diff --git a/dae/Makefile b/dae/Makefile
index bbbdb96d..e9b80315 100644
--- a/dae/Makefile
+++ b/dae/Makefile
@@ -10,7 +10,7 @@ PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=1d52465dd455d9702a75486bc4dadde684d6f782
+PKG_SOURCE_VERSION:=0e757f29d5c82deb1fcf687004a8b7b1fe7afb9d
 PKG_SOURCE_URL:=https://github.com/olicesx/dae.git
 PKG_MIRROR_HASH:=skip
 
diff --git a/luci-app-passwall/luasrc/passwall/util_sing-box.lua b/luci-app-passwall/luasrc/passwall/util_sing-box.lua
index 4200fec4..afb9ad3b 100644
--- a/luci-app-passwall/luasrc/passwall/util_sing-box.lua
+++ b/luci-app-passwall/luasrc/passwall/util_sing-box.lua
@@ -1997,17 +1997,6 @@ function gen_config(var)
 			else default_dns_flag = "direct"
 			end
 		end
-		if default_dns_flag == "remote" then
-			if remote_dns_fake then
-				table.insert(dns.rules, {
-					query_type = { "A", "AAAA" },
-					server = fakedns_tag,
-					disable_cache = true,
-					rewrite_ttl = 30,
-					strategy = remote_strategy
-				})
-			end
-		end
 		dns.final = default_dns_flag
 
 		--按分流顺序DNS
@@ -2062,6 +2051,28 @@ function gen_config(var)
 				end
 			end
 		end
+		if default_dns_flag == "remote" then
+			if remote_dns_fake then
+				-- When default is not direct and enable fakedns, default DNS use FakeDNS.
+				local fakedns_dns_rule = {
+					query_type = {
+						"A", "AAAA"
+					},
+					server = fakedns_tag,
+					disable_cache = true,
+					rewrite_ttl = 30,
+					strategy = remote_strategy,
+				}
+				table.insert(dns.rules, fakedns_dns_rule)
+			else
+				local remote_dns_rule = {
+					server = "remote",
+					disable_cache = true,
+					strategy = remote_strategy,
+				}
+				table.insert(dns.rules, remote_dns_rule)
+			end
+		end
 		local dns_in_inbound = {
 			type = "direct",
 			tag = "dns-in",
diff --git a/luci-app-passwall/luasrc/passwall/util_xray.lua b/luci-app-passwall/luasrc/passwall/util_xray.lua
index 5e861f08..e384d8b0 100644
--- a/luci-app-passwall/luasrc/passwall/util_xray.lua
+++ b/luci-app-passwall/luasrc/passwall/util_xray.lua
@@ -1733,7 +1733,7 @@ function gen_config(var)
 			elseif remote_dns_query_strategy == "UseIPv6" then
 				table.insert(fakedns, fakedns6)
 			end
-			if remote_dns_fake and inner_fakedns ~= "1" then
+			if remote_dns_fake then
 				table.insert(dns.servers, 1, _remote_fakedns)
 			end
 		end
diff --git a/luci-app-passwall2/luasrc/controller/passwall2.lua b/luci-app-passwall2/luasrc/controller/passwall2.lua
index 080b429e..6ec25906 100644
--- a/luci-app-passwall2/luasrc/controller/passwall2.lua
+++ b/luci-app-passwall2/luasrc/controller/passwall2.lua
@@ -261,7 +261,7 @@ end
 
 function get_socks_log()
 	local name = http.formvalue("name")
-	local path = "/tmp/etc/passwall2/SOCKS_" .. name .. ".log"
+	local path = "/tmp/etc/passwall2/" .. name .. ".log"
 	if nixio.fs.access(path) then
 		local content = luci.sys.exec("tail -n 5000 ".. path)
 		content = content:gsub("\n", "<br />")
@@ -309,7 +309,7 @@ function socks_status()
 	local index = http.formvalue("index")
 	local id = http.formvalue("id")
 	e.index = index
-	e.socks_status = luci.sys.call(string.format("/bin/busybox top -bn1 | grep -v -E 'grep|acl/|acl_' | grep '%s/bin/' | grep '%s' | grep 'SOCKS_' > /dev/null", appname, id)) == 0
+	e.socks_status = luci.sys.call(string.format("/bin/busybox top -bn1 | grep -v -E 'grep|acl/|acl_' | grep '%s/bin/' | grep '%s' > /dev/null", appname, id)) == 0
 	local use_http = uci:get(appname, id, "http_port") or 0
 	e.use_http = 0
 	if tonumber(use_http) > 0 then
@@ -439,7 +439,7 @@ end
 function clear_all_nodes()
 	uci:set(appname, '@global[0]', "enabled", "0")
 	uci:set(appname, '@global[0]', "socks_enabled", "0")
-	uci:set(appname, '@haproxy_config[0]', "balancing_enable", "0")
+	uci:set(appname, '@global_haproxy[0]', "balancing_enable", "0")
 	uci:delete(appname, '@global[0]', "node")
 	uci:foreach(appname, "socks", function(t)
 		uci:delete(appname, t[".name"])
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/acl.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/acl.lua
index 0b815a51..522170ee 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/acl.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/acl.lua
@@ -23,8 +23,10 @@ s.anonymous = true
 s.addremove = true
 s.extedit = api.url("acl_config", "%s")
 function s.create(e, t)
-	t = TypedSection.create(e, t)
-	luci.http.redirect(e.extedit:format(t))
+	local uuid = api.gen_short_uuid(5)
+	uuid = "acl_" .. uuid
+	TypedSection.create(e, uuid)
+	luci.http.redirect(e.extedit:format(uuid))
 end
 
 ---- Enable
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua
index 6f506950..b6b78fc7 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua
@@ -43,7 +43,7 @@ local socks_list = {}
 m.uci:foreach(appname, "socks", function(s)
 	if s.enabled == "1" and s.node then
 		socks_list[#socks_list + 1] = {
-			id = "Socks_" .. s[".name"],
+			id = s[".name"],
 			remark = translate("Socks Config") .. " [" .. s.port .. translate("Port") .. "]",
 			group = "Socks"
 		}
@@ -312,10 +312,10 @@ s2.anonymous = true
 s2.addremove = true
 s2.extedit = api.url("socks_config", "%s")
 function s2.create(e, t)
-	local uuid = api.gen_short_uuid()
-	t = uuid
-	TypedSection.create(e, t)
-	luci.http.redirect(e.extedit:format(t))
+	local uuid = api.gen_short_uuid(5)
+	uuid = "socks_" .. uuid
+	TypedSection.create(e, uuid)
+	luci.http.redirect(e.extedit:format(uuid))
 end
 
 o = s2:option(DummyValue, "status", translate("Status"))
@@ -336,7 +336,7 @@ o.group = {}
 o = s2:option(DummyValue, "now_node", translate("Current Node"))
 o.rawhtml = true
 o.cfgvalue = function(_, n)
-	local current_node = api.get_cache_var("socks_" .. n)
+	local current_node = api.get_cache_var(n)
 	if current_node then
 		local node = m:get(current_node)
 		if node then
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua
index 06dad374..d6f14020 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua
@@ -113,7 +113,9 @@ s.anonymous = true
 s.addremove = true
 
 s.create = function(e, t)
-	TypedSection.create(e, api.gen_short_uuid())
+	local uuid = api.gen_short_uuid(5)
+	uuid = "haproxy_" .. uuid
+	TypedSection.create(e, uuid)
 end
 
 s.remove = function(self, section)
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe.lua
index 3a05c465..66df5407 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe.lua
@@ -134,11 +134,12 @@ s.sortable = true
 s.template = "cbi/tblsection"
 s.extedit = api.url("node_subscribe_config", "%s")
 function s.create(e, t)
-	local id = TypedSection.create(e, t)
-	uci:set(appname, id, "hysteria_up_mbps", "100")
-	uci:set(appname, id, "hysteria_down_mbps", "100")
-	api.uci_save(uci, appname)
-	luci.http.redirect(e.extedit:format(id))
+	local uuid = api.gen_short_uuid(5)
+	uuid = "sub_" .. uuid
+	TypedSection.create(e, uuid)
+	m:set(uuid, "hysteria_up_mbps", "100")
+	m:set(uuid, "hysteria_down_mbps", "100")
+	luci.http.redirect(e.extedit:format(uuid))
 end
 
 o = s:option(Value, "remark", translate("Remarks"))
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua
index b46db196..74cc6f14 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua
@@ -263,7 +263,9 @@ if has_xray then
 	s_xray_noise.addremove = true
 
 	s_xray_noise.create = function(e, t)
-		TypedSection.create(e, api.gen_short_uuid())
+		local uuid = api.gen_short_uuid(5)
+		uuid = "xray_noise_" .. uuid
+		TypedSection.create(e, uuid)
 	end
 
 	s_xray_noise.remove = function(self, section)
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/socks_config.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/socks_config.lua
index 9d9ac64a..5b48df4e 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/socks_config.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/socks_config.lua
@@ -31,7 +31,7 @@ o.default = 1
 o.rmempty = false
 
 local auto_switch_tip
-local current_node = api.get_cache_var("socks_" .. arg[1])
+local current_node = api.get_cache_var(arg[1])
 if current_node then
 	local n = m:get(current_node)
 	if n then
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/ray.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/ray.lua
index 728ab2fc..ad40219e 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/ray.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/ray.lua
@@ -518,6 +518,9 @@ o = s:option(Flag, _n("use_mldsa65Verify"), translate("ML-DSA-65"))
 o.default = "0"
 o:depends({ [_n("tls")] = true, [_n("reality")] = true })
 
+o = s:option(Value, _n("cipherSuites"), translate("Cipher Suites"), '<a href="https://go.dev/src/crypto/tls/cipher_suites.go#L44" target="_blank">***</a>' .. " " .. translate("Configures the list of supported cipher suites, separated by :"))
+o:depends({ [_n("tls")] = true, [_n("reality")] = false })
+
 o = s:option(TextValue, _n("reality_mldsa65Verify"), "ML-DSA-65 " .. translate("Public key"))
 o.default = ""
 o.rows = 5
diff --git a/luci-app-passwall2/luasrc/passwall2/api.lua b/luci-app-passwall2/luasrc/passwall2/api.lua
index 3ec184d5..f11ef1a7 100644
--- a/luci-app-passwall2/luasrc/passwall2/api.lua
+++ b/luci-app-passwall2/luasrc/passwall2/api.lua
@@ -583,7 +583,7 @@ function get_node_list()
 	uci:foreach(appname, "socks", function(s)
 		if s.enabled == "1" and s.node then
 			node_list.socks_list[#node_list.socks_list + 1] = {
-				id = "Socks_" .. s[".name"],
+				id = s[".name"],
 				remark = i18n.translate("Socks Config") .. " [" .. s.port .. i18n.translate("Port") .. "]",
 				group = "Socks"
 			}
@@ -677,8 +677,9 @@ function gen_uuid(format)
 	return uuid
 end
 
-function gen_short_uuid()
-	return sys.exec("echo -n $(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 8)")
+function gen_short_uuid(length)
+	if not length then length = 8 end
+	return sys.exec("echo -n $(head /dev/urandom | tr -dc A-Za-z0-9 | head -c %s)" % length)
 end
 
 function uci_get_type(type, config, default)
diff --git a/luci-app-passwall2/luasrc/passwall2/util_sing-box.lua b/luci-app-passwall2/luasrc/passwall2/util_sing-box.lua
index 312787f3..903c5856 100644
--- a/luci-app-passwall2/luasrc/passwall2/util_sing-box.lua
+++ b/luci-app-passwall2/luasrc/passwall2/util_sing-box.lua
@@ -1308,36 +1308,25 @@ function gen_config(var)
 			default_node_port = server_port
 		end
 
-		function gen_socks_config_node(node_id, socks_id, remarks)
-			if node_id then
-				socks_id = node_id:sub(1 + #"Socks_")
-			end
-			local result
-			local socks_node = uci:get_all(appname, socks_id) or nil
-			if socks_node then
-				if not remarks then
-					remarks = socks_node.port
-				end
-				result = {
-					[".name"] = "Socksid_" .. socks_id,
-					remarks = remarks,
+		function get_node_by_id(node_id)
+			if not node_id or node_id == "" or node_id == "nil" then return nil end
+			local section = uci:get_all(appname, node_id) or {}
+			if section[".type"] == "socks" then
+				local result = {
+					[".name"] = node_id,
+					remarks = "socks[%s]" % section.port,
 					type = "sing-box",
 					protocol = "socks",
 					address = "127.0.0.1",
-					port = socks_node.port,
+					port = section.port,
 					uot = "1"
 				}
+				return result
 			end
-			return result
-		end
-
-		function get_node_by_id(node_id)
-			if not node_id or node_id == "" or node_id == "nil" then return nil end
-			if node_id:find("Socks_") then
-				return gen_socks_config_node(node_id)
-			else
-				return uci:get_all(appname, node_id)
+			if section[".type"] == "nodes" then
+				return section
 			end
+			return nil
 		end
 
 		function gen_urltest_outbound(_node)
diff --git a/luci-app-passwall2/luasrc/passwall2/util_xray.lua b/luci-app-passwall2/luasrc/passwall2/util_xray.lua
index 5a953edd..9558730e 100644
--- a/luci-app-passwall2/luasrc/passwall2/util_xray.lua
+++ b/luci-app-passwall2/luasrc/passwall2/util_xray.lua
@@ -189,7 +189,8 @@ function gen_outbound(flag, node, tag, proxy_table)
 					certificates = (node.tls_certificate == "1" and node.tls_certificate_pem ~= "") and {
 						certificate = api.split(node.tls_certificate_pem, "\n"),
 						usage = "verify"
-					} or nil
+					} or nil,
+					cipherSuites = node.cipherSuites or nil
 				} or nil,
 				realitySettings = (node.stream_security == "reality") and {
 					serverName = node.tls_serverName,
@@ -994,37 +995,26 @@ function gen_config(var)
 		table.insert(inbounds, inbound)
 	end
 
-	function gen_socks_config_node(node_id, socks_id, remarks)
-		if node_id then
-			socks_id = node_id:sub(1 + #"Socks_")
-		end
-		local result
-		local socks_node = uci:get_all(appname, socks_id) or nil
-		if socks_node then
-			if not remarks then
-				remarks = socks_node.port
-			end
-			result = {
-				[".name"] = "Socksid_" .. socks_id,
-				remarks = remarks,
+	function get_node_by_id(node_id)
+		if not node_id or node_id == "" or node_id == "nil" then return nil end
+		local section = uci:get_all(appname, node_id) or {}
+		if section[".type"] == "socks" then
+			local result = {
+				[".name"] = node_id,
+				remarks = "socks[%s]" % section.port,
 				type = "Xray",
 				protocol = "socks",
 				address = "127.0.0.1",
-				port = socks_node.port,
+				port = section.port,
 				transport = "tcp",
 				stream_security = "none"
 			}
+			return result
 		end
-		return result
-	end
-
-	function get_node_by_id(node_id)
-		if not node_id or node_id == "" or node_id == "nil" then return nil end
-		if node_id:find("Socks_") then
-			return gen_socks_config_node(node_id)
-		else
-			return uci:get_all(appname, node_id)
+		if section[".type"] == "nodes" then
+			return section
 		end
+		return nil
 	end
 
 	function gen_loopback(outbound_tag, loopback_dst)
diff --git a/luci-app-passwall2/luasrc/view/passwall2/global/footer.htm b/luci-app-passwall2/luasrc/view/passwall2/global/footer.htm
index 661c1bd9..a62966a0 100644
--- a/luci-app-passwall2/luasrc/view/passwall2/global/footer.htm
+++ b/luci-app-passwall2/luasrc/view/passwall2/global/footer.htm
@@ -55,8 +55,8 @@ local appname = api.appname
 			return;
 		}
 		let to_url = '<%=api.url("node_config")%>/' + node_select_value;
-		if (node_select_value.indexOf("Socks_") === 0) {
-			to_url = '<%=api.url("socks_config")%>/' + node_select_value.substring("Socks_".length);
+		if (node_select_value.indexOf("socks_") === 0) {
+			to_url = '<%=api.url("socks_config")%>/' + node_select_value;
 		}
 		location.href = to_url;
 	}
diff --git a/luci-app-passwall2/luasrc/view/passwall2/include/shunt_options.htm b/luci-app-passwall2/luasrc/view/passwall2/include/shunt_options.htm
index 83b3c4f3..b547e78e 100644
--- a/luci-app-passwall2/luasrc/view/passwall2/include/shunt_options.htm
+++ b/luci-app-passwall2/luasrc/view/passwall2/include/shunt_options.htm
@@ -30,7 +30,7 @@
 			const selectNode = document.getElementById(dom_id + "_node");
 			val = selectNode.value;
 		}
-		if (val == "" || val.startsWith("_") || val.startsWith("Socks_") || !normal_list.find(element => element.id == val)) {
+		if (val == "" || val.startsWith("_") || val.startsWith("socks_") || !normal_list.find(element => element.id == val)) {
 			const hiddenSelect = document.getElementById(cbid);
 			const panel = document.getElementById(cbid + ".panel");
 			const display = document.getElementById(cbid + ".display");
diff --git a/luci-app-passwall2/po/fa/passwall2.po b/luci-app-passwall2/po/fa/passwall2.po
index c0a36ba7..1d8f7068 100644
--- a/luci-app-passwall2/po/fa/passwall2.po
+++ b/luci-app-passwall2/po/fa/passwall2.po
@@ -2428,3 +2428,9 @@ msgstr "غیرفعال کردن استفاده مجدد از TLS"
 
 msgid "Not Set"
 msgstr "تنظیم نشده"
+
+msgid "Cipher Suites"
+msgstr "سوئیت‌های رمزدار"
+
+msgid "Configures the list of supported cipher suites, separated by :"
+msgstr "فهرست مجموعه‌های رمز پشتیبانی‌شده را که با موارد زیر از هم جدا شده‌اند، پیکربندی می‌کند:"
diff --git a/luci-app-passwall2/po/ru/passwall2.po b/luci-app-passwall2/po/ru/passwall2.po
index 8f0f6453..9461436f 100644
--- a/luci-app-passwall2/po/ru/passwall2.po
+++ b/luci-app-passwall2/po/ru/passwall2.po
@@ -2426,3 +2426,9 @@ msgstr "Отключить повторное использование TLS"
 
 msgid "Not Set"
 msgstr "Не задано"
+
+msgid "Cipher Suites"
+msgstr "Наборы шифров"
+
+msgid "Configures the list of supported cipher suites, separated by :"
+msgstr "Задает список поддерживаемых наборов шифров, разделенных двоеточием (:)."
diff --git a/luci-app-passwall2/po/zh-cn/passwall2.po b/luci-app-passwall2/po/zh-cn/passwall2.po
index 8612e424..19f8e055 100644
--- a/luci-app-passwall2/po/zh-cn/passwall2.po
+++ b/luci-app-passwall2/po/zh-cn/passwall2.po
@@ -2414,3 +2414,9 @@ msgstr "禁用 TLS 连接复用"
 
 msgid "Not Set"
 msgstr "未设置"
+
+msgid "Cipher Suites"
+msgstr "密码套件"
+
+msgid "Configures the list of supported cipher suites, separated by :"
+msgstr "配置支持的密码套件列表，以冒号 (:) 分隔。"
diff --git a/luci-app-passwall2/po/zh-tw/passwall2.po b/luci-app-passwall2/po/zh-tw/passwall2.po
index a7d0bbb0..9961c93b 100644
--- a/luci-app-passwall2/po/zh-tw/passwall2.po
+++ b/luci-app-passwall2/po/zh-tw/passwall2.po
@@ -2420,3 +2420,9 @@ msgstr "禁用 TLS 連接復用"
 
 msgid "Not Set"
 msgstr "未設置"
+
+msgid "Cipher Suites"
+msgstr "密碼套件"
+
+msgid "Configures the list of supported cipher suites, separated by :"
+msgstr "配置支援的密碼套件列表，以冒號 (:) 分隔。"
diff --git a/luci-app-passwall2/root/etc/uci-defaults/luci-passwall2 b/luci-app-passwall2/root/etc/uci-defaults/luci-passwall2
index 19ab146d..3f231894 100755
--- a/luci-app-passwall2/root/etc/uci-defaults/luci-passwall2
+++ b/luci-app-passwall2/root/etc/uci-defaults/luci-passwall2
@@ -53,6 +53,25 @@ frag_len=$(uci -q get passwall2.@global_xray[0].fragment_length)
 [ -n "$frag_len" ] && uci -q set passwall2.@global_xray[0].fragment_lengths="$frag_len" && uci -q delete passwall2.@global_xray[0].fragment_length
 frag_dly=$(uci -q get passwall2.@global_xray[0].fragment_delay)
 [ -n "$frag_dly" ] && uci -q set passwall2.@global_xray[0].fragment_delays="$frag_dly" && uci -q delete passwall2.@global_xray[0].fragment_delay
+
+for sid in $(uci show passwall2 | grep "=socks" | awk -F '.' '{print $2}' | awk -F '=' '{print $1}'); do
+	if [ -z "$(echo ${sid} | grep '^socks_')" ]; then
+		new_id="socks_$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 5)"
+		uci -q rename passwall2.${sid}="${new_id}"
+		unset sid new_id
+	fi
+done
+for sid in $(uci show passwall2 | grep "@acl_rule" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
+	new_id="acl_$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 5)"
+	uci -q rename passwall2.${sid}="${new_id}"
+	unset sid new_id
+done
+for sid in $(uci show passwall2 | grep "@subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
+	new_id="sub_$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 5)"
+	uci -q rename passwall2.${sid}="${new_id}"
+	unset sid new_id
+done
+
 uci -q commit passwall2
 
 sed -i "s#add_from#group#g" /etc/config/passwall2 2>/dev/null
diff --git a/luci-app-passwall2/root/usr/share/passwall2/app.sh b/luci-app-passwall2/root/usr/share/passwall2/app.sh
index 63fb6c83..ba5561cb 100755
--- a/luci-app-passwall2/root/usr/share/passwall2/app.sh
+++ b/luci-app-passwall2/root/usr/share/passwall2/app.sh
@@ -419,7 +419,7 @@ run_socks() {
 			json_add_string "logfile" "${log_file}"
 		}
 		[ -n "$no_run" ] && json_add_string "no_run" "1"
-		json_add_string "flag" "SOCKS_${flag}"
+		json_add_string "flag" "${flag}"
 		json_add_string "local_socks_address" "${bind}"
 		json_add_string "local_socks_port" "${socks_port}"
 		json_add_string "direct_dns_udp_port" "${DIRECT_DNS_UDP_PORT}"
@@ -441,7 +441,7 @@ run_socks() {
 			json_add_null "server_port"
 		}
 		[ -n "$no_run" ] && json_add_string "no_run" "1"
-		json_add_string "flag" "SOCKS_${flag}"
+		json_add_string "flag" "${flag}"
 		json_add_string "local_socks_address" "${bind}"
 		json_add_string "local_socks_port" "${socks_port}"
 		json_add_string "direct_dns_udp_port" "${DIRECT_DNS_UDP_PORT}"
@@ -535,13 +535,13 @@ socks_node_switch() {
 		local prefix pf filename
 		# Kill the SS plugin process
 		for prefix in "" "HTTP_"; do
-			pf="$TMP_PATH/${prefix}SOCKS_${flag}_plugin.pid"
+			pf="$TMP_PATH/${prefix}${flag}_plugin.pid"
 			[ -s "$pf" ] && kill -9 "$(head -n1 "$pf")" >/dev/null 2>&1
 		done
 
 		busybox pgrep -af "$TMP_BIN_PATH" | awk -v P1="${flag}" 'BEGIN{IGNORECASE=1}$0~P1 && !/acl\/|acl_/{print $1}' | xargs kill -9 >/dev/null 2>&1
 		for prefix in "" "HTTP_" "HTTP2"; do
-			rm -rf "$TMP_PATH/${prefix}SOCKS_${flag}"*
+			rm -rf "$TMP_PATH/${prefix}${flag}"*
 		done
 
 		for filename in $(ls ${TMP_SCRIPT_FUNC_PATH}); do
@@ -552,15 +552,15 @@ socks_node_switch() {
 		local bind="0.0.0.0"
 		[ "$bind_local" = "1" ] && bind="127.0.0.1"
 		local port=$(config_n_get $flag port)
-		local config_file="SOCKS_${flag}.json"
-		local log_file="SOCKS_${flag}.log"
+		local config_file="${flag}.json"
+		local log_file="${flag}.log"
 		local log=$(config_n_get $flag log 1)
 		[ "$log" == "0" ] && log_file=""
 		local http_port=$(config_n_get $flag http_port 0)
 		local http_config_file="HTTP2SOCKS_${flag}.json"
 		LOG_FILE="/dev/null"
 		run_socks flag=$flag node=$new_node bind=$bind socks_port=$port config_file=$config_file http_port=$http_port http_config_file=$http_config_file log_file=$log_file
-		set_cache_var "socks_${flag}" "$new_node"
+		set_cache_var "${flag}" "$new_node"
 		local USE_TABLES=$(get_cache_var "USE_TABLES")
 		[ -n "$USE_TABLES" ] && source $APP_PATH/${USE_TABLES}.sh filter_direct_node_list
 	}
@@ -764,14 +764,14 @@ start_socks() {
 				local bind="0.0.0.0"
 				[ "$bind_local" = "1" ] && bind="127.0.0.1"
 				local port=$(config_n_get $id port)
-				local config_file="SOCKS_${id}.json"
-				local log_file="SOCKS_${id}.log"
+				local config_file="${id}.json"
+				local log_file="${id}.log"
 				local log=$(config_n_get $id log 1)
 				[ "$log" == "0" ] && log_file=""
 				local http_port=$(config_n_get $id http_port 0)
 				local http_config_file="HTTP2SOCKS_${id}.json"
 				run_socks flag=$id node=$node bind=$bind socks_port=$port config_file=$config_file http_port=$http_port http_config_file=$http_config_file log_file=$log_file
-				set_cache_var "socks_${id}" "$node"
+				set_cache_var "${id}" "$node"
 
 				# Auto switch logic
 				local enable_autoswitch=$(config_n_get $id enable_autoswitch 0)
@@ -869,10 +869,9 @@ start_crontab() {
 	for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
 		sub_update_week_mode=$(config_n_get $item update_week_mode)
 		if [ -n "$sub_update_week_mode" ]; then
-			cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1)
 			remark=$(config_n_get $item remark)
 			sub_update_time_mode=$(config_n_get $item update_time_mode)
-			echo "$cfgid" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_time_mode}
+			echo "$item" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_time_mode}
 			log_i18n 0 "Scheduled tasks: Auto update [%s] subscription." "${remark}"
 		fi
 	done
@@ -1010,22 +1009,26 @@ run_ipset_dnsmasq() {
 
 acl_app() {
 	local items=$(uci show ${CONFIG} | grep "=acl_rule" | cut -d '.' -sf 2 | cut -d '=' -sf 1)
-	[ -n "$items" ] && {
+	if [ -z "$items" ]; then
+		ENABLED_ACLS=0
+		return
+	else
+		local has_enabled
 		local index=0
-		local item
+		local sid
 		local redir_port dns_port dnsmasq_port socks_port
 		local ipt_tmp msg msg2
 		redir_port=11200
 		socks_port=11600
 		dns_port=11300
 		dnsmasq_port=${GLOBAL_DNSMASQ_PORT:-11400}
-		for item in $items; do
+		for sid in $items; do
 			index=$(expr $index + 1)
 			local enabled sid remarks sources interface tcp_no_redir_ports udp_no_redir_ports node direct_dns_query_strategy remote_dns_protocol remote_dns remote_dns_doh remote_dns_client_ip remote_dns_detour remote_fakedns remote_dns_query_strategy log loglevel log_file
 			local _ip _mac _iprange _ipset _ip_or_mac source_list config_file
-			local sid=$(uci -q show "${CONFIG}.${item}" | grep "=acl_rule" | awk -F '=' '{print $1}' | awk -F '.' '{print $2}')
 			[ "$(config_n_get $sid enabled)" = "1" ] || continue
-			eval $(uci -q show "${CONFIG}.${item}" | cut -d'.' -sf 3-)
+			has_enabled=1
+			eval $(uci -q show "${CONFIG}.${sid}" | cut -d'.' -sf 3-)
 			log=${log:-0}
 			loglevel=${loglevel:-warn}
 			log_file="/dev/null"
@@ -1150,7 +1153,8 @@ acl_app() {
 			unset _ip _mac _iprange _ipset _ip_or_mac source_list config_file
 		done
 		unset redir_port dns_port dnsmasq_port
-	}
+		[ -n "${has_enabled}" ] || ENABLED_ACLS=0
+	fi
 }
 
 start() {
@@ -1209,8 +1213,7 @@ start() {
 		local cfgids item
 		for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
 			if [ "$(config_n_get "$item" boot_update 0)" = "1" ]; then
-				local cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1)
-				cfgids="${cfgids:+$cfgids,}$cfgid"
+				cfgids="${cfgids:+$cfgids,}$item"
 			fi
 		done
 		[ -n "$cfgids" ] && {
@@ -1298,9 +1301,6 @@ get_config() {
 		[ -n "$NODE" ] && [ "$(config_get_type $NODE)" == "nodes" ] && ENABLED_DEFAULT_ACL=1
 	}
 	ENABLED_ACLS=$(config_t_get global acl_enable 0)
-	[ "$ENABLED_ACLS" == 1 ] && {
-		[ "$(uci show ${CONFIG} | grep "@acl_rule" | grep "enabled='1'" | wc -l)" == 0 ] && ENABLED_ACLS=0
-	}
 	SOCKS_ENABLED=$(config_t_get global socks_enabled 0)
 	REDIR_PORT=$(echo $(get_new_port 1041 tcp,udp))
 	TCP_PROXY_WAY=$(config_t_get global_forwarding tcp_proxy_way redirect)
diff --git a/luci-app-passwall2/root/usr/share/passwall2/rule_update.lua b/luci-app-passwall2/root/usr/share/passwall2/rule_update.lua
index 18cb53bb..c6cb64c5 100755
--- a/luci-app-passwall2/root/usr/share/passwall2/rule_update.lua
+++ b/luci-app-passwall2/root/usr/share/passwall2/rule_update.lua
@@ -85,7 +85,7 @@ local function fetch_geofile(geo_name, geo_type, url)
 	local tmp_path = "/tmp/" .. geo_name
 	local asset_path = asset_location .. geo_name
 	local down_filename = url:match("^.*/([^/?#]+)")
-	local sha_url = url:gsub(down_filename, down_filename .. ".sha256sum")
+	local sha_url = url:gsub((down_filename:gsub("(%W)", "%%%1")), down_filename .. ".sha256sum")
 	local sha_path = tmp_path .. ".sha256sum"
 
 	local function verify_sha256(sha_file)
diff --git a/luci-app-passwall2/root/usr/share/passwall2/socks_auto_switch.sh b/luci-app-passwall2/root/usr/share/passwall2/socks_auto_switch.sh
index 36fda212..d0f8be9a 100755
--- a/luci-app-passwall2/root/usr/share/passwall2/socks_auto_switch.sh
+++ b/luci-app-passwall2/root/usr/share/passwall2/socks_auto_switch.sh
@@ -77,8 +77,8 @@ test_auto_switch() {
 	local b_nodes=$1
 	local now_node=$2
 	[ -z "$now_node" ] && {
-		if [ -n "$(get_cache_var "socks_${id}")" ]; then
-			now_node=$(get_cache_var "socks_${id}")
+		if [ -n "$(get_cache_var "${id}")" ]; then
+			now_node=$(get_cache_var "${id}")
 		else
 			#log_i18n 0 "Socks switch detection: Unknown error."
 			return 1
diff --git a/luci-app-passwall2/root/usr/share/passwall2/subscribe.lua b/luci-app-passwall2/root/usr/share/passwall2/subscribe.lua
index 56464045..97cf756b 100755
--- a/luci-app-passwall2/root/usr/share/passwall2/subscribe.lua
+++ b/luci-app-passwall2/root/usr/share/passwall2/subscribe.lua
@@ -168,10 +168,10 @@ do
 				local flag = i18n.translatef("Socks node list [%s]", i) .. " " .. i18n.translatef("Backup node list")
 				local currentNodes = {}
 				local newNodes = {}
-				for k, node_id in ipairs(t.autoswitch_backup_node) do
-					if node_id then
-						local currentNode = uci:get_all(appname, node_id) or nil
-						if currentNode then
+				for k, asb_node in ipairs(t.autoswitch_backup_node) do
+					if asb_node then
+						local currentNode = uci:get_all(appname, asb_node) or {}
+						if currentNode[".type"] == "nodes" then
 							currentNodes[#currentNodes + 1] = {
 								log = true,
 								remarks = flag .. "[" .. k .. "]",
@@ -276,36 +276,39 @@ do
 
 			for k, e in pairs(rules) do
 				local _node_id = node[e[".name"]] or nil
-				if _node_id and not _node_id:find("Socks_") then
-					CONFIG[#CONFIG + 1] = {
-						log = false,
-						currentNode = _node_id and uci:get_all(appname, _node_id) or nil,
-						remarks = i18n.translatef("Shunt [%s] node", e.remarks),
-						set = function(o, server)
-							if not server then server = "" end
-							uci:set(appname, node_id, e[".name"], server)
-							o.newNodeId = server
-						end
-					}
+				if _node_id then
+					local section = uci:get_all(appname, node_id) or {}
+					if section[".type"] == "nodes" then
+						CONFIG[#CONFIG + 1] = {
+							log = false,
+							currentNode = section,
+							remarks = i18n.translatef("Shunt [%s] node", e.remarks),
+							set = function(o, server)
+								if not server then server = "" end
+								uci:set(appname, node_id, e[".name"], server)
+								o.newNodeId = server
+							end
+						}
+					end
 				end
-				
 			end
 		elseif node.protocol and node.protocol == '_balancing' then
 			local flag = i18n.translatef("Xray Load Balancing node [%s] list", node_id)
 			local currentNodes = {}
 			local newNodes = {}
 			if node.balancing_node then
-				for k, node in pairs(node.balancing_node) do
+				for k, b_node_id in pairs(node.balancing_node) do
 					currentNodes[#currentNodes + 1] = {
 						log = true,
-						node = node,
+						node = b_node_id,
 						currentNode = (function()
-							if node and node:find("Socks_") then
-								return { Socks = node }
+							local section = uci:get_all(appname, b_node_id) or {}
+							if section[".type"] == "socks" then
+								return { Socks = b_node_id }
 							end
-							return node and uci:get_all(appname, node) or nil
+							return section
 						end)(),
-						remarks = node,
+						remarks = b_node_id,
 						set = function(o, server)
 							if o and server and server ~= "nil" then
 								table.insert(o.newNodes, server)
@@ -328,37 +331,41 @@ do
 
 			-- Backup Node
 			local currentNode = uci:get_all(appname, node_id) or nil
-			if currentNode and currentNode.fallback_node and not currentNode.fallback_node:find("Socks_") then
-				CONFIG[#CONFIG + 1] = {
-					log = true,
-					id = node_id,
-					remarks = i18n.translatef("Xray Load Balancing node [%s] backup node", node_id),
-					currentNode = uci:get_all(appname, currentNode.fallback_node) or nil,
-					set = function(o, server)
-						uci:set(appname, node_id, "fallback_node", server)
-						o.newNodeId = server
-					end,
-					delete = function(o)
-						uci:delete(appname, node_id, "fallback_node")
-					end
-				}
+			if currentNode and currentNode.fallback_node then
+				local section = uci:get_all(appname, currentNode.fallback_node) or {}
+				if section[".type"] == "nodes" then
+					CONFIG[#CONFIG + 1] = {
+						log = true,
+						id = node_id,
+						remarks = i18n.translatef("Xray Load Balancing node [%s] backup node", node_id),
+						currentNode = section,
+						set = function(o, server)
+							uci:set(appname, node_id, "fallback_node", server)
+							o.newNodeId = server
+						end,
+						delete = function(o)
+							uci:delete(appname, node_id, "fallback_node")
+						end
+					}
+				end
 			end
 		elseif node.protocol and node.protocol == '_urltest' then
 			local flag = i18n.translatef("Sing-Box URLTest node [%s] list", node_id)
 			local currentNodes = {}
 			local newNodes = {}
 			if node.urltest_node then
-				for k, node in pairs(node.urltest_node) do
+				for k, u_node_id in pairs(node.urltest_node) do
 					currentNodes[#currentNodes + 1] = {
 						log = true,
-						node = node,
+						node = u_node_id,
 						currentNode = (function()
-							if node and node:find("Socks_") then
-								return { Socks = node }
+							local section = uci:get_all(appname, u_node_id) or {}
+							if section[".type"] == "socks" then
+								return { Socks = u_node_id }
 							end
-							return node and uci:get_all(appname, node) or nil
+							return section
 						end)(),
-						remarks = node,
+						remarks = u_node_id,
 						set = function(o, server)
 							if o and server and server ~= "nil" then
 								table.insert(o.newNodes, server)
@@ -381,37 +388,43 @@ do
 		else
 			-- Preproxy Node
 			local currentNode = uci:get_all(appname, node_id) or nil
-			if currentNode and currentNode.preproxy_node and not currentNode.preproxy_node:find("Socks_") then
-				CONFIG[#CONFIG + 1] = {
-					log = true,
-					id = node_id,
-					remarks = i18n.translatef("Node [%s] preproxy node", node_id),
-					currentNode = uci:get_all(appname, currentNode.preproxy_node) or nil,
-					set = function(o, server)
-						uci:set(appname, node_id, "preproxy_node", server)
-						o.newNodeId = server
-					end,
-					delete = function(o)
-						uci:delete(appname, node_id, "preproxy_node")
-					end
-				}
+			if currentNode and currentNode.preproxy_node then
+				local section = uci:get_all(appname, currentNode.preproxy_node) or {}
+				if section[".type"] == "nodes" then
+					CONFIG[#CONFIG + 1] = {
+						log = true,
+						id = node_id,
+						remarks = i18n.translatef("Node [%s] preproxy node", node_id),
+						currentNode = uci:get_all(appname, currentNode.preproxy_node) or nil,
+						set = function(o, server)
+							uci:set(appname, node_id, "preproxy_node", server)
+							o.newNodeId = server
+						end,
+						delete = function(o)
+							uci:delete(appname, node_id, "preproxy_node")
+						end
+					}
+				end
 			end
 			-- Landing node
 			local currentNode = uci:get_all(appname, node_id) or nil
-			if currentNode and currentNode.to_node and not currentNode.to_node:find("Socks_") then
-				CONFIG[#CONFIG + 1] = {
-					log = true,
-					id = node_id,
-					remarks = i18n.translatef("Node [%s] landing node", node_id),
-					currentNode = uci:get_all(appname, currentNode.to_node) or nil,
-					set = function(o, server)
-						uci:set(appname, node_id, "to_node", server)
-						o.newNodeId = server
-					end,
-					delete = function(o)
-						uci:delete(appname, node_id, "to_node")
-					end
-				}
+			if currentNode and currentNode.to_node then
+				local section = uci:get_all(appname, currentNode.to_node) or {}
+				if section[".type"] == "nodes" then
+					CONFIG[#CONFIG + 1] = {
+						log = true,
+						id = node_id,
+						remarks = i18n.translatef("Node [%s] landing node", node_id),
+						currentNode = uci:get_all(appname, currentNode.to_node) or nil,
+						set = function(o, server)
+							uci:set(appname, node_id, "to_node", server)
+							o.newNodeId = server
+						end,
+						delete = function(o)
+							uci:delete(appname, node_id, "to_node")
+						end
+					}
+				end
 			end
 		end
 	end)
diff --git a/luci-app-passwall2/root/usr/share/passwall2/tasks.sh b/luci-app-passwall2/root/usr/share/passwall2/tasks.sh
index d89c7f99..392d85e3 100755
--- a/luci-app-passwall2/root/usr/share/passwall2/tasks.sh
+++ b/luci-app-passwall2/root/usr/share/passwall2/tasks.sh
@@ -40,10 +40,9 @@ do
 		for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
 			sub_update_week_mode=$(config_n_get $item update_week_mode)
 			if [ -n "$sub_update_week_mode" ]; then
-				cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1)
 				remark=$(config_n_get $item remark)
 				sub_update_interval_mode=$(config_n_get $item update_interval_mode)
-				echo "$cfgid" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_interval_mode}
+				echo "$item" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_interval_mode}
 			fi
 		done