update 2026-09-14 10:58:48

update 2026-09-14 06:01:57
update 2026-09-14 02:28:52
2026-09-14 12:24:20 +08:00 · 2026-09-14 10:58:48 +08:00 · 2026-09-14 06:01:57 +08:00 · 2026-09-14 02:28:52 +08:00 · 2026-09-13 23:28:56 +08:00 · 2026-09-13 16:42:22 +08:00
68 changed files with 3914 additions and 1679 deletions
@@ -301,9 +301,10 @@ package_version_from_url() {
  case "$file" in
    clashoo_*_"$ARCH".ipk)
      v="${file#clashoo_}"
-      printf '%s\n' "${v%_${ARCH}.ipk}"
+      v="${v%_${ARCH}.ipk}"
+      printf '%s\n' "$v" | sed 's/^\([0-9][0-9][0-9][0-9]\.[0-9][0-9]*\.[0-9][0-9]*\)\./\1~/'
      ;;
-    clashoo_*.ipk) printf '%s\n' "$file" | sed -n 's/^clashoo_\(.*\)_[^_][^_]*\.ipk$/\1/p' ;;
+    clashoo_*.ipk) printf '%s\n' "$file" | sed -n 's/^clashoo_\(.*\)_[^_][^_]*\.ipk$/\1/p' | sed 's/^\([0-9][0-9][0-9][0-9]\.[0-9][0-9]*\.[0-9][0-9]*\)\./\1~/' ;;
    luci-app-clashoo_*.ipk) printf '%s\n' "$file" | sed -n 's/^luci-app-clashoo_\(.*\)_all\.ipk$/\1/p' ;;
    luci-i18n-clashoo-zh-cn_*.ipk) printf '%s\n' "$file" | sed -n 's/^luci-i18n-clashoo-zh-cn_\(.*\)_all\.ipk$/\1/p' ;;
    clashoo-*.apk)
@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=dae
-PKG_VERSION:=2026.09.06
-PKG_RELEASE:=2
+PKG_VERSION:=2026.09.12
+PKG_RELEASE:=1

-PKG_SOURCE:=dae-src-2026.09.06-80525dabf966.tar.gz
+PKG_SOURCE:=dae-src-2026.09.12-187058462a1f.tar.gz
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-daede/releases/download/dae-src
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_HASH:=80525dabf966403524f3eac4ca46bb520ae487177b77e4b7b4482d24c2aa923e
+PKG_HASH:=187058462a1fd9eeb9885f4971ccf4bc81358533e71730d8509bd7968624c1c7

 PKG_LICENSE:=AGPL-3.0-only
 PKG_LICENSE_FILE:=LICENSE
@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=daed
-PKG_VERSION:=2026.09.06
-PKG_RELEASE:=2
+PKG_VERSION:=2026.09.12
+PKG_RELEASE:=1

-PKG_SOURCE:=daed-src-2026.09.06-62f2e24ac52a.tar.gz
+PKG_SOURCE:=daed-src-2026.09.12-a0181f729855.tar.gz
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-daede/releases/download/daed-src
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_HASH:=62f2e24ac52a6897633d0a0ed43d5a2419164ae43fa26e5c6fe11b5fe973fa61
+PKG_HASH:=a0181f7298552497ed193e683a54b1df77f2d5441524d61989f3e3e3cf6eac51

 PKG_LICENSE:=AGPL-3.0-only MIT
 PKG_LICENSE_FILES:=LICENSE wing/LICENSE
@@ -1,8 +1,65 @@
 #!/bin/sh
+# daed-cleanup.sh — reaper for stale daed kernel state.
+#
+# Removes:
+#   1. Processes inside the `daens` netns (SIGTERM, then SIGKILL after 1s)
+#   2. The `daens` network namespace itself (ip netns del, with
+#      umount+rm as fallback for zombie nsfs mounts)
+#   3. The `dae0` veth pair in the host netns
+#
+# daed itself owns TC clsact detach. This opkg-side helper only
+# reaps stale daens/dae0 state and never removes /sys/fs/bpf/daed.
+# The pin directory is created during normal startup, so it is not
+# a reliable leak indicator and must not block service lifecycle.
+#
+# The function stays sourceable by both init.d/daed and daed-guard.
+
+daed_process_probe() {
+	if command -v pgrep >/dev/null 2>&1; then
+		pgrep -f '^/usr/bin/daed([[:space:]]|$)' >/dev/null 2>&1
+		case "$?" in
+			0) return 0 ;;
+			1) return 1 ;;
+		esac
+	fi
+
+	if command -v pidof >/dev/null 2>&1; then
+		pidof daed >/dev/null 2>&1
+		case "$?" in
+			0) return 0 ;;
+			1) return 1 ;;
+		esac
+	fi
+
+	return 2
+}

 daed_cleanup_runtime() {
-	local pid
+	local pid rc=0 probe_rc

+	# If daed userspace is currently running, do not touch the
+	# netns, the veth, or the eBPF dataplane. They are in active
+	# use; removing them would make every connection through dae
+	# hang.
+	daed_process_probe
+	probe_rc=$?
+	case "$probe_rc" in
+	0)
+		if [ "${DAED_GUARD_CLEANUP:-start}" = "start" ]; then
+			logger -t daed-init "cleanup: pre-start skipped because /usr/bin/daed is still running; refusing a second instance"
+			return 1
+		fi
+		logger -t daed-init "cleanup: post-exit skipped because another /usr/bin/daed instance is still running"
+		return 0
+		;;
+	1) ;;
+	*)
+		logger -t daed-init "cleanup: cannot determine whether daed is running; refusing to remove netns/veth"
+		return 1
+		;;
+	esac
+
+	# 1. Kill processes inside daens.
 	for pid in $(ip netns pids daens 2>/dev/null); do
 		kill "$pid" 2>/dev/null
 	done
@@ -14,14 +71,36 @@ daed_cleanup_runtime() {
 		done
 	fi

+	# 2. Remove the daens netns. ip netns del can fail if a
+	#    process still references it via /proc/<pid>/ns/net or
+	#    because the umount has already happened. Try the
+	#    umount/rm fallback.
 	if ! ip netns del daens 2>/dev/null; then
 		umount -l /run/netns/daens 2>/dev/null
-		rm -f /run/netns/daens
+		if [ -e /run/netns/daens ] && ! rm -f /run/netns/daens 2>/dev/null; then
+			logger -t daed-init "cleanup: failed to remove /run/netns/daens (resource busy); a reboot may be required"
+			rc=1
+		fi
 	fi

-	ip link del dae0 2>/dev/null || true
+	# 3. Remove the dae0 veth pair.
+	if ip link show dae0 >/dev/null 2>&1; then
+		if ! ip link del dae0 2>/dev/null; then
+			logger -t daed-init "cleanup: failed to remove dae0 veth pair"
+			rc=1
+		fi
+	fi

+	# 4. The pin root is normal persistent state. Never remove it or
+	#    make its existence change the cleanup result.
+	if [ -e /sys/fs/bpf/daed ]; then
+		logger -t daed-init "cleanup: /sys/fs/bpf/daed exists; leaving normal pin root unchanged"
+	fi
+
+	# Final verification covers only netns and veth state.
 	[ ! -e /run/netns/daens ] || return 1
-	! ip netns list 2>/dev/null | awk '$1 == "daens" { found=1 } END { exit !found }' || return 1
+	! ip netns list 2>/dev/null | grep -Eq '^daens([[:space:]]|$)' || return 1
 	! ip link show dae0 >/dev/null 2>&1 || return 1
+
+	return $rc
 }
@@ -1,29 +1,131 @@
 #!/bin/sh
+# Keep daed as a child so signals can be forwarded and stale netns/veth
+# state can be cleaned before start and after exit. daed owns TC detach;
+# /sys/fs/bpf/daed is normal persistent state and is never removed here.

 . /usr/share/daed/cleanup.sh

+# Pre-start cleanup refuses to remove runtime state while another
+# daed instance is active, and fails closed if that probe is broken.
+DAED_GUARD_CLEANUP=start
 if ! daed_cleanup_runtime; then
-	echo "daed: stale network state could not be removed" >&2
+	echo "daed: stale /usr/bin/daed or netns state could not be verified or removed; refusing to start. Check process and netns state." >&2
+	logger -t daed-init "pre-start cleanup failed: refusing to start daed"
 	exit 1
 fi

-# Keep daed as a child so a panic or unexpected exit is followed by an
-# immediate teardown of all kernel/runtime state before procd can respawn us.
+# Keep daed as a child so post-exit cleanup runs before procd can
+# respawn it.
 child_pid=
-cleanup_child() {
-	[ -n "$child_pid" ] && kill "$child_pid" 2>/dev/null
+pending_signal=
+shutdown_signal=
+shutdown_elapsed=0
+forced_kill=0
+child_term_timeout=20
+
+forward_signal() {
+	local sig="$1"
+	if [ -z "$child_pid" ]; then
+		pending_signal="$sig"
+		logger -t daed-init "signal $sig received before daed child started; launch cancelled"
+		return 0
+	fi
+	case "$sig" in
+		TERM|INT|QUIT)
+			if [ -z "$shutdown_signal" ]; then
+				shutdown_signal="$sig"
+				shutdown_elapsed=0
+			fi
+			;;
+	esac
+	kill -"$sig" "$child_pid" 2>/dev/null
 }
-trap cleanup_child TERM INT

-/usr/bin/daed "$@" &
-child_pid=$!
-wait "$child_pid"
-status=$?
-child_pid=
-trap - TERM INT
+exit_with_signal() {
+	local sig="$1"
+	trap - TERM INT HUP QUIT
+	kill -"$sig" "$$" 2>/dev/null
+	exit 1
+}

-if ! daed_cleanup_runtime; then
-	echo "daed: runtime cleanup after exit failed" >&2
-	status=1
+child_is_running() {
+	local state
+	kill -0 "$child_pid" 2>/dev/null || return 1
+	state=$(awk '{ print $3 }' "/proc/$child_pid/stat" 2>/dev/null)
+	[ "$state" != "Z" ]
+}
+trap 'forward_signal TERM' TERM
+trap 'forward_signal INT' INT
+trap 'forward_signal HUP' HUP
+trap 'forward_signal QUIT' QUIT
+
+start_child() {
+	local sig
+	# Keep this check inside the function as well as at the call site:
+	# it closes the ordinary pre-start window, while the pending-signal
+	# path below handles a signal arriving during the background fork.
+	[ -z "$pending_signal" ] || return 125
+	/usr/bin/daed "$@" &
+	child_pid=$!
+	if [ -n "$pending_signal" ]; then
+		sig="$pending_signal"
+		pending_signal=
+		forward_signal "$sig"
+	fi
+}
+
+if [ -n "$pending_signal" ]; then
+	logger -t daed-init "refusing to start daed after pending signal $pending_signal"
+	exit_with_signal "$pending_signal"
 fi
-exit "$status"
+
+# Best-effort OOM preference; failure must not block startup.
+if ! echo -16 > /proc/self/oom_score_adj 2>/dev/null; then
+	logger -t daed-init "warn: failed to set /proc/self/oom_score_adj; continuing without OOM preference"
+fi
+if ! start_child "$@"; then
+	logger -t daed-init "refusing to start daed after pending signal $pending_signal"
+	if [ -n "$pending_signal" ]; then
+		exit_with_signal "$pending_signal"
+	fi
+	exit 1
+fi
+status=0
+reaped=0
+while [ "$reaped" -eq 0 ]; do
+	if [ -n "$shutdown_signal" ] && child_is_running; then
+		if [ "$shutdown_elapsed" -ge "$child_term_timeout" ]; then
+			if [ "$forced_kill" -eq 0 ]; then
+				logger -t daed-init "daed did not exit within ${child_term_timeout}s after $shutdown_signal; sending KILL"
+				kill -KILL "$child_pid" 2>/dev/null
+				forced_kill=1
+			fi
+		else
+			sleep 1
+			shutdown_elapsed=$((shutdown_elapsed + 1))
+			continue
+		fi
+		sleep 1
+		continue
+	fi
+	wait "$child_pid" 2>/dev/null
+	status=$?
+	if ! child_is_running; then
+		reaped=1
+	fi
+done
+child_pid=
+trap - TERM INT HUP QUIT
+
+# Post-exit cleanup runs after the child is reaped.
+DAED_GUARD_CLEANUP=post-exit
+cleanup_status=0
+daed_cleanup_runtime || cleanup_status=$?
+if [ "$cleanup_status" -ne 0 ]; then
+	echo "daed: runtime cleanup after exit failed" >&2
+	logger -t daed-init "post-exit cleanup failed; check ip netns / ip link show"
+fi
+if [ "$status" -ne 0 ]; then
+	exit "$status"
+fi
+exit "$cleanup_status"
@@ -1,5 +1,7 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2023 Tianling Shen <cnsztl@immortalwrt.org>
+# daed-guard handles bounded child shutdown and post-exit netns/veth cleanup.
+# Keep the log file and a pre-stop state snapshot for diagnostics.

 USE_PROCD=1
 START=99
@@ -10,18 +12,28 @@ LOG="/var/log/daed/daed.log"

 . /usr/share/daed/cleanup.sh

+log() {
+	logger -t daed-init "$@"
+}
+
 start_service() {
+	log "start: begin"
 	config_load "$CONF"

 	local enabled
 	config_get_bool enabled "config" "enabled" "0"
-	[ "$enabled" -eq "1" ] || return 1
+	if [ "$enabled" -ne "1" ]; then
+		log "start: config disabled, exit"
+		return 1
+	fi

 	local listen_addr log_maxbackups log_maxsize
 	config_get listen_addr "config" "listen_addr" "0.0.0.0:2023"
 	config_get log_maxbackups "config" "log_maxbackups" "1"
 	config_get log_maxsize "config" "log_maxsize" "5"

+	log "start: listen=$listen_addr log_maxbackups=$log_maxbackups log_maxsize=$log_maxsize"
+
 	procd_open_instance "$CONF"
 	procd_set_param env DAE_LOCATION_ASSET="/usr/share/v2ray" TZ="$(uci -q get system.@system[0].zonename)"
 	procd_set_param command "$PROG" run
@@ -33,25 +45,37 @@ start_service() {

 	procd_set_param limits core="unlimited"
 	procd_set_param limits nofile="1000000 1000000"
-	# Avoid an endless crash/respawn loop which can repeatedly reattach dae's
-	# data-plane hooks and make the router management plane unreachable.
-	procd_set_param respawn 3600 5 5
+	# daed-guard escalates its child after 20 seconds. Leave time for
+	# reap and post-exit cleanup before procd kills the wrapper.
+	procd_set_param term_timeout 30
+	# procd_set_param respawn: arguments are (threshold, timeout, retry).
+	#   threshold = runtime that resets the short-lived exit counter
+	#   timeout   = seconds to wait between retries
+	#   retry     = maximum short-lived exits before procd gives up
+	# Reset the counter after one hour of stable runtime; otherwise retry
+	# after 5 seconds and stop after 10 failures.
+	procd_set_param respawn 3600 5 10
+	# daed-guard sets oom_score_adj before forking; procd has no
+	# oom_adj/oom_score_adj parameter.
 	# procd_set_param stdout 1
 	procd_set_param stderr 1

 	procd_close_instance
+	log "start: procd_open_instance done"
 }

 stop_service() {
-	rm -f "$LOG"
-	daed_cleanup_runtime
-}
-
-restart() {
-	stop
-	sleep 1
-	daed_cleanup_runtime
-	start
+	log "stop: begin"
+	# Cleanup runs in daed-guard after its child exits. Record only a
+	# pre-stop snapshot here; pin entries do not prove TC attachment.
+	local pinned="" ns_left=""
+	if [ -d /sys/fs/bpf/daed ]; then
+		pinned=$(ls /sys/fs/bpf/daed 2>/dev/null | tr '\n' ' ')
+	fi
+	if ip netns list 2>/dev/null | grep -q '^daens'; then
+		ns_left="daens"
+	fi
+	log "stop: pre-stop state — bpf_pin_entries=[${pinned:-none}] netns_left=[${ns_left:-none}]"
 }

 service_triggers() {
@@ -1,8 +1,6 @@
 # SPDX-License-Identifier: GPL-3.0-only
 #
-# Copyright (C) 2021-2023  sirpdboy  <herboy2008@gmail.com>
-# 
-# This is free software, licensed under the Apache License, Version 2.0 .
+# Copyright (C) 2021-2026 sirpdboy  <herboy2008@gmail.com>
 #

 include $(TOPDIR)/rules.mk
@@ -10,12 +8,12 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=ddns-go
 PKG_VERSION:=6.17.7
 PKG_RELEASE:=1
-
+PKG_VERSION:=6.17.7
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/jeessy2/ddns-go/tar.gz/v$(PKG_VERSION)?
 PKG_HASH:=f7001004e092d9641aad5a94158e0b4cae4a53a7f5c7d96d5c6af3d246c56fcc

-PKG_LICENSE:=MIT
+PKG_HASH:=f7001004e092d9641aad5a94158e0b4cae4a53a7f5c7d96d5c6af3d246c56fcc
 PKG_LICENSE_FILES:=LICENSE
 PKG_MAINTAINER:=Tianling Shen <cnsztl@immortalwrt.org>

@@ -44,14 +42,18 @@ define Package/ddns-go/description
  support Alidns Dnspod Cloudflare Hicloud Callback Baiducloud porkbun GoDaddy Google Domains.
 endef

+define Package/ddns-go/conffiles
+/etc/config/ddns-go
+/etc/ddns-go/ddns-go-config.yaml
+endef
+
 define Package/ddns-go/install
 	$(call GoPackage/Package/Install/Bin,$(1))

 	$(INSTALL_DIR) $(1)/etc/init.d
-	$(INSTALL_BIN) $(CURDIR)/file/ddns-go.init $(1)/etc/init.d/ddns-go
-
-	$(INSTALL_DIR) $(1)/etc/uci-defaults
-	$(INSTALL_BIN) $(CURDIR)/file/luci-ddns-go.uci-default $(1)/etc/uci-defaults/luci-ddns-go
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_BIN) $(CURDIR)/files/ddns-go.init $(1)/etc/init.d/ddns-go
+	$(INSTALL_CONF) $(CURDIR)/files/ddns-go.conf $(1)/etc/config/ddns-go
 endef

 $(eval $(call GoBinPackage,ddns-go))
@@ -1,46 +0,0 @@
-#!/bin/sh /etc/rc.common
-#
-# Copyright (C) 2021-2023  sirpdboy  <herboy2008@gmail.com> https://github.com/sirpdboy/luci-app-ddns-go 
-#
-# This file is part of ddns-go .
-# 
-# This is free software, licensed under the Apache License, Version 2.0 .
-#
-
-
-START=99
-USE_PROCD=1
-
-PROG=/usr/bin/ddns-go
-CONFDIR=/etc/ddns-go
-CONF=$CONFDIR/ddns-go-config.yaml
-
-get_config() {
-        config_get_bool enabled $1 enabled 1
-	config_get_bool logger $1 logger 1
-	config_get port $1 port 9876
-	config_get time $1 time 300
-}
-
-init_yaml(){
-	[ -d $CONFDIR ] || mkdir -p $CONFDIR 2>/dev/null
-	cat /usr/share/ddns-go/ddns-go-default.yaml  > $CONF
-}
-
-start_service() {
-	config_load ddns-go
-        config_foreach get_config basic
-	[ x$enabled == x1 ] || return 1
-	[ -s ${CONF} ] || init_yaml
-	logger -t ddns-go -p warn "ddns-go is start."
-	echo "ddns-go is start."
-	procd_open_instance
-	procd_set_param command $PROG -l :$port -f $time -c "$CONF"
-	[ "x$logger" == x1 ] && procd_set_param stderr 1
-	procd_set_param respawn
-	procd_close_instance
-}
-
-service_triggers() {
-      procd_add_reload_trigger "ddns-go"
-}
@@ -1,7 +0,0 @@
-#!/bin/sh
-
-[ -s "/etc/ddns-go/localtime" ] && mv -f /etc/ddns-go/localtime /etc/localtime
-/etc/init.d/ddns-go enable
-/etc/init.d/ddns-go start
-rm -f /tmp/luci*
-exit 0
@@ -0,0 +1,9 @@
+config basic 'config'
+	option enabled '0'
+	option logger '1'
+	option port '9876'
+	option time '300'
+	option ctimes '5'
+	option skipverify '0'
+	option delay '0'
+	option dns '223.5.5.5'
@@ -0,0 +1,85 @@
+#!/bin/sh /etc/rc.common
+#
+# Copyright (C) 2021-2026  sirpdboy  <herboy2008@gmail.com>
+#
+# This file is part of ddns-go .
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+START=99
+USE_PROCD=1
+NAME=ddns-go
+PROG=/usr/bin/ddns-go
+CONFDIR=/etc/ddns-go
+CONF=$CONFDIR/ddns-go-config.yaml
+
+init_yaml() {
+	[ -d "$CONFDIR" ] || mkdir -p "$CONFDIR"
+	chown -R ddns-go:ddns-go "$CONFDIR"
+	chmod 755 "$CONFDIR"
+	[ -f "$CONF" ] && chmod 644 "$CONF"
+}
+
+build_args() {
+	local cfg="$1"
+	local args="-c $CONF"
+
+	config_get port "$cfg" port '9876'
+	args="$args -l :$port"
+
+	config_get time "$cfg" time '300'
+	[ -n "$time" ] && args="$args -f $time"
+
+	config_get ctimes "$cfg" ctimes '5'
+	[ -n "$ctimes" ] && args="$args -cacheTimes $ctimes"
+
+	config_get dns "$cfg" dns '223.5.5.5'
+	[ -n "$dns" ] && args="$args -dns $dns"
+
+	config_get_bool noweb "$cfg" noweb 0
+	[ "$noweb" -eq 1 ] && args="$args -noweb"
+
+	config_get_bool skipverify "$cfg" skipverify 0
+	[ "$skipverify" -eq 1 ] && args="$args -skipVerify"
+
+	echo "$args"
+}
+
+start_instance() {
+	local cfg="$1"
+	local logger
+	config_get_bool enabled "$cfg" enabled 0
+	[ "$enabled" -eq 0 ] && return 0
+
+	config_get delay "$cfg" delay 0
+	if [ "$delay" -gt 0 ]; then
+		local uptime=$(awk -F. '{print $1}' /proc/uptime)
+		[ "$uptime" -lt 120 ] && sleep "$delay"
+	fi
+
+	init_yaml
+
+	local args=$(build_args "$cfg")
+
+	procd_open_instance
+	procd_set_param command $PROG $args
+
+	config_get_bool logger "$cfg" logger 1
+	procd_set_param stdout "$logger"
+	procd_set_param stderr "$logger"
+
+	procd_set_param user ddns-go
+	procd_set_param respawn
+
+	procd_close_instance
+}
+
+start_service() {
+	config_load "$NAME"
+	config_foreach start_instance 'basic'
+}
+
+service_triggers() {
+	procd_add_reload_trigger "$NAME"
+}
@@ -9,9 +9,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://gn.googlesource.com/gn.git
-PKG_SOURCE_DATE:=2026-09-03
-PKG_SOURCE_VERSION:=4f6a76b64b8279e98004f541f8e136307efe5e01
-PKG_MIRROR_HASH:=933dc8c8d745923437c9e730ab7c2a23a53562144513a4f634ad10381c23be44
+PKG_SOURCE_DATE:=2026-09-11
+PKG_SOURCE_VERSION:=cfcd774b98f3433e18b722f9a7ff06119825b8eb
+PKG_MIRROR_HASH:=d8bea9ac89f9e87f36874601588f0d8d32221bf1ad8488f2fd9775abcddf4860

 PKG_LICENSE:=BSD 3-Clause
 PKG_LICENSE_FILES:=LICENSE
@@ -3,7 +3,7 @@
 #ifndef OUT_LAST_COMMIT_POSITION_H_
 #define OUT_LAST_COMMIT_POSITION_H_

-#define LAST_COMMIT_POSITION_NUM 2553
-#define LAST_COMMIT_POSITION "2553 (4f6a76b64b82)"
+#define LAST_COMMIT_POSITION_NUM 2563
+#define LAST_COMMIT_POSITION "2563 (cfcd774b98f3)"

 #endif  // OUT_LAST_COMMIT_POSITION_H_
@@ -11,6 +11,7 @@ P4REV:=9
 PKG_VERSION:=5.0.4.0

 PKG_BUILD_PARALLEL:=1
+PATCH_DIR:=./patches-$(KERNEL_PATCHVER)

 # PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_NAME)
 PKG_KCONFIG:= \
@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-clashoo
 PKG_VERSION:=1.30.0
-PKG_RELEASE:=13
+PKG_RELEASE:=14
 PKG_MAINTAINER:=kenzok8
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)

@@ -143,7 +143,7 @@ const callOverview          = rpc.declare({ object: 'luci.clashoo', method: 'ove
 const callSmartFlushCache       = rpc.declare({ object: 'luci.clashoo', method: 'smart_flush_cache',       expect: {} });
 const callListSingboxProfiles   = rpc.declare({ object: 'luci.clashoo', method: 'list_singbox_profiles',   expect: {} });
 const callGetSingboxProfile     = rpc.declare({ object: 'luci.clashoo', method: 'get_singbox_profile',     params: ['name'],                   expect: {} });
-const callSaveSingboxProfile    = rpc.declare({ object: 'luci.clashoo', method: 'save_singbox_profile',    params: ['name', 'content'],         expect: {} });
+const callSaveSingboxProfileChunk = rpc.declare({ object: 'luci.clashoo', method: 'save_singbox_profile_chunk', params: ['name', 'content', 'index', 'total'], expect: {} });
 const callSetSingboxProfile     = rpc.declare({ object: 'luci.clashoo', method: 'set_singbox_profile',     params: ['name'],                   expect: {} });
 const callDeleteSingboxProfile  = rpc.declare({ object: 'luci.clashoo', method: 'delete_singbox_profile',  params: ['name'],                   expect: {} });
 const callCreateSingboxConfig   = rpc.declare({ object: 'luci.clashoo', method: 'create_singbox_config',   params: ['sub_url', 'name'], expect: {} });
@@ -235,7 +235,23 @@ return baseclass.extend({

    listSingboxProfiles:  function ()           { return L.resolveDefault(callListSingboxProfiles(),          { profiles: [], active: '' }); },
    getSingboxProfile:    function (name)        { return L.resolveDefault(callGetSingboxProfile(name),        {}); },
-    saveSingboxProfile:   function (name, content){ return L.resolveDefault(callSaveSingboxProfile(name, content), {}); },
+    saveSingboxProfile: function (name, content) {
+        var chunkSize = 24576;
+        var total = Math.max(1, Math.ceil((content || '').length / chunkSize));
+        var index = 0;
+
+        function sendNext() {
+            var chunk = (content || '').slice(index * chunkSize, (index + 1) * chunkSize);
+            return L.resolveDefault(callSaveSingboxProfileChunk(name, chunk, String(index), String(total)), {}).then(function (r) {
+                if (!r || !r.success)
+                    return { success: false, error: (r && r.error) || 'upload_failed', message: (r && (r.message || r.error)) || _('Upload failed') };
+                index++;
+                return index < total ? sendNext() : r;
+            });
+        }
+
+        return sendNext();
+    },
    setSingboxProfile:    function (name)        { return L.resolveDefault(callSetSingboxProfile(name),        {}); },
    deleteSingboxProfile: function (name)        { return L.resolveDefault(callDeleteSingboxProfile(name),     {}); },
    createSingboxConfig:  function (url, name) { return L.resolveDefault(callCreateSingboxConfig(url, name), {}); },
@@ -3812,6 +3812,50 @@ return { success: true, name };
 }
 },

+save_singbox_profile_chunk: {
+args: { name: 'name', content: 'content', index: 'index', total: 'total' },
+call: function(req) {
+let name    = req.args?.name    || '';
+let content = req.args?.content;
+let idx     = int(req.args?.index || 0);
+let total   = int(req.args?.total || 0);
+if (!name || index(name, '/') >= 0 || index(name, '..') >= 0)
+  return { success: false, error: 'invalid name' };
+if (!match(name, /\.json$/)) name = name + '.json';
+if (type(content) != 'string') return { success: false, error: 'invalid content' };
+if (total < 1 || idx < 0 || idx >= total) return { success: false, error: 'invalid chunk' };
+if (total == 1 && !content) return { success: false, error: 'empty content' };
+let dir = '/usr/share/clashoo/config/singbox';
+system('mkdir -p ' + shell_quote(dir) + ' >/dev/null 2>&1');
+let tmp = '/tmp/clashoo_sb_upload_' + name;
+if (idx == 0) {
+  if (writefile(tmp, content) === null)
+    return { success: false, error: 'write_failed', message: '写入文件失败' };
+} else {
+  let fp = open(tmp, 'a');
+  if (!fp) return { success: false, error: 'write_failed', message: '打开文件失败' };
+  let ok = fp.write(content);
+  fp.close();
+  if (ok === null) return { success: false, error: 'write_failed', message: '写入文件失败' };
+}
+if (idx + 1 < total)
+  return { success: true, name, index: idx, total, complete: false };
+let binary = find_binary();
+if (binary && match(binary, /sing-box/)) {
+  if (system(shell_quote(binary) + ' check -c ' + shell_quote(tmp) + ' >/dev/null 2>&1') != 0) {
+    system('rm -f ' + shell_quote(tmp));
+    return { success: false, error: 'invalid_config', message: 'sing-box 配置验证失败，请检查 JSON 格式' };
+  }
+}
+if (system('cp -f ' + shell_quote(tmp) + ' ' + shell_quote(dir + '/' + name) + ' >/dev/null 2>&1') != 0) {
+  system('rm -f ' + shell_quote(tmp));
+  return { success: false, error: 'write_failed', message: '写入文件失败' };
+}
+system('rm -f ' + shell_quote(tmp));
+return { success: true, name, index: idx, total, complete: true };
+}
+},
+
 set_singbox_profile: {
 args: { name: 'name' },
 call: function(req) {
@@ -160,8 +160,18 @@ const injectStyles = () => {
 		'.btn-allow:hover { background: #059669 !important; color: #fff !important; }',
 		'.btn-block { background: rgba(239, 68, 68, 0.12) !important; color: #dc2626 !important; border: 1px solid rgba(239, 68, 68, 0.3) !important; }',
 		'.btn-block:hover { background: #dc2626 !important; color: #fff !important; }',
+		'.mosdns-pagination-bar { display: flex !important; justify-content: space-between !important; align-items: center !important; margin-top: 0.5rem !important; padding: 0.75rem 0.5rem 0.25rem 0.5rem !important; border-top: 1px solid var(--border-color-medium, rgba(125,125,125,0.15)) !important; flex-wrap: wrap !important; gap: 0.5rem !important; box-sizing: border-box !important; width: 100% !important; }',
+		'.mosdns-pagination-bar::after, .mosdns-pagination-bar::before { display: none !important; content: none !important; }',
+		'.mosdns-pagination-info { display: inline-flex !important; align-items: center !important; font-size: 0.85rem !important; opacity: 0.85 !important; }',
+		'.mosdns-pagination-btns { display: flex !important; gap: 0.5rem !important; margin-left: auto !important; }',
+		'.mosdns-page-input { height: 24px !important; line-height: 22px !important; text-align: center !important; font-size: 0.82rem !important; font-weight: 600 !important; padding: 0 4px !important; margin: 0 4px !important; border: 1px solid rgba(125,125,125,0.3) !important; border-radius: 4px !important; background: var(--cbi-section-bg, #fff) !important; color: inherit !important; display: inline-block !important; vertical-align: middle !important; box-sizing: border-box !important; transition: all 0.2s ease !important; }',
+		'.mosdns-page-input:focus { border-color: #3b82f6 !important; box-shadow: 0 0 0 2px rgba(59, 130, 246, 0.25) !important; outline: none !important; }',
+		'.mosdns-page-input::-webkit-outer-spin-button, .mosdns-page-input::-webkit-inner-spin-button { -webkit-appearance: none !important; margin: 0 !important; }',
+		'.mosdns-page-input[type=number] { -moz-appearance: textfield !important; }',
 		'@keyframes pulse { 0% { opacity: 1; } 50% { opacity: 0.4; } 100% { opacity: 1; } }',
 		'@media (prefers-color-scheme: dark) {',
+		'	.mosdns-pagination-bar { border-top-color: rgba(255,255,255,0.08) !important; }',
+		'	.mosdns-page-input { background: rgba(255,255,255,0.06) !important; border-color: rgba(255,255,255,0.18) !important; color: #fff !important; }',
 		'	.mosdns-stat-card, .mosdns-rank-panel, .mosdns-modal-meta-item, .mosdns-answer-row { background: rgba(255,255,255,0.03); border-color: rgba(255,255,255,0.08); box-shadow: none; }',
 		'	.mosdns-sparkline-tooltip { background: #1e242b; border-color: rgba(255,255,255,0.15); box-shadow: 0 4px 12px rgba(0,0,0,0.5); }',
 		'	.mosdns-log-row:hover { background: rgba(255,255,255,0.04); }',
@@ -864,7 +874,7 @@ const renderLogsTable = logsData => {
 			E('td', { class: 'td col-time', style: 'font-size: 0.82rem; opacity: 0.7; white-space: nowrap;' }, formatTimestamp(item.timestamp)),
 			E('td', {
 				class: 'td col-client mosdns-mono',
-				style: 'font-size: 0.82rem; max-width: 150px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;',
+				style: 'font-size: 0.82rem; max-width: 190px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;',
 				title: clientInfo.title
 			}, clientInfo.display),
 			E('td', { class: 'td col-domain', style: 'max-width: 320px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;', title: item.domain || '-' }, [
@@ -887,47 +897,99 @@ const renderLogsTable = logsData => {
 		]));
 	}

-	return E('div', {}, [
-		E('table', { class: 'table cbi-section-table mosdns-table', style: 'margin-top: 0.25rem;' }, [
-			E('tr', { class: 'tr table-titles' }, [
-				E('th', { class: 'th col-time', style: 'width: 85px;' }, _('Time')),
-				E('th', { class: 'th col-client', style: 'width: 125px;' }, _('Client IP')),
-				E('th', { class: 'th col-domain' }, _('Domain & Record')),
-				E('th', { class: 'th col-status', style: 'width: 90px;' }, _('Status')),
-				E('th', { class: 'th col-answers' }, _('Answers')),
-				E('th', { class: 'th col-latency', style: 'width: 80px; text-align: right;' }, _('Elapsed'))
-			]),
-			...rows
-		]),
+		const inputWidth = Math.max(46, (String(totalPages).length * 8 + 18)) + 'px';
+		const pageInput = E('input', {
+			type: 'number',
+			class: 'cbi-input-text mosdns-page-input',
+			min: 1,
+			max: totalPages,
+			value: pageIdx + 1,
+			style: `width: ${inputWidth};`,
+			title: _('Enter page number and press Enter to jump')
+		});

-		E('div', { style: 'display: flex; justify-content: space-between; align-items: center; margin-top: 0.75rem;' }, [
-			E('span', { style: 'font-size: 0.85rem; opacity: 0.7;' }, _('Page %d / %d (%d entries)').format(pageIdx + 1, totalPages, total)),
-			E('div', { style: 'display: flex; gap: 0.5rem;' }, [
-				E('button', {
-					class: 'btn cbi-button cbi-button-action',
-					disabled: pageIdx === 0 ? 'disabled' : null,
-					click: () => {
-						if (pageIdx > 0) {
-							pageIdx--;
-							updateLiveStatusBadge();
-							refreshLogs();
+		const doJump = () => {
+			const val = parseInt(pageInput.value, 10);
+			if (isNaN(val)) {
+				pageInput.value = pageIdx + 1;
+				return;
+			}
+			const targetPage = Math.max(1, Math.min(totalPages, val));
+			pageInput.value = targetPage;
+			if (targetPage - 1 !== pageIdx) {
+				pageIdx = targetPage - 1;
+				updateLiveStatusBadge();
+				refreshLogs();
+			}
+		};
+
+		pageInput.addEventListener('keydown', ev => {
+			if (ev.key === 'Enter') {
+				ev.preventDefault();
+				pageInput.blur();
+			}
+		});
+
+		pageInput.addEventListener('focus', () => {
+			pageInput.select();
+		});
+
+		pageInput.addEventListener('blur', () => {
+			doJump();
+		});
+
+		const pageParts = _('Page %d / %d (%d entries)').format(999999, totalPages, total).split('999999');
+		const paginationLabel = E('div', {
+			class: 'mosdns-pagination-info'
+		}, [
+			pageParts[0] || '',
+			pageInput,
+			pageParts[1] || ''
+		]);
+
+		return E('div', {}, [
+			E('table', { class: 'table cbi-section-table mosdns-table', style: 'margin-top: 0.25rem; margin-bottom: 0;' }, [
+				E('tr', { class: 'tr table-titles' }, [
+					E('th', { class: 'th col-time', style: 'width: 85px;' }, _('Time')),
+					E('th', { class: 'th col-client', style: 'width: 125px;' }, _('Client IP')),
+					E('th', { class: 'th col-domain' }, _('Domain & Record')),
+					E('th', { class: 'th col-status', style: 'width: 90px;' }, _('Status')),
+					E('th', { class: 'th col-answers' }, _('Answers')),
+					E('th', { class: 'th col-latency', style: 'width: 95px; text-align: right;' }, _('Elapsed'))
+				]),
+				...rows
+			]),
+
+			E('div', {
+				class: 'mosdns-pagination-bar'
+			}, [
+				paginationLabel,
+				E('div', { class: 'mosdns-pagination-btns' }, [
+					E('button', {
+						class: 'btn cbi-button cbi-button-action',
+						disabled: pageIdx === 0 ? 'disabled' : null,
+						click: () => {
+							if (pageIdx > 0) {
+								pageIdx--;
+								updateLiveStatusBadge();
+								refreshLogs();
+							}
 						}
-					}
-				}, _('Previous')),
-				E('button', {
-					class: 'btn cbi-button cbi-button-action',
-					disabled: (pageIdx + 1) >= totalPages ? 'disabled' : null,
-					click: () => {
-						if ((pageIdx + 1) < totalPages) {
-							pageIdx++;
-							updateLiveStatusBadge();
-							refreshLogs();
+					}, _('Previous')),
+					E('button', {
+						class: 'btn cbi-button cbi-button-action',
+						disabled: (pageIdx + 1) >= totalPages ? 'disabled' : null,
+						click: () => {
+							if ((pageIdx + 1) < totalPages) {
+								pageIdx++;
+								updateLiveStatusBadge();
+								refreshLogs();
+							}
 						}
-					}
-				}, _('Next'))
+					}, _('Next'))
+				])
 			])
-		])
-	]);
+		]);
 };

 const pollScheduler = async () => {
@@ -17,19 +17,19 @@ msgstr ""
 msgid "API Options"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:718
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:728
 msgid "Add domain to the blocklist to block DNS resolution:"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:717
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:727
 msgid "Add domain to the whitelist to permit DNS resolution:"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:710
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:720
 msgid "Add to Blocklist"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:710
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:720
 msgid "Add to Whitelist"
 msgstr ""

@@ -90,7 +90,7 @@ msgstr ""
 msgid "Aliyun Public DNS (DNS over QUIC)"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1026
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1088
 msgid "All Queries"
 msgstr ""

@@ -99,8 +99,8 @@ msgstr ""
 msgid "Another update is already in progress."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:805
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:897
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:815
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:957
 msgid "Answers"
 msgstr ""

@@ -108,7 +108,7 @@ msgstr ""
 msgid "Apple domains optimization"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1053
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1115
 msgid ""
 "Are you sure you want to clear all real-time query logs and top rankings?"
 msgstr ""
@@ -127,11 +127,11 @@ msgid ""
 "rules through scheduled tasks."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:478
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:488
 msgid "Average Processing Time"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:538
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:548
 msgid "Avg Processing"
 msgstr ""

@@ -155,8 +155,8 @@ msgid ""
 msgstr ""

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/rules.js:31
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:633
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:635
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:643
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:645
 msgid "Block Lists"
 msgstr ""

@@ -164,11 +164,11 @@ msgstr ""
 msgid "Block PTR"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1027
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1089
 msgid "Blocked Only"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:456
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:466
 msgid "Blocked by Filters"
 msgstr ""

@@ -190,16 +190,16 @@ msgstr ""
 msgid "Cache Prefetching"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1028
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1090
 msgid "Cached Only"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:467
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:477
 msgid "Cached Queries"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:730
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1058
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:740
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1120
 msgid "Cancel"
 msgstr ""

@@ -229,7 +229,7 @@ msgstr ""
 msgid "Cisco Public DNS (208.67.222.222)"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1078
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1140
 msgid "Clear"
 msgstr ""

@@ -237,22 +237,22 @@ msgstr ""
 msgid "Clear logs"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1049
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1052
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1111
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1114
 msgid "Clear query logs"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:861
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:878
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:871
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:888
 msgid "Click to view full details"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:787
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:894
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:797
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:954
 msgid "Client IP"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:832
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:842
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/update.js:35
 msgid "Close"
 msgstr ""
@@ -292,7 +292,7 @@ msgstr ""
 msgid "Configuration Editor"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:734
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:744
 msgid "Confirm"
 msgstr ""

@@ -330,7 +330,7 @@ msgstr ""
 msgid "DNS Forward"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:444
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:454
 msgid "DNS Queries Total"
 msgstr ""

@@ -374,20 +374,20 @@ msgstr ""
 msgid "DoH/TCP/DoT Connection Multiplexing idle timeout (default 30 seconds)"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:895
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:955
 msgid "Domain & Record"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:627
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:655
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:637
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:665
 msgid "Domain name cannot be empty."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:720
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:730
 msgid "Domain:"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:898
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:958
 msgid "Elapsed"
 msgstr ""

@@ -425,6 +425,10 @@ msgstr ""
 msgid "Enabled"
 msgstr ""

+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:908
+msgid "Enter page number and press Enter to jump"
+msgstr ""
+
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:505
 msgid "Enter the GeoIP.dat category to be exported, Allow add multiple tags"
 msgstr ""
@@ -478,7 +482,7 @@ msgstr ""
 msgid "Failed to clean logs."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1072
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1134
 msgid "Failed to clear query logs:"
 msgstr ""

@@ -486,15 +490,15 @@ msgstr ""
 msgid "Failed to start update."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:970
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1032
 msgid "Failed to update query logs:"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:699
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:709
 msgid "Failed to update rule file: %s"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1044
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1106
 msgid "First Page / Resume"
 msgstr ""

@@ -595,10 +599,10 @@ msgstr ""

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:410
 msgid ""
-"IPv4 CIDR: <a href=\"https://www.cloudflare.com/ips-v4\" "
-"target=\"_blank\">https://www.cloudflare.com/ips-v4</a> <br /> IPv6 CIDR: <a "
-"href=\"https://www.cloudflare.com/ips-v6\" target=\"_blank\">https://www."
-"cloudflare.com/ips-v6</a>"
+"IPv4 CIDR: <a href=\"https://www.cloudflare.com/ips-v4\" target=\"_blank"
+"\">https://www.cloudflare.com/ips-v4</a> <br /> IPv6 CIDR: <a href=\"https://"
+"www.cloudflare.com/ips-v6\" target=\"_blank\">https://www.cloudflare.com/ips-"
+"v6</a>"
 msgstr ""

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:190
@@ -621,7 +625,7 @@ msgstr ""
 msgid "Info"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:828
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:838
 msgid "Intercept"
 msgstr ""

@@ -631,7 +635,7 @@ msgid ""
 "seconds)."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:479
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:489
 msgid "Latency"
 msgstr ""

@@ -716,12 +720,12 @@ msgstr ""
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:33
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:106
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/logs.js:70
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1094
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1156
 #: luci-app-mosdns/root/usr/share/luci/menu.d/luci-app-mosdns.json:3
 msgid "MosDNS"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:510
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:520
 msgid ""
 "MosDNS API is unreachable. Please ensure MosDNS is running and stats_api "
 "plugin is enabled."
@@ -739,15 +743,15 @@ msgstr ""
 msgid "Netflix, Disney+, Hulu and streaming media rules list will use this DNS"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:927
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:989
 msgid "Next"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:768
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:778
 msgid "No DNS answer records returned."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:560
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:570
 msgid "No data available"
 msgstr ""

@@ -755,19 +759,19 @@ msgstr ""
 msgid "No log data."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:886
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:896
 msgid "No query log entries found."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:904
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:941
 msgid "Page %d / %d (%d entries)"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:438
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:448
 msgid "Per-query speed"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:821
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:831
 msgid "Permit"
 msgstr ""

@@ -802,7 +806,7 @@ msgstr ""
 msgid "Prevent DNS Leaks"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:916
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:978
 msgid "Previous"
 msgstr ""

@@ -821,7 +825,7 @@ msgstr ""
 msgid "Quad9 Public DNS (9.9.9.9)"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:811
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:821
 msgid "Query Log Details"
 msgstr ""

@@ -831,7 +835,7 @@ msgid ""
 "consume more memory)"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1067
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1129
 msgid "Query logs cleared successfully."
 msgstr ""

@@ -839,7 +843,7 @@ msgstr ""
 msgid "RUNNING"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1098
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1160
 msgid "Real-time Query Logs"
 msgstr ""

@@ -869,7 +873,7 @@ msgstr ""
 msgid "Ring Buffer Capacity"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:799
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:809
 msgid "Rule Hit"
 msgstr ""

@@ -889,7 +893,7 @@ msgstr ""
 msgid "Save the cache locally and reload the cache dump on the next startup"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1015
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1077
 msgid "Search domain or client IP..."
 msgstr ""

@@ -901,7 +905,7 @@ msgstr ""
 msgid "Starting update..."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1094
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1156
 #: luci-app-mosdns/root/usr/share/luci/menu.d/luci-app-mosdns.json:38
 msgid "Statistics"
 msgstr ""
@@ -910,7 +914,7 @@ msgstr ""
 msgid "Stats Dump"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:896
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:956
 msgid "Status"
 msgstr ""

@@ -930,7 +934,7 @@ msgstr ""
 msgid "TCP/DoT Connection Multiplexing"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:723
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:733
 msgid "Target file: %s (supports domain matching rules)"
 msgstr ""

@@ -966,20 +970,20 @@ msgid ""
 "content in yaml format."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:791
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:893
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:801
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:953
 msgid "Time"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:599
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:609
 msgid "Top Blocked Domains"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:606
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:616
 msgid "Top Clients"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:592
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:602
 msgid "Top Queried Domains"
 msgstr ""

@@ -1029,7 +1033,7 @@ msgstr ""
 msgid "Updating Database..."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:795
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:805
 msgid "Upstream"
 msgstr ""

@@ -1051,8 +1055,8 @@ msgid ""
 msgstr ""

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/rules.js:23
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:633
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:635
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:643
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:645
 msgid "White Lists"
 msgstr ""

@@ -1070,15 +1074,15 @@ msgstr ""
 msgid "https://gh-proxy.com"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:427
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:540
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:437
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:550
 msgid "● Live"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:223
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:233
 msgid "● Live Auto-refresh"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:227
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:237
 msgid "❚❚ Paused (Page %d)"
 msgstr ""
@@ -27,19 +27,19 @@ msgstr "API 监听端口"
 msgid "API Options"
 msgstr "API 选项"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:718
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:728
 msgid "Add domain to the blocklist to block DNS resolution:"
 msgstr "将域名添加到黑名单以拦截 DNS 解析："

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:717
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:727
 msgid "Add domain to the whitelist to permit DNS resolution:"
 msgstr "将域名添加到白名单以放行 DNS 解析："

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:710
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:720
 msgid "Add to Blocklist"
 msgstr "添加到黑名单"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:710
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:720
 msgid "Add to Whitelist"
 msgstr "添加到白名单"

@@ -105,7 +105,7 @@ msgstr "阿里云公共 DNS（DNS over HTTPS）"
 msgid "Aliyun Public DNS (DNS over QUIC)"
 msgstr "阿里云公共 DNS（DNS over QUIC）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1026
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1088
 msgid "All Queries"
 msgstr "所有查询"

@@ -114,8 +114,8 @@ msgstr "所有查询"
 msgid "Another update is already in progress."
 msgstr "另一个更新正在进行中。"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:805
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:897
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:815
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:957
 msgid "Answers"
 msgstr "应答结果"

@@ -123,7 +123,7 @@ msgstr "应答结果"
 msgid "Apple domains optimization"
 msgstr "Apple 域名解析优化"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1053
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1115
 msgid ""
 "Are you sure you want to clear all real-time query logs and top rankings?"
 msgstr "确定要清空所有实时查询日志和排行数据吗？"
@@ -142,11 +142,11 @@ msgid ""
 "rules through scheduled tasks."
 msgstr "通过定时任务自动更新 GeoIP 和 GeoSite 数据库以及广告过滤规则。"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:478
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:488
 msgid "Average Processing Time"
 msgstr "平均延迟"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:538
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:548
 msgid "Avg Processing"
 msgstr "平均处理"

@@ -172,8 +172,8 @@ msgstr ""
 "解析。"

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/rules.js:31
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:633
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:635
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:643
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:645
 msgid "Block Lists"
 msgstr "黑名单"

@@ -181,11 +181,11 @@ msgstr "黑名单"
 msgid "Block PTR"
 msgstr "PTR 黑名单"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1027
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1089
 msgid "Blocked Only"
 msgstr "仅拦截"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:456
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:466
 msgid "Blocked by Filters"
 msgstr "拦截总数"

@@ -207,16 +207,16 @@ msgstr "自动保存缓存"
 msgid "Cache Prefetching"
 msgstr "缓存预取"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1028
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1090
 msgid "Cached Only"
 msgstr "仅缓存"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:467
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:477
 msgid "Cached Queries"
 msgstr "缓存命中"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:730
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1058
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:740
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1120
 msgid "Cancel"
 msgstr "取消"

@@ -246,7 +246,7 @@ msgstr "思科公共 DNS（208.67.220.220）"
 msgid "Cisco Public DNS (208.67.222.222)"
 msgstr "思科公共 DNS（208.67.222.222）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1078
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1140
 msgid "Clear"
 msgstr "清空"

@@ -254,22 +254,22 @@ msgstr "清空"
 msgid "Clear logs"
 msgstr "清空日志"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1049
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1052
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1111
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1114
 msgid "Clear query logs"
 msgstr "清除查询日志"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:861
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:878
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:871
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:888
 msgid "Click to view full details"
 msgstr "点击查看完整详情"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:787
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:894
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:797
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:954
 msgid "Client IP"
 msgstr "客户端 IP"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:832
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:842
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/update.js:35
 msgid "Close"
 msgstr "关闭"
@@ -309,7 +309,7 @@ msgstr "配置文件"
 msgid "Configuration Editor"
 msgstr "配置编辑器"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:734
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:744
 msgid "Confirm"
 msgstr "确认"

@@ -348,7 +348,7 @@ msgstr "DNS 缓存大小"
 msgid "DNS Forward"
 msgstr "DNS 转发"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:444
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:454
 msgid "DNS Queries Total"
 msgstr "DNS 查询总数"

@@ -393,20 +393,20 @@ msgstr ""
 msgid "DoH/TCP/DoT Connection Multiplexing idle timeout (default 30 seconds)"
 msgstr "DoH/TCP/DoT 连接复用空闲保持时间（默认 30 秒）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:895
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:955
 msgid "Domain & Record"
 msgstr "域名与类型"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:627
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:655
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:637
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:665
 msgid "Domain name cannot be empty."
 msgstr "域名不能为空"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:720
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:730
 msgid "Domain:"
 msgstr "域名："

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:898
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:958
 msgid "Elapsed"
 msgstr "耗时"

@@ -444,6 +444,10 @@ msgstr "启用此选项 fallback 策略会强制转发到远程 DNS"
 msgid "Enabled"
 msgstr "启用"

+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:908
+msgid "Enter page number and press Enter to jump"
+msgstr "输入页码并按回车跳转"
+
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:505
 msgid "Enter the GeoIP.dat category to be exported, Allow add multiple tags"
 msgstr "输入需要导出的 GeoIP.dat 类别条目，允许添加多个标签"
@@ -497,7 +501,7 @@ msgstr "导出目录：/var/mosdns"
 msgid "Failed to clean logs."
 msgstr "清理日志失败：%s"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1072
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1134
 msgid "Failed to clear query logs:"
 msgstr "清除查询日志失败："

@@ -505,15 +509,15 @@ msgstr "清除查询日志失败："
 msgid "Failed to start update."
 msgstr "启动更新失败"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:970
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1032
 msgid "Failed to update query logs:"
 msgstr "更新查询日志失败："

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:699
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:709
 msgid "Failed to update rule file: %s"
 msgstr "更新规则文件失败: %s"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1044
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1106
 msgid "First Page / Resume"
 msgstr "重置并恢复"

@@ -614,15 +618,15 @@ msgstr "IP 地址"

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:410
 msgid ""
-"IPv4 CIDR: <a href=\"https://www.cloudflare.com/ips-v4\" "
-"target=\"_blank\">https://www.cloudflare.com/ips-v4</a> <br /> IPv6 CIDR: <a "
-"href=\"https://www.cloudflare.com/ips-v6\" target=\"_blank\">https://www."
-"cloudflare.com/ips-v6</a>"
+"IPv4 CIDR: <a href=\"https://www.cloudflare.com/ips-v4\" target=\"_blank"
+"\">https://www.cloudflare.com/ips-v4</a> <br /> IPv6 CIDR: <a href=\"https://"
+"www.cloudflare.com/ips-v6\" target=\"_blank\">https://www.cloudflare.com/ips-"
+"v6</a>"
 msgstr ""
-"IPv4 CIDR: <a href=\"https://www.cloudflare.com/ips-v4\" "
-"target=\"_blank\">https://www.cloudflare.com/ips-v4</a> <br /> IPv6 CIDR: <a "
-"href=\"https://www.cloudflare.com/ips-v6\" target=\"_blank\">https://www."
-"cloudflare.com/ips-v6</a>"
+"IPv4 CIDR: <a href=\"https://www.cloudflare.com/ips-v4\" target=\"_blank"
+"\">https://www.cloudflare.com/ips-v4</a> <br /> IPv6 CIDR: <a href=\"https://"
+"www.cloudflare.com/ips-v6\" target=\"_blank\">https://www.cloudflare.com/ips-"
+"v6</a>"

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:190
 msgid ""
@@ -644,7 +648,7 @@ msgstr "空闲超时"
 msgid "Info"
 msgstr "信息"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:828
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:838
 msgid "Intercept"
 msgstr "拦截"

@@ -654,7 +658,7 @@ msgid ""
 "seconds)."
 msgstr "后台线程扫描缓存以进行预取的时间间隔（单位：秒）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:479
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:489
 msgid "Latency"
 msgstr "延迟"

@@ -742,12 +746,12 @@ msgstr "修改 DNS 应答结果的最小 TTL 值 (秒)，0 表示不修改"
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:33
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:106
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/logs.js:70
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1094
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1156
 #: luci-app-mosdns/root/usr/share/luci/menu.d/luci-app-mosdns.json:3
 msgid "MosDNS"
 msgstr "MosDNS"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:510
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:520
 msgid ""
 "MosDNS API is unreachable. Please ensure MosDNS is running and stats_api "
 "plugin is enabled."
@@ -767,15 +771,15 @@ msgstr "未运行"
 msgid "Netflix, Disney+, Hulu and streaming media rules list will use this DNS"
 msgstr "自定义 Netflix、Disney+、Hulu 以及 “流媒体” 规则列表的 DNS 服务器"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:927
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:989
 msgid "Next"
 msgstr "下一页"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:768
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:778
 msgid "No DNS answer records returned."
 msgstr "无 DNS 应答记录"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:560
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:570
 msgid "No data available"
 msgstr "暂无数据"

@@ -783,19 +787,19 @@ msgstr "暂无数据"
 msgid "No log data."
 msgstr "无日志数据。"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:886
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:896
 msgid "No query log entries found."
 msgstr "未找到查询日志记录。"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:904
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:941
 msgid "Page %d / %d (%d entries)"
 msgstr "第 %d / %d 页（%d 条记录）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:438
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:448
 msgid "Per-query speed"
 msgstr "单次查询速度"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:821
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:831
 msgid "Permit"
 msgstr "放行"

@@ -832,7 +836,7 @@ msgstr "当剩余 TTL 小于此值（秒）时触发预取"
 msgid "Prevent DNS Leaks"
 msgstr "防止 DNS 泄漏"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:916
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:978
 msgid "Previous"
 msgstr "上一页"

@@ -851,7 +855,7 @@ msgstr "Quad9 公共 DNS（149.112.112.112）"
 msgid "Quad9 Public DNS (9.9.9.9)"
 msgstr "Quad9 公共 DNS（9.9.9.9）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:811
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:821
 msgid "Query Log Details"
 msgstr "查询日志详情"

@@ -861,7 +865,7 @@ msgid ""
 "consume more memory)"
 msgstr "查询日志环形缓冲区容量（FIFO 覆盖，默认 2000，数值越大占用内存越多）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1067
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1129
 msgid "Query logs cleared successfully."
 msgstr "查询日志清除成功。"

@@ -869,7 +873,7 @@ msgstr "查询日志清除成功。"
 msgid "RUNNING"
 msgstr "运行中"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1098
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1160
 msgid "Real-time Query Logs"
 msgstr "实时查询日志"

@@ -901,7 +905,7 @@ msgstr "远程 DNS 服务器"
 msgid "Ring Buffer Capacity"
 msgstr "环形缓冲区容量"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:799
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:809
 msgid "Rule Hit"
 msgstr "命中规则"

@@ -921,7 +925,7 @@ msgstr "保存统计数据与查询日志在本地，并在下次启动时重新
 msgid "Save the cache locally and reload the cache dump on the next startup"
 msgstr "保存缓存到本地文件，以供下次启动时重新载入使用"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1015
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1077
 msgid "Search domain or client IP..."
 msgstr "搜索域名或客户端 IP..."

@@ -933,7 +937,7 @@ msgstr "设置日志文件的最大容量（单位：MB）。"
 msgid "Starting update..."
 msgstr "正在启动更新..."

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1094
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1156
 #: luci-app-mosdns/root/usr/share/luci/menu.d/luci-app-mosdns.json:38
 msgid "Statistics"
 msgstr "统计"
@@ -942,7 +946,7 @@ msgstr "统计"
 msgid "Stats Dump"
 msgstr "自动保存统计"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:896
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:956
 msgid "Status"
 msgstr "状态"

@@ -962,7 +966,7 @@ msgstr "支持本地文件，例如：file:///var/mosdns/example.txt"
 msgid "TCP/DoT Connection Multiplexing"
 msgstr "TCP/DoT 连接复用"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:723
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:733
 msgid "Target file: %s (supports domain matching rules)"
 msgstr "目标文件: %s (支持域名匹配规则)"

@@ -1002,20 +1006,20 @@ msgstr ""
 "这是文件 “/etc/mosdns/config_custom.yaml” 的内容，您的 MosDNS 配置将从此文件"
 "生成。仅接受 yaml 格式的配置内容。"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:791
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:893
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:801
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:953
 msgid "Time"
 msgstr "时间"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:599
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:609
 msgid "Top Blocked Domains"
 msgstr "拦截域名 (Top 10)"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:606
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:616
 msgid "Top Clients"
 msgstr "活跃客户端 (Top 10)"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:592
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:602
 msgid "Top Queried Domains"
 msgstr "查询域名 (Top 10)"

@@ -1065,7 +1069,7 @@ msgstr "更新成功"
 msgid "Updating Database..."
 msgstr "更新数据库..."

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:795
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:805
 msgid "Upstream"
 msgstr "上游服务器"

@@ -1091,8 +1095,8 @@ msgstr ""
 "则）"

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/rules.js:23
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:633
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:635
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:643
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:645
 msgid "White Lists"
 msgstr "白名单"

@@ -1110,24 +1114,15 @@ msgstr "信风公共 DNS（114.114.115.115）"
 msgid "https://gh-proxy.com"
 msgstr "https://gh-proxy.com"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:427
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:540
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:437
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:550
 msgid "● Live"
 msgstr "● 实时"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:223
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:233
 msgid "● Live Auto-refresh"
 msgstr "● 实时刷新"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:227
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:237
 msgid "❚❚ Paused (Page %d)"
 msgstr "❚❚ 暂停 (第 %d 页)"
-
-#~ msgid "Action"
-#~ msgstr "操作"
-
-#~ msgid "Add %s to Blocklist"
-#~ msgstr "将 %s 添加到黑名单"
-
-#~ msgid "Add %s to Whitelist"
-#~ msgstr "将 %s 添加到白名单"
@@ -72,7 +72,7 @@ function get_adlist() {
 	let adblock = uci_cursor.get('mosdns', 'config', 'adblock');

 	if (adblock !== '1') {
-		mkdir('/etc/mosdns/rule', 0755);
+		mkdir('/var/mosdns', 0755);
 		exec_sys('rm -rf /etc/mosdns/rule/adlist /etc/mosdns/rule/.ad_source');
 		writefile('/var/mosdns/disable-ads.txt', '');
 		print("/var/mosdns/disable-ads.txt\n");
@@ -620,6 +620,7 @@ if singbox_tags:find("with_utls") then
 	o:depends({ protocol = "shadowsocks", tls = true })
 	o:depends({ protocol = "trojan", tls = true })
 	o:depends({ protocol = "anytls", tls = true })
+	o:depends({ protocol = "http", tls = true })

 	o = s:option(Value, "reality_publicKey", translate("Public Key"))
 	o:depends({ reality = true })
@@ -401,6 +401,7 @@ o = s:option(Flag, "tls", translate("TLS"))
 o.default = 0
 o:depends({ protocol = "vmess" })
 o:depends({ protocol = "vless" })
+o:depends({ protocol = "http" })
 o:depends({ protocol = "trojan" })
 o:depends({ protocol = "shadowsocks" })

@@ -719,6 +720,8 @@ o:depends({ protocol = "vless", transport = "raw" })
 o:depends({ protocol = "vless", transport = "ws" })
 o:depends({ protocol = "vless", transport = "grpc" })
 o:depends({ protocol = "vless", transport = "httpupgrade" })
+o:depends({ protocol = "http" })
+o:depends({ protocol = "socks" })
 o:depends({ protocol = "shadowsocks" })
 o:depends({ protocol = "trojan" })

@@ -206,13 +206,18 @@ o.validate = function(self, value, t)
 end
 o:depends({ protocol = "vmess" })
 o:depends({ protocol = "vless" })
+o:depends({ protocol = "http" })
 o:depends({ protocol = "shadowsocks" })
 o:depends({ protocol = "trojan" })

 -- [[ REALITY部分 ]] --
 o = s:option(Flag, "reality", translate("REALITY"))
 o.default = 0
-o:depends({ tls = true })
+o:depends({ tls = true, transport = "raw" })
+o:depends({ tls = true, transport = "ws" })
+o:depends({ tls = true, transport = "grpc" })
+o:depends({ tls = true, transport = "httpupgrade" })
+o:depends({ tls = true, transport = "xhttp" })

 o = s:option(Value, "reality_private_key", translate("Private Key"))
 o:depends({ reality = true })
@@ -163,12 +163,16 @@ function sh_uci_commit(config)
 	exec_call(string.format("uci -q commit %s", config))
 end

+function del_cache_var(key)
+	sys.call(string.format('. /usr/share/passwall2/utils.sh ; del_cache_var "%s"', key))
+end
+
 function set_cache_var(key, val)
-	sys.call(string.format('. /usr/share/passwall/utils.sh ; set_cache_var %s "%s"', key, val))
+	sys.call(string.format('. /usr/share/passwall/utils.sh ; set_cache_var "%s" "%s"', key, val))
 end

 function get_cache_var(key)
-	local val = sys.exec(string.format('. /usr/share/passwall/utils.sh ; echo -n $(get_cache_var %s)', key))
+	local val = sys.exec(string.format('. /usr/share/passwall/utils.sh ; echo -n $(get_cache_var "%s")', key))
 	if val == "" then val = nil end
 	return val
 end
@@ -2072,3 +2076,11 @@ function gen_wireguard_key()
 		}
 	end
 end
+
+function get_socks_port_by_cache(node_id)
+	return get_cache_var("node_%s_socks_port" % { node_id })
+end
+
+function set_socks_port_to_cache(node_id, v)
+	set_cache_var("node_%s_socks_port" % { node_id }, v)
+end
@@ -105,31 +105,51 @@ function gen_outbound(flag, node, tag, proxy_table)
 		end

 		if node.type ~= "sing-box" then
-			local relay_port = node.port
-			local new_port = api.get_new_port()
-			local config_file = string.format("%s_%s_%s.json", flag, tag, new_port)
-			if tag and node_id and not tag:find(node_id) then
-				config_file = string.format("%s_%s_%s_%s.json", flag, tag, node_id, new_port)
-			end
-			if run_socks_instance then
-				sys.call(string.format('/usr/share/passwall/app.sh run_socks "%s"> /dev/null',
-					string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
-						new_port, --flag
-						node_id, --node
-						"127.0.0.1", --bind
-						new_port, --socks port
-						config_file, --config file
-						(proxy_tag and relay_port) and tostring(relay_port) or "" --relay port
+			if node.type == "Socks" then
+				node.protocol = "socks"
+				proxy_tag = "socks <- " .. node_id
+			else
+				local new_port
+				if run_socks_instance then
+					local relay_port = (proxy_tag and node.port) and tostring(node.port) or ""
+					if relay_port == "" then
+						local cache = api.get_socks_port_by_cache(node_id)
+						if cache then
+							new_port = cache
+							run_socks_instance = nil
+						end
+					end
+					if run_socks_instance then
+						new_port = api.get_new_port()
+						local config_file = string.format("nodesocks_%s_%s.json", node_id, new_port)
+						if tag and node_id and not tag:find(node_id) then
+							config_file = string.format("nodesocks_%s_%s_%s.json", tag, node_id, new_port)
+						end
+						sys.call(string.format('/usr/share/passwall/app.sh run_socks "%s"> /dev/null',
+							string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
+								new_port, --flag
+								node_id, --node
+								"127.0.0.1", --bind
+								new_port, --socks port
+								config_file, --config file
+								relay_port --relay port
+								)
+							)
 						)
-					)
-				)
+						if relay_port == "" then
+							api.set_socks_port_to_cache(node_id, new_port)
+						end
+					end
+				end
+				if new_port then
+					node = {
+						protocol = "socks",
+						address = "127.0.0.1",
+						port = new_port
+					}
+					proxy_tag = "socks <- " .. node_id
+				end
 			end
-			node = {
-				protocol = "socks",
-				address = "127.0.0.1",
-				port = new_port
-			}
-			proxy_tag = "socks <- " .. node_id
 		else
 			if proxy_tag then
 				node.detour = proxy_tag
@@ -481,9 +501,9 @@ function gen_outbound(flag, node, tag, proxy_table)
 				obfs = node.hysteria_obfs,
 				auth = (node.hysteria_auth_type == "base64") and node.hysteria_auth_password or nil,
 				auth_str = (node.hysteria_auth_type == "string") and node.hysteria_auth_password or nil,
-				recv_window_conn = tonumber(node.hysteria_recv_window_conn),  --1.14 将变更为 stream_receive_window
-				recv_window = tonumber(node.hysteria_recv_window),  --1.14 将变更为 connection_receive_window
-				disable_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,  --1.14 将变更为 disable_path_mtu_discovery
+				stream_receive_window = tonumber(node.hysteria_recv_window_conn),
+				connection_receive_window = tonumber(node.hysteria_recv_window),
+				disable_path_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,
 				tls = tls
 			}
 		end
@@ -910,10 +930,10 @@ function gen_config_server(node)
 			down_mbps = tonumber(node.hysteria_down_mbps),
 			obfs = node.hysteria_obfs,
 			users = users,
-			recv_window_conn = node.hysteria_recv_window_conn and tonumber(node.hysteria_recv_window_conn) or nil, --1.14 to stream_receive_window
-			recv_window_client = node.hysteria_recv_window_client and tonumber(node.hysteria_recv_window_client) or nil, --1.14 to connection_receive_window
-			max_conn_client = node.hysteria_max_conn_client and tonumber(node.hysteria_max_conn_client) or nil,  --1.14 to max_concurrent_streams
-			disable_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,  --1.14 to disable_path_mtu_discover
+			stream_receive_window = node.hysteria_recv_window_conn and tonumber(node.hysteria_recv_window_conn) or nil,
+			connection_receive_window = node.hysteria_recv_window_client and tonumber(node.hysteria_recv_window_client) or nil,
+			max_concurrent_streams = node.hysteria_max_conn_client and tonumber(node.hysteria_max_conn_client) or nil,
+			disable_path_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,
 			tls = tls
 		}
 	end
@@ -60,29 +60,45 @@ function gen_outbound(flag, node, tag, proxy_table)
 				node.protocol = "socks"
 				node.transport = "tcp"
 			else
-				local relay_port = node.port
-				local new_port = api.get_new_port()
-				local config_file = string.format("%s_%s_%s.json", flag, tag, new_port)
-				if tag and node_id and not tag:find(node_id) then
-					config_file = string.format("%s_%s_%s_%s.json", flag, tag, node_id, new_port)
-				end
+				local new_port
 				if run_socks_instance then
-					sys.call(string.format('/usr/share/passwall/app.sh run_socks "%s"> /dev/null',
-						string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
-							new_port, --flag
-							node_id, --node
-							"127.0.0.1", --bind
-							new_port, --socks port
-							config_file, --config file
-							(proxy_tag and relay_port) and tostring(relay_port) or "" --relay port
+					local relay_port = (proxy_tag and node.port) and tostring(node.port) or ""
+					if relay_port == "" then
+						local cache = api.get_socks_port_by_cache(node_id)
+						if cache then
+							new_port = cache
+							run_socks_instance = nil
+						end
+					end
+					if run_socks_instance then
+						new_port = api.get_new_port()
+						local config_file = string.format("nodesocks_%s_%s.json", node_id, new_port)
+						if tag and node_id and not tag:find(node_id) then
+							config_file = string.format("nodesocks_%s_%s_%s.json", tag, node_id, new_port)
+						end
+						sys.call(string.format('/usr/share/passwall/app.sh run_socks "%s"> /dev/null',
+							string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
+								new_port, --flag
+								node_id, --node
+								"127.0.0.1", --bind
+								new_port, --socks port
+								config_file, --config file
+								relay_port --relay port
+								)
+							)
 						)
-					))
+						if relay_port == "" then
+							api.set_socks_port_to_cache(node_id, new_port)
+						end
+					end
+				end
+				if new_port then
+					node = {}
+					node.protocol = "socks"
+					node.transport = "tcp"
+					node.address = "127.0.0.1"
+					node.port = new_port
 				end
-				node = {}
-				node.protocol = "socks"
-				node.transport = "tcp"
-				node.address = "127.0.0.1"
-				node.port = new_port
 			end
 			node.stream_security = "none"
 			proxy_tag = "socks <- " .. node_id
@@ -120,6 +136,10 @@ function gen_outbound(flag, node, tag, proxy_table)
 			node.stream_security = "tls"
 		end

+		if node.protocol == "http" and node.stream_security == "tls" then
+			node.transport = "raw"
+		end
+
 		if remarks then
 			tag = tag .. ":" .. remarks
 		end
@@ -138,7 +158,7 @@ function gen_outbound(flag, node, tag, proxy_table)
 				xudpConcurrency = (node.mux == "1" and ((node.xudp_concurrency) and tonumber(node.xudp_concurrency) or 8)) or nil
 			} or nil,
 			-- 底层传输配置
-			streamSettings = (node.streamSettings or dialer_proxy_tag or node.protocol == "vmess" or node.protocol == "vless" or node.protocol == "socks" or node.protocol == "shadowsocks" or node.protocol == "trojan" or node.protocol == "hysteria") and {
+			streamSettings = (node.streamSettings or dialer_proxy_tag or node.protocol == "vmess" or node.protocol == "vless" or node.protocol == "socks" or node.protocol == "shadowsocks" or node.protocol == "trojan" or node.protocol == "hysteria" or node.protocol == "http") and {
 				sockopt = {
 					mark = 255,
 					domainStrategy = node.domain_strategy or "UseIP",
@@ -544,7 +564,7 @@ function gen_config_server(node)
 			allowTransparent = false,
 			users = users
 		}
-		node.transport = "tcp"
+		node.transport = "raw"
 		node.tcp_guise = "none"
 	elseif node.protocol == "shadowsocks" then
 		settings = {
@@ -759,14 +759,6 @@ local current_node = map:get(section)
 		return fromUrl(link);
 	}

-	function tofromUrl(btn) {
-		let link = prompt('<%:Paste Share URL Here%>', '');
-		if (link === null || link === "") {
-			return false;
-		}
-		return fromUrl(link);
-	}
-
 	function fromUrl(link, from_cache) {
 		if (!link) {
 			return false;
@@ -109,20 +109,26 @@ api.uci_foreach_c("haproxy_config", function(t)
 			t.origin_port = server_port
 			if health_check_type == "script_logic" then
 				if server_node.type ~= "Socks" then
-					local relay_port = server_node.port
-					local new_port = api.get_new_port()
-					local config_file = string.format("%s_%s.json", t[".name"], new_port)
-					sys.call(string.format('/usr/share/%s/app.sh run_socks "%s"> /dev/null',
-						appname,
-						string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s",
-							new_port, --flag
-							server_node[".name"], --node
-							"127.0.0.1", --bind
-							new_port, --socks port
-							config_file --config file
+					local new_port
+					local cache = api.get_socks_port_by_cache(server_node[".name"])
+					if cache then
+						new_port = cache
+					else
+						new_port = api.get_new_port()
+						local config_file = string.format("%s_%s.json", t[".name"], new_port)
+						sys.call(string.format('/usr/share/%s/app.sh run_socks "%s"> /dev/null',
+							appname,
+							string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s",
+								new_port, --flag
+								server_node[".name"], --node
+								"127.0.0.1", --bind
+								new_port, --socks port
+								config_file --config file
+								)
 							)
 						)
-					)
+						api.set_socks_port_to_cache(server_node[".name"], new_port)
+					end
 					server_address = "127.0.0.1"
 					server_port = new_port
 				end
@@ -1098,7 +1098,7 @@ add_firewall_rule() {

 	insert_rule_before "$ipt_m" "PREROUTING" "mwan3" "-j PSW"
 	# Only TCP, UDP Invalid.
-	insert_rule_before "$ipt_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT"
+	insert_rule_before "$ipt_m" "PREROUTING" "PSW" "-p tcp -m socket --transparent -j PSW_DIVERT"

 	$ipt_m -N PSW_OUTPUT
 	$ipt_m -A PSW_OUTPUT $(dst $IPSET_LAN) -j RETURN
@@ -1172,7 +1172,7 @@ add_firewall_rule() {

 	insert_rule_before "$ip6t_m" "PREROUTING" "mwan3" "-j PSW"
 	# Only TCP, UDP Invalid.
-	insert_rule_before "$ip6t_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT"
+	insert_rule_before "$ip6t_m" "PREROUTING" "PSW" "-p tcp -m socket --transparent -j PSW_DIVERT"

 	$ip6t_m -N PSW_OUTPUT
 	$ip6t_m -A PSW_OUTPUT -m mark --mark 0xff/0xff -j RETURN
@@ -1477,7 +1477,7 @@ gen_include() {
 		[ -z "${_ipt}" ] && return

 		echo "*$2"
-		${_ipt}-save -t $2 | grep "PSW" | grep -v "\-j PSW$" | grep -v "mangle\-OUTPUT\-PSW" | grep -v "socket \-j PSW_DIVERT$" | sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/"
+		${_ipt}-save -t $2 | grep "PSW" | grep -v "\-j PSW$" | grep -v "mangle\-OUTPUT\-PSW" | grep -v "\-m socket .*\-j PSW_DIVERT$" | sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/"
 		echo 'COMMIT'
 	}
 	local __ipt=""
@@ -1501,7 +1501,7 @@ gen_include() {
 			[ -z "${is_tproxy}" ] && \$(${MY_PATH} insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "-p tcp -j PSW")

 			\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "mwan3" "-j PSW")
-			\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT")
+			\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "PSW" "-p tcp -m socket --transparent -j PSW_DIVERT")
 		EOF
 		)
 	}
@@ -1522,7 +1522,7 @@ gen_include() {
 			[ "$accept_icmpv6" = "1" ] && $ip6t_n -A PREROUTING -p ipv6-icmp -j PSW

 			\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "mwan3" "-j PSW")
-			\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT")
+			\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "PSW" "-p tcp -m socket --transparent -j PSW_DIVERT")
 		EOF
 		)
 	}
@@ -469,16 +469,28 @@ load_acl() {
 				else
 					[ -n "${DIRECT_DNSMASQ_PORT}" ] && dns_redirect=${DIRECT_DNSMASQ_PORT}
 				fi
-				if [ -n "${dns_redirect}" ]; then
-					nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
-					[ "$_ipv4" != "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
-					nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
-					[ "$_ipv4" != "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
-					#nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp ${_ipt_source} udp dport 53 counter redirect to :${dns_redirect} comment \"$remarks\""
-					#nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter redirect to :${dns_redirect} comment \"$remarks\""
-					nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter redirect to :${dns_redirect} comment \"$remarks\""
-					nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter redirect to :${dns_redirect} comment \"$remarks\""
+
+				if ([ -n "$tcp_port" ] || [ -n "$udp_port" ]) && [ -n "$dns_redirect" ]; then
+					if [ "$PROXY_IPV6" = "1" ]; then
+						nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} udp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} tcp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter redirect to :$dns_redirect comment \"$remarks\""
+						nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter redirect to :$dns_redirect comment \"$remarks\""
+					else
+						nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} udp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol tcp ${_ipt_source} tcp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp ${_ipt_source} udp dport 53 counter redirect to :$dns_redirect comment \"$remarks\""
+						nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter redirect to :$dns_redirect comment \"$remarks\""
+					fi
 					[ -z "$(get_cache_var "ACL_${sid}_default")" ] && echolog "     - ${msg}节点不同于全局配置，DNS 重定向到专用服务器[${dns_redirect}]。"
+				else
+					if [ "$PROXY_IPV6" = "1" ]; then
+						nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
+						nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
+					else
+						nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
+						nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
+					fi
 				fi

 				[ -n "$tcp_port" ] || [ -n "$udp_port" ] && {
@@ -657,15 +669,26 @@ load_acl() {
 			[ -n "${DIRECT_DNSMASQ_PORT}" ] && DNS_REDIRECT=${DIRECT_DNSMASQ_PORT}
 		fi

-		if [ -n "${DNS_REDIRECT}" ]; then
-			nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp udp dport 53 counter return comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp udp dport 53 counter return comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol tcp tcp dport 53 counter return comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp tcp dport 53 counter return comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp udp dport 53 counter redirect to :${DNS_REDIRECT} comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp tcp dport 53 counter redirect to :${DNS_REDIRECT} comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp udp dport 53 counter redirect to :${DNS_REDIRECT} comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp tcp dport 53 counter redirect to :${DNS_REDIRECT} comment \"默认\""
+		if ([ -n "${TCP_PROXY_MODE}" ] || [ -n "${UDP_PROXY_MODE}" ]) && [ -n "$DNS_REDIRECT" ]; then
+			if [ "$PROXY_IPV6" = "1" ]; then
+				nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp udp dport 53 counter accept"
+				nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp tcp dport 53 counter accept"
+				nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp udp dport 53 counter redirect to :$DNS_REDIRECT comment \"默认\""
+				nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp tcp dport 53 counter redirect to :$DNS_REDIRECT comment \"默认\""
+			else
+				nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp udp dport 53 counter accept"
+				nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol tcp tcp dport 53 counter accept"
+				nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp udp dport 53 counter redirect to :$DNS_REDIRECT comment \"默认\""
+				nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp tcp dport 53 counter redirect to :$DNS_REDIRECT comment \"默认\""
+			fi
+		else
+			if [ "$PROXY_IPV6" = "1" ]; then
+				nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp udp dport 53 counter return comment \"默认\""
+				nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp tcp dport 53 counter return comment \"默认\""
+			else
+				nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp udp dport 53 counter return comment \"默认\""
+				nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp tcp dport 53 counter return comment \"默认\""
+			fi
 		fi

 		[ -n "${TCP_PROXY_MODE}" ] || [ -n "${UDP_PROXY_MODE}" ] && {
@@ -1310,10 +1333,15 @@ add_firewall_rule() {

 		if [ -n "$NODE" ] && ([ -n "${LOCALHOST_TCP_PROXY_MODE}" ] || [ -n "${LOCALHOST_UDP_PROXY_MODE}" ]); then
 			[ -n "$DNS_REDIRECT_PORT" ] && {
-				nft "add rule $NFTABLE_NAME nat_output ip protocol udp oif lo udp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
-				nft "add rule $NFTABLE_NAME nat_output ip protocol tcp oif lo tcp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
-				nft "add rule $NFTABLE_NAME nat_output meta l4proto udp oif lo udp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
-				nft "add rule $NFTABLE_NAME nat_output meta l4proto tcp oif lo tcp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
+				if [ "$PROXY_IPV6" == "1" ]; then
+					#nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto udp udp dport 53 counter accept"
+					#nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto tcp tcp dport 53 counter accept"
+					nft "add rule $NFTABLE_NAME nat_output oif lo meta l4proto udp udp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
+					nft "add rule $NFTABLE_NAME nat_output oif lo meta l4proto tcp tcp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
+				else
+					nft "add rule $NFTABLE_NAME nat_output oif lo ip protocol udp udp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
+					nft "add rule $NFTABLE_NAME nat_output oif lo ip protocol tcp tcp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
+				fi
 			}
 		fi

@@ -384,15 +384,25 @@ lua_api() {
 	echo $(lua -e "local api = require 'luci.passwall.api' print(api.${func})")
 }

+
+del_cache_var() {
+	local key="${1}"
+	[ -n "${key}" ] && [ -f "${TMP_PATH}/var" ] && {
+		sed -i "/${key}=/d" $TMP_PATH/var >/dev/null 2>&1
+	}
+}
+
 set_cache_var() {
 	local key="${1}"
 	shift 1
-	local val="$@"
-	[ -n "${key}" ] && [ -n "${val}" ] && {
-		[ ! -d $TMP_PATH ] && mkdir -p $TMP_PATH
-		sed -i "/${key}=/d" $TMP_PATH/var >/dev/null 2>&1
-		echo "${key}=\"${val}\"" >> $TMP_PATH/var
-		eval ${key}=\"${val}\"
+	[ -n "${key}" ] && {
+		del_cache_var ${key}
+		local val="$@"
+		[ -n "${val}" ] && {
+			[ ! -d $TMP_PATH ] && mkdir -p $TMP_PATH
+			echo "${key}=\"${val}\"" >> $TMP_PATH/var
+			eval ${key}=\"${val}\"
+		}
 	}
 }

@@ -6,7 +6,7 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-passwall2
-PKG_VERSION:=26.9.9
+PKG_VERSION:=26.9.12
 PKG_RELEASE:=2
 PKG_PO_VERSION:=$(PKG_VERSION)

@@ -280,7 +280,7 @@ end

 function index_status()
 	local e = {}
-	e["global_status"] = luci.sys.call("/bin/busybox top -bn1 | grep -v 'grep' | grep '%s/bin/' | grep '/acl/default' >/dev/null" % api.TMP_PATH) == 0
+	e["global_status"] = luci.sys.call("/bin/busybox top -bn1 | grep -v 'grep' | grep '%s/bin/' | grep '/acl_default\\.json' >/dev/null" % api.TMP_PATH) == 0
 	http_write_json(e)
 end

@@ -311,8 +311,8 @@ loglevel:value("error")
 o = s:taboption("log", DummyValue, "_log", translate("Log File"))
 o.rawhtml = true
 o.cfgvalue = function(t, n)
-	local log_path = api.TMP_PATH .. "/acl/default.log"
-	local log_url = api.url("get_redir_log") .. "?id=default"
+	local log_path = api.TMP_PATH .. "/acl/acl_default.log"
+	local log_url = api.url("get_redir_log") .. "?id=acl_default"
 	return string.format(
 		'<code>%s</code>&nbsp;&nbsp;<input class="btn cbi-button cbi-button-apply" type="button" value="%s" onclick="window.open(\'%s\', \'_blank\')" />',
 		log_path,
@@ -668,7 +668,8 @@ if singbox_tags:find("with_utls") then
 	o:depends({ protocol = "socks", tls = true })
 	o:depends({ protocol = "trojan", tls = true })
 	o:depends({ protocol = "anytls", tls = true })
-	
+	o:depends({ protocol = "http", tls = true })
+
 	o = s:option(Value, "reality_publicKey", translate("Public Key"))
 	o:depends({ reality = true })
 	
@@ -213,7 +213,11 @@ o:depends({ protocol = "trojan" })
 -- [[ REALITY ]] --
 o = s:option(Flag, "reality", translate("REALITY"))
 o.default = 0
-o:depends({ tls = true })
+o:depends({ tls = true, transport = "raw" })
+o:depends({ tls = true, transport = "ws" })
+o:depends({ tls = true, transport = "grpc" })
+o:depends({ tls = true, transport = "httpupgrade" })
+o:depends({ tls = true, transport = "xhttp" })

 o = s:option(Value, "reality_private_key", translate("Private Key"))
 o:depends({ reality = true })
@@ -192,12 +192,16 @@ function sh_uci_commit(config)
 	exec_call(string.format("uci -q commit %s", config))
 end

+function del_cache_var(key)
+	sys.call(string.format('. /usr/share/passwall2/utils.sh ; del_cache_var "%s"', key))
+end
+
 function set_cache_var(key, val)
-	sys.call(string.format('. /usr/share/passwall2/utils.sh ; set_cache_var %s "%s"', key, val))
+	sys.call(string.format('. /usr/share/passwall2/utils.sh ; set_cache_var "%s" "%s"', key, val))
 end

 function get_cache_var(key)
-	local val = sys.exec(string.format('. /usr/share/passwall2/utils.sh ; echo -n $(get_cache_var %s)', key))
+	local val = sys.exec(string.format('. /usr/share/passwall2/utils.sh ; echo -n $(get_cache_var "%s")', key))
 	if val == "" then val = nil end
 	return val
 end
@@ -2054,3 +2058,11 @@ function parseDNS(dns)
 	end
 	return dns, 53
 end
+
+function get_socks_port_by_cache(node_id)
+	return get_cache_var("node_%s_socks_port" % { node_id })
+end
+
+function set_socks_port_to_cache(node_id, v)
+	set_cache_var("node_%s_socks_port" % { node_id }, v)
+end
@@ -123,31 +123,46 @@ function gen_outbound(flag, node, tag, proxy_table)
 		end

 		if node.type ~= "sing-box" then
-			local relay_port = node.port
-			local new_port = api.get_new_port()
-			local config_file = string.format("%s_%s_%s.json", flag, tag, new_port)
-			if tag and node_id and not tag:find(node_id) then
-				config_file = string.format("%s_%s_%s_%s.json", flag, tag, node_id, new_port)
-			end
+			local new_port
 			if run_socks_instance then
-				sys.call(string.format('/usr/share/passwall2/app.sh run_socks "%s"> /dev/null',
-					string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
-						new_port, --flag
-						node_id, --node
-						"127.0.0.1", --bind
-						new_port, --socks port
-						config_file, --config file
-						(proxy_tag and relay_port) and tostring(relay_port) or "" --relay port
+				local relay_port = (proxy_tag and node.port) and tostring(node.port) or ""
+				if relay_port == "" then
+					local cache = api.get_socks_port_by_cache(node_id)
+					if cache then
+						new_port = cache
+						run_socks_instance = nil
+					end
+				end
+				if run_socks_instance then
+					new_port = api.get_new_port()
+					local config_file = string.format("nodesocks_%s_%s.json", node_id, new_port)
+					if tag and node_id and not tag:find(node_id) then
+						config_file = string.format("nodesocks_%s_%s_%s.json", tag, node_id, new_port)
+					end
+					sys.call(string.format('/usr/share/passwall2/app.sh run_socks "%s"> /dev/null',
+						string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
+							new_port, --flag
+							node_id, --node
+							"127.0.0.1", --bind
+							new_port, --socks port
+							config_file, --config file
+							relay_port --relay port
+							)
 						)
 					)
-				)
+					if relay_port == "" then
+						api.set_socks_port_to_cache(node_id, new_port)
+					end
+				end
+			end
+			if new_port then
+				node = {
+					protocol = "socks",
+					address = "127.0.0.1",
+					port = new_port
+				}
+				proxy_tag = "socks <- " .. node_id
 			end
-			node = {
-				protocol = "socks",
-				address = "127.0.0.1",
-				port = new_port
-			}
-			proxy_tag = "socks <- " .. node_id
 		else
 			if proxy_tag then
 				node.detour = proxy_tag
@@ -502,9 +517,9 @@ function gen_outbound(flag, node, tag, proxy_table)
 				obfs = node.hysteria_obfs,
 				auth = (node.hysteria_auth_type == "base64") and node.hysteria_auth_password or nil,
 				auth_str = (node.hysteria_auth_type == "string") and node.hysteria_auth_password or nil,
-				recv_window_conn = tonumber(node.hysteria_recv_window_conn),  --1.14 将变更为 stream_receive_window
-				recv_window = tonumber(node.hysteria_recv_window),  --1.14 将变更为 connection_receive_window
-				disable_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,  --1.14 将变更为 disable_path_mtu_discovery
+				stream_receive_window = tonumber(node.hysteria_recv_window_conn),
+				connection_receive_window = tonumber(node.hysteria_recv_window),
+				disable_path_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,
 				tls = tls
 			}
 		end
@@ -931,10 +946,10 @@ function gen_config_server(node)
 			down_mbps = tonumber(node.hysteria_down_mbps),
 			obfs = node.hysteria_obfs,
 			users = users,
-			recv_window_conn = node.hysteria_recv_window_conn and tonumber(node.hysteria_recv_window_conn) or nil, --1.14 to stream_receive_window
-			recv_window_client = node.hysteria_recv_window_client and tonumber(node.hysteria_recv_window_client) or nil, --1.14 to connection_receive_window
-			max_conn_client = node.hysteria_max_conn_client and tonumber(node.hysteria_max_conn_client) or nil,  --1.14 to max_concurrent_streams
-			disable_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,  --1.14 to disable_path_mtu_discover
+			stream_receive_window = node.hysteria_recv_window_conn and tonumber(node.hysteria_recv_window_conn) or nil,
+			connection_receive_window = node.hysteria_recv_window_client and tonumber(node.hysteria_recv_window_client) or nil,
+			max_concurrent_streams = node.hysteria_max_conn_client and tonumber(node.hysteria_max_conn_client) or nil,
+			disable_path_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,
 			tls = tls
 		}
 	end
@@ -71,32 +71,47 @@ function gen_outbound(flag, node, tag, proxy_table)
 		end

 		if node.type ~= "Xray" then
-			local relay_port = node.port
-			local new_port = api.get_new_port()
-			local config_file = string.format("%s_%s_%s.json", flag, tag, new_port)
-			if tag and node_id and not tag:find(node_id) then
-				config_file = string.format("%s_%s_%s_%s.json", flag, tag, node_id, new_port)
-			end
+			local new_port
 			if run_socks_instance then
-				sys.call(string.format('/usr/share/passwall2/app.sh run_socks "%s"> /dev/null',
-					string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
-						new_port, --flag
-						node_id, --node
-						"127.0.0.1", --bind
-						new_port, --socks port
-						config_file, --config file
-						(proxy_tag and relay_port) and tostring(relay_port) or "" --relay port
+				local relay_port = (proxy_tag and node.port) and tostring(node.port) or ""
+				if relay_port == "" then
+					local cache = api.get_socks_port_by_cache(node_id)
+					if cache then
+						new_port = cache
+						run_socks_instance = nil
+					end
+				end
+				if run_socks_instance then
+					new_port = api.get_new_port()
+					local config_file = string.format("nodesocks_%s_%s.json", node_id, new_port)
+					if tag and node_id and not tag:find(node_id) then
+						config_file = string.format("nodesocks_%s_%s_%s.json", tag, node_id, new_port)
+					end
+					sys.call(string.format('/usr/share/passwall2/app.sh run_socks "%s"> /dev/null',
+						string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
+							new_port, --flag
+							node_id, --node
+							"127.0.0.1", --bind
+							new_port, --socks port
+							config_file, --config file
+							relay_port --relay port
+							)
 						)
 					)
-				)
+					if relay_port == "" then
+						api.set_socks_port_to_cache(node_id, new_port)
+					end
+				end
+			end
+			if new_port then
+				node = {}
+				node.protocol = "socks"
+				node.transport = "tcp"
+				node.address = "127.0.0.1"
+				node.port = new_port
+				node.stream_security = "none"
+				proxy_tag = "socks <- " .. node_id
 			end
-			node = {}
-			node.protocol = "socks"
-			node.transport = "tcp"
-			node.address = "127.0.0.1"
-			node.port = new_port
-			node.stream_security = "none"
-			proxy_tag = "socks <- " .. node_id
 		else
 			dialer_proxy_tag = proxy_tag
 		end
@@ -131,6 +146,10 @@ function gen_outbound(flag, node, tag, proxy_table)
 			node.stream_security = "tls"
 		end

+		if node.protocol == "http" and node.stream_security == "tls" then
+			node.transport = "raw"
+		end
+
 		if remarks then
 			tag = tag .. ":" .. remarks
 		end
@@ -148,7 +167,7 @@ function gen_outbound(flag, node, tag, proxy_table)
 				concurrency = (node.mux == "1" and ((node.mux_concurrency) and tonumber(node.mux_concurrency) or -1)) or nil,
 				xudpConcurrency = (node.mux == "1" and ((node.xudp_concurrency) and tonumber(node.xudp_concurrency) or 8)) or nil
 			} or nil,
-			streamSettings = (node.streamSettings or dialer_proxy_tag or node.protocol == "vmess" or node.protocol == "vless" or node.protocol == "socks" or node.protocol == "shadowsocks" or node.protocol == "trojan" or node.protocol == "hysteria") and {
+			streamSettings = (node.streamSettings or dialer_proxy_tag or node.protocol == "vmess" or node.protocol == "vless" or node.protocol == "socks" or node.protocol == "shadowsocks" or node.protocol == "trojan" or node.protocol == "hysteria" or node.protocol == "http") and {
 				sockopt = {
 					mark = 255,
 					domainStrategy = node.domain_strategy or "UseIP",
@@ -552,7 +571,7 @@ function gen_config_server(node)
 			allowTransparent = false,
 			users = users
 		}
-		node.transport = "tcp"
+		node.transport = "raw"
 		node.tcp_guise = "none"
 	elseif node.protocol == "shadowsocks" then
 		settings = {
@@ -127,7 +127,7 @@ local sid = "@global[0]"

 				const m = cbid.match(/\.node$/);
 				if (m) {
-					html += '<a href="#" onclick="window.open(\'' + '<%=api.url("get_redir_log")%>?id=default' + '\', \'_blank\')"><%:Log%></a>';
+					html += '<a href="#" onclick="window.open(\'' + '<%=api.url("get_redir_log")%>?id=acl_default' + '\', \'_blank\')"><%:Log%></a>';
 				}

 				html = '<div class="node-actions" style="display:inline-flex; align-items:center; gap:4px; flex-wrap:wrap; margin-left:4px;">' + html + '</div>'
@@ -855,7 +855,7 @@ acl_node() {
 		local DNSMASQ_DEFAULT_DNS="${AUTO_DNS}"
 		local DNSMASQ_LOCAL_DNS="${LOCAL_DNS:-${AUTO_DNS}}"
 		[ -n "${DIRECT_DNS_DNSMASQ_SERVER}" ] && DNSMASQ_LOCAL_DNS="${DIRECT_DNS_DNSMASQ_SERVER}"
-		if [ "${flag}" = "default" ]; then
+		if [ "${flag}" = "acl_default" ]; then
 			set_cache_var "GLOBAL_SOCKS_server" "127.0.0.1:$socks_port"
 			set_cache_var "ACL_GLOBAL_node" "$node"
 			run_new_dnsmasq=$(config_n_get @global[0] dns_redirect 1)
@@ -864,7 +864,7 @@ acl_node() {
 				#Modify the default dnsmasq service
 				lua $APP_PATH/helper_dnsmasq.lua stretch
 				json_init
-				json_add_string "FLAG" "default"
+				json_add_string "FLAG" "${flag}"
 				json_add_string "TMP_DNSMASQ_PATH" "${GLOBAL_DNSMASQ_CONF_PATH}"
 				json_add_string "DNSMASQ_CONF_FILE" "${GLOBAL_DNSMASQ_CONF}"
 				json_add_string "DEFAULT_DNS" "${DNSMASQ_DEFAULT_DNS}"
@@ -912,7 +912,7 @@ start() {
 	check_run_environment
 	[ -n "$USE_TABLES" ] && {
 		ACL_JSON=$(lua $APP_PATH/app_acl.lua)
-		[ ! -f ${TMP_ACL_PATH}/acl_node_default ] && ENABLED_DEFAULT_ACL=0
+		[ ! -f ${TMP_ACL_PATH}/acl_node_acl_default ] && ENABLED_DEFAULT_ACL=0
 		local acl_node_num=$(jsonfilter -s "${ACL_JSON}" -e '$.node_order[*]' | wc -l)

 		if [ "${acl_node_num}" == 0 ]; then
@@ -1062,7 +1062,7 @@ get_config() {
 		fi
 	fi
 	set_cache_var GLOBAL_DNSMASQ_CONF ${DNSMASQ_CONF_DIR}/dnsmasq-${CONFIG}.conf
-	set_cache_var GLOBAL_DNSMASQ_CONF_PATH ${TMP_ACL_PATH}/default_dnsmasq.d
+	set_cache_var GLOBAL_DNSMASQ_CONF_PATH ${TMP_ACL_PATH}/acl_default_dnsmasq.d

 	QUEUE_RUN=1
 }
@@ -24,7 +24,7 @@ end
 function init_acl()
 	if true then
 		-- Get Default AC
-		D.flag = "default"
+		D.flag = "acl_default"
 		D.remarks = api.i18n.translatef("Default")
 		D.tcp_no_redir_ports = uci_get("@global_forwarding[0]", "tcp_no_redir_ports")
 		D.udp_no_redir_ports = uci_get("@global_forwarding[0]", "udp_no_redir_ports")
@@ -109,20 +109,26 @@ api.uci_foreach_c("haproxy_config", function(t)
 			t.origin_port = server_port
 			if health_check_type == "script_logic" then
 				if server_node.type ~= "Socks" then
-					local relay_port = server_node.port
-					local new_port = api.get_new_port()
-					local config_file = string.format("%s_%s.json", t[".name"], new_port)
-					sys.call(string.format('/usr/share/%s/app.sh run_socks "%s"> /dev/null',
-						appname,
-						string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s",
-							new_port, --flag
-							server_node[".name"], --node
-							"127.0.0.1", --bind
-							new_port, --socks port
-							config_file --config file
+					local new_port
+					local cache = api.get_socks_port_by_cache(server_node[".name"])
+					if cache then
+						new_port = cache
+					else
+						new_port = api.get_new_port()
+						local config_file = string.format("%s_%s.json", t[".name"], new_port)
+						sys.call(string.format('/usr/share/%s/app.sh run_socks "%s"> /dev/null',
+							appname,
+							string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s",
+								new_port, --flag
+								server_node[".name"], --node
+								"127.0.0.1", --bind
+								new_port, --socks port
+								config_file --config file
+								)
 							)
 						)
-					)
+						api.set_socks_port_to_cache(server_node[".name"], new_port)
+					end
 					server_address = "127.0.0.1"
 					server_port = new_port
 				end
@@ -329,7 +329,7 @@ function add_rule(var)
 			tinsert(conf_lines, "no-poll")
 			tinsert(conf_lines, "no-resolv")

-			if FLAG == "default" then
+			if FLAG == "acl_default" then
 				api.set_cache_var("DEFAULT_DNS", DEFAULT_DNS)
 			end
 		end
@@ -755,8 +755,8 @@ add_firewall_rule() {

 	$ipt_m -N PSW2
 	# Socket Only TCP, UDP Invalid.
-	$ipt_m -A PSW2 -p tcp -m socket -j MARK --set-mark ${FWMARK}
-	$ipt_m -A PSW2 -p tcp -m socket -j ACCEPT
+	$ipt_m -A PSW2 -p tcp -m socket --transparent -j MARK --set-mark ${FWMARK}
+	$ipt_m -A PSW2 -p tcp -m socket --transparent -j ACCEPT
 	$ipt_m -A PSW2 $(dst $IPSET_VPS) -j RETURN
 	$ipt_m -A PSW2 $(comment "WAN_IP_RETURN") $(dst $IPSET_WAN) -j RETURN
 	$ipt_m -A PSW2 -m conntrack --ctdir REPLY -j RETURN
@@ -798,8 +798,8 @@ add_firewall_rule() {

 	$ip6t_m -N PSW2
 	# Socket Only TCP, UDP Invalid.
-	$ip6t_m -A PSW2 -p tcp -m socket -j MARK --set-mark ${FWMARK}
-	$ip6t_m -A PSW2 -p tcp -m socket -j ACCEPT
+	$ip6t_m -A PSW2 -p tcp -m socket --transparent -j MARK --set-mark ${FWMARK}
+	$ip6t_m -A PSW2 -p tcp -m socket --transparent -j ACCEPT
 	$ip6t_m -A PSW2 $(dst $IPSET_VPS6) -j RETURN
 	$ip6t_m -A PSW2 $(comment "WAN6_IP_RETURN") $(dst $IPSET_WAN6) -j RETURN
 	$ip6t_m -A PSW2 -m conntrack --ctdir REPLY -j RETURN
@@ -331,12 +331,15 @@ load_acl() {
 				[ -n "$dns_redirect_port" ] && {
 					#nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip protocol udp udp dport 53 counter accept"
 					#nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip protocol tcp tcp dport 53 counter accept"
-					#nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto udp udp dport 53 counter accept"
-					#nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto tcp tcp dport 53 counter accept"
-					nft "add rule $NFTABLE_NAME nat_output ip protocol udp oif lo udp dport 53 counter redirect to :$dns_redirect_port comment \"PSW2_DNS\""
-					nft "add rule $NFTABLE_NAME nat_output ip protocol tcp oif lo tcp dport 53 counter redirect to :$dns_redirect_port comment \"PSW2_DNS\""
-					nft "add rule $NFTABLE_NAME nat_output meta l4proto udp oif lo udp dport 53 counter redirect to :$dns_redirect_port comment \"PSW2_DNS\""
-					nft "add rule $NFTABLE_NAME nat_output meta l4proto tcp oif lo tcp dport 53 counter redirect to :$dns_redirect_port comment \"PSW2_DNS\""
+					if [ "$PROXY_IPV6" == "1" ]; then
+						#nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto udp udp dport 53 counter accept"
+						#nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto tcp tcp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME nat_output oif lo meta l4proto udp udp dport 53 counter redirect to :$dns_redirect_port comment \"PSW2_DNS\""
+						nft "add rule $NFTABLE_NAME nat_output oif lo meta l4proto tcp tcp dport 53 counter redirect to :$dns_redirect_port comment \"PSW2_DNS\""
+					else
+						nft "add rule $NFTABLE_NAME nat_output oif lo ip protocol udp udp dport 53 counter redirect to :$dns_redirect_port comment \"PSW2_DNS\""
+						nft "add rule $NFTABLE_NAME nat_output oif lo ip protocol tcp tcp dport 53 counter redirect to :$dns_redirect_port comment \"PSW2_DNS\""
+					fi
 					log 2 "${msg}$(i18n "DNS will redirected to the dedicated DNS server [%s]." "${dns_redirect_port}")"
 				}
 			fi
@@ -501,20 +504,26 @@ load_acl() {
 				}

 				if ([ -z "$no_tcp_proxy" ] || [ -z "$no_udp_proxy" ]) && [ -n "$dns_redirect_port" ]; then
-					nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} udp dport 53 counter accept"
-					nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp ${_ipt_source} tcp dport 53 counter accept"
-					nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} udp dport 53 counter accept"
-					nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} tcp dport 53 counter accept"
-					nft "add rule $NFTABLE_NAME PSW2_DNS ip protocol udp ${_ipt_source} udp dport 53 counter redirect to :$dns_redirect_port comment \"$remarks\""
-					nft "add rule $NFTABLE_NAME PSW2_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter redirect to :$dns_redirect_port comment \"$remarks\""
-					nft "add rule $NFTABLE_NAME PSW2_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter redirect to :$dns_redirect_port comment \"$remarks\""
-					nft "add rule $NFTABLE_NAME PSW2_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter redirect to :$dns_redirect_port comment \"$remarks\""
+					if [ "$PROXY_IPV6" == "1" ]; then
+						nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} udp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} tcp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME PSW2_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter redirect to :$dns_redirect_port comment \"$remarks\""
+						nft "add rule $NFTABLE_NAME PSW2_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter redirect to :$dns_redirect_port comment \"$remarks\""
+					else
+						nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} udp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp ${_ipt_source} tcp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME PSW2_DNS ip protocol udp ${_ipt_source} udp dport 53 counter redirect to :$dns_redirect_port comment \"$remarks\""
+						nft "add rule $NFTABLE_NAME PSW2_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter redirect to :$dns_redirect_port comment \"$remarks\""
+					fi
 					log 2 "${msg}$(i18n "DNS will redirected to the dedicated DNS server [%s]." "${dns_redirect_port}")"
 				else
-					nft "add rule $NFTABLE_NAME PSW2_DNS ip protocol udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
-					nft "add rule $NFTABLE_NAME PSW2_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
-					nft "add rule $NFTABLE_NAME PSW2_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
-					nft "add rule $NFTABLE_NAME PSW2_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
+					if [ "$PROXY_IPV6" == "1" ]; then
+						nft "add rule $NFTABLE_NAME PSW2_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
+						nft "add rule $NFTABLE_NAME PSW2_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
+					else
+						nft "add rule $NFTABLE_NAME PSW2_DNS ip protocol udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
+						nft "add rule $NFTABLE_NAME PSW2_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
+					fi
 				fi

 				[ -z "$no_tcp_proxy" ] && [ -n "$redir_port" ] && {
@@ -60,15 +60,24 @@ get_cache_var() {
 	}
 }

+del_cache_var() {
+	local key="${1}"
+	[ -n "${key}" ] && [ -f "${TMP_PATH}/var" ] && {
+		sed -i "/${key}=/d" $TMP_PATH/var >/dev/null 2>&1
+	}
+}
+
 set_cache_var() {
 	local key="${1}"
 	shift 1
-	local val="$@"
-	[ -n "${key}" ] && [ -n "${val}" ] && {
-		[ ! -d $TMP_PATH ] && mkdir -p $TMP_PATH
-		sed -i "/${key}=/d" $TMP_PATH/var >/dev/null 2>&1
-		echo "${key}=\"${val}\"" >> $TMP_PATH/var
-		eval ${key}=\"${val}\"
+	[ -n "${key}" ] && {
+		del_cache_var ${key}
+		local val="$@"
+		[ -n "${val}" ] && {
+			[ ! -d $TMP_PATH ] && mkdir -p $TMP_PATH
+			echo "${key}=\"${val}\"" >> $TMP_PATH/var
+			eval ${key}=\"${val}\"
+		}
 	}
 }

@@ -32,7 +32,7 @@ LUCI_PKGARCH:=all
 LUCI_DEPENDS:= \
 	+libuci-lua +lua +luci-compat +coreutils +coreutils-base64 +dns2tcp +dnsmasq-full \
 	+jq +ip-full +lua-neturl +libuci-lua +microsocks +ipt2socks +lyaml \
-	+resolveip +curl +nping +unzip +xz-utils +xz \
+	+resolveip +bind-dig +curl +nping +unzip +xz-utils +xz \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_ChinaDNS_NG:chinadns-ng \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_MosDNS:mosdns \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_Shadow_TLS:shadow-tls \
@@ -5,24 +5,27 @@
 local m, s, sec, o
 local uci = require "luci.model.uci".cursor()
 local URL = require "url"
+local sys = require "luci.sys"
+local util = require "luci.util"
+local datatypes = require "luci.cbi.datatypes"

 -- 获取 LAN IP 地址
 function lanip()
 	local lan_ip

 	-- 尝试从 UCI 直接读取
-	lan_ip = luci.sys.exec("uci -q get network.lan.ipaddr 2>/dev/null | awk -F'/' '{print $1}' | tr -d '\\n'")
+	lan_ip = sys.exec("uci -q get network.lan.ipaddr 2>/dev/null | awk -F'/' '{print $1}' | tr -d '\\n'")

 	-- 尝试从 LAN 接口信息中读取（优先 ifname，再 fallback 到 device）
 	if not lan_ip or lan_ip == "" then
-		lan_ip = luci.sys.exec([[
+		lan_ip = sys.exec([[
 ip -4 addr show $(uci -q -p /tmp/state get network.lan.ifname || uci -q -p /tmp/state get network.lan.device) 2>/dev/null \
  | grep -w 'inet' | awk '{print $2}' | cut -d'/' -f1 | grep -v '^127\.' | head -n1 | tr -d '\n']])
 	end

 	-- 取任意一个 global IPv4 地址
 	if not lan_ip or lan_ip == "" then
-		lan_ip = luci.sys.exec([[
+		lan_ip = sys.exec([[
 ip -4 addr show scope global 2>/dev/null \
  | grep -w 'inet' | awk '{print $2}' | cut -d'/' -f1 | grep -v '^127\.' | head -n1 | tr -d '\n']])
 	end
@@ -31,10 +34,9 @@ ip -4 addr show scope global 2>/dev/null \
 end

 local lan_ip = lanip()
-local validation = require "luci.cbi.datatypes"
 local clash_nodes = {}
 local function is_finded(e)
-	return luci.sys.exec(string.format('type -t -p "%s" -p "/usr/libexec/%s" 2>/dev/null', e, e)) ~= ""
+	return sys.exec(string.format('type -t -p "%s" -p "/usr/libexec/%s" 2>/dev/null', e, e)) ~= ""
 end

 local function clash_display_name(s)
@@ -48,6 +50,28 @@ local function clash_display_name(s)
 	return "[CLASH]"
 end

+local function is_valid_dns(str)
+	if datatypes.ip4addrport(str) then
+		return true
+	end
+
+	local scheme, target = str:match("^([a-zA-Z0-9%+%-%.]+)://(.+)$")
+	if scheme and target and #target > 0 then
+		return true
+	end
+
+	local host = str:match("^([^:]+):%d+$") or str
+	if host:match("[a-zA-Z]") 
+	   and not host:match("[^%w%.%-]") 
+	   and not host:match("^[%.%-]") 
+	   and not host:match("[%.%-]$") 
+	   and not host:match("%.%.") then
+		return true
+	end
+
+	return false
+end
+
 m = Map("shadowsocksr", translate("ShadowSocksR Plus+ Settings"), translate("<h3>Support SS/SSR/V2RAY/XRAY/TROJAN/TUIC/HYSTERIA2/NAIVEPROXY/SOCKS5/CLASH etc.</h3>"))
 m:section(SimpleSection).template = "shadowsocksr/status"

@@ -131,7 +155,7 @@ o:value("7", translate("Prefer module built-in DNS"))
 o:value("0", translate("Use Local DNS Service listen port 5335"))
 o.default = 1

-o = s:option(Value, "tunnel_forward", translate("Anti-pollution DNS Server"))
+o = s:option(Value, "dns2tcp_tunnel_forward", translate("Anti-pollution DNS Server"))
 o:value("8.8.4.4:53", translate("Google Public DNS (8.8.4.4)"))
 o:value("8.8.8.8:53", translate("Google Public DNS (8.8.8.8)"))
 o:value("208.67.222.222:53", translate("OpenDNS (208.67.222.222)"))
@@ -144,11 +168,55 @@ o:value("4.2.2.3:53", translate("Level 3 Public DNS (4.2.2.3)"))
 o:value("4.2.2.4:53", translate("Level 3 Public DNS (4.2.2.4)"))
 o:value("1.1.1.1:53", translate("Cloudflare DNS (1.1.1.1)"))
 o:depends("pdnsd_enable", "1")
-o:depends("pdnsd_enable", "7")
 o.description = translate("Custom DNS Server format as IP:PORT (default: 8.8.4.4:53)")
 o.datatype = "ip4addrport"
 o.default = "8.8.4.4:53"

+o = s:option(Value, "tunnel_forward", translate("Anti-pollution DNS Server"))
+o:value("8.8.4.4:53", translate("Google Public DNS (8.8.4.4)"))
+o:value("8.8.8.8:53", translate("Google Public DNS (8.8.8.8)"))
+o:value("208.67.222.222:53", translate("OpenDNS (208.67.222.222)"))
+o:value("208.67.220.220:53", translate("OpenDNS (208.67.220.220)"))
+o:value("209.244.0.3:53", translate("Level 3 Public DNS (209.244.0.3)"))
+o:value("209.244.0.4:53", translate("Level 3 Public DNS (209.244.0.4)"))
+o:value("4.2.2.1:53", translate("Level 3 Public DNS (4.2.2.1)"))
+o:value("4.2.2.2:53", translate("Level 3 Public DNS (4.2.2.2)"))
+o:value("4.2.2.3:53", translate("Level 3 Public DNS (4.2.2.3)"))
+o:value("4.2.2.4:53", translate("Level 3 Public DNS (4.2.2.4)"))
+o:value("1.1.1.1:53", translate("Cloudflare DNS (1.1.1.1)"))
+o:depends("pdnsd_enable", "7")
+o.datatype = nil
+o.description =
+	"<ul>" ..
+	"<li>" .. translate("Custom DNS Server (supports format IP:PORT, domain name, or scheme://...).") .. "</li>" ..
+	"<li>" .. translate("Muitiple DNS server can saperate with ','") .. "</li>" ..
+	"<li>" .. translate("Note: IP addresses MUST specify a port.") .. "</li>" ..
+	"</ul>"
+o.default = "8.8.4.4:53"
+o.validate = function(self, value, section)
+	if section and value and value ~= "" then
+		local parts = {}
+		for part in (value .. ","):gmatch("(.-),") do
+			part = part:gsub("^%s*", ""):gsub("%s*$", "")
+			if part ~= "" then
+				if not is_valid_dns(part) then
+					return nil, translate("Expecting: %s"):format(translate("IP:PORT, Domain, or Protocol URL (e.g. 8.8.8.8:53, dns.google, https://...).") ..
+						"<br>".. translate("Note: Pure IP without port is not allowed."))
+				end
+				table.insert(parts, part)
+			end
+		end
+
+		if #parts > 0 then
+			return table.concat(parts, ",")
+		end
+
+		return nil, translate("Expecting: %s"):format(translate("valid address:port")) -- 有效的地址:端口
+	end
+
+	return value
+end
+
 o = s:option(Value, "tunnel_forward_mosdns", translate("Anti-pollution DNS Server"))
 o:value("tcp://8.8.4.4:53,tcp://8.8.8.8:53", translate("Google Public DNS"))
 o:value("tcp://208.67.222.222:53,tcp://208.67.220.220:53", translate("OpenDNS"))
@@ -225,7 +293,7 @@ if is_finded("chinadns-ng") then
 				local parts = {}
 				for part in string.gmatch(value, "[^,]+") do
 					part = part:gsub("^%s*", ""):gsub("%s*$", "")
-					if not validation.ip4addrport(part) then
+					if not datatypes.ip4addrport(part) then
 						return nil, translate("Expecting: %s"):format(translate("valid address:port (comma separated)"))
 					end
 					table.insert(parts, part)
@@ -236,7 +304,7 @@ if is_finded("chinadns-ng") then
 				return table.concat(parts, ",")
 			end

-			if validation.ip4addrport(value) then
+			if datatypes.ip4addrport(value) then
 				return value
 			end

@@ -1,8 +1,11 @@
 require "luci.ip"
 require "nixio.fs"
 require "luci.sys"
+local ucic = luci.model.uci.cursor()
 local m, s, o

+local enable_mihomo = ucic:get_first('shadowsocksr', 'server_subscribe', 'enable_mihomo') or ''
+
 m = Map("shadowsocksr")

 s = m:section(TypedSection, "access_control")
@@ -116,7 +119,7 @@ o.rows = 13
 o.wrap = "off"
 o.rmempty = true
 o.cfgvalue = function(self, section)
-	return nixio.fs.readfile(denydomainconf) or " "
+	return nixio.fs.readfile(denydomainconf) or ""
 end
 o.write = function(self, section, value)
 	nixio.fs.writefile(denydomainconf, value:gsub("\r\n", "\n"))
@@ -125,6 +128,54 @@ o.remove = function(self, section, value)
 	nixio.fs.writefile(denydomainconf, "")
 end

+if enable_mihomo == "1" then
+	s:tab("fake_ip_filter", translate("Fake-IP Filter and Fallback Lists"))
+	local fake_ip_filter_conf = "/etc/ssrplus/fake_ip_filter.list"
+	o = s:taboption("fake_ip_filter", TextValue, "fake_ip_filter_conf", "", "<font style=color:red>" .. translate("Specifically for editing the Fake-IP filter list.") .. "</font>") -- 专用于编辑 Fake-IP 过滤规则文件。
+	o.rows = 13
+	o.wrap = "off"
+	o.rmempty = true
+	o.cfgvalue = function(self, section)
+		return nixio.fs.readfile(fake_ip_filter_conf) or ""
+	end
+	o.write = function(self, section, value)
+		nixio.fs.writefile(fake_ip_filter_conf, value:gsub("\r\n", "\n"))
+	end
+	o.remove = function(self, section, value)
+		nixio.fs.writefile(fake_ip_filter_conf, "")
+	end
+
+	local fallback_ipcidr_conf = "/etc/ssrplus/fallback_ipcidr.list"
+	o = s:taboption("fake_ip_filter", TextValue, "fallback_ipcidr_conf", "", "<font style=color:red>" .. translate("Specifically for editing the Fallback IP-CIDR list.") .. "</font>") -- 专用于编辑 Fallback IP-CIDR 规则文件。
+	o.rows = 13
+	o.wrap = "off"
+	o.rmempty = true
+	o.cfgvalue = function(self, section)
+		return nixio.fs.readfile(fallback_ipcidr_conf) or ""
+	end
+	o.write = function(self, section, value)
+		nixio.fs.writefile(fallback_ipcidr_conf, value:gsub("\r\n", "\n"))
+	end
+	o.remove = function(self, section, value)
+		nixio.fs.writefile(fallback_ipcidr_conf, "")
+	end
+
+	local fallback_domain_conf = "/etc/ssrplus/fallback_domain.list"
+	o = s:taboption("fake_ip_filter", TextValue, "fallback_domain_conf", "", "<font style=color:red>" .. translate("Specifically for editing the Fallback domain filter list.") .. "</font>") -- 专用于编辑 Fallback 域名过滤规则文件。
+	o.rows = 13
+	o.wrap = "off"
+	o.rmempty = true
+	o.cfgvalue = function(self, section)
+		return nixio.fs.readfile(fallback_domain_conf) or ""
+	end
+	o.write = function(self, section, value)
+		nixio.fs.writefile(fallback_domain_conf, value:gsub("\r\n", "\n"))
+	end
+	o.remove = function(self, section, value)
+		nixio.fs.writefile(fallback_domain_conf, "")
+	end
+end
+
 if luci.sys.call('[ -f "/www/luci-static/resources/uci.js" ]') == 0 then
 	m.apply_on_parse = true
 	function m.on_apply(self)
@@ -188,9 +188,10 @@ local function save_uploaded_clash_node(upload_name, final_path)
 	local alias

 	if not sid then
-		sid = uci:add("shadowsocksr", "servers")
+		local sid_output = luci.sys.exec("uci add shadowsocksr servers 2>/dev/null")
+		sid = trim(sid_output)
 	end
-	if not sid then
+	if not sid or sid == "" then
 		return nil
 	end

@@ -200,20 +201,50 @@ local function save_uploaded_clash_node(upload_name, final_path)
 		alias = upload_alias(upload_name)
 	end

-	uci:set("shadowsocksr", sid, "type", "clash")
-	uci:set("shadowsocksr", sid, "alias", alias)
-	uci:set("shadowsocksr", sid, "server", "127.0.0.1")
-	uci:set("shadowsocksr", sid, "server_port", "0")
-	uci:delete("shadowsocksr", sid, "clash_url")
-	uci:set("shadowsocksr", sid, "clash_path", final_path)
-	uci:set("shadowsocksr", sid, "clash_user_agent", uci:get("shadowsocksr", sid, "clash_user_agent") or "clash")
-	if not uci:get("shadowsocksr", sid, "switch_enable") then
-		uci:set("shadowsocksr", sid, "switch_enable", uci:get_first("shadowsocksr", "server_subscribe", "switch", "1") or "1")
+	local switch_enable = uci:get("shadowsocksr", sid, "switch_enable")
+	if not switch_enable or switch_enable == "" then
+		switch_enable = uci:get_first("shadowsocksr", "server_subscribe", "switch", "1") or "1"
+	end
+
+	local clash_user_agent = uci:get("shadowsocksr", sid, "clash_user_agent")
+	if not clash_user_agent or clash_user_agent == "" then
+		clash_user_agent = "clash"
+	end
+
+	local safe_sid = luci.util.shellquote(sid)
+	local safe_alias = luci.util.shellquote(alias)
+	local safe_path = luci.util.shellquote(final_path)
+	local safe_upload_name = luci.util.shellquote(upload_name)
+	local safe_switch_enable = luci.util.shellquote(switch_enable)
+	local safe_user_agent = luci.util.shellquote(clash_user_agent)
+
+	local cmd = string.format(
+		"uci set shadowsocksr.%s.type=clash && " ..
+		"uci set shadowsocksr.%s.alias=%s && " ..
+		"uci set shadowsocksr.%s.server=127.0.0.1 && " ..
+		"uci set shadowsocksr.%s.server_port=0 && " ..
+		"uci delete shadowsocksr.%s.clash_url 2>/dev/null; " ..
+		"uci set shadowsocksr.%s.clash_path=%s && " ..
+		"uci set shadowsocksr.%s.clash_user_agent=%s && " ..
+		"uci set shadowsocksr.%s.switch_enable=%s && " ..
+		"uci set shadowsocksr.%s.yaml_upload=1 && " ..
+		"uci set shadowsocksr.%s.yaml_upload_name=%s && " ..
+		"uci commit shadowsocksr",
+		safe_sid,
+		safe_sid, safe_alias,
+		safe_sid,
+		safe_sid,
+		safe_sid,
+		safe_sid, safe_path,
+		safe_sid, safe_user_agent,
+		safe_sid, safe_switch_enable,
+		safe_sid,
+		safe_sid, safe_upload_name
+	)
+
+	if luci.sys.call(cmd) ~= 0 then
+		return nil
 	end
-	uci:set("shadowsocksr", sid, "yaml_upload", "1")
-	uci:set("shadowsocksr", sid, "yaml_upload_name", upload_name)
-	uci:save("shadowsocksr")
-	uci:commit("shadowsocksr")

 	cleanup_old_clash_path(old_path, final_path, sid)
 	luci.sys.call(string.format("/etc/init.d/shadowsocksr clash_cache %s >/dev/null 2>&1 &", luci.util.shellquote(sid)))
@@ -267,32 +298,48 @@ if has_mihomo then
 			local tmp_output = string.format("%s/.upload-%d-%d.yaml", CLASH_YAML_DIR, nixio.getpid(), os.time())
 			local sid
 			local alias
+			local redirect_message_url

 			nixio.fs.mkdirr(CLASH_YAML_DIR)
 			nixio.fs.remove(tmp_output)
 			if preprocess_clash_yaml(upload_tmp_path, tmp_output) then
 				hash = hash_file(tmp_output)
-				if hash == "" then
-					nixio.fs.remove(tmp_output)
+				if not hash or hash == "" then
 					upload_errmessage = translate("Uploaded YAML validation or preprocessing failed.")
 				else
 					final_path = string.format("%s/%s.yaml", CLASH_YAML_DIR, hash)
-					luci.sys.call(string.format("mv -f %s %s", luci.util.shellquote(tmp_output), luci.util.shellquote(final_path)))
-					sid, alias = save_uploaded_clash_node(upload_filename, final_path)
-					if sid then
-						upload_message = string.format(translate("Custom YAML imported successfully: %s"), alias or sid)
+					local mv_ret = luci.sys.call(string.format("mv -f %s %s", luci.util.shellquote(tmp_output), luci.util.shellquote(final_path)))
+					if mv_ret == 0 and nixio.fs.access(final_path) then
+						sid, alias = save_uploaded_clash_node(upload_filename, final_path)
+						if sid then
+							local message = string.format(translate("Custom YAML imported successfully: %s"), alias or sid)
+							local redirect_url = luci.dispatcher.build_url("admin", "services", "shadowsocksr", "servers")
+							redirect_message_url = redirect_url .. "?upload_message=" .. luci.http.urlencode(message)
+						else
+							upload_errmessage = translate("Uploaded YAML validation or preprocessing failed.")
+							if final_path and nixio.fs.access(final_path) then
+								nixio.fs.remove(final_path)
+							end
+						end
 					else
-						upload_errmessage = translate("Uploaded YAML validation or preprocessing failed.")
+						upload_errmessage = translate("Failed to move uploaded YAML to target directory.")
 					end
 				end
 			else
-				nixio.fs.remove(tmp_output)
-				upload_errmessage = translate("Uploaded YAML validation or preprocessing failed.")
+				upload_errmessage = upload_errmessage or translate("Uploaded YAML validation or preprocessing failed.")
 			end
-		end

-		if upload_tmp_path then
-			nixio.fs.remove(upload_tmp_path)
+			if upload_tmp_path and nixio.fs.access(upload_tmp_path) then
+				nixio.fs.remove(upload_tmp_path)
+			end
+			if tmp_output and nixio.fs.access(tmp_output) then
+				nixio.fs.remove(tmp_output)
+			end
+
+			if redirect_message_url then
+				luci.http.redirect(redirect_message_url)
+				return
+			end
 		end
 	end
 end
@@ -407,8 +454,11 @@ end
 m = Map("shadowsocksr", translate("Servers subscription and manage"))
 if upload_errmessage then
 	m.errmessage = upload_errmessage
-elseif upload_message then
-	m.message = upload_message
+else
+	local message = luci.http.formvalue("upload_message")
+	if message and message ~= "" then
+		m.message = message
+	end
 end

 local style_section = m:section(SimpleSection)
@@ -566,6 +616,29 @@ if has_mihomo then
 	o.rmempty = true
 	o.description = translate("Disabled means use Xray or ShadowSocks-Rust core.")

+	o = s:option(Flag, "enable_fake_ip", string.format("<b><span style='color:red;'>%s</span></b>", translate("Enable Fake-IP Mode")))
+	o.default = "0"
+	o.rmempty = true
+	o:depends("enable_mihomo", "1")
+	o.description = translate(
+		"<ul>" ..
+		"<li>" .. translate("Enable Fake-IP mode; disable to use redir-host mode.") .. "</li>" ..
+		"<li>" .. translate("Enable Fake-IP mode for better performance.") .. "</li>" ..
+		"<li>" .. translate("If disabled, Redir-Host mode will be used which returns real IP addresses.") .. "</li>" ..
+		"<li>" .. translate("Tips: Fake-IP Filter and Fallback Lists:") .. " " ..
+		"<span id='fake_ip_filter_control_link'></span>" ..
+		"<script type='text/javascript'>" ..
+			"(function() {" ..
+				"var url = '" .. luci.dispatcher.build_url("admin", "services", "shadowsocksr", "control") .. "?tab=fake_ip_filter#fake_ip_filter';" ..
+				"var linkText = '<font style=\"color:green\"><b>" .. translate("Click here to manage") .. "</b></font>';" ..
+				"var elem = document.getElementById('fake_ip_filter_control_link');" ..
+				"if (elem) elem.innerHTML = '<a href=\"' + url + '\">' + linkText + '</a>';" ..
+			"})();" ..
+		"</script>" ..
+		"</li>" ..
+		"</ul>"
+	)
+
 	o = s:option(Flag, "sub_convert", translate("Subscribe Convert Online"))
 	o.description = translate("Convert subscriptions to Clash/Mihomo YAML with a subscription template URL.")
 	o.default = "0"
@@ -1,4 +1,4 @@
 <%+cbi/valueheader%>
 	<input class="cbi-input-file" style="width: 400px" type="file" id="clash_yaml_file" name="clash_yaml_file" accept=".yaml,.yml" />
-	<input type="submit" class="cbi-button cbi-input-apply" name="upload_clash_yaml" value="<%:Upload%>" />
+	<input type="submit" class="bt cbi-button cbi-input-apply" name="upload_clash_yaml" value="<%:Upload%>" />
 <%+cbi/valuefooter%>
@@ -608,6 +608,10 @@ prepare_clash_runtime_config() {
 	local dns_mode
 	local client_policy_stats
 	local client_rules
+	local enable_fake_ip
+	local socks5_auth
+	local socks5_user
+	local socks5_pass

 	cache_file="$(get_clash_cache_file "$sid")"
 	workdir="$(get_clash_workdir "$sid")"
@@ -623,6 +627,7 @@ prepare_clash_runtime_config() {
 	dns_mode="$(uci_get_by_type global pdnsd_enable 0)"
 	client_policy_stats=""
 	client_rules=0
+	enable_fake_ip="$(uci_get_by_type server_subscribe enable_fake_ip "")"

 	[ -s "$cache_file" ] || return 1

@@ -640,17 +645,55 @@ prepare_clash_runtime_config() {
 		routing-mark: $CLASH_OUTBOUND_MARK
 		profile:
 		  store-selected: true
+		  store-fake-ip: true
 		tun:
 		  enable: false
-		dns:
-		  enable: $( [ "$dns_mode" = "7" ] && echo "true" || echo "false" )
-		  enhanced-mode: redir-host
-		  listen: 127.0.0.1:$dns_port
-		  ipv6: $( [ "$dns_ipv4_only" = "1" ] && echo "false" || echo "true" )
 	EOF

+	# 根据 enable_fake_ip 决定 enhanced-mode
+	if [ "$enable_fake_ip" = "1" ]; then
+		ENHANCED_MODE="fake-ip"
+	else
+		ENHANCED_MODE="redir-host"
+	fi
+	# 根据 dns_mode 添加不同的 dns 配置
+	if [ "$dns_mode" = "7" ]; then
+		cat >> "$overlay_file" <<-EOF
+			dns:
+			  enable: true
+			  enhanced-mode: $ENHANCED_MODE
+			  listen: 127.0.0.1:$dns_port
+			  ipv6: $( [ "$dns_ipv4_only" = "1" ] && echo "false" || echo "true" )
+		EOF
+	else
+		cat >> "$overlay_file" <<-EOF
+			dns:
+			  enable: true
+			  enhanced-mode: $ENHANCED_MODE
+			  ipv6: $( [ "$dns_ipv4_only" = "1" ] && echo "false" || echo "true" )
+		EOF
+	fi
+
 	if [ -n "$socks_port" ] && [ "$socks_port" != "0" ]; then
 		echo "socks-port: $socks_port" >>"$overlay_file"
+
+		socks5_auth="$(uci_get_by_type socks5_proxy socks5_auth noauth)"
+		socks5_user="$(uci_get_by_type socks5_proxy socks5_user "")"
+		socks5_pass="$(uci_get_by_type socks5_proxy socks5_pass "")"
+
+		if [ "$socks5_auth" = "password" ]; then
+			if [ -z "$socks5_user" ] || [ -z "$socks5_pass" ]; then
+				echolog "警告：SOCKS5 代理未完整配置用户名或密码，已自动降级为无认证模式 (noauth)！"
+				socks5_auth="noauth"
+			fi
+		fi
+
+		if [ "$socks5_auth" = "password" ]; then
+			cat >>"$overlay_file" <<-EOF
+				authentication:
+				  - "$socks5_user:$socks5_pass"
+			EOF
+		fi
 	fi

 	merge_stats="$(/usr/bin/lua "$CLASH_YAML_HELPER" merge "$raw_file" "$overlay_file" "$runtime_file" 2>/dev/null)" || return 1
@@ -1230,14 +1273,24 @@ start_dns() {
 	ssrplus_dns="$(uci_get_by_type global pdnsd_enable 0)"
 	global_server_type="$(uci_get_by_name "$GLOBAL_SERVER" type)"
 	builtin_dns_enabled=0
-	dnsserver="$(uci_get_by_type global tunnel_forward 8.8.4.4:53)"

 	if [ "$ssrplus_dns" = "5" ]; then
 		ssrplus_dns="$(force_dns2tcp_fallback "旧版 DNSPROXY 模式已移除")" || return 1
 		uci_set_by_type global pdnsd_enable "$ssrplus_dns"
-	elif [ "$ssrplus_dns" = "6" ]; then
-		dnsserver="$(uci_get_by_type global chinadns_ng_tunnel_forward 8.8.4.4:53)"
 	fi
+	case "$ssrplus_dns" in
+		1)
+			dnsserver="$(uci_get_by_type global dns2tcp_tunnel_forward 8.8.4.4:53)"
+		;;
+		6)
+			dnsserver="$(uci_get_by_type global chinadns_ng_tunnel_forward 8.8.4.4:53)"
+		;;
+		7)
+			dnsserver="$(uci_get_by_type global tunnel_forward 8.8.4.4:53)"
+		;;
+		*)
+			;;
+	esac
 	run_mode="$(normalize_run_mode)"

 	if [ "$ssrplus_dns" = "4" ] && ! is_finded "mosdns"; then
@@ -1503,15 +1556,15 @@ generate_xray_config() {
 		{
 			"log": {
 				"loglevel": "warning"
-		},
-		"inbounds": [$inbound_json],
-		"outbounds": [
-			{
-				"protocol": "freedom",
-				"settings": {}
-			}
-		]
-	}
+			},
+			"inbounds": [$inbound_json],
+			"outbounds": [
+				{
+					"protocol": "freedom",
+					"settings": {}
+				}
+			]
+		}
 	EOF
 	return 0
 }
@@ -2887,12 +2940,18 @@ start_rules() {
 	local ac_ips
 	local custom_ports
 	local proxyport
+	local enable_fake_ip

 	server=$(get_host_ip "$GLOBAL_SERVER")
 	local_port=$(get_default_node_local_port)
 	lan_ac_ips=$(uci_get_by_type access_control lan_ac_ips)
 	lan_ac_mode=$(uci_get_by_type access_control lan_ac_mode)

+	enable_fake_ip=$(uci_get_by_type server_subscribe enable_fake_ip "")
+	if [ -z "$enable_fake_ip" ]; then
+		enable_fake_ip="0"
+	fi
+
 	if [ "$kcp_enable_flag" = "0" ] && [ "$redir_udp" = "1" ]; then
 		udp_server=$(get_host_ip "$UDP_RELAY_SERVER")
 		udp_local_port=$tmp_udp_port
@@ -2937,26 +2996,27 @@ start_rules() {
 		fi
 	elif [ "$USE_TABLES" = "iptables" ]; then
 		ARG_A=""
-		fi
-		/usr/share/shadowsocksr/gfw2ipset.sh
-		/usr/bin/ssr-rules \
-			-s "$server" \
-			-l "$local_port" \
-			-S "$udp_server" \
-			-L "$udp_local_port" \
-			-a "$ac_ips" \
-			-i "/etc/ssrplus/china_ssr.txt" \
-			-b "$(uci_get_by_type access_control wan_bp_ips)" \
-			-w "$(uci_get_by_type access_control wan_fw_ips)" \
-			-B "$(uci_get_by_type access_control lan_bp_ips)" \
-			-p "$(uci_get_by_type access_control lan_fp_ips)" \
-			-G "$(uci_get_by_type access_control lan_gm_ips)" \
-			-m "$(uci_get_by_type access_control Interface)" \
-			-D "$proxyport" \
-			"$(get_arg_out)" "$(gfwmode)" "$ARG_UDP" "$ARG_UDP_RULES" "$ARG_A"
+	fi
+	/usr/share/shadowsocksr/gfw2ipset.sh
+	/usr/bin/ssr-rules \
+		-s "$server" \
+		-l "$local_port" \
+		-S "$udp_server" \
+		-L "$udp_local_port" \
+		-a "$ac_ips" \
+		-i "/etc/ssrplus/china_ssr.txt" \
+		-b "$(uci_get_by_type access_control wan_bp_ips)" \
+		-w "$(uci_get_by_type access_control wan_fw_ips)" \
+		-B "$(uci_get_by_type access_control lan_bp_ips)" \
+		-p "$(uci_get_by_type access_control lan_fp_ips)" \
+		-G "$(uci_get_by_type access_control lan_gm_ips)" \
+		-m "$(uci_get_by_type access_control Interface)" \
+		-D "$proxyport" \
+		-E "$enable_fake_ip" \
+		"$(get_arg_out)" "$(gfwmode)" "$ARG_UDP" "$ARG_UDP_RULES" "$ARG_A"

-		return $?
-	}
+	return $?
+}

 start() {
 	local run_mode
@@ -0,0 +1,78 @@
+*.lan
+*.localdomain
+*.example
+*.invalid
+*.localhost
+*.test
+*.local
+*.home.arpa
+time.*.com
+time.*.gov
+time.*.edu.cn
+time.*.apple.com
+time1.*.com
+time2.*.com
+time3.*.com
+time4.*.com
+time5.*.com
+time6.*.com
+time7.*.com
+ntp.*.com
+ntp1.*.com
+ntp2.*.com
+ntp3.*.com
+ntp4.*.com
+ntp5.*.com
+ntp6.*.com
+ntp7.*.com
+*.time.edu.cn
+*.ntp.org.cn
+.pool.ntp.org
+time1.cloud.tencent.com
+stun.*.*
+stun.*.*.*
+swscan.apple.com
+mesu.apple.com
+music.163.com
+*.music.163.com
+*.126.net
+musicapi.taihe.com
+music.taihe.com
+songsearch.kugou.com
+trackercdn.kugou.com
+*.kuwo.cn
+api-jooxtt.sanook.com
+api.joox.com
+y.qq.com
+*.y.qq.com
+streamoc.music.tc.qq.com
+mobileoc.music.tc.qq.com
+isure.stream.qqmusic.qq.com
+dl.stream.qqmusic.qq.com
+aqqmusic.tc.qq.com
+amobile.music.tc.qq.com
+localhost.ptlogin2.qq.com
+*.msftconnecttest.com
+*.msftncsi.com
+*.xiami.com
+*.music.migu.cn
+music.migu.cn
+.wotgame.cn
+.wggames.cn
+.wowsgame.cn
+.wargaming.net
+*.*.*.srv.nintendo.net
+*.*.stun.playstation.net
+xbox.*.*.microsoft.com
+*.*.xboxlive.com
+*.ipv6.microsoft.com
+teredo.*.*.*
+teredo.*.*
+speedtest.cros.wr.pvp.net
+.jjvip8.com
+www.douyu.com
+activityapi.huya.com
+activityapi.huya.com.w.cdngslb.com
+www.bilibili.com
+api.bilibili.com
+a.w.bilicdn1.com
@@ -0,0 +1,9 @@
+.google.com
+.facebook.com
+.youtube.com
+.twitter.com
+.telegram.org
+.githubusercontent.com
+.googlevideo.com
+.msftconnecttest.com
+.msftncsi.com
@@ -0,0 +1,15 @@
+0.0.0.0/8
+10.0.0.0/8
+100.64.0.0/10
+127.0.0.0/8
+169.254.0.0/16
+172.16.0.0/12
+192.0.0.0/24
+192.0.2.0/24
+192.88.99.0/24
+192.168.0.0/16
+198.51.100.0/24
+203.0.113.0/24
+224.0.0.0/4
+240.0.0.0/4
+255.255.255.255/32
@@ -39,6 +39,18 @@ if [ -s "/etc/config/shadowsocksr" ]; then
        uci -q set shadowsocksr.@server_subscribe[0].auto_update_min_time='0'
    fi

+    if ! uci -q get shadowsocksr.@server_subscribe[0].enable_mihomo > /dev/null; then
+        uci -q set shadowsocksr.@server_subscribe[0].enable_mihomo='1'
+    fi
+
+    if ! uci -q get shadowsocksr.@server_subscribe[0].enable_fake_ip > /dev/null; then
+        uci -q set shadowsocksr.@server_subscribe[0].enable_fake_ip='1'
+    fi
+
+    if ! uci -q get shadowsocksr.@server_subscribe[0].sub_convert > /dev/null; then
+        uci -q set shadowsocksr.@server_subscribe[0].sub_convert='1'
+    fi
+
    if ! uci -q get shadowsocksr.@server_subscribe[0].config_auto_update_mode > /dev/null; then
        uci -q set shadowsocksr.@server_subscribe[0].config_auto_update_mode='0'
    fi
@@ -46,6 +46,7 @@ CHECK_STATUS=0
 RESTORE_RULES=0
 FLUSH_RULES=0
 CLEANUP_PERSISTENCE=0
+ENABLE_FAKE_IP=0
 # ASCII code for SSRP.Use whatever,just not the same.
 FWMARK="0x53535250"

@@ -83,14 +84,15 @@ usage() {
 		    -m <Interface>          Interface name
 		    -I <ip_list_file>       a file content is bypassed shunt ip list
 		    -e <extra_options>      extra options for iptables
+		    -E <0|1>				enable_fake_ip status
 		    -o                      apply the rules to the OUTPUT chain
 		    -O                      apply the global rules to the OUTPUT chain
-			    -u                      enable udprelay mode, TPROXY is required
-			    -U                      enable udprelay mode, using different IP
-			                            and ports for TCP and UDP
-			    -y                      disable all auxiliary UDP rules when UDP
-			                            transparent proxy is unavailable
-			    -f                      flush the rules
+		    -u                      enable udprelay mode, TPROXY is required
+		    -U                      enable udprelay mode, using different IP
+			                        and ports for TCP and UDP
+		    -y                      disable all auxiliary UDP rules when UDP
+			                        transparent proxy is unavailable
+		    -f                      flush the rules
 		    -g                      gfwlist mode
 		    -r                      router mode
 		    -z                      all mode
@@ -232,6 +234,12 @@ cleanup_persistence_files() {
 		loger 5 "Removed xhttp hash file: /tmp/.last_xhttp_hash"
 	fi

+	# Remove Fake_IP Mode state file
+	if [ -f "$ENABLE_FAKE_IP_STATE_FILE" ]; then
+		rm -f "$ENABLE_FAKE_IP_STATE_FILE" 2>/dev/null
+		loger 5 "Removed Fake_IP Mode state file: $ENABLE_FAKE_IP_STATE_FILE"
+	fi
+
 	loger 5 "Persistence cleanup completed"
 	return 0
 }
@@ -315,25 +323,64 @@ flush_nftables() {

 flush_iptables_legacy() {
 	flush_iptables() {
-		local ipt="iptables -t $1"
-		local DAT=$(iptables-save -t $1)
-		eval $(echo "$DAT" | grep "$TAG" | sed -e 's/^-A/$ipt -D/' -e 's/$/;/')
-		for chain in $(echo "$DAT" | awk '/^:SS_SPEC/{print $1}'); do
-			$ipt -F ${chain:1} 2>/dev/null && $ipt -X ${chain:1}
+		local table=$1
+		local ipt="iptables -t $table"
+		local DAT
+
+		DAT=$(iptables-save -t $table 2>/dev/null)
+
+		[ -z "$DAT" ] && return 0
+
+		# 1. 解除所有引用 SS_SPEC* 链的规则
+		echo "$DAT" | grep -E "^-A .*SS_SPEC" | while read -r line; do
+			local chain rule
+			chain=$(echo "$line" | awk '{print $2}')
+			rule=$(echo "$line" | sed 's/^-A [^ ]* //')
+			[ -n "$chain" ] && [ -n "$rule" ] && \
+				eval "$ipt -D \"$chain\" $rule 2>/dev/null"
 		done
+
+		# 2. 删除带 TAG 或 mark 的残留规则（同样加上 eval）
+		echo "$DAT" | grep -E "^-A " | grep -E "$TAG|-m mark|--mark" | while read -r line; do
+			local chain rule
+			chain=$(echo "$line" | awk '{print $2}')
+			rule=$(echo "$line" | sed 's/^-A [^ ]* //')
+			[ -n "$chain" ] && [ -n "$rule" ] && \
+				eval "$ipt -D \"$chain\" $rule 2>/dev/null"
+		done
+
+		# 3. 提取所有以 SS_SPEC 开头的自定义链
+		local chains
+		chains=$(echo "$DAT" | awk '/^:SS_SPEC/{sub(/^:/,"",$1); print $1}')
+
+		# 4. 清空并彻底删除 SS_SPEC* 自定义链
+		for chain in $chains; do
+			$ipt -F "$chain" 2>/dev/null
+			$ipt -X "$chain" 2>/dev/null
+		done
+
+		return 0
 	}
+
+	# 依次对 nat 和 mangle 表执行清理
 	flush_iptables nat
 	flush_iptables mangle
-	if ip rule show | grep -Eq "fwmark ${FWMARK}.*lookup 999"; then
+
+	# 清理策略路由与路由表
+	if ip rule show | grep -Eiq "fwmark ${FWMARK}.*lookup 999"; then
 		ip rule del fwmark ${FWMARK} table 999 2>/dev/null
 	fi
 	if ip route show table 999 | grep -Eq "^local.*dev lo"; then
 		ip route del local 0.0.0.0/0 dev lo table 999 2>/dev/null
 	fi
+
+	# 清理 IPSET 集合（先 -F 清空，后 -X 销毁）
 	for setname in ss_spec_lan_ac ss_spec_wan_ac ssr_gen_router \
 			china fplan bplan gmlan whitelist blacklist gfwlist music; do
+		ipset -F $setname 2>/dev/null
 		ipset -X $setname 2>/dev/null
 	done
+
 	[ -n "$FWI" ] && echo '#!/bin/sh' >$FWI
 	return 0
 }
@@ -524,6 +571,11 @@ fw_rule() {
 }

 fw_rule_nft() {
+	# 优先将 Fake-IP (198.18.0.0/16) 的 TCP 流量重定向至代理端口
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		$NFT add rule inet ss_spec ss_spec_wan_fw ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+	fi
+
 	# redirect/translation: when PROXY_PORTS present, redirect those tcp ports to local_port
 	if [ -n "$PROXY_PORTS" ]; then
 		PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
@@ -559,6 +611,10 @@ fw_rule_iptables() {
 		$IPT -A SS_SPEC_WAN_FW -d "$net" -j RETURN
 	done

+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		$IPT -A SS_SPEC_WAN_FW -d 198.18.0.0/16 -p tcp -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+	fi
+
 	$IPT -A SS_SPEC_WAN_FW -p tcp $PROXY_PORTS -j REDIRECT --to-ports "$local_port" 2>/dev/null || {
 		loger 3 "Can't redirect TCP, please check the iptables."
 		exit 1
@@ -611,6 +667,33 @@ ac_rule_nft() {
 	fi
 	$NFT flush chain inet ss_spec ss_spec_prerouting 2>/dev/null

+	# Fake-IP 重定向处理 (引入 Interface 匹配，防止 WAN 口越权)
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		if [ -z "$Interface" ]; then
+			if [ -n "$MATCH_SET" ]; then
+				$NFT add rule inet ss_spec ss_spec_prerouting ip daddr 198.18.0.0/16 $MATCH_SET meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+				$NFT add rule inet ss_spec ss_spec_prerouting ip daddr 198.18.0.0/16 $MATCH_SET meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+			else
+				$NFT add rule inet ss_spec ss_spec_prerouting ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+				$NFT add rule inet ss_spec ss_spec_prerouting ip daddr 198.18.0.0/16 meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+			fi
+		else
+			for name in $Interface; do
+				local IFNAME=$(uci -P /var/state get network."$name".ifname 2>/dev/null)
+				[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
+				if [ -n "$IFNAME" ]; then
+					if [ -n "$MATCH_SET" ]; then
+						$NFT add rule inet ss_spec ss_spec_prerouting meta iifname "$IFNAME" ip daddr 198.18.0.0/16 $MATCH_SET meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+						$NFT add rule inet ss_spec ss_spec_prerouting meta iifname "$IFNAME" ip daddr 198.18.0.0/16 $MATCH_SET meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+					else
+						$NFT add rule inet ss_spec ss_spec_prerouting meta iifname "$IFNAME" ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+						$NFT add rule inet ss_spec ss_spec_prerouting meta iifname "$IFNAME" ip daddr 198.18.0.0/16 meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+					fi
+				fi
+			done
+		fi
+	fi
+
 	# Exclude special local addresses
 	if $NFT list chain inet ss_spec ss_spec_prerouting >/dev/null 2>&1; then
 		for net in 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4; do
@@ -625,16 +708,6 @@ ac_rule_nft() {
 	#	done
 	#fi

-	# Build a rule in the prerouting hook chain that jumps to business chain with conditions
-	if [ -n "$PROXY_PORTS" ]; then
-		PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
-		if [ -n "$PORTS_ARGS" ]; then
-			TCP_EXT_ARGS="meta l4proto tcp tcp dport { $PORTS_ARGS }"
-		fi
-	else
-		TCP_EXT_ARGS="meta l4proto tcp"
-	fi
-
 	# Block UDP port 443 when TPROXY not Enable
 	if [ -z "$TPROXY" ] && [ "$DISABLE_UDP_RULES" != "1" ]; then
 		# Add UDP 443 block rule
@@ -658,6 +731,17 @@ ac_rule_nft() {
 			done
 		fi
 	fi
+
+	# Build a rule in the prerouting hook chain that jumps to business chain with conditions
+	if [ -n "$PROXY_PORTS" ]; then
+		PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
+		if [ -n "$PORTS_ARGS" ]; then
+			TCP_EXT_ARGS="meta l4proto tcp tcp dport { $PORTS_ARGS }"
+		fi
+	else
+		TCP_EXT_ARGS="meta l4proto tcp"
+	fi
+
 	if [ -z "$Interface" ]; then
 		# generic prerouting jump already exists (see ipset_nft), but if we have MATCH_SET_CONDITION we add a more specific rule
 		if [ -n "$MATCH_SET" ]; then
@@ -683,11 +767,16 @@ ac_rule_nft() {
 	case "$OUTPUT" in
 	1)
 		# Create ss_spec_output tcp chain
-			if ! $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
-				$NFT add chain inet ss_spec ss_spec_output '{ type nat hook output priority 0; policy accept; }'
-			fi
-			$NFT flush chain inet ss_spec ss_spec_output 2>/dev/null
-			$NFT add rule inet ss_spec ss_spec_output meta mark 255 return 2>/dev/null
+		if ! $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
+			$NFT add chain inet ss_spec ss_spec_output '{ type nat hook output priority 0; policy accept; }'
+		fi
+		$NFT flush chain inet ss_spec ss_spec_output 2>/dev/null
+		$NFT add rule inet ss_spec ss_spec_output meta mark 255 return 2>/dev/null
+
+		if [ "$ENABLE_FAKE_IP" = "1" ]; then
+			$NFT add rule inet ss_spec ss_spec_output ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+			$NFT add rule inet ss_spec ss_spec_output ip daddr 198.18.0.0/16 meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+		fi
 		
 		# Exclude special local addresses
 		if $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
@@ -708,11 +797,16 @@ ac_rule_nft() {
 		;;
 	2)
 		# Create ss_spec_output tcp chain
-			if ! $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
-				$NFT add chain inet ss_spec ss_spec_output '{ type nat hook output priority 0; policy accept; }'
-			fi
-			$NFT flush chain inet ss_spec ss_spec_output 2>/dev/null
-			$NFT add rule inet ss_spec ss_spec_output meta mark 255 return 2>/dev/null
+		if ! $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
+			$NFT add chain inet ss_spec ss_spec_output '{ type nat hook output priority 0; policy accept; }'
+		fi
+		$NFT flush chain inet ss_spec ss_spec_output 2>/dev/null
+		$NFT add rule inet ss_spec ss_spec_output meta mark 255 return 2>/dev/null
+
+		if [ "$ENABLE_FAKE_IP" = "1" ]; then
+			$NFT add rule inet ss_spec ss_spec_output ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+			$NFT add rule inet ss_spec ss_spec_output ip daddr 198.18.0.0/16 meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+		fi
 		
 		# Exclude special local addresses
 		if $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
@@ -754,11 +848,38 @@ ac_rule_iptables() {
 			return 2
 			;;
 		esac
+
+		local ip_list="${LAN_AC_IP#?}"
+		ipset -! create ss_spec_lan_ac hash:net 2>/dev/null
+		ipset flush ss_spec_lan_ac 2>/dev/null
+		if [ -n "$ip_list" ]; then
+			for ip in $ip_list; do
+				ipset add ss_spec_lan_ac "$ip" 2>/dev/null
+			done
+		fi
+	fi
+
+	# 2. PREROUTING 链处理
+	if [ -z "$Interface" ]; then
+		# Global rules
+		if [ -n "$MATCH_SET" ]; then
+			$IPT -I PREROUTING 1 -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		else
+			$IPT -I PREROUTING 1 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		fi
+	else
+		for name in $Interface; do
+			local IFNAME=$(uci -P /var/state get network."$name".ifname 2>/dev/null)
+			[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
+			if [ -n "$IFNAME" ]; then
+				if [ -n "$MATCH_SET" ]; then
+					$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+				else
+					$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+				fi
+			fi
+		done
 	fi
-	ipset -! -R <<-EOF || return 1
-		create ss_spec_lan_ac hash:net
-		$(for ip in ${LAN_AC_IP#?}; do echo "add ss_spec_lan_ac $ip"; done)
-	EOF

 	# Block UDP port 443 when TPROXY not Enable
 	if [ -z "$TPROXY" ] && [ "$DISABLE_UDP_RULES" != "1" ]; then
@@ -784,42 +905,67 @@ ac_rule_iptables() {
 			done
 		fi
 	fi
-	if [ -z "$Interface" ]; then
-		# Global rules
-		if [ -n "$MATCH_SET" ]; then
-			$IPT -I PREROUTING 1 -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
-		else
-			$IPT -I PREROUTING 1 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
-		fi
-	else
-		for name in $Interface; do
-			local IFNAME=$(uci -P /var/state get network."$name".ifname 2>/dev/null)
-			[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
-			if [ -n "$IFNAME" ]; then
-				if [ -n "$MATCH_SET" ]; then
-					$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
-				else
-					$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
-				fi
+
+	# 拦截 Fake-IP 流量 (198.18.0.0/16)，受 Interface 和 LAN_AC 控制
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		if [ -z "$Interface" ]; then
+			if [ -n "$MATCH_SET" ]; then
+				$IPT -I PREROUTING 1 -p tcp -d 198.18.0.0/16 $MATCH_SET -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+				$IPT -I PREROUTING 2 -p udp -d 198.18.0.0/16 $MATCH_SET -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			else
+				$IPT -I PREROUTING 1 -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+				$IPT -I PREROUTING 2 -p udp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
 			fi
-		done
+		else
+			for name in $Interface; do
+				local IFNAME=$(uci -P /var/state get network."$name".ifname 2>/dev/null)
+				[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
+				if [ -n "$IFNAME" ]; then
+					if [ -n "$MATCH_SET" ]; then
+						$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp -d 198.18.0.0/16 $MATCH_SET -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+						$IPT -I PREROUTING 2 ${IFNAME:+-i $IFNAME} -p udp -d 198.18.0.0/16 $MATCH_SET -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+					else
+						$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+						$IPT -I PREROUTING 2 ${IFNAME:+-i $IFNAME} -p udp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+					fi
+				fi
+			done
+		fi
 	fi

 	case "$OUTPUT" in
 	1)
-		$IPT -I OUTPUT 1 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		# fake-ip first
+		if [ "$ENABLE_FAKE_IP" = "1" ]; then
+			$IPT -I OUTPUT 1 -m mark --mark 255 -j RETURN 2>/dev/null
+			$IPT -I OUTPUT 2 -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			$IPT -I OUTPUT 3 -p udp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			$IPT -I OUTPUT 4 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		else
+			$IPT -I OUTPUT 1 -m mark --mark 255 -j RETURN 2>/dev/null
+			$IPT -I OUTPUT 2 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		fi
 		;;
 	2)
 		ipset -! -R <<-EOF || return 1
 			create ssr_gen_router hash:net
 			$(gen_spec_iplist | sed -e "s/^/add ssr_gen_router /")
 		EOF
-			$IPT -N SS_SPEC_ROUTER 2>/dev/null
-			$IPT -F SS_SPEC_ROUTER 2>/dev/null
-			$IPT -A SS_SPEC_ROUTER -m mark --mark 255 -j RETURN && \
-			$IPT -A SS_SPEC_ROUTER -m set --match-set ssr_gen_router dst -j RETURN && \
-			$IPT -A SS_SPEC_ROUTER -j SS_SPEC_WAN_FW
-		$IPT -I OUTPUT 1 -p tcp -m comment --comment "$TAG" -j SS_SPEC_ROUTER
+		$IPT -N SS_SPEC_ROUTER 2>/dev/null
+		$IPT -F SS_SPEC_ROUTER 2>/dev/null
+		# $IPT -A SS_SPEC_ROUTER -m mark --mark 255 -j RETURN
+		$IPT -A SS_SPEC_ROUTER -m set --match-set ssr_gen_router dst -j RETURN
+		$IPT -A SS_SPEC_ROUTER -j SS_SPEC_WAN_FW
+		# fake-ip first
+		if [ "$ENABLE_FAKE_IP" = "1" ]; then
+			$IPT -I OUTPUT 1 -m mark --mark 255 -j RETURN 2>/dev/null
+			$IPT -I OUTPUT 2 -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			$IPT -I OUTPUT 3 -p udp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			$IPT -I OUTPUT 4 -p tcp -m comment --comment "$TAG" -j SS_SPEC_ROUTER
+		else
+			$IPT -I OUTPUT 1 -m mark --mark 255 -j RETURN 2>/dev/null
+			$IPT -I OUTPUT 2 -p tcp -m comment --comment "$TAG" -j SS_SPEC_ROUTER
+		fi
 		;;
 	esac
 	return $?
@@ -855,29 +1001,29 @@ tp_rule_nft() {
 	fi

 	local MATCH_SET=""
+	local EXT_ARGS=""

 	if [ -n "$PROXY_PORTS" ]; then
-		PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
-		if [ -n "$PORTS_ARGS" ]; then
-			EXT_ARGS="udp dport { $PORTS_ARGS }"
-		else
-			EXT_ARGS=""
-		fi
+		local PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
+		[ -n "$PORTS_ARGS" ] && EXT_ARGS="udp dport { $PORTS_ARGS }"
 	fi

 	if [ -n "$LAN_AC_IP" ]; then
 		# Create LAN access control set if needed
+		local mode="${LAN_AC_IP:0:1}"
+		local ips="${LAN_AC_IP:1}"
+
 		if ! $NFT list set ip ss_spec_mangle ss_spec_lan_ac >/dev/null 2>&1; then
 			$NFT add set ip ss_spec_mangle ss_spec_lan_ac '{ type ipv4_addr; flags interval; auto-merge; }' 2>/dev/null
 		else
 			$NFT flush set ip ss_spec_mangle ss_spec_lan_ac 2>/dev/null
 		fi

-		for ip in ${LAN_AC_IP#?}; do
+		for ip in $ips; do
 			[ -n "$ip" ] && $NFT add element ip ss_spec_mangle ss_spec_lan_ac "{ $ip }" 2>/dev/null
 		done

-		case "${LAN_AC_IP%${LAN_AC_IP#?}}" in
+		case "$mode" in
 		w | W)
 			MATCH_SET="ip saddr @ss_spec_lan_ac"
 			;;
@@ -906,8 +1052,10 @@ tp_rule_nft() {
 	fi

 	# Bulk import xhttp ip list into nft whitelist (server + shunt)
-	if [ -f "${xhttp_ip:=/etc/ssrplus/xhttp_address.txt}" ]; then
-		$NFT add element ip ss_spec_mangle whitelist "{ $(tr '\n' ',' < "${xhttp_ip}" | sed 's/,$//') }" 2>/dev/null
+	local xhttp_file="${xhttp_ip:=/etc/ssrplus/xhttp_address.txt}"
+	if [ -s "$xhttp_file" ]; then
+		local xhttp_content=$(tr '\n' ',' < "$xhttp_file" | sed 's/,$//')
+		[ -n "$xhttp_content" ] && $NFT add element ip ss_spec_mangle whitelist "{ $xhttp_content }" 2>/dev/null
 	fi

 	# use priority mangle for compatibility with other rules
@@ -917,6 +1065,12 @@ tp_rule_nft() {
 		$NFT flush chain ip ss_spec_mangle ss_spec_tproxy 2>/dev/null
 	fi

+	# 优先对 Fake-IP 进行 TPROXY 重定向 (无需受限于 PROXY_PORTS 限制)
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		$NFT add rule ip ss_spec_mangle ss_spec_tproxy ip daddr 198.18.0.0/16 counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
+	fi
+
+	# Exclude special local addresses
 	if $NFT list chain ip ss_spec_mangle ss_spec_tproxy >/dev/null 2>&1; then
 		for net in 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4; do
 			$NFT add rule ip ss_spec_mangle ss_spec_tproxy ip daddr $net return 2>/dev/null
@@ -934,9 +1088,9 @@ tp_rule_nft() {
 	$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp dport 53 return 2>/dev/null

 	# avoid redirecting to udp server address
-	if [ -n "$server" ]; then
-		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp dport != 53 ip daddr "$server" return 2>/dev/null
-	fi
+	# if [ -n "$server" ]; then
+	# 	$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp dport != 53 ip daddr "$server" return 2>/dev/null
+	# fi

 	# if server != SERVER add SERVER to whitelist set (so tproxy won't touch it)
 	if [ -n "$server" ]; then
@@ -946,6 +1100,9 @@ tp_rule_nft() {
 		$NFT add element ip ss_spec_mangle whitelist "{ $SERVER }" 2>/dev/null
 	fi

+	# 显式豁免白名单集合中的 IP
+	$NFT add rule ip ss_spec_mangle ss_spec_tproxy ip daddr @whitelist return 2>/dev/null
+
 	# access control and tproxy rules
 	$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip saddr @bplan return 2>/dev/null
 	$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp $EXT_ARGS ip saddr @fplan counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
@@ -965,7 +1122,9 @@ tp_rule_nft() {

 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip daddr @ss_spec_wan_ac return 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip daddr @china return 2>/dev/null
+		# 80 端口规则：非国内 IP 的 80 端口，走 TPROXY
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp udp dport 80 counter drop comment "\"$TAG\"" 2>/dev/null
+		# 443 端口规则：非国内 IP 的 443 端口，走 TPROXY
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp udp dport 443 counter drop comment "\"$TAG\"" 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip saddr @gmlan ip daddr != @china counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp $EXT_ARGS ip daddr != @ss_spec_wan_ac counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
@@ -975,7 +1134,9 @@ tp_rule_nft() {
 			$NFT add set ip ss_spec_mangle gfwlist '{ type ipv4_addr; flags interval; auto-merge; }' 2>/dev/null
 		fi
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip daddr @china return 2>/dev/null
+		# 80 端口规则：非国内 IP 的 80 端口，走 TPROXY
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp udp dport 80 counter drop comment "\"$TAG\"" 2>/dev/null
+		# 443 端口规则：非国内 IP 的 443 端口，走 TPROXY
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp udp dport 443 counter drop comment "\"$TAG\"" 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp $EXT_ARGS ip daddr @gfwlist counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip saddr @gmlan ip daddr != @china counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
@@ -988,6 +1149,8 @@ tp_rule_nft() {
 	# finally, ensure prerouting hook entry to jump to tproxy chain
 	if ! $NFT list chain ip ss_spec_mangle prerouting >/dev/null 2>&1; then
 		$NFT add chain ip ss_spec_mangle prerouting '{ type filter hook prerouting priority mangle; policy accept; }'
+	else
+		$NFT flush chain ip ss_spec_mangle prerouting 2>/dev/null
 	fi

 	# add prerouting jump (idempotent)
@@ -1056,8 +1219,14 @@ tp_rule_iptables() {
 	do
 		$ipt -A SS_SPEC_TPROXY -p udp -d "$net" -j RETURN
 	done
+	# fake-ip 规则
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		$ipt -A SS_SPEC_TPROXY -p udp $MATCH_SET -d 198.18.0.0/16 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+	fi
+
 	[ -n "$SERVER" ] && $ipt -A SS_SPEC_TPROXY -p udp ! --dport 53 -d "$SERVER" -j RETURN
 	[ -n "$SERVER" ] && [ "$server" != "$SERVER" ] && ipset -! add whitelist "$SERVER"
+	$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set whitelist dst -j RETURN
 	if [ -f "${xhttp_ip:=/etc/ssrplus/xhttp_address.txt}" ]; then
 		while IFS= read -r ip; do
 			[ -n "$ip" ] && ipset add whitelist "$ip" -exist
@@ -1065,6 +1234,7 @@ tp_rule_iptables() {
 	fi
 	$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set bplan src -j RETURN
 	$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set fplan src -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+	$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set blacklist dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 	case "$RUNMODE" in
 	router)
 		ipset -! -R <<-EOF || return 1
@@ -1073,15 +1243,27 @@ tp_rule_iptables() {
 		EOF
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set ss_spec_wan_ac dst -j RETURN
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set china dst -j RETURN
+		# 80 端口规则：非国内 IP 的 80 端口，走 TPROXY
 		$ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j DROP
-		$ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j DROP 
+		# 443 端口规则：非国内 IP 的 443 端口，走 TPROXY
+		$ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j DROP
+		# 保留海外 QUIC 代理
+		# $ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+		# $ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+		# $ipt -A SS_SPEC_TPROXY -p udp -m set ! --match-set china dst --dport 80 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+		# $ipt -A SS_SPEC_TPROXY -p udp -m set ! --match-set china dst --dport 443 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set gmlan src -m set ! --match-set china dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set ! --match-set ss_spec_wan_ac dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		;;
 	gfw)
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set china dst -j RETURN
+		# 80 端口规则：非国内 IP 的 80 端口，走 TPROXY
 		$ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j DROP
-		$ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j DROP 
+		# 443 端口规则：非国内 IP 的 443 端口，走 TPROXY
+		$ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j DROP
+		# 保留海外 QUIC 代理
+		# $ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+		# $ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set gfwlist dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set gmlan src -m set ! --match-set china dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		;;
@@ -1463,7 +1645,7 @@ restore_from_persistence() {
 	fi
 }

-while getopts ":m:s:l:S:L:i:e:a:B:b:w:p:G:D:F:N:M:I:oOuUyfgrzAKPCRXh" arg; do
+while getopts ":m:s:l:S:L:i:e:E:a:B:b:w:p:G:D:F:N:M:I:oOuUyfgrzAKPCRXh" arg; do
 	case "$arg" in
 	m)
 		Interface=$OPTARG
@@ -1486,6 +1668,9 @@ while getopts ":m:s:l:S:L:i:e:a:B:b:w:p:G:D:F:N:M:I:oOuUyfgrzAKPCRXh" arg; do
 	e)
 		EXT_ARGS=$OPTARG
 		;;
+	E)
+		ENABLE_FAKE_IP=$OPTARG
+		;;
 	a)
 		LAN_AC_IP=$OPTARG
 		;;
@@ -1689,6 +1874,14 @@ if [ -n "$local_port" ]; then

 	if [ "$USE_NFT" = "1" ]; then
 		# NFTables
+		# Detect Fake_IP Mode state change (execute first)
+		ENABLE_FAKE_IP_STATE_FILE="/tmp/.last_enable_fake_ip"
+		if [ -f "$ENABLE_FAKE_IP_STATE_FILE" ]; then
+			LAST_ENABLE_FAKE_IP=$(cat "$ENABLE_FAKE_IP_STATE_FILE")
+		else
+			LAST_ENABLE_FAKE_IP=""
+		fi
+
 		# Save previous TPROXY state file
 		TPROXY_STATE_FILE="/tmp/.last_tproxy"
 		if [ -f "$TPROXY_STATE_FILE" ]; then
@@ -1778,6 +1971,13 @@ if [ -n "$local_port" ]; then
 			LAST_XHTTP_FILE_HASH=""
 		fi

+		# Check if Fake_IP Mode state has changed
+		ENABLE_FAKE_IP_CHANGED=0
+		if [ "$LAST_ENABLE_FAKE_IP" != "$ENABLE_FAKE_IP" ]; then
+			loger 6 "Fake_IP Mode state changed: $LAST_ENABLE_FAKE_IP -> $ENABLE_FAKE_IP"
+			ENABLE_FAKE_IP_CHANGED=1
+		fi
+
 		# STEP 1: Check if TPROXY has value (1 or 2)
 		if [ "$TPROXY" = "1" ] || [ "$TPROXY" = "2" ]; then
 			TPROXY_HAS_VALUE=1
@@ -1873,7 +2073,9 @@ if [ -n "$local_port" ]; then
 		# 1. TPROXY changes from empty ↔ has value
 		# 2. PROXY_PORTS changes from empty ↔ has value
 		# 3. Any IP list has changed
-		if [ "$TPROXY_HAS_VALUE" != "$LAST_HAS_VALUE" ] || \
+		# 4. ENABLE_FAKE_IP state changed
+		if [ "$ENABLE_FAKE_IP_CHANGED" = "1" ] || \
+		   [ "$TPROXY_HAS_VALUE" != "$LAST_HAS_VALUE" ] || \
 		   [ "$PROXY_HAS_VALUE" != "$LAST_PROXY_HAS_VALUE" ] || \
 		   [ "$ANY_IP_LIST_CHANGED" = "1" ]; then
 			FORCE_RECREATE=1
@@ -1891,6 +2093,7 @@ if [ -n "$local_port" ]; then
 		fi

 		# STEP 4: Save current state
+		echo "$ENABLE_FAKE_IP" > "$ENABLE_FAKE_IP_STATE_FILE"
 		echo "$TPROXY" > "$TPROXY_STATE_FILE"
 		echo "$PROXY_PORTS" > "$PROXY_PORTS_STATE_FILE"
 		echo "$(normalize_ip_list "$WAN_BP_IP")" > "$WAN_BP_IP_STATE_FILE"
@@ -3,6 +3,7 @@
 require "luci.sys"
 local ucursor = require "luci.model.uci".cursor()
 local json = require "luci.jsonc"
+local datatypes = require "luci.cbi.datatypes"

 -- An omitted value reaches us either as a missing argument or as an empty
 -- string, depending on whether the caller quoted the expansion. Empty strings
@@ -181,6 +182,62 @@ local function format_host_port(host, port)
 	return host .. ":" .. tostring(port)
 end

+local function format_dns_server(proxy)
+	if not proxy or proxy == "" then
+		return proxy
+	end
+
+	local scheme, rest = proxy:match("^([a-zA-Z0-9%+%-%.]+)://(.+)$")
+	if scheme then
+		scheme = scheme:lower()
+		if scheme == "tls" or scheme == "dot" then
+			if not rest:match(":%d+$") then
+				rest = rest .. ":853"
+			end
+			return "tls://" .. rest
+		elseif scheme == "https" or scheme == "doh" or scheme == "dohl" or scheme == "doq" or scheme == "doql" then
+			local host, path = rest:match("^([^/]+)(.*)$")
+			host = host or rest
+			path = path or ""
+			if path == "" or path == "/" then
+				path = "/dns-query"
+			end
+			return "https://" .. host .. path
+		elseif scheme == "tcp" or scheme == "udp" then
+			if not rest:match(":%d+$") then
+				rest = rest .. ":53"
+			end
+			return scheme .. "://" .. rest
+		else
+			return proxy
+		end
+	end
+
+	local host, port = proxy:match("^([^:]+):(%d+)$")
+	if host and port then
+		if port == "853" then
+			return "tls://" .. host .. ":853"
+		elseif port == "443" then
+			return "https://" .. host .. "/dns-query"
+		elseif port == "53" then
+			return host -- 53 端口输出纯 IP / Host (如 8.8.4.4)
+		else
+			return "udp://" .. host .. ":" .. port
+		end
+	end
+
+	-- 确保包含字母，防止把 IP 当成域名
+	if proxy:match("[a-zA-Z]") and not proxy:match("[^%w%.%-]") then
+		local path = ""
+		if not proxy:match("/") then
+			path = "/dns-query"
+		end
+		return "https://" .. proxy .. path
+	end
+
+	return proxy
+end
+
 -- 确保正确判断程序是否存在
 local function is_finded(e)
 	return luci.sys.exec(string.format('type -t -p "%s" -p "/usr/libexec/%s" 2>/dev/null', e, e)) ~= ""
@@ -391,31 +448,141 @@ local Xray = {
 }

 if server.type == "v2ray" and dns_mode == "7" and os.getenv("SSR_SWITCH_PROBE") ~= "1" then
-	local dns_host = builtin_dns_server:match("^([^:]+)") or "8.8.4.4"
-	local dns_port = tonumber(builtin_dns_server:match(":(%d+)$")) or 53
+	local raw_servers_str = builtin_dns_server or "8.8.4.4:53"

+	local dns_servers = {}
+	local host_list = {}
+	local port_list = {}
+	local first_host = nil
+	local first_port = nil
+
+	-- 按逗号或空格分割多个 DNS 地址
+	for raw_server in string.gmatch(raw_servers_str, "[^,%s\r\n]+") do
+		if raw_server and raw_server ~= "" then
+			-- 1. 先进行格式化处理
+			local formatted = format_dns_server(raw_server)
+
+			local host = nil
+			local port = nil
+
+			-- 2. 解析 host 和对应的实际端口
+			if formatted:match("^https://") then
+				local target = formatted:match("^https://([^/]+)")
+				if target:match(":%d+$") then
+					host, port = target:match("^([^:]+):(%d+)$")
+					port = tonumber(port)
+				else
+					host = target
+					port = 443
+				end
+			elseif formatted:match("^tls://") then
+				local target = formatted:match("^tls://([^/]+)")
+				if target:match(":%d+$") then
+					host, port = target:match("^([^:]+):(%d+)$")
+					port = tonumber(port)
+				else
+					host = target
+					port = 853
+				end
+			elseif formatted:match("^tcp://") or formatted:match("^udp://") then
+				local target = formatted:match("^[a-zA-Z0-9%+%-%.]+://([^/]+)")
+				if target:match(":%d+$") then
+					host, port = target:match("^([^:]+):(%d+)$")
+					port = tonumber(port)
+				else
+					host = target
+					port = 53
+				end
+			else
+				if formatted:match(":%d+$") then
+					host, port = formatted:match("^([^:]+):(%d+)$")
+					port = tonumber(port)
+				else
+					host = formatted
+					port = 53
+				end
+			end
+
+			-- 保存格式化后的 Xray.dns.servers 条目
+			table.insert(dns_servers, formatted)
+
+			-- 分别收集 Host 与 Port
+			if host and port then
+				table.insert(host_list, host)
+				table.insert(port_list, port)
+				-- 保存第一个 DNS 的 host 和 port
+				-- if not first_host then --dokodemo-door 入站的 address 单个地址使用。
+				-- 	first_host = host  --dokodemo-door 入站的 address 单个地址使用。
+				--	first_port = port  --dokodemo-door 入站的 address 单个地址使用。
+				-- end
+			end
+		end
+	end
+
+	-- 如果没有有效的 DNS 服务器，使用默认值
+	if #dns_servers == 0 then
+		table.insert(dns_servers, "8.8.4.4")
+		table.insert(host_list, "8.8.4.4")
+		table.insert(port_list, 53)
+		-- first_host = "8.8.4.4" --dokodemo-door 入站的 address 单个地址使用。
+		-- first_port = 53 --dokodemo-door 入站的 address 单个地址使用。
+	end
+
+	-- 构建 dns 出站地址（支持逗号分隔的多个地址）
+	-- 检查所有 DNS 端口是否一致
+	--local outbound_address = "" --dokodemo-door 入站的 address 单个地址使用。
+	local all_same_port = true
+	local common_port = port_list[1]
+	for i = 2, #port_list do
+		if port_list[i] ~= common_port then
+			all_same_port = false
+			break
+		end
+	end
+
+	-- 根据端口一致性计算 address 与 target_port
+	local address_str = ""
+	local target_port = 0
+
+	if all_same_port then
+		-- outbound_address = table.concat(host_list, ",") --dokodemo-door 入站的 address 单个地址时使用。
+		address_str = table.concat(host_list, ",")
+		target_port = common_port
+	else
+		local combined = {}
+		for i = 1, #host_list do
+			table.insert(combined, string.format("%s:%d", host_list[i], port_list[i]))
+		end
+		-- outbound_address = table.concat(combined, ",") --dokodemo-door 入站的 address 单个地址时使用。
+		address_str = table.concat(combined, ",")
+		target_port = 0
+	end
+	
+	-- 构建 Xray.dns 配置
 	Xray.dns = {
 		queryStrategy = (dns_ipv4_only == "1") and "UseIPv4" or "UseIP",
-		servers = {
-			string.format("tcp://%s:%d", dns_host, dns_port)
-		}
+		servers = dns_servers
 	}

+	-- 构建 dokodemo-door 入站
 	table.insert(Xray.inbounds, {
 		listen = "127.0.0.1",
 		port = 5335,
 		protocol = "dokodemo-door",
 		settings = {
-			address = dns_host,
-			port = dns_port,
+			address = address_str,
+			-- address = first_host,        -- 单个地址
+			port = target_port,
+			-- port = first_port,           -- 对应端口
 			network = "tcp,udp"
 		},
 		tag = "builtin-dns-in"
 	})
-
+	
 	xray_builtin_dns = {
-		address = dns_host,
-		port = dns_port
+		address = address_str,
+		-- address = outbound_address, --dokodemo-door 入站的 address 单个地址时使用。
+		port = target_port
 	}
 end
 	-- 传入连接
@@ -27,6 +27,9 @@ config server_subscribe
 	option auto_update_week_time '*'
 	option auto_update_day_time '2'
 	option auto_update_min_time '0'
+	option enable_mihomo '1'
+	option enable_fake_ip '1'
+	option sub_convert '1'
 	option url_test_url 'https://www.google.com/generate_204'
 	option user_agent 'v2rayN/9.99'
 	option filter_words '过期/重置/套餐/剩余/网址/QQ群/官网/防失联/回国'
@@ -1714,7 +1714,7 @@ local function processData(szType, content, cfgid)
 			result.quic_security = params.quicSecurity or "none"
 			result.quic_key = params.key
 		elseif result.transport == "grpc" then
-			result.serviceName = params.serviceName
+			result.serviceName = params.servicename
 			result.grpc_mode = params.mode or "gun"
 		elseif result.transport == "tcp" or result.transport == "raw" then
 			result.tcp_guise = params.headerType and params.headerType ~= "" and params.headerType or "none"
@@ -80,7 +80,7 @@ export function load_profile() {
 	let result = {};
 	const process = popen('yq -M -p yaml -o json /etc/nikki/run/config.yaml');
 	if (process) {
-		result = json(process);
+		result = json(process.read('all'));
 		process.close();
 	}
 	return result;
@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=v2rayA
-PKG_VERSION:=2.4.18
+PKG_VERSION:=2.4.19
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/v2rayA/v2rayA/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=4799ba0212aa2681f501768d0b54e2bc77668b775e9fb0da4d1fc2a04253c550
+PKG_HASH:=dadf109788454fa10795974e780a0651431f9dfa5d163629766bff4ce36a7b27
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)/service

 PKG_LICENSE:=AGPL-3.0-only
@@ -60,7 +60,7 @@ define Download/v2raya-web
 	URL:=https://github.com/v2rayA/v2rayA/releases/download/v$(PKG_VERSION)/
 	URL_FILE:=web.tar.gz
 	FILE:=$(WEB_FILE)
-	HASH:=df8f9d4dd79eac8ba5edb9ad1d816c11edca757b61cda8dd6f9763a39b76a170
+	HASH:=b194bd1e0242d5e3b18fc60069b6560f924f3c14657ddf80953c098df96735ba
 endef

 define Build/Prepare
Author	SHA1	Message	Date
action	87faec277a	update 2026-09-14 10:58:48	2026-09-14 10:58:48 +08:00
action	d341a782d4	update 2026-09-14 06:01:57	2026-09-14 06:01:57 +08:00
action	205be274cd	update 2026-09-14 02:28:52	2026-09-14 02:28:52 +08:00
action	622dd92021	update 2026-09-13 23:28:56	2026-09-13 23:28:56 +08:00
action	141863e6d4	update 2026-09-13 16:42:22	2026-09-13 16:42:22 +08:00
action	2e55e363ac	update 2026-09-13 10:43:38	2026-09-13 10:43:38 +08:00
action	86d911baf4	update 2026-09-13 05:53:41	2026-09-13 05:53:41 +08:00
action	65075cb38f	update 2026-09-13 02:01:59	2026-09-13 02:01:59 +08:00
action	aff13cf0c6	update 2026-09-12 22:51:39	2026-09-12 22:51:39 +08:00