1
 	}
 
-	find_loaded_wed_module() {
-		local mod
+	get_wed_param_value() {
+		local param_path="$1"
 
-		for mod in $MTK_WED_MODULES; do
-			lsmod | grep -q "^$mod " && {
-				echo "$mod"
-				return 0
-			}
-		done
+		[ -n "$param_path" ] || return 1
+		[ -r "$param_path" ] || return 1
 
-		return 1
+		cat "$param_path" 2>/dev/null
 	}
 
-	is_wed_wo_enabled() {
-		local mod="$1"
-		local value
+	set_wed_wo() {
+		local target_value="$1"
+		local param_path
+		local current_value
 
-		[ -n "$mod" ] || return 1
-		[ -r "/sys/module/$mod/parameters/wed_enable" ] || return 1
+		param_path="$(find_wed_param)" || return 0
+		current_value="$(get_wed_param_value "$param_path")" || return 0
+		[ -w "$param_path" ] || return 0
 
-		value="$(cat "/sys/module/$mod/parameters/wed_enable" 2>/dev/null)"
+		case "$target_value" in
+		Y)
+			[ "$current_value" = "Y" ] || [ "$current_value" = "1" ] && return 0
+			;;
+		N)
+			[ "$current_value" = "N" ] || [ "$current_value" = "0" ] && return 0
+			;;
+		esac
 
-		[ "$value" = "Y" ] || [ "$value" = "1" ]
+		echo "$target_value" > "$param_path" 2>/dev/null || true
 	}
 
 	load_wed_wo() {
-		local mod
-		local loaded_mod
-
-		mod="$(find_wed_module)" || return 0
-		loaded_mod="$(find_loaded_wed_module)" || true
-
-		[ "$loaded_mod" = "$mod" ] && is_wed_wo_enabled "$mod" && return 0
-
-		wifi down >/dev/null 2>&1
-		rmmod "$mod" 2>/dev/null
-		sleep 1
-		modprobe "$mod" wed_enable=Y 2>/dev/null || modprobe "$mod" 2>/dev/null
-		wifi up >/dev/null 2>&1
+		set_wed_wo "Y"
 	}
 
 	unload_wed_wo() {
-		local mod
-
-		mod="$(find_loaded_wed_module)" || return 0
-		is_wed_wo_enabled "$mod" || return 0
-
-		wifi down >/dev/null 2>&1
-		rmmod "$mod" 2>/dev/null
-		sleep 1
-		modprobe "$mod" 2>/dev/null
-		wifi up >/dev/null 2>&1
+		set_wed_wo "N"
 	}
 
 	if [ "$fastpath" != "fast_classifier" ] && lsmod | grep -q "fast_classifier"; then
diff --git a/luci-base/root/usr/share/rpcd/ucode/luci b/luci-base/root/usr/share/rpcd/ucode/luci
index 7abe93bd..a5611072 100644
--- a/luci-base/root/usr/share/rpcd/ucode/luci
+++ b/luci-base/root/usr/share/rpcd/ucode/luci
@@ -18,6 +18,11 @@ function shellquote(s) {
 	return `'${replace(s, "'", "'\\''")}'`;
 }
 
+function has_supported_hw_offloading_target(target) {
+	return type(target) == 'string' &&
+		match(target, /^(ramips\/mt7621|mediatek\/mt76..|mediatek\/filogic)$/) != null;
+}
+
 function callPackageVersionCheck(pkg) {
 	let version = "";
 
@@ -223,14 +228,27 @@ const methods = {
 
 	getFeatures: {
 		call: function() {
-			let kernel_version = popen('echo -n `uname -r`').read('all');
+			const kernel_version = popen('echo -n `uname -r`').read('all');
+			const has_fw3 = access('/sbin/fw3') == true;
+			const has_fw4 = access('/sbin/fw4') == true;
+			const has_ipt_flowoffload = access('/sys/module/xt_FLOWOFFLOAD/refcnt') == true;
+			const has_nft_flowoffload = access('/sys/module/nft_flow_offload/refcnt') == true;
+			const ubus = connect();
+			const sysboard = ubus ? ubus.call('system', 'board') : null;
+			const has_hw_offloading = has_supported_hw_offloading_target(sysboard?.release?.target) &&
+				((has_fw3 && has_ipt_flowoffload) || (has_fw4 && has_nft_flowoffload));
+
+			if (ubus)
+				ubus.disconnect();
+
 			let result = {
-				firewall:   access('/sbin/fw3') == true,
-				firewall4:  access('/sbin/fw4') == true,
+				firewall:   has_fw3,
+				firewall4:  has_fw4,
 				opkg:       access('/bin/opkg') == true,
 				bonding:    access('/sys/module/bonding'),
 				mii_tool:   access('/usr/sbin/mii-tool'),
-				offloading: access('/sys/module/xt_FLOWOFFLOAD/refcnt') == true || access('/sys/module/nft_flow_offload/refcnt') == true,
+				offloading: (has_fw3 && has_ipt_flowoffload) || (has_fw4 && has_nft_flowoffload),
+				offloading_hw: has_hw_offloading,
 				fullcone:   access(`/lib/modules/${kernel_version}/xt_FULLCONENAT.ko`) == true || access(`/lib/modules/${kernel_version}/nft_fullcone.ko`) == true,
 				br2684ctl:  access('/usr/sbin/br2684ctl') == true,
 				swconfig:   access('/sbin/swconfig') == true,
diff --git a/naiveproxy/Makefile b/naiveproxy/Makefile
index 8c92c3ac..63a5c6d3 100644
--- a/naiveproxy/Makefile
+++ b/naiveproxy/Makefile
@@ -1,8 +1,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=naiveproxy
-PKG_VERSION:=147.0.7727.49
-PKG_RELEASE:=1
+PKG_VERSION:=148.0.7778.96
+PKG_RELEASE:=2
 
 ARCH_PREBUILT:=$(ARCH_PACKAGES)
 
diff --git a/qBittorrent-Enhanced-Edition/Makefile b/qBittorrent-Enhanced-Edition/Makefile
index 608e97a9..3c8d4e34 100644
--- a/qBittorrent-Enhanced-Edition/Makefile
+++ b/qBittorrent-Enhanced-Edition/Makefile
@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=qBittorrent-Enhanced-Edition
 PKG_VERSION:=5.1.3.10
-PKG_RELEASE:=4
+PKG_RELEASE:=5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/c0re100/qBittorrent-Enhanced-Edition/tar.gz/release-$(PKG_VERSION)?
@@ -27,7 +27,8 @@ define Package/qbittorrent-enhanced-edition
   URL:=https://github.com/c0re100/qBittorrent-Enhanced-Edition
   DEPENDS:=+libtorrent-rasterbar +libQt6Core +libQt6Network +libQt6Sql \
     +libQt6Xml +qt6-plugin-libqopensslbackend +qt6-plugin-libqsqlite
-  PROVIDES:=@qbittorrent
+  PROVIDES:=qbittorrent
+  CONFLICTS:=qbittorrent
 endef
 
 define Package/qbittorrent-enhanced-edition/description
diff --git a/qt6base/Makefile b/qt6base/Makefile
index 789b8b9c..5dc36338 100644
--- a/qt6base/Makefile
+++ b/qt6base/Makefile
@@ -9,9 +9,9 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=qt6base
 PKG_BASE:=6.9
-PKG_BUGFIX:=1
+PKG_BUGFIX:=3
 PKG_VERSION:=$(PKG_BASE).$(PKG_BUGFIX)
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=qtbase-everywhere-src-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://mirrors.tencent.com/qt/archive/qt/$(PKG_BASE)/$(PKG_VERSION)/submodules/ \
diff --git a/qt6base/patches/020-fix-build-without-cssparser.patch b/qt6base/patches/020-fix-build-without-cssparser.patch
new file mode 100644
index 00000000..c6e61e80
--- /dev/null
+++ b/qt6base/patches/020-fix-build-without-cssparser.patch
@@ -0,0 +1,28 @@
+--- a/src/widgets/widgets/qcommandlinkbutton.cpp
++++ b/src/widgets/widgets/qcommandlinkbutton.cpp
+@@ -11,7 +11,9 @@
+ #include <qmath.h>
+ 
+ #include "private/qpushbutton_p.h"
++#if QT_CONFIG(style_stylesheet)
+ #include "private/qstylesheetstyle_p.h"
++#endif
+ 
+ QT_BEGIN_NAMESPACE
+ 
+@@ -285,11 +287,15 @@ bool QCommandLinkButton::event(QEvent *e
+         // - or it has been set in the style sheet, in which case we don't want to override it here.
+         // When a style sheet with an icon is replaced by one without an icon, the old icon
+         // will be reset, when baseStyle()->repolish() is called.
++#if QT_CONFIG(style_stylesheet)
+         if (!qobject_cast<QStyleSheetStyle *>(style())) {
++#endif
+             QStyleOptionButton opt;
+             initStyleOption(&opt);
+             setIcon(style()->standardIcon(QStyle::SP_CommandLink, &opt, this));
++#if QT_CONFIG(style_stylesheet)
+         }
++#endif
+     }
+ 
+     return QPushButton::event(e);
diff --git a/qt6tools/Makefile b/qt6tools/Makefile
index 2f4253e6..021c898f 100644
--- a/qt6tools/Makefile
+++ b/qt6tools/Makefile
@@ -9,9 +9,9 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=qt6tools
 PKG_BASE:=6.9
-PKG_BUGFIX:=1
+PKG_BUGFIX:=3
 PKG_VERSION:=$(PKG_BASE).$(PKG_BUGFIX)
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=qttools-everywhere-src-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://mirrors.tencent.com/qt/archive/qt/$(PKG_BASE)/$(PKG_VERSION)/submodules/ \
diff --git a/qt6tools/patches/010-no-clang.patch b/qt6tools/patches/010-no-clang.patch
index 85fac0b0..073d9e52 100644
--- a/qt6tools/patches/010-no-clang.patch
+++ b/qt6tools/patches/010-no-clang.patch
@@ -1,6 +1,6 @@
 --- a/configure.cmake
 +++ b/configure.cmake
-@@ -3,7 +3,7 @@
+@@ -6,7 +6,7 @@ include(${CMAKE_CURRENT_LIST_DIR}/src/qd
  
  #### Tests