diff --git a/luci-app-dnsproxy/htdocs/luci-static/resources/view/dnsproxy.js b/luci-app-dnsproxy/htdocs/luci-static/resources/view/dnsproxy.js
index c9e95772..e936b3af 100644
--- a/luci-app-dnsproxy/htdocs/luci-static/resources/view/dnsproxy.js
+++ b/luci-app-dnsproxy/htdocs/luci-static/resources/view/dnsproxy.js
@@ -385,9 +385,11 @@ return view.extend({
 		so.validate = validateServerValue;
 		so.modalonly = true;
 
-		so = ss.option(form.DynamicList, 'upstream', _('Upstream DNS'));
+		so = ss.option(form.DynamicList, 'upstream', _('Upstream DNS'),
+			_('Allows the use of a specified upstream for specific domain. <a href="%s" target="_blank">Syntax reference</a>.')
+			.format('https://github.com/AdguardTeam/dnsproxy#specifying-upstreams-for-domains'));
 		so.rmempty = false;
-		so.validate = validateServerValue;
+		//so.validate = validateServerValue; // See #11
 		so.modalonly = true;
 
 		so = ss.option(form.DynamicList, 'fallback', _('Fallback DNS'));
diff --git a/luci-app-dnsproxy/po/templates/dnsproxy.pot b/luci-app-dnsproxy/po/templates/dnsproxy.pot
index 3ab591ca..83876b2a 100644
--- a/luci-app-dnsproxy/po/templates/dnsproxy.pot
+++ b/luci-app-dnsproxy/po/templates/dnsproxy.pot
@@ -11,6 +11,12 @@ msgstr ""
 msgid "Add DNS profile"
 msgstr ""
 
+#: htdocs/luci-static/resources/view/dnsproxy.js:389
+msgid ""
+"Allows the use of a specified upstream for specific domain. <a href=\"%s\" "
+"target=\"_blank\">Syntax reference</a>."
+msgstr ""
+
 #: htdocs/luci-static/resources/view/dnsproxy.js:285
 msgid "Bogus-NXDOMAIN"
 msgstr ""
@@ -122,7 +128,7 @@ msgstr ""
 msgid "Failed to apply DNS profile: %s"
 msgstr ""
 
-#: htdocs/luci-static/resources/view/dnsproxy.js:393
+#: htdocs/luci-static/resources/view/dnsproxy.js:395
 msgid "Fallback DNS"
 msgstr ""
 
diff --git a/luci-app-passwall/luasrc/controller/passwall.lua b/luci-app-passwall/luasrc/controller/passwall.lua
index 73456c12..e9fa889f 100644
--- a/luci-app-passwall/luasrc/controller/passwall.lua
+++ b/luci-app-passwall/luasrc/controller/passwall.lua
@@ -852,9 +852,13 @@ local backup_files = {
 function create_backup()
 	local date = os.date("%y%m%d%H%M")
 	local tar_file = "/tmp/passwall-" .. date .. "-backup.tar.gz"
+	local version_file = "/tmp/passwall-version"
+	local version = api.get_version()
 	fs.remove(tar_file)
-	local cmd = "tar -czf " .. tar_file .. " " .. table.concat(backup_files, " ")
+	fs.writefile(version_file, version .. "\n")
+	local cmd = "tar -czf " .. tar_file .. " " .. table.concat(backup_files, " ") .. " " .. "-C /tmp passwall-version"
 	luci.sys.call(cmd)
+	fs.remove(version_file)
 	http.header("Content-Disposition", "attachment; filename=passwall-" .. date .. "-backup.tar.gz")
 	http.header("X-Backup-Filename", "passwall-" .. date .. "-backup.tar.gz")
 	http.prepare_content("application/octet-stream")
@@ -895,7 +899,12 @@ function restore_backup()
 			uci:revert(c_config)
 			uci:revert(api.s_config)
 			luci.sys.call("echo '' > /tmp/log/passwall.log")
-			api.log(" * PassWall 配置文件上传成功…")
+			api.log(" * PassWall 备份文件上传成功…")
+			local version_file = "passwall-version"
+			local version = luci.sys.exec("tar -xOf " .. file_path .. " " .. version_file .. " 2>/dev/null"):match("^%s*(.-)%s*$")
+			if version and version ~= "" then
+				api.log(" * 备份文件由 PassWall " .. version .. " 生成。")
+			end
 			local temp_dir = '/tmp/passwall_bak'
 			luci.sys.call("mkdir -p " .. temp_dir)
 			if luci.sys.call("tar -xzf " .. file_path .. " -C " .. temp_dir) == 0 then
@@ -909,8 +918,9 @@ function restore_backup()
 					end
 				end
 				if type == "all" or type == "client" then
-					api.log(" * PassWall 配置还原成功…")
+					api.log(" * PassWall 备份还原成功…")
 					api.log(" * 重启 PassWall 服务中…\n")
+					api.sh_uci_set(c_config, "@global[0]", "flush_set", "1", true)
 					luci.sys.call('/etc/init.d/passwall restart > /dev/null 2>&1 &')
 				end
 				if type == "all" or type == "server" then
@@ -918,7 +928,7 @@ function restore_backup()
 				end
 				result = { status = "success", message = "Upload completed", path = file_path }
 			else
-				api.log(" * PassWall 配置文件解压失败，请重试！")
+				api.log(" * PassWall 备份文件解压失败，请重试！")
 				result = { status = "error", message = "Decompression failed" }
 			end
 			luci.sys.call("rm -rf " .. temp_dir)
diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua
index 11d8918e..6001b1c0 100644
--- a/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua
+++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua
@@ -395,6 +395,8 @@ o:value("tcp", "TCP")
 o:value("udp", "UDP")
 o:value("doh", "DoH")
 o:value("http3", "HTTP3(DoH3)")
+o:value("tls", "TLS(DoT)")
+o:value("quic", "QUIC(DoQ)")
 o:depends("dns_mode", "sing-box")
 o.cfgvalue = function(self, section)
 	return m:get(section, "v2ray_dns_mode")
@@ -422,6 +424,8 @@ o:depends({xray_dns_mode = "udp"})
 o:depends({xray_dns_mode = "tcp"})
 o:depends({singbox_dns_mode = "udp"})
 o:depends({singbox_dns_mode = "tcp"})
+o:depends({singbox_dns_mode = "tls"})
+o:depends({singbox_dns_mode = "quic"})
 
 o = s:option(Value, "remote_dns_doh", translate("Remote DNS DoH"))
 o.description = translate("Format: URL[,IP] (optional IP to map the domain in the URL)")
diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
index 3054167c..12752c54 100644
--- a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
+++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
@@ -369,6 +369,8 @@ o:value("tcp", "TCP")
 o:value("udp", "UDP")
 o:value("doh", "DoH")
 o:value("http3", "HTTP3(DoH3)")
+o:value("tls", "TLS(DoT)")
+o:value("quic", "QUIC(DoQ)")
 o:depends("dns_mode", "sing-box")
 o:depends("smartdns_dns_mode", "sing-box")
 o.cfgvalue = function(self, section)
@@ -411,6 +413,8 @@ o:depends({xray_dns_mode = "udp"})
 o:depends({xray_dns_mode = "tcp"})
 o:depends({singbox_dns_mode = "udp"})
 o:depends({singbox_dns_mode = "tcp"})
+o:depends({singbox_dns_mode = "tls"})
+o:depends({singbox_dns_mode = "quic"})
 
 ---- DoH
 o = s:taboption("DNS", Value, "remote_dns_doh", translate("Remote DNS DoH"))
diff --git a/luci-app-passwall/luasrc/passwall/util_sing-box.lua b/luci-app-passwall/luasrc/passwall/util_sing-box.lua
index df1deaf6..32ed5428 100644
--- a/luci-app-passwall/luasrc/passwall/util_sing-box.lua
+++ b/luci-app-passwall/luasrc/passwall/util_sing-box.lua
@@ -1127,8 +1127,10 @@ function gen_config(var)
 	local direct_dns_query_strategy = var["direct_dns_query_strategy"]
 	local remote_dns_udp_server = var["remote_dns_udp_server"]
 	local remote_dns_udp_port = var["remote_dns_udp_port"]
+	local remote_dns_quic = var["remote_dns_quic"]
 	local remote_dns_tcp_server = var["remote_dns_tcp_server"]
 	local remote_dns_tcp_port = var["remote_dns_tcp_port"]
+	local remote_dns_tls = var["remote_dns_tls"]
 	local remote_dns_doh = var["remote_dns_doh"]
 	local remote_dns_http3 = var["remote_dns_http3"]
 	local remote_dns_client_ip = var["remote_dns_client_ip"]
@@ -1883,13 +1885,19 @@ function gen_config(var)
 			remote_server.type = "udp"
 			remote_server.server = remote_dns_udp_server
 			remote_server.server_port = server_port
-
+			if remote_dns_quic then
+				remote_server.type = "quic"
+				remote_server.server_port = tonumber(remote_dns_udp_port) or 853
+			end
 		elseif remote_dns_tcp_server then
 			local server_port = tonumber(remote_dns_tcp_port) or 53
 			remote_server.type = "tcp"
 			remote_server.server = remote_dns_tcp_server
 			remote_server.server_port = server_port
-
+			if remote_dns_tls then
+				remote_server.type = "tls"
+				remote_server.server_port = tonumber(remote_dns_tcp_port) or 853
+			end
 		elseif remote_dns_doh then
 			local _a = api.parseDoH(remote_dns_doh)
 			if _a then
diff --git a/luci-app-passwall/root/usr/share/passwall/app.sh b/luci-app-passwall/root/usr/share/passwall/app.sh
index 09768885..36c4052b 100755
--- a/luci-app-passwall/root/usr/share/passwall/app.sh
+++ b/luci-app-passwall/root/usr/share/passwall/app.sh
@@ -150,16 +150,30 @@ run_singbox() {
 
 	[ -n "$remote_dns_query_strategy" ] && json_add_string "remote_dns_query_strategy" "${remote_dns_query_strategy}"
 	case "$remote_dns_protocol" in
-		udp|tcp)
-			local _proto="$remote_dns_protocol"
-			local _dns=$(get_first_dns remote_dns_${_proto}_server 53)
-			local _dns_address=$(echo ${_dns} | awk -F '#' '{print $1}')
-			local _dns_port=$(echo ${_dns} | awk -F '#' '{print $2}')
-			json_add_string "remote_dns_${_proto}_server" "${_dns_address}"
-			json_add_string "remote_dns_${_proto}_port" "${_dns_port}"
+		udp|quic)
+			local _dns_address=$(echo "$remote_dns_udp_server" | awk -F '#' '{print $1}')
+			local default_port=53
+			[ "$remote_dns_protocol" = "quic" ] && {
+				default_port=853
+				json_add_string "remote_dns_quic" "1"
+			}
+			local _dns_port=$(echo "$remote_dns_udp_server" | awk -F '#' -v def="$default_port" '{print ($2 ? $2 : def)}')
+			json_add_string "remote_dns_udp_server" "$_dns_address"
+			json_add_string "remote_dns_udp_port" "$_dns_port"
+		;;
+		tcp|tls)
+			local _dns_address=$(echo "$remote_dns_tcp_server" | awk -F '#' '{print $1}')
+			local default_port=53
+			[ "$remote_dns_protocol" = "tls" ] && {
+				default_port=853
+				json_add_string "remote_dns_tls" "1"
+			}
+			local _dns_port=$(echo "$remote_dns_tcp_server" | awk -F '#' -v def="$default_port" '{print ($2 ? $2 : def)}')
+			json_add_string "remote_dns_tcp_server" "$_dns_address"
+			json_add_string "remote_dns_tcp_port" "$_dns_port"
 		;;
 		doh|http3)
-			json_add_string "remote_dns_doh" "${remote_dns_doh}"
+			json_add_string "remote_dns_doh" "$remote_dns_doh"
 			[ "$remote_dns_protocol" = "http3" ] && json_add_string "remote_dns_http3" "1"
 		;;
 	esac
@@ -245,13 +259,17 @@ run_xray() {
 	[ -n "$dns_cache" ] && json_add_string "dns_cache" "${dns_cache}"
 
 	case "$remote_dns_protocol" in
-		udp|tcp)
-			local _proto="$remote_dns_protocol"
-			local _dns=$(get_first_dns remote_dns_${_proto}_server 53)
-			local _dns_address=$(echo ${_dns} | awk -F '#' '{print $1}')
-			local _dns_port=$(echo ${_dns} | awk -F '#' '{print $2}')
-			json_add_string "remote_dns_${_proto}_server" "${_dns_address}"
-			json_add_string "remote_dns_${_proto}_port" "${_dns_port}"
+		udp)
+			local _dns_address=$(echo "$remote_dns_udp_server" | awk -F '#' '{print $1}')
+			local _dns_port=$(echo "$remote_dns_udp_server" | awk -F '#' '{print ($2 ? $2 : 53)}')
+			json_add_string "remote_dns_udp_server" "$_dns_address"
+			json_add_string "remote_dns_udp_port" "$_dns_port"
+		;;
+		tcp)
+			local _dns_address=$(echo "$remote_dns_tcp_server" | awk -F '#' '{print $1}')
+			local _dns_port=$(echo "$remote_dns_tcp_server" | awk -F '#' '{print ($2 ? $2 : 53)}')
+			json_add_string "remote_dns_tcp_server" "$_dns_address"
+			json_add_string "remote_dns_tcp_port" "$_dns_port"
 		;;
 		doh)
 			json_add_string "remote_dns_doh" "${remote_dns_doh}"
@@ -282,7 +300,7 @@ run_dns2socks() {
 	eval_set_val "$@"
 	[ -n "$flag" ] && flag="_${flag}"
 	[ -n "$log_file" ] || log_file="/dev/null"
-	dns=$(get_first_dns dns 53 | sed 's/#/:/g')
+	dns=$(format_dns $dns 53)
 	[ -n "$socks" ] && {
 		socks="${socks//#/:}"
 		socks_address=$(echo $socks | awk -F ':' '{print $1}')
@@ -601,7 +619,6 @@ start_global() {
 		local v2ray_dns_mode=$(config_n_get @global[0] v2ray_dns_mode tcp)
 		[ "${DNS_MODE}" != "sing-box" ] && [ "$protocol" = "_shunt" ] && {
 			DNS_MODE="sing-box"
-			[ "$v2ray_dns_mode" = "tcp+doh" ] && v2ray_dns_mode="tcp"
 		}
 
 		[ "$protocol" = "_shunt" ] && {
@@ -637,10 +654,13 @@ start_global() {
 
 			_args="${_args} remote_dns_protocol=${v2ray_dns_mode}"
 			case "$v2ray_dns_mode" in
-				udp|tcp)
-					local _proto="$v2ray_dns_mode"
-					_args="${_args} remote_dns_${_proto}_server=${REMOTE_DNS}"
-					resolve_dns_log="Sing-Box DNS(127.0.0.1#${resolve_dns_port}) -> ${_proto}://${REMOTE_DNS}"
+				udp|quic)
+					_args="${_args} remote_dns_udp_server=${REMOTE_DNS}"
+					resolve_dns_log="Sing-Box DNS(127.0.0.1#${resolve_dns_port}) -> ${v2ray_dns_mode}://${REMOTE_DNS}"
+				;;
+				tcp|tls)
+					_args="${_args} remote_dns_tcp_server=${REMOTE_DNS}"
+					resolve_dns_log="Sing-Box DNS(127.0.0.1#${resolve_dns_port}) -> ${v2ray_dns_mode}://${REMOTE_DNS}"
 				;;
 				doh|http3)
 					local remote_dns_doh=$(config_n_get @global[0] remote_dns_doh "https://1.1.1.1/dns-query")
@@ -677,7 +697,11 @@ start_global() {
 		local v2ray_dns_mode=$(config_n_get @global[0] v2ray_dns_mode tcp)
 		[ "${DNS_MODE}" != "xray" ] && [ "$protocol" = "_shunt" ] && {
 			DNS_MODE="xray"
-			[ "$v2ray_dns_mode" = "http3" ] && v2ray_dns_mode="tcp"
+			case "$v2ray_dns_mode" in http3|tls|quic)
+				v2ray_dns_mode="tcp"
+				REMOTE_DNS="1.1.1.1#53"
+				;;
+			esac
 		}
 
 		[ "$protocol" = "_shunt" ] && {
@@ -1023,7 +1047,7 @@ start_dns() {
 	echolog "DNS域名解析："
 
 	local china_ng_local_dns=$(IFS=','; set -- $LOCAL_DNS; [ "${1%%[#:]*}" = "127.0.0.1" ] && echo "$1" || ([ -n "$2" ] && echo "$*" || echo "$1"))
-	local sing_box_local_dns=
+	local v2ray_local_dns
 	local direct_dns_mode=$(config_n_get @global[0] direct_dns_mode "auto")
 
 	#获取访问控制节点所使用的DNS分流模式
@@ -1040,19 +1064,18 @@ start_dns() {
 		udp)
 			LOCAL_DNS=$(normalize_dns "$(config_n_get @global[0] direct_dns 223.5.5.5:53)")
 			china_ng_local_dns=${LOCAL_DNS}
-			sing_box_local_dns="direct_dns_udp_server=${LOCAL_DNS}"
+			v2ray_local_dns="direct_dns_udp_server=${LOCAL_DNS}"
 		;;
 		tcp)	
 			local DIRECT_DNS=$(normalize_dns "$(config_n_get @global[0] direct_dns 223.5.5.5:53)")
 			china_ng_local_dns="tcp://${DIRECT_DNS}"
-			sing_box_local_dns="direct_dns_tcp_server=${DIRECT_DNS}"
+			v2ray_local_dns="direct_dns_tcp_server=${DIRECT_DNS}"
 
 			#当全局（包括访问控制节点）开启chinadns-ng时，不启动新进程。
 			[ "$DNS_SHUNT" != "chinadns-ng" ] || [ "$ACL_RULE_DNSMASQ" = "1" ] && {
 				LOCAL_DNS="127.0.0.1#${NEXT_DNS_LISTEN_PORT}"
-				local china_ng_c_dns="tcp://$(get_first_dns DIRECT_DNS 53)"
-				ln_run "$(first_type chinadns-ng)" chinadns-ng "/dev/null" -b :: -l ${NEXT_DNS_LISTEN_PORT} -c ${china_ng_c_dns} -d chn
-				echolog "  - ChinaDNS-NG(${LOCAL_DNS}) -> ${china_ng_c_dns}"
+				ln_run "$(first_type chinadns-ng)" chinadns-ng "/dev/null" -b :: -l ${NEXT_DNS_LISTEN_PORT} -c ${china_ng_local_dns} -d chn
+				echolog "  - ChinaDNS-NG(${LOCAL_DNS}) -> ${china_ng_local_dns}"
 				echolog "  * 请确保上游直连 DNS 支持 TCP 查询。"
 				NEXT_DNS_LISTEN_PORT=$(expr $NEXT_DNS_LISTEN_PORT + 1)
 			}
@@ -1083,9 +1106,8 @@ start_dns() {
 	case "$DNS_MODE" in
 	dns2socks)
 		local dns2socks_socks_server=$(echo $(config_n_get @global[0] socks_server 127.0.0.1:1080) | sed "s/#/:/g")
-		local dns2socks_forward=$(get_first_dns REMOTE_DNS 53 | sed 's/#/:/g')
-		run_dns2socks socks=$dns2socks_socks_server listen_address=127.0.0.1 listen_port=${NEXT_DNS_LISTEN_PORT} dns=$dns2socks_forward cache=$DNS_CACHE
-		echolog "  - dns2socks(${TUN_DNS})，${dns2socks_socks_server} -> tcp://${dns2socks_forward}"
+		run_dns2socks socks=$dns2socks_socks_server listen_address=127.0.0.1 listen_port=${NEXT_DNS_LISTEN_PORT} dns=$REMOTE_DNS cache=$DNS_CACHE
+		echolog "  - dns2socks(${TUN_DNS})，${dns2socks_socks_server} -> tcp://${REMOTE_DNS}"
 	;;
 	sing-box)
 		[ -z "${NO_PLUGIN_DNS}" ] && {
@@ -1111,10 +1133,13 @@ start_dns() {
 			_args="${_args} dns_listen_port=${NEXT_DNS_LISTEN_PORT}"
 			_args="${_args} remote_dns_protocol=${v2ray_dns_mode}"
 			case "$v2ray_dns_mode" in
-				udp|tcp)
-					local _proto="$v2ray_dns_mode"
-					_args="${_args} remote_dns_${_proto}_server=${REMOTE_DNS}"
-					echolog "  - Sing-Box DNS(${TUN_DNS}) -> ${_proto}://${REMOTE_DNS}"
+				udp|quic)
+					_args="${_args} remote_dns_udp_server=${REMOTE_DNS}"
+					echolog "  - Sing-Box DNS(${TUN_DNS}) -> ${v2ray_dns_mode}://${REMOTE_DNS}"
+				;;
+				tcp|tls)
+					_args="${_args} remote_dns_tcp_server=${REMOTE_DNS}"
+					echolog "  - Sing-Box DNS(${TUN_DNS}) -> ${v2ray_dns_mode}://${REMOTE_DNS}"
 				;;
 				doh|http3)
 					local remote_dns_doh=$(config_n_get @global[0] remote_dns_doh "https://1.1.1.1/dns-query")
@@ -1123,7 +1148,7 @@ start_dns() {
 				;;
 			esac
 			_args="${_args} dns_socks_address=127.0.0.1 dns_socks_port=${GLOBAL_SOCKS_port}"
-			[ -n "${sing_box_local_dns}" ] && _args="${_args} ${sing_box_local_dns}"
+			[ -n "${v2ray_local_dns}" ] && _args="${_args} ${v2ray_local_dns}"
 			run_singbox ${_args}
 		}
 	;;
@@ -1162,13 +1187,14 @@ start_dns() {
 				;;
 			esac
 			_args="${_args} dns_socks_address=127.0.0.1 dns_socks_port=${GLOBAL_SOCKS_port}"
+			[ -n "${v2ray_local_dns}" ] && _args="${_args} ${v2ray_local_dns}"
 			run_xray ${_args}
 		}
 	;;
 	udp)
 		UDP_PROXY_DNS=1
 		local china_ng_listen_port=${NEXT_DNS_LISTEN_PORT}
-		local china_ng_trust_dns="udp://$(get_first_dns REMOTE_DNS 53)"
+		local china_ng_trust_dns="udp://${REMOTE_DNS}"
 		if [ "$DNS_SHUNT" != "chinadns-ng" ] && [ "$FILTER_PROXY_IPV6" = "1" ]; then
 			DNSMASQ_FILTER_PROXY_IPV6=0
 			local no_ipv6_trust="-N"
@@ -1182,7 +1208,7 @@ start_dns() {
 	tcp)
 		TCP_PROXY_DNS=1
 		local china_ng_listen_port=${NEXT_DNS_LISTEN_PORT}
-		local china_ng_trust_dns="tcp://$(get_first_dns REMOTE_DNS 53)"
+		local china_ng_trust_dns="tcp://${REMOTE_DNS}"
 		[ "$DNS_SHUNT" != "chinadns-ng" ] && {
 			[ "$FILTER_PROXY_IPV6" = "1" ] && DNSMASQ_FILTER_PROXY_IPV6=0 && local no_ipv6_trust="-N"
 			ln_run "$(first_type chinadns-ng)" chinadns-ng "/dev/null" -b :: -l ${china_ng_listen_port} -t ${china_ng_trust_dns} -d gfw ${no_ipv6_trust}
@@ -1272,7 +1298,7 @@ start_dns() {
 		[ "$(check_ver "$dnsmasq_version" "2.87")" = "1" ] && echolog "Dnsmasq版本低于2.87，有可能无法正常使用！！！"
 	}
 
-	local DNSMASQ_TUN_DNS=$(get_first_dns TUN_DNS 53)
+	local DNSMASQ_TUN_DNS=$(normalize_dns $TUN_DNS 53)
 	local RUN_NEW_DNSMASQ=1
 	RUN_NEW_DNSMASQ=${DNS_REDIRECT}
 	if [ "${RUN_NEW_DNSMASQ}" = "0" ]; then
@@ -1448,7 +1474,13 @@ acl_app() {
 							fi
 							([ "$type" = "sing-box" ] || [ "$type" = "xray" ]) && [ "$protocol" = "_shunt" ] && [ "$type" != "$dns_mode" ] && {
 								dns_mode=$type
-								[ "$type" = "xray" ] && [ "$v2ray_dns_mode" = "http3" ] && v2ray_dns_mode="tcp"
+								[ "$type" = "xray" ] && {
+									case "$v2ray_dns_mode" in http3|tls|quic)
+										v2ray_dns_mode="tcp"
+										remote_dns="1.1.1.1#53"
+										;;
+									esac
+								}
 							}
 							dns_cache_key="${dns_mode}_${remote_dns}_${v2ray_dns_mode:-none}_${remote_dns_client_ip:-0}_${remote_fakedns:-0}_${remote_rewrite_ttl:-30}"
 							([ "$v2ray_dns_mode" = "doh" ] || [ "$v2ray_dns_mode" = "http3" ]) && {
@@ -1763,7 +1795,7 @@ get_config() {
 	[ -z "$(first_type $DNS_SHUNT)" ] && DNS_SHUNT="dnsmasq"
 	DNS_MODE=$(config_n_get @global[0] dns_mode tcp)
 	[ "$DNS_SHUNT" = "smartdns" ] && DNS_MODE=$(config_n_get @global[0] smartdns_dns_mode socks)
-	REMOTE_DNS=$(normalize_dns "$(config_n_get @global[0] remote_dns 1.1.1.1:53)")
+	REMOTE_DNS=$(normalize_dns "$(config_n_get @global[0] remote_dns 1.1.1.1)")
 	USE_DEFAULT_DNS=$(config_n_get @global[0] use_default_dns direct)
 	FILTER_PROXY_IPV6=$(config_n_get @global[0] filter_proxy_ipv6 0)
 	DNS_REDIRECT=$(config_n_get @global[0] dns_redirect 1)
diff --git a/luci-app-passwall/root/usr/share/passwall/lease2hosts.sh b/luci-app-passwall/root/usr/share/passwall/lease2hosts.sh
index bfb43632..77b648d1 100755
--- a/luci-app-passwall/root/usr/share/passwall/lease2hosts.sh
+++ b/luci-app-passwall/root/usr/share/passwall/lease2hosts.sh
@@ -4,8 +4,7 @@
 
 . /usr/share/passwall/utils.sh
 LOCK_FILE=${LOCK_PATH}/${CONFIG}_lease2hosts.lock
-LEASE_FILE=$(uci -q get "dhcp.@dnsmasq[0].leasefile")
-LEASE_FILE=${LEASE_FILE:="/tmp/dhcp.leases"}
+LEASE_FILE=$(uci -q get dhcp.@dnsmasq[0].leasefile || echo "/tmp/dhcp.leases")
 HOSTS_FILE="$TMP_PATH2/dhcp-hosts"
 TMP_FILE="/tmp/dhcp-hosts.tmp"
 
diff --git a/luci-app-passwall/root/usr/share/passwall/utils.sh b/luci-app-passwall/root/usr/share/passwall/utils.sh
index 65984815..f64d7e71 100755
--- a/luci-app-passwall/root/usr/share/passwall/utils.sh
+++ b/luci-app-passwall/root/usr/share/passwall/utils.sh
@@ -208,31 +208,9 @@ check_host() {
 	return 0
 }
 
-get_first_dns() {
-	local __hosts_val=${1}; shift 1
-	__first() {
-		[ -z "${2}" ] && return 0
-		echo "${2}#${3}"
-		return 1
-	}
-	hosts_foreach "${__hosts_val}" __first "$@"
-}
-
-get_last_dns() {
-	local __hosts_val=${1}; shift 1
-	local __first __last
-	__every() {
-		[ -z "${2}" ] && return 0
-		__last="${2}#${3}"
-		__first=${__first:-${__last}}
-	}
-	hosts_foreach "${__hosts_val}" __first "$@"
-	[ "${__first}" =  "${__last}" ] || echo "${__last}"
-}
-
 normalize_dns() {
 	local s="$1"
-	local addr port
+	local addr port="${2-}"
 	case "$s" in
 		\[*\]:*)
 			# [ip6]:port
@@ -254,18 +232,22 @@ normalize_dns() {
 			# [ip6]
 			addr="${s#\[}"
 			addr="${addr%\]}"
-			port=""
 		;;
 		*)
 			addr="$s"
-			port=""
 		;;
 	esac
-	if [ -n "$port" ]; then
-		echo "${addr}#${port}"
-	else
-		echo "$addr"
-	fi
+	[ -n "$port" ] && echo "${addr}#${port}" || echo "$addr"
+}
+
+format_dns() {
+	local dns="${1%%#*}"
+	local port="${1#*#}"
+	[ "$port" = "$1" ] && port="${2-53}"
+	case "$dns" in
+		*:*) echo "[$dns]:$port" ;;
+		*)   echo "$dns:$port" ;;
+	esac
 }
 
 check_port_exists() {
diff --git a/luci-app-passwall2/po/zh-cn/passwall2.po b/luci-app-passwall2/po/zh-cn/passwall2.po
index 7bc9d275..c45f283a 100644
--- a/luci-app-passwall2/po/zh-cn/passwall2.po
+++ b/luci-app-passwall2/po/zh-cn/passwall2.po
@@ -2426,3 +2426,7 @@ msgstr "配置支持的密码套件列表。"
 
 msgid "This username already exists."
 msgstr "该用户名已存在。"
+
+msgid "Update Options"
+msgstr "更新选项"
+
diff --git a/tuic-client/Makefile b/tuic-client/Makefile
index 8a687fdf..c1e6400e 100644
--- a/tuic-client/Makefile
+++ b/tuic-client/Makefile
@@ -5,15 +5,15 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=tuic-client
-PKG_UPSTREAM_VERSION:=2.0.0-dev3
-PKG_VERSION:=2.0.0_pre3
+PKG_UPSTREAM_VERSION:=2.0.0-dev4
+PKG_VERSION:=2.0.0_pre4
 PKG_RELEASE:=1
 
-TUIC_HASH_AARCH64:=45d61e97532157354ad2af27c34fbe26ec4b3429c4e4d0a3b02f0fc5cf7d31d6
-TUIC_HASH_ARMV7:=065659cd12ab03e873fcecc5142fa69e40c55c56f4932a9545463e9cf4ed0cad
-TUIC_HASH_ARMV7HF:=dc94542a1cf6758b9f2c20b4cecb73c66292cba4f8371fd6b3cce5b8a45bd709
-TUIC_HASH_I686:=39dc1a25ea083104e01bb0d9e4ad51d2590178b32b55caf1cb78f18d28a96735
-TUIC_HASH_X86_64:=b547bdd77400726328ccd7d4950309feb7d0803ce8a03dcc7df401fb7b65502c
+TUIC_HASH_AARCH64:=0f9cf59e42482c9760cc5dab33246d470f62315d921ace69eba32e6707db4512
+TUIC_HASH_ARMV7:=b6ca20ddcf56614b4044c30d5bdeeec3c121ca6d6d60565df5d07317af42abfc
+TUIC_HASH_ARMV7HF:=674be311611406a9475fa2f954d352dd84bca7e49ba4d7265c945f12f52b2db0
+TUIC_HASH_I686:=f58775774e94a2222e72aafa570510f96180f745dee40ce295404669b22a6449
+TUIC_HASH_X86_64:=6b0af183a8b5634d5e1192ff88b6b6f212e3e0c33a7c7efd0c5828b0685eb372
 
 PKG_MAINTAINER:=Tianling Shen <cnsztl@immortalwrt.org>
 PKG_LICENSE:=GPL-3.0-or-later