update 2026-09-12 22:51:39

luci-app-ssr-plus/root/etc/init.d/shadowsocksr

@@ -608,6 +608,7 @@ prepare_clash_runtime_config() {
 	local dns_mode
 	local client_policy_stats
 	local client_rules
+	local enable_fake_ip
 
 	cache_file="$(get_clash_cache_file "$sid")"
 	workdir="$(get_clash_workdir "$sid")"
@@ -623,6 +624,7 @@ prepare_clash_runtime_config() {
 	dns_mode="$(uci_get_by_type global pdnsd_enable 0)"
 	client_policy_stats=""
 	client_rules=0
+	enable_fake_ip="$(uci_get_by_type server_subscribe enable_fake_ip "")"
 
 	[ -s "$cache_file" ] || return 1
 
@@ -640,15 +642,33 @@ prepare_clash_runtime_config() {
 		routing-mark: $CLASH_OUTBOUND_MARK
 		profile:
 		  store-selected: true
+		  store-fake-ip: true
 		tun:
 		  enable: false
-		dns:
-		  enable: $( [ "$dns_mode" = "7" ] && echo "true" || echo "false" )
-		  enhanced-mode: redir-host
-		  listen: 127.0.0.1:$dns_port
-		  ipv6: $( [ "$dns_ipv4_only" = "1" ] && echo "false" || echo "true" )
 	EOF
 
+	# 根据 dns_mode 添加不同的 dns 配置
+	if [ "$dns_mode" = "7" ]; then
+		# 根据 enable_fake_ip 决定 enhanced-mode
+		if [ "$enable_fake_ip" = "1" ]; then
+			ENHANCED_MODE="fake-ip"
+		else
+			ENHANCED_MODE="redir-host"
+		fi
+		cat >> "$overlay_file" <<-EOF
+			dns:
+			  enable: true
+			  enhanced-mode: $ENHANCED_MODE
+			  listen: 127.0.0.1:$dns_port
+			  ipv6: $( [ "$dns_ipv4_only" = "1" ] && echo "false" || echo "true" )
+		EOF
+	else
+		cat >> "$overlay_file" <<-EOF
+			dns:
+			  enable: false
+		EOF
+	fi
+
 	if [ -n "$socks_port" ] && [ "$socks_port" != "0" ]; then
 		echo "socks-port: $socks_port" >>"$overlay_file"
 	fi
@@ -1230,14 +1250,24 @@ start_dns() {
 	ssrplus_dns="$(uci_get_by_type global pdnsd_enable 0)"
 	global_server_type="$(uci_get_by_name "$GLOBAL_SERVER" type)"
 	builtin_dns_enabled=0
-	dnsserver="$(uci_get_by_type global tunnel_forward 8.8.4.4:53)"
 
 	if [ "$ssrplus_dns" = "5" ]; then
 		ssrplus_dns="$(force_dns2tcp_fallback "旧版 DNSPROXY 模式已移除")" || return 1
 		uci_set_by_type global pdnsd_enable "$ssrplus_dns"
-	elif [ "$ssrplus_dns" = "6" ]; then
-		dnsserver="$(uci_get_by_type global chinadns_ng_tunnel_forward 8.8.4.4:53)"
 	fi
+	case "$ssrplus_dns" in
+		1)
+			dnsserver="$(uci_get_by_type global dns2tcp_tunnel_forward 8.8.4.4:53)"
+		;;
+		6)
+			dnsserver="$(uci_get_by_type global chinadns_ng_tunnel_forward 8.8.4.4:53)"
+		;;
+		7)
+			dnsserver="$(uci_get_by_type global tunnel_forward 8.8.4.4:53)"
+		;;
+		*)
+			;;
+	esac
 	run_mode="$(normalize_run_mode)"
 
 	if [ "$ssrplus_dns" = "4" ] && ! is_finded "mosdns"; then
@@ -1503,15 +1533,15 @@ generate_xray_config() {
 		{
 			"log": {
 				"loglevel": "warning"
-		},
-		"inbounds": [$inbound_json],
-		"outbounds": [
-			{
-				"protocol": "freedom",
-				"settings": {}
-			}
-		]
-	}
+			},
+			"inbounds": [$inbound_json],
+			"outbounds": [
+				{
+					"protocol": "freedom",
+					"settings": {}
+				}
+			]
+		}
 	EOF
 	return 0
 }
@@ -2887,12 +2917,18 @@ start_rules() {
 	local ac_ips
 	local custom_ports
 	local proxyport
+	local enable_fake_ip
 
 	server=$(get_host_ip "$GLOBAL_SERVER")
 	local_port=$(get_default_node_local_port)
 	lan_ac_ips=$(uci_get_by_type access_control lan_ac_ips)
 	lan_ac_mode=$(uci_get_by_type access_control lan_ac_mode)
 
+	enable_fake_ip=$(uci_get_by_type server_subscribe enable_fake_ip "")
+	if [ -z "$enable_fake_ip" ]; then
+		enable_fake_ip="0"
+	fi
+
 	if [ "$kcp_enable_flag" = "0" ] && [ "$redir_udp" = "1" ]; then
 		udp_server=$(get_host_ip "$UDP_RELAY_SERVER")
 		udp_local_port=$tmp_udp_port
@@ -2937,26 +2973,27 @@ start_rules() {
 		fi
 	elif [ "$USE_TABLES" = "iptables" ]; then
 		ARG_A=""
-		fi
-		/usr/share/shadowsocksr/gfw2ipset.sh
-		/usr/bin/ssr-rules \
-			-s "$server" \
-			-l "$local_port" \
-			-S "$udp_server" \
-			-L "$udp_local_port" \
-			-a "$ac_ips" \
-			-i "/etc/ssrplus/china_ssr.txt" \
-			-b "$(uci_get_by_type access_control wan_bp_ips)" \
-			-w "$(uci_get_by_type access_control wan_fw_ips)" \
-			-B "$(uci_get_by_type access_control lan_bp_ips)" \
-			-p "$(uci_get_by_type access_control lan_fp_ips)" \
-			-G "$(uci_get_by_type access_control lan_gm_ips)" \
-			-m "$(uci_get_by_type access_control Interface)" \
-			-D "$proxyport" \
-			"$(get_arg_out)" "$(gfwmode)" "$ARG_UDP" "$ARG_UDP_RULES" "$ARG_A"
+	fi
+	/usr/share/shadowsocksr/gfw2ipset.sh
+	/usr/bin/ssr-rules \
+		-s "$server" \
+		-l "$local_port" \
+		-S "$udp_server" \
+		-L "$udp_local_port" \
+		-a "$ac_ips" \
+		-i "/etc/ssrplus/china_ssr.txt" \
+		-b "$(uci_get_by_type access_control wan_bp_ips)" \
+		-w "$(uci_get_by_type access_control wan_fw_ips)" \
+		-B "$(uci_get_by_type access_control lan_bp_ips)" \
+		-p "$(uci_get_by_type access_control lan_fp_ips)" \
+		-G "$(uci_get_by_type access_control lan_gm_ips)" \
+		-m "$(uci_get_by_type access_control Interface)" \
+		-D "$proxyport" \
+		-E "$enable_fake_ip" \
+		"$(get_arg_out)" "$(gfwmode)" "$ARG_UDP" "$ARG_UDP_RULES" "$ARG_A"
 
-		return $?
-	}
+	return $?
+}
 
 start() {
 	local run_mode

luci-app-ssr-plus/root/etc/ssrplus/fake_ip_filter.list

@@ -0,0 +1,78 @@
+*.lan
+*.localdomain
+*.example
+*.invalid
+*.localhost
+*.test
+*.local
+*.home.arpa
+time.*.com
+time.*.gov
+time.*.edu.cn
+time.*.apple.com
+time1.*.com
+time2.*.com
+time3.*.com
+time4.*.com
+time5.*.com
+time6.*.com
+time7.*.com
+ntp.*.com
+ntp1.*.com
+ntp2.*.com
+ntp3.*.com
+ntp4.*.com
+ntp5.*.com
+ntp6.*.com
+ntp7.*.com
+*.time.edu.cn
+*.ntp.org.cn
++.pool.ntp.org
+time1.cloud.tencent.com
+stun.*.*
+stun.*.*.*
+swscan.apple.com
+mesu.apple.com
+music.163.com
+*.music.163.com
+*.126.net
+musicapi.taihe.com
+music.taihe.com
+songsearch.kugou.com
+trackercdn.kugou.com
+*.kuwo.cn
+api-jooxtt.sanook.com
+api.joox.com
+y.qq.com
+*.y.qq.com
+streamoc.music.tc.qq.com
+mobileoc.music.tc.qq.com
+isure.stream.qqmusic.qq.com
+dl.stream.qqmusic.qq.com
+aqqmusic.tc.qq.com
+amobile.music.tc.qq.com
+localhost.ptlogin2.qq.com
+*.msftconnecttest.com
+*.msftncsi.com
+*.xiami.com
+*.music.migu.cn
+music.migu.cn
++.wotgame.cn
++.wggames.cn
++.wowsgame.cn
++.wargaming.net
+*.*.*.srv.nintendo.net
+*.*.stun.playstation.net
+xbox.*.*.microsoft.com
+*.*.xboxlive.com
+*.ipv6.microsoft.com
+teredo.*.*.*
+teredo.*.*
+speedtest.cros.wr.pvp.net
++.jjvip8.com
+www.douyu.com
+activityapi.huya.com
+activityapi.huya.com.w.cdngslb.com
+www.bilibili.com
+api.bilibili.com
+a.w.bilicdn1.com

luci-app-ssr-plus/root/etc/ssrplus/fallback_domain.list

@@ -0,0 +1,9 @@
++.google.com
++.facebook.com
++.youtube.com
++.twitter.com
++.telegram.org
++.githubusercontent.com
++.googlevideo.com
++.msftconnecttest.com
++.msftncsi.com

luci-app-ssr-plus/root/etc/ssrplus/fallback_ipcidr.list

@@ -0,0 +1,15 @@
+0.0.0.0/8
+10.0.0.0/8
+100.64.0.0/10
+127.0.0.0/8
+169.254.0.0/16
+172.16.0.0/12
+192.0.0.0/24
+192.0.2.0/24
+192.88.99.0/24
+192.168.0.0/16
+198.51.100.0/24
+203.0.113.0/24
+224.0.0.0/4
+240.0.0.0/4
+255.255.255.255/32

luci-app-ssr-plus/root/etc/uci-defaults/luci-ssr-plus

@@ -39,6 +39,18 @@ if [ -s "/etc/config/shadowsocksr" ]; then
         uci -q set shadowsocksr.@server_subscribe[0].auto_update_min_time='0'
     fi
 
+    if ! uci -q get shadowsocksr.@server_subscribe[0].enable_mihomo > /dev/null; then
+        uci -q set shadowsocksr.@server_subscribe[0].enable_mihomo='1'
+    fi
+
+    if ! uci -q get shadowsocksr.@server_subscribe[0].enable_fake_ip > /dev/null; then
+        uci -q set shadowsocksr.@server_subscribe[0].enable_fake_ip='1'
+    fi
+
+    if ! uci -q get shadowsocksr.@server_subscribe[0].sub_convert > /dev/null; then
+        uci -q set shadowsocksr.@server_subscribe[0].sub_convert='1'
+    fi
+
     if ! uci -q get shadowsocksr.@server_subscribe[0].config_auto_update_mode > /dev/null; then
         uci -q set shadowsocksr.@server_subscribe[0].config_auto_update_mode='0'
     fi

luci-app-ssr-plus/root/usr/bin/ssr-rules

@@ -46,6 +46,7 @@ CHECK_STATUS=0
 RESTORE_RULES=0
 FLUSH_RULES=0
 CLEANUP_PERSISTENCE=0
+ENABLE_FAKE_IP=0
 # ASCII code for SSRP.Use whatever,just not the same.
 FWMARK="0x53535250"
 
@@ -83,14 +84,15 @@ usage() {
 		    -m <Interface>          Interface name
 		    -I <ip_list_file>       a file content is bypassed shunt ip list
 		    -e <extra_options>      extra options for iptables
+		    -E <0|1>				enable_fake_ip status
 		    -o                      apply the rules to the OUTPUT chain
 		    -O                      apply the global rules to the OUTPUT chain
-			    -u                      enable udprelay mode, TPROXY is required
-			    -U                      enable udprelay mode, using different IP
-			                            and ports for TCP and UDP
-			    -y                      disable all auxiliary UDP rules when UDP
-			                            transparent proxy is unavailable
-			    -f                      flush the rules
+		    -u                      enable udprelay mode, TPROXY is required
+		    -U                      enable udprelay mode, using different IP
+			                        and ports for TCP and UDP
+		    -y                      disable all auxiliary UDP rules when UDP
+			                        transparent proxy is unavailable
+		    -f                      flush the rules
 		    -g                      gfwlist mode
 		    -r                      router mode
 		    -z                      all mode
@@ -232,6 +234,12 @@ cleanup_persistence_files() {
 		loger 5 "Removed xhttp hash file: /tmp/.last_xhttp_hash"
 	fi
 
+	# Remove Fake_IP Mode state file
+	if [ -f "$ENABLE_FAKE_IP_STATE_FILE" ]; then
+		rm -f "$ENABLE_FAKE_IP_STATE_FILE" 2>/dev/null
+		loger 5 "Removed Fake_IP Mode state file: $ENABLE_FAKE_IP_STATE_FILE"
+	fi
+
 	loger 5 "Persistence cleanup completed"
 	return 0
 }
@@ -315,25 +323,64 @@ flush_nftables() {
 
 flush_iptables_legacy() {
 	flush_iptables() {
-		local ipt="iptables -t $1"
-		local DAT=$(iptables-save -t $1)
-		eval $(echo "$DAT" | grep "$TAG" | sed -e 's/^-A/$ipt -D/' -e 's/$/;/')
-		for chain in $(echo "$DAT" | awk '/^:SS_SPEC/{print $1}'); do
-			$ipt -F ${chain:1} 2>/dev/null && $ipt -X ${chain:1}
+		local table=$1
+		local ipt="iptables -t $table"
+		local DAT
+
+		DAT=$(iptables-save -t $table 2>/dev/null)
+
+		[ -z "$DAT" ] && return 0
+
+		# 1. 解除所有引用 SS_SPEC* 链的规则
+		echo "$DAT" | grep -E "^-A .*SS_SPEC" | while read -r line; do
+			local chain rule
+			chain=$(echo "$line" | awk '{print $2}')
+			rule=$(echo "$line" | sed 's/^-A [^ ]* //')
+			[ -n "$chain" ] && [ -n "$rule" ] && \
+				eval "$ipt -D \"$chain\" $rule 2>/dev/null"
 		done
+
+		# 2. 删除带 TAG 或 mark 的残留规则（同样加上 eval）
+		echo "$DAT" | grep -E "^-A " | grep -E "$TAG|-m mark|--mark" | while read -r line; do
+			local chain rule
+			chain=$(echo "$line" | awk '{print $2}')
+			rule=$(echo "$line" | sed 's/^-A [^ ]* //')
+			[ -n "$chain" ] && [ -n "$rule" ] && \
+				eval "$ipt -D \"$chain\" $rule 2>/dev/null"
+		done
+
+		# 3. 提取所有以 SS_SPEC 开头的自定义链
+		local chains
+		chains=$(echo "$DAT" | awk '/^:SS_SPEC/{sub(/^:/,"",$1); print $1}')
+
+		# 4. 清空并彻底删除 SS_SPEC* 自定义链
+		for chain in $chains; do
+			$ipt -F "$chain" 2>/dev/null
+			$ipt -X "$chain" 2>/dev/null
+		done
+
+		return 0
 	}
+
+	# 依次对 nat 和 mangle 表执行清理
 	flush_iptables nat
 	flush_iptables mangle
-	if ip rule show | grep -Eq "fwmark ${FWMARK}.*lookup 999"; then
+
+	# 清理策略路由与路由表
+	if ip rule show | grep -Eiq "fwmark ${FWMARK}.*lookup 999"; then
 		ip rule del fwmark ${FWMARK} table 999 2>/dev/null
 	fi
 	if ip route show table 999 | grep -Eq "^local.*dev lo"; then
 		ip route del local 0.0.0.0/0 dev lo table 999 2>/dev/null
 	fi
+
+	# 清理 IPSET 集合（先 -F 清空，后 -X 销毁）
 	for setname in ss_spec_lan_ac ss_spec_wan_ac ssr_gen_router \
 			china fplan bplan gmlan whitelist blacklist gfwlist music; do
+		ipset -F $setname 2>/dev/null
 		ipset -X $setname 2>/dev/null
 	done
+
 	[ -n "$FWI" ] && echo '#!/bin/sh' >$FWI
 	return 0
 }
@@ -524,6 +571,11 @@ fw_rule() {
 }
 
 fw_rule_nft() {
+	# 优先将 Fake-IP (198.18.0.0/16) 的 TCP 流量重定向至代理端口
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		$NFT add rule inet ss_spec ss_spec_wan_fw ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+	fi
+
 	# redirect/translation: when PROXY_PORTS present, redirect those tcp ports to local_port
 	if [ -n "$PROXY_PORTS" ]; then
 		PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
@@ -559,6 +611,10 @@ fw_rule_iptables() {
 		$IPT -A SS_SPEC_WAN_FW -d "$net" -j RETURN
 	done
 
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		$IPT -A SS_SPEC_WAN_FW -d 198.18.0.0/16 -p tcp -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+	fi
+
 	$IPT -A SS_SPEC_WAN_FW -p tcp $PROXY_PORTS -j REDIRECT --to-ports "$local_port" 2>/dev/null || {
 		loger 3 "Can't redirect TCP, please check the iptables."
 		exit 1
@@ -611,6 +667,33 @@ ac_rule_nft() {
 	fi
 	$NFT flush chain inet ss_spec ss_spec_prerouting 2>/dev/null
 
+	# Fake-IP 重定向处理 (引入 Interface 匹配，防止 WAN 口越权)
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		if [ -z "$Interface" ]; then
+			if [ -n "$MATCH_SET" ]; then
+				$NFT add rule inet ss_spec ss_spec_prerouting ip daddr 198.18.0.0/16 $MATCH_SET meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+				$NFT add rule inet ss_spec ss_spec_prerouting ip daddr 198.18.0.0/16 $MATCH_SET meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+			else
+				$NFT add rule inet ss_spec ss_spec_prerouting ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+				$NFT add rule inet ss_spec ss_spec_prerouting ip daddr 198.18.0.0/16 meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+			fi
+		else
+			for name in $Interface; do
+				local IFNAME=$(uci -P /var/state get network."$name".ifname 2>/dev/null)
+				[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
+				if [ -n "$IFNAME" ]; then
+					if [ -n "$MATCH_SET" ]; then
+						$NFT add rule inet ss_spec ss_spec_prerouting meta iifname "$IFNAME" ip daddr 198.18.0.0/16 $MATCH_SET meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+						$NFT add rule inet ss_spec ss_spec_prerouting meta iifname "$IFNAME" ip daddr 198.18.0.0/16 $MATCH_SET meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+					else
+						$NFT add rule inet ss_spec ss_spec_prerouting meta iifname "$IFNAME" ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+						$NFT add rule inet ss_spec ss_spec_prerouting meta iifname "$IFNAME" ip daddr 198.18.0.0/16 meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+					fi
+				fi
+			done
+		fi
+	fi
+
 	# Exclude special local addresses
 	if $NFT list chain inet ss_spec ss_spec_prerouting >/dev/null 2>&1; then
 		for net in 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4; do
@@ -625,16 +708,6 @@ ac_rule_nft() {
 	#	done
 	#fi
 
-	# Build a rule in the prerouting hook chain that jumps to business chain with conditions
-	if [ -n "$PROXY_PORTS" ]; then
-		PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
-		if [ -n "$PORTS_ARGS" ]; then
-			TCP_EXT_ARGS="meta l4proto tcp tcp dport { $PORTS_ARGS }"
-		fi
-	else
-		TCP_EXT_ARGS="meta l4proto tcp"
-	fi
-
 	# Block UDP port 443 when TPROXY not Enable
 	if [ -z "$TPROXY" ] && [ "$DISABLE_UDP_RULES" != "1" ]; then
 		# Add UDP 443 block rule
@@ -658,6 +731,17 @@ ac_rule_nft() {
 			done
 		fi
 	fi
+
+	# Build a rule in the prerouting hook chain that jumps to business chain with conditions
+	if [ -n "$PROXY_PORTS" ]; then
+		PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
+		if [ -n "$PORTS_ARGS" ]; then
+			TCP_EXT_ARGS="meta l4proto tcp tcp dport { $PORTS_ARGS }"
+		fi
+	else
+		TCP_EXT_ARGS="meta l4proto tcp"
+	fi
+
 	if [ -z "$Interface" ]; then
 		# generic prerouting jump already exists (see ipset_nft), but if we have MATCH_SET_CONDITION we add a more specific rule
 		if [ -n "$MATCH_SET" ]; then
@@ -683,11 +767,16 @@ ac_rule_nft() {
 	case "$OUTPUT" in
 	1)
 		# Create ss_spec_output tcp chain
-			if ! $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
-				$NFT add chain inet ss_spec ss_spec_output '{ type nat hook output priority 0; policy accept; }'
-			fi
-			$NFT flush chain inet ss_spec ss_spec_output 2>/dev/null
-			$NFT add rule inet ss_spec ss_spec_output meta mark 255 return 2>/dev/null
+		if ! $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
+			$NFT add chain inet ss_spec ss_spec_output '{ type nat hook output priority 0; policy accept; }'
+		fi
+		$NFT flush chain inet ss_spec ss_spec_output 2>/dev/null
+		$NFT add rule inet ss_spec ss_spec_output meta mark 255 return 2>/dev/null
+
+		if [ "$ENABLE_FAKE_IP" = "1" ]; then
+			$NFT add rule inet ss_spec ss_spec_output ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+			$NFT add rule inet ss_spec ss_spec_output ip daddr 198.18.0.0/16 meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+		fi
 		
 		# Exclude special local addresses
 		if $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
@@ -708,11 +797,16 @@ ac_rule_nft() {
 		;;
 	2)
 		# Create ss_spec_output tcp chain
-			if ! $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
-				$NFT add chain inet ss_spec ss_spec_output '{ type nat hook output priority 0; policy accept; }'
-			fi
-			$NFT flush chain inet ss_spec ss_spec_output 2>/dev/null
-			$NFT add rule inet ss_spec ss_spec_output meta mark 255 return 2>/dev/null
+		if ! $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
+			$NFT add chain inet ss_spec ss_spec_output '{ type nat hook output priority 0; policy accept; }'
+		fi
+		$NFT flush chain inet ss_spec ss_spec_output 2>/dev/null
+		$NFT add rule inet ss_spec ss_spec_output meta mark 255 return 2>/dev/null
+
+		if [ "$ENABLE_FAKE_IP" = "1" ]; then
+			$NFT add rule inet ss_spec ss_spec_output ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+			$NFT add rule inet ss_spec ss_spec_output ip daddr 198.18.0.0/16 meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+		fi
 		
 		# Exclude special local addresses
 		if $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
@@ -754,11 +848,38 @@ ac_rule_iptables() {
 			return 2
 			;;
 		esac
+
+		local ip_list="${LAN_AC_IP#?}"
+		ipset -! create ss_spec_lan_ac hash:net 2>/dev/null
+		ipset flush ss_spec_lan_ac 2>/dev/null
+		if [ -n "$ip_list" ]; then
+			for ip in $ip_list; do
+				ipset add ss_spec_lan_ac "$ip" 2>/dev/null
+			done
+		fi
+	fi
+
+	# 2. PREROUTING 链处理
+	if [ -z "$Interface" ]; then
+		# Global rules
+		if [ -n "$MATCH_SET" ]; then
+			$IPT -I PREROUTING 1 -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		else
+			$IPT -I PREROUTING 1 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		fi
+	else
+		for name in $Interface; do
+			local IFNAME=$(uci -P /var/state get network."$name".ifname 2>/dev/null)
+			[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
+			if [ -n "$IFNAME" ]; then
+				if [ -n "$MATCH_SET" ]; then
+					$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+				else
+					$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+				fi
+			fi
+		done
 	fi
-	ipset -! -R <<-EOF || return 1
-		create ss_spec_lan_ac hash:net
-		$(for ip in ${LAN_AC_IP#?}; do echo "add ss_spec_lan_ac $ip"; done)
-	EOF
 
 	# Block UDP port 443 when TPROXY not Enable
 	if [ -z "$TPROXY" ] && [ "$DISABLE_UDP_RULES" != "1" ]; then
@@ -784,42 +905,67 @@ ac_rule_iptables() {
 			done
 		fi
 	fi
-	if [ -z "$Interface" ]; then
-		# Global rules
-		if [ -n "$MATCH_SET" ]; then
-			$IPT -I PREROUTING 1 -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
-		else
-			$IPT -I PREROUTING 1 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
-		fi
-	else
-		for name in $Interface; do
-			local IFNAME=$(uci -P /var/state get network."$name".ifname 2>/dev/null)
-			[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
-			if [ -n "$IFNAME" ]; then
-				if [ -n "$MATCH_SET" ]; then
-					$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
-				else
-					$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
-				fi
+
+	# 拦截 Fake-IP 流量 (198.18.0.0/16)，受 Interface 和 LAN_AC 控制
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		if [ -z "$Interface" ]; then
+			if [ -n "$MATCH_SET" ]; then
+				$IPT -I PREROUTING 1 -p tcp -d 198.18.0.0/16 $MATCH_SET -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+				$IPT -I PREROUTING 2 -p udp -d 198.18.0.0/16 $MATCH_SET -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			else
+				$IPT -I PREROUTING 1 -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+				$IPT -I PREROUTING 2 -p udp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
 			fi
-		done
+		else
+			for name in $Interface; do
+				local IFNAME=$(uci -P /var/state get network."$name".ifname 2>/dev/null)
+				[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
+				if [ -n "$IFNAME" ]; then
+					if [ -n "$MATCH_SET" ]; then
+						$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp -d 198.18.0.0/16 $MATCH_SET -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+						$IPT -I PREROUTING 2 ${IFNAME:+-i $IFNAME} -p udp -d 198.18.0.0/16 $MATCH_SET -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+					else
+						$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+						$IPT -I PREROUTING 2 ${IFNAME:+-i $IFNAME} -p udp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+					fi
+				fi
+			done
+		fi
 	fi
 
 	case "$OUTPUT" in
 	1)
-		$IPT -I OUTPUT 1 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		# fake-ip first
+		if [ "$ENABLE_FAKE_IP" = "1" ]; then
+			$IPT -I OUTPUT 1 -m mark --mark 255 -j RETURN 2>/dev/null
+			$IPT -I OUTPUT 2 -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			$IPT -I OUTPUT 3 -p udp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			$IPT -I OUTPUT 4 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		else
+			$IPT -I OUTPUT 1 -m mark --mark 255 -j RETURN 2>/dev/null
+			$IPT -I OUTPUT 2 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		fi
 		;;
 	2)
 		ipset -! -R <<-EOF || return 1
 			create ssr_gen_router hash:net
 			$(gen_spec_iplist | sed -e "s/^/add ssr_gen_router /")
 		EOF
-			$IPT -N SS_SPEC_ROUTER 2>/dev/null
-			$IPT -F SS_SPEC_ROUTER 2>/dev/null
-			$IPT -A SS_SPEC_ROUTER -m mark --mark 255 -j RETURN && \
-			$IPT -A SS_SPEC_ROUTER -m set --match-set ssr_gen_router dst -j RETURN && \
-			$IPT -A SS_SPEC_ROUTER -j SS_SPEC_WAN_FW
-		$IPT -I OUTPUT 1 -p tcp -m comment --comment "$TAG" -j SS_SPEC_ROUTER
+		$IPT -N SS_SPEC_ROUTER 2>/dev/null
+		$IPT -F SS_SPEC_ROUTER 2>/dev/null
+		# $IPT -A SS_SPEC_ROUTER -m mark --mark 255 -j RETURN
+		$IPT -A SS_SPEC_ROUTER -m set --match-set ssr_gen_router dst -j RETURN
+		$IPT -A SS_SPEC_ROUTER -j SS_SPEC_WAN_FW
+		# fake-ip first
+		if [ "$ENABLE_FAKE_IP" = "1" ]; then
+			$IPT -I OUTPUT 1 -m mark --mark 255 -j RETURN 2>/dev/null
+			$IPT -I OUTPUT 2 -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			$IPT -I OUTPUT 3 -p udp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			$IPT -I OUTPUT 4 -p tcp -m comment --comment "$TAG" -j SS_SPEC_ROUTER
+		else
+			$IPT -I OUTPUT 1 -m mark --mark 255 -j RETURN 2>/dev/null
+			$IPT -I OUTPUT 2 -p tcp -m comment --comment "$TAG" -j SS_SPEC_ROUTER
+		fi
 		;;
 	esac
 	return $?
@@ -855,29 +1001,29 @@ tp_rule_nft() {
 	fi
 
 	local MATCH_SET=""
+	local EXT_ARGS=""
 
 	if [ -n "$PROXY_PORTS" ]; then
-		PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
-		if [ -n "$PORTS_ARGS" ]; then
-			EXT_ARGS="udp dport { $PORTS_ARGS }"
-		else
-			EXT_ARGS=""
-		fi
+		local PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
+		[ -n "$PORTS_ARGS" ] && EXT_ARGS="udp dport { $PORTS_ARGS }"
 	fi
 
 	if [ -n "$LAN_AC_IP" ]; then
 		# Create LAN access control set if needed
+		local mode="${LAN_AC_IP:0:1}"
+		local ips="${LAN_AC_IP:1}"
+
 		if ! $NFT list set ip ss_spec_mangle ss_spec_lan_ac >/dev/null 2>&1; then
 			$NFT add set ip ss_spec_mangle ss_spec_lan_ac '{ type ipv4_addr; flags interval; auto-merge; }' 2>/dev/null
 		else
 			$NFT flush set ip ss_spec_mangle ss_spec_lan_ac 2>/dev/null
 		fi
 
-		for ip in ${LAN_AC_IP#?}; do
+		for ip in $ips; do
 			[ -n "$ip" ] && $NFT add element ip ss_spec_mangle ss_spec_lan_ac "{ $ip }" 2>/dev/null
 		done
 
-		case "${LAN_AC_IP%${LAN_AC_IP#?}}" in
+		case "$mode" in
 		w | W)
 			MATCH_SET="ip saddr @ss_spec_lan_ac"
 			;;
@@ -906,8 +1052,10 @@ tp_rule_nft() {
 	fi
 
 	# Bulk import xhttp ip list into nft whitelist (server + shunt)
-	if [ -f "${xhttp_ip:=/etc/ssrplus/xhttp_address.txt}" ]; then
-		$NFT add element ip ss_spec_mangle whitelist "{ $(tr '\n' ',' < "${xhttp_ip}" | sed 's/,$//') }" 2>/dev/null
+	local xhttp_file="${xhttp_ip:=/etc/ssrplus/xhttp_address.txt}"
+	if [ -s "$xhttp_file" ]; then
+		local xhttp_content=$(tr '\n' ',' < "$xhttp_file" | sed 's/,$//')
+		[ -n "$xhttp_content" ] && $NFT add element ip ss_spec_mangle whitelist "{ $xhttp_content }" 2>/dev/null
 	fi
 
 	# use priority mangle for compatibility with other rules
@@ -917,6 +1065,12 @@ tp_rule_nft() {
 		$NFT flush chain ip ss_spec_mangle ss_spec_tproxy 2>/dev/null
 	fi
 
+	# 优先对 Fake-IP 进行 TPROXY 重定向 (无需受限于 PROXY_PORTS 限制)
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		$NFT add rule ip ss_spec_mangle ss_spec_tproxy ip daddr 198.18.0.0/16 counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
+	fi
+
+	# Exclude special local addresses
 	if $NFT list chain ip ss_spec_mangle ss_spec_tproxy >/dev/null 2>&1; then
 		for net in 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4; do
 			$NFT add rule ip ss_spec_mangle ss_spec_tproxy ip daddr $net return 2>/dev/null
@@ -934,9 +1088,9 @@ tp_rule_nft() {
 	$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp dport 53 return 2>/dev/null
 
 	# avoid redirecting to udp server address
-	if [ -n "$server" ]; then
-		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp dport != 53 ip daddr "$server" return 2>/dev/null
-	fi
+	# if [ -n "$server" ]; then
+	# 	$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp dport != 53 ip daddr "$server" return 2>/dev/null
+	# fi
 
 	# if server != SERVER add SERVER to whitelist set (so tproxy won't touch it)
 	if [ -n "$server" ]; then
@@ -946,6 +1100,9 @@ tp_rule_nft() {
 		$NFT add element ip ss_spec_mangle whitelist "{ $SERVER }" 2>/dev/null
 	fi
 
+	# 显式豁免白名单集合中的 IP
+	$NFT add rule ip ss_spec_mangle ss_spec_tproxy ip daddr @whitelist return 2>/dev/null
+
 	# access control and tproxy rules
 	$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip saddr @bplan return 2>/dev/null
 	$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp $EXT_ARGS ip saddr @fplan counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
@@ -965,7 +1122,9 @@ tp_rule_nft() {
 
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip daddr @ss_spec_wan_ac return 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip daddr @china return 2>/dev/null
+		# 80 端口规则：非国内 IP 的 80 端口，走 TPROXY
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp udp dport 80 counter drop comment "\"$TAG\"" 2>/dev/null
+		# 443 端口规则：非国内 IP 的 443 端口，走 TPROXY
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp udp dport 443 counter drop comment "\"$TAG\"" 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip saddr @gmlan ip daddr != @china counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp $EXT_ARGS ip daddr != @ss_spec_wan_ac counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
@@ -975,7 +1134,9 @@ tp_rule_nft() {
 			$NFT add set ip ss_spec_mangle gfwlist '{ type ipv4_addr; flags interval; auto-merge; }' 2>/dev/null
 		fi
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip daddr @china return 2>/dev/null
+		# 80 端口规则：非国内 IP 的 80 端口，走 TPROXY
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp udp dport 80 counter drop comment "\"$TAG\"" 2>/dev/null
+		# 443 端口规则：非国内 IP 的 443 端口，走 TPROXY
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp udp dport 443 counter drop comment "\"$TAG\"" 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp $EXT_ARGS ip daddr @gfwlist counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip saddr @gmlan ip daddr != @china counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
@@ -988,6 +1149,8 @@ tp_rule_nft() {
 	# finally, ensure prerouting hook entry to jump to tproxy chain
 	if ! $NFT list chain ip ss_spec_mangle prerouting >/dev/null 2>&1; then
 		$NFT add chain ip ss_spec_mangle prerouting '{ type filter hook prerouting priority mangle; policy accept; }'
+	else
+		$NFT flush chain ip ss_spec_mangle prerouting 2>/dev/null
 	fi
 
 	# add prerouting jump (idempotent)
@@ -1056,8 +1219,14 @@ tp_rule_iptables() {
 	do
 		$ipt -A SS_SPEC_TPROXY -p udp -d "$net" -j RETURN
 	done
+	# fake-ip 规则
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		$ipt -A SS_SPEC_TPROXY -p udp $MATCH_SET -d 198.18.0.0/16 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+	fi
+
 	[ -n "$SERVER" ] && $ipt -A SS_SPEC_TPROXY -p udp ! --dport 53 -d "$SERVER" -j RETURN
 	[ -n "$SERVER" ] && [ "$server" != "$SERVER" ] && ipset -! add whitelist "$SERVER"
+	$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set whitelist dst -j RETURN
 	if [ -f "${xhttp_ip:=/etc/ssrplus/xhttp_address.txt}" ]; then
 		while IFS= read -r ip; do
 			[ -n "$ip" ] && ipset add whitelist "$ip" -exist
@@ -1065,6 +1234,7 @@ tp_rule_iptables() {
 	fi
 	$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set bplan src -j RETURN
 	$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set fplan src -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+	$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set blacklist dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 	case "$RUNMODE" in
 	router)
 		ipset -! -R <<-EOF || return 1
@@ -1073,15 +1243,27 @@ tp_rule_iptables() {
 		EOF
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set ss_spec_wan_ac dst -j RETURN
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set china dst -j RETURN
+		# 80 端口规则：非国内 IP 的 80 端口，走 TPROXY
 		$ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j DROP
-		$ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j DROP 
+		# 443 端口规则：非国内 IP 的 443 端口，走 TPROXY
+		$ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j DROP
+		# 保留海外 QUIC 代理
+		# $ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+		# $ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+		# $ipt -A SS_SPEC_TPROXY -p udp -m set ! --match-set china dst --dport 80 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+		# $ipt -A SS_SPEC_TPROXY -p udp -m set ! --match-set china dst --dport 443 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set gmlan src -m set ! --match-set china dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set ! --match-set ss_spec_wan_ac dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		;;
 	gfw)
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set china dst -j RETURN
+		# 80 端口规则：非国内 IP 的 80 端口，走 TPROXY
 		$ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j DROP
-		$ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j DROP 
+		# 443 端口规则：非国内 IP 的 443 端口，走 TPROXY
+		$ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j DROP
+		# 保留海外 QUIC 代理
+		# $ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+		# $ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set gfwlist dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set gmlan src -m set ! --match-set china dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		;;
@@ -1463,7 +1645,7 @@ restore_from_persistence() {
 	fi
 }
 
-while getopts ":m:s:l:S:L:i:e:a:B:b:w:p:G:D:F:N:M:I:oOuUyfgrzAKPCRXh" arg; do
+while getopts ":m:s:l:S:L:i:e:E:a:B:b:w:p:G:D:F:N:M:I:oOuUyfgrzAKPCRXh" arg; do
 	case "$arg" in
 	m)
 		Interface=$OPTARG
@@ -1486,6 +1668,9 @@ while getopts ":m:s:l:S:L:i:e:a:B:b:w:p:G:D:F:N:M:I:oOuUyfgrzAKPCRXh" arg; do
 	e)
 		EXT_ARGS=$OPTARG
 		;;
+	E)
+		ENABLE_FAKE_IP=$OPTARG
+		;;
 	a)
 		LAN_AC_IP=$OPTARG
 		;;
@@ -1689,6 +1874,14 @@ if [ -n "$local_port" ]; then
 
 	if [ "$USE_NFT" = "1" ]; then
 		# NFTables
+		# Detect Fake_IP Mode state change (execute first)
+		ENABLE_FAKE_IP_STATE_FILE="/tmp/.last_enable_fake_ip"
+		if [ -f "$ENABLE_FAKE_IP_STATE_FILE" ]; then
+			LAST_ENABLE_FAKE_IP=$(cat "$ENABLE_FAKE_IP_STATE_FILE")
+		else
+			LAST_ENABLE_FAKE_IP=""
+		fi
+
 		# Save previous TPROXY state file
 		TPROXY_STATE_FILE="/tmp/.last_tproxy"
 		if [ -f "$TPROXY_STATE_FILE" ]; then
@@ -1778,6 +1971,13 @@ if [ -n "$local_port" ]; then
 			LAST_XHTTP_FILE_HASH=""
 		fi
 
+		# Check if Fake_IP Mode state has changed
+		ENABLE_FAKE_IP_CHANGED=0
+		if [ "$LAST_ENABLE_FAKE_IP" != "$ENABLE_FAKE_IP" ]; then
+			loger 6 "Fake_IP Mode state changed: $LAST_ENABLE_FAKE_IP -> $ENABLE_FAKE_IP"
+			ENABLE_FAKE_IP_CHANGED=1
+		fi
+
 		# STEP 1: Check if TPROXY has value (1 or 2)
 		if [ "$TPROXY" = "1" ] || [ "$TPROXY" = "2" ]; then
 			TPROXY_HAS_VALUE=1
@@ -1873,7 +2073,9 @@ if [ -n "$local_port" ]; then
 		# 1. TPROXY changes from empty ↔ has value
 		# 2. PROXY_PORTS changes from empty ↔ has value
 		# 3. Any IP list has changed
-		if [ "$TPROXY_HAS_VALUE" != "$LAST_HAS_VALUE" ] || \
+		# 4. ENABLE_FAKE_IP state changed
+		if [ "$ENABLE_FAKE_IP_CHANGED" = "1" ] || \
+		   [ "$TPROXY_HAS_VALUE" != "$LAST_HAS_VALUE" ] || \
 		   [ "$PROXY_HAS_VALUE" != "$LAST_PROXY_HAS_VALUE" ] || \
 		   [ "$ANY_IP_LIST_CHANGED" = "1" ]; then
 			FORCE_RECREATE=1
@@ -1891,6 +2093,7 @@ if [ -n "$local_port" ]; then
 		fi
 
 		# STEP 4: Save current state
+		echo "$ENABLE_FAKE_IP" > "$ENABLE_FAKE_IP_STATE_FILE"
 		echo "$TPROXY" > "$TPROXY_STATE_FILE"
 		echo "$PROXY_PORTS" > "$PROXY_PORTS_STATE_FILE"
 		echo "$(normalize_ip_list "$WAN_BP_IP")" > "$WAN_BP_IP_STATE_FILE"

luci-app-ssr-plus/root/usr/share/shadowsocksr/gen_config.lua

@@ -3,6 +3,7 @@
 require "luci.sys"
 local ucursor = require "luci.model.uci".cursor()
 local json = require "luci.jsonc"
+local datatypes = require "luci.cbi.datatypes"
 
 -- An omitted value reaches us either as a missing argument or as an empty
 -- string, depending on whether the caller quoted the expansion. Empty strings
@@ -181,6 +182,62 @@ local function format_host_port(host, port)
 	return host .. ":" .. tostring(port)
 end
 
+local function format_dns_server(proxy)
+	if not proxy or proxy == "" then
+		return proxy
+	end
+
+	local scheme, rest = proxy:match("^([a-zA-Z0-9%+%-%.]+)://(.+)$")
+	if scheme then
+		scheme = scheme:lower()
+		if scheme == "tls" or scheme == "dot" then
+			if not rest:match(":%d+$") then
+				rest = rest .. ":853"
+			end
+			return "tls://" .. rest
+		elseif scheme == "https" or scheme == "doh" or scheme == "dohl" or scheme == "doq" or scheme == "doql" then
+			local host, path = rest:match("^([^/]+)(.*)$")
+			host = host or rest
+			path = path or ""
+			if path == "" or path == "/" then
+				path = "/dns-query"
+			end
+			return "https://" .. host .. path
+		elseif scheme == "tcp" or scheme == "udp" then
+			if not rest:match(":%d+$") then
+				rest = rest .. ":53"
+			end
+			return scheme .. "://" .. rest
+		else
+			return proxy
+		end
+	end
+
+	local host, port = proxy:match("^([^:]+):(%d+)$")
+	if host and port then
+		if port == "853" then
+			return "tls://" .. host .. ":853"
+		elseif port == "443" then
+			return "https://" .. host .. "/dns-query"
+		elseif port == "53" then
+			return host -- 53 端口输出纯 IP / Host (如 8.8.4.4)
+		else
+			return "udp://" .. host .. ":" .. port
+		end
+	end
+
+	-- 确保包含字母，防止把 IP 当成域名
+	if proxy:match("[a-zA-Z]") and not proxy:match("[^%w%.%-]") then
+		local path = ""
+		if not proxy:match("/") then
+			path = "/dns-query"
+		end
+		return "https://" .. proxy .. path
+	end
+
+	return proxy
+end
+
 -- 确保正确判断程序是否存在
 local function is_finded(e)
 	return luci.sys.exec(string.format('type -t -p "%s" -p "/usr/libexec/%s" 2>/dev/null', e, e)) ~= ""
@@ -391,31 +448,141 @@ local Xray = {
 }
 
 if server.type == "v2ray" and dns_mode == "7" and os.getenv("SSR_SWITCH_PROBE") ~= "1" then
-	local dns_host = builtin_dns_server:match("^([^:]+)") or "8.8.4.4"
-	local dns_port = tonumber(builtin_dns_server:match(":(%d+)$")) or 53
+	local raw_servers_str = builtin_dns_server or "8.8.4.4:53"
 
+	local dns_servers = {}
+	local host_list = {}
+	local port_list = {}
+	local first_host = nil
+	local first_port = nil
+
+	-- 按逗号或空格分割多个 DNS 地址
+	for raw_server in string.gmatch(raw_servers_str, "[^,%s\r\n]+") do
+		if raw_server and raw_server ~= "" then
+			-- 1. 先进行格式化处理
+			local formatted = format_dns_server(raw_server)
+
+			local host = nil
+			local port = nil
+
+			-- 2. 解析 host 和对应的实际端口
+			if formatted:match("^https://") then
+				local target = formatted:match("^https://([^/]+)")
+				if target:match(":%d+$") then
+					host, port = target:match("^([^:]+):(%d+)$")
+					port = tonumber(port)
+				else
+					host = target
+					port = 443
+				end
+			elseif formatted:match("^tls://") then
+				local target = formatted:match("^tls://([^/]+)")
+				if target:match(":%d+$") then
+					host, port = target:match("^([^:]+):(%d+)$")
+					port = tonumber(port)
+				else
+					host = target
+					port = 853
+				end
+			elseif formatted:match("^tcp://") or formatted:match("^udp://") then
+				local target = formatted:match("^[a-zA-Z0-9%+%-%.]+://([^/]+)")
+				if target:match(":%d+$") then
+					host, port = target:match("^([^:]+):(%d+)$")
+					port = tonumber(port)
+				else
+					host = target
+					port = 53
+				end
+			else
+				if formatted:match(":%d+$") then
+					host, port = formatted:match("^([^:]+):(%d+)$")
+					port = tonumber(port)
+				else
+					host = formatted
+					port = 53
+				end
+			end
+
+			-- 保存格式化后的 Xray.dns.servers 条目
+			table.insert(dns_servers, formatted)
+
+			-- 分别收集 Host 与 Port
+			if host and port then
+				table.insert(host_list, host)
+				table.insert(port_list, port)
+				-- 保存第一个 DNS 的 host 和 port
+				-- if not first_host then --dokodemo-door 入站的 address 单个地址使用。
+				-- 	first_host = host  --dokodemo-door 入站的 address 单个地址使用。
+				--	first_port = port  --dokodemo-door 入站的 address 单个地址使用。
+				-- end
+			end
+		end
+	end
+
+	-- 如果没有有效的 DNS 服务器，使用默认值
+	if #dns_servers == 0 then
+		table.insert(dns_servers, "8.8.4.4")
+		table.insert(host_list, "8.8.4.4")
+		table.insert(port_list, 53)
+		-- first_host = "8.8.4.4" --dokodemo-door 入站的 address 单个地址使用。
+		-- first_port = 53 --dokodemo-door 入站的 address 单个地址使用。
+	end
+
+	-- 构建 dns 出站地址（支持逗号分隔的多个地址）
+	-- 检查所有 DNS 端口是否一致
+	--local outbound_address = "" --dokodemo-door 入站的 address 单个地址使用。
+	local all_same_port = true
+	local common_port = port_list[1]
+	for i = 2, #port_list do
+		if port_list[i] ~= common_port then
+			all_same_port = false
+			break
+		end
+	end
+
+	-- 根据端口一致性计算 address 与 target_port
+	local address_str = ""
+	local target_port = 0
+
+	if all_same_port then
+		-- outbound_address = table.concat(host_list, ",") --dokodemo-door 入站的 address 单个地址时使用。
+		address_str = table.concat(host_list, ",")
+		target_port = common_port
+	else
+		local combined = {}
+		for i = 1, #host_list do
+			table.insert(combined, string.format("%s:%d", host_list[i], port_list[i]))
+		end
+		-- outbound_address = table.concat(combined, ",") --dokodemo-door 入站的 address 单个地址时使用。
+		address_str = table.concat(combined, ",")
+		target_port = 0
+	end
+	
+	-- 构建 Xray.dns 配置
 	Xray.dns = {
 		queryStrategy = (dns_ipv4_only == "1") and "UseIPv4" or "UseIP",
-		servers = {
-			string.format("tcp://%s:%d", dns_host, dns_port)
-		}
+		servers = dns_servers
 	}
 
+	-- 构建 dokodemo-door 入站
 	table.insert(Xray.inbounds, {
 		listen = "127.0.0.1",
 		port = 5335,
 		protocol = "dokodemo-door",
 		settings = {
-			address = dns_host,
-			port = dns_port,
+			address = address_str,
+			-- address = first_host,        -- 单个地址
+			port = target_port,
+			-- port = first_port,           -- 对应端口
 			network = "tcp,udp"
 		},
 		tag = "builtin-dns-in"
 	})
-
+	
 	xray_builtin_dns = {
-		address = dns_host,
-		port = dns_port
+		address = address_str,
+		-- address = outbound_address, --dokodemo-door 入站的 address 单个地址时使用。
+		port = target_port
 	}
 end
 	-- 传入连接

luci-app-ssr-plus/root/usr/share/shadowsocksr/shadowsocksr.config

@@ -27,6 +27,9 @@ config server_subscribe
 	option auto_update_week_time '*'
 	option auto_update_day_time '2'
 	option auto_update_min_time '0'
+	option enable_mihomo '1'
+	option enable_fake_ip '1'
+	option sub_convert '1'
 	option url_test_url 'https://www.google.com/generate_204'
 	option user_agent 'v2rayN/9.99'
 	option filter_words '过期/重置/套餐/剩余/网址/QQ群/官网/防失联/回国'