update 2026-09-14 10:58:48

update 2026-09-14 06:01:57
update 2026-09-14 02:28:52
2026-09-14 12:24:20 +08:00 · 2026-09-14 10:58:48 +08:00 · 2026-09-14 06:01:57 +08:00 · 2026-09-14 02:28:52 +08:00 · 2026-09-13 23:28:56 +08:00 · 2026-09-13 16:42:22 +08:00
183 changed files with 7275 additions and 4482 deletions
@@ -1,8 +1,8 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=clashoo
-PKG_SHORT_SHA:=fd74ecb
-PKG_COMMIT_DATE:=2026.09.05
+PKG_SHORT_SHA:=dca26db
+PKG_COMMIT_DATE:=2026.09.11

 PKG_VERSION:=$(PKG_COMMIT_DATE)~$(PKG_SHORT_SHA)
 PKG_RELEASE:=1
@@ -11,8 +11,8 @@ PKG_SOURCE:=$(PKG_NAME)-alpha-$(PKG_SHORT_SHA).tar.gz
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-alpha-$(PKG_SHORT_SHA)
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-alpha-$(PKG_SHORT_SHA)
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-clashoo/releases/download/mihomo-src
-PKG_SOURCE_VERSION:=fd74ecb6e22bbdba17a4d7441531fea69ee43036
-PKG_HASH:=b88239c01871ba771b1e80caadf247feab42130783f5ab40be0c9fe27a9cc836
+PKG_SOURCE_VERSION:=dca26db017bcde90071f3e16f97b12fafbccfa31
+PKG_HASH:=593e53b3aeb52bbd3f49ddf4ae7773ce340bf2e984a9d5634a6385fa3041b5a2
 PKG_BUILD_VERSION:=alpha-$(PKG_SHORT_SHA)

 PKG_LICENSE:=GPL3.0+
@@ -47,6 +47,9 @@ config clashoo 'config'
 	option fallback_filter_geoip '0'
 	list fallback_filter_ipcidr '240.0.0.0/4'
 	option dns_respect_rules '1'
+	option dns_loopback_compat '0'
+	list dns_loopback_compat_resolver 'udp://223.5.5.5:53'
+	list dns_loopback_compat_resolver 'udp://119.29.29.29:53'
 	option dns_migrated '1'
 	option block_quic '0'
 	option singbox_independent_cache '0'
@@ -790,6 +790,11 @@ _dnsmasq_state_digest() {
 		"$(uci -q get dhcp.@dnsmasq[0].resolvfile 2>/dev/null)"
 }

+_reload_dnsmasq() {
+	/etc/init.d/dnsmasq reload >/dev/null 2>&1 && return 0
+	/etc/init.d/dnsmasq restart >/dev/null 2>&1
+}
+
 revert_dns() {
 #===========================================================================================================================  
 	local _before _after
@@ -803,7 +808,7 @@ revert_dns() {
 		return 0
 	fi
 	uci commit dhcp
-	/etc/init.d/dnsmasq restart >/dev/null 2>&1
+	_reload_dnsmasq >/dev/null 2>&1
 #=========================================================================================================================== 	 
 }

@@ -1040,6 +1045,99 @@ _clashoo_dns_force_fields() {
 	return 0
 }

+_dns_nameserver_inherit_mode() {
+	local has_nameserver marker prefer_h3 respect_false has_proxy force_respect
+	command -v yq >/dev/null 2>&1 || return 0
+	[ -s "$CONFIG_YAML" ] || return 0
+
+	has_nameserver="$(yq -M e '(.dns.nameserver // null) | (tag != "!!null" and length > 0)' "$CONFIG_YAML" 2>/dev/null)"
+	[ "$has_nameserver" = "true" ] || return 0
+
+	marker=0
+	if yq -M e -r '(.dns.nameserver // null) | .. | select(tag == "!!str")' "$CONFIG_YAML" 2>/dev/null |
+		awk '
+		{
+			hash = index($0, "#")
+			if (!hash) next
+			fragment = substr($0, hash + 1)
+			split(fragment, parts, "&")
+			if (parts[1] !~ /=/) { found = 1; exit }
+		}
+		END { exit(found ? 0 : 1) }'; then
+		marker=1
+	fi
+	prefer_h3="$(yq -M e '(.dns."prefer-h3" // false) == true' "$CONFIG_YAML" 2>/dev/null)"
+	respect_false="$(yq -M e '((.dns // {}) | has("respect-rules")) and ((.dns."respect-rules") == false or (.dns."respect-rules") == "false")' "$CONFIG_YAML" 2>/dev/null)"
+	has_proxy="$(yq -M e '(.dns // {}) | has("proxy-server-nameserver")' "$CONFIG_YAML" 2>/dev/null)"
+	force_respect=0
+	case ",${CLASHOO_DNS_FORCE:-}," in
+		*,respect-rules,*) force_respect=1 ;;
+	esac
+
+	# skip suppresses both the generated proxy role and automatic respect-rules.
+	if [ "$marker" = "1" ] ||
+		{ [ "$prefer_h3" = "true" ] && [ "$force_respect" != "1" ]; } ||
+		{ [ "$respect_false" = "true" ] && [ "$force_respect" != "1" ]; } ||
+		[ "$(uci -q get clashoo.config.dns_respect_rules 2>/dev/null)" = "0" ]; then
+		printf '%s' skip
+		return 0
+	fi
+	case ",${CLASHOO_DNS_FORCE:-}," in
+		*,proxy-server-nameserver,*) return 0 ;;
+	esac
+	[ "$has_proxy" = "true" ] && return 0
+	printf '%s' inherit
+}
+
+_adapt_dns_loopback_resolver() {
+	local filter listen host host_pattern old_port servers replacement tmp
+	[ "$(uci -q get clashoo.config.dns_loopback_compat 2>/dev/null)" = "1" ] || return 0
+	command -v yq >/dev/null 2>&1 || return 0
+	[ -s "$CONFIG_YAML" ] || return 0
+
+	filter="${CLASHOO_DNS_LOOPBACK_FILTER:-/usr/share/clashoo/runtime/dns_loopback_adapter.yq}"
+	[ -r "$filter" ] || return 0
+	[ "$(yq -M e '(.dns."proxy-server-nameserver" | type)' "$CONFIG_YAML" 2>/dev/null)" = "!!seq" ] || return 0
+
+	listen="$(yq -M e -r '.dns.listen // ""' "$CONFIG_YAML" 2>/dev/null)"
+	old_port="${listen##*:}"
+	host="${listen%:*}"
+	printf '%s' "$old_port" | grep -Eq '^[0-9]+$' || return 0
+	host="$(printf '%s' "$host" | tr 'A-Z' 'a-z')"
+	case "$host" in
+		""|0.0.0.0|'[::]'|::)
+			host_pattern='(localhost|127(\.[0-9]{1,3}){3}|\[?::1\]?)' ;;
+		localhost)
+			host_pattern='localhost' ;;
+		127.*)
+			printf '%s' "$host" | grep -Eq '^127(\.[0-9]{1,3}){3}$' || return 0
+			host_pattern="$(printf '%s' "$host" | sed 's/\./\\./g')" ;;
+		'[::1]'|::1)
+			host_pattern='\[?::1\]?' ;;
+		*)
+			return 0 ;;
+	esac
+
+	servers="$(yq -M e -r '.dns."proxy-server-nameserver"[]' "$CONFIG_YAML" 2>/dev/null)"
+	printf '%s\n' "$servers" | grep -Eiq "^([A-Za-z][A-Za-z0-9+.-]*://)?(${host_pattern}):${old_port}($|[/#?])" || return 0
+
+	replacement="$(uci -q get clashoo.config.dns_loopback_compat_resolver 2>/dev/null)"
+	[ -n "$replacement" ] || replacement='udp://223.5.5.5:53 udp://119.29.29.29:53'
+	tmp="$(mktemp "${CONFIG_YAML}.dns-loopback.XXXXXX" 2>/dev/null)" || return 0
+	export CLASHOO_DNS_OLD_PORT="$old_port"
+	export CLASHOO_DNS_HOST_PATTERN="$host_pattern"
+	export CLASHOO_DNS_REPLACEMENT="$replacement"
+	if yq -M e --from-file "$filter" "$CONFIG_YAML" > "$tmp" 2>/dev/null &&
+		mv -f "$tmp" "$CONFIG_YAML"; then
+		log_msg "Adapted stale loopback proxy DNS" "已适配失效的回环节点 DNS"
+	else
+		rm -f "$tmp"
+		log_msg "Loopback proxy DNS adaptation failed; preserved source settings" "回环节点 DNS 适配失败，已保留原配置"
+	fi
+	unset CLASHOO_DNS_OLD_PORT CLASHOO_DNS_HOST_PATTERN CLASHOO_DNS_REPLACEMENT
+	return 0
+}
+
 backfill_custom_sniffer_overrides() {
 	[ "$CLASHOO_KEEP_SNIFFER" = "1" ] || return 0
 	[ "$(uci -q get clashoo.config.sniffer_streaming 2>/dev/null)" = "1" ] || return 0
@@ -1062,8 +1160,15 @@ ensure_quic_fallback_guard() {
 yml_change() {
 	CLASHOO_DNS_FORCE="$(_clashoo_dns_force_fields)"
 	CLASHOO_DNS_PRESENT="$(_user_dns_fields "$CLASHOO_DNS_FORCE")"
+	CLASHOO_DNS_INHERIT_MODE="$(_dns_nameserver_inherit_mode)"
+	CLASHOO_DNS_INHERIT_NAMESERVER=""
+	if [ "$CLASHOO_DNS_INHERIT_MODE" = "inherit" ]; then
+		CLASHOO_DNS_INHERIT_NAMESERVER="$(yq -M e -o=json '(.dns.nameserver // [])' "$CONFIG_YAML" 2>/dev/null)"
+	fi
 	export CLASHOO_DNS_FORCE
 	export CLASHOO_DNS_PRESENT
+	export CLASHOO_DNS_INHERIT_MODE
+	export CLASHOO_DNS_INHERIT_NAMESERVER
 	CLASHOO_KEEP_FAKEIP_FILTER=""
 	CLASHOO_KEEP_SNIFFER=""
 	if command -v yq >/dev/null 2>&1 && [ -s "$CONFIG_YAML" ]; then
@@ -1583,8 +1688,7 @@ singbox_dns_change() {
 	fi
 	if [ "$(_dnsmasq_state_digest)" != "$_sb_dns_before" ]; then
 		uci commit dhcp >/dev/null 2>&1
-		/etc/init.d/dnsmasq stop >/dev/null 2>&1
-		/etc/init.d/dnsmasq start >/dev/null 2>&1
+		_reload_dnsmasq >/dev/null 2>&1
 	else
 		uci -q revert dhcp >/dev/null 2>&1
 	fi
@@ -1880,6 +1984,7 @@ _start_prepare_config() {
 	if command -v yq >/dev/null 2>&1 && grep -q '<<[[:space:]]*:' "$CONFIG_YAML" 2>/dev/null; then
 		yq e -i 'explode(.)' "$CONFIG_YAML" 2>/dev/null || true
 	fi
+	_adapt_dns_loopback_resolver >/dev/null 2>&1
 	# stage bundled cn.mrs into the core dir; mihomo rejects rule-set paths outside /etc/clashoo
 	if [ -f /usr/share/clashoo/ruleset/cn.mrs ]; then
 		if [ ! -f /etc/clashoo/ruleset/cn.mrs ] || [ /usr/share/clashoo/ruleset/cn.mrs -nt /etc/clashoo/ruleset/cn.mrs ]; then
@@ -1993,8 +2098,7 @@ _start_launch_core() {

 		if [ "$(_dnsmasq_state_digest)" != "$_dnsmasq_digest_before" ]; then
 			log_msg "Reloading DNS resolver" "重启 DNS 解析"
-			/etc/init.d/dnsmasq stop >/dev/null 2>&1
-			/etc/init.d/dnsmasq start >/dev/null 2>&1
+			_reload_dnsmasq >/dev/null 2>&1
 		fi

 		restore >/dev/null 2>&1
@@ -2041,7 +2145,7 @@ boot(){
 		runtime_state_set "health_status" "starting"
 		runtime_state_set "health_detail" "boot_starting"
 		runtime_state_set "updated_at" "$(date +%s)"
-		# start_service does mihomo -t dry-run + firewall restart + dnsmasq restart
+		# start_service does mihomo -t dry-run + firewall restart + dnsmasq reload/fallback
 		# (~20-30s on LXC). Doing this synchronously in boot() blocks rcS S99 stage
 		# and during that window sshd/uhttpd refuse connections (kex reset). Detach
 		# to background with a small settle delay so the rcS pipeline finishes and
@@ -2283,6 +2387,9 @@ reload_service()
 			-X PUT -d '{"path":"'"$CONFIG_YAML"'"}' \
 			"http://${_lip}:${_dp}/configs?force=true" >/dev/null 2>&1
 		backend_apply_rules 2>/dev/null
+		if [ "$(uci -q get clashoo.config.core_only 2>/dev/null)" != "1" ]; then
+			_reload_dnsmasq >/dev/null 2>&1
+		fi
 		runtime_run_health_check_settle >/dev/null 2>&1
 	fi
 }
@@ -6,12 +6,14 @@ set clashoo_china6 {
 		2001:250::/30,
 		2001:254::/33,
 		2001:255::/32,
+		2001:7fa:5::/48,
 		2001:c68::/32,
 		2001:cc0::/32,
 		2001:da8::/32,
 		2001:daa:1::/48,
 		2001:daa:2::/47,
 		2001:daa:4::/47,
+		2001:daa:6::/48,
 		2001:daa:9::/48,
 		2001:dc7::/45,
 		2001:dc7:9::/48,
@@ -117,7 +119,6 @@ set clashoo_china6 {
 		2400:5280:1400::/38,
 		2400:5280:1c00::/38,
 		2400:5280:3400::/38,
-		2400:5280:4000::/38,
 		2400:5280:4c00::/38,
 		2400:5280:5000::/36,
 		2400:5280:6000::/35,
@@ -757,9 +758,7 @@ set clashoo_china6 {
 		2401:f860:10::/44,
 		2401:f860:20::/43,
 		2401:f860:40::/42,
-		2401:f860:80::/46,
-		2401:f860:84::/48,
-		2401:f860:86::/47,
+		2401:f860:80::/45,
 		2401:f860:89::/48,
 		2401:f860:8a::/47,
 		2401:f860:8c::/46,
@@ -781,7 +780,6 @@ set clashoo_china6 {
 		2401:f860:2000::/35,
 		2401:f860:4000::/34,
 		2401:f860:8000::/33,
-		2401:fa00:40::/48,
 		2401:fa80::/32,
 		2401:fb80::/32,
 		2401:fc60::/32,
@@ -939,6 +937,7 @@ set clashoo_china6 {
 		2402:7140::/32,
 		2402:71c0::/32,
 		2402:7240::/32,
+		2402:72a0::/32,
 		2402:72c0::/32,
 		2402:7540::/32,
 		2402:75c0::/32,
@@ -1458,15 +1457,7 @@ set clashoo_china6 {
 		2404:1880::/32,
 		2404:1c80::/32,
 		2404:1cc0::/32,
-		2404:1d80::/44,
-		2404:1d80:10::/45,
-		2404:1d80:18::/47,
-		2404:1d80:1b::/48,
-		2404:1d80:1c::/46,
-		2404:1d80:20::/43,
-		2404:1d80:40::/42,
-		2404:1d80:80::/41,
-		2404:1d80:100::/40,
+		2404:1d80::/39,
 		2404:1d80:200::/44,
 		2404:1d80:210::/47,
 		2404:1d80:212::/48,
@@ -1765,10 +1756,9 @@ set clashoo_china6 {
 		2405:84c0:8008::/45,
 		2405:84c0:8010::/48,
 		2405:84c0:8019::/48,
-		2405:84c0:801b::/48,
 		2405:84c0:801c::/46,
 		2405:84c0:8020::/47,
-		2405:84c0:8034::/46,
+		2405:84c0:8036::/47,
 		2405:84c0:8038::/46,
 		2405:84c0:803c::/47,
 		2405:84c0:803e::/48,
@@ -1943,7 +1933,13 @@ set clashoo_china6 {
 		2406:840:190::/44,
 		2406:840:1a0::/43,
 		2406:840:1c0::/42,
-		2406:840:200::/41,
+		2406:840:201::/48,
+		2406:840:202::/47,
+		2406:840:204::/46,
+		2406:840:208::/45,
+		2406:840:210::/44,
+		2406:840:220::/43,
+		2406:840:240::/42,
 		2406:840:280::/42,
 		2406:840:2c0::/43,
 		2406:840:2e1::/48,
@@ -1952,7 +1948,6 @@ set clashoo_china6 {
 		2406:840:2e8::/45,
 		2406:840:2f0::/44,
 		2406:840:300::/41,
-		2406:840:381::/48,
 		2406:840:382::/47,
 		2406:840:384::/46,
 		2406:840:388::/45,
@@ -2274,18 +2269,7 @@ set clashoo_china6 {
 		2406:840:9fc0::/43,
 		2406:840:9fe0::/44,
 		2406:840:a000::/35,
-		2406:840:c000::/41,
-		2406:840:c080::/43,
-		2406:840:c0a0::/45,
-		2406:840:c0a9::/48,
-		2406:840:c0aa::/47,
-		2406:840:c0ac::/46,
-		2406:840:c0b0::/44,
-		2406:840:c0c0::/42,
-		2406:840:c100::/40,
-		2406:840:c200::/39,
-		2406:840:c400::/38,
-		2406:840:c800::/37,
+		2406:840:c000::/36,
 		2406:840:e000::/41,
 		2406:840:e090::/44,
 		2406:840:e0a0::/43,
@@ -2294,7 +2278,7 @@ set clashoo_china6 {
 		2406:840:e0cc::/47,
 		2406:840:e0ce::/48,
 		2406:840:e0d0::/44,
-		2406:840:e0e6::/47,
+		2406:840:e0e4::/46,
 		2406:840:e0e9::/48,
 		2406:840:e0ea::/47,
 		2406:840:e0ec::/46,
@@ -2436,14 +2420,7 @@ set clashoo_china6 {
 		2406:840:f120::/43,
 		2406:840:f140::/42,
 		2406:840:f180::/41,
-		2406:840:f201::/48,
-		2406:840:f202::/48,
-		2406:840:f204::/46,
-		2406:840:f208::/45,
-		2406:840:f210::/44,
-		2406:840:f220::/43,
-		2406:840:f240::/42,
-		2406:840:f280::/41,
+		2406:840:f200::/40,
 		2406:840:f300::/43,
 		2406:840:f320::/44,
 		2406:840:f330::/46,
@@ -2527,13 +2504,7 @@ set clashoo_china6 {
 		2406:840:fc68::/45,
 		2406:840:fc74::/46,
 		2406:840:fc78::/45,
-		2406:840:fc80::/48,
-		2406:840:fc82::/48,
-		2406:840:fc84::/48,
-		2406:840:fc86::/48,
-		2406:840:fc88::/46,
-		2406:840:fc8c::/47,
-		2406:840:fc8e::/48,
+		2406:840:fc80::/44,
 		2406:840:fc94::/46,
 		2406:840:fc98::/45,
 		2406:840:fca4::/46,
@@ -2612,19 +2583,17 @@ set clashoo_china6 {
 		2406:840:fe52::/47,
 		2406:840:fe54::/46,
 		2406:840:fe58::/45,
-		2406:840:fe60::/44,
-		2406:840:fe70::/47,
-		2406:840:fe72::/48,
-		2406:840:fe75::/48,
-		2406:840:fe76::/47,
-		2406:840:fe78::/45,
+		2406:840:fe60::/43,
 		2406:840:fe80::/44,
 		2406:840:fe95::/48,
 		2406:840:fe9c::/48,
 		2406:840:fe9f::/48,
 		2406:840:fea0::/48,
 		2406:840:fea9::/48,
-		2406:840:feb0::/44,
+		2406:840:feb0::/47,
+		2406:840:feb2::/48,
+		2406:840:feb4::/46,
+		2406:840:feb8::/45,
 		2406:840:fec1::/48,
 		2406:840:fec6::/47,
 		2406:840:fec8::/47,
@@ -3236,7 +3205,6 @@ set clashoo_china6 {
 		2605:9d80:9042::/48,
 		2605:9d80:9071::/48,
 		2605:9d80:9092::/48,
-		2804:1e48:9001::/48,
 		2804:1e48:9002::/48,
 		2a03:f900::/29,
 		2a04:3e00:1002::/48,
@@ -3301,10 +3269,7 @@ set clashoo_china6 {
 		2a0a:d681:e200::/39,
 		2a0a:d681:e400::/38,
 		2a0a:d681:e800::/37,
-		2a0a:d681:f000::/37,
-		2a0a:d681:f800::/39,
-		2a0a:d681:fa00::/40,
-		2a0a:d681:fd00::/40,
+		2a0a:d681:f000::/36,
 		2a0a:d682::/33,
 		2a0a:d682:8000::/34,
 		2a0a:d682:c000::/36,
@@ -427,7 +427,6 @@ set clashoo_china {
 		43.240.128.0/21,
 		43.240.136.0/22,
 		43.240.156.0/22,
-		43.240.160.0/19,
 		43.240.192.0/19,
 		43.240.240.0/20,
 		43.241.0.0/20,
@@ -1325,7 +1324,7 @@ set clashoo_china {
 		103.36.96.0/22,
 		103.36.132.0/22,
 		103.36.136.0/22,
-		103.36.160.0/19,
+		103.36.160.0/20,
 		103.36.192.0/19,
 		103.36.224.0/20,
 		103.36.240.0/21,
@@ -1630,6 +1629,7 @@ set clashoo_china {
 		103.70.14.0/23,
 		103.70.148.0/22,
 		103.70.224.0/23,
+		103.70.227.0/24,
 		103.70.236.0/22,
 		103.70.252.0/22,
 		103.71.0.0/22,
@@ -1733,6 +1733,7 @@ set clashoo_china {
 		103.81.120.0/22,
 		103.81.148.0/22,
 		103.81.164.0/22,
+		103.81.184.0/23,
 		103.81.200.0/22,
 		103.81.232.0/22,
 		103.82.60.0/22,
@@ -1879,6 +1880,7 @@ set clashoo_china {
 		103.97.144.0/21,
 		103.97.188.0/22,
 		103.97.192.0/22,
+		103.97.229.0/24,
 		103.98.0.0/23,
 		103.98.40.0/21,
 		103.98.48.0/22,
@@ -2964,7 +2966,10 @@ set clashoo_china {
 		110.92.68.0/22,
 		110.93.32.0/19,
 		110.94.0.0/15,
-		110.96.0.0/12,
+		110.96.0.0/15,
+		110.98.0.0/16,
+		110.100.0.0/14,
+		110.104.0.0/13,
 		110.112.0.0/13,
 		110.120.0.0/16,
 		110.121.0.0/22,
@@ -3388,10 +3393,8 @@ set clashoo_china {
 		117.134.0.0/17,
 		117.134.128.0/18,
 		117.134.205.0/24,
-		117.134.206.0/23,
-		117.134.208.0/21,
-		117.134.216.0/22,
-		117.134.220.0/23,
+		117.134.207.0/24,
+		117.134.208.0/20,
 		117.134.232.0/21,
 		117.134.240.0/20,
 		117.135.0.0/16,
@@ -3498,7 +3501,13 @@ set clashoo_china {
 		119.48.0.0/13,
 		119.57.0.0/16,
 		119.58.0.0/16,
-		119.59.128.0/17,
+		119.59.128.0/24,
+		119.59.130.0/24,
+		119.59.132.0/22,
+		119.59.136.0/21,
+		119.59.144.0/20,
+		119.59.160.0/19,
+		119.59.192.0/18,
 		119.60.0.0/15,
 		119.62.0.0/16,
 		119.63.32.0/19,
@@ -3893,6 +3902,7 @@ set clashoo_china {
 		129.211.0.0/16,
 		132.232.0.0/16,
 		132.237.134.0/24,
+		134.49.240.0/22,
 		134.175.0.0/16,
 		137.59.59.0/24,
 		137.59.88.0/22,
@@ -4203,6 +4213,7 @@ set clashoo_china {
 		163.0.0.0/16,
 		163.47.4.0/22,
 		163.52.28.0/23,
+		163.52.76.0/23,
 		163.53.0.0/20,
 		163.53.36.0/22,
 		163.53.40.0/21,
@@ -4339,12 +4350,6 @@ set clashoo_china {
 		180.210.212.0/22,
 		180.212.0.0/15,
 		180.222.224.0/19,
-		180.223.196.0/24,
-		180.223.200.0/22,
-		180.223.212.0/24,
-		180.223.232.0/21,
-		180.223.240.0/21,
-		180.223.252.0/22,
 		180.233.0.0/18,
 		180.233.64.0/19,
 		180.233.144.0/22,
@@ -4416,14 +4421,14 @@ set clashoo_china {
 		183.182.12.0/22,
 		183.182.16.0/23,
 		183.182.23.0/24,
-		183.182.24.0/23,
-		183.182.26.0/24,
-		183.182.28.0/22,
+		183.182.24.0/21,
 		183.184.0.0/13,
 		183.192.0.0/10,
+		185.2.48.0/24,
 		185.2.51.0/24,
 		185.75.173.0/24,
 		185.75.174.0/24,
+		185.192.56.0/22,
 		188.131.128.0/17,
 		192.51.172.0/23,
 		192.55.46.0/23,
@@ -4654,7 +4659,9 @@ set clashoo_china {
 		202.55.4.0/24,
 		202.55.18.0/23,
 		202.55.20.0/22,
-		202.55.24.0/21,
+		202.55.24.0/22,
+		202.55.28.0/23,
+		202.55.31.0/24,
 		202.57.192.0/20,
 		202.57.212.0/22,
 		202.57.216.0/22,
@@ -4789,9 +4796,7 @@ set clashoo_china {
 		202.130.39.0/24,
 		202.130.224.0/19,
 		202.131.16.0/21,
-		202.131.48.0/22,
-		202.131.54.0/23,
-		202.131.56.0/21,
+		202.131.48.0/20,
 		202.131.208.0/20,
 		202.133.32.0/20,
 		202.134.58.0/24,
@@ -4815,6 +4820,8 @@ set clashoo_china {
 		202.143.56.0/21,
 		202.143.100.0/22,
 		202.143.104.0/22,
+		202.144.196.0/23,
+		202.144.198.0/24,
 		202.146.160.0/20,
 		202.146.184.0/23,
 		202.146.186.0/24,
@@ -5021,7 +5028,6 @@ set clashoo_china {
 		203.8.8.0/24,
 		203.8.23.0/24,
 		203.8.25.0/24,
-		203.8.30.0/24,
 		203.8.70.0/24,
 		203.8.82.0/24,
 		203.8.86.0/23,
@@ -5949,6 +5955,7 @@ set clashoo_china {
 		203.223.16.0/24,
 		203.223.21.0/24,
 		203.223.22.0/23,
+		206.109.70.0/23,
 		206.109.75.0/24,
 		210.2.0.0/19,
 		210.5.0.0/19,
@@ -5971,8 +5978,6 @@ set clashoo_china {
 		210.26.0.0/15,
 		210.28.0.0/14,
 		210.32.0.0/12,
-		210.48.140.0/23,
-		210.48.142.0/24,
 		210.51.0.0/16,
 		210.52.0.0/15,
 		210.56.192.0/19,
@@ -6043,7 +6048,9 @@ set clashoo_china {
 		218.24.0.0/14,
 		218.28.0.0/15,
 		218.30.0.0/19,
-		218.30.32.0/21,
+		218.30.32.0/22,
+		218.30.36.0/23,
+		218.30.38.0/24,
 		218.30.40.0/22,
 		218.30.45.0/24,
 		218.30.46.0/23,
@@ -6154,7 +6161,6 @@ set clashoo_china {
 		221.128.224.0/21,
 		221.128.232.0/22,
 		221.128.238.0/23,
-		221.128.244.0/22,
 		221.129.0.0/16,
 		221.130.0.0/15,
 		221.133.224.0/19,
@@ -0,0 +1,17 @@
+. as $document |
+strenv(CLASHOO_DNS_OLD_PORT) as $old_port |
+strenv(CLASHOO_DNS_HOST_PATTERN) as $host_pattern |
+(strenv(CLASHOO_DNS_REPLACEMENT) | split(" ") | map(select(length > 0))) as $replacement |
+("(?i)^(?:[a-z][a-z0-9+.-]*://)?(?:" + $host_pattern + "):" + $old_port + "(?:$|[/#?])") as $old_loopback |
+(
+  $document |
+  select((.dns."proxy-server-nameserver" | type) == "!!seq") |
+  ([.dns."proxy-server-nameserver"[] | select(type == "!!str" and test($old_loopback))] | length) as $match_count |
+  select($match_count > 0) |
+  .dns."proxy-server-nameserver" =
+    ([
+      .dns."proxy-server-nameserver"[] |
+      select((type == "!!str" and test($old_loopback)) | not) |
+      select(. as $server | ($replacement | contains([$server])) | not)
+    ] + $replacement)
+) // $document
@@ -12,10 +12,13 @@ trap 'rm -f "$CUSTOM_RULE_FILE" "$RULE" "$CLASH" "$CLASH_CONFIG"' EXIT

 [ -f "$CONFIG_YAML" ] || exit 0

+. /usr/share/clashoo/runtime/primary_group.sh
+

 # __PROXY__ placeholder -> primary proxy group (cached by RPC);
 # fallback to GLOBAL (built-in mihomo group)
-PRIMARY_GROUP="$(uci -q get clashoo.config.primary_proxy_group)"
+CACHED_PRIMARY_GROUP="$(uci -q get clashoo.config.primary_proxy_group)"
+PRIMARY_GROUP="$(clashoo_resolve_primary_group "$CONFIG_YAML" "$CACHED_PRIMARY_GROUP")"
 [ -n "$PRIMARY_GROUP" ] || PRIMARY_GROUP="GLOBAL"

 append=$(uci get clashoo.config.append_rules 2>/dev/null)
@@ -119,6 +119,14 @@ for (let f in split(s(getenv('CLASHOO_DNS_PRESENT'), ''), ','))
 let dns_force = {};
 for (let f in split(s(getenv('CLASHOO_DNS_FORCE'), ''), ','))
 	if (length(trim(f))) dns_force[trim(f)] = true;
+let dns_inherit_mode = s(getenv('CLASHOO_DNS_INHERIT_MODE'), '');
+let inherited_nameserver = json(s(getenv('CLASHOO_DNS_INHERIT_NAMESERVER'), '[]'));
+if (type(inherited_nameserver) != 'array') {
+	if (inherited_nameserver != null && inherited_nameserver != '')
+		inherited_nameserver = [inherited_nameserver];
+	else
+		inherited_nameserver = [];
+}
 let dns_role_fields = ['nameserver', 'proxy-server-nameserver', 'direct-nameserver',
 	'default-nameserver', 'nameserver-policy', 'respect-rules'];
 let had_user_dns_roles = false;
@@ -158,8 +166,15 @@ uci.foreach('clashoo', 'dnsservers', function(sec) {
 	if (!dns_roles[role]) dns_roles[role] = [];
 	push(dns_roles[role], srv);
 });
-for (let role in keys(dns_roles))
+for (let role in keys(dns_roles)) {
+	if (role == 'proxy-server-nameserver' && (dns_inherit_mode == 'inherit' || dns_inherit_mode == 'skip') &&
+		!dns_present[role] && !dns_force[role]) continue;
 	if (!dns_present[role] || dns_force[role]) cfg['dns'][role] = dns_roles[role];
+}
+
+if (dns_inherit_mode == 'inherit' && length(inherited_nameserver) &&
+	!dns_present['proxy-server-nameserver'] && !dns_force['proxy-server-nameserver'])
+	cfg['dns']['proxy-server-nameserver'] = inherited_nameserver;

 let bootstrap = a('default_nameserver');
 if (bootstrap == null) bootstrap = a('defaul_nameserver');
@@ -182,8 +197,10 @@ if (length(keys(policies)) && (!dns_present['nameserver-policy'] || dns_force['n
 	cfg['dns']['nameserver-policy'] = policies;

 let respect_rules = a('dns_respect_rules') == null ? true : ab('dns_respect_rules');
-if (respect_rules && length(cfg['dns']['proxy-server-nameserver'] || [])
-    && (!dns_present['respect-rules'] || dns_force['respect-rules']) && !dns_present['prefer-h3'])
+if (dns_force['respect-rules'])
+	cfg['dns']['respect-rules'] = respect_rules;
+else if (respect_rules && length(cfg['dns']['proxy-server-nameserver'] || [])
+    && !dns_present['respect-rules'] && !dns_present['prefer-h3'])
 	cfg['dns']['respect-rules'] = true;

 /* profile */
@@ -0,0 +1,49 @@
+#!/bin/sh
+
+clashoo_resolve_primary_group() {
+	local config_yaml="$1"
+	local cached_group="$2"
+	local group_rows
+	local resolved_group
+
+	if [ "$cached_group" = "GLOBAL" ]; then
+		printf '%s\n' "GLOBAL"
+		return 0
+	fi
+
+	if [ ! -f "$config_yaml" ] || ! command -v yq >/dev/null 2>&1; then
+		printf '%s\n' "GLOBAL"
+		return 0
+	fi
+
+	group_rows="$(yq -M e -r '(."proxy-groups" // [])[] | [.name, .type] | @tsv' "$config_yaml" 2>/dev/null)" || {
+		printf '%s\n' "GLOBAL"
+		return 0
+	}
+
+	if [ -n "$cached_group" ] && printf '%s\n' "$group_rows" |
+		awk -F '\t' -v wanted="$cached_group" '$1 == wanted { found = 1; exit } END { exit !found }'
+	then
+		printf '%s\n' "$cached_group"
+		return 0
+	fi
+
+	resolved_group="$(printf '%s\n' "$group_rows" | awk -F '\t' '
+		tolower($2) == "select" &&
+		(index($1, "节点选择") || index($1, "代理") || index($1, "🚀") || tolower($1) ~ /proxy/) {
+			print $1
+			exit
+		}
+	')"
+
+	if [ -z "$resolved_group" ]; then
+		resolved_group="$(printf '%s\n' "$group_rows" | awk -F '\t' '
+			tolower($2) == "select" {
+				print $1
+				exit
+			}
+		')"
+	fi
+
+	printf '%s\n' "${resolved_group:-GLOBAL}"
+}
@@ -301,9 +301,10 @@ package_version_from_url() {
  case "$file" in
    clashoo_*_"$ARCH".ipk)
      v="${file#clashoo_}"
-      printf '%s\n' "${v%_${ARCH}.ipk}"
+      v="${v%_${ARCH}.ipk}"
+      printf '%s\n' "$v" | sed 's/^\([0-9][0-9][0-9][0-9]\.[0-9][0-9]*\.[0-9][0-9]*\)\./\1~/'
      ;;
-    clashoo_*.ipk) printf '%s\n' "$file" | sed -n 's/^clashoo_\(.*\)_[^_][^_]*\.ipk$/\1/p' ;;
+    clashoo_*.ipk) printf '%s\n' "$file" | sed -n 's/^clashoo_\(.*\)_[^_][^_]*\.ipk$/\1/p' | sed 's/^\([0-9][0-9][0-9][0-9]\.[0-9][0-9]*\.[0-9][0-9]*\)\./\1~/' ;;
    luci-app-clashoo_*.ipk) printf '%s\n' "$file" | sed -n 's/^luci-app-clashoo_\(.*\)_all\.ipk$/\1/p' ;;
    luci-i18n-clashoo-zh-cn_*.ipk) printf '%s\n' "$file" | sed -n 's/^luci-i18n-clashoo-zh-cn_\(.*\)_all\.ipk$/\1/p' ;;
    clashoo-*.apk)
@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=dae
-PKG_VERSION:=2026.08.28
-PKG_RELEASE:=4
+PKG_VERSION:=2026.09.12
+PKG_RELEASE:=1

-PKG_SOURCE:=dae-src-2026.08.28-d6aca8a10b35.tar.gz
+PKG_SOURCE:=dae-src-2026.09.12-187058462a1f.tar.gz
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-daede/releases/download/dae-src
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_HASH:=d6aca8a10b3549d28ff29979793fc0e074f183957f516a17b50d6f3961730c30
+PKG_HASH:=187058462a1fd9eeb9885f4971ccf4bc81358533e71730d8509bd7968624c1c7

 PKG_LICENSE:=AGPL-3.0-only
 PKG_LICENSE_FILE:=LICENSE
@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=daed
-PKG_VERSION:=2026.08.28
-PKG_RELEASE:=4
+PKG_VERSION:=2026.09.12
+PKG_RELEASE:=1

-PKG_SOURCE:=daed-src-2026.08.28-73f01b995c34.tar.gz
+PKG_SOURCE:=daed-src-2026.09.12-a0181f729855.tar.gz
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-daede/releases/download/daed-src
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_HASH:=73f01b995c341586fdf7ab6ee8ed7a4cb52b59fd913ca75b1e61b3ecb6c9a350
+PKG_HASH:=a0181f7298552497ed193e683a54b1df77f2d5441524d61989f3e3e3cf6eac51

 PKG_LICENSE:=AGPL-3.0-only MIT
 PKG_LICENSE_FILES:=LICENSE wing/LICENSE
@@ -1,8 +1,65 @@
 #!/bin/sh
+# daed-cleanup.sh — reaper for stale daed kernel state.
+#
+# Removes:
+#   1. Processes inside the `daens` netns (SIGTERM, then SIGKILL after 1s)
+#   2. The `daens` network namespace itself (ip netns del, with
+#      umount+rm as fallback for zombie nsfs mounts)
+#   3. The `dae0` veth pair in the host netns
+#
+# daed itself owns TC clsact detach. This opkg-side helper only
+# reaps stale daens/dae0 state and never removes /sys/fs/bpf/daed.
+# The pin directory is created during normal startup, so it is not
+# a reliable leak indicator and must not block service lifecycle.
+#
+# The function stays sourceable by both init.d/daed and daed-guard.
+
+daed_process_probe() {
+	if command -v pgrep >/dev/null 2>&1; then
+		pgrep -f '^/usr/bin/daed([[:space:]]|$)' >/dev/null 2>&1
+		case "$?" in
+			0) return 0 ;;
+			1) return 1 ;;
+		esac
+	fi
+
+	if command -v pidof >/dev/null 2>&1; then
+		pidof daed >/dev/null 2>&1
+		case "$?" in
+			0) return 0 ;;
+			1) return 1 ;;
+		esac
+	fi
+
+	return 2
+}

 daed_cleanup_runtime() {
-	local pid
+	local pid rc=0 probe_rc

+	# If daed userspace is currently running, do not touch the
+	# netns, the veth, or the eBPF dataplane. They are in active
+	# use; removing them would make every connection through dae
+	# hang.
+	daed_process_probe
+	probe_rc=$?
+	case "$probe_rc" in
+	0)
+		if [ "${DAED_GUARD_CLEANUP:-start}" = "start" ]; then
+			logger -t daed-init "cleanup: pre-start skipped because /usr/bin/daed is still running; refusing a second instance"
+			return 1
+		fi
+		logger -t daed-init "cleanup: post-exit skipped because another /usr/bin/daed instance is still running"
+		return 0
+		;;
+	1) ;;
+	*)
+		logger -t daed-init "cleanup: cannot determine whether daed is running; refusing to remove netns/veth"
+		return 1
+		;;
+	esac
+
+	# 1. Kill processes inside daens.
 	for pid in $(ip netns pids daens 2>/dev/null); do
 		kill "$pid" 2>/dev/null
 	done
@@ -14,14 +71,36 @@ daed_cleanup_runtime() {
 		done
 	fi

+	# 2. Remove the daens netns. ip netns del can fail if a
+	#    process still references it via /proc/<pid>/ns/net or
+	#    because the umount has already happened. Try the
+	#    umount/rm fallback.
 	if ! ip netns del daens 2>/dev/null; then
 		umount -l /run/netns/daens 2>/dev/null
-		rm -f /run/netns/daens
+		if [ -e /run/netns/daens ] && ! rm -f /run/netns/daens 2>/dev/null; then
+			logger -t daed-init "cleanup: failed to remove /run/netns/daens (resource busy); a reboot may be required"
+			rc=1
+		fi
 	fi

-	ip link del dae0 2>/dev/null || true
+	# 3. Remove the dae0 veth pair.
+	if ip link show dae0 >/dev/null 2>&1; then
+		if ! ip link del dae0 2>/dev/null; then
+			logger -t daed-init "cleanup: failed to remove dae0 veth pair"
+			rc=1
+		fi
+	fi

+	# 4. The pin root is normal persistent state. Never remove it or
+	#    make its existence change the cleanup result.
+	if [ -e /sys/fs/bpf/daed ]; then
+		logger -t daed-init "cleanup: /sys/fs/bpf/daed exists; leaving normal pin root unchanged"
+	fi
+
+	# Final verification covers only netns and veth state.
 	[ ! -e /run/netns/daens ] || return 1
-	! ip netns list 2>/dev/null | awk '$1 == "daens" { found=1 } END { exit !found }' || return 1
+	! ip netns list 2>/dev/null | grep -Eq '^daens([[:space:]]|$)' || return 1
 	! ip link show dae0 >/dev/null 2>&1 || return 1
+
+	return $rc
 }
@@ -1,29 +1,131 @@
 #!/bin/sh
+# Keep daed as a child so signals can be forwarded and stale netns/veth
+# state can be cleaned before start and after exit. daed owns TC detach;
+# /sys/fs/bpf/daed is normal persistent state and is never removed here.

 . /usr/share/daed/cleanup.sh

+# Pre-start cleanup refuses to remove runtime state while another
+# daed instance is active, and fails closed if that probe is broken.
+DAED_GUARD_CLEANUP=start
 if ! daed_cleanup_runtime; then
-	echo "daed: stale network state could not be removed" >&2
+	echo "daed: stale /usr/bin/daed or netns state could not be verified or removed; refusing to start. Check process and netns state." >&2
+	logger -t daed-init "pre-start cleanup failed: refusing to start daed"
 	exit 1
 fi

-# Keep daed as a child so a panic or unexpected exit is followed by an
-# immediate teardown of all kernel/runtime state before procd can respawn us.
+# Keep daed as a child so post-exit cleanup runs before procd can
+# respawn it.
 child_pid=
-cleanup_child() {
-	[ -n "$child_pid" ] && kill "$child_pid" 2>/dev/null
+pending_signal=
+shutdown_signal=
+shutdown_elapsed=0
+forced_kill=0
+child_term_timeout=20
+
+forward_signal() {
+	local sig="$1"
+	if [ -z "$child_pid" ]; then
+		pending_signal="$sig"
+		logger -t daed-init "signal $sig received before daed child started; launch cancelled"
+		return 0
+	fi
+	case "$sig" in
+		TERM|INT|QUIT)
+			if [ -z "$shutdown_signal" ]; then
+				shutdown_signal="$sig"
+				shutdown_elapsed=0
+			fi
+			;;
+	esac
+	kill -"$sig" "$child_pid" 2>/dev/null
 }
-trap cleanup_child TERM INT

-/usr/bin/daed "$@" &
-child_pid=$!
-wait "$child_pid"
-status=$?
-child_pid=
-trap - TERM INT
+exit_with_signal() {
+	local sig="$1"
+	trap - TERM INT HUP QUIT
+	kill -"$sig" "$$" 2>/dev/null
+	exit 1
+}

-if ! daed_cleanup_runtime; then
-	echo "daed: runtime cleanup after exit failed" >&2
-	status=1
+child_is_running() {
+	local state
+	kill -0 "$child_pid" 2>/dev/null || return 1
+	state=$(awk '{ print $3 }' "/proc/$child_pid/stat" 2>/dev/null)
+	[ "$state" != "Z" ]
+}
+trap 'forward_signal TERM' TERM
+trap 'forward_signal INT' INT
+trap 'forward_signal HUP' HUP
+trap 'forward_signal QUIT' QUIT
+
+start_child() {
+	local sig
+	# Keep this check inside the function as well as at the call site:
+	# it closes the ordinary pre-start window, while the pending-signal
+	# path below handles a signal arriving during the background fork.
+	[ -z "$pending_signal" ] || return 125
+	/usr/bin/daed "$@" &
+	child_pid=$!
+	if [ -n "$pending_signal" ]; then
+		sig="$pending_signal"
+		pending_signal=
+		forward_signal "$sig"
+	fi
+}
+
+if [ -n "$pending_signal" ]; then
+	logger -t daed-init "refusing to start daed after pending signal $pending_signal"
+	exit_with_signal "$pending_signal"
 fi
-exit "$status"
+
+# Best-effort OOM preference; failure must not block startup.
+if ! echo -16 > /proc/self/oom_score_adj 2>/dev/null; then
+	logger -t daed-init "warn: failed to set /proc/self/oom_score_adj; continuing without OOM preference"
+fi
+if ! start_child "$@"; then
+	logger -t daed-init "refusing to start daed after pending signal $pending_signal"
+	if [ -n "$pending_signal" ]; then
+		exit_with_signal "$pending_signal"
+	fi
+	exit 1
+fi
+status=0
+reaped=0
+while [ "$reaped" -eq 0 ]; do
+	if [ -n "$shutdown_signal" ] && child_is_running; then
+		if [ "$shutdown_elapsed" -ge "$child_term_timeout" ]; then
+			if [ "$forced_kill" -eq 0 ]; then
+				logger -t daed-init "daed did not exit within ${child_term_timeout}s after $shutdown_signal; sending KILL"
+				kill -KILL "$child_pid" 2>/dev/null
+				forced_kill=1
+			fi
+		else
+			sleep 1
+			shutdown_elapsed=$((shutdown_elapsed + 1))
+			continue
+		fi
+		sleep 1
+		continue
+	fi
+	wait "$child_pid" 2>/dev/null
+	status=$?
+	if ! child_is_running; then
+		reaped=1
+	fi
+done
+child_pid=
+trap - TERM INT HUP QUIT
+
+# Post-exit cleanup runs after the child is reaped.
+DAED_GUARD_CLEANUP=post-exit
+cleanup_status=0
+daed_cleanup_runtime || cleanup_status=$?
+if [ "$cleanup_status" -ne 0 ]; then
+	echo "daed: runtime cleanup after exit failed" >&2
+	logger -t daed-init "post-exit cleanup failed; check ip netns / ip link show"
+fi
+if [ "$status" -ne 0 ]; then
+	exit "$status"
+fi
+exit "$cleanup_status"
@@ -1,5 +1,7 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2023 Tianling Shen <cnsztl@immortalwrt.org>
+# daed-guard handles bounded child shutdown and post-exit netns/veth cleanup.
+# Keep the log file and a pre-stop state snapshot for diagnostics.

 USE_PROCD=1
 START=99
@@ -10,18 +12,28 @@ LOG="/var/log/daed/daed.log"

 . /usr/share/daed/cleanup.sh

+log() {
+	logger -t daed-init "$@"
+}
+
 start_service() {
+	log "start: begin"
 	config_load "$CONF"

 	local enabled
 	config_get_bool enabled "config" "enabled" "0"
-	[ "$enabled" -eq "1" ] || return 1
+	if [ "$enabled" -ne "1" ]; then
+		log "start: config disabled, exit"
+		return 1
+	fi

 	local listen_addr log_maxbackups log_maxsize
 	config_get listen_addr "config" "listen_addr" "0.0.0.0:2023"
 	config_get log_maxbackups "config" "log_maxbackups" "1"
 	config_get log_maxsize "config" "log_maxsize" "5"

+	log "start: listen=$listen_addr log_maxbackups=$log_maxbackups log_maxsize=$log_maxsize"
+
 	procd_open_instance "$CONF"
 	procd_set_param env DAE_LOCATION_ASSET="/usr/share/v2ray" TZ="$(uci -q get system.@system[0].zonename)"
 	procd_set_param command "$PROG" run
@@ -33,25 +45,37 @@ start_service() {

 	procd_set_param limits core="unlimited"
 	procd_set_param limits nofile="1000000 1000000"
-	# Avoid an endless crash/respawn loop which can repeatedly reattach dae's
-	# data-plane hooks and make the router management plane unreachable.
-	procd_set_param respawn 3600 5 5
+	# daed-guard escalates its child after 20 seconds. Leave time for
+	# reap and post-exit cleanup before procd kills the wrapper.
+	procd_set_param term_timeout 30
+	# procd_set_param respawn: arguments are (threshold, timeout, retry).
+	#   threshold = runtime that resets the short-lived exit counter
+	#   timeout   = seconds to wait between retries
+	#   retry     = maximum short-lived exits before procd gives up
+	# Reset the counter after one hour of stable runtime; otherwise retry
+	# after 5 seconds and stop after 10 failures.
+	procd_set_param respawn 3600 5 10
+	# daed-guard sets oom_score_adj before forking; procd has no
+	# oom_adj/oom_score_adj parameter.
 	# procd_set_param stdout 1
 	procd_set_param stderr 1

 	procd_close_instance
+	log "start: procd_open_instance done"
 }

 stop_service() {
-	rm -f "$LOG"
-	daed_cleanup_runtime
-}
-
-restart() {
-	stop
-	sleep 1
-	daed_cleanup_runtime
-	start
+	log "stop: begin"
+	# Cleanup runs in daed-guard after its child exits. Record only a
+	# pre-stop snapshot here; pin entries do not prove TC attachment.
+	local pinned="" ns_left=""
+	if [ -d /sys/fs/bpf/daed ]; then
+		pinned=$(ls /sys/fs/bpf/daed 2>/dev/null | tr '\n' ' ')
+	fi
+	if ip netns list 2>/dev/null | grep -q '^daens'; then
+		ns_left="daens"
+	fi
+	log "stop: pre-stop state — bpf_pin_entries=[${pinned:-none}] netns_left=[${ns_left:-none}]"
 }

 service_triggers() {
@@ -1,8 +1,6 @@
 # SPDX-License-Identifier: GPL-3.0-only
 #
-# Copyright (C) 2021-2023  sirpdboy  <herboy2008@gmail.com>
-# 
-# This is free software, licensed under the Apache License, Version 2.0 .
+# Copyright (C) 2021-2026 sirpdboy  <herboy2008@gmail.com>
 #

 include $(TOPDIR)/rules.mk
@@ -10,12 +8,12 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=ddns-go
 PKG_VERSION:=6.17.7
 PKG_RELEASE:=1
-
+PKG_VERSION:=6.17.7
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/jeessy2/ddns-go/tar.gz/v$(PKG_VERSION)?
 PKG_HASH:=f7001004e092d9641aad5a94158e0b4cae4a53a7f5c7d96d5c6af3d246c56fcc

-PKG_LICENSE:=MIT
+PKG_HASH:=f7001004e092d9641aad5a94158e0b4cae4a53a7f5c7d96d5c6af3d246c56fcc
 PKG_LICENSE_FILES:=LICENSE
 PKG_MAINTAINER:=Tianling Shen <cnsztl@immortalwrt.org>

@@ -44,14 +42,18 @@ define Package/ddns-go/description
  support Alidns Dnspod Cloudflare Hicloud Callback Baiducloud porkbun GoDaddy Google Domains.
 endef

+define Package/ddns-go/conffiles
+/etc/config/ddns-go
+/etc/ddns-go/ddns-go-config.yaml
+endef
+
 define Package/ddns-go/install
 	$(call GoPackage/Package/Install/Bin,$(1))

 	$(INSTALL_DIR) $(1)/etc/init.d
-	$(INSTALL_BIN) $(CURDIR)/file/ddns-go.init $(1)/etc/init.d/ddns-go
-
-	$(INSTALL_DIR) $(1)/etc/uci-defaults
-	$(INSTALL_BIN) $(CURDIR)/file/luci-ddns-go.uci-default $(1)/etc/uci-defaults/luci-ddns-go
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_BIN) $(CURDIR)/files/ddns-go.init $(1)/etc/init.d/ddns-go
+	$(INSTALL_CONF) $(CURDIR)/files/ddns-go.conf $(1)/etc/config/ddns-go
 endef

 $(eval $(call GoBinPackage,ddns-go))
@@ -1,46 +0,0 @@
-#!/bin/sh /etc/rc.common
-#
-# Copyright (C) 2021-2023  sirpdboy  <herboy2008@gmail.com> https://github.com/sirpdboy/luci-app-ddns-go 
-#
-# This file is part of ddns-go .
-# 
-# This is free software, licensed under the Apache License, Version 2.0 .
-#
-
-
-START=99
-USE_PROCD=1
-
-PROG=/usr/bin/ddns-go
-CONFDIR=/etc/ddns-go
-CONF=$CONFDIR/ddns-go-config.yaml
-
-get_config() {
-        config_get_bool enabled $1 enabled 1
-	config_get_bool logger $1 logger 1
-	config_get port $1 port 9876
-	config_get time $1 time 300
-}
-
-init_yaml(){
-	[ -d $CONFDIR ] || mkdir -p $CONFDIR 2>/dev/null
-	cat /usr/share/ddns-go/ddns-go-default.yaml  > $CONF
-}
-
-start_service() {
-	config_load ddns-go
-        config_foreach get_config basic
-	[ x$enabled == x1 ] || return 1
-	[ -s ${CONF} ] || init_yaml
-	logger -t ddns-go -p warn "ddns-go is start."
-	echo "ddns-go is start."
-	procd_open_instance
-	procd_set_param command $PROG -l :$port -f $time -c "$CONF"
-	[ "x$logger" == x1 ] && procd_set_param stderr 1
-	procd_set_param respawn
-	procd_close_instance
-}
-
-service_triggers() {
-      procd_add_reload_trigger "ddns-go"
-}
@@ -1,7 +0,0 @@
-#!/bin/sh
-
-[ -s "/etc/ddns-go/localtime" ] && mv -f /etc/ddns-go/localtime /etc/localtime
-/etc/init.d/ddns-go enable
-/etc/init.d/ddns-go start
-rm -f /tmp/luci*
-exit 0
@@ -0,0 +1,9 @@
+config basic 'config'
+	option enabled '0'
+	option logger '1'
+	option port '9876'
+	option time '300'
+	option ctimes '5'
+	option skipverify '0'
+	option delay '0'
+	option dns '223.5.5.5'
@@ -0,0 +1,85 @@
+#!/bin/sh /etc/rc.common
+#
+# Copyright (C) 2021-2026  sirpdboy  <herboy2008@gmail.com>
+#
+# This file is part of ddns-go .
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+START=99
+USE_PROCD=1
+NAME=ddns-go
+PROG=/usr/bin/ddns-go
+CONFDIR=/etc/ddns-go
+CONF=$CONFDIR/ddns-go-config.yaml
+
+init_yaml() {
+	[ -d "$CONFDIR" ] || mkdir -p "$CONFDIR"
+	chown -R ddns-go:ddns-go "$CONFDIR"
+	chmod 755 "$CONFDIR"
+	[ -f "$CONF" ] && chmod 644 "$CONF"
+}
+
+build_args() {
+	local cfg="$1"
+	local args="-c $CONF"
+
+	config_get port "$cfg" port '9876'
+	args="$args -l :$port"
+
+	config_get time "$cfg" time '300'
+	[ -n "$time" ] && args="$args -f $time"
+
+	config_get ctimes "$cfg" ctimes '5'
+	[ -n "$ctimes" ] && args="$args -cacheTimes $ctimes"
+
+	config_get dns "$cfg" dns '223.5.5.5'
+	[ -n "$dns" ] && args="$args -dns $dns"
+
+	config_get_bool noweb "$cfg" noweb 0
+	[ "$noweb" -eq 1 ] && args="$args -noweb"
+
+	config_get_bool skipverify "$cfg" skipverify 0
+	[ "$skipverify" -eq 1 ] && args="$args -skipVerify"
+
+	echo "$args"
+}
+
+start_instance() {
+	local cfg="$1"
+	local logger
+	config_get_bool enabled "$cfg" enabled 0
+	[ "$enabled" -eq 0 ] && return 0
+
+	config_get delay "$cfg" delay 0
+	if [ "$delay" -gt 0 ]; then
+		local uptime=$(awk -F. '{print $1}' /proc/uptime)
+		[ "$uptime" -lt 120 ] && sleep "$delay"
+	fi
+
+	init_yaml
+
+	local args=$(build_args "$cfg")
+
+	procd_open_instance
+	procd_set_param command $PROG $args
+
+	config_get_bool logger "$cfg" logger 1
+	procd_set_param stdout "$logger"
+	procd_set_param stderr "$logger"
+
+	procd_set_param user ddns-go
+	procd_set_param respawn
+
+	procd_close_instance
+}
+
+start_service() {
+	config_load "$NAME"
+	config_foreach start_instance 'basic'
+}
+
+service_triggers() {
+	procd_add_reload_trigger "$NAME"
+}
@@ -9,9 +9,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://gn.googlesource.com/gn.git
-PKG_SOURCE_DATE:=2026-09-03
-PKG_SOURCE_VERSION:=4f6a76b64b8279e98004f541f8e136307efe5e01
-PKG_MIRROR_HASH:=933dc8c8d745923437c9e730ab7c2a23a53562144513a4f634ad10381c23be44
+PKG_SOURCE_DATE:=2026-09-11
+PKG_SOURCE_VERSION:=cfcd774b98f3433e18b722f9a7ff06119825b8eb
+PKG_MIRROR_HASH:=d8bea9ac89f9e87f36874601588f0d8d32221bf1ad8488f2fd9775abcddf4860

 PKG_LICENSE:=BSD 3-Clause
 PKG_LICENSE_FILES:=LICENSE
@@ -3,7 +3,7 @@
 #ifndef OUT_LAST_COMMIT_POSITION_H_
 #define OUT_LAST_COMMIT_POSITION_H_

-#define LAST_COMMIT_POSITION_NUM 2553
-#define LAST_COMMIT_POSITION "2553 (4f6a76b64b82)"
+#define LAST_COMMIT_POSITION_NUM 2563
+#define LAST_COMMIT_POSITION "2563 (cfcd774b98f3)"

 #endif  // OUT_LAST_COMMIT_POSITION_H_
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=automount
 PKG_VERSION:=1
-PKG_RELEASE:=40
+PKG_RELEASE:=41
 PKG_ARCH:=all

 include $(INCLUDE_DIR)/package.mk
@@ -6,6 +6,9 @@
 blkdev=`dirname $DEVPATH`
 basename=`basename $blkdev`
 device=`basename $DEVPATH`
+
+grep -qs "^/dev/$device " /proc/mounts && exit 0
+
 skip=`block info | grep -vE '(f2fs|kernel|squashfs)' | sed 's/\(.*\): .*/\1/' | grep -q $device ; echo $?`
 path=$DEVPATH

@@ -1,57 +0,0 @@
-#
-# Copyright (C) 2010-2011 OpenWrt.org
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=autosamba
-PKG_VERSION:=1
-PKG_RELEASE:=15
-PKG_ARCH:=all
-
-PKG_CONFIG_DEPENDS:= \
-	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_KSMBD \
-	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_SAMBA3 \
-	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_SAMBA4 \
-
-include $(INCLUDE_DIR)/package.mk
-
-define Package/autosamba
-  TITLE:=Samba autoconfig hotplug script.
-  MAINTAINER:=Lean
-  DEPENDS:=+wsdd2 +PACKAGE_$(PKG_NAME)_INCLUDE_KSMBD:luci-app-ksmbd +PACKAGE_$(PKG_NAME)_INCLUDE_SAMBA3:luci-app-samba +PACKAGE_$(PKG_NAME)_INCLUDE_SAMBA4:luci-app-samba4 
-endef
-
-define Package/autosamba/description
-A hotplug script to config Samba share automatically.
-endef
-
-define Package/$(PKG_NAME)/config
-choice
-	prompt "Samba Server Selection"
-	default PACKAGE_$(PKG_NAME)_INCLUDE_KSMBD
-	
-	config PACKAGE_$(PKG_NAME)_INCLUDE_KSMBD
-	bool "KSMBD"
-
-	config PACKAGE_$(PKG_NAME)_INCLUDE_SAMBA3
-	bool "SAMBA 3"
-
-	config PACKAGE_$(PKG_NAME)_INCLUDE_SAMBA4
-	bool "SAMBA 4"
-endchoice
-
-endef
-
-define Build/Compile
-endef
-
-define Package/autosamba/install
-	$(INSTALL_DIR) $(1)/etc/hotplug.d/block
-	$(INSTALL_BIN) ./files/20-smb $(1)/etc/hotplug.d/block/20-smb
-endef
-
-$(eval $(call BuildPackage,autosamba))
@@ -1,106 +0,0 @@
-#!/bin/sh
-
-#
-#  D-Team Technology Co.,Ltd. ShenZhen
-#  作者:Vic
-#
-# 警告:对着屏幕的哥们,我们允许你使用此脚本，但不允许你抹去作者的信息,请保留这段话。
-#
-
-. /lib/functions.sh
-. /lib/functions/service.sh
-
-global=0
-config_file="/etc/config/samba4"
-
-wait_for_init() {
-	for i in `seq 30`
-	do
-		[ -e /tmp/procd.done ] || {
-		sleep 1; continue;
-		}
-		return
-	done
-}
-
-smb_handle() {
-	config_get path $1 path
-	if [  "$path" = "$2" ] ;then
-		global=1
-	fi
-}
-
-chk_en() {
-	config_get_bool autoshare $1 autoshare 1
-	[ $autoshare -eq 0 ] && exit
-}
-
-config_load samba4
-config_foreach chk_en samba4
-
-device=`basename $DEVPATH`
-
-case "$ACTION" in
-	add)
-
-	case "$device" in
-		sd*);;
-		md*);;
-		hd*);;
-		mmcblk*);;
-		*) return;;
-	esac
-
-	path="/dev/$device"
-
-	wait_for_init
-
-	cat /proc/mounts | grep -v '/boot\|/opt' | while read j
-	do
-		str=${j%% *}
-		if [ "$str" == $path ];then
-			strr=${j#* }
-			target=${strr%% *}
-			global=0
-			config_foreach smb_handle sambashare $target
-			name=${target#*/mnt/}
-
-			if [ $global -eq 0 ] ;then
-				echo -e "\n\nconfig sambashare" >> $config_file
-				echo -e "\toption auto '1'" >> $config_file
-				echo -e "\toption name '$name'" >> $config_file
-				echo -e "\toption path '$target'" >> $config_file
-				echo -e "\toption read_only 'no'" >> $config_file
-				echo -e "\toption guest_ok 'yes'" >> $config_file
-				echo -e "\toption create_mask '0666'" >> $config_file
-				echo -e "\toption dir_mask '0777'" >> $config_file
-				echo -e "\toption device '$device'" >> $config_file
-				echo -e "\toption inherit_owner 'yes'" >> $config_file
-				/etc/init.d/samba4 reload
-				return
-			fi
-		fi
-	done
-	;;
-
-	remove)
-		i=0
-		while true
-		do
-			dev=`uci get samba4.@sambashare[$i].device`
-			[ $? -ne 0 ] && break
-
-			[ "$dev" = "$device" ] && {
-				auto=`uci get samba4.@sambashare[$i].auto`
-				[ $auto = "1" ] && {
-					mount_dir=`uci get samba4.@sambashare[$i].name`
-					uci delete samba4.@sambashare[$i]
-					uci commit
-					/etc/init.d/samba4 reload
-					return
-				}
-			}
-			let i+=1
-		done
-	;;
-esac
@@ -11,6 +11,7 @@ P4REV:=9
 PKG_VERSION:=5.0.4.0

 PKG_BUILD_PARALLEL:=1
+PATCH_DIR:=./patches-$(KERNEL_PATCHVER)

 # PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_NAME)
 PKG_KCONFIG:= \
@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-clashoo
 PKG_VERSION:=1.30.0
-PKG_RELEASE:=12
+PKG_RELEASE:=14
 PKG_MAINTAINER:=kenzok8
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)

@@ -143,7 +143,7 @@ const callOverview          = rpc.declare({ object: 'luci.clashoo', method: 'ove
 const callSmartFlushCache       = rpc.declare({ object: 'luci.clashoo', method: 'smart_flush_cache',       expect: {} });
 const callListSingboxProfiles   = rpc.declare({ object: 'luci.clashoo', method: 'list_singbox_profiles',   expect: {} });
 const callGetSingboxProfile     = rpc.declare({ object: 'luci.clashoo', method: 'get_singbox_profile',     params: ['name'],                   expect: {} });
-const callSaveSingboxProfile    = rpc.declare({ object: 'luci.clashoo', method: 'save_singbox_profile',    params: ['name', 'content'],         expect: {} });
+const callSaveSingboxProfileChunk = rpc.declare({ object: 'luci.clashoo', method: 'save_singbox_profile_chunk', params: ['name', 'content', 'index', 'total'], expect: {} });
 const callSetSingboxProfile     = rpc.declare({ object: 'luci.clashoo', method: 'set_singbox_profile',     params: ['name'],                   expect: {} });
 const callDeleteSingboxProfile  = rpc.declare({ object: 'luci.clashoo', method: 'delete_singbox_profile',  params: ['name'],                   expect: {} });
 const callCreateSingboxConfig   = rpc.declare({ object: 'luci.clashoo', method: 'create_singbox_config',   params: ['sub_url', 'name'], expect: {} });
@@ -235,7 +235,23 @@ return baseclass.extend({

    listSingboxProfiles:  function ()           { return L.resolveDefault(callListSingboxProfiles(),          { profiles: [], active: '' }); },
    getSingboxProfile:    function (name)        { return L.resolveDefault(callGetSingboxProfile(name),        {}); },
-    saveSingboxProfile:   function (name, content){ return L.resolveDefault(callSaveSingboxProfile(name, content), {}); },
+    saveSingboxProfile: function (name, content) {
+        var chunkSize = 24576;
+        var total = Math.max(1, Math.ceil((content || '').length / chunkSize));
+        var index = 0;
+
+        function sendNext() {
+            var chunk = (content || '').slice(index * chunkSize, (index + 1) * chunkSize);
+            return L.resolveDefault(callSaveSingboxProfileChunk(name, chunk, String(index), String(total)), {}).then(function (r) {
+                if (!r || !r.success)
+                    return { success: false, error: (r && r.error) || 'upload_failed', message: (r && (r.message || r.error)) || _('Upload failed') };
+                index++;
+                return index < total ? sendNext() : r;
+            });
+        }
+
+        return sendNext();
+    },
    setSingboxProfile:    function (name)        { return L.resolveDefault(callSetSingboxProfile(name),        {}); },
    deleteSingboxProfile: function (name)        { return L.resolveDefault(callDeleteSingboxProfile(name),     {}); },
    createSingboxConfig:  function (url, name) { return L.resolveDefault(callCreateSingboxConfig(url, name), {}); },
@@ -1357,6 +1357,14 @@ return view.extend({
    o = s.option(form.Flag, 'dns_respect_rules', _("DNS Respect Rules"));
    o.default = '1';
    o.description = _("DNS queries follow the routing rules, so overseas domains resolve through the proxy instead of a polluted result. Requires proxy-server-nameserver.");
+    o = s.option(form.Flag, 'dns_loopback_compat', _("OpenClash/Nikki Loopback DNS Compatibility"));
+    o.default = '0';
+    o.description = _("Optional compatibility for normal managed mode. At runtime, replace only proxy node resolvers that point back to the imported configuration's own DNS listener. Core Only mode stays verbatim; the source configuration and unrelated local DNS services remain unchanged.");
+    o.depends('enable_dns', '1');
+    o = s.option(form.DynamicList, 'dns_loopback_compat_resolver', _("Loopback DNS Replacement"));
+    o.placeholder = 'udp://223.5.5.5:53';
+    o.description = _("Used only when the compatibility switch detects a stale self-reference. When empty, udp://223.5.5.5:53 and udp://119.29.29.29:53 are used. Plain IP DNS is recommended to avoid bootstrap loops.");
+    o.depends('dns_loopback_compat', '1');
    o = s.option(form.Value, 'dns_ecs', _("ECS Client Subnet"));
    o.placeholder = _("Recommended blank");
    o.description = _("mihomo writes the ecs parameter to DNS URLs; sing-box writes dns.client_subnet. Leave empty to skip.");
@@ -902,9 +902,18 @@ msgstr ""
 msgid "OpenClash is enabled; disable it first to avoid rule conflicts"
 msgstr ""

+msgid "OpenClash/Nikki Loopback DNS Compatibility"
+msgstr ""
+
 msgid "Operation failed: "
 msgstr ""

+msgid "Loopback DNS Replacement"
+msgstr ""
+
+msgid "Optional compatibility for normal managed mode. At runtime, replace only proxy node resolvers that point back to the imported configuration's own DNS listener. Core Only mode stays verbatim; the source configuration and unrelated local DNS services remain unchanged."
+msgstr ""
+
 msgid "Other Configuration Files (upload / overwrite output)"
 msgstr ""

@@ -1502,6 +1511,9 @@ msgstr ""
 msgid "User-Agent (UA)"
 msgstr ""

+msgid "Used only when the compatibility switch detects a stale self-reference. When empty, udp://223.5.5.5:53 and udp://119.29.29.29:53 are used. Plain IP DNS is recommended to avoid bootstrap loops."
+msgstr ""
+
 msgid "Username"
 msgstr ""

@@ -909,6 +909,18 @@ msgstr "TCP 或 UDP 任意一个选择 TUN 时，该栈设置才会生效。"
 msgid "OpenClash is enabled; disable it first to avoid rule conflicts"
 msgstr "OpenClash 已启用，请先停用以避免规则冲突"

+msgid "OpenClash/Nikki Loopback DNS Compatibility"
+msgstr "OpenClash/Nikki 回环 DNS 兼容"
+
+msgid "Loopback DNS Replacement"
+msgstr "回环 DNS 替换地址"
+
+msgid "Optional compatibility for normal managed mode. At runtime, replace only proxy node resolvers that point back to the imported configuration's own DNS listener. Core Only mode stays verbatim; the source configuration and unrelated local DNS services remain unchanged."
+msgstr "用于普通接管模式的可选兼容功能。运行时仅替换指回导入配置自身 DNS 监听的节点解析器；仅内核模式保持原样，源配置和其他本地 DNS 服务不受影响。"
+
+msgid "Used only when the compatibility switch detects a stale self-reference. When empty, udp://223.5.5.5:53 and udp://119.29.29.29:53 are used. Plain IP DNS is recommended to avoid bootstrap loops."
+msgstr "仅在兼容开关检测到失效自引用时使用。留空则使用 udp://223.5.5.5:53 和 udp://119.29.29.29:53。建议使用纯 IP DNS，避免启动解析死循环。"
+
 msgid "Operation failed: "
 msgstr "操作失败: "

@@ -3812,6 +3812,50 @@ return { success: true, name };
 }
 },

+save_singbox_profile_chunk: {
+args: { name: 'name', content: 'content', index: 'index', total: 'total' },
+call: function(req) {
+let name    = req.args?.name    || '';
+let content = req.args?.content;
+let idx     = int(req.args?.index || 0);
+let total   = int(req.args?.total || 0);
+if (!name || index(name, '/') >= 0 || index(name, '..') >= 0)
+  return { success: false, error: 'invalid name' };
+if (!match(name, /\.json$/)) name = name + '.json';
+if (type(content) != 'string') return { success: false, error: 'invalid content' };
+if (total < 1 || idx < 0 || idx >= total) return { success: false, error: 'invalid chunk' };
+if (total == 1 && !content) return { success: false, error: 'empty content' };
+let dir = '/usr/share/clashoo/config/singbox';
+system('mkdir -p ' + shell_quote(dir) + ' >/dev/null 2>&1');
+let tmp = '/tmp/clashoo_sb_upload_' + name;
+if (idx == 0) {
+  if (writefile(tmp, content) === null)
+    return { success: false, error: 'write_failed', message: '写入文件失败' };
+} else {
+  let fp = open(tmp, 'a');
+  if (!fp) return { success: false, error: 'write_failed', message: '打开文件失败' };
+  let ok = fp.write(content);
+  fp.close();
+  if (ok === null) return { success: false, error: 'write_failed', message: '写入文件失败' };
+}
+if (idx + 1 < total)
+  return { success: true, name, index: idx, total, complete: false };
+let binary = find_binary();
+if (binary && match(binary, /sing-box/)) {
+  if (system(shell_quote(binary) + ' check -c ' + shell_quote(tmp) + ' >/dev/null 2>&1') != 0) {
+    system('rm -f ' + shell_quote(tmp));
+    return { success: false, error: 'invalid_config', message: 'sing-box 配置验证失败，请检查 JSON 格式' };
+  }
+}
+if (system('cp -f ' + shell_quote(tmp) + ' ' + shell_quote(dir + '/' + name) + ' >/dev/null 2>&1') != 0) {
+  system('rm -f ' + shell_quote(tmp));
+  return { success: false, error: 'write_failed', message: '写入文件失败' };
+}
+system('rm -f ' + shell_quote(tmp));
+return { success: true, name, index: idx, total, complete: true };
+}
+},
+
 set_singbox_profile: {
 args: { name: 'name' },
 call: function(req) {
@@ -5,8 +5,8 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-daede
-PKG_VERSION:=1.14.7
-PKG_RELEASE:=25
+PKG_VERSION:=1.15
+PKG_RELEASE:=2
 PKG_MAINTAINER:=kenzok8
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)

@@ -78,6 +78,7 @@ define Package/$(PKG_NAME)/install
 	$(INSTALL_BIN) ./root/usr/share/luci-app-daede/proxy-check.sh $(1)/usr/share/luci-app-daede/proxy-check.sh
 	$(INSTALL_BIN) ./root/usr/share/luci-app-daede/fetch-clash-yaml.sh $(1)/usr/share/luci-app-daede/fetch-clash-yaml.sh
 	$(INSTALL_BIN) ./root/usr/share/luci-app-daede/config-backup.sh $(1)/usr/share/luci-app-daede/config-backup.sh
+	$(INSTALL_BIN) ./root/usr/share/luci-app-daede/snapshot-file.sh $(1)/usr/share/luci-app-daede/snapshot-file.sh
 	$(INSTALL_BIN) ./root/usr/share/luci-app-daede/config-defaults.sh $(1)/usr/share/luci-app-daede/config-defaults.sh
 	$(INSTALL_DIR) $(1)/usr/share/luci-app-daede/defaults
 	$(INSTALL_DATA) $(CURDIR)/../dae/files/dae.config $(1)/usr/share/luci-app-daede/defaults/dae
@@ -13,6 +13,7 @@

 const FETCHER = '/usr/share/luci-app-daede/fetch-clash-yaml.sh';
 const GENERATOR = '/usr/share/luci-app-daede/gen-dae-config.sh';
+const SNAPSHOT_HELPER = '/usr/share/luci-app-daede/snapshot-file.sh';
 const SUB_STAGE = '/tmp/daede-sub.txt';
 const FETCH_CHUNK_BYTES = 16384;

@@ -651,11 +652,19 @@ return view.extend({
 			const name = airportName.value.trim();
 			const groupName = airportSync.backendGroupName(name, 'daed', airportId);
 			const endpoint = daedEndpoint();
-			// daed can't read file:// — it HTTP-fetches a subscription link. Stage
-			// the converted links (base64) and let daed pull them from the
-			// loopback-only CGI, so the import lands as ONE subscription.
-			const subToken = airportSync.backendId(airportId) + Date.now().toString(36);
-			const stageFile = '/tmp/daede-daedsub-' + subToken;
+			// daed can't read file:// — it HTTP-fetches a subscription link. Persist
+			// the converted snapshot and let daed pull it from the loopback-only CGI,
+			// so later daed refreshes and configuration backups keep working.
+			// Keep the CGI token opaque, bounded, and unique across imports started in
+			// the same millisecond. The final sanitization also protects the filename
+			// and the CGI's allow-list if backendId ever changes.
+			const tokenTime = Date.now().toString(36);
+			const tokenRandom = Math.random().toString(36).slice(2, 12);
+			const tokenPrefix = airportSync.backendId(airportId).replace(/[^A-Za-z0-9]/g, '')
+				.slice(0, Math.max(0, 64 - tokenTime.length - tokenRandom.length));
+			const subToken = (tokenPrefix + tokenTime + tokenRandom).slice(0, 64);
+			const snapshotFile = '/etc/daed/daede-sub-' + subToken;
+			const stageFile = '/etc/daed/.daede-sub-stage-' + subToken;
 			const subUrl = 'http://127.0.0.1/cgi-bin/daede-sub?t=' + subToken;
 			const b64 = btoa(items.map(function(item) { return item.link; }).join('\n') + '\n');

@@ -664,15 +673,156 @@ return view.extend({
 			let createdGroupId = '';
 			const createdNodeIds = [];
 			let groupReady = false;
+			let snapshotCommitted = false;
+			let snapshotFinalToken = '';
+			let reuseExistingSnapshot = false;
 			const oldSubId = existingAirport ? existingAirport.subscription_id : '';
 			const oldNodeIds = existingAirport ? existingAirport.node_ids : [];

-			const dropStage = function() { return fs.exec('/bin/rm', [ '-f', stageFile ]).catch(function() {}); };
+			const dropSnapshot = function(path) {
+				if (!path)
+					return Promise.resolve();
+				return fs.remove(path).catch(function(error) {
+					const message = String(error && (error.message || error) || '');
+					if (/not found|no such file|enoent/i.test(message))
+						return;
+					throw error;
+				});
+			};
+			const appendWarning = function(error, warning) {
+				const result = error instanceof Error ? error : new Error(String(error && (error.message || error) || error));
+				result.message = result.message + '; ' + warning;
+				return result;
+			};
+			const snapshotAction = function(args) {
+				return fs.exec(SNAPSHOT_HELPER, args).then(function(res) {
+					if (!res || res.code !== 0)
+						throw new Error((res && (res.stderr || res.stdout)) || _('Snapshot operation failed'));
+					return res;
+				});
+			};
+			const cleanupStage = function() {
+				return snapshotAction([ 'discard', subToken ]);
+			};
+			const querySubscriptions = function() {
+				if (!token)
+					return Promise.reject(new Error(_('daed subscription cleanup could not be verified')));
+				return graphQL(endpoint, 'query SubscriptionLinks{subscriptions{id link}}', {}, token).then(function(value) {
+					if (!value || !Array.isArray(value.subscriptions))
+						throw new Error(_('daed returned an invalid subscription list'));
+					return value.subscriptions;
+				});
+			};
+			const dropSnapshotIfUnreferenced = function() {
+				if (snapshotFinalToken !== subToken)
+					return Promise.resolve();
+				return querySubscriptions().then(function(subscriptions) {
+					if (subscriptions.some(function(sub) { return String(sub.link || '') === subUrl; }))
+						throw new Error(_('new daed subscription snapshot is still referenced; it was kept'));
+					return dropSnapshot(snapshotFile);
+				});
+			};
+			const finishWithSnapshotCleanup = function(result) {
+				return dropSnapshotIfUnreferenced().then(function() {
+					return result;
+				}).catch(function(error) {
+					const warning = String(error && (error.message || error) || error);
+					result.warning = result.warning
+						? result.warning + '; ' + warning
+						: warning;
+					return result;
+				});
+			};
+			const updateExistingSubscription = function() {
+				const old = (((before || {}).subscriptions) || []).find(function(sub) { return sub.id === oldSubId; });
+				if (!old)
+					return Promise.reject(new Error(_('Managed subscription no longer exists in daed')));
+
+				const oldLink = String(old.link || '');
+				const localToken = oldLink.match(/^http:\/\/127\.0\.0\.1\/cgi-bin\/daede-sub\?t=([A-Za-z0-9]{1,64})$/);
+				const refresh = function() {
+					return graphQL(endpoint, 'mutation UpdateSub($id:ID!){updateSubscription(id:$id){id}}', { id: oldSubId }, token);
+				};
+				const currentLink = function() {
+					return querySubscriptions().then(function(subscriptions) {
+						const current = subscriptions.find(function(sub) { return sub.id === oldSubId; });
+						return current ? String(current.link || '') : '';
+					});
+				};
+				const restoreOldLink = function(originalError) {
+					return graphQL(endpoint, 'mutation RestoreLink($id:ID!,$link:String!){updateSubscriptionLink(id:$id,link:$link)}', {
+						id: oldSubId,
+						link: oldLink
+					}, token).then(refresh).then(currentLink).then(function(link) {
+						if (link !== oldLink) {
+							snapshotCommitted = true;
+							throw appendWarning(originalError, _('rollback was not confirmed; both subscription snapshots were kept'));
+						}
+						throw originalError;
+					}, function(rollbackError) {
+						snapshotCommitted = true;
+						throw appendWarning(originalError, _('rollback could not be confirmed; both subscription snapshots were kept: %s').format(String(rollbackError && (rollbackError.message || rollbackError) || rollbackError)));
+					});
+				};
+				const finish = function() {
+					const tag = old.tag !== groupName
+						? graphQL(endpoint, 'mutation TagSub($id:ID!,$tag:String!){tagSubscription(id:$id,tag:$tag)}', {
+							id: oldSubId,
+							tag: groupName
+						}, token).catch(function(error) {
+							return String(error && (error.message || error) || error);
+						})
+						: Promise.resolve('');
+					return tag.then(function(tagWarning) {
+						writeAirportRecord(existingAirport, {
+							id: airportId,
+							backend: 'daed',
+							name: name,
+							sourceHash: state.sourceHash,
+							groupId: existingAirport.group_id,
+							subscriptionId: oldSubId,
+							nodeIds: []
+						});
+						return applyUciChanges().then(function() {
+							items.forEach(function(item) { item.duplicate = true; item.selected = false; });
+							return {
+								added: items.length,
+								duplicates: 0,
+								failed: 0,
+								warning: tagWarning
+							};
+						});
+					});
+				};
+
+				if (localToken && reuseExistingSnapshot) {
+					return graphQL(endpoint, 'mutation UpdateSub($id:ID!){updateSubscription(id:$id){id}}', { id: oldSubId }, token)
+						.then(currentLink).then(function(link) {
+							if (link !== oldLink)
+								throw new Error(_('daed did not confirm the existing subscription link after refresh'));
+						}).catch(function(error) {
+							throw appendWarning(error, _('daed subscription refresh failed; the new snapshot remains at the existing link and existing nodes were kept'));
+						}).then(finish);
+				}
+
+				return graphQL(endpoint, 'mutation SetLink($id:ID!,$link:String!){updateSubscriptionLink(id:$id,link:$link)}', {
+					id: oldSubId,
+					link: subUrl
+				}, token).then(refresh).then(function() {
+					return currentLink().then(function(link) {
+						if (link !== subUrl)
+							throw new Error(_('daed did not confirm the new subscription link'));
+					});
+				}).catch(restoreOldLink).then(function() {
+					snapshotCommitted = true;
+					return finish();
+				});
+			};
 			const loadState = function(forceLogin) {
 				return requestDaedToken(endpoint, forceLogin).then(function(auth) {
 					token = auth.token;
 					usedCachedToken = auth.cached;
-					return graphQL(endpoint, 'query State{nodes(first:10000){edges{id link tag}} groups{id name nodes{id}}}', {}, token);
+					return graphQL(endpoint, 'query State{nodes(first:10000){edges{id link tag}} groups{id name nodes{id}} subscriptions{id link tag}}', {}, token);
 				});
 			};
 			const importDirectNodes = function() {
@@ -797,7 +947,7 @@ return view.extend({
 				});
 			};

-			return fs.write(stageFile, b64).then(function() {
+			return fs.write(stageFile, b64, 384).then(function() {
 				return loadState(false).catch(function(error) {
 					if (!usedCachedToken || !daedSession.isAccessDenied(error))
 						throw error;
@@ -806,42 +956,63 @@ return view.extend({
 				});
 			}).then(function(dataValue) {
 				before = dataValue;
-				// drop this airport's previous subscription first: the new one
-				// reuses the same tag (group name) and daed enforces unique tags.
-				if (!oldSubId)
-					return null;
-				return graphQL(endpoint, 'mutation RmSub($ids:[ID!]!){removeSubscriptions(ids:$ids)}', { ids: [ oldSubId ] }, token).catch(function() {});
-			}).then(function() {
-				// import the whole converted batch as one subscription
-				return graphQL(endpoint,
-					'mutation Import($a:ImportArgument!){importSubscription(rollbackError:false,arg:$a){sub{id} nodeImportResult{error}}}',
-					{ a: { link: subUrl, tag: groupName } }, token).then(function(result) {
-						const sub = result.importSubscription && result.importSubscription.sub;
-						const rows = (result.importSubscription && result.importSubscription.nodeImportResult) || [];
-						const usable = rows.length
-							? rows.some(function(r) { return !r.error || r.error === 'node already exists'; })
-							: !!(sub && sub.id);
-						if (!sub || !sub.id || !usable) {
-							const details = rows.map(function(r) { return r.error; }).filter(Boolean).join('; ');
-							if (sub && sub.id)
-								newSubId = sub.id;
-							throw new Error(details || _('No usable nodes were imported'));
-						}
-						return result;
-					}).catch(function(error) {
-						if (daedSession.isAccessDenied(error))
-							throw error;
-						const cleanupSub = newSubId
-							? graphQL(endpoint, 'mutation Rm($ids:[ID!]!){removeSubscriptions(ids:$ids)}', { ids: [ newSubId ] }, token).catch(function() {})
-							: Promise.resolve();
-						newSubId = '';
-						return cleanupSub.then(importDirectNodes).then(function(result) {
-							return { directResult: result };
-						});
+				const old = (before.subscriptions || []).find(function(sub) { return sub.id === oldSubId; });
+				const localToken = old && String(old.link || '').match(/^http:\/\/127\.0\.0\.1\/cgi-bin\/daede-sub\?t=([A-Za-z0-9]{1,64})$/);
+				const oldLinkReferences = localToken
+					? (before.subscriptions || []).filter(function(sub) { return String(sub.link || '') === String(old.link || ''); })
+					: [];
+				reuseExistingSnapshot = !!(localToken && oldLinkReferences.length === 1 && String(oldLinkReferences[0].id) === String(oldSubId));
+				const publish = reuseExistingSnapshot
+					? snapshotAction([ 'replace', localToken[1], subToken ]).then(function() {
+						snapshotFinalToken = localToken[1];
+						snapshotCommitted = true;
+					})
+					: snapshotAction([ 'publish', subToken ]).then(function() {
+						snapshotFinalToken = subToken;
 					});
+				return publish.then(function() {
+					if (oldSubId)
+						return updateExistingSubscription().then(function(result) { return { existingResult: result }; });
+					// import the whole converted batch as one subscription
+					return graphQL(endpoint,
+						'mutation Import($a:ImportArgument!){importSubscription(rollbackError:false,arg:$a){sub{id} nodeImportResult{error}}}',
+						{ a: { link: subUrl, tag: groupName } }, token).then(function(result) {
+							const sub = result.importSubscription && result.importSubscription.sub;
+							const rows = (result.importSubscription && result.importSubscription.nodeImportResult) || [];
+							const usable = rows.length
+								? rows.some(function(r) { return !r.error || r.error === 'node already exists'; })
+								: !!(sub && sub.id);
+							if (!sub || !sub.id || !usable) {
+								const details = rows.map(function(r) { return r.error; }).filter(Boolean).join('; ');
+								if (sub && sub.id)
+									newSubId = sub.id;
+								throw new Error(details || _('No usable nodes were imported'));
+							}
+							return result;
+						}).catch(function(error) {
+							if (daedSession.isAccessDenied(error))
+								throw error;
+							const cleanupSub = newSubId
+								? graphQL(endpoint, 'mutation Rm($ids:[ID!]!){removeSubscriptions(ids:$ids)}', { ids: [ newSubId ] }, token).catch(function(cleanupError) {
+									snapshotCommitted = true;
+									throw appendWarning(error, _('rollback could not be confirmed; the new subscription snapshot was kept: %s').format(String(cleanupError && (cleanupError.message || cleanupError) || cleanupError)));
+								})
+								: Promise.resolve();
+							newSubId = '';
+							return cleanupSub.then(function() {
+								if (oldSubId)
+									throw error;
+								return importDirectNodes();
+							}).then(function(result) {
+								return { directResult: result };
+							});
+						});
+				});
 			}).then(function(result) {
+				if (result.existingResult)
+					return result.existingResult;
 				if (result.directResult)
-					return result.directResult;
+					return finishWithSnapshotCleanup(result.directResult);

 				const sub = result.importSubscription && result.importSubscription.sub;
 				newSubId = sub.id;
@@ -861,6 +1032,7 @@ return view.extend({
 				return ensureGroup.then(function(groupId) {
 					return graphQL(endpoint, 'mutation AddSubs($id:ID!,$ids:[ID!]!){groupAddSubscriptions(id:$id,subscriptionIDs:$ids)}', { id: groupId, ids: [ newSubId ] }, token).then(function() {
 						groupReady = true;
+						snapshotCommitted = true;
 						const cleanup = [];
 						// Migrate converter-managed airport groups to proxy, but never
 						// disturb proxy's existing nodes or other subscriptions.
@@ -880,7 +1052,12 @@ return view.extend({
 							});
 							return applyUciChanges().then(function() {
 								items.forEach(function(item) { item.duplicate = true; item.selected = false; });
-								return { added: items.length, duplicates: 0, failed: failed };
+								return {
+									added: items.length,
+									duplicates: 0,
+									failed: failed,
+									warning: ''
+								};
 							});
 						});
 					});
@@ -892,15 +1069,47 @@ return view.extend({
 					throw error;
 				const cleanup = [];
 				if (newSubId)
-					cleanup.push(graphQL(endpoint, 'mutation Rm($ids:[ID!]!){removeSubscriptions(ids:$ids)}', { ids: [ newSubId ] }, token));
+					cleanup.push(graphQL(endpoint, 'mutation Rm($ids:[ID!]!){removeSubscriptions(ids:$ids)}', { ids: [ newSubId ] }, token).catch(function(cleanupError) {
+						snapshotCommitted = true;
+						throw cleanupError;
+					}));
 				if (createdNodeIds.length)
 					cleanup.push(graphQL(endpoint, 'mutation Rm($ids:[ID!]!){removeNodes(ids:$ids)}', { ids: createdNodeIds }, token));
 				if (createdGroupId)
 					cleanup.push(graphQL(endpoint, 'mutation RmG($id:ID!){removeGroup(id:$id)}', { id: createdGroupId }, token));
-				return Promise.all(cleanup).catch(function() {}).then(function() { throw error; });
-			}).finally(function() {
-				token = '';
-				return dropStage();
+				return Promise.all(cleanup).then(function() {
+					throw error;
+				}, function(cleanupError) {
+					snapshotCommitted = true;
+					throw appendWarning(error, _('rollback could not be confirmed; the new subscription snapshot was kept: %s').format(String(cleanupError && (cleanupError.message || cleanupError) || cleanupError)));
+				});
+			}).then(function(result) {
+				return cleanupStage().then(function() {
+					token = '';
+					return result;
+				}, function(cleanupError) {
+					token = '';
+					result.warning = result.warning
+						? result.warning + '; ' + String(cleanupError && (cleanupError.message || cleanupError) || cleanupError)
+						: String(cleanupError && (cleanupError.message || cleanupError) || cleanupError);
+					return result;
+				});
+			}, function(error) {
+				let cleanupWarning = '';
+				const removeSnapshot = snapshotCommitted
+					? Promise.resolve()
+					: dropSnapshotIfUnreferenced().catch(function(cleanupError) {
+						cleanupWarning = _('rollback could not be confirmed; the new subscription snapshot was kept: %s').format(String(cleanupError && (cleanupError.message || cleanupError) || cleanupError));
+					});
+				return removeSnapshot.then(function() {
+					return cleanupStage().catch(function(stageError) {
+						const warning = _('snapshot stage cleanup failed: %s').format(String(stageError && (stageError.message || stageError) || stageError));
+						cleanupWarning = cleanupWarning ? cleanupWarning + '; ' + warning : warning;
+					});
+				}).then(function() {
+					token = '';
+					throw cleanupWarning ? appendWarning(error, cleanupWarning) : error;
+				});
 			});
 		};

@@ -924,8 +1133,11 @@ return view.extend({
 			setImportStatus(_('Importing node group…'));
 			const action = state.target === 'dae' ? importDae(items) : importDaed(items);
 			action.then(function(result) {
-				setImportStatus(_('Node group imported: added %d, reused %d, failed %d')
-					.format(result.added, result.duplicates, result.failed), result.failed ? 'err' : 'ok');
+				let message = _('Node group imported: added %d, reused %d, failed %d')
+					.format(result.added, result.duplicates, result.failed);
+				if (result.warning)
+					message += ' ' + _('Completed with warning: %s').format(result.warning);
+				setImportStatus(message, result.failed || result.warning ? 'err' : 'ok');
 				renderResults();
 			}).catch(function(e) {
 				setImportStatus(_('Node group import failed: %s').format(e.message || e), 'err');
@@ -812,6 +812,12 @@ msgstr ""
 msgid "Node group imported: added %d, reused %d, failed %d"
 msgstr ""

+msgid "Completed with warning: %s"
+msgstr ""
+
+msgid "Managed subscription no longer exists in daed"
+msgstr ""
+
 msgid "Node group import failed: %s"
 msgstr ""

@@ -1004,6 +1004,12 @@ msgstr "正在导入节点组…"
 msgid "Node group imported: added %d, reused %d, failed %d"
 msgstr "节点组导入完成：新增 %d，复用 %d，失败 %d"

+msgid "Completed with warning: %s"
+msgstr "已完成，但有警告：%s"
+
+msgid "Managed subscription no longer exists in daed"
+msgstr "daed 中已不存在该托管订阅"
+
 msgid "Node group import failed: %s"
 msgstr "节点组导入失败：%s"

@@ -1004,6 +1004,12 @@ msgstr "正在导入节点组…"
 msgid "Node group imported: added %d, reused %d, failed %d"
 msgstr "节点组导入完成：新增 %d，复用 %d，失败 %d"

+msgid "Completed with warning: %s"
+msgstr "已完成，但有警告：%s"
+
+msgid "Managed subscription no longer exists in daed"
+msgstr "daed 中已不存在该托管订阅"
+
 msgid "Node group import failed: %s"
 msgstr "节点组导入失败：%s"

@@ -31,6 +31,12 @@ paths() {
 		case "${name%.sub}" in ''|*[!A-Za-z0-9_]*) fail 'unexpected subscription filename' ;; esac
 		printf 'etc/dae/subscriptions/%s\n' "$name"
 	done
+	for sub in "$1"/etc/daed/daede-sub-*; do
+		[ -e "$sub" ] || [ -L "$sub" ] || continue
+		name="${sub##*/daede-sub-}"
+		case "$name" in ''|*[!A-Za-z0-9]*) fail 'unexpected daed subscription filename' ;; esac
+		printf 'etc/daed/daede-sub-%s\n' "$name"
+	done
 }
 check_paths() {
 	for dir in /etc/config /etc/dae /etc/daed /etc/dae/subscriptions; do
@@ -42,6 +48,14 @@ check_paths() {
 		[ ! -e "/$p" ] || [ -f "/$p" ] || fail "not a regular file: /$p"
 	done < "$WORK/paths"
 }
+cleanup_stages() {
+	for stage in /etc/daed/.daede-sub-stage-*; do
+		[ -e "$stage" ] || [ -L "$stage" ] || continue
+		[ ! -L "$stage" ] || fail "refusing symlink: $stage"
+		[ -f "$stage" ] || fail "not a regular file: $stage"
+		rm -f "$stage" || fail "failed to remove stale snapshot stage: $stage"
+	done
+}
 snapshot() {
 	mkdir -p "$WORK/before"
 	while IFS= read -r p; do
@@ -139,6 +153,9 @@ validate_archive() {
 			etc/dae/subscriptions/*.sub)
 				name="${p#etc/dae/subscriptions/}"
 				case "${name%.sub}" in ''|*[!A-Za-z0-9_]*) fail 'invalid subscription path' ;; esac ;;
+			etc/daed/daede-sub-*)
+				name="${p#etc/daed/daede-sub-}"
+				case "$name" in ''|*[!A-Za-z0-9]*) fail 'invalid daed subscription path' ;; esac ;;
 			*) fail 'unexpected archive entry' ;;
 		esac
 	done < "$WORK/entries"
@@ -175,6 +192,7 @@ run_action() {
 		fi
 	fi
 	stop_backends
+	[ "$ACTION" = reset ] && cleanup_stages
 	snapshot
 	if [ "$ACTION" = export ]; then
 		paths "$WORK/before" > "$WORK/candidates"
@@ -0,0 +1,81 @@
+#!/bin/sh
+# Publish converter snapshots without exposing a partially written final file.
+
+set -eu
+
+DIR=/etc/daed
+PREFIX=daede-sub
+STAGE_PREFIX=.daede-sub-stage
+
+fail() {
+	echo "$*" >&2
+	exit 1
+}
+
+valid_token() {
+	[ "$#" -eq 1 ] || return 1
+	case "$1" in
+		''|*[!A-Za-z0-9]*) return 1 ;;
+	esac
+	[ "${#1}" -le 64 ]
+}
+
+stage_path() { printf '%s/%s-%s\n' "$DIR" "$STAGE_PREFIX" "$1"; }
+final_path() { printf '%s/%s-%s\n' "$DIR" "$PREFIX" "$1"; }
+
+regular_file() {
+	[ -f "$1" ] && [ ! -L "$1" ]
+}
+
+safe_dir() {
+	[ -d "$DIR" ] && [ ! -L "$DIR" ] || fail "invalid snapshot directory"
+}
+
+publish() {
+	[ "$#" -eq 1 ] || fail 'publish expects one token'
+	valid_token "$1" || fail 'invalid snapshot token'
+	safe_dir
+	stage=$(stage_path "$1")
+	final=$(final_path "$1")
+	regular_file "$stage" || fail 'snapshot stage is not a regular file'
+	[ ! -e "$final" ] && [ ! -L "$final" ] || fail 'snapshot already exists'
+	chmod 600 "$stage" || fail 'cannot secure snapshot stage'
+	mv -f "$stage" "$final" || fail 'cannot publish snapshot'
+}
+
+replace() {
+	[ "$#" -eq 2 ] || fail 'replace expects existing and stage tokens'
+	valid_token "$1" || fail 'invalid existing snapshot token'
+	valid_token "$2" || fail 'invalid stage snapshot token'
+	safe_dir
+	[ "$1" != "$2" ] || fail 'existing and stage tokens must differ'
+	stage=$(stage_path "$2")
+	final=$(final_path "$1")
+	regular_file "$stage" || fail 'snapshot stage is not a regular file'
+	if [ -e "$final" ] || [ -L "$final" ]; then
+		regular_file "$final" || fail 'existing snapshot is not a regular file'
+	fi
+	chmod 600 "$stage" || fail 'cannot secure snapshot stage'
+	mv -f "$stage" "$final" || fail 'cannot replace snapshot'
+}
+
+discard() {
+	[ "$#" -eq 1 ] || fail 'discard expects one token'
+	valid_token "$1" || fail 'invalid snapshot token'
+	safe_dir
+	stage=$(stage_path "$1")
+	if [ -L "$stage" ]; then
+		fail 'refusing symlink snapshot stage'
+	fi
+	if [ -e "$stage" ]; then
+		[ -f "$stage" ] || fail 'snapshot stage is not a regular file'
+		rm -f "$stage" || fail 'cannot discard snapshot stage'
+	fi
+}
+
+case "${1:-}" in
+	publish) shift; publish "$@" ;;
+	replace) shift; replace "$@" ;;
+	discard) shift; discard "$@" ;;
+	*) fail 'unknown snapshot action' ;;
+esac
@@ -43,9 +43,12 @@
 				"/tmp/dae-validate.dae": [ "write" ],
 				"/tmp/daede-import.b64": [ "write" ],
 				"/tmp/daede-sub.txt": [ "write" ],
-				"/tmp/daede-daedsub-*": [ "write" ],
-				"/bin/rm -f /tmp/daede-daedsub-*": [ "exec" ],
+				"/etc/daed/.daede-sub-stage-*": [ "write" ],
+				"/etc/daed/daede-sub-*": [ "write" ],
 				"/usr/share/luci-app-daede/config-backup.sh import": [ "exec" ],
+				"/usr/share/luci-app-daede/snapshot-file.sh publish *": [ "exec" ],
+				"/usr/share/luci-app-daede/snapshot-file.sh replace * *": [ "exec" ],
+				"/usr/share/luci-app-daede/snapshot-file.sh discard *": [ "exec" ],
 				"/usr/share/luci-app-daede/gen-dae-config.sh write-sub *": [ "exec" ],
 				"/usr/share/luci-app-daede/gen-dae-config.sh delete-sub *": [ "exec" ],
 				"/etc/config/daede": [ "write" ],
@@ -2,13 +2,13 @@
 # daede-sub - serve a converter's staged node list to the local daed only.
 #
 # daed (dae-wing) can only build a subscription by HTTP-fetching a link, and it
-# does not read file:// like dae core. So the converter stages the base64 share
-# links in /tmp/daede-daedsub-<token> and points daed's importSubscription at
+# does not read file:// like dae core. So the converter stores the base64 share
+# links in /etc/daed/daede-sub-<token> and points daed's importSubscription at
 # http://127.0.0.1/cgi-bin/daede-sub?t=<token>. This CGI is the read side.
 #
 # Locked to loopback (REMOTE_ADDR), so even though uhttpd listens on the LAN no
-# remote client can pull the links. The frontend deletes the staged file after
-# the import (success or failure), so the exposure is one local fetch.
+# remote client can pull the links. The snapshot remains available for daed's
+# own refresh action and is included in daede configuration backups.

 deny() { printf 'Status: 403 Forbidden\r\nContent-Type: text/plain\r\n\r\nforbidden\n'; exit 0; }

@@ -18,7 +18,7 @@ deny() { printf 'Status: 403 Forbidden\r\nContent-Type: text/plain\r\n\r\nforbid
 t=$(printf '%s' "$QUERY_STRING" | sed -n 's/^.*\bt=\([A-Za-z0-9]\{1,64\}\).*$/\1/p')
 [ -n "$t" ] || deny

-f="/tmp/daede-daedsub-$t"
+f="/etc/daed/daede-sub-$t"
 [ -f "$f" ] || deny

 printf 'Content-Type: text/plain\r\n\r\n'
@@ -385,9 +385,11 @@ return view.extend({
 		so.validate = validateServerValue;
 		so.modalonly = true;

-		so = ss.option(form.DynamicList, 'upstream', _('Upstream DNS'));
+		so = ss.option(form.DynamicList, 'upstream', _('Upstream DNS'),
+			_('Allows the use of a specified upstream for specific domain. <a href="%s" target="_blank">Syntax reference</a>.')
+			.format('https://github.com/AdguardTeam/dnsproxy#specifying-upstreams-for-domains'));
 		so.rmempty = false;
-		so.validate = validateServerValue;
+		//so.validate = validateServerValue; // See #11
 		so.modalonly = true;

 		so = ss.option(form.DynamicList, 'fallback', _('Fallback DNS'));
@@ -11,6 +11,12 @@ msgstr ""
 msgid "Add DNS profile"
 msgstr ""

+#: htdocs/luci-static/resources/view/dnsproxy.js:389
+msgid ""
+"Allows the use of a specified upstream for specific domain. <a href=\"%s\" "
+"target=\"_blank\">Syntax reference</a>."
+msgstr ""
+
 #: htdocs/luci-static/resources/view/dnsproxy.js:285
 msgid "Bogus-NXDOMAIN"
 msgstr ""
@@ -122,7 +128,7 @@ msgstr ""
 msgid "Failed to apply DNS profile: %s"
 msgstr ""

-#: htdocs/luci-static/resources/view/dnsproxy.js:393
+#: htdocs/luci-static/resources/view/dnsproxy.js:395
 msgid "Fallback DNS"
 msgstr ""

@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 LUCI_TITLE:=LuCI support for fastnet
 LUCI_DEPENDS:=+fastnet
 LUCI_PKGARCH:=all
-PKG_VERSION:=0.7.2-r1
+PKG_VERSION:=0.7.7-r1
 # PKG_RELEASE MUST be empty for luci.mk
 PKG_RELEASE:=
 LUCI_MINIFY_CSS:=0
@@ -17,4 +17,3 @@ LUCI_MINIFY_JS:=0
 include $(TOPDIR)/feeds/luci/luci.mk

 # call BuildPackage - OpenWrt buildroot signature
-
@@ -7,9 +7,9 @@
 include $(TOPDIR)/rules.mk

 LUCI_TITLE:=KaiPlus
-PKG_VERSION:=1.0.1
+PKG_VERSION:=1.0.9
 PKG_RELEASE:=1
-LUCI_DEPENDS:=+kaiplus +luci-compat
+LUCI_DEPENDS:=+kaiplus +luci-compat +luci-lib-linkeaseauth
 LUCI_MINIFY_CSS:=0
 LUCI_MINIFY_JS:=0

@@ -62,4 +62,10 @@ base_path.default = "/apps/kaiplus/"
 base_path.rmempty = false
 base_path.readonly = true

+local release_channel = s:option(ListValue, "release_channel", translate("Release channel"))
+release_channel:value("stable", translate("Stable"))
+release_channel:value("canary", translate("Canary"))
+release_channel.default = "stable"
+release_channel.rmempty = false
+
 return m
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-mosdns
-PKG_VERSION:=1.7.13
+PKG_VERSION:=1.7.14
 PKG_RELEASE:=1

 LUCI_TITLE:=LuCI Support for mosdns
@@ -160,8 +160,18 @@ const injectStyles = () => {
 		'.btn-allow:hover { background: #059669 !important; color: #fff !important; }',
 		'.btn-block { background: rgba(239, 68, 68, 0.12) !important; color: #dc2626 !important; border: 1px solid rgba(239, 68, 68, 0.3) !important; }',
 		'.btn-block:hover { background: #dc2626 !important; color: #fff !important; }',
+		'.mosdns-pagination-bar { display: flex !important; justify-content: space-between !important; align-items: center !important; margin-top: 0.5rem !important; padding: 0.75rem 0.5rem 0.25rem 0.5rem !important; border-top: 1px solid var(--border-color-medium, rgba(125,125,125,0.15)) !important; flex-wrap: wrap !important; gap: 0.5rem !important; box-sizing: border-box !important; width: 100% !important; }',
+		'.mosdns-pagination-bar::after, .mosdns-pagination-bar::before { display: none !important; content: none !important; }',
+		'.mosdns-pagination-info { display: inline-flex !important; align-items: center !important; font-size: 0.85rem !important; opacity: 0.85 !important; }',
+		'.mosdns-pagination-btns { display: flex !important; gap: 0.5rem !important; margin-left: auto !important; }',
+		'.mosdns-page-input { height: 24px !important; line-height: 22px !important; text-align: center !important; font-size: 0.82rem !important; font-weight: 600 !important; padding: 0 4px !important; margin: 0 4px !important; border: 1px solid rgba(125,125,125,0.3) !important; border-radius: 4px !important; background: var(--cbi-section-bg, #fff) !important; color: inherit !important; display: inline-block !important; vertical-align: middle !important; box-sizing: border-box !important; transition: all 0.2s ease !important; }',
+		'.mosdns-page-input:focus { border-color: #3b82f6 !important; box-shadow: 0 0 0 2px rgba(59, 130, 246, 0.25) !important; outline: none !important; }',
+		'.mosdns-page-input::-webkit-outer-spin-button, .mosdns-page-input::-webkit-inner-spin-button { -webkit-appearance: none !important; margin: 0 !important; }',
+		'.mosdns-page-input[type=number] { -moz-appearance: textfield !important; }',
 		'@keyframes pulse { 0% { opacity: 1; } 50% { opacity: 0.4; } 100% { opacity: 1; } }',
 		'@media (prefers-color-scheme: dark) {',
+		'	.mosdns-pagination-bar { border-top-color: rgba(255,255,255,0.08) !important; }',
+		'	.mosdns-page-input { background: rgba(255,255,255,0.06) !important; border-color: rgba(255,255,255,0.18) !important; color: #fff !important; }',
 		'	.mosdns-stat-card, .mosdns-rank-panel, .mosdns-modal-meta-item, .mosdns-answer-row { background: rgba(255,255,255,0.03); border-color: rgba(255,255,255,0.08); box-shadow: none; }',
 		'	.mosdns-sparkline-tooltip { background: #1e242b; border-color: rgba(255,255,255,0.15); box-shadow: 0 4px 12px rgba(0,0,0,0.5); }',
 		'	.mosdns-log-row:hover { background: rgba(255,255,255,0.04); }',
@@ -864,7 +874,7 @@ const renderLogsTable = logsData => {
 			E('td', { class: 'td col-time', style: 'font-size: 0.82rem; opacity: 0.7; white-space: nowrap;' }, formatTimestamp(item.timestamp)),
 			E('td', {
 				class: 'td col-client mosdns-mono',
-				style: 'font-size: 0.82rem; max-width: 150px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;',
+				style: 'font-size: 0.82rem; max-width: 190px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;',
 				title: clientInfo.title
 			}, clientInfo.display),
 			E('td', { class: 'td col-domain', style: 'max-width: 320px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;', title: item.domain || '-' }, [
@@ -887,47 +897,99 @@ const renderLogsTable = logsData => {
 		]));
 	}

-	return E('div', {}, [
-		E('table', { class: 'table cbi-section-table mosdns-table', style: 'margin-top: 0.25rem;' }, [
-			E('tr', { class: 'tr table-titles' }, [
-				E('th', { class: 'th col-time', style: 'width: 85px;' }, _('Time')),
-				E('th', { class: 'th col-client', style: 'width: 125px;' }, _('Client IP')),
-				E('th', { class: 'th col-domain' }, _('Domain & Record')),
-				E('th', { class: 'th col-status', style: 'width: 90px;' }, _('Status')),
-				E('th', { class: 'th col-answers' }, _('Answers')),
-				E('th', { class: 'th col-latency', style: 'width: 80px; text-align: right;' }, _('Elapsed'))
-			]),
-			...rows
-		]),
+		const inputWidth = Math.max(46, (String(totalPages).length * 8 + 18)) + 'px';
+		const pageInput = E('input', {
+			type: 'number',
+			class: 'cbi-input-text mosdns-page-input',
+			min: 1,
+			max: totalPages,
+			value: pageIdx + 1,
+			style: `width: ${inputWidth};`,
+			title: _('Enter page number and press Enter to jump')
+		});

-		E('div', { style: 'display: flex; justify-content: space-between; align-items: center; margin-top: 0.75rem;' }, [
-			E('span', { style: 'font-size: 0.85rem; opacity: 0.7;' }, _('Page %d / %d (%d entries)').format(pageIdx + 1, totalPages, total)),
-			E('div', { style: 'display: flex; gap: 0.5rem;' }, [
-				E('button', {
-					class: 'btn cbi-button cbi-button-action',
-					disabled: pageIdx === 0 ? 'disabled' : null,
-					click: () => {
-						if (pageIdx > 0) {
-							pageIdx--;
-							updateLiveStatusBadge();
-							refreshLogs();
+		const doJump = () => {
+			const val = parseInt(pageInput.value, 10);
+			if (isNaN(val)) {
+				pageInput.value = pageIdx + 1;
+				return;
+			}
+			const targetPage = Math.max(1, Math.min(totalPages, val));
+			pageInput.value = targetPage;
+			if (targetPage - 1 !== pageIdx) {
+				pageIdx = targetPage - 1;
+				updateLiveStatusBadge();
+				refreshLogs();
+			}
+		};
+
+		pageInput.addEventListener('keydown', ev => {
+			if (ev.key === 'Enter') {
+				ev.preventDefault();
+				pageInput.blur();
+			}
+		});
+
+		pageInput.addEventListener('focus', () => {
+			pageInput.select();
+		});
+
+		pageInput.addEventListener('blur', () => {
+			doJump();
+		});
+
+		const pageParts = _('Page %d / %d (%d entries)').format(999999, totalPages, total).split('999999');
+		const paginationLabel = E('div', {
+			class: 'mosdns-pagination-info'
+		}, [
+			pageParts[0] || '',
+			pageInput,
+			pageParts[1] || ''
+		]);
+
+		return E('div', {}, [
+			E('table', { class: 'table cbi-section-table mosdns-table', style: 'margin-top: 0.25rem; margin-bottom: 0;' }, [
+				E('tr', { class: 'tr table-titles' }, [
+					E('th', { class: 'th col-time', style: 'width: 85px;' }, _('Time')),
+					E('th', { class: 'th col-client', style: 'width: 125px;' }, _('Client IP')),
+					E('th', { class: 'th col-domain' }, _('Domain & Record')),
+					E('th', { class: 'th col-status', style: 'width: 90px;' }, _('Status')),
+					E('th', { class: 'th col-answers' }, _('Answers')),
+					E('th', { class: 'th col-latency', style: 'width: 95px; text-align: right;' }, _('Elapsed'))
+				]),
+				...rows
+			]),
+
+			E('div', {
+				class: 'mosdns-pagination-bar'
+			}, [
+				paginationLabel,
+				E('div', { class: 'mosdns-pagination-btns' }, [
+					E('button', {
+						class: 'btn cbi-button cbi-button-action',
+						disabled: pageIdx === 0 ? 'disabled' : null,
+						click: () => {
+							if (pageIdx > 0) {
+								pageIdx--;
+								updateLiveStatusBadge();
+								refreshLogs();
+							}
 						}
-					}
-				}, _('Previous')),
-				E('button', {
-					class: 'btn cbi-button cbi-button-action',
-					disabled: (pageIdx + 1) >= totalPages ? 'disabled' : null,
-					click: () => {
-						if ((pageIdx + 1) < totalPages) {
-							pageIdx++;
-							updateLiveStatusBadge();
-							refreshLogs();
+					}, _('Previous')),
+					E('button', {
+						class: 'btn cbi-button cbi-button-action',
+						disabled: (pageIdx + 1) >= totalPages ? 'disabled' : null,
+						click: () => {
+							if ((pageIdx + 1) < totalPages) {
+								pageIdx++;
+								updateLiveStatusBadge();
+								refreshLogs();
+							}
 						}
-					}
-				}, _('Next'))
+					}, _('Next'))
+				])
 			])
-		])
-	]);
+		]);
 };

 const pollScheduler = async () => {
@@ -17,19 +17,19 @@ msgstr ""
 msgid "API Options"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:718
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:728
 msgid "Add domain to the blocklist to block DNS resolution:"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:717
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:727
 msgid "Add domain to the whitelist to permit DNS resolution:"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:710
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:720
 msgid "Add to Blocklist"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:710
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:720
 msgid "Add to Whitelist"
 msgstr ""

@@ -90,7 +90,7 @@ msgstr ""
 msgid "Aliyun Public DNS (DNS over QUIC)"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1026
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1088
 msgid "All Queries"
 msgstr ""

@@ -99,8 +99,8 @@ msgstr ""
 msgid "Another update is already in progress."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:805
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:897
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:815
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:957
 msgid "Answers"
 msgstr ""

@@ -108,7 +108,7 @@ msgstr ""
 msgid "Apple domains optimization"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1053
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1115
 msgid ""
 "Are you sure you want to clear all real-time query logs and top rankings?"
 msgstr ""
@@ -127,11 +127,11 @@ msgid ""
 "rules through scheduled tasks."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:478
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:488
 msgid "Average Processing Time"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:538
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:548
 msgid "Avg Processing"
 msgstr ""

@@ -155,8 +155,8 @@ msgid ""
 msgstr ""

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/rules.js:31
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:633
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:635
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:643
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:645
 msgid "Block Lists"
 msgstr ""

@@ -164,11 +164,11 @@ msgstr ""
 msgid "Block PTR"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1027
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1089
 msgid "Blocked Only"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:456
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:466
 msgid "Blocked by Filters"
 msgstr ""

@@ -190,16 +190,16 @@ msgstr ""
 msgid "Cache Prefetching"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1028
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1090
 msgid "Cached Only"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:467
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:477
 msgid "Cached Queries"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:730
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1058
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:740
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1120
 msgid "Cancel"
 msgstr ""

@@ -229,7 +229,7 @@ msgstr ""
 msgid "Cisco Public DNS (208.67.222.222)"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1078
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1140
 msgid "Clear"
 msgstr ""

@@ -237,22 +237,22 @@ msgstr ""
 msgid "Clear logs"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1049
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1052
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1111
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1114
 msgid "Clear query logs"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:861
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:878
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:871
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:888
 msgid "Click to view full details"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:787
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:894
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:797
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:954
 msgid "Client IP"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:832
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:842
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/update.js:35
 msgid "Close"
 msgstr ""
@@ -292,7 +292,7 @@ msgstr ""
 msgid "Configuration Editor"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:734
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:744
 msgid "Confirm"
 msgstr ""

@@ -330,7 +330,7 @@ msgstr ""
 msgid "DNS Forward"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:444
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:454
 msgid "DNS Queries Total"
 msgstr ""

@@ -374,20 +374,20 @@ msgstr ""
 msgid "DoH/TCP/DoT Connection Multiplexing idle timeout (default 30 seconds)"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:895
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:955
 msgid "Domain & Record"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:627
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:655
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:637
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:665
 msgid "Domain name cannot be empty."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:720
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:730
 msgid "Domain:"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:898
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:958
 msgid "Elapsed"
 msgstr ""

@@ -425,6 +425,10 @@ msgstr ""
 msgid "Enabled"
 msgstr ""

+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:908
+msgid "Enter page number and press Enter to jump"
+msgstr ""
+
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:505
 msgid "Enter the GeoIP.dat category to be exported, Allow add multiple tags"
 msgstr ""
@@ -478,7 +482,7 @@ msgstr ""
 msgid "Failed to clean logs."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1072
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1134
 msgid "Failed to clear query logs:"
 msgstr ""

@@ -486,15 +490,15 @@ msgstr ""
 msgid "Failed to start update."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:970
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1032
 msgid "Failed to update query logs:"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:699
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:709
 msgid "Failed to update rule file: %s"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1044
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1106
 msgid "First Page / Resume"
 msgstr ""

@@ -595,10 +599,10 @@ msgstr ""

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:410
 msgid ""
-"IPv4 CIDR: <a href=\"https://www.cloudflare.com/ips-v4\" "
-"target=\"_blank\">https://www.cloudflare.com/ips-v4</a> <br /> IPv6 CIDR: <a "
-"href=\"https://www.cloudflare.com/ips-v6\" target=\"_blank\">https://www."
-"cloudflare.com/ips-v6</a>"
+"IPv4 CIDR: <a href=\"https://www.cloudflare.com/ips-v4\" target=\"_blank"
+"\">https://www.cloudflare.com/ips-v4</a> <br /> IPv6 CIDR: <a href=\"https://"
+"www.cloudflare.com/ips-v6\" target=\"_blank\">https://www.cloudflare.com/ips-"
+"v6</a>"
 msgstr ""

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:190
@@ -621,7 +625,7 @@ msgstr ""
 msgid "Info"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:828
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:838
 msgid "Intercept"
 msgstr ""

@@ -631,7 +635,7 @@ msgid ""
 "seconds)."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:479
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:489
 msgid "Latency"
 msgstr ""

@@ -716,12 +720,12 @@ msgstr ""
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:33
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:106
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/logs.js:70
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1094
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1156
 #: luci-app-mosdns/root/usr/share/luci/menu.d/luci-app-mosdns.json:3
 msgid "MosDNS"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:510
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:520
 msgid ""
 "MosDNS API is unreachable. Please ensure MosDNS is running and stats_api "
 "plugin is enabled."
@@ -739,15 +743,15 @@ msgstr ""
 msgid "Netflix, Disney+, Hulu and streaming media rules list will use this DNS"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:927
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:989
 msgid "Next"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:768
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:778
 msgid "No DNS answer records returned."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:560
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:570
 msgid "No data available"
 msgstr ""

@@ -755,19 +759,19 @@ msgstr ""
 msgid "No log data."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:886
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:896
 msgid "No query log entries found."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:904
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:941
 msgid "Page %d / %d (%d entries)"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:438
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:448
 msgid "Per-query speed"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:821
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:831
 msgid "Permit"
 msgstr ""

@@ -802,7 +806,7 @@ msgstr ""
 msgid "Prevent DNS Leaks"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:916
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:978
 msgid "Previous"
 msgstr ""

@@ -821,7 +825,7 @@ msgstr ""
 msgid "Quad9 Public DNS (9.9.9.9)"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:811
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:821
 msgid "Query Log Details"
 msgstr ""

@@ -831,7 +835,7 @@ msgid ""
 "consume more memory)"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1067
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1129
 msgid "Query logs cleared successfully."
 msgstr ""

@@ -839,7 +843,7 @@ msgstr ""
 msgid "RUNNING"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1098
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1160
 msgid "Real-time Query Logs"
 msgstr ""

@@ -869,7 +873,7 @@ msgstr ""
 msgid "Ring Buffer Capacity"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:799
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:809
 msgid "Rule Hit"
 msgstr ""

@@ -889,7 +893,7 @@ msgstr ""
 msgid "Save the cache locally and reload the cache dump on the next startup"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1015
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1077
 msgid "Search domain or client IP..."
 msgstr ""

@@ -901,7 +905,7 @@ msgstr ""
 msgid "Starting update..."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1094
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1156
 #: luci-app-mosdns/root/usr/share/luci/menu.d/luci-app-mosdns.json:38
 msgid "Statistics"
 msgstr ""
@@ -910,7 +914,7 @@ msgstr ""
 msgid "Stats Dump"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:896
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:956
 msgid "Status"
 msgstr ""

@@ -930,7 +934,7 @@ msgstr ""
 msgid "TCP/DoT Connection Multiplexing"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:723
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:733
 msgid "Target file: %s (supports domain matching rules)"
 msgstr ""

@@ -966,20 +970,20 @@ msgid ""
 "content in yaml format."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:791
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:893
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:801
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:953
 msgid "Time"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:599
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:609
 msgid "Top Blocked Domains"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:606
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:616
 msgid "Top Clients"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:592
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:602
 msgid "Top Queried Domains"
 msgstr ""

@@ -1029,7 +1033,7 @@ msgstr ""
 msgid "Updating Database..."
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:795
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:805
 msgid "Upstream"
 msgstr ""

@@ -1051,8 +1055,8 @@ msgid ""
 msgstr ""

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/rules.js:23
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:633
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:635
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:643
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:645
 msgid "White Lists"
 msgstr ""

@@ -1070,15 +1074,15 @@ msgstr ""
 msgid "https://gh-proxy.com"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:427
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:540
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:437
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:550
 msgid "● Live"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:223
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:233
 msgid "● Live Auto-refresh"
 msgstr ""

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:227
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:237
 msgid "❚❚ Paused (Page %d)"
 msgstr ""
@@ -27,19 +27,19 @@ msgstr "API 监听端口"
 msgid "API Options"
 msgstr "API 选项"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:718
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:728
 msgid "Add domain to the blocklist to block DNS resolution:"
 msgstr "将域名添加到黑名单以拦截 DNS 解析："

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:717
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:727
 msgid "Add domain to the whitelist to permit DNS resolution:"
 msgstr "将域名添加到白名单以放行 DNS 解析："

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:710
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:720
 msgid "Add to Blocklist"
 msgstr "添加到黑名单"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:710
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:720
 msgid "Add to Whitelist"
 msgstr "添加到白名单"

@@ -105,7 +105,7 @@ msgstr "阿里云公共 DNS（DNS over HTTPS）"
 msgid "Aliyun Public DNS (DNS over QUIC)"
 msgstr "阿里云公共 DNS（DNS over QUIC）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1026
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1088
 msgid "All Queries"
 msgstr "所有查询"

@@ -114,8 +114,8 @@ msgstr "所有查询"
 msgid "Another update is already in progress."
 msgstr "另一个更新正在进行中。"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:805
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:897
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:815
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:957
 msgid "Answers"
 msgstr "应答结果"

@@ -123,7 +123,7 @@ msgstr "应答结果"
 msgid "Apple domains optimization"
 msgstr "Apple 域名解析优化"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1053
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1115
 msgid ""
 "Are you sure you want to clear all real-time query logs and top rankings?"
 msgstr "确定要清空所有实时查询日志和排行数据吗？"
@@ -142,11 +142,11 @@ msgid ""
 "rules through scheduled tasks."
 msgstr "通过定时任务自动更新 GeoIP 和 GeoSite 数据库以及广告过滤规则。"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:478
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:488
 msgid "Average Processing Time"
 msgstr "平均延迟"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:538
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:548
 msgid "Avg Processing"
 msgstr "平均处理"

@@ -172,8 +172,8 @@ msgstr ""
 "解析。"

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/rules.js:31
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:633
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:635
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:643
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:645
 msgid "Block Lists"
 msgstr "黑名单"

@@ -181,11 +181,11 @@ msgstr "黑名单"
 msgid "Block PTR"
 msgstr "PTR 黑名单"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1027
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1089
 msgid "Blocked Only"
 msgstr "仅拦截"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:456
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:466
 msgid "Blocked by Filters"
 msgstr "拦截总数"

@@ -207,16 +207,16 @@ msgstr "自动保存缓存"
 msgid "Cache Prefetching"
 msgstr "缓存预取"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1028
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1090
 msgid "Cached Only"
 msgstr "仅缓存"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:467
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:477
 msgid "Cached Queries"
 msgstr "缓存命中"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:730
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1058
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:740
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1120
 msgid "Cancel"
 msgstr "取消"

@@ -246,7 +246,7 @@ msgstr "思科公共 DNS（208.67.220.220）"
 msgid "Cisco Public DNS (208.67.222.222)"
 msgstr "思科公共 DNS（208.67.222.222）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1078
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1140
 msgid "Clear"
 msgstr "清空"

@@ -254,22 +254,22 @@ msgstr "清空"
 msgid "Clear logs"
 msgstr "清空日志"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1049
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1052
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1111
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1114
 msgid "Clear query logs"
 msgstr "清除查询日志"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:861
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:878
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:871
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:888
 msgid "Click to view full details"
 msgstr "点击查看完整详情"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:787
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:894
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:797
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:954
 msgid "Client IP"
 msgstr "客户端 IP"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:832
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:842
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/update.js:35
 msgid "Close"
 msgstr "关闭"
@@ -309,7 +309,7 @@ msgstr "配置文件"
 msgid "Configuration Editor"
 msgstr "配置编辑器"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:734
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:744
 msgid "Confirm"
 msgstr "确认"

@@ -348,7 +348,7 @@ msgstr "DNS 缓存大小"
 msgid "DNS Forward"
 msgstr "DNS 转发"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:444
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:454
 msgid "DNS Queries Total"
 msgstr "DNS 查询总数"

@@ -393,20 +393,20 @@ msgstr ""
 msgid "DoH/TCP/DoT Connection Multiplexing idle timeout (default 30 seconds)"
 msgstr "DoH/TCP/DoT 连接复用空闲保持时间（默认 30 秒）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:895
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:955
 msgid "Domain & Record"
 msgstr "域名与类型"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:627
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:655
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:637
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:665
 msgid "Domain name cannot be empty."
 msgstr "域名不能为空"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:720
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:730
 msgid "Domain:"
 msgstr "域名："

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:898
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:958
 msgid "Elapsed"
 msgstr "耗时"

@@ -444,6 +444,10 @@ msgstr "启用此选项 fallback 策略会强制转发到远程 DNS"
 msgid "Enabled"
 msgstr "启用"

+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:908
+msgid "Enter page number and press Enter to jump"
+msgstr "输入页码并按回车跳转"
+
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:505
 msgid "Enter the GeoIP.dat category to be exported, Allow add multiple tags"
 msgstr "输入需要导出的 GeoIP.dat 类别条目，允许添加多个标签"
@@ -497,7 +501,7 @@ msgstr "导出目录：/var/mosdns"
 msgid "Failed to clean logs."
 msgstr "清理日志失败：%s"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1072
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1134
 msgid "Failed to clear query logs:"
 msgstr "清除查询日志失败："

@@ -505,15 +509,15 @@ msgstr "清除查询日志失败："
 msgid "Failed to start update."
 msgstr "启动更新失败"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:970
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1032
 msgid "Failed to update query logs:"
 msgstr "更新查询日志失败："

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:699
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:709
 msgid "Failed to update rule file: %s"
 msgstr "更新规则文件失败: %s"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1044
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1106
 msgid "First Page / Resume"
 msgstr "重置并恢复"

@@ -614,15 +618,15 @@ msgstr "IP 地址"

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:410
 msgid ""
-"IPv4 CIDR: <a href=\"https://www.cloudflare.com/ips-v4\" "
-"target=\"_blank\">https://www.cloudflare.com/ips-v4</a> <br /> IPv6 CIDR: <a "
-"href=\"https://www.cloudflare.com/ips-v6\" target=\"_blank\">https://www."
-"cloudflare.com/ips-v6</a>"
+"IPv4 CIDR: <a href=\"https://www.cloudflare.com/ips-v4\" target=\"_blank"
+"\">https://www.cloudflare.com/ips-v4</a> <br /> IPv6 CIDR: <a href=\"https://"
+"www.cloudflare.com/ips-v6\" target=\"_blank\">https://www.cloudflare.com/ips-"
+"v6</a>"
 msgstr ""
-"IPv4 CIDR: <a href=\"https://www.cloudflare.com/ips-v4\" "
-"target=\"_blank\">https://www.cloudflare.com/ips-v4</a> <br /> IPv6 CIDR: <a "
-"href=\"https://www.cloudflare.com/ips-v6\" target=\"_blank\">https://www."
-"cloudflare.com/ips-v6</a>"
+"IPv4 CIDR: <a href=\"https://www.cloudflare.com/ips-v4\" target=\"_blank"
+"\">https://www.cloudflare.com/ips-v4</a> <br /> IPv6 CIDR: <a href=\"https://"
+"www.cloudflare.com/ips-v6\" target=\"_blank\">https://www.cloudflare.com/ips-"
+"v6</a>"

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:190
 msgid ""
@@ -644,7 +648,7 @@ msgstr "空闲超时"
 msgid "Info"
 msgstr "信息"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:828
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:838
 msgid "Intercept"
 msgstr "拦截"

@@ -654,7 +658,7 @@ msgid ""
 "seconds)."
 msgstr "后台线程扫描缓存以进行预取的时间间隔（单位：秒）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:479
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:489
 msgid "Latency"
 msgstr "延迟"

@@ -742,12 +746,12 @@ msgstr "修改 DNS 应答结果的最小 TTL 值 (秒)，0 表示不修改"
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:33
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/basic.js:106
 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/logs.js:70
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1094
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1156
 #: luci-app-mosdns/root/usr/share/luci/menu.d/luci-app-mosdns.json:3
 msgid "MosDNS"
 msgstr "MosDNS"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:510
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:520
 msgid ""
 "MosDNS API is unreachable. Please ensure MosDNS is running and stats_api "
 "plugin is enabled."
@@ -767,15 +771,15 @@ msgstr "未运行"
 msgid "Netflix, Disney+, Hulu and streaming media rules list will use this DNS"
 msgstr "自定义 Netflix、Disney+、Hulu 以及 “流媒体” 规则列表的 DNS 服务器"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:927
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:989
 msgid "Next"
 msgstr "下一页"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:768
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:778
 msgid "No DNS answer records returned."
 msgstr "无 DNS 应答记录"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:560
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:570
 msgid "No data available"
 msgstr "暂无数据"

@@ -783,19 +787,19 @@ msgstr "暂无数据"
 msgid "No log data."
 msgstr "无日志数据。"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:886
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:896
 msgid "No query log entries found."
 msgstr "未找到查询日志记录。"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:904
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:941
 msgid "Page %d / %d (%d entries)"
 msgstr "第 %d / %d 页（%d 条记录）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:438
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:448
 msgid "Per-query speed"
 msgstr "单次查询速度"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:821
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:831
 msgid "Permit"
 msgstr "放行"

@@ -832,7 +836,7 @@ msgstr "当剩余 TTL 小于此值（秒）时触发预取"
 msgid "Prevent DNS Leaks"
 msgstr "防止 DNS 泄漏"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:916
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:978
 msgid "Previous"
 msgstr "上一页"

@@ -851,7 +855,7 @@ msgstr "Quad9 公共 DNS（149.112.112.112）"
 msgid "Quad9 Public DNS (9.9.9.9)"
 msgstr "Quad9 公共 DNS（9.9.9.9）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:811
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:821
 msgid "Query Log Details"
 msgstr "查询日志详情"

@@ -861,7 +865,7 @@ msgid ""
 "consume more memory)"
 msgstr "查询日志环形缓冲区容量（FIFO 覆盖，默认 2000，数值越大占用内存越多）"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1067
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1129
 msgid "Query logs cleared successfully."
 msgstr "查询日志清除成功。"

@@ -869,7 +873,7 @@ msgstr "查询日志清除成功。"
 msgid "RUNNING"
 msgstr "运行中"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1098
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1160
 msgid "Real-time Query Logs"
 msgstr "实时查询日志"

@@ -901,7 +905,7 @@ msgstr "远程 DNS 服务器"
 msgid "Ring Buffer Capacity"
 msgstr "环形缓冲区容量"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:799
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:809
 msgid "Rule Hit"
 msgstr "命中规则"

@@ -921,7 +925,7 @@ msgstr "保存统计数据与查询日志在本地，并在下次启动时重新
 msgid "Save the cache locally and reload the cache dump on the next startup"
 msgstr "保存缓存到本地文件，以供下次启动时重新载入使用"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1015
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1077
 msgid "Search domain or client IP..."
 msgstr "搜索域名或客户端 IP..."

@@ -933,7 +937,7 @@ msgstr "设置日志文件的最大容量（单位：MB）。"
 msgid "Starting update..."
 msgstr "正在启动更新..."

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1094
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:1156
 #: luci-app-mosdns/root/usr/share/luci/menu.d/luci-app-mosdns.json:38
 msgid "Statistics"
 msgstr "统计"
@@ -942,7 +946,7 @@ msgstr "统计"
 msgid "Stats Dump"
 msgstr "自动保存统计"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:896
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:956
 msgid "Status"
 msgstr "状态"

@@ -962,7 +966,7 @@ msgstr "支持本地文件，例如：file:///var/mosdns/example.txt"
 msgid "TCP/DoT Connection Multiplexing"
 msgstr "TCP/DoT 连接复用"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:723
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:733
 msgid "Target file: %s (supports domain matching rules)"
 msgstr "目标文件: %s (支持域名匹配规则)"

@@ -1002,20 +1006,20 @@ msgstr ""
 "这是文件 “/etc/mosdns/config_custom.yaml” 的内容，您的 MosDNS 配置将从此文件"
 "生成。仅接受 yaml 格式的配置内容。"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:791
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:893
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:801
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:953
 msgid "Time"
 msgstr "时间"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:599
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:609
 msgid "Top Blocked Domains"
 msgstr "拦截域名 (Top 10)"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:606
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:616
 msgid "Top Clients"
 msgstr "活跃客户端 (Top 10)"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:592
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:602
 msgid "Top Queried Domains"
 msgstr "查询域名 (Top 10)"

@@ -1065,7 +1069,7 @@ msgstr "更新成功"
 msgid "Updating Database..."
 msgstr "更新数据库..."

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:795
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:805
 msgid "Upstream"
 msgstr "上游服务器"

@@ -1091,8 +1095,8 @@ msgstr ""
 "则）"

 #: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/rules.js:23
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:633
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:635
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:643
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:645
 msgid "White Lists"
 msgstr "白名单"

@@ -1110,24 +1114,15 @@ msgstr "信风公共 DNS（114.114.115.115）"
 msgid "https://gh-proxy.com"
 msgstr "https://gh-proxy.com"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:427
-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:540
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:437
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:550
 msgid "● Live"
 msgstr "● 实时"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:223
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:233
 msgid "● Live Auto-refresh"
 msgstr "● 实时刷新"

-#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:227
+#: luci-app-mosdns/htdocs/luci-static/resources/view/mosdns/statistics.js:237
 msgid "❚❚ Paused (Page %d)"
 msgstr "❚❚ 暂停 (第 %d 页)"
-
-#~ msgid "Action"
-#~ msgstr "操作"
-
-#~ msgid "Add %s to Blocklist"
-#~ msgstr "将 %s 添加到黑名单"
-
-#~ msgid "Add %s to Whitelist"
-#~ msgstr "将 %s 添加到白名单"
@@ -429,7 +429,11 @@ generate_config() {
 	json_add_string "exec" "\$modify_ddns_ttl"
 	json_close_object
 	json_add_object
-	json_add_string "matches" "!qname \$ddnslist"
+	json_add_array "matches"
+	json_add_string "" "!qname \$ddnslist"
+	json_add_string "" "!qname \$blocklist"
+	json_add_string "" "!qname \$adlist"
+	json_close_array
 	json_add_string "exec" "\$modify_ttl"
 	json_close_object
 	[ "$cloudflare" -eq 1 ] && {
@@ -571,6 +575,22 @@ generate_config() {
 	json_add_array "args"
 	json_add_object
 	json_add_string "matches" "qname \$blocklist"
+	json_add_string "exec" "black_hole 0.0.0.0 ::"
+	json_close_object
+	json_add_object
+	json_add_string "matches" "qname \$adlist"
+	json_add_string "exec" "black_hole 0.0.0.0 ::"
+	json_close_object
+	json_add_object
+	json_add_string "matches" "has_resp"
+	json_add_string "exec" "ttl 3600"
+	json_close_object
+	json_add_object
+	json_add_string "matches" "has_resp"
+	json_add_string "exec" "accept"
+	json_close_object
+	json_add_object
+	json_add_string "matches" "qname \$blocklist"
 	json_add_string "exec" "reject 3"
 	json_close_object
 	json_add_object
@@ -72,7 +72,7 @@ function get_adlist() {
 	let adblock = uci_cursor.get('mosdns', 'config', 'adblock');

 	if (adblock !== '1') {
-		mkdir('/etc/mosdns/rule', 0755);
+		mkdir('/var/mosdns', 0755);
 		exec_sys('rm -rf /etc/mosdns/rule/adlist /etc/mosdns/rule/.ad_source');
 		writefile('/var/mosdns/disable-ads.txt', '');
 		print("/var/mosdns/disable-ads.txt\n");
@@ -7,7 +7,7 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-passwall
-PKG_VERSION:=26.9.1
+PKG_VERSION:=26.9.9
 PKG_RELEASE:=1
 PKG_PO_VERSION:=$(PKG_VERSION)

@@ -164,9 +164,17 @@ define Package/$(PKG_NAME)/conffiles
 /usr/share/passwall/rules/domains_excluded
 endef

+define Package/$(PKG_NAME)/postinst
+#!/bin/sh
+rm -f $${IPKG_INSTROOT}/usr/share/passwall/rules/*.nft
+rm -rf $${IPKG_INSTROOT}/tmp/etc/passwall_tmp
+exit 0
+endef
+
 define Package/$(PKG_NAME)/postrm
 #!/bin/sh
 rm -f $${IPKG_INSTROOT}/usr/share/passwall/rules/*.nft
+rm -rf $${IPKG_INSTROOT}/tmp/etc/passwall_tmp
 exit 0
 endef

@@ -61,14 +61,11 @@ function getOption(config, section, opt) {
 	const id = `cbid.${config}.${section}.${opt}`;
 	obj = document.getElementsByName(id)[0] || document.getElementById(id);
 	if (obj) {
+		//lua luci combobox
 		const combobox = document.getElementById('cbi.combobox.' + id);
 		if (combobox) {
 			obj.combobox = combobox;
 		}
-		const div = document.getElementById(id);
-		if (div && div.getElementsByTagName("li").length > 0) {
-			obj = div;
-		}
 		return obj;
 	} else {
 		return null;
@@ -479,7 +479,21 @@ function add_node()
 		uci_set(uid, "group", group)
 	end

-	uci_set(uid, "type", "Socks")
+	if api.is_finded("ipt2socks") then
+		uci_set(uid, "type", "Socks")
+	elseif api.finded_com("sing-box") then
+		uci_set(uid, "type", "sing-box")
+	elseif api.finded_com("xray") then
+		uci_set(uid, "type", "Xray")
+	elseif api.is_finded("sslocal") then
+		uci_set(uid, "type", "SS-Rust")
+	elseif api.is_finded("ssr-local") then
+		uci_set(uid, "type", "SSR")
+	elseif api.finded_com("hysteria") then
+		uci_set(uid, "type", "Hysteria2")
+	elseif api.is_finded("naive") then
+		uci_set(uid, "type", "Naiveproxy")
+	end

 	if redirect == "1" then
 		uci_save()
@@ -852,9 +866,13 @@ local backup_files = {
 function create_backup()
 	local date = os.date("%y%m%d%H%M")
 	local tar_file = "/tmp/passwall-" .. date .. "-backup.tar.gz"
+	local version_file = "/tmp/passwall-version"
+	local version = api.get_version()
 	fs.remove(tar_file)
-	local cmd = "tar -czf " .. tar_file .. " " .. table.concat(backup_files, " ")
+	fs.writefile(version_file, version .. "\n")
+	local cmd = "tar -czf " .. tar_file .. " " .. table.concat(backup_files, " ") .. " " .. "-C /tmp passwall-version"
 	luci.sys.call(cmd)
+	fs.remove(version_file)
 	http.header("Content-Disposition", "attachment; filename=passwall-" .. date .. "-backup.tar.gz")
 	http.header("X-Backup-Filename", "passwall-" .. date .. "-backup.tar.gz")
 	http.prepare_content("application/octet-stream")
@@ -895,7 +913,12 @@ function restore_backup()
 			uci:revert(c_config)
 			uci:revert(api.s_config)
 			luci.sys.call("echo '' > /tmp/log/passwall.log")
-			api.log(" * PassWall 配置文件上传成功…")
+			api.log(" * PassWall 备份文件上传成功…")
+			local version_file = "passwall-version"
+			local version = luci.sys.exec("tar -xOf " .. file_path .. " " .. version_file .. " 2>/dev/null"):match("^%s*(.-)%s*$")
+			if version and version ~= "" then
+				api.log(" * 备份文件由 PassWall " .. version .. " 生成。")
+			end
 			local temp_dir = '/tmp/passwall_bak'
 			luci.sys.call("mkdir -p " .. temp_dir)
 			if luci.sys.call("tar -xzf " .. file_path .. " -C " .. temp_dir) == 0 then
@@ -909,8 +932,9 @@ function restore_backup()
 					end
 				end
 				if type == "all" or type == "client" then
-					api.log(" * PassWall 配置还原成功…")
+					api.log(" * PassWall 备份还原成功…")
 					api.log(" * 重启 PassWall 服务中…\n")
+					api.sh_uci_set(c_config, "@global[0]", "flush_set", "1", true)
 					luci.sys.call('/etc/init.d/passwall restart > /dev/null 2>&1 &')
 				end
 				if type == "all" or type == "server" then
@@ -918,7 +942,7 @@ function restore_backup()
 				end
 				result = { status = "success", message = "Upload completed", path = file_path }
 			else
-				api.log(" * PassWall 配置文件解压失败，请重试！")
+				api.log(" * PassWall 备份文件解压失败，请重试！")
 				result = { status = "error", message = "Decompression failed" }
 			end
 			luci.sys.call("rm -rf " .. temp_dir)
@@ -47,20 +47,23 @@ end

 -- [[ ACLs Settings ]]--
 s = m:section(NamedSection, arg[1], translate("ACLs"), translate("ACLs"))
-s.addremove = false
-s.dynamic = false
+
+s:tab("Main", translate("Main"))
+s:tab("Proxy", translate("Proxy"))
+s:tab("DNS", translate("DNS"))
+s:tab("Log", translate("Log"))

 ---- Enable
-o = s:option(Flag, "enabled", translate("Enable"))
+o = s:taboption("Main", Flag, "enabled", translate("Enable"))
 o.default = 1
 o.rmempty = false

 ---- Remarks
-o = s:option(Value, "remarks", translate("Remarks"))
+o = s:taboption("Main", Value, "remarks", translate("Remarks"))
 o.default = arg[1]
 o.rmempty = false

-o = s:option(Value, "interface", translate("Source Interface"))
+o = s:taboption("Main", Value, "interface", translate("Source Interface"))
 o:value("", translate("All"))
 local iface = api.get_network_devices()
 for _, d in ipairs(iface) do
@@ -94,7 +97,7 @@ table.sort(mac_t, function(a,b)
 end)

 ---- Source
-sources = s:option(DynamicList, "sources", translate("Source"))
+sources = s:taboption("Main", DynamicList, "sources", translate("Source"))
 sources.description = "<ul><li>" .. translate("Example:")
 .. "</li><li>" .. translate("MAC") .. ": 00:00:00:FF:FF:FF"
 .. "</li><li>" .. translate("IP") .. ": 192.168.1.100"
@@ -152,13 +155,14 @@ sources.validate = function(self, value, t)
 	return value
 end

-o = s:option(ListValue, "mode", translate("Mode"))
+local NODE = m:get("@global[0]", "node") or ""
+o = s:taboption("Main", ListValue, "mode", translate("Mode"))
 o:value("0", translate("No Proxy"))
 o:value("1", translate("Proxy"))

 ---- TCP No Redir Ports
 local TCP_NO_REDIR_PORTS = m:get("@global_forwarding[0]", "tcp_no_redir_ports")
-o = s:option(Value, "tcp_no_redir_ports", translate("TCP No Redir Ports"))
+o = s:taboption("Proxy", Value, "tcp_no_redir_ports", translate("TCP No Redir Ports"))
 o:value("", translate("Use global config") .. "(" .. TCP_NO_REDIR_PORTS .. ")")
 o:value("disable", translate("No patterns are used"))
 o:value("1:65535", translate("All"))
@@ -167,7 +171,7 @@ o.validate = port_validate

 ---- UDP No Redir Ports
 local UDP_NO_REDIR_PORTS = m:get("@global_forwarding[0]", "udp_no_redir_ports")
-o = s:option(Value, "udp_no_redir_ports", translate("UDP No Redir Ports"),
+o = s:taboption("Proxy", Value, "udp_no_redir_ports", translate("UDP No Redir Ports"),
 	"<font color='red'>" .. 
 		translate("Fill in the ports you don't want to be forwarded by the agent, with the highest priority.") ..
 	"</font>")
@@ -177,53 +181,48 @@ o:value("1:65535", translate("All"))
 o:depends("mode", "1")
 o.validate = port_validate

-o = s:option(DummyValue, "_hide_node_option", "")
-o.template = m:template_path("/cbi/hidevalue")
-o.value = "1"
+o = s:taboption("Main", HideValue, "_hide_node_option", "")
 o:depends("mode", "0")
 o:depends({ tcp_no_redir_ports = "1:65535", udp_no_redir_ports = "1:65535" })
 if TCP_NO_REDIR_PORTS == "1:65535" and UDP_NO_REDIR_PORTS == "1:65535" then
 	o:depends({ tcp_no_redir_ports = "", udp_no_redir_ports = "" })
 end

-o = s:option(Flag, "use_global_config", translatef("Use global config"))
+o = s:taboption("Main", Flag, "use_global_config", translatef("Use global config"))
 o.default = "0"
 o.rmempty = false
-o:depends({ _hide_node_option = "1",  ['!reverse'] = true })
+o:depends({ _hide_node_option = "1", ['!reverse'] = true })

-o = s:option(ListValue, "node", "<a style='color: red'>" .. translate("Proxy Node") .. "</a>")
+o = s:taboption("Main", ListValue, "node", "<a style='color: red'>" .. translate("Proxy Node") .. "</a>")
 o.group = {}
 o:depends({ _hide_node_option = false, use_global_config = false })
 o.template = m:template_path("/cbi/nodes_listvalue")
+o.description = translate("Use global configuration when using the global node.")

-current_node_id = o:formvalue(arg[1])
-if not current_node_id then
-	current_node_id = m:get(arg[1], "node")
+current_node_id = m:get(arg[1], "node")
+local node_value = s.fields["node"]:formvalue(s.section)
+if node_value then
+	current_node_id = node_value
 end
 current_node = current_node_id and m:get(current_node_id) or {}

-o = s:option(DummyValue, "_acl_node_bool", "")
-o.template = m:template_path("/cbi/hidevalue")
-o.value = "1"
-o:depends({ node = "",  ['!reverse'] = true })
+o = s:taboption("Main", HideValue, "node_save_before", "")
+o.value = current_node[".name"]
+o.cbid = function(self, section) return "node_save_before" end

---- Log
-o = s:option(Flag, "log", translate("Enable Node Log"))
-o.default = 0
-o.rmempty = false
-o:depends({ _hide_node_option = false, use_global_config = false })
+o = s:taboption("Main", HideValue, "_acl_node_bool", "")
+o:depends({ node = "", ['!reverse'] = true })

-o = s:option(ListValue, "loglevel", "Sing-Box/Xray " .. translate("Log Level"))
-o.default = "warn"
-o:value("debug", "Debug")
-o:value("info", "Info")
-o:value("warn", "Warning")
-o:value("error", "Error")
-o:depends("log", "1")
+o = s:taboption("Main", HideValue, "_diff_global_node", "")
+if NODE ~= "" then
+	o:depends({ node = NODE, ['!reverse'] = true })
+else
+	o:depends({ _acl_node_bool = "1" })
+end

 ---- TCP Proxy Drop Ports
 local TCP_PROXY_DROP_PORTS = m:get("@global_forwarding[0]", "tcp_proxy_drop_ports")
-o = s:option(Value, "tcp_proxy_drop_ports", translate("TCP Proxy Drop Ports"))
+o = s:taboption("Proxy", Value, "tcp_proxy_drop_ports", translate("TCP Proxy Drop Ports"))
 o:value("", translate("Use global config") .. "(" .. TCP_PROXY_DROP_PORTS .. ")")
 o:value("disable", translate("No patterns are used"))
 o.validate = port_validate
@@ -232,7 +231,7 @@ o:depends({ _acl_node_bool = "1" })

 ---- UDP Proxy Drop Ports
 local UDP_PROXY_DROP_PORTS = m:get("@global_forwarding[0]", "udp_proxy_drop_ports")
-o = s:option(Value, "udp_proxy_drop_ports", translate("UDP Proxy Drop Ports"))
+o = s:taboption("Proxy", Value, "udp_proxy_drop_ports", translate("UDP Proxy Drop Ports"))
 o:value("", translate("Use global config") .. "(" .. UDP_PROXY_DROP_PORTS .. ")")
 o:value("disable", translate("No patterns are used"))
 o:value("443", translate("QUIC"))
@@ -242,7 +241,7 @@ o:depends({ _acl_node_bool = "1" })

 ---- TCP Redir Ports
 local TCP_REDIR_PORTS = m:get("@global_forwarding[0]", "tcp_redir_ports")
-o = s:option(Value, "tcp_redir_ports", translate("TCP Redir Ports"), translatef("Only work with using the %s node.", "TCP"))
+o = s:taboption("Proxy", Value, "tcp_redir_ports", translate("TCP Redir Ports"), translatef("Only work with using the %s node.", "TCP"))
 o:value("", translate("Use global config") .. "(" .. TCP_REDIR_PORTS .. ")")
 o:value("1:65535", translate("All"))
 o:value("80,443", "80,443")
@@ -254,7 +253,7 @@ o:depends({ _acl_node_bool = "1" })

 ---- UDP Redir Ports
 local UDP_REDIR_PORTS = m:get("@global_forwarding[0]", "udp_redir_ports")
-o = s:option(Value, "udp_redir_ports", translate("UDP Redir Ports"), translatef("Only work with using the %s node.", "UDP"))
+o = s:taboption("Proxy", Value, "udp_redir_ports", translate("UDP Redir Ports"), translatef("Only work with using the %s node.", "UDP"))
 o:value("", translate("Use global config") .. "(" .. UDP_REDIR_PORTS .. ")")
 o:value("1:65535", translate("All"))
 o:value("53", "53")
@@ -262,7 +261,7 @@ o.validate = port_validate
 o:depends({ use_global_config = true })
 o:depends({ _acl_node_bool = "1" })

-o = s:option(DummyValue, "tips", "　")
+o = s:taboption("Proxy", DummyValue, "tips", "　")
 o.rawhtml = true
 o.cfgvalue = function(t, n)
 	return string.format('<font color="red">%s</font>',
@@ -271,71 +270,67 @@ end
 o:depends({ use_global_config = true })
 o:depends({ _acl_node_bool = "1" })

-o = s:option(Flag, "use_direct_list", translatef("Use %s", translate("Direct List")))
+o = s:taboption("Proxy", Flag, "use_direct_list", translatef("Use %s", translate("Direct List")))
 o.default = "1"
-o:depends({ _acl_node_bool = "1" })
+o:depends({ _acl_node_bool = "1", _diff_global_node = "1" })

-o = s:option(Flag, "use_proxy_list", translatef("Use %s", translate("Proxy List")))
+o = s:taboption("Proxy", Flag, "use_proxy_list", translatef("Use %s", translate("Proxy List")))
 o.default = "1"
-o:depends({ _acl_node_bool = "1" })
+o:depends({ _acl_node_bool = "1", _diff_global_node = "1" })

-o = s:option(Flag, "use_block_list", translatef("Use %s", translate("Block List")))
+o = s:taboption("Proxy", Flag, "use_block_list", translatef("Use %s", translate("Block List")))
 o.default = "1"
-o:depends({ _acl_node_bool = "1" })
+o:depends({ _acl_node_bool = "1", _diff_global_node = "1" })

 if has_gfwlist then
-	o = s:option(Flag, "use_gfw_list", translatef("Use %s", translate("GFW List")))
+	o = s:taboption("Proxy", Flag, "use_gfw_list", translatef("Use %s", translate("GFW List")))
 	o.default = "1"
-	o:depends({ _acl_node_bool = "1" })
+	o:depends({ _acl_node_bool = "1", _diff_global_node = "1" })
 end

 if has_chnlist or has_chnroute then
-	o = s:option(ListValue, "chn_list", translate("China List"))
+	o = s:taboption("Proxy", ListValue, "chn_list", translate("China List"))
 	o:value("0", translate("Close(Not use)"))
 	o:value("direct", translate("Direct Connection"))
 	o:value("proxy", translate("Proxy"))
 	o.default = "direct"
-	o:depends({ _acl_node_bool = "1" })
+	o:depends({ _acl_node_bool = "1", _diff_global_node = "1" })
 end

-o = s:option(ListValue, "tcp_proxy_mode", "TCP " .. translate("Proxy Mode"))
+o = s:taboption("Proxy", ListValue, "tcp_proxy_mode", "TCP " .. translate("Proxy Mode"))
 o:value("disable", translate("No Proxy"))
 o:value("proxy", translate("Proxy"))
-o:depends({ _acl_node_bool = "1" })
+o:depends({ _acl_node_bool = "1", _diff_global_node = "1" })

-o = s:option(ListValue, "udp_proxy_mode", "UDP " .. translate("Proxy Mode"))
+o = s:taboption("Proxy", ListValue, "udp_proxy_mode", "UDP " .. translate("Proxy Mode"))
 o:value("disable", translate("No Proxy"))
 o:value("proxy", translate("Proxy"))
-o:depends({ _acl_node_bool = "1" })
+o:depends({ _acl_node_bool = "1", _diff_global_node = "1" })

-o = s:option(DummyValue, "switch_mode", " ")
+o = s:taboption("Proxy", DummyValue, "switch_mode", "")
 o.template = m:template_path("/global/proxy")
-o:depends({ _acl_node_bool = "1" })
+o:depends({ _acl_node_bool = "1", _diff_global_node = "1" })

 -- Node → DNS Depends Settings
-o = s:option(DummyValue, "_node_sel_shunt", "")
-o.template = m:template_path("/cbi/hidevalue")
-o.value = "1"
+o = s:taboption("Main", HideValue, "_node_sel_shunt", "")
 o:depends({ node = "__always__" })

-o = s:option(DummyValue, "_node_sel_other", "")
-o.template = m:template_path("/cbi/hidevalue")
-o.value = "1"
-o:depends({ _node_sel_shunt = "1",  ['!reverse'] = true })
+o = s:taboption("Main", HideValue, "_node_sel_other", "")
+o:depends({ _node_sel_shunt = "1", ['!reverse'] = true })

 ---- DNS
-o = s:option(ListValue, "dns_shunt", "DNS " .. translate("Shunt"))
+o = s:taboption("DNS", ListValue, "dns_shunt", "DNS " .. translate("Shunt"))
 o.default = "chinadns-ng"
 o:value("dnsmasq", "Dnsmasq")
 o:value("chinadns-ng", translate("ChinaDNS-NG (recommended)"))
-o:depends({ _acl_node_bool = "1" })
+o:depends({ _acl_node_bool = "1", _diff_global_node = "1" })

-o = s:option(Flag, "filter_proxy_ipv6", translate("Filter Proxy Host IPv6"), translate("Experimental feature."))
+o = s:taboption("DNS", Flag, "filter_proxy_ipv6", translate("Filter Proxy Host IPv6"), translate("Experimental feature."))
 o.default = "0"
-o:depends({ _acl_node_bool = "1" })
+o:depends({ _acl_node_bool = "1", _diff_global_node = "1" })

 ---- DNS Forward Mode
-o = s:option(ListValue, "dns_mode", translate("Filter Mode"))
+o = s:taboption("DNS", ListValue, "dns_mode", translate("Filter Mode"))
 if api.is_finded("dns2socks") then
 	o:value("dns2socks", "dns2socks")
 end
@@ -345,7 +340,7 @@ end
 if has_xray then
 	o:value("xray", "Xray")
 end
-o:depends({ _acl_node_bool = "1", _node_sel_other = "1" })
+o:depends({ _acl_node_bool = "1", _node_sel_other = "1", _diff_global_node = "1" })
 o.write = function(self, section, value)
 	if value == "dns2socks" then
 		m:del(section, "v2ray_dns_mode")
@@ -374,7 +369,7 @@ o.remove = function(self, section)
 	end
 end

-o = s:option(ListValue, "xray_dns_mode", translate("Request protocol"))
+o = s:taboption("DNS", ListValue, "xray_dns_mode", translate("Request protocol"))
 o.default = "tcp"
 o:value("tcp", "TCP")
 o:value("udp", "UDP")
@@ -389,12 +384,14 @@ o.write = function(self, section, value)
 	end
 end

-o = s:option(ListValue, "singbox_dns_mode", translate("Request protocol"))
+o = s:taboption("DNS", ListValue, "singbox_dns_mode", translate("Request protocol"))
 o.default = "tcp"
 o:value("tcp", "TCP")
 o:value("udp", "UDP")
 o:value("doh", "DoH")
 o:value("http3", "HTTP3(DoH3)")
+o:value("tls", "TLS(DoT)")
+o:value("quic", "QUIC(DoQ)")
 o:depends("dns_mode", "sing-box")
 o.cfgvalue = function(self, section)
 	return m:get(section, "v2ray_dns_mode")
@@ -406,7 +403,7 @@ o.write = function(self, section, value)
 end

 ---- DNS Forward
-o = s:option(Value, "remote_dns", translate("Remote DNS"))
+o = s:taboption("DNS", Value, "remote_dns", translate("Remote DNS"))
 o.datatype = "or(ipaddr,ipaddrport(1))"
 o.default = "1.1.1.1"
 o:value("1.1.1.1", "1.1.1.1 (CloudFlare)")
@@ -422,8 +419,10 @@ o:depends({xray_dns_mode = "udp"})
 o:depends({xray_dns_mode = "tcp"})
 o:depends({singbox_dns_mode = "udp"})
 o:depends({singbox_dns_mode = "tcp"})
+o:depends({singbox_dns_mode = "tls"})
+o:depends({singbox_dns_mode = "quic"})

-o = s:option(Value, "remote_dns_doh", translate("Remote DNS DoH"))
+o = s:taboption("DNS", Value, "remote_dns_doh", translate("Remote DNS DoH"))
 o.description = translate("Format: URL[,IP] (optional IP to map the domain in the URL)")
 o:value("https://1.1.1.1/dns-query", "1.1.1.1 (CloudFlare)")
 o:value("https://1.1.1.2/dns-query", "1.1.1.2 (CloudFlare-Security)")
@@ -462,15 +461,15 @@ o:depends({xray_dns_mode = "doh"})
 o:depends({singbox_dns_mode = "doh"})
 o:depends({singbox_dns_mode = "http3"})

-o = s:option(Value, "remote_dns_client_ip", translate("EDNS Client Subnet"))
+o = s:taboption("DNS", Value, "remote_dns_client_ip", translate("EDNS Client Subnet"))
 o.description = translate("Notify the DNS server when the DNS query is notified, the location of the client (cannot be a private IP address).") .. "<br />" ..
 		translate("This feature requires the DNS server to support the Edns Client Subnet (RFC7871).")
 o.datatype = "ipaddr"
 o:depends({dns_mode = "sing-box"})
 o:depends({dns_mode = "xray"})
-o:depends({_node_sel_shunt = "1"})
+o:depends({_node_sel_shunt = "1", _diff_global_node = "1"})

-o = s:option(Flag, "remote_fakedns", "FakeDNS", translate("Use FakeDNS work in the domain that proxy."))
+o = s:taboption("DNS", Flag, "remote_fakedns", "FakeDNS", translate("Use FakeDNS work in the domain that proxy."))
 o.default = "0"
 o.rmempty = false
 o:depends({dns_mode = "sing-box"})
@@ -488,12 +487,12 @@ o.validate = function(self, value, t)
 	return value
 end

-o = s:option(Value, "remote_rewrite_ttl", translate("Remote DNS") .. " TTL")
+o = s:taboption("DNS", Value, "remote_rewrite_ttl", translate("Remote DNS") .. " TTL")
 o.datatype = "min(1)"
 o.default = "30"
 o:depends({dns_mode = "sing-box"})

-o = s:option(ListValue, "chinadns_ng_default_tag", translate("Default DNS"))
+o = s:taboption("DNS", ListValue, "chinadns_ng_default_tag", translate("Default DNS"))
 o.default = "none"
 o:value("gfw", translate("Remote DNS"))
 o:value("chn", translate("Direct DNS"))
@@ -511,18 +510,73 @@ o.description = desc
 		.. "</ul>"
 o:depends({dns_shunt = "chinadns-ng", tcp_proxy_mode = "proxy", chn_list = "direct"})

-o = s:option(Flag, "force_https_soa", translate("Force HTTPS SOA"), translate("Force queries with qtype 65 to respond with an SOA record."))
+o = s:taboption("DNS", Flag, "force_https_soa", translate("Force HTTPS SOA"), translate("Force queries with qtype 65 to respond with an SOA record."))
 o.default = "0"
 o.rmempty = false
 o:depends({dns_shunt = "chinadns-ng"})

-o = s:option(ListValue, "use_default_dns", translate("Default DNS"))
+o = s:taboption("DNS", ListValue, "use_default_dns", translate("Default DNS"))
 o.default = "direct"
 o:value("remote", translate("Remote DNS"))
 o:value("direct", translate("Direct DNS"))
 o.description = desc .. "</ul>"
 o:depends({dns_shunt = "dnsmasq", tcp_proxy_mode = "proxy", chn_list = "direct"})

+---- Log
+o = s:taboption("Log", Flag, "log", translate("Enable Node Log"))
+o.default = 0
+o.rmempty = false
+o:depends({ _acl_node_bool = "1", _diff_global_node = "1" })
+
+o = s:taboption("Log", ListValue, "loglevel", "Sing-Box/Xray " .. translate("Log Level"))
+o.default = "warn"
+o:value("debug", "Debug")
+o:value("info", "Info")
+o:value("warn", "Warning")
+o:value("error", "Error")
+o:depends("log", "1")
+
+o = s:taboption("Log", DummyValue, "_node_log", translate("Log File"))
+o.rawhtml = true
+o.cfgvalue = function(t, n)
+	local log_file = api.TMP_PATH .. "/acl/" .. arg[1] .. "/node.log"
+	local log_url = api.url("get_redir_log") .. "?id=" .. arg[1]
+	local s = "<code>%s</code>&nbsp;&nbsp;" % log_file
+	if api.fs.access(log_file) then
+		local btn = string.format(
+			'<input class="btn cbi-button cbi-button-apply" type="button" value="%s" onclick="window.open(\'%s\', \'_blank\')" />',
+			translate("View Log"),
+			log_url
+		)
+		s = s .. btn
+	end
+	return s
+end
+o:depends("log", "1")
+
+o = s:taboption("Log", Flag, "log_chinadns_ng", translate("Enable") .. " ChinaDNS-NG " .. translate("Log"))
+o.default = "0"
+o.rmempty = false
+o:depends("dns_shunt", "chinadns-ng")
+
+o = s:taboption("Log", DummyValue, "_chinadns_ng_log", translate("Log File"))
+o.rawhtml = true
+o.cfgvalue = function(t, n)
+	local log_file = api.TMP_PATH .. "/acl/" .. arg[1] .. "/chinadns_ng.log"
+	local log_url = api.url("get_chinadns_log") .. "?flag=" .. arg[1]
+	local s = "<code>%s</code>&nbsp;&nbsp;" % log_file
+	if api.fs.access(log_file) then
+		local btn = string.format(
+			'<input class="btn cbi-button cbi-button-apply" type="button" value="%s" onclick="window.open(\'%s\', \'_blank\')" />',
+			translate("View Log"),
+			log_url
+		)
+		s = s .. btn
+	end
+	return s
+end
+o:depends("log_chinadns_ng", "1")
+
 local o_node = s.fields["node"]
 local shunt_list = {}

@@ -532,7 +586,7 @@ for k, v in pairs(socks_list) do
 end
 for k, v in pairs(nodes_table) do
 	if #normal_list == 0 then
-		s.fields["dns_mode"]:depends({ _acl_node_bool = "1" })
+		s.fields["dns_mode"]:depends({ _acl_node_bool = "1", _diff_global_node = "1" })
 		break
 	end
 	if v.protocol and v.protocol == "_shunt" then
@@ -540,16 +594,16 @@ for k, v in pairs(nodes_table) do
 			o_node:value(v.id, v["remark"])
 			o_node.group[#o_node.group+1] = (v.group and v.group ~= "") and v.group or translate("default")

-			s.fields["xray_dns_mode"]:depends({ _acl_node_bool = "1", node = v.id })
+			s.fields["xray_dns_mode"]:depends({ _acl_node_bool = "1", _diff_global_node = "1", node = v.id })
 			s.fields["_node_sel_shunt"]:depends({ node = v.id })
 		end
 		if v.type == "sing-box" and has_singbox then
 			o_node:value(v.id, v["remark"])
 			o_node.group[#o_node.group+1] = (v.group and v.group ~= "") and v.group or translate("default")

-			s.fields["singbox_dns_mode"]:depends({ _acl_node_bool = "1", node = v.id })
+			s.fields["singbox_dns_mode"]:depends({ _acl_node_bool = "1", _diff_global_node = "1", node = v.id })
 			s.fields["_node_sel_shunt"]:depends({ node = v.id })
-			s.fields["remote_rewrite_ttl"]:depends({ _acl_node_bool = "1", node = v.id })
+			s.fields["remote_rewrite_ttl"]:depends({ _acl_node_bool = "1", _diff_global_node = "1", node = v.id })
 		end
 		shunt_list[#shunt_list + 1] = v
 	else
@@ -558,21 +612,17 @@ for k, v in pairs(nodes_table) do
 	end
 end

-m:appendTemplate("/acl/config_footer", {section = arg[1]})
-
--[[
 -- Shunt
-if current_node.protocol == "_shunt" then
+if current_node.protocol == "_shunt" and current_node[".name"] ~= NODE then
 	local shunt_lua = loadfile("/usr/lib/lua/luci/model/cbi/passwall/client/include/shunt_options.lua")
 	setfenv(shunt_lua, getfenv(1))(m, s, {
-		s_cfgid = s.section,
-		node_id = current_node_id,
 		node = current_node,
-		verify_option = s.fields["node"]
+		verify_option = s.fields["node"],
+		tab = "Shunt",
+		tab_desc = translate("Shunt Rule"),
 	})
 end

-m:appendTemplate("/acl/shunt", { shunt_list = api.jsonc.stringify(shunt_list), section = s.section })
-]]--
+m:appendTemplate("/include/node_change", { verify_option = s.fields["node"], shunt_list = api.jsonc.stringify(shunt_list) })

 return api.return_map(m)
@@ -112,6 +112,10 @@ o:value("", translate("Close"))
 o.group = {""}

 current_node_id = m:get(s.section, "node")
+local node_value = s.fields["node"]:formvalue(s.section)
+if node_value then
+	current_node_id = node_value
+end
 current_node = current_node_id and m:get(current_node_id) or {}

 -- Shunt Start
@@ -120,17 +124,10 @@ if (has_singbox or has_xray) and #nodes_table > 0 then
 		if current_node.protocol == "_shunt" then
 			local shunt_lua = loadfile("/usr/lib/lua/luci/model/cbi/passwall/client/include/shunt_options.lua")
 			setfenv(shunt_lua, getfenv(1))(m, s, {
-				s_cfgid = s.section,
-				node_id = current_node_id,
 				node = current_node,
-				socks_list = socks_list,
-				urltest_list = urltest_list,
-				balancing_list = balancing_list,
-				iface_list = iface_list,
-				normal_list = normal_list,
 				verify_option = s.fields["node"],
 				tab = "Shunt",
-				tab_desc = translate("Shunt Rule")
+				tab_desc = translate("Shunt Rule"),
 			})
 		end
 	else
@@ -165,20 +162,18 @@ o = s:taboption("Main", Flag, "node_socks_bind_local", translate("Node") .. " So
 o.default = "1"
 o:depends("_node", "1")

-o = s:taboption("Main", DummyValue, "_node", "")
-o.template = m:template_path("/cbi/hidevalue")
-o.value = "1"
+o = s:taboption("Main", HideValue, "node_save_before", "")
+o.value = current_node[".name"]
+o.cbid = function(self, section) return "node_save_before" end
+
+o = s:taboption("Main", HideValue, "_node", "")
 o:depends({ node = "",  ['!reverse'] = true })

 -- Node → DNS Depends Settings
-o = s:taboption("Main", DummyValue, "_node_sel_shunt", "")
-o.template = m:template_path("/cbi/hidevalue")
-o.value = "1"
+o = s:taboption("Main", HideValue, "_node_sel_shunt", "")
 o:depends({ node = "__always__" })

-o = s:taboption("Main", DummyValue, "_node_sel_other", "")
-o.template = m:template_path("/cbi/hidevalue")
-o.value = "1"
+o = s:taboption("Main", HideValue, "_node_sel_other", "")
 o:depends({ _node_sel_shunt = "1",  ['!reverse'] = true })

 -- [[ DNS Settings ]]--
@@ -369,6 +364,8 @@ o:value("tcp", "TCP")
 o:value("udp", "UDP")
 o:value("doh", "DoH")
 o:value("http3", "HTTP3(DoH3)")
+o:value("tls", "TLS(DoT)")
+o:value("quic", "QUIC(DoQ)")
 o:depends("dns_mode", "sing-box")
 o:depends("smartdns_dns_mode", "sing-box")
 o.cfgvalue = function(self, section)
@@ -411,6 +408,8 @@ o:depends({xray_dns_mode = "udp"})
 o:depends({xray_dns_mode = "tcp"})
 o:depends({singbox_dns_mode = "udp"})
 o:depends({singbox_dns_mode = "tcp"})
+o:depends({singbox_dns_mode = "tls"})
+o:depends({singbox_dns_mode = "quic"})

 ---- DoH
 o = s:taboption("DNS", Value, "remote_dns_doh", translate("Remote DNS DoH"))
@@ -561,7 +560,7 @@ o:value("disable", translate("No Proxy"))
 o:value("proxy", translate("Proxy"))
 o.default = "proxy"

-o = s:taboption("Proxy", DummyValue, "switch_mode", " ")
+o = s:taboption("Proxy", DummyValue, "switch_mode", "")
 o.template = m:template_path("/global/proxy")

 ---- Check the transparent proxy component
@@ -643,6 +642,8 @@ s:tab("maintain", translate("Maintain"))
 o = s:taboption("maintain", DummyValue, "")
 o.template = m:template_path("/global/backup")

+m:appendTemplate("/include/node_change", { verify_option = s.fields["node"], shunt_list = api.jsonc.stringify(shunt_list) })
+
 -- [[ Socks Server ]]--
 o = s:taboption("Main", Flag, "socks_enabled", "Socks " .. translate("Main switch"))
 o.rmempty = false
@@ -780,7 +781,7 @@ for k, v in pairs(nodes_table) do
 	end
 end

-m:appendTemplate("/global/footer", {shunt_list = api.jsonc.stringify(shunt_list)})
+m:appendTemplate("/global/footer")

 m:appendTemplate("/cbi/sortable", {sectiontype = s2.sectiontype})

@@ -1,13 +1,28 @@
 local m, s, data = ...

-if not data.node_id or not data.node then
+if not data.node or not data.node[".name"] then
 	return
 end

 local api = m.api
-local s_cfgid = data.s_cfgid
-local current_node_id = data.node_id
+local section_id = s.section
+local current_node = data.node
+local current_node_id = current_node[".name"]
+local verify_option = data.verify_option
 local node_list = data.node_list or api.get_node_list()
+local shunt_section_type = "shunt_option_list"
+
+if data.tab then
+	if #s.tab_names > 0 then
+		table.insert(s.tab_names, 2, data.tab)
+		s.tabs[data.tab] = {
+			title       = data.tab_desc,
+			childs      = { }
+		}
+	else
+		s:tab(data.tab, data.tab_desc)
+	end
+end

 local groups = {}
 m:foreach("shunt_rules", function(s)
@@ -16,6 +31,9 @@ m:foreach("shunt_rules", function(s)
 	end
 end)

+local node_save_before = luci.http.formvalue("node_save_before")
+local load_shunt = luci.http.formvalue("load_shunt")
+
 local function get_cfgvalue()
 	return function(self, section)
 		return m:get(current_node_id, self.option)
@@ -23,8 +41,10 @@ local function get_cfgvalue()
 end
 local function get_write()
 	return function(self, section, value)
-		if data.verify_option then
-			if data.verify_option:formvalue(section) == current_node_id then
+		if node_save_before and node_save_before ~= current_node_id then return end
+		if load_shunt == "1" then return end
+		if verify_option then
+			if verify_option:formvalue(section) == current_node_id then
 				m:set(current_node_id, self.option, value)
 			end
 		else
@@ -34,8 +54,10 @@ local function get_write()
 end
 local function get_remove()
 	return function(self, section)
-		if data.verify_option then
-			if data.verify_option:formvalue(section) == current_node_id then
+		if node_save_before and node_save_before ~= current_node_id then return end
+		if load_shunt == "1" then return end
+		if verify_option then
+			if verify_option:formvalue(section) == current_node_id then
 				m:del(current_node_id, self.option)
 			end
 		else
@@ -44,10 +66,6 @@ local function get_remove()
 	end
 end

-if data.tab then
-	s:tab(data.tab, data.tab_desc)
-end
-
 local function add_option(class, option_name, option_title, option_desc)
 	local a
 	if data.tab then
@@ -63,8 +81,8 @@ local function add_option(class, option_name, option_title, option_desc)
 		a.write = get_write()
 		a.remove = get_remove()
 	end
-	if data.verify_option then
-		a:depends(data.verify_option.option, current_node_id)
+	if verify_option then
+		a:depends(verify_option.option, current_node_id)
 	end
 	return a
 end
@@ -81,7 +99,7 @@ local function add_depends(o, deps)
 	end
 end

-if data.node.type == "Xray" then
+if current_node.type == "Xray" then
 	o = add_option(ListValue, "domainStrategy", translate("Domain Strategy"))
 	o:value("AsIs")
 	o:value("IPIfNonMatch")
@@ -134,7 +152,7 @@ table.insert(shunt_rules, {

 s2 = m:section(Table, shunt_rules, " ")
 s2.config = m.config
-s2.sectiontype = "shunt_option_list"
+s2.sectiontype = shunt_section_type

 o = s2:option(DummyValue, "remarks", translate("Rule"))
 o.rawhtml = true
@@ -157,9 +175,13 @@ _node.cfgvalue = function(self, section)
 	return m:get(current_node_id, shunt_rules[section]["_node_option"]) or shunt_rules[section]["_node_default"]
 end
 _node.write = function(self, section, value)
+	if node_save_before and node_save_before ~= current_node_id then return end
+	if load_shunt == "1" then return end
 	return m:set(current_node_id, shunt_rules[section]["_node_option"], value)
 end
 _node.remove = function(self, section)
+	if node_save_before and node_save_before ~= current_node_id then return end
+	if load_shunt == "1" then return end
 	return m:del(current_node_id, shunt_rules[section]["_node_option"])
 end

@@ -170,9 +192,13 @@ o.cfgvalue = function(self, section)
 	return m:get(current_node_id, shunt_rules[section]["_fakedns_option"])
 end
 o.write = function(self, section, value)
+	if node_save_before and node_save_before ~= current_node_id then return end
+	if load_shunt == "1" then return end
 	return m:set(current_node_id, shunt_rules[section]["_fakedns_option"], value)
 end
 o.remove = function(self, section)
+	if node_save_before and node_save_before ~= current_node_id then return end
+	if load_shunt == "1" then return end
 	return m:del(current_node_id, shunt_rules[section]["_fakedns_option"])
 end

@@ -186,9 +212,13 @@ proxy_tag_node.cfgvalue = function(self, section)
 	return m:get(current_node_id, shunt_rules[section]["_proxy_tag_option"])
 end
 proxy_tag_node.write = function(self, section, value)
+	if node_save_before and node_save_before ~= current_node_id then return end
+	if load_shunt == "1" then return end
 	return m:set(current_node_id, shunt_rules[section]["_proxy_tag_option"], value)
 end
 proxy_tag_node.remove = function(self, section)
+	if node_save_before and node_save_before ~= current_node_id then return end
+	if load_shunt == "1" then return end
 	return m:del(current_node_id, shunt_rules[section]["_proxy_tag_option"])
 end

@@ -204,4 +234,11 @@ for k1, v1 in pairs(node_list) do
 	end
 end

-m:appendTemplate("/include/shunt_options", {id = current_node_id, s_cfgid = s_cfgid or current_node_id, normal_list = api.jsonc.stringify(node_list.normal_list)})
+m:appendTemplate("/include/shunt_options", {
+	node_id = current_node_id,
+	section_id = section_id or current_node_id,
+	section_type = shunt_section_type,
+	tab_name = data.tab,
+	normal_list = api.jsonc.stringify(node_list.normal_list),
+	shunt_list = api.jsonc.stringify(node_list.shunt_list)
+})
@@ -61,7 +61,6 @@ end
 local types_dir = "/usr/lib/lua/luci/model/cbi/" .. api.appname .. "/client/type/"
 s.val = {}
 s.val["type"] = m:get(arg[1], "type")
-s.val["protocol"] = m:get(arg[1], "protocol")

 if luci.http.formvalue("cbi.submit") == "1" then
 	local formvalue_type = luci.http.formvalue(formvalue_key .. "type")
@@ -72,34 +71,6 @@ end

 o = s:option(ListValue, "type", translate("Type"))

-if api.is_finded("ipt2socks") then
-	local type_name = "Socks"
-
-	s.fields["type"]:value(type_name, "Socks")
-
-	if s.val["type"] == type_name then
-		local s2 = NamedSection(m, arg[1], "server")
-		s2.type_name = type_name
-		s2.option_prefix = "socks_"
-
-		o = s2:option(ListValue, "del_protocol", "　") --始终隐藏，用于删除 protocol
-		o:depends({ __hide = "1" })
-		o.rewrite_option = "protocol"
-
-		o = s2:option(Value, "address", translate("Address (Support Domain Name)"))
-
-		o = s2:option(Value, "port", translate("Port"))
-		o.datatype = "port"
-
-		o = s2:option(Value, "username", translate("Username"))
-
-		o = s2:option(Value, "password", translate("Password"))
-		o.password = true
-
-		api.luci_types(s, s2)
-	end
-end
-
 local type_table = {}
 for filename in api.fs.dir(types_dir) do
 	table.insert(type_table, filename)
@@ -0,0 +1,35 @@
+if not api.is_finded("ipt2socks") then
+	return
+end
+
+-- [[ Socks ]]
+local m, s1 = ...
+local type_name = "Socks"
+
+s1.fields["type"]:value(type_name, "Socks")
+
+if s1.val["type"] and s1.val["type"] ~= type_name then
+	return
+end
+
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
+s.type_name = type_name
+s.option_prefix = "socks_"
+api.set_type_cbi(s)
+
+o = s:option(ListValue, "del_protocol", "¡¡") --Ê¼ÖÕÒþ²Ø£¬ÓÃÓÚÉ¾³ý protocol
+o:depends({ __hide = "1" })
+o.rewrite_option = "protocol"
+
+o = s:option(Value, "address", translate("Address (Support Domain Name)"))
+
+o = s:option(Value, "port", translate("Port"))
+o.datatype = "port"
+
+o = s:option(Value, "username", translate("Username"))
+
+o = s:option(Value, "password", translate("Password"))
+o.password = true
+
+api.type_cbi_section(s1, s)
@@ -17,15 +17,11 @@ if s1.val["type"] ~= type_name then
 	return
 end

-local s = NamedSection(m, arg[1], "server")
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
 s.type_name = type_name
 s.option_prefix = "singbox_"
-
-local formvalue_proto = luci.http.formvalue(formvalue_key .. "protocol")
-
-if formvalue_proto then s1.val["protocol"] = formvalue_proto end
-
-local arg_select_proto = luci.http.formvalue("select_proto") or ""
+api.set_type_cbi(s)

 local ss_method_new_list = {
 	"none", "aes-128-gcm", "aes-192-gcm", "aes-256-gcm", "chacha20-ietf-poly1305", "xchacha20-ietf-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305"
@@ -72,24 +68,20 @@ end
 o:value("_urltest", translate("URLTest"))
 o:value("_shunt", translate("Shunt"))
 o:value("_iface", translate("Custom Interface"))
-function o.custom_cfgvalue(self, section)
-	if arg_select_proto ~= "" then
-		return arg_select_proto
-	else
-		return m:get(section, self.config_option)
-	end
+
+local protocol_val = m:get(s.section, "protocol")
+local formvalue_proto = s.fields["protocol"]:formvalue(s.section)
+if formvalue_proto then
+	protocol_val = formvalue_proto
 end

-local load_urltest_options = s1.val["protocol"] == "_urltest" or arg_select_proto == "_urltest"
-local load_shunt_options = s1.val["protocol"] == "_shunt" or arg_select_proto == "_shunt"
-local load_iface_options = s1.val["protocol"] == "_iface" or arg_select_proto == "_iface"
+local load_urltest_options = protocol_val == "_urltest"
+local load_shunt_options = protocol_val == "_shunt"
+local load_iface_options = protocol_val == "_iface"
 local load_normal_options = true
 if load_urltest_options or load_shunt_options or load_iface_options then
 	load_normal_options = nil
 end
-if not arg_select_proto:find("_") then
-	load_normal_options = true
-end

 local netdev_list = api.get_network_devices()
 local node_list = api.get_node_list()
@@ -115,11 +107,11 @@ if load_urltest_options then -- [[ URLTest Start ]]
 		end
 	end
 	-- 读取旧 DynamicList
-	function o.custom_cfgvalue(self, section)
+	function o.cfgvalue(self, section)
 		return table.concat(m:get(section, "urltest_node") or {}, " ")
 	end
 	-- 写入保持 DynamicList
-	function o.custom_write(self, section, value)
+	function o.write(self, section, value)
 		local old = m:get(section, "urltest_node") or {}
 		local new, set = {}, {}
 		for v in value:gmatch("%S+") do
@@ -628,6 +620,7 @@ if singbox_tags:find("with_utls") then
 	o:depends({ protocol = "shadowsocks", tls = true })
 	o:depends({ protocol = "trojan", tls = true })
 	o:depends({ protocol = "anytls", tls = true })
+	o:depends({ protocol = "http", tls = true })

 	o = s:option(Value, "reality_publicKey", translate("Public Key"))
 	o:depends({ reality = true })
@@ -935,7 +928,7 @@ if not load_shunt_options then
 	for k1, v1 in pairs(node_list) do
 		if k1 ~= "shunt_list" and k1 ~= "iface_list" then
 			for i, v in ipairs(v1) do
-				if v.id ~= arg[1] then
+				if v.id ~= s.section then
 					o1:value(v.id, v.remark)
 					o1.group[#o1.group+1] = (v.group and v.group ~= "") and v.group or translate("default")
 					if k1 == "normal_list" then
@@ -949,14 +942,15 @@ if not load_shunt_options then
 	end
 end

-api.luci_types(s1, s)
+api.type_cbi_section(s1, s)

 if load_shunt_options then
-	local current_node = m:get(arg[1]) or {}
 	local shunt_lua = loadfile("/usr/lib/lua/luci/model/cbi/passwall/client/include/shunt_options.lua")
 	setfenv(shunt_lua, getfenv(1))(m, s1, {
-		node_id = arg[1],
-		node = current_node,
+		node = {
+			[".name"] = s.section,
+			type = type_name,
+		},
 		node_list = node_list,
 	})
 end
@@ -15,15 +15,11 @@ if s1.val["type"] ~= type_name then
 	return
 end

-local s = NamedSection(m, arg[1], "server")
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
 s.type_name = type_name
 s.option_prefix = "xray_"
-
-local formvalue_proto = luci.http.formvalue(formvalue_key .. "protocol")
-
-if formvalue_proto then s1.val["protocol"] = formvalue_proto end
-
-local arg_select_proto = luci.http.formvalue("select_proto") or ""
+api.set_type_cbi(s)

 local ss_method_list = {
 	"aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "chacha20-ietf-poly1305", "xchacha20-poly1305", "xchacha20-ietf-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305"
@@ -53,31 +49,26 @@ if api.compare_versions(xray_version, ">=", "1.8.12") then
 end
 o:value("_shunt", translate("Shunt"))
 o:value("_iface", translate("Custom Interface"))
-function o.custom_cfgvalue(self, section)
-	if arg_select_proto ~= "" then
-		return arg_select_proto
-	else
-		return m:get(section, self.config_option)
-	end
+local protocol_val = m:get(s.section, "protocol")
+local formvalue_proto = s.fields["protocol"]:formvalue(s.section)
+if formvalue_proto then
+	protocol_val = formvalue_proto
 end

-local load_balancing_options = s1.val["protocol"] == "_balancing" or arg_select_proto == "_balancing"
-local load_shunt_options = s1.val["protocol"] == "_shunt" or arg_select_proto == "_shunt"
-local load_iface_options = s1.val["protocol"] == "_iface" or arg_select_proto == "_iface"
+local load_balancing_options = protocol_val == "_balancing"
+local load_shunt_options = protocol_val == "_shunt"
+local load_iface_options = protocol_val == "_iface"
 local load_normal_options = true
 if load_balancing_options or load_shunt_options or load_iface_options then
 	load_normal_options = nil
 end
-if not arg_select_proto:find("_") then
-	load_normal_options = true
-end

 local netdev_list = api.get_network_devices()
 local node_list = api.get_node_list()
 local fallback_list = {}
 local is_balancer = nil
 for k, e in ipairs(node_list.balancing_list or {}) do
-	if e.id ~= arg[1] then
+	if e.id ~= s.section then
 		fallback_list[#fallback_list + 1] = {
 			id = e["id"],
 			remark = e["remark"],
@@ -110,11 +101,11 @@ if load_balancing_options then -- [[ Load balancing Start ]]
 		end
 	end
 	-- 读取旧 DynamicList
-	function o.custom_cfgvalue(self, section)
+	function o.cfgvalue(self, section)
 		return table.concat(m:get(section, "balancing_node") or {}, " ")
 	end
 	-- 写入保持 DynamicList
-	function o.custom_write(self, section, value)
+	function o.write(self, section, value)
 		local old = m:get(section, "balancing_node") or {}
 		local new, set = {}, {}
 		for v in value:gmatch("%S+") do
@@ -213,7 +204,7 @@ if load_balancing_options then -- [[ Load balancing Start ]]
 		local depth = get_fallback_depth(v.id)
 		-- 超过最大套娃层数后，不允许继续选择 balancer
 		if depth < MAX_FALLBACK_DEPTH
-			and not will_loop(arg[1], v.id)
+			and not will_loop(s.section, v.id)
 		then
 			o:value(v.id, v.remark)
 			o.group[#o.group + 1] = (v.group and v.group ~= "") and v.group or translate("default")
@@ -410,6 +401,7 @@ o = s:option(Flag, "tls", translate("TLS"))
 o.default = 0
 o:depends({ protocol = "vmess" })
 o:depends({ protocol = "vless" })
+o:depends({ protocol = "http" })
 o:depends({ protocol = "trojan" })
 o:depends({ protocol = "shadowsocks" })

@@ -678,13 +670,13 @@ o.validate = function(self, value)
 	if v then return v end
 	return nil, "XHTTP Extra " .. translate("Must be JSON text!")
 end
-o.custom_cfgvalue = function(self, section, value)
+o.cfgvalue = function(self, section, value)
 	local raw = m:get(section, "xhttp_extra")
 	if raw then
 		return api.base64Decode(raw)
 	end
 end
-o.custom_write = function(self, section, value)
+o.write = function(self, section, value)
 	m:set(section, "xhttp_extra", api.base64Encode(value) or "")
 	local success, data = pcall(api.jsonc.parse, value)
 	if success and data then
@@ -700,7 +692,7 @@ o.custom_write = function(self, section, value)
 		m:del(section, "download_address")
 	end
 end
-o.custom_remove = function(self, section, value)
+o.remove = function(self, section, value)
 	m:del(section, "xhttp_extra")
 	m:del(section, "download_address")
 end
@@ -728,6 +720,8 @@ o:depends({ protocol = "vless", transport = "raw" })
 o:depends({ protocol = "vless", transport = "ws" })
 o:depends({ protocol = "vless", transport = "grpc" })
 o:depends({ protocol = "vless", transport = "httpupgrade" })
+o:depends({ protocol = "http" })
+o:depends({ protocol = "socks" })
 o:depends({ protocol = "shadowsocks" })
 o:depends({ protocol = "trojan" })

@@ -763,13 +757,13 @@ o.validate = function(self, value)
 	if v then return v end
 	return nil, "FinalMask " .. translate("Must be JSON text!")
 end
-o.custom_cfgvalue = function(self, section, value)
+o.cfgvalue = function(self, section, value)
 	local raw = m:get(section, "finalmask")
 	if raw then
 		return api.base64Decode(raw)
 	end
 end
-o.custom_write = function(self, section, value)
+o.write = function(self, section, value)
 	m:set(section, "finalmask", api.base64Encode(value) or "")
 end

@@ -871,7 +865,7 @@ if not load_shunt_options then
 	for k1, v1 in pairs(node_list) do
 		if k1 ~= "shunt_list" and k1 ~= "iface_list" then
 			for i, v in ipairs(v1) do
-				if v.id ~= arg[1] then
+				if v.id ~= s.section then
 					o1:value(v.id, v.remark)
 					o1.group[#o1.group+1] = (v.group and v.group ~= "") and v.group or translate("default")
 					if k1 == "normal_list" then
@@ -885,14 +879,16 @@ if not load_shunt_options then
 	end
 end

-api.luci_types(s1, s)
+api.type_cbi_section(s1, s)

 if load_shunt_options then
 	local current_node = m:get(arg[1]) or {}
 	local shunt_lua = loadfile("/usr/lib/lua/luci/model/cbi/passwall/client/include/shunt_options.lua")
 	setfenv(shunt_lua, getfenv(1))(m, s1, {
-		node_id = arg[1],
-		node = current_node,
+		node = {
+			[".name"] = s.section,
+			type = type_name,
+		},
 		node_list = node_list,
 	})
 end
@@ -12,9 +12,11 @@ if s1.val["type"] ~= type_name then
 	return
 end

-local s = NamedSection(m, arg[1], "server")
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
 s.type_name = type_name
 s.option_prefix = "ssrust_"
+api.set_type_cbi(s)

 local ssrust_encrypt_method_list = {
 	"none", "plain",
@@ -69,4 +71,4 @@ end
 o = s:option(Value, "plugin_opts", translate("opts"))
 o:depends({ plugin_enabled = true })

-api.luci_types(s1, s)
+api.type_cbi_section(s1, s)
@@ -12,9 +12,11 @@ if s1.val["type"] ~= type_name then
 	return
 end

-local s = NamedSection(m, arg[1], "server")
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
 s.type_name = type_name
 s.option_prefix = "ssr_"
+api.set_type_cbi(s)

 local ssr_encrypt_method_list = {
 	"none", "table", "rc2-cfb", "rc4", "rc4-md5", "rc4-md5-6", "aes-128-cfb",
@@ -63,4 +65,4 @@ o.default = 300
 o = s:option(Flag, "tcp_fast_open", "TCP " .. translate("Fast Open"), translate("Need node support required"))
 o.default = 0

-api.luci_types(s1, s)
+api.type_cbi_section(s1, s)
@@ -12,13 +12,11 @@ if s1.val["type"] ~= type_name then
 	return
 end

-local s = NamedSection(m, arg[1], "server")
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
 s.type_name = type_name
 s.option_prefix = "hysteria2_"
-
-local function _n(name)
-	return s.option_prefix .. name
-end
+api.set_type_cbi(s)

 o = s:option(ListValue, "protocol", translate("Protocol"))
 o:value("udp", "UDP")
@@ -32,22 +30,22 @@ o:depends({ realms = false })

 o = s:option(Value, "hop", translate("Port hopping range"))
 o.description = translate("Format as 1000:2000 or 1000-2000 Multiple groups are separated by commas (,).")
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ realms = false })

 o = s:option(Value, "hop_interval", translate("Hop Interval(second)"), translate("Supports a fixed value or a random range (e.g., 30, 5-30), minimum 5."))
 o.datatype = "or(uinteger,portrange)"
 o.placeholder = "30"
 o.default = "30"
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ realms = false })

 o = s:option(Flag, "realms", translate("Realms"))
 o.default = "0"
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(Value, "realm_url", translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name")
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ realms = "1" })
 o.validate = function(self, value)
 	value = api.trim(value)
@@ -58,26 +56,26 @@ end

 o = s:option(DynamicList, "realm_stun", translate("Realm STUN"))
 o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" }
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ realms = "1" })

 o = s:option(Flag, "realm_upnp", translate("Enable") .. " UPnP/NAT-PMP", translate("Enable UPnP/NAT-PMP port mapping on your gateway to improve hole punching success."))
 o.default = "0"
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ realms = "1" })

 o = s:option(Value, "auth_password", translate("Auth Password"))
 o.password = true
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(ListValue, "obfs_type", translate("Obfs Type"))
 o:value("", translate("Disable"))
 o:value("salamander")
 o:value("gecko")
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(Value, "obfs_password", translate("Obfs Password"))
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ obfs_type = "salamander" })
 o:depends({ obfs_type = "gecko" })

@@ -86,14 +84,14 @@ o.datatype = "uinteger"
 o.placeholder = "512"
 o.default = "512"
 o:depends({ obfs_type = "gecko" })
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(Value, "obfs_MaxPacketSize", translate("Gecko Packet Size (max)"))
 o.datatype = "uinteger"
 o.placeholder = "1200"
 o.default = "1200"
 o:depends({ obfs_type = "gecko" })
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(Flag, "fast_open", translate("Fast Open"))
 o.default = "0"
@@ -106,28 +104,28 @@ o.default = "0"
 o = s:option(Value, "tls_pinSHA256", translate("PinSHA256"),translate("Certificate fingerprint"))

 o = s:option(Value, "up_mbps", translate("Max upload Mbps"))
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(Value, "down_mbps", translate("Max download Mbps"))
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(Value, "recv_window", translate("QUIC stream receive window"))
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(Value, "recv_window_conn", translate("QUIC connection receive window"))
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(Value, "idle_timeout", translate("Idle Timeout"), translate("Units:seconds") .. " (4~120)")
 o.datatype = "range(4,120)"
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(Value, "keep_alive_period", translate("QUIC KeepAlive interval"), translate("Units:seconds") .. " (2~60)")
 o.datatype = "range(2,60)"
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(Flag, "disable_mtu_discovery", translate("Disable MTU detection"))
 o.default = "0"
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option


 o = s:option(Flag, "ech", translate("ECH"))
@@ -145,6 +143,6 @@ end

 o = s:option(Flag, "lazy_start", translate("Lazy Start"))
 o.default = "0"
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

-api.luci_types(s1, s)
+api.type_cbi_section(s1, s)
@@ -12,9 +12,11 @@ if s1.val["type"] ~= type_name then
 	return
 end

-local s = NamedSection(m, arg[1], "server")
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
 s.type_name = type_name
 s.option_prefix = "naive_"
+api.set_type_cbi(s)

 o = s:option(ListValue, "protocol", translate("Protocol"))
 o:value("https", translate("HTTPS"))
@@ -30,4 +32,4 @@ o = s:option(Value, "username", translate("Username"))
 o = s:option(Value, "password", translate("Password"))
 o.password = true

-api.luci_types(s1, s)
+api.type_cbi_section(s1, s)
@@ -15,9 +15,11 @@ if s1.val["type"] and s1.val["type"] ~= type_name then
 	return
 end

-local s = NamedSection(m, arg[1], "server")
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
 s.type_name = type_name
 s.option_prefix = "socks_"
+api.set_type_cbi(s)

 o = s:option(Value, "port", translate("Listen Port"))
 o.datatype = "port"
@@ -44,4 +46,4 @@ o:depends({ firewall_allow = true })
 o = s:option(Flag, "log", translate("Log"))
 o.default = "1"

-api.luci_types(s1, s)
+api.type_cbi_section(s1, s)
@@ -21,9 +21,11 @@ if s1.val["type"] and s1.val["type"] ~= type_name then
 	return
 end

-local s = NamedSection(m, arg[1], "server")
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
 s.type_name = type_name
 s.option_prefix = "singbox_"
+api.set_type_cbi(s)

 local singbox_tags = luci.sys.exec(singbox_bin .. " version  | grep 'Tags:' | awk '{print $2}'")

@@ -48,13 +50,13 @@ o.validate = function(self, value)
 	if v then return v end
 	return nil, translate("Custom Config") .. " " .. translate("Must be JSON text!")
 end
-o.custom_cfgvalue = function(self, section, value)
+o.cfgvalue = function(self, section, value)
 	local config_str = m:get(section, "config_str")
 	if config_str then
 		return api.base64Decode(config_str)
 	end
 end
-o.custom_write = function(self, section, value)
+o.write = function(self, section, value)
 	m:set(section, "config_str", api.base64Encode(value) or "")
 end

@@ -562,4 +564,4 @@ o:value("warn")
 o:value("error")
 o:depends({ log = true })

-api.luci_types(s1, s)
+api.type_cbi_section(s1, s)
@@ -19,9 +19,11 @@ if s1.val["type"] and s1.val["type"] ~= type_name then
 	return
 end

-local s = NamedSection(m, arg[1], "server")
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
 s.type_name = type_name
 s.option_prefix = "xray_"
+api.set_type_cbi(s)

 local ss_method_list = {
 	"aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "xchacha20-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305"
@@ -44,13 +46,13 @@ o.validate = function(self, value)
 	if v then return v end
 	return nil, translate("Custom Config") .. " " .. translate("Must be JSON text!")
 end
-o.custom_cfgvalue = function(self, section, value)
+o.cfgvalue = function(self, section, value)
 	local config_str = m:get(section, "config_str")
 	if config_str then
 		return api.base64Decode(config_str)
 	end
 end
-o.custom_write = function(self, section, value)
+o.write = function(self, section, value)
 	m:set(section, "config_str", api.base64Encode(value) or "")
 end

@@ -204,13 +206,18 @@ o.validate = function(self, value, t)
 end
 o:depends({ protocol = "vmess" })
 o:depends({ protocol = "vless" })
+o:depends({ protocol = "http" })
 o:depends({ protocol = "shadowsocks" })
 o:depends({ protocol = "trojan" })

 -- [[ REALITY部分 ]] --
 o = s:option(Flag, "reality", translate("REALITY"))
 o.default = 0
-o:depends({ tls = true })
+o:depends({ tls = true, transport = "raw" })
+o:depends({ tls = true, transport = "ws" })
+o:depends({ tls = true, transport = "grpc" })
+o:depends({ tls = true, transport = "httpupgrade" })
+o:depends({ tls = true, transport = "xhttp" })

 o = s:option(Value, "reality_private_key", translate("Private Key"))
 o:depends({ reality = true })
@@ -257,8 +264,8 @@ end
 -- [[ TLS部分 ]] --

 o = s:option(FileUpload, "tls_certificateFile", translate("Public key absolute path"), translate("as:") .. "/etc/ssl/fullchain.pem")
-o.default = m:get(s.section, "tls_certificateFile") or "/etc/config/ssl/" .. arg[1] .. ".pem"
-if o and o:formvalue(arg[1]) then o.default = o:formvalue(arg[1]) end
+o.default = m:get(s.section, "tls_certificateFile") or "/etc/config/ssl/" .. s.section .. ".pem"
+if o and o:formvalue(s.section) then o.default = o:formvalue(s.section) end
 o:depends({ tls = true, reality = false })
 o:depends({ protocol = "hysteria2"})
 o.validate = function(self, value, t)
@@ -273,8 +280,8 @@ o.validate = function(self, value, t)
 end

 o = s:option(FileUpload, "tls_keyFile", translate("Private key absolute path"), translate("as:") .. "/etc/ssl/private.key")
-o.default = m:get(s.section, "tls_keyFile") or "/etc/config/ssl/" .. arg[1] .. ".key"
-if o and o:formvalue(arg[1]) then o.default = o:formvalue(arg[1]) end
+o.default = m:get(s.section, "tls_keyFile") or "/etc/config/ssl/" .. s.section .. ".key"
+if o and o:formvalue(s.section) then o.default = o:formvalue(s.section) end
 o:depends({ tls = true, reality = false })
 o:depends({ protocol = "hysteria2"})
 o.validate = function(self, value, t)
@@ -396,13 +403,13 @@ o:depends({ use_finalmask = true })
 o.rows = 10
 o.wrap = "off"
 o.datatype = "json"
-o.custom_cfgvalue = function(self, section, value)
+o.cfgvalue = function(self, section, value)
 	local raw = m:get(section, "finalmask")
 	if raw then
 		return api.base64Decode(raw)
 	end
 end
-o.custom_write = function(self, section, value)
+o.write = function(self, section, value)
 	m:set(section, "finalmask", api.base64Encode(value) or "")
 end

@@ -549,4 +556,4 @@ o:value("warning")
 o:value("error")
 o:depends({ log = true })

-api.luci_types(s1, s)
+api.type_cbi_section(s1, s)
@@ -16,9 +16,11 @@ if s1.val["type"] and s1.val["type"] ~= type_name then
 	return
 end

-local s = NamedSection(m, arg[1], "server")
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
 s.type_name = type_name
 s.option_prefix = "ssrust_"
+api.set_type_cbi(s)

 local ssrust_encrypt_method_list = {
 	"plain", "none",
@@ -39,13 +41,13 @@ o.validate = function(self, value)
 	if v then return v end
 	return nil, translate("Custom Config") .. " " .. translate("Must be JSON text!")
 end
-o.custom_cfgvalue = function(self, section, value)
+o.cfgvalue = function(self, section, value)
 	local config_str = m:get(section, "config_str")
 	if config_str then
 		return api.base64Decode(config_str)
 	end
 end
-o.custom_write = function(self, section, value)
+o.write = function(self, section, value)
 	m:set(section, "config_str", api.base64Encode(value) or "")
 end

@@ -88,4 +90,4 @@ o = s:option(Flag, "log", translate("Log"))
 o.default = "1"
 o.rmempty = false

-api.luci_types(s1, s)
+api.type_cbi_section(s1, s)
@@ -16,9 +16,11 @@ if s1.val["type"] and s1.val["type"] ~= type_name then
 	return
 end

-local s = NamedSection(m, arg[1], "server")
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
 s.type_name = type_name
 s.option_prefix = "ssr_"
+api.set_type_cbi(s)

 local ssr_encrypt_method_list = {
 	"none", "table", "rc2-cfb", "rc4", "rc4-md5", "rc4-md5-6", "aes-128-cfb",
@@ -52,13 +54,13 @@ o.validate = function(self, value)
 	if v then return v end
 	return nil, translate("Custom Config") .. " " .. translate("Must be JSON text!")
 end
-o.custom_cfgvalue = function(self, section, value)
+o.cfgvalue = function(self, section, value)
 	local config_str = m:get(section, "config_str")
 	if config_str then
 		return api.base64Decode(config_str)
 	end
 end
-o.custom_write = function(self, section, value)
+o.write = function(self, section, value)
 	m:set(section, "config_str", api.base64Encode(value) or "")
 end

@@ -119,4 +121,4 @@ o = s:option(Flag, "log", translate("Log"))
 o.default = "1"
 o.rmempty = false

-api.luci_types(s1, s)
+api.type_cbi_section(s1, s)
@@ -12,13 +12,11 @@ if s1.val["type"] and s1.val["type"] ~= type_name then
 	return
 end

-local s = NamedSection(m, arg[1], "server")
+local s = NamedSection(m, arg[1], "tmp_" .. s1.sectiontype)
+s.parent = s1
 s.type_name = type_name
 s.option_prefix = "hysteria2_"
-
-local function _n(name)
-	return s.option_prefix .. name
-end
+api.set_type_cbi(s)

 o = s:option(Flag, "custom", translate("Use Custom Config"))

@@ -33,13 +31,13 @@ o.validate = function(self, value)
 	if v then return v end
 	return nil, translate("Custom Config") .. " " .. translate("Must be JSON text!")
 end
-o.custom_cfgvalue = function(self, section, value)
+o.cfgvalue = function(self, section, value)
 	local config_str = m:get(section, "config_str")
 	if config_str then
 		return api.base64Decode(config_str)
 	end
 end
-o.custom_write = function(self, section, value)
+o.write = function(self, section, value)
 	m:set(section, "config_str", api.base64Encode(value) or "")
 end

@@ -55,11 +53,11 @@ o:depends({ custom = false })

 o = s:option(Flag, "realms", translate("Realms"))
 o.default = "0"
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ custom = false })

 o = s:option(Value, "realm_url", translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name")
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ realms = "1" })
 o.validate = function(self, value)
 	value = api.trim(value)
@@ -70,23 +68,23 @@ end

 o = s:option(DynamicList, "realm_stun", translate("Realm STUN"))
 o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" }
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ realms = "1" })

 o = s:option(Flag, "realm_upnp", translate("Enable") .. " UPnP/NAT-PMP", translate("Enable UPnP/NAT-PMP port mapping on your gateway to improve hole punching success."))
 o.default = "0"
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ realms = "1" })

 o = s:option(ListValue, "obfs_type", translate("Obfs Type"))
 o:value("", translate("Disable"))
 o:value("salamander")
 o:value("gecko")
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ custom = false })

 o = s:option(Value, "obfs_password", translate("Obfs Password"))
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ obfs_type = "salamander" })
 o:depends({ obfs_type = "gecko" })

@@ -95,31 +93,31 @@ o.datatype = "uinteger"
 o.placeholder = "512"
 o.default = "512"
 o:depends({ obfs_type = "gecko" })
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(Value, "obfs_MaxPacketSize", translate("Gecko Packet Size (max)"))
 o.datatype = "uinteger"
 o.placeholder = "1200"
 o.default = "1200"
 o:depends({ obfs_type = "gecko" })
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option

 o = s:option(Flag, "udp", translate("UDP"))
 o.default = "1"
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ custom = false })

 o = s:option(Value, "up_mbps", translate("Max upload Mbps"))
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ custom = false })

 o = s:option(Value, "down_mbps", translate("Max download Mbps"))
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ custom = false })

 o = s:option(Flag, "ignoreClientBandwidth", translate("ignoreClientBandwidth"))
 o.default = "0"
-o.rewrite_option = _n(o.option)
+o.rewrite_option = o.option
 o:depends({ custom = false })

 o = s:option(FileUpload, "tls_certificateFile", translate("Public key absolute path"), translate("as:") .. "/etc/ssl/fullchain.pem")
@@ -181,4 +179,4 @@ o = s:option(Flag, "log", translate("Log"))
 o.default = "1"
 o.rmempty = false

-api.luci_types(s1, s)
+api.type_cbi_section(s1, s)
@@ -163,12 +163,16 @@ function sh_uci_commit(config)
 	exec_call(string.format("uci -q commit %s", config))
 end

+function del_cache_var(key)
+	sys.call(string.format('. /usr/share/passwall2/utils.sh ; del_cache_var "%s"', key))
+end
+
 function set_cache_var(key, val)
-	sys.call(string.format('. /usr/share/passwall/utils.sh ; set_cache_var %s "%s"', key, val))
+	sys.call(string.format('. /usr/share/passwall/utils.sh ; set_cache_var "%s" "%s"', key, val))
 end

 function get_cache_var(key)
-	local val = sys.exec(string.format('. /usr/share/passwall/utils.sh ; echo -n $(get_cache_var %s)', key))
+	local val = sys.exec(string.format('. /usr/share/passwall/utils.sh ; echo -n $(get_cache_var "%s")', key))
 	if val == "" then val = nil end
 	return val
 end
@@ -1378,11 +1382,22 @@ function to_move(app_name,file)
 end

 function get_version()
-	local version = sys.exec("opkg list-installed luci-app-passwall 2>/dev/null | awk '{print $3}'")
-	if not version or #version == 0 then
-		version = sys.exec("apk list luci-app-passwall 2>/dev/null | awk '/installed/ {print $1}' | cut -d'-' -f4-")
+	local version
+	local version_file = CACHE_PATH .. "/passwall_version"
+	sys.call("mkdir -p " .. CACHE_PATH)
+	if fs.access(version_file) then
+		version = fs.readfile(version_file)
+	else
+		version = sys.exec("opkg list-installed luci-app-passwall 2>/dev/null | awk '{print $3}'")
+		if not version or version == "" then
+			version = sys.exec("apk list luci-app-passwall 2>/dev/null | awk '/installed/ {print $1}' | cut -d'-' -f4-")
+		end
+		version = (version or ""):match("^%s*(.-)%s*$")
+		if version ~= "" then
+			fs.writefile(version_file, version)
+		end
 	end
-	return (version or ""):gsub("\n", ""):match("^([^-]+)")
+	return version:match("^([^-]+)") or ""
 end

 function to_check_self()
@@ -1506,11 +1521,111 @@ function set_default_cbi()
 			return cbi.AbstractValue.write(self, section, new_val)
 		end
 	end
+	if true then
+		--HideValue
+		local HideValue = util.class(cbi.DummyValue)
+		function HideValue.__init__(self, ...)
+			cbi.DummyValue.__init__(self, ...)
+			self.template = self.map:template_path("/cbi/hidevalue")
+			self.value = "1"
+		end
+		cbi.HideValue = HideValue
+	end
+end
+
+function set_type_cbi(s)
+	local cbi = require "luci.cbi"
+	local s1 = s.parent
+	function s.option(s_self, class, option, ...)
+		local obj  = class(s_self.map, s_self, option, ...)
+		obj.config_option = option
+		obj.option_prefix = s_self.option_prefix
+		obj.option = s_self.option_prefix .. option
+		obj.cfgvalue = function(self, section)
+			if self.rewrite_option then
+				return self.map:get(section, self.rewrite_option)
+			else
+				return self.map:get(section, self.config_option)
+			end
+		end
+		obj.write = function(self, section, value)
+			if s1.fields["type"]:formvalue(s_self.section) == s_self.type_name then
+				local new_val = value
+				if util.instanceof(self, cbi.DynamicList) then
+					local new_t = {}
+					if type(value) == "table" then
+						new_t = table_remove_duplicates(value)
+					else
+						new_t = { value }
+					end
+					if self.cast == "string" then
+						new_val = table.concat(new_t, " ")
+					else
+						new_val = new_t
+					end
+				end
+				if self.rewrite_option then
+					self.map:set(section, self.rewrite_option, new_val)
+				else
+					self.map:set(section, self.config_option, new_val)
+				end
+			end
+		end
+		obj.remove = function(self, section)
+			if s1.fields["type"]:formvalue(s_self.section) == s_self.type_name then
+				if self.rewrite_option then
+					self.map:del(section, self.rewrite_option)
+				else
+					self.map:del(section, self.config_option)
+				end
+			end
+		end
+		obj.deplist2json = function(self, section, deplist)
+			local deps, i, d = { }
+			if type(self.deps) == "table" then
+				if not next(self.deps) then
+					self:depends({ type = s.type_name })
+				end
+				local list = deplist or self.deps
+				for i, d in ipairs(list) do
+					if s.type_name and not d["type"] then
+						d["type"] = s.type_name
+					end
+					local a, k, v = { }
+					for k, v in pairs(d) do
+						if k:find("!", 1, true) then
+							a[k] = v
+						elseif k:find("^", 1, true) then
+							a[k:sub(2)] = v
+						elseif k:find(".", 1, true) then
+							a['cbid%s' % k] = v
+						elseif s_self.fields[k] then
+							a['cbid.%s.%s.%s' %{ self.config, section, s_self.fields[k].option }] = v
+						else
+							a['cbid.%s.%s.%s' %{ self.config, section, k }] = v
+						end
+					end
+					deps[#deps+1] = a
+				end
+			end
+			return util.serialize_json(deps)
+		end
+		s_self:append(obj)
+		s_self.fields[option] = obj
+		return obj
+	end
+end
+
+function type_cbi_section(s, s2)
+	for i, v in ipairs(s2.children) do
+		local o = s2.children[i]
+		s:append(o)
+		s.fields[o.option] = o
+	end
 end

 function return_map(map)
 	local cbi = require "luci.cbi"
-	local api = require "luci.passwall.api"
 	if true then
 		-- header
 		local header = cbi.Template(appname .. "/cbi/header")
@@ -1526,113 +1641,6 @@ function return_map(map)
 	return map
 end

-function luci_types(s, s2)
-	local cbi = require "luci.cbi"
-	local m = s.map
-	local id = s2.section
-	local type_name = s2.type_name
-	local option_prefix = s2.option_prefix
-	local fv_type
-	local field_type = s.fields["type"]
-	if field_type then
-		fv_type = field_type:formvalue(id)
-	end
-	for i, v in ipairs(s2.children) do
-		local o = s2.children[i]
-		o.config_option = o.option
-		o.option_prefix = option_prefix
-		o.option = option_prefix .. o.option
-		if not o.not_rewrite then
-			o.cfgvalue = function(self, section)
-				-- Add a custom `custom_cfgvalue` attribute. If a custom `custom_cfgvalue` function exists, the custom `cfgvalue` logic will be used.
-				if self.custom_cfgvalue then
-					return self:custom_cfgvalue(section)
-				else
-					if self.rewrite_option then
-						return m:get(section, self.rewrite_option)
-					else
-						return m:get(section, self.config_option)
-					end
-				end
-			end
-			o.write = function(self, section, value)
-				if s.fields["type"]:formvalue(id) == type_name then
-					-- Add a custom `custom_write` attribute; if a custom `custom_write` function exists, then use the custom write logic.
-					if self.custom_write then
-						self:custom_write(section, value)
-					else
-						local new_val = value
-						if util.instanceof(self, cbi.DynamicList) then
-							local new_t = {}
-							if type(value) == "table" then
-								new_t = table_remove_duplicates(value)
-							else
-								new_t = { value }
-							end
-							if self.cast == "string" then
-								new_val = table.concat(new_t, " ")
-							else
-								new_val = new_t
-							end
-						end
-						if self.rewrite_option then
-							m:set(section, self.rewrite_option, new_val)
-						else
-							m:set(section, self.config_option, new_val)
-						end
-					end
-				end
-			end
-			o.remove = function(self, section)
-				if s.fields["type"]:formvalue(id) == type_name then
-					-- Add a custom `custom_remove` attribute; if a custom `custom_remove` function exists, use the custom remove logic.
-					if self.custom_remove then
-						self:custom_remove(section)
-					else
-						if self.rewrite_option then
-							m:del(section, self.rewrite_option)
-						else
-							m:del(section, self.config_option)
-						end
-					end
-				end
-			end
-		end
-
-		local deps = o.deps
-		if #deps > 0 then
-			local function process_deps(dep)
-				local rewrite_deps = {}
-				for k, v in pairs(dep) do
-					if k:find("!") then
-						rewrite_deps[k] = v
-					else
-						rewrite_deps[option_prefix .. k] = v
-					end
-				end
-				if not rewrite_deps['!reverse'] then
-					rewrite_deps["type"] = type_name
-				end
-				return rewrite_deps
-			end
-			for index, value in ipairs(deps) do
-				local rewrite_deps = process_deps(value)
-				if rewrite_deps then
-					deps[index] = rewrite_deps
-				end
-			end
-		else
-			o:depends({ type = type_name })
-		end
-
-		if fv_type and fv_type ~= type_name then
-			o.rmempty = true
-		end
-
-		s:append(o)
-	end
-end
-
 function get_std_domain(domain)
 	domain = trim(domain)
 	if domain == "" then return "" end
@@ -2068,3 +2076,11 @@ function gen_wireguard_key()
 		}
 	end
 end
+
+function get_socks_port_by_cache(node_id)
+	return get_cache_var("node_%s_socks_port" % { node_id })
+end
+
+function set_socks_port_to_cache(node_id, v)
+	set_cache_var("node_%s_socks_port" % { node_id }, v)
+end
@@ -105,31 +105,51 @@ function gen_outbound(flag, node, tag, proxy_table)
 		end

 		if node.type ~= "sing-box" then
-			local relay_port = node.port
-			local new_port = api.get_new_port()
-			local config_file = string.format("%s_%s_%s.json", flag, tag, new_port)
-			if tag and node_id and not tag:find(node_id) then
-				config_file = string.format("%s_%s_%s_%s.json", flag, tag, node_id, new_port)
-			end
-			if run_socks_instance then
-				sys.call(string.format('/usr/share/passwall/app.sh run_socks "%s"> /dev/null',
-					string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
-						new_port, --flag
-						node_id, --node
-						"127.0.0.1", --bind
-						new_port, --socks port
-						config_file, --config file
-						(proxy_tag and relay_port) and tostring(relay_port) or "" --relay port
+			if node.type == "Socks" then
+				node.protocol = "socks"
+				proxy_tag = "socks <- " .. node_id
+			else
+				local new_port
+				if run_socks_instance then
+					local relay_port = (proxy_tag and node.port) and tostring(node.port) or ""
+					if relay_port == "" then
+						local cache = api.get_socks_port_by_cache(node_id)
+						if cache then
+							new_port = cache
+							run_socks_instance = nil
+						end
+					end
+					if run_socks_instance then
+						new_port = api.get_new_port()
+						local config_file = string.format("nodesocks_%s_%s.json", node_id, new_port)
+						if tag and node_id and not tag:find(node_id) then
+							config_file = string.format("nodesocks_%s_%s_%s.json", tag, node_id, new_port)
+						end
+						sys.call(string.format('/usr/share/passwall/app.sh run_socks "%s"> /dev/null',
+							string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
+								new_port, --flag
+								node_id, --node
+								"127.0.0.1", --bind
+								new_port, --socks port
+								config_file, --config file
+								relay_port --relay port
+								)
+							)
 						)
-					)
-				)
+						if relay_port == "" then
+							api.set_socks_port_to_cache(node_id, new_port)
+						end
+					end
+				end
+				if new_port then
+					node = {
+						protocol = "socks",
+						address = "127.0.0.1",
+						port = new_port
+					}
+					proxy_tag = "socks <- " .. node_id
+				end
 			end
-			node = {
-				protocol = "socks",
-				address = "127.0.0.1",
-				port = new_port
-			}
-			proxy_tag = "socks <- " .. node_id
 		else
 			if proxy_tag then
 				node.detour = proxy_tag
@@ -481,9 +501,9 @@ function gen_outbound(flag, node, tag, proxy_table)
 				obfs = node.hysteria_obfs,
 				auth = (node.hysteria_auth_type == "base64") and node.hysteria_auth_password or nil,
 				auth_str = (node.hysteria_auth_type == "string") and node.hysteria_auth_password or nil,
-				recv_window_conn = tonumber(node.hysteria_recv_window_conn),  --1.14 将变更为 stream_receive_window
-				recv_window = tonumber(node.hysteria_recv_window),  --1.14 将变更为 connection_receive_window
-				disable_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,  --1.14 将变更为 disable_path_mtu_discovery
+				stream_receive_window = tonumber(node.hysteria_recv_window_conn),
+				connection_receive_window = tonumber(node.hysteria_recv_window),
+				disable_path_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,
 				tls = tls
 			}
 		end
@@ -910,10 +930,10 @@ function gen_config_server(node)
 			down_mbps = tonumber(node.hysteria_down_mbps),
 			obfs = node.hysteria_obfs,
 			users = users,
-			recv_window_conn = node.hysteria_recv_window_conn and tonumber(node.hysteria_recv_window_conn) or nil, --1.14 to stream_receive_window
-			recv_window_client = node.hysteria_recv_window_client and tonumber(node.hysteria_recv_window_client) or nil, --1.14 to connection_receive_window
-			max_conn_client = node.hysteria_max_conn_client and tonumber(node.hysteria_max_conn_client) or nil,  --1.14 to max_concurrent_streams
-			disable_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,  --1.14 to disable_path_mtu_discover
+			stream_receive_window = node.hysteria_recv_window_conn and tonumber(node.hysteria_recv_window_conn) or nil,
+			connection_receive_window = node.hysteria_recv_window_client and tonumber(node.hysteria_recv_window_client) or nil,
+			max_concurrent_streams = node.hysteria_max_conn_client and tonumber(node.hysteria_max_conn_client) or nil,
+			disable_path_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,
 			tls = tls
 		}
 	end
@@ -1127,8 +1147,10 @@ function gen_config(var)
 	local direct_dns_query_strategy = var["direct_dns_query_strategy"]
 	local remote_dns_udp_server = var["remote_dns_udp_server"]
 	local remote_dns_udp_port = var["remote_dns_udp_port"]
+	local remote_dns_quic = var["remote_dns_quic"]
 	local remote_dns_tcp_server = var["remote_dns_tcp_server"]
 	local remote_dns_tcp_port = var["remote_dns_tcp_port"]
+	local remote_dns_tls = var["remote_dns_tls"]
 	local remote_dns_doh = var["remote_dns_doh"]
 	local remote_dns_http3 = var["remote_dns_http3"]
 	local remote_dns_client_ip = var["remote_dns_client_ip"]
@@ -1883,13 +1905,19 @@ function gen_config(var)
 			remote_server.type = "udp"
 			remote_server.server = remote_dns_udp_server
 			remote_server.server_port = server_port
-
+			if remote_dns_quic then
+				remote_server.type = "quic"
+				remote_server.server_port = tonumber(remote_dns_udp_port) or 853
+			end
 		elseif remote_dns_tcp_server then
 			local server_port = tonumber(remote_dns_tcp_port) or 53
 			remote_server.type = "tcp"
 			remote_server.server = remote_dns_tcp_server
 			remote_server.server_port = server_port
-
+			if remote_dns_tls then
+				remote_server.type = "tls"
+				remote_server.server_port = tonumber(remote_dns_tcp_port) or 853
+			end
 		elseif remote_dns_doh then
 			local _a = api.parseDoH(remote_dns_doh)
 			if _a then
@@ -2208,14 +2236,10 @@ function gen_config(var)
 		})
 	else
 		table.insert(dns.rules, 1, {
-			action = "evaluate",
+			preferred_by = "hosts",
+			action = "route",
 			server = "hosts"
 		})
-		table.insert(dns.rules, 2, {
-			match_response = true,
-			ip_accept_any = true,
-			action = "respond"
-		})
 	end

 	if COMMON.default_outbound_tag == "block" then
@@ -44,6 +44,7 @@ function gen_outbound(flag, node, tag, proxy_table)
 		local remarks = node.remarks

 		local proxy_tag = nil
+		local dialer_proxy_tag = nil
 		local fragment = nil
 		local noise = nil
 		local run_socks_instance = true
@@ -59,39 +60,50 @@ function gen_outbound(flag, node, tag, proxy_table)
 				node.protocol = "socks"
 				node.transport = "tcp"
 			else
-				local relay_port = node.port
-				local new_port = api.get_new_port()
-				local config_file = string.format("%s_%s_%s.json", flag, tag, new_port)
-				if tag and node_id and not tag:find(node_id) then
-					config_file = string.format("%s_%s_%s_%s.json", flag, tag, node_id, new_port)
-				end
+				local new_port
 				if run_socks_instance then
-					sys.call(string.format('/usr/share/passwall/app.sh run_socks "%s"> /dev/null',
-						string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
-							new_port, --flag
-							node_id, --node
-							"127.0.0.1", --bind
-							new_port, --socks port
-							config_file, --config file
-							(proxy_tag and relay_port) and tostring(relay_port) or "" --relay port
+					local relay_port = (proxy_tag and node.port) and tostring(node.port) or ""
+					if relay_port == "" then
+						local cache = api.get_socks_port_by_cache(node_id)
+						if cache then
+							new_port = cache
+							run_socks_instance = nil
+						end
+					end
+					if run_socks_instance then
+						new_port = api.get_new_port()
+						local config_file = string.format("nodesocks_%s_%s.json", node_id, new_port)
+						if tag and node_id and not tag:find(node_id) then
+							config_file = string.format("nodesocks_%s_%s_%s.json", tag, node_id, new_port)
+						end
+						sys.call(string.format('/usr/share/passwall/app.sh run_socks "%s"> /dev/null',
+							string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
+								new_port, --flag
+								node_id, --node
+								"127.0.0.1", --bind
+								new_port, --socks port
+								config_file, --config file
+								relay_port --relay port
+								)
+							)
 						)
-					))
+						if relay_port == "" then
+							api.set_socks_port_to_cache(node_id, new_port)
+						end
+					end
+				end
+				if new_port then
+					node = {}
+					node.protocol = "socks"
+					node.transport = "tcp"
+					node.address = "127.0.0.1"
+					node.port = new_port
 				end
-				node = {}
-				node.protocol = "socks"
-				node.transport = "tcp"
-				node.address = "127.0.0.1"
-				node.port = new_port
 			end
 			node.stream_security = "none"
 			proxy_tag = "socks <- " .. node_id
 		else
-			if proxy_tag then
-				node.proxySettings = {
-					tag = proxy_tag,
-					transportLayer = true
-				}
-			end
+			dialer_proxy_tag = proxy_tag
 		end

 		if node.type == "Xray" then
@@ -124,6 +136,10 @@ function gen_outbound(flag, node, tag, proxy_table)
 			node.stream_security = "tls"
 		end

+		if node.protocol == "http" and node.stream_security == "tls" then
+			node.transport = "raw"
+		end
+
 		if remarks then
 			tag = tag .. ":" .. remarks
 		end
@@ -135,7 +151,6 @@ function gen_outbound(flag, node, tag, proxy_table)
 			_flag = flag,
 			_flag_proxy_tag = proxy_tag,
 			tag = tag,
-			proxySettings = node.proxySettings or nil,
 			protocol = node.protocol,
 			mux = {
 				enabled = (node.mux == "1") and true or false,
@@ -143,7 +158,7 @@ function gen_outbound(flag, node, tag, proxy_table)
 				xudpConcurrency = (node.mux == "1" and ((node.xudp_concurrency) and tonumber(node.xudp_concurrency) or 8)) or nil
 			} or nil,
 			-- 底层传输配置
-			streamSettings = (node.streamSettings or node.protocol == "vmess" or node.protocol == "vless" or node.protocol == "socks" or node.protocol == "shadowsocks" or node.protocol == "trojan" or node.protocol == "hysteria") and {
+			streamSettings = (node.streamSettings or dialer_proxy_tag or node.protocol == "vmess" or node.protocol == "vless" or node.protocol == "socks" or node.protocol == "shadowsocks" or node.protocol == "trojan" or node.protocol == "hysteria" or node.protocol == "http") and {
 				sockopt = {
 					mark = 255,
 					domainStrategy = node.domain_strategy or "UseIP",
@@ -154,7 +169,8 @@ function gen_outbound(flag, node, tag, proxy_table)
 						PrioritizeIPv6 = false,
 						Interleave = 1,
 						MaxConcurrentTry = 4
-					} or nil
+					} or nil,
+					dialerProxy = dialer_proxy_tag,
 				},
 				[(api.compare_versions(xray_version, "<", "26.7.11")) and "network" or "method"] = node.transport, -- Todo: Remove version check and "network"
 				security = node.stream_security,
@@ -548,7 +564,7 @@ function gen_config_server(node)
 			allowTransparent = false,
 			users = users
 		}
-		node.transport = "tcp"
+		node.transport = "raw"
 		node.tcp_guise = "none"
 	elseif node.protocol == "shadowsocks" then
 		settings = {
@@ -1209,10 +1225,9 @@ function gen_config(var)
 						end
 						if preproxy_outbound then
 							outbound.tag = preproxy_outbound.tag .. " -> " .. outbound.tag
-							outbound.proxySettings = {
-								tag = preproxy_outbound.tag,
-								transportLayer = true
-							}
+							outbound.streamSettings = outbound.streamSettings or {}
+							outbound.streamSettings.sockopt = outbound.streamSettings.sockopt or {}
+							outbound.streamSettings.sockopt.dialerProxy = preproxy_outbound.tag
 							if not exist then
 								last_insert_outbound = preproxy_outbound
 							end
@@ -1260,10 +1275,9 @@ function gen_config(var)
 					if to_outbound then
 						to_outbound.tag = outbound.tag .. " -> " .. to_outbound.tag
 						if to_node.type == "Xray" then
-							to_outbound.proxySettings = {
-								tag = outbound.tag,
-								transportLayer = true
-							}
+							to_outbound.streamSettings = to_outbound.streamSettings or {}
+							to_outbound.streamSettings.sockopt = to_outbound.streamSettings.sockopt or {}
+							to_outbound.streamSettings.sockopt.dialerProxy = outbound.tag
 						end
 						table.insert(outbounds_table, to_outbound)
 						default_outTag = to_outbound.tag
@@ -1800,8 +1814,8 @@ function gen_config(var)
 			remote_dns_outbound = {
 				tag = "dns-out",
 				protocol = "dns",
-				proxySettings = dns_outbound_tag and {
-					tag = (dns_outbound_tag ~= "blackhole") and dns_outbound_tag or "direct"
+				streamSettings = dns_outbound_tag and {
+					sockopt = { dialerProxy = (dns_outbound_tag ~= "blackhole") and dns_outbound_tag or "direct" }
 				} or nil,
 				settings = {
 					address = (chn_list ~= "proxy") and "8.8.8.8" or "223.5.5.5",
@@ -2032,13 +2046,13 @@ function gen_config(var)
 		local direct_outbound = {
 			protocol = "freedom",
 			tag = "direct",
-			settings = {
-				domainStrategy = (direct_dns_query_strategy and direct_dns_query_strategy ~= "") and direct_dns_query_strategy or "UseIP",
-				finalRules = (api.compare_versions(xray_version, ">", "26.4.25")) and {{ action = "allow" }} or nil  -- Todo: Remove version check
-			},
+			settings = (api.compare_versions(xray_version, ">", "26.4.25")) and {  -- Todo: Remove version check
+				finalRules = {{ action = "allow" }}
+			} or nil,
 			streamSettings = {
 				sockopt = {
-					mark = 255
+					mark = 255,
+					domainStrategy = (direct_dns_query_strategy and direct_dns_query_strategy ~= "") and direct_dns_query_strategy or "UseIP"
 				}
 			}
 		}
@@ -1,121 +0,0 @@
-<%
-local map = self.map
-local api = map.api
-local sid = self.section
-%>
-<script type="text/javascript">
-	//<![CDATA[
-	function to_edit_node(btn) {
-		if (!btn) return;
-		const idReg = /^cbid\..*\..*node$/;
-		let hidden_select = null;
-		const selects = document.querySelectorAll('select[id^="cbid."][id*="."][id$="node"]');
-		for (const sel of selects) {
-			if ( idReg.test(sel.id) && getComputedStyle(sel).display === "none" && (sel.compareDocumentPosition(btn) & Node.DOCUMENT_POSITION_FOLLOWING)) {
-				hidden_select = sel;
-			}
-		}
-		if (!hidden_select) return;
-		let node_select_value = hidden_select?.options[0]?.value;
-		if (!node_select_value || node_select_value.indexOf("tcp") === 0) {
-			return;
-		}
-		let to_url = '<%=api.url("node_config")%>/' + node_select_value;
-		if (node_select_value.indexOf("socks_") === 0) {
-			to_url = '<%=api.url("socks_config")%>/' + node_select_value;
-		}
-		location.href = to_url;
-	}
-
-	document.addEventListener('DOMContentLoaded', function () {
-		function go() {
-			const node = document.querySelector(".cbi-section-node");
-			if (!node) return false;
-			let changed = false;
-			const all_node = node.querySelectorAll("[id]");
-			const reg1 = /^cbid\..*node\.main$/;
-
-			for (const el of all_node) {
-				if (!reg1.test(el.id)) continue;
-
-				if (el.querySelector(".node-actions")) continue;
-
-				const cbid = el.id.replace(/\.main$/, "");
-				const hidden_select = document.getElementById(cbid);
-				const node_select_value = hidden_select?.options[0]?.value;
-				if (!node_select_value) {
-					continue;
-				}
-
-				let html = '<a href="#" onclick="return to_edit_node(this);"><%:Edit%></a>';
-
-				const m = cbid.match(/\.node$/);
-				if (m) {
-					html += '<a href="#" onclick="window.open(\'' + '<%=api.url("get_redir_log") .. "?id=" .. sid%>' + '\', \'_blank\')"><%:Log%></a>';
-				}
-
-				html = '<div class="node-actions" style="display:inline-flex; align-items:center; gap:4px; flex-wrap:wrap; margin-left:4px;">' + html + '</div>'
-
-				el.insertAdjacentHTML("beforeend", html);
-				changed = true;
-			}
-			return changed;
-		}
-
-		const target = document.querySelector('form') || document.body;
-		const observer = new MutationObserver(() => go() ? observer.disconnect() : 0);
-		observer.observe(target, { childList: true, subtree: true });
-		const timer = setInterval(() => go() ? (clearInterval(timer), observer.disconnect()) : 0, 300);
-		setTimeout(() => { clearInterval(timer); observer.disconnect(); }, 5000);
-	});
-
-	(function () {
-		const startTime = Date.now();
-		const TIMEOUT = 3000;
-
-		const waitForDnsSelect = () => {
-			const dns_select = document.querySelector("select[id*='dns_shunt']");
-			if (dns_select) {
-				initDnsSelect(dns_select);
-				return;
-			}
-			if (Date.now() - startTime >= TIMEOUT) {
-				return;
-			}
-			requestAnimationFrame(waitForDnsSelect);
-		};
-		waitForDnsSelect();
-
-		const initDnsSelect = (dns_select) => {
-			if (dns_select.value === "chinadns-ng") {
-				addLogLink(dns_select);
-			}
-			if (dns_select._dnsLogBinded) return;
-			dns_select._dnsLogBinded = true;
-
-			dns_select.addEventListener("change", () => {
-				const existingLogLink = dns_select.parentElement.querySelector("a.dns-log-link");
-				if (existingLogLink) {
-					existingLogLink.remove();
-				}
-				if (dns_select.value === "chinadns-ng") {
-					addLogLink(dns_select);
-				}
-			});
-		};
-
-		const addLogLink = (select) => {
-			if (select.parentElement.querySelector("a.dns-log-link")) {
-				return;
-			}
-			const logLink = document.createElement("a");
-			logLink.innerHTML = "<%:Log%>";
-			logLink.href = "#";
-			logLink.className = "dns-log-link";
-			logLink.style.marginLeft = "10px";
-			logLink.setAttribute("onclick", "window.open('" + '<%=api.url("get_chinadns_log") .. "?flag=" .. sid%>' + "', '_blank')");
-			select.insertAdjacentElement("afterend", logLink);
-		};
-	})();
-	//]]>
-</script>
@@ -1,59 +0,0 @@
-<%
-local map = self.map
-local api = map.api
-local appname = map.config
-local section = self.section
-%>
-<script type="text/javascript">
-	//<![CDATA[
-	const shunt_list = JSON.parse('<%=self.shunt_list%>');
-
-	document.addEventListener("DOMContentLoaded", () => {
-		const id = "cbid.<%=appname%>.<%=section%>.node";
-		let node = null;
-		const onChange = (e) => {
-			const new_val = e.target.value;
-			const new_hasItem = shunt_list.some(element => element.id == new_val);
-			if (new_hasItem) {
-				XHR.get('<%=api.url("update_config")%>', {
-					id: "<%=section%>",
-					data: JSON.stringify({
-						node: new_val,
-						mode: "1"
-					})
-				}, function(x, data) {
-					if (x && x.status == 200 && data.code == 1) {
-						window.location.reload();
-					} else {
-						alert("<%:Error%>");
-					}
-				});
-			} else {
-				document.getElementById("cbi-<%=appname%>-shunt_option_list")?.style.setProperty("display", "none");
-			}
-		};
-		const check = () => {
-			const el = document.getElementById(id);
-			if (el === node) return;
-			if (node && !el) {
-				document.getElementById("cbi-<%=appname%>-shunt_option_list")?.style.setProperty("display", "none");
-			} else {
-				let o_hasItem = shunt_list.some(element => element.id == el.value);
-				if (o_hasItem) {
-					document.getElementById("cbi-<%=appname%>-shunt_option_list")?.style.setProperty("display", "");
-				}
-			}
-			node = el;
-			if (node) {
-				node.addEventListener("change", onChange);
-			}
-		};
-		const observer = new MutationObserver(check);
-		observer.observe(document.body, {
-			childList: true,
-			subtree: true
-		});
-		check();
-	});
-	//]]>
-</script>
@@ -65,13 +65,13 @@ window.dl_dropdown_data["<%=cbid%>"] = <%=json.stringify(dropdown_data)%>;
 </script>

 <div id="<%=cbid%>.main" class="dl-dropdown-container">
-	<select id="<%=cbid%>.ref" class="cbi-input-select" style="display:none !important;">
-		<option value>placeholder</option>
-	</select>
-
+	<div style="display:none !important;">
+		<select id="<%=cbid%>.ref" class="cbi-input-select" style="display:none !important;">
+			<option value>placeholder</option>
+		</select>
+	</div>
 	<!-- 已选节点显示区 -->
 	<div id="<%=cbid%>.selected" class="dl-selected-list"></div>
-
 	<!-- 模拟 listvalue 控件外观 -->
 	<div class="cbi-input-value cbi-input-select dl-dropdown-display" id="<%=cbid%>.display" tabindex="0">
 		<span id="<%=cbid%>.label" class="dl-dropdown-label">
@@ -90,9 +90,11 @@ window.lv_dropdown_data["<%=cbid%>"] = <%=json.stringify(dropdown_data)%>;

 <div id="<%=cbid%>.main" class="lv-dropdown-container">
 	<!-- 隐藏 select（保存实际配置值） -->
-	<select id="<%=cbid%>" name="<%=cbid%>" class="cbi-input-select" data-update="change" style="display:none !important;">
-		<option value="<%=current_key%>" selected="selected">placeholder</option>
-	</select>
+	<div style="display:none !important;">
+		<select id="<%=cbid%>" name="<%=cbid%>" class="cbi-input-select" data-update="change" style="display:none !important;">
+			<option value="<%=current_key%>" selected="selected">placeholder</option>
+		</select>
+	</div>
 	<!-- 模拟 ListValue 控件外观 -->
 	<div class="cbi-input-value cbi-input-select lv-dropdown-display" id="<%=cbid%>.display" tabindex="0">
 		<span id="<%=cbid%>.label" class="lv-dropdown-label" title="<%=pcdata(current_label)%>">
@@ -64,9 +64,11 @@ end
 %>

 <div id="<%=cbid%>" class="cbi-input-select" style="display:inline-block;">
-	<select id="<%=cbid%>.ref" class="cbi-input-select" style="display:none !important;">
-		<option value>placeholder</option>
-	</select>
+	<div style="display:none !important;">
+		<select id="<%=cbid%>.ref" class="cbi-input-select" style="display:none !important;">
+			<option value>placeholder</option>
+		</select>
+	</div>
 	<!-- 搜索框 -->
 	<input type="text" id="<%=cbid%>.search"
 		class="mv_search_input cbi-input-text"
@@ -97,9 +97,11 @@ window.v_dropdown_data["<%=cbid%>"] = <%=json.stringify(dropdown_data)%>;
 </script>

 <div id="<%=cbid%>.v-main" class="v-dropdown-container">
-	<select id="<%=cbid%>.ref" class="cbi-input-select" style="display:none !important;">
-		<option value>placeholder</option>
-	</select>
+	<div style="display:none !important;">
+		<select id="<%=cbid%>.ref" class="cbi-input-select" style="display:none !important;">
+			<option value>placeholder</option>
+		</select>
+	</div>
 	<!-- 隐藏 input（保存实际配置值） -->
 	<input type="text" id="<%=cbid%>" name="<%=cbid%>" value="<%=current_key%>" data-update="change" style="display:none !important;" />
 	<!-- 模拟 ListValue 控件外观 -->
@@ -14,11 +14,6 @@ local sid = "@global[0]"
 	}
 }

-.shunt-tab-hidden {
-	display: none !important;
-	visibility: hidden !important;
-}
-
@media screen and (max-width: 1152px) {
 	#cbi-<%=appname%>-socks .cbi-section-table-titles {
 		display: none !important;
@@ -28,7 +23,6 @@ local sid = "@global[0]"
 <script type="text/javascript">
 	//<![CDATA[
 	let global_id = "<%=sid%>";
-	const shunt_list = JSON.parse('<%=self.shunt_list%>');

 	function to_edit_node(btn, stype) {
 		if (!btn) return;
@@ -235,47 +229,5 @@ local sid = "@global[0]"
 			select.insertAdjacentElement("afterend", logLink);
 		};
 	})();
-
-	document.addEventListener("DOMContentLoaded", () => setTimeout(() => {
-		const hiddenSelect = document.getElementById("cbid.<%=appname%>.<%=sid%>.node");
-		let o_val = hiddenSelect.value
-		const o_hasItem = shunt_list.find(element => element.id == o_val);
-		hiddenSelect.addEventListener("change", function(el){
-			let new_val = el.target.value
-			const new_hasItem = shunt_list.find(element => element.id == new_val);
-			if (new_hasItem) {
-				XHR.get('<%=api.url("update_config")%>', {
-					id: "<%=sid%>",
-					data: JSON.stringify({
-						node: new_val
-					})
-				},
-				function(x, data) {
-					if (x && x.status == 200 && data.code == 1) {
-						window.location.reload();
-					}
-					else {
-						alert("<%:Error%>");
-					}
-				});
-			} else {
-				try {
-					document.getElementById("tab.<%=appname%>.<%=sid%>.Shunt").classList.add('shunt-tab-hidden');
-					document.getElementById("tab.<%=appname%>.<%=sid%>.Shunt").style.display = "none";
-				} catch (error) {}
-				try {
-					document.querySelector('li[data-tab*="Shunt"]').classList.add('shunt-tab-hidden');
-					document.querySelector('li[data-tab*="Shunt"]').style.display = "none";
-				} catch (error) {}
-			}
-		});
-		let shunt_taboption = document.getElementById("container.<%=appname%>.<%=sid%>.Shunt");
-		if (shunt_taboption) {
-			let shunt_option_list = document.getElementById("cbi-<%=appname%>-shunt_option_list");
-			if (shunt_option_list) {
-				shunt_taboption.appendChild(shunt_option_list);
-			}
-		}
-	}, 100));
 	//]]>
 </script>
@@ -1,14 +1,14 @@
-<div class="cbi-value" id="cbi-<%=self.config.."-"..section.."-"..self.option%>" data-index="<%=self.index%>" data-depends="<%=pcdata(self:deplist2json(section))%>">
-	<label class="cbi-value-title">
-		<%:Switch Mode%>
-	</label>
-	<div class="cbi-value-field">
-		<div>
-			<input class="btn cbi-button cbi-button-apply" type="button" onclick="switch_gfw_mode()" value="<%:GFW List%>" />
-			<input class="btn cbi-button cbi-button-apply" type="button" onclick="switch_chnroute_mode()" value="<%:Not China List%>" />
-			<input class="btn cbi-button cbi-button-apply" type="button" onclick="switch_returnhome_mode()" value="<%:China List%>" />
-			<input class="btn cbi-button cbi-button-apply" type="button" onclick="switch_global_mode()" value="<%:Global Proxy%>" />
-		</div>
+<%+cbi/valueheader%>
+
+<label class="cbi-value-title">
+	<%:Switch Mode%>
+</label>
+<div class="cbi-value-field">
+	<div>
+		<input class="btn cbi-button cbi-button-apply" type="button" onclick="switch_gfw_mode()" value="<%:GFW List%>" />
+		<input class="btn cbi-button cbi-button-apply" type="button" onclick="switch_chnroute_mode()" value="<%:Not China List%>" />
+		<input class="btn cbi-button cbi-button-apply" type="button" onclick="switch_returnhome_mode()" value="<%:China List%>" />
+		<input class="btn cbi-button cbi-button-apply" type="button" onclick="switch_global_mode()" value="<%:Global Proxy%>" />
 	</div>
 </div>

@@ -108,3 +108,4 @@
 		opt.set("udp_proxy_mode", "proxy");
 	}
 </script>
+<%+cbi/valuefooter%>
@@ -0,0 +1,73 @@
+<%
+local map = self.map
+local api = map.api
+local config = map.config
+local verify_option = self.verify_option
+local section_id = verify_option.section.section
+-%>
+<% if verify_option then -%>
+<script type="text/javascript">
+	//<![CDATA[
+	document.addEventListener("DOMContentLoaded", () => {
+		const shunt_list = JSON.parse('<%=self.shunt_list%>');
+		const dom_node_id = "<%=verify_option:cbid(section_id)%>";
+		let uci_node_val = "";
+		const onChange = (e) => {
+			const new_val = e.target.value;
+			const to_shunt = shunt_list.some(element => element.id == new_val);
+			if (to_shunt) {
+				const map = document.getElementById("cbi-<%=config%>");
+				const hiddenInput = document.createElement('input');
+				hiddenInput.type = 'hidden';
+				hiddenInput.name = 'node_save_before';
+				hiddenInput.value = uci_node_val;
+				map.appendChild(hiddenInput);
+				const saveBtn = document.getElementsByClassName('cbi-button-save');
+				if (saveBtn && saveBtn.length > 0) {
+					saveBtn[saveBtn.length - 1].click();
+				}
+				/*
+				XHR.get('<%=api.url("update_config")%>', {
+					id: "<%=section_id%>",
+					data: JSON.stringify({
+						node: new_val,
+						mode: "1"
+					})
+				}, function(x, data) {
+					if (x && x.status == 200 && data.code == 1) {
+						window.location.reload();
+					} else {
+						alert("<%:Error%>");
+					}
+				});
+				*/
+			} else {
+				try { shunt.hide(); } catch (error) {}
+			}
+		};
+		const check = () => {
+			const el = document.getElementById(dom_node_id);
+			if (!el) {
+				try { shunt.hide(); } catch (error) {}
+				return;
+			}
+			let is_shunt = shunt_list.some(element => element.id == el.value);
+			if (is_shunt) {
+				try { shunt.show(); } catch (error) {}
+			}
+			if (!el.hasEventListener) {
+				uci_node_val = el.value;
+				el.addEventListener("change", onChange);
+				el.hasEventListener = true;
+			}
+		};
+		const observer = new MutationObserver(check);
+		observer.observe(document.body, {
+			childList: true,
+			subtree: true
+		});
+		check();
+	});
+	//]]>
+</script>
+<%- end %>
@@ -2,18 +2,22 @@
 local map = self.map
 local api = map.api
 local config = map.config
-local id = self.id
-local s_cfgid = self.s_cfgid
+local node_id = self.node_id
+local verify_option = self.verify_option
+local section_id = self.section_id
+local section_type = self.section_type
+local tab_name = self.tab_name
 -%>
 <style>
-.hidden {
+.shunt_hidden {
 	display: none !important;
 	visibility: hidden !important;
 }
 </style>
 <script type="text/javascript">
 	//<![CDATA[
-	const normal_list = JSON.parse('<%=self.normal_list%>');
+	var normal_list = JSON.parse('<%=self.normal_list%>');
+
 	function check_fakedns(id, val) {
 		const dom_id = "cbid.table." + id + ".";
 		const fakedns_dom = document.getElementById(dom_id + "_fakedns");
@@ -21,12 +25,14 @@ local s_cfgid = self.s_cfgid
 			const selectNode = document.getElementById(dom_id + "_node");
 			val = selectNode.value;
 		}
-		if (val == "" || val == "_direct") {
-			fakedns_dom.value = 0;
-			fakedns_dom.checked = false;
-			fakedns_dom.classList.add('hidden');
-		} else {
-			fakedns_dom.classList.remove('hidden');
+		if (fakedns_dom) {
+			if (val == "" || val == "_direct") {
+				fakedns_dom.value = 0;
+				fakedns_dom.checked = false;
+				fakedns_dom.classList.add('shunt_hidden');
+			} else {
+				fakedns_dom.classList.remove('shunt_hidden');
+			}
 		}
 	}
 	function check_proxy_tag(id, val) {
@@ -45,13 +51,13 @@ local s_cfgid = self.s_cfgid
 			const searchInput = document.getElementById(cbid + ".search");
 			const listContainer = document.getElementById(cbid + ".list");
 			lv_change(cbid, listContainer, hiddenSelect, labelSpan, searchInput, "", "<%:Close (Not use)%>");
-			proxy_tag_dom.classList.add('hidden');
+			proxy_tag_dom?.classList.add('shunt_hidden');
 		} else {
-			proxy_tag_dom.classList.remove('hidden');
+			proxy_tag_dom?.classList.remove('shunt_hidden');
 		}
 	}
 	function refresh_depends() {
-		const table_dom = document.getElementById("cbi-passwall-shunt_option_list");
+		const table_dom = document.getElementById("cbi-<%=config%>-<%=section_type%>");
 		if (table_dom) {
 			const trs = table_dom.getElementsByTagName("tr");
 			for (let i = 1; i < trs.length;i++) {
@@ -60,40 +66,82 @@ local s_cfgid = self.s_cfgid
 			}
 		}
 	}
+	const shunt = {
+		tab() {
+			// Move the shunt options to Tab
+			<% if tab_name then -%>
+			const shunt_taboption = document.getElementById("container.<%=config%>.<%=section_id%>.<%=tab_name%>");
+			if (shunt_taboption) {
+				const shunt_option_list = document.getElementById("cbi-<%=config%>-<%=section_type%>");
+				if (shunt_option_list) {
+					shunt_taboption.appendChild(shunt_option_list);
+				}
+			}
+			<%- end %>
+		},
+		hide() {
+			document.getElementById("cbi-<%=config%>-<%=section_type%>")?.classList.add('shunt_hidden');
+			<% if tab_name then -%>
+			try { document.getElementById("tab.<%=config%>.<%=section_id%>.<%=tab_name%>")?.classList.add('shunt_hidden'); } catch (error) {}
+			try { document.querySelector('li[data-tab*="<%=tab_name%>"]')?.classList.add('shunt_hidden'); } catch (error) {}
+			const shunt_taboption = document.getElementById("container.<%=config%>.<%=section_id%>.<%=tab_name%>");
+			if (shunt_taboption) {
+				[...shunt_taboption.querySelectorAll('[name]')].forEach(el => {
+					const nameValue = el.getAttribute('name');
+					el.setAttribute('o-name', nameValue);
+					el.removeAttribute('name');
+				});
+			}
+			<%- end %>
+		},
+		show() {
+			document.getElementById("cbi-<%=config%>-<%=section_type%>")?.classList.remove('shunt_hidden');
+			<% if tab_name then -%>
+			try { document.getElementById("tab.<%=config%>.<%=section_id%>.<%=tab_name%>")?.classList.remove('shunt_hidden'); } catch (error) {}
+			try { document.querySelector('li[data-tab*="<%=tab_name%>"]')?.classList.remove('shunt_hidden'); } catch (error) {}
+			const shunt_taboption = document.getElementById("container.<%=config%>.<%=section_id%>.<%=tab_name%>");
+			if (shunt_taboption) {
+				[...shunt_taboption.querySelectorAll('[o-name]')].forEach(el => {
+					const nameValue = el.getAttribute('o-name');
+					el.setAttribute('name', nameValue);
+					el.removeAttribute('o-name');
+				});
+			}
+			<%- end %>
+		}
+	}
 	document.addEventListener("DOMContentLoaded", function () {
+		shunt.tab();
 		waitForElement('select[name*="<%=config%>"][name*="shunt_group"]', function(el) {
 			let o_val = el.value;
 			el.addEventListener("change", () => {
 				el.blur();
 				if (o_val != el.value) {
-					let save = true;
-					if (save) {
-						update_config("<%=id%>", {
-							shunt_group: getOption("<%=config%>", "<%=s_cfgid%>", "shunt_group").value,
-						}, get_current_url());
-					}
+					update_config("<%=node_id%>", {
+						shunt_group: getOption("<%=config%>", "<%=section_id%>", "shunt_group").value,
+					}, get_current_url());
 				}
 			});
 		});
-	});
-	document.addEventListener("DOMContentLoaded", () => setTimeout(() => {
-		refresh_depends();
-		const table_dom = document.getElementById("cbi-passwall-shunt_option_list");
-		if (table_dom) {
-			const trs = table_dom.getElementsByTagName("tr");
-			for (let i = 1; i < trs.length;i++) {
-				const selectNode = document.getElementById("cbid.table." + i + "._node.main");
-				selectNode.addEventListener("change", function(el){
-					let new_val = el.target.value
-					check_fakedns(i, new_val);
-					check_proxy_tag(i, new_val);
-				});
-				if (i == trs.length - 1) {
-					const newArray = window.lv_dropdown_data["cbid.table." + i + "._node"].ungrouped.filter(item => item.key !== "_default");
-					window.lv_dropdown_data["cbid.table." + i + "._node"].ungrouped = newArray
+		setTimeout(() => {
+			refresh_depends();
+			const table_dom = document.getElementById("cbi-<%=config%>-<%=section_type%>");
+			if (table_dom) {
+				const trs = table_dom.getElementsByTagName("tr");
+				for (let i = 1; i < trs.length;i++) {
+					const selectNode = document.getElementById("cbid.table." + i + "._node.main");
+					selectNode.addEventListener("change", function(el){
+						let new_val = el.target.value
+						check_fakedns(i, new_val);
+						check_proxy_tag(i, new_val);
+					});
+					if (i == trs.length - 1) {
+						const newArray = window.lv_dropdown_data["cbid.table." + i + "._node"].ungrouped.filter(item => item.key !== "_default");
+						window.lv_dropdown_data["cbid.table." + i + "._node"].ungrouped = newArray
+					}
 				}
 			}
-		}
-	}, 100));
+		}, 200)
+	});
 	//]]>
 </script>
@@ -26,36 +26,45 @@ local config = map.config
 						update_config(node_id, {
 							remarks: getOption("<%=config%>", "<%=sid%>", "remarks").value,
 							group: getOption("<%=config%>", "<%=sid%>", "group").value,
-							type: getOption("<%=config%>", "<%=sid%>", "type").value,
+							type: el.value,
 							//protocol: ''
 						}, node_config_url);
 					}
 				}
 			});
+			const fromUrlCache = JSON.parse(sessionStorage.getItem("fromUrl"));
+			if (fromUrlCache && fromUrlCache.savetime && (Date.now() - fromUrlCache.timestamp) < fromUrlCache.savetime) {
+				fromUrl(fromUrlCache.link, true)
+			} else {
+				sessionStorage.removeItem("fromUrl");
+			}
 		});
 		waitForElement('select[name*="<%=config%>"][name*="protocol"]', function(el) {
 			let o_val = el.value;
+			const name_split = el.name.split(".");
+			const name = name_split[name_split.length - 1];
 			el.addEventListener("change", () => {
 				el.blur();
 				if (el.value.startsWith("_") || (o_val.startsWith("_") && !el.value.startsWith("_"))) {
-					let name_split = el.name.split(".");
-					let name = name_split[name_split.length - 1];
-					let save = true;
-					if (save) {
-						/*
-						const saveBtn = document.getElementsByClassName('cbi-button-save');
-						if (saveBtn && saveBtn.length > 0) {
-							saveBtn[saveBtn.length - 1].click();
-						}
-						*/
-						update_config(node_id, {
-							remarks: getOption("<%=config%>", "<%=sid%>", "remarks").value,
-							group: getOption("<%=config%>", "<%=sid%>", "group").value,
-							protocol: getOption("<%=config%>", "<%=sid%>", name).value,
-						}, node_config_url);
-					} else {
-						window.location.href = node_config_url + "?select_proto=" + encodeURIComponent(el.value);
+					if (el.value.startsWith("_")) {
+						const map = document.getElementById("cbi-<%=config%>");
+						const hiddenInput = document.createElement('input');
+						hiddenInput.type = 'hidden';
+						hiddenInput.name = 'load' + el.value;
+						hiddenInput.value = '1';
+						map.appendChild(hiddenInput);
 					}
+					const saveBtn = document.getElementsByClassName('cbi-button-save');
+					if (saveBtn && saveBtn.length > 0) {
+						saveBtn[saveBtn.length - 1].click();
+					}
+					/*
+					update_config(node_id, {
+						remarks: getOption("<%=config%>", "<%=sid%>", "remarks").value,
+						group: getOption("<%=config%>", "<%=sid%>", "group").value,
+						protocol: el.value,
+					}, node_config_url);
+					*/
 				}
 			});
 		});
@@ -1,8 +1,8 @@
 <%+cbi/valueheader%>
 <%
-local api = require "luci.passwall.api"
-local appname = api.appname
 local map = self.map
+local api = map.api
+local config = map.config

 local has_ss_rust = api.is_finded("sslocal")
 local has_singbox = api.finded_com("sing-box")
@@ -17,7 +17,7 @@ local hysteria2_type = api.get_core("hysteria2_type", {{has_hysteria2,"hysteria2

 local current_node = map:get(section)
 -%>
-<script src="<%=resource%>/view/<%=appname%>/qrcode.min.js"></script>
+<script src="<%=resource%>/view/<%=api.appname%>/qrcode.min.js"></script>
 <script type="text/javascript">//<![CDATA[
 	let has_singbox = "<%=has_singbox%>"
 	let has_xray = "<%=has_xray%>"
@@ -112,8 +112,7 @@ local current_node = map:get(section)

 	function buildUrl(btn, urlname, sid) {
 		var opt = {
-			base: "cbid.<%=appname%>",
-			client: true,
+			base: "cbid.<%=config%>",
 			get: function (opt) {
 				var id = this.base + "." + opt;
 				var obj = document.getElementsByName(id)[0] || document.getElementsByClassName(id)[0] || document.getElementById(id)
@@ -158,7 +157,6 @@ local current_node = map:get(section)
 			}
 		}
 		opt.base = "cbid." + urlname + "." + sid;
-		opt.client = urlname.indexOf("server") === -1;
 		var v_type = opt.get("type").value;
 		var v_alias = opt.get("remarks");

@@ -753,34 +751,41 @@ local current_node = map:get(section)
 		return server.replace(/^\[/, '').replace(/\]$/, '');
 	}

-	function fromUrl(btn, urlname, sid, cacheData) {
-		var opt = {
-			base: 'cbid.<%=appname%>',
-			client: true,
+	function tofromUrl(btn) {
+		let link = prompt('<%:Paste Share URL Here%>', '');
+		if (link === null || link === "") {
+			return false;
+		}
+		return fromUrl(link);
+	}
+
+	function fromUrl(link, from_cache) {
+		if (!link) {
+			return false;
+		}
+		const s = document.getElementById("<%=self.option%>-status");
+		if (!s) {
+			alert("Never");
+			return false;
+		}
+		s.innerHTML = "";
+
+		const current_type = '<%=current_node.type or ""%>';
+		let switch_type = null;
+
+		const opt = {
+			base: "cbid.<%=self.option%>.<%=self.value%>",
 			get: function (opt) {
-				var obj;
-				var id = this.base + '.' + opt;
-				obj = document.getElementsByName(id)[0] || document.getElementById(id);
-				if (obj) {
-					var combobox = document.getElementById('cbi.combobox.' + id);
-					if (combobox) {
-						obj.combobox = combobox;
-					}
-					var div = document.getElementById(id);
-					if (div && div.getElementsByTagName("li").length > 0) {
-						obj = div;
-					}
-					return obj;
-				} else {
-					return null;
-				}
+				return getOption("<%=config%>", "<%=self.value%>", opt);
 			},
 			set: function (opt, val) {
+				if (!switch_type && opt == "type" && current_type != val) {
+					switch_type = val;
+					return;
+				}
 				var obj;
 				obj = this.get(opt);
 				if (obj) {
-					var event = document.createEvent("HTMLEvents");
-					event.initEvent("change", true, true);
 					if (obj.type === 'checkbox') {
 						obj.checked = val;
 					} else {
@@ -814,17 +819,17 @@ local current_node = map:get(section)
 						}
 					}
 					try {
-						obj.dispatchEvent(event);
+						obj.dispatchEvent(new Event("change", { bubbles: true, cancelable: true }));
 					} catch (err) {}
 				} else {
 					//alert('<%:Faltal on set option, please help in debug: %>' + opt + ' = ' + val);
-					// 处理 DynamicList
+					// Processing DynamicList
 					var fullName = this.base + '.' + opt;
 					var lists = document.querySelectorAll('.cbi-dynlist');
 					for (var i = 0; i < lists.length; i++) {
 						var parent = lists[i].closest('.cbi-value');
 						if (!parent) continue;
-						// 尝试从 label 的 for 属性中提取 fullName
+						// Try to extract fullName from the label's for attribute.
 						var label = parent.querySelector('label.cbi-value-title');
 						var labelFor = label?.getAttribute('for');
 						if (labelFor === fullName) {
@@ -838,57 +843,20 @@ local current_node = map:get(section)
 						}
 					}
 				}
-			},
-			setlist: function (opt, vlist) {
-				var id = this.base + "." + opt;
-				var objs = document.getElementsByName(id) || document.getElementsByClassName(id);
-				if (objs) {
-					var values = "";
-					for (var i = 0; i < vlist.length; i++) {
-						values += vlist[i] + ", ";
-					}
-					alert("Manually input the option:\n" + opt + "s:\n[" + values + "]");
-				} else {
-					//alert("<%:Faltal on set option, please help in debug: %>" + opt);
-				}
 			}
 		}

-		var s = document.getElementById(urlname + '-status');
-		if (!s) {
-			alert("Never");
-			return false;
-		}
-		opt.base = "cbid." + urlname + "." + sid;
-		opt.client = urlname.indexOf("server") === -1;
-		var ssrurl = null;
-		if (cacheData) {
-			ssrurl = cacheData.ssrurl
-		} else {
-			ssrurl = prompt('<%:Paste Share URL Here%>', '');
-			if (ssrurl === null || ssrurl === "") {
-				return false;
-			}
-			sessionStorage.setItem("fromUrl", JSON.stringify({
-				timestamp: Date.now(),
-				savetime: 60 * 1000,
-				urlname: urlname,
-				sid: sid,
-				ssrurl: ssrurl
-			}));
-		}
-		ssrurl = ssrurl.replace(/&amp;/gi, '&').replace(/\s*#\s*/, '#').trim();  //一些奇葩的链接用"&amp;"当做"&"，"#"前后带空格
-		s.innerHTML = "";
-		var ssu = ssrurl.split('://');
-		var event = document.createEvent("HTMLEvents");
-		event.initEvent("change", true, true);
+		link = link.split(/\r\n|\r|\n/, 1)[0];
+		link = link.replace(/&amp;/gi, '&').replace(/\s*#\s*/, '#').trim();  //一些奇葩的链接用"&amp;"当做"&"，"#"前后带空格
+		const link_split = link.split('://');
+		const link_type = link_split[0];

-		var dom_prefix = null
+		let dom_prefix = null;

-		if (ssu[0] === "ssr") {
+		if (link_type === "ssr") {
 			dom_prefix = "ssr_"
-			//var b64c = ssu[1].match(/([A-Za-z0-9_-]+)/);
-			var sstr = b64decsafe((ssu[1] || "").replace(/#.*/, "").trim());
+			//var b64c = link_split[1].match(/([A-Za-z0-9_-]+)/);
+			var sstr = b64decsafe((link_split[1] || "").replace(/#.*/, "").trim());
 			var ploc = sstr.indexOf("/?");
 			var url0 = "", param = "";
 			if (ploc > 0) {
@@ -923,8 +891,8 @@ local current_node = map:get(section)
 			if (typeof (rem) !== 'undefined' && rem !== '' && rem.length > 0)
 				opt.set('remarks', b64decutf8safe(rem));
 		}
-		if (ssu[0] === "ss") {
-			var url0 = ssu[1] || "";
+		if (link_type === "ss") {
+			var url0 = link_split[1] || "";
 			param = "";

 			var ploc = url0.indexOf("#");
@@ -999,15 +967,15 @@ local current_node = map:get(section)
 					queryParam.type && queryParam.type !== "tcp" &&
 					queryParam.headerType && queryParam.headerType !== "none";
 			if (has_xray && (ss_type == "xray" || needUpgrade || queryParam.type === "xhttp")) {
-				dom_prefix = "xray_"
+				dom_prefix = "xray_";
 				opt.set('type', "Xray");
 				opt.set(dom_prefix + 'protocol', "shadowsocks");
 			} else if (has_singbox && (ss_type == "sing-box" || needUpgrade)) {
-				dom_prefix = "singbox_"
+				dom_prefix = "singbox_";
 				opt.set('type', "sing-box");
 				opt.set(dom_prefix + 'protocol', "shadowsocks");
 			} else {
-				dom_prefix = "ssrust_"
+				dom_prefix = "ssrust_";
 				opt.set('type', "SS-Rust");
 			}

@@ -1207,17 +1175,17 @@ local current_node = map:get(section)
 				}
 			}
 		}
-		if (ssu[0] === "trojan") {
+		if (link_type === "trojan") {
 			if (trojan_type == "sing-box" && has_singbox) {
-				dom_prefix = "singbox_"
+				dom_prefix = "singbox_";
 				opt.set('type', "sing-box");
 				opt.set(dom_prefix + 'protocol', "trojan");
 			} else if (trojan_type == "xray" && has_xray) {
-				dom_prefix = "xray_"
+				dom_prefix = "xray_";
 				opt.set('type', "Xray");
 				opt.set(dom_prefix + 'protocol', "trojan");
 			}
-			var m = parseNodeUrl(ssrurl);
+			var m = parseNodeUrl(link);
 			var password = m.passwd;
 			if (password === "") {
 				s.innerHTML = "<font color='red'><%:Invalid Share URL Format%></font>";
@@ -1345,14 +1313,14 @@ local current_node = map:get(section)
 				opt.set('remarks', decodeURIComponent(m.hash.substr(1)));
 			}
 		}
-		if (ssu[0] === "vmess") {
-			var sstr = b64DecodeUnicode((ssu[1] || "").replace(/#.*/, "").trim());
+		if (link_type === "vmess") {
+			var sstr = b64DecodeUnicode((link_split[1] || "").replace(/#.*/, "").trim());
 			var ploc = sstr.indexOf("/?");
 			if (vmess_type == "sing-box" && has_singbox) {
-				dom_prefix = "singbox_"
+				dom_prefix = "singbox_";
 				opt.set('type', "sing-box");
 			} else if (has_xray) {
-				dom_prefix = "xray_"
+				dom_prefix = "xray_";
 				opt.set('type', "Xray");
 			}
 			opt.set(dom_prefix + 'protocol', "vmess");
@@ -1446,14 +1414,14 @@ local current_node = map:get(section)
 			opt.set(dom_prefix + 'use_finalmask', !!ssm.fm);
 			opt.set(dom_prefix + 'finalmask', ssm.fm || "");
 		}
-		if (ssu[0] === "vless") {
+		if (link_type === "vless") {
 			if (vless_type == "sing-box" && has_singbox) {
 				dom_prefix = "singbox_";
 			} else if (has_xray) {
 				dom_prefix = "xray_";
 			}

-			var m = parseNodeUrl(ssrurl);
+			var m = parseNodeUrl(link);
 			var password = m.passwd;
 			if (password === "") {
 				s.innerHTML = "<font color='red'><%:Invalid Share URL Format%></font>";
@@ -1475,7 +1443,7 @@ local current_node = map:get(section)
 			if (["xhttp", "kcp", "mkcp"].includes(queryParam.type) && vless_type !== "xray" && has_xray) {
 				dom_prefix = "xray_";
 			}
-			opt.set("type", dom_prefix === "singbox_" ? "sing-box" : "Xray");
+			opt.set('type', dom_prefix == "singbox_" ? "sing-box" : "Xray");

 			opt.set(dom_prefix + 'protocol', "vless");
 			opt.set(dom_prefix + 'uuid', password);
@@ -1605,8 +1573,8 @@ local current_node = map:get(section)
 				opt.set('remarks', decodeURIComponent(m.hash.substr(1)));
 			}
 		}
-		if (ssu[0] === "hysteria2" || ssu[0] === "hy2") {
-			var m = parseNodeUrl(ssrurl);
+		if (link_type === "hysteria2" || link_type === "hy2") {
+			var m = parseNodeUrl(link);
 			var password = m.passwd;
 			if (password === "") {
 				s.innerHTML = "<font color='red'><%:Invalid Share URL Format%></font>";
@@ -1671,13 +1639,13 @@ local current_node = map:get(section)
 				opt.set('remarks', decodeURIComponent(m.hash.substr(1)));
 			}
 		}
-		if (ssu[0] === "tuic") {
+		if (link_type === "tuic") {
 			if (has_singbox) {
-				dom_prefix = "singbox_"
+				dom_prefix = "singbox_";
 				opt.set('type', "sing-box");
 			}
 			opt.set(dom_prefix + 'protocol', "tuic");
-			var _parsedUrl = new URL("http://" + ssu[1]);
+			var _parsedUrl = new URL("http://" + link_split[1]);
 			var username = _parsedUrl.username;
 			var password = _parsedUrl.password;
 			var hostname = _parsedUrl.hostname;
@@ -1720,13 +1688,13 @@ local current_node = map:get(section)
 				opt.set('remarks', decodeURIComponent(hash.substr(1)));
 			}
 		}
-		if (ssu[0] === "anytls") {
+		if (link_type === "anytls") {
 			if (has_singbox) {
-				dom_prefix = "singbox_"
+				dom_prefix = "singbox_";
 				opt.set('type', "sing-box");
 			}
 			opt.set(dom_prefix + 'protocol', "anytls");
-			var m = parseNodeUrl(ssrurl);
+			var m = parseNodeUrl(link);
 			var password = m.passwd;
 			if (password === "") {
 				s.innerHTML = "<font color='red'><%:Invalid Share URL Format%></font>";
@@ -1776,13 +1744,13 @@ local current_node = map:get(section)
 				opt.set('remarks', decodeURIComponent(m.hash.substr(1)));
 			}
 		}
-		if (ssu[0] === "naive+https" || ssu[0] === "naive+quic") {
+		if (link_type === "naive+https" || link_type === "naive+quic") {
 			if (has_singbox) {
-				dom_prefix = "singbox_"
+				dom_prefix = "singbox_";
 				opt.set('type', "sing-box");
 			}
 			opt.set(dom_prefix + 'protocol', "naive");
-			var _parsedUrl = new URL("http://" + ssu[1]);
+			var _parsedUrl = new URL("http://" + link_split[1]);
 			var username = _parsedUrl.username;
 			var password = _parsedUrl.password;
 			var hostname = _parsedUrl.hostname;
@@ -1817,7 +1785,7 @@ local current_node = map:get(section)
 			opt.set(dom_prefix + 'tls_serverName', queryParam.sni || '');
 			opt.set(dom_prefix + 'ech', !!queryParam.ech);
 			opt.set(dom_prefix + 'ech_config', queryParam.ech || '');
-			if (ssu[0] === "naive+quic") {
+			if (link_type === "naive+quic") {
 				opt.set(dom_prefix + 'naive_quic', true);
 				opt.set(dom_prefix + 'naive_congestion_control', queryParam.congestion_control || 'bbr');
 			}
@@ -1825,16 +1793,25 @@ local current_node = map:get(section)
 				opt.set('remarks', decodeURIComponent(hash.substr(1)));
 			}
 		}
-		if (dom_prefix && dom_prefix != null) {
-			if (opt.get(dom_prefix + 'port').value) {
-				opt.get(dom_prefix + 'port').focus();
-				opt.get(dom_prefix + 'port').blur();
-			}
-		} else {
+
+		if (switch_type) {
+			sessionStorage.setItem("fromUrl", JSON.stringify({
+				timestamp: Date.now(),
+				savetime: 60 * 1000,
+				link: link
+			}));
+			opt.set("type", switch_type);
+			return
+		}
+		if (!dom_prefix) {
 			s.innerHTML = "<font color='red'><%:Invalid Share URL Format%></font>";
 			sessionStorage.removeItem("fromUrl");
 			return false;
 		}
+		if (opt.get(dom_prefix + 'port')) {
+			opt.get(dom_prefix + 'port').focus();
+			opt.get(dom_prefix + 'port').blur();
+		}
 		s.innerHTML = "<font color='green'><%:Import Finished %></font>";
 		sessionStorage.removeItem("fromUrl");
 		return true;
@@ -1844,17 +1821,6 @@ local current_node = map:get(section)
 		window.open('<%=api.url("gen_client_config")%>?id=' + sid, "_blank")
 	}

-	document.addEventListener("DOMContentLoaded", function () {
-		setTimeout(function () {
-			const fromUrlCache = JSON.parse(sessionStorage.getItem("fromUrl"));
-			if (fromUrlCache && fromUrlCache.savetime && (Date.now() - fromUrlCache.timestamp) < fromUrlCache.savetime) {
-				fromUrl(null, fromUrlCache.urlname, fromUrlCache.sid, fromUrlCache)
-			} else {
-				sessionStorage.removeItem("fromUrl");
-			}
-		}, 500);
-	})
-
 //]]></script>
 <style>
 .share-toolbar {
@@ -1887,7 +1853,7 @@ local current_node = map:get(section)
 <div class="share-toolbar">
 	<div class="toolbar-buttons">
 		<% if not current_node.protocol or not current_node.protocol:find("^_") then -%>
-		<input id="fromUrlBtn" type="button" class="btn cbi-button cbi-button-apply" value='<%:From Share URL%>' onclick="return fromUrl(this, '<%=self.option%>', '<%=self.value%>')" />
+		<input id="fromUrlBtn" type="button" class="btn cbi-button cbi-button-apply" value='<%:From Share URL%>' onclick="return tofromUrl()" />
 		<input id="exportUrlBtn" type="button" class="btn cbi-button cbi-button-apply" value='<%:Build Share URL%>' onclick="return exportUrl(this, '<%=self.option%>', '<%=self.value%>')" />
 		<input id="genQrcodeBtn" type="button" class="btn cbi-button cbi-button-apply" value='<%:Generate QRCode%>' onclick="return genQrcode(this, '<%=self.option%>', '<%=self.value%>')" />
 		<% end -%>
@@ -5,20 +5,21 @@ local appname = map.config
 local is_js_luci = api.is_js_luci()
 local section_tag = is_js_luci and "div" or "fieldset"

-local default_node_type = ""
 local shunt_rule_list = {}
 local node = map:get("@global[0]", "node")
 if node then
-	local node_type = map:get(node, "type")
 	local node_protocol = map:get(node, "protocol")
-	if (node_type == "Xray" or node_type == "sing-box") and node_protocol == "_shunt" then
-		default_node_type = node_protocol
+	if node_protocol == "_shunt" then
 		local node_shunt_group = map:get(node, "shunt_group")
 		map:foreach("shunt_rules", function(e)
 			if e[".name"] and e.remarks and e.group == node_shunt_group then
 				shunt_rule_list[#shunt_rule_list + 1] = e
 			end
 		end)
+		shunt_rule_list[#shunt_rule_list + 1] = {
+			[".name"] = "default_node",
+			remarks = translate("Default")
+		}
 	end
 end
 -%>
@@ -1671,14 +1672,13 @@ table td, .table .td {
 					<input class="btn cbi-button" type="button" onclick="set_node_div.set('@global[0]', 'node')" value="<%:OK%>" />
 				</div>
 			</div>
-			<% if default_node_type == "_shunt" then %>
+			<% if #shunt_rule_list > 0 then %>
 			<div id="set_node_shunt_div" style="margin: 0.5em 0; padding: 0.5em; background: #f7f7f7; border-radius: 4px;">
 				<div class="cbi-section-descr" style="text-align: left;"><a style="color:#FF8C00"><%:Set as the routing rule node:%></a></div>
 				<div>
 				<% for i, v in ipairs(shunt_rule_list) do %>
 					<input class="btn cbi-button" type="button" onclick="set_node_div.set('<%=node%>', '<%=v[".name"]%>')" value="<%=v.remarks%>" />
 				<% end %>
-					<input class="btn cbi-button" type="button" onclick="set_node_div.set('<%=node%>', 'default_node')" value="<%:Default%>" />
 				</div>
 			</div>
 			<% end %>
@@ -1253,6 +1253,9 @@ msgstr "访问控制"
 msgid "ACLs is a tools which used to designate specific IP proxy mode."
 msgstr "访问控制列表是用于指定特殊 IP 代理模式的工具。"

+msgid "Use global configuration when using the global node."
+msgstr "与全局节点相同时，将使用全局配置。"
+
 msgid "Example:"
 msgstr "例："

@@ -150,16 +150,30 @@ run_singbox() {

 	[ -n "$remote_dns_query_strategy" ] && json_add_string "remote_dns_query_strategy" "${remote_dns_query_strategy}"
 	case "$remote_dns_protocol" in
-		udp|tcp)
-			local _proto="$remote_dns_protocol"
-			local _dns=$(get_first_dns remote_dns_${_proto}_server 53)
-			local _dns_address=$(echo ${_dns} | awk -F '#' '{print $1}')
-			local _dns_port=$(echo ${_dns} | awk -F '#' '{print $2}')
-			json_add_string "remote_dns_${_proto}_server" "${_dns_address}"
-			json_add_string "remote_dns_${_proto}_port" "${_dns_port}"
+		udp|quic)
+			local _dns_address=$(echo "$remote_dns_udp_server" | awk -F '#' '{print $1}')
+			local default_port=53
+			[ "$remote_dns_protocol" = "quic" ] && {
+				default_port=853
+				json_add_string "remote_dns_quic" "1"
+			}
+			local _dns_port=$(echo "$remote_dns_udp_server" | awk -F '#' -v def="$default_port" '{print ($2 ? $2 : def)}')
+			json_add_string "remote_dns_udp_server" "$_dns_address"
+			json_add_string "remote_dns_udp_port" "$_dns_port"
+		;;
+		tcp|tls)
+			local _dns_address=$(echo "$remote_dns_tcp_server" | awk -F '#' '{print $1}')
+			local default_port=53
+			[ "$remote_dns_protocol" = "tls" ] && {
+				default_port=853
+				json_add_string "remote_dns_tls" "1"
+			}
+			local _dns_port=$(echo "$remote_dns_tcp_server" | awk -F '#' -v def="$default_port" '{print ($2 ? $2 : def)}')
+			json_add_string "remote_dns_tcp_server" "$_dns_address"
+			json_add_string "remote_dns_tcp_port" "$_dns_port"
 		;;
 		doh|http3)
-			json_add_string "remote_dns_doh" "${remote_dns_doh}"
+			json_add_string "remote_dns_doh" "$remote_dns_doh"
 			[ "$remote_dns_protocol" = "http3" ] && json_add_string "remote_dns_http3" "1"
 		;;
 	esac
@@ -245,13 +259,17 @@ run_xray() {
 	[ -n "$dns_cache" ] && json_add_string "dns_cache" "${dns_cache}"

 	case "$remote_dns_protocol" in
-		udp|tcp)
-			local _proto="$remote_dns_protocol"
-			local _dns=$(get_first_dns remote_dns_${_proto}_server 53)
-			local _dns_address=$(echo ${_dns} | awk -F '#' '{print $1}')
-			local _dns_port=$(echo ${_dns} | awk -F '#' '{print $2}')
-			json_add_string "remote_dns_${_proto}_server" "${_dns_address}"
-			json_add_string "remote_dns_${_proto}_port" "${_dns_port}"
+		udp)
+			local _dns_address=$(echo "$remote_dns_udp_server" | awk -F '#' '{print $1}')
+			local _dns_port=$(echo "$remote_dns_udp_server" | awk -F '#' '{print ($2 ? $2 : 53)}')
+			json_add_string "remote_dns_udp_server" "$_dns_address"
+			json_add_string "remote_dns_udp_port" "$_dns_port"
+		;;
+		tcp)
+			local _dns_address=$(echo "$remote_dns_tcp_server" | awk -F '#' '{print $1}')
+			local _dns_port=$(echo "$remote_dns_tcp_server" | awk -F '#' '{print ($2 ? $2 : 53)}')
+			json_add_string "remote_dns_tcp_server" "$_dns_address"
+			json_add_string "remote_dns_tcp_port" "$_dns_port"
 		;;
 		doh)
 			json_add_string "remote_dns_doh" "${remote_dns_doh}"
@@ -282,7 +300,7 @@ run_dns2socks() {
 	eval_set_val "$@"
 	[ -n "$flag" ] && flag="_${flag}"
 	[ -n "$log_file" ] || log_file="/dev/null"
-	dns=$(get_first_dns dns 53 | sed 's/#/:/g')
+	dns=$(format_dns $dns 53)
 	[ -n "$socks" ] && {
 		socks="${socks//#/:}"
 		socks_address=$(echo $socks | awk -F ':' '{print $1}')
@@ -319,10 +337,10 @@ run_socks() {
 	[ -n "$config_file" ] && [ -z "$(echo ${config_file} | grep $TMP_PATH)" ] && config_file=$TMP_PATH/$config_file
 	[ -n "$http_port" ] || http_port=0
 	[ -n "$http_config_file" ] && [ -z "$(echo ${http_config_file} | grep $TMP_PATH)" ] && http_config_file=$TMP_PATH/$http_config_file
-	if [ -n "$log_file" ] && [ "$log_file" != "/dev/null" ] && [ -z "$(echo ${log_file} | grep $TMP_PATH)" ]; then
-		log_file=$TMP_PATH/$log_file
-	else
+	if [ -z "$log_file" ] || [ "$log_file" = "/dev/null" ]; then
 		log_file="/dev/null"
+	elif [ "${log_file#"$TMP_PATH/"}" = "$log_file" ]; then
+		log_file=$TMP_PATH/$log_file
 	fi

 	local type=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z')
@@ -548,11 +566,7 @@ start_global() {
 	local node_socks_bind_local=$(config_n_get @global[0] node_socks_bind_local 1)
 	local node_socks_bind="127.0.0.1"
 	[ "${node_socks_bind_local}" != "1" ] && node_socks_bind="0.0.0.0"
-	local global_socks_port=$(config_n_get @global[0] node_socks_port 1070)
-	GLOBAL_SOCKS_port=$(get_new_port $global_socks_port)
-	if [ "$GLOBAL_SOCKS_port" != "$global_socks_port" ]; then
-		echolog "注意：全局节点 Socks 端口冲突，原端口 ${global_socks_port} 已自动更改为 ${GLOBAL_SOCKS_port}！"
-	fi
+	GLOBAL_SOCKS_port=$(config_n_get @global[0] node_socks_port 1070)
 	GLOBAL_HTTP_port=$(config_n_get @global[0] node_http_port 0)
 	[ "$GLOBAL_HTTP_port" != "0" ] && local on_node_http=1
 	if [ $PROXY_IPV6 = "1" ]; then
@@ -601,7 +615,6 @@ start_global() {
 		local v2ray_dns_mode=$(config_n_get @global[0] v2ray_dns_mode tcp)
 		[ "${DNS_MODE}" != "sing-box" ] && [ "$protocol" = "_shunt" ] && {
 			DNS_MODE="sing-box"
-			[ "$v2ray_dns_mode" = "tcp+doh" ] && v2ray_dns_mode="tcp"
 		}

 		[ "$protocol" = "_shunt" ] && {
@@ -637,10 +650,13 @@ start_global() {

 			_args="${_args} remote_dns_protocol=${v2ray_dns_mode}"
 			case "$v2ray_dns_mode" in
-				udp|tcp)
-					local _proto="$v2ray_dns_mode"
-					_args="${_args} remote_dns_${_proto}_server=${REMOTE_DNS}"
-					resolve_dns_log="Sing-Box DNS(127.0.0.1#${resolve_dns_port}) -> ${_proto}://${REMOTE_DNS}"
+				udp|quic)
+					_args="${_args} remote_dns_udp_server=${REMOTE_DNS}"
+					resolve_dns_log="Sing-Box DNS(127.0.0.1#${resolve_dns_port}) -> ${v2ray_dns_mode}://${REMOTE_DNS}"
+				;;
+				tcp|tls)
+					_args="${_args} remote_dns_tcp_server=${REMOTE_DNS}"
+					resolve_dns_log="Sing-Box DNS(127.0.0.1#${resolve_dns_port}) -> ${v2ray_dns_mode}://${REMOTE_DNS}"
 				;;
 				doh|http3)
 					local remote_dns_doh=$(config_n_get @global[0] remote_dns_doh "https://1.1.1.1/dns-query")
@@ -677,7 +693,11 @@ start_global() {
 		local v2ray_dns_mode=$(config_n_get @global[0] v2ray_dns_mode tcp)
 		[ "${DNS_MODE}" != "xray" ] && [ "$protocol" = "_shunt" ] && {
 			DNS_MODE="xray"
-			[ "$v2ray_dns_mode" = "http3" ] && v2ray_dns_mode="tcp"
+			case "$v2ray_dns_mode" in http3|tls|quic)
+				v2ray_dns_mode="tcp"
+				REMOTE_DNS="1.1.1.1#53"
+				;;
+			esac
 		}

 		[ "$protocol" = "_shunt" ] && {
@@ -1023,7 +1043,7 @@ start_dns() {
 	echolog "DNS域名解析："

 	local china_ng_local_dns=$(IFS=','; set -- $LOCAL_DNS; [ "${1%%[#:]*}" = "127.0.0.1" ] && echo "$1" || ([ -n "$2" ] && echo "$*" || echo "$1"))
-	local sing_box_local_dns=
+	local v2ray_local_dns
 	local direct_dns_mode=$(config_n_get @global[0] direct_dns_mode "auto")

 	#获取访问控制节点所使用的DNS分流模式
@@ -1040,19 +1060,18 @@ start_dns() {
 		udp)
 			LOCAL_DNS=$(normalize_dns "$(config_n_get @global[0] direct_dns 223.5.5.5:53)")
 			china_ng_local_dns=${LOCAL_DNS}
-			sing_box_local_dns="direct_dns_udp_server=${LOCAL_DNS}"
+			v2ray_local_dns="direct_dns_udp_server=${LOCAL_DNS}"
 		;;
 		tcp)	
 			local DIRECT_DNS=$(normalize_dns "$(config_n_get @global[0] direct_dns 223.5.5.5:53)")
 			china_ng_local_dns="tcp://${DIRECT_DNS}"
-			sing_box_local_dns="direct_dns_tcp_server=${DIRECT_DNS}"
+			v2ray_local_dns="direct_dns_tcp_server=${DIRECT_DNS}"

 			#当全局（包括访问控制节点）开启chinadns-ng时，不启动新进程。
 			[ "$DNS_SHUNT" != "chinadns-ng" ] || [ "$ACL_RULE_DNSMASQ" = "1" ] && {
 				LOCAL_DNS="127.0.0.1#${NEXT_DNS_LISTEN_PORT}"
-				local china_ng_c_dns="tcp://$(get_first_dns DIRECT_DNS 53)"
-				ln_run "$(first_type chinadns-ng)" chinadns-ng "/dev/null" -b :: -l ${NEXT_DNS_LISTEN_PORT} -c ${china_ng_c_dns} -d chn
-				echolog "  - ChinaDNS-NG(${LOCAL_DNS}) -> ${china_ng_c_dns}"
+				ln_run "$(first_type chinadns-ng)" chinadns-ng "/dev/null" -b :: -l ${NEXT_DNS_LISTEN_PORT} -c ${china_ng_local_dns} -d chn
+				echolog "  - ChinaDNS-NG(${LOCAL_DNS}) -> ${china_ng_local_dns}"
 				echolog "  * 请确保上游直连 DNS 支持 TCP 查询。"
 				NEXT_DNS_LISTEN_PORT=$(expr $NEXT_DNS_LISTEN_PORT + 1)
 			}
@@ -1083,9 +1102,8 @@ start_dns() {
 	case "$DNS_MODE" in
 	dns2socks)
 		local dns2socks_socks_server=$(echo $(config_n_get @global[0] socks_server 127.0.0.1:1080) | sed "s/#/:/g")
-		local dns2socks_forward=$(get_first_dns REMOTE_DNS 53 | sed 's/#/:/g')
-		run_dns2socks socks=$dns2socks_socks_server listen_address=127.0.0.1 listen_port=${NEXT_DNS_LISTEN_PORT} dns=$dns2socks_forward cache=$DNS_CACHE
-		echolog "  - dns2socks(${TUN_DNS})，${dns2socks_socks_server} -> tcp://${dns2socks_forward}"
+		run_dns2socks socks=$dns2socks_socks_server listen_address=127.0.0.1 listen_port=${NEXT_DNS_LISTEN_PORT} dns=$REMOTE_DNS cache=$DNS_CACHE
+		echolog "  - dns2socks(${TUN_DNS})，${dns2socks_socks_server} -> tcp://${REMOTE_DNS}"
 	;;
 	sing-box)
 		[ -z "${NO_PLUGIN_DNS}" ] && {
@@ -1111,10 +1129,13 @@ start_dns() {
 			_args="${_args} dns_listen_port=${NEXT_DNS_LISTEN_PORT}"
 			_args="${_args} remote_dns_protocol=${v2ray_dns_mode}"
 			case "$v2ray_dns_mode" in
-				udp|tcp)
-					local _proto="$v2ray_dns_mode"
-					_args="${_args} remote_dns_${_proto}_server=${REMOTE_DNS}"
-					echolog "  - Sing-Box DNS(${TUN_DNS}) -> ${_proto}://${REMOTE_DNS}"
+				udp|quic)
+					_args="${_args} remote_dns_udp_server=${REMOTE_DNS}"
+					echolog "  - Sing-Box DNS(${TUN_DNS}) -> ${v2ray_dns_mode}://${REMOTE_DNS}"
+				;;
+				tcp|tls)
+					_args="${_args} remote_dns_tcp_server=${REMOTE_DNS}"
+					echolog "  - Sing-Box DNS(${TUN_DNS}) -> ${v2ray_dns_mode}://${REMOTE_DNS}"
 				;;
 				doh|http3)
 					local remote_dns_doh=$(config_n_get @global[0] remote_dns_doh "https://1.1.1.1/dns-query")
@@ -1123,7 +1144,7 @@ start_dns() {
 				;;
 			esac
 			_args="${_args} dns_socks_address=127.0.0.1 dns_socks_port=${GLOBAL_SOCKS_port}"
-			[ -n "${sing_box_local_dns}" ] && _args="${_args} ${sing_box_local_dns}"
+			[ -n "${v2ray_local_dns}" ] && _args="${_args} ${v2ray_local_dns}"
 			run_singbox ${_args}
 		}
 	;;
@@ -1162,13 +1183,14 @@ start_dns() {
 				;;
 			esac
 			_args="${_args} dns_socks_address=127.0.0.1 dns_socks_port=${GLOBAL_SOCKS_port}"
+			[ -n "${v2ray_local_dns}" ] && _args="${_args} ${v2ray_local_dns}"
 			run_xray ${_args}
 		}
 	;;
 	udp)
 		UDP_PROXY_DNS=1
 		local china_ng_listen_port=${NEXT_DNS_LISTEN_PORT}
-		local china_ng_trust_dns="udp://$(get_first_dns REMOTE_DNS 53)"
+		local china_ng_trust_dns="udp://${REMOTE_DNS}"
 		if [ "$DNS_SHUNT" != "chinadns-ng" ] && [ "$FILTER_PROXY_IPV6" = "1" ]; then
 			DNSMASQ_FILTER_PROXY_IPV6=0
 			local no_ipv6_trust="-N"
@@ -1182,7 +1204,7 @@ start_dns() {
 	tcp)
 		TCP_PROXY_DNS=1
 		local china_ng_listen_port=${NEXT_DNS_LISTEN_PORT}
-		local china_ng_trust_dns="tcp://$(get_first_dns REMOTE_DNS 53)"
+		local china_ng_trust_dns="tcp://${REMOTE_DNS}"
 		[ "$DNS_SHUNT" != "chinadns-ng" ] && {
 			[ "$FILTER_PROXY_IPV6" = "1" ] && DNSMASQ_FILTER_PROXY_IPV6=0 && local no_ipv6_trust="-N"
 			ln_run "$(first_type chinadns-ng)" chinadns-ng "/dev/null" -b :: -l ${china_ng_listen_port} -t ${china_ng_trust_dns} -d gfw ${no_ipv6_trust}
@@ -1272,7 +1294,7 @@ start_dns() {
 		[ "$(check_ver "$dnsmasq_version" "2.87")" = "1" ] && echolog "Dnsmasq版本低于2.87，有可能无法正常使用！！！"
 	}

-	local DNSMASQ_TUN_DNS=$(get_first_dns TUN_DNS 53)
+	local DNSMASQ_TUN_DNS=$(normalize_dns $TUN_DNS 53)
 	local RUN_NEW_DNSMASQ=1
 	RUN_NEW_DNSMASQ=${DNS_REDIRECT}
 	if [ "${RUN_NEW_DNSMASQ}" = "0" ]; then
@@ -1356,6 +1378,7 @@ acl_app() {

 			log=${log:-0}
 			loglevel=${loglevel:-warn}
+			log_chinadns_ng=${log_chinadns_ng:-0}

 			if [ -n "${sources}" ]; then
 				for s in $sources; do
@@ -1411,7 +1434,10 @@ acl_app() {

 			[ -n "$node" ] && {
 				local GLOBAL_NODE=$(get_cache_var "ACL_GLOBAL_node")
-				[ -n "${GLOBAL_NODE}" ] && GLOBAL_redir_port=$(get_cache_var "ACL_GLOBAL_redir_port")
+				[ -n "${GLOBAL_NODE}" ] && {
+					local GLOBAL_redir_port=$(get_cache_var "ACL_GLOBAL_redir_port")
+					[ "$node" = "${GLOBAL_NODE}" ] && node="default"
+				}
 				if [ "$node" = "default" ]; then
 					if [ -n "${GLOBAL_NODE}" ]; then
 						set_cache_var "ACL_${sid}_node" "${GLOBAL_NODE}"
@@ -1423,181 +1449,189 @@ acl_app() {
 						echolog "  - 全局节点未启用，跳过【${remarks}】"
 					fi
 				else
-					[ "$(config_get_type $node)" = "nodes" ] || [ "$(config_get_type $node)" = "socks" ] && {
-						if [ -n "${GLOBAL_NODE}" ] && [ "$node" = "${GLOBAL_NODE}" ]; then
-							set_cache_var "ACL_${sid}_node" "${GLOBAL_NODE}"
-							set_cache_var "ACL_${sid}_redir_port" "${GLOBAL_redir_port}"
-							set_cache_var "ACL_${sid}_dns_port" "${GLOBAL_DNSMASQ_PORT}"
-							set_cache_var "ACL_${sid}_default" "1"
-							[ "$GLOBAL_SHUNT_NODE_FAKEDNS" = "1" ] && use_fakedns=1
+					([ "$(config_get_type $node)" = "nodes" ] || [ "$(config_get_type $node)" = "socks" ]) && {
+						local type protocol
+						if [ "$(config_get_type $node)" = "socks" ]; then
+							if [ "${dns_mode}" = "xray" ]; then
+								type="xray"
+							elif [ "${dns_mode}" = "sing-box" ]; then
+								type="sing-box"
+							elif [ -n "${SINGBOX_BIN}" ]; then
+								type="sing-box"
+							elif [ -n "${XRAY_BIN}" ]; then
+								type="xray"
+							fi
 						else
-							local type protocol
-							if [ "$(config_get_type $node)" = "socks" ]; then
-								if [ "${dns_mode}" = "xray" ]; then
-									type="xray"
-								elif [ "${dns_mode}" = "sing-box" ]; then
-									type="sing-box"
-								elif [ -n "${SINGBOX_BIN}" ]; then
-									type="sing-box"
-								elif [ -n "${XRAY_BIN}" ]; then
-									type="xray"
+							type=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z')
+							protocol=$(config_n_get $node protocol)
+						fi
+						([ "$type" = "sing-box" ] || [ "$type" = "xray" ]) && [ "$protocol" = "_shunt" ] && [ "$type" != "$dns_mode" ] && {
+							dns_mode=$type
+							[ "$type" = "xray" ] && {
+								case "$v2ray_dns_mode" in http3|tls|quic)
+									v2ray_dns_mode="tcp"
+									remote_dns="1.1.1.1#53"
+									;;
+								esac
+							}
+						}
+
+						local dns_cache_str="${dns_mode}_${v2ray_dns_mode}_${remote_dns}_${remote_dns_doh}_${remote_dns_client_ip}_${remote_fakedns}_${remote_rewrite_ttl}"
+						dns_cache_key="$(echo -n "${dns_cache_str}" | md5sum | cut -d " " -f1)"
+
+						if [ "$remote_fakedns" = "1" ] || ([ "$protocol" = "_shunt" ] && [ "$(config_n_get $node fakedns)" = "1" ]); then
+							use_fakedns=1
+						fi
+
+						run_dns() {
+							local dns_fwd_port=$1
+							[ -z "$dns_fwd_port" ] && {
+								dns_port=$(get_new_port $(expr $dns_port + 1))
+								dns_fwd_port=$dns_port
+								if [ "$dns_mode" = "dns2socks" ]; then
+									run_dns2socks flag=acl_${sid} socks_address=127.0.0.1 socks_port=$socks_port listen_address=0.0.0.0 listen_port=$dns_fwd_port dns=$remote_dns cache=1
+								elif [ "$dns_mode" = "sing-box" ] || [ "$dns_mode" = "xray" ]; then
+									config_file=$TMP_ACL_PATH/${node}_SOCKS_${socks_port}_DNS.json
+									remote_dns_doh=${remote_dns_doh:-https://1.1.1.1/dns-query}
+									local type=${dns_mode}
+									[ "${dns_mode}" = "sing-box" ] && type="singbox"
+									dnsmasq_filter_proxy_ipv6=0
+									remote_dns_query_strategy="UseIP"
+									[ "$filter_proxy_ipv6" = "1" ] && {
+										remote_dns_query_strategy="UseIPv4"
+										set_cache_var "node_${node}_${dns_cache_key}_ipv6" "0"
+									}
+									run_${type} flag=acl_${sid} type=$dns_mode dns_socks_address=127.0.0.1 dns_socks_port=$socks_port dns_listen_port=$dns_fwd_port \
+										remote_dns_protocol=${v2ray_dns_mode} remote_dns_udp_server=${remote_dns} remote_dns_tcp_server=${remote_dns} remote_dns_doh="${remote_dns_doh}" \
+										remote_dns_query_strategy=${remote_dns_query_strategy} remote_dns_client_ip=${remote_dns_client_ip} config_file=$config_file
 								fi
-							else
-								type=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z')
-								protocol=$(config_n_get $node protocol)
-							fi
-							([ "$type" = "sing-box" ] || [ "$type" = "xray" ]) && [ "$protocol" = "_shunt" ] && [ "$type" != "$dns_mode" ] && {
-								dns_mode=$type
-								[ "$type" = "xray" ] && [ "$v2ray_dns_mode" = "http3" ] && v2ray_dns_mode="tcp"
-							}
-							dns_cache_key="${dns_mode}_${remote_dns}_${v2ray_dns_mode:-none}_${remote_dns_client_ip:-0}_${remote_fakedns:-0}_${remote_rewrite_ttl:-30}"
-							([ "$v2ray_dns_mode" = "doh" ] || [ "$v2ray_dns_mode" = "http3" ]) && {
-								dns_cache_key="${dns_mode}_${remote_dns_doh:-https://1.1.1.1/dns-query}_${v2ray_dns_mode:-doh}_${remote_dns_client_ip:-0}_${remote_fakedns:-0}_${remote_rewrite_ttl:-30}"
+								set_cache_var "node_${node}_${dns_cache_key}" "$dns_fwd_port"
 							}

-							if [ "$remote_fakedns" = "1" ] || ([ "$protocol" = "_shunt" ] && [ "$(config_n_get $node fakedns)" = "1" ]); then
-								use_fakedns=1
-							fi
+							[ "$dns_shunt" = "chinadns-ng" ] && [ -n "$(first_type chinadns-ng)" ] && {
+								chinadns_ng_min=2024.04.13
+								chinadns_ng_now=$($(first_type chinadns-ng) -V | grep -i "ChinaDNS-NG " | awk '{print $2}')
+								if [ $(check_ver "$chinadns_ng_now" "$chinadns_ng_min") = 1 ]; then
+									echolog "  * 注意：当前 ChinaDNS-NG 版本为[ $chinadns_ng_now ]，请更新到[ $chinadns_ng_min ]或以上版本，否则 DNS 有可能无法正常工作！"
+								fi

-							run_dns() {
-								local _dns_port
-								[ -n $1 ] && _dns_port=$1
-								[ -z ${_dns_port} ] && {
+								[ "$filter_proxy_ipv6" = "1" ] && dnsmasq_filter_proxy_ipv6=0
+								chinadns_port=$(expr $chinadns_port + 1)
+								_china_ng_listen="127.0.0.1#${chinadns_port},::1#${chinadns_port}"
+
+								_chinadns_local_dns=$(IFS=','; set -- $LOCAL_DNS; [ "${1%%[#:]*}" = "127.0.0.1" ] && echo "$1" || ([ -n "$2" ] && echo "$1,$2" || echo "$1"))
+								_direct_dns_mode=$(config_n_get @global[0] direct_dns_mode "auto")
+								case "${_direct_dns_mode}" in
+									udp)
+										_chinadns_local_dns=$(normalize_dns "$(config_n_get @global[0] direct_dns 223.5.5.5:53)")
+									;;
+									tcp)
+										_chinadns_local_dns="tcp://$(normalize_dns "$(config_n_get @global[0] direct_dns 223.5.5.5:53)")"
+									;;
+								esac
+
+								run_chinadns_ng \
+									_flag="$sid" \
+									_listen_port=${chinadns_port} \
+									_dns_local=${_chinadns_local_dns} \
+									_dns_trust=127.0.0.1#${dns_fwd_port} \
+									_no_ipv6_trust=${filter_proxy_ipv6} \
+									_use_direct_list=${use_direct_list} \
+									_use_proxy_list=${use_proxy_list} \
+									_use_block_list=${use_block_list} \
+									_gfwlist=${use_gfw_list} \
+									_chnlist=${chn_list} \
+									_default_mode=${tcp_proxy_mode} \
+									_default_tag=${chinadns_ng_default_tag:-smart} \
+									_no_logic_log=1 \
+									_node=${node} \
+									_filter_https=${force_https_soa:-0} \
+									_log=${log_chinadns_ng}
+
+								use_default_dns="chinadns_ng"
+							}
+
+							([ "$filter_proxy_ipv6" = "1" ] && [ "$dnsmasq_filter_proxy_ipv6" = "1" ]) && {
+								dnsmasq_filter_proxy_ipv6=$(get_cache_var "node_${node}_${dns_cache_key}_ipv6")
+								dnsmasq_filter_proxy_ipv6=${dnsmasq_filter_proxy_ipv6:-1}
+							}
+
+							dnsmasq_port=$(get_new_port $(expr $dnsmasq_port + 1))
+							local dnsmasq_conf=${acl_path}/dnsmasq.conf
+							local dnsmasq_conf_path=${acl_path}/dnsmasq.d
+							lua $APP_PATH/helper_dnsmasq.lua add_rule -FLAG ${sid} -TMP_DNSMASQ_PATH ${dnsmasq_conf_path} -DNSMASQ_CONF_FILE ${dnsmasq_conf} \
+								-LISTEN_PORT ${dnsmasq_port} -DEFAULT_DNS ${DEFAULT_DNS} -LOCAL_DNS $LOCAL_DNS \
+								-USE_DIRECT_LIST "${use_direct_list}" -USE_PROXY_LIST "${use_proxy_list}" -USE_BLOCK_LIST "${use_block_list}" -USE_GFW_LIST "${use_gfw_list}" -CHN_LIST "${chn_list}" \
+								-TUN_DNS "127.0.0.1#${dns_fwd_port}" -USE_DEFAULT_DNS "${use_default_dns:-direct}" -CHINADNS_DNS ${_china_ng_listen:-0} \
+								-NODE $node -DEFAULT_PROXY_MODE ${tcp_proxy_mode} -NO_PROXY_IPV6 ${dnsmasq_filter_proxy_ipv6:-0} -NFTFLAG ${nftflag:-0} \
+								-NO_LOGIC_LOG 1
+							ln_run "$(first_type dnsmasq)" "dnsmasq_${sid}" "/dev/null" -C ${dnsmasq_conf} -x ${acl_path}/dnsmasq.pid
+							set_cache_var "ACL_${sid}_dns_port" "${dnsmasq_port}"
+							#dhcp.leases to hosts
+							$APP_PATH/lease2hosts.sh > /dev/null 2>&1 &
+						}
+						local _redir_port=$(get_cache_var "node_${node}_redir_port")
+						local _socks_port=$(get_cache_var "node_${node}_socks_port")
+						local _enable_log=$(get_cache_var "node_${node}_enable_log")
+						local _dns_port
+						if [ -n "${_socks_port}" ] && [ -n "${_redir_port}" ] && [ "${_enable_log}" != "1" ] && [ "${log}" != "1" ]; then
+							socks_port=${_socks_port}
+							node_port=${_redir_port}
+							_dns_port=$(get_cache_var "node_${node}_${dns_cache_key}")
+							run_dns ${_dns_port}
+						else
+							socks_port=$(get_new_port $(expr $socks_port + 1))
+							set_cache_var "node_${node}_socks_port" "${socks_port}"
+							redir_port=$(get_new_port $(expr $redir_port + 1))
+							set_cache_var "node_${node}_redir_port" "${redir_port}"
+							node_port=$redir_port
+							local log_file="/dev/null"
+							[ "${log}" = "1" ] && {
+								log_file="${TMP_ACL_PATH}/${sid}/node.log"
+								set_cache_var "node_${node}_enable_log" "1"
+							}
+
+							if [ "${type}" = "sing-box" ] || [ "${type}" = "xray" ]; then
+								config_file="acl/${node}_${redir_port}.json"
+								_extra_param="socks_address=127.0.0.1 socks_port=$socks_port"
+								[ "${type}" = "${dns_mode}" ] && {
 									dns_port=$(get_new_port $(expr $dns_port + 1))
 									_dns_port=$dns_port
-									if [ "$dns_mode" = "dns2socks" ]; then
-										run_dns2socks flag=acl_${sid} socks_address=127.0.0.1 socks_port=$socks_port listen_address=0.0.0.0 listen_port=${_dns_port} dns=$remote_dns cache=1
-									elif [ "$dns_mode" = "sing-box" ] || [ "$dns_mode" = "xray" ]; then
-										config_file=$TMP_ACL_PATH/${node}_SOCKS_${socks_port}_DNS.json
-										remote_dns_doh=${remote_dns_doh:-https://1.1.1.1/dns-query}
-										local type=${dns_mode}
-										[ "${dns_mode}" = "sing-box" ] && type="singbox"
-										dnsmasq_filter_proxy_ipv6=0
-										remote_dns_query_strategy="UseIP"
-										[ "$filter_proxy_ipv6" = "1" ] && remote_dns_query_strategy="UseIPv4"
-										run_${type} flag=acl_${sid} type=$dns_mode dns_socks_address=127.0.0.1 dns_socks_port=$socks_port dns_listen_port=${_dns_port} remote_dns_protocol=${v2ray_dns_mode} remote_dns_udp_server=${remote_dns} remote_dns_tcp_server=${remote_dns} remote_dns_doh="${remote_dns_doh}" remote_dns_query_strategy=${remote_dns_query_strategy} remote_dns_client_ip=${remote_dns_client_ip} config_file=$config_file
-									fi
-									set_cache_var "node_${node}_$(echo -n "${dns_cache_key}" | md5sum | cut -d " " -f1)" "${_dns_port}"
+									dnsmasq_filter_proxy_ipv6=0
+									remote_dns_query_strategy="UseIP"
+									[ "$filter_proxy_ipv6" = "1" ] && {
+										remote_dns_query_strategy="UseIPv4"
+										set_cache_var "node_${node}_${dns_cache_key}_ipv6" "0"
+									}
+									remote_dns_doh=${remote_dns_doh:-https://1.1.1.1/dns-query}
+									_extra_param="${_extra_param} dns_listen_port=${_dns_port} remote_dns_protocol=${v2ray_dns_mode} remote_dns_udp_server=${remote_dns} remote_dns_tcp_server=${remote_dns}"
+									_extra_param="${_extra_param} remote_dns_doh=${remote_dns_doh} remote_dns_query_strategy=${remote_dns_query_strategy} remote_fakedns=${remote_fakedns:-0} remote_dns_client_ip=${remote_dns_client_ip}"
 								}
-
-								[ "$dns_shunt" = "chinadns-ng" ] && [ -n "$(first_type chinadns-ng)" ] && {
-									chinadns_ng_min=2024.04.13
-									chinadns_ng_now=$($(first_type chinadns-ng) -V | grep -i "ChinaDNS-NG " | awk '{print $2}')
-									if [ $(check_ver "$chinadns_ng_now" "$chinadns_ng_min") = 1 ]; then
-										echolog "  * 注意：当前 ChinaDNS-NG 版本为[ $chinadns_ng_now ]，请更新到[ $chinadns_ng_min ]或以上版本，否则 DNS 有可能无法正常工作！"
-									fi
-
-									[ "$filter_proxy_ipv6" = "1" ] && dnsmasq_filter_proxy_ipv6=0
-									chinadns_port=$(expr $chinadns_port + 1)
-									_china_ng_listen="127.0.0.1#${chinadns_port},::1#${chinadns_port}"
-
-									_chinadns_local_dns=$(IFS=','; set -- $LOCAL_DNS; [ "${1%%[#:]*}" = "127.0.0.1" ] && echo "$1" || ([ -n "$2" ] && echo "$1,$2" || echo "$1"))
-									_direct_dns_mode=$(config_n_get @global[0] direct_dns_mode "auto")
-									case "${_direct_dns_mode}" in
-										udp)
-											_chinadns_local_dns=$(normalize_dns "$(config_n_get @global[0] direct_dns 223.5.5.5:53)")
-										;;
-										tcp)
-											_chinadns_local_dns="tcp://$(normalize_dns "$(config_n_get @global[0] direct_dns 223.5.5.5:53)")"
-										;;
-									esac
-
-									run_chinadns_ng \
-										_flag="$sid" \
-										_listen_port=${chinadns_port} \
-										_dns_local=${_chinadns_local_dns} \
-										_dns_trust=127.0.0.1#${_dns_port} \
-										_no_ipv6_trust=${filter_proxy_ipv6} \
-										_use_direct_list=${use_direct_list} \
-										_use_proxy_list=${use_proxy_list} \
-										_use_block_list=${use_block_list} \
-										_gfwlist=${use_gfw_list} \
-										_chnlist=${chn_list} \
-										_default_mode=${tcp_proxy_mode} \
-										_default_tag=${chinadns_ng_default_tag:-smart} \
-										_no_logic_log=1 \
-										_node=${node} \
-										_filter_https=${force_https_soa:-0} \
-										_log=${log}
-
-									use_default_dns="chinadns_ng"
+								_extra_param="${_extra_param} tcp_proxy_way=$TCP_PROXY_WAY"
+								config_file="$TMP_PATH/$config_file"
+								[ "${type}" = "sing-box" ] && {
+									type="singbox"
+									_extra_param="${_extra_param} remote_rewrite_ttl=${remote_rewrite_ttl:-30}"
 								}
-
-								dnsmasq_port=$(get_new_port $(expr $dnsmasq_port + 1))
-								local dnsmasq_conf=${acl_path}/dnsmasq.conf
-								local dnsmasq_conf_path=${acl_path}/dnsmasq.d
-								lua $APP_PATH/helper_dnsmasq.lua add_rule -FLAG ${sid} -TMP_DNSMASQ_PATH ${dnsmasq_conf_path} -DNSMASQ_CONF_FILE ${dnsmasq_conf} \
-									-LISTEN_PORT ${dnsmasq_port} -DEFAULT_DNS ${DEFAULT_DNS} -LOCAL_DNS $LOCAL_DNS \
-									-USE_DIRECT_LIST "${use_direct_list}" -USE_PROXY_LIST "${use_proxy_list}" -USE_BLOCK_LIST "${use_block_list}" -USE_GFW_LIST "${use_gfw_list}" -CHN_LIST "${chn_list}" \
-									-TUN_DNS "127.0.0.1#${_dns_port}" -USE_DEFAULT_DNS "${use_default_dns:-direct}" -CHINADNS_DNS ${_china_ng_listen:-0} \
-									-NODE $node -DEFAULT_PROXY_MODE ${tcp_proxy_mode} -NO_PROXY_IPV6 ${dnsmasq_filter_proxy_ipv6:-0} -NFTFLAG ${nftflag:-0} \
-									-NO_LOGIC_LOG 1
-								ln_run "$(first_type dnsmasq)" "dnsmasq_${sid}" "/dev/null" -C ${dnsmasq_conf} -x ${acl_path}/dnsmasq.pid
-								set_cache_var "ACL_${sid}_dns_port" "${dnsmasq_port}"
-								set_cache_var "node_${node}_$(echo -n "${tcp_proxy_mode}_${dns_cache_key}" | md5sum | cut -d " " -f1)" "${dnsmasq_port}"
-								#dhcp.leases to hosts
-								$APP_PATH/lease2hosts.sh > /dev/null 2>&1 &
-							}
-							_redir_port=$(get_cache_var "node_${node}_redir_port")
-							_socks_port=$(get_cache_var "node_${node}_socks_port")
-							if [ -n "${_socks_port}" ] && [ -n "${_redir_port}" ]; then
-								socks_port=${_socks_port}
-								node_port=${_redir_port}
-								_dnsmasq_port=$(get_cache_var "node_${node}_$(echo -n "${tcp_proxy_mode}_${dns_cache_key}" | md5sum | cut -d " " -f1)")
-								if [ -z "${_dnsmasq_port}" ]; then
-									_dns_port=$(get_cache_var "node_${node}_$(echo -n "${dns_cache_key}" | md5sum | cut -d " " -f1)")
-									run_dns ${_dns_port}
-								else
-									[ -n "${_dnsmasq_port}" ] && set_cache_var "ACL_${sid}_dns_port" "${_dnsmasq_port}"
-								fi
+								_extra_param="${_extra_param} use_proxy_list=$use_proxy_list use_gfw_list=$use_gfw_list chn_list=$chn_list"
+								run_${type} flag=$node node=$node redir_port=$redir_port ${_extra_param} config_file=$config_file log_file=$log_file loglevel=$loglevel
 							else
-								socks_port=$(get_new_port $(expr $socks_port + 1))
-								set_cache_var "node_${node}_socks_port" "${socks_port}"
-								redir_port=$(get_new_port $(expr $redir_port + 1))
-								set_cache_var "node_${node}_redir_port" "${redir_port}"
-								node_port=$redir_port
-								local log_file="/dev/null"
-								[ "${log}" = "1" ] && log_file="${TMP_ACL_PATH}/${sid}/node.log"
-
-								if [ "${type}" = "sing-box" ] || [ "${type}" = "xray" ]; then
-									config_file="acl/${node}_${redir_port}.json"
-									_extra_param="socks_address=127.0.0.1 socks_port=$socks_port"
-									[ "${type}" = "${dns_mode}" ] && {
-										dns_port=$(get_new_port $(expr $dns_port + 1))
-										_dns_port=$dns_port
-										dnsmasq_filter_proxy_ipv6=0
-										remote_dns_query_strategy="UseIP"
-										[ "$filter_proxy_ipv6" = "1" ] && remote_dns_query_strategy="UseIPv4"
-										remote_dns_doh=${remote_dns_doh:-https://1.1.1.1/dns-query}
-										_extra_param="${_extra_param} dns_listen_port=${_dns_port} remote_dns_protocol=${v2ray_dns_mode} remote_dns_udp_server=${remote_dns} remote_dns_tcp_server=${remote_dns}"
-										_extra_param="${_extra_param} remote_dns_doh=${remote_dns_doh} remote_dns_query_strategy=${remote_dns_query_strategy} remote_fakedns=${remote_fakedns:-0} remote_dns_client_ip=${remote_dns_client_ip}"
-									}
-									_extra_param="${_extra_param} tcp_proxy_way=$TCP_PROXY_WAY"
-									config_file="$TMP_PATH/$config_file"
-									[ "${type}" = "sing-box" ] && {
-										type="singbox"
-										_extra_param="${_extra_param} remote_rewrite_ttl=${remote_rewrite_ttl:-30}"
-									}
-									_extra_param="${_extra_param} use_proxy_list=$use_proxy_list use_gfw_list=$use_gfw_list chn_list=$chn_list"
-									run_${type} flag=$node node=$node redir_port=$redir_port ${_extra_param} config_file=$config_file log_file=$log_file loglevel=$loglevel
-								else
-									config_file="acl/${node}_SOCKS_${socks_port}.json"
-									run_socks flag=$node node=$node bind=127.0.0.1 socks_port=$socks_port config_file=$config_file log_file=$log_file
-									# log_file=$TMP_ACL_PATH/ipt2socks_${node}_${redir_port}.log
-									log_file="/dev/null"
-									run_ipt2socks flag=acl_${node} tcp_tproxy=${is_tproxy} local_port=$redir_port socks_address=127.0.0.1 socks_port=$socks_port log_file=$log_file
-								fi
-								run_dns ${_dns_port}
+								config_file="acl/${node}_SOCKS_${socks_port}.json"
+								run_socks flag=$node node=$node bind=127.0.0.1 socks_port=$socks_port config_file=$config_file log_file=$log_file
+								# log_file=$TMP_ACL_PATH/ipt2socks_${node}_${redir_port}.log
+								log_file="/dev/null"
+								run_ipt2socks flag=acl_${node} tcp_tproxy=${is_tproxy} local_port=$redir_port socks_address=127.0.0.1 socks_port=$socks_port log_file=$log_file
 							fi
-							set_cache_var "ACL_${sid}_node" "${node}"
-							set_cache_var "ACL_${sid}_redir_port" "${node_port}"
+							run_dns ${_dns_port}
 						fi
+						set_cache_var "ACL_${sid}_node" "${node}"
+						set_cache_var "ACL_${sid}_redir_port" "${node_port}"
 					}
 				fi
 				[ "${use_fakedns}" = "1" ] && set_cache_var "ACL_${sid}_fakedns" "1"
 			}
 			unset enabled sid remarks sources interface tcp_no_redir_ports udp_no_redir_ports use_global_config node use_direct_list use_proxy_list use_block_list use_gfw_list chn_list tcp_proxy_mode udp_proxy_mode filter_proxy_ipv6 dns_mode remote_dns v2ray_dns_mode remote_dns_doh remote_dns_client_ip
-			unset _ip _mac _iprange _ipset _ip_or_mac source_list node_port config_file _extra_param dns_cache_key log loglevel
+			unset _ip _mac _iprange _ipset _ip_or_mac source_list node_port config_file _extra_param dns_cache_key log loglevel log_chinadns_ng
 			unset _china_ng_listen _chinadns_local_dns _direct_dns_mode chinadns_ng_default_tag dnsmasq_filter_proxy_ipv6 remote_fakedns force_https_soa use_fakedns remote_rewrite_ttl
 		done
 		unset socks_port redir_port dns_port dnsmasq_port chinadns_port
@@ -1763,7 +1797,7 @@ get_config() {
 	[ -z "$(first_type $DNS_SHUNT)" ] && DNS_SHUNT="dnsmasq"
 	DNS_MODE=$(config_n_get @global[0] dns_mode tcp)
 	[ "$DNS_SHUNT" = "smartdns" ] && DNS_MODE=$(config_n_get @global[0] smartdns_dns_mode socks)
-	REMOTE_DNS=$(normalize_dns "$(config_n_get @global[0] remote_dns 1.1.1.1:53)")
+	REMOTE_DNS=$(normalize_dns "$(config_n_get @global[0] remote_dns 1.1.1.1)")
 	USE_DEFAULT_DNS=$(config_n_get @global[0] use_default_dns direct)
 	FILTER_PROXY_IPV6=$(config_n_get @global[0] filter_proxy_ipv6 0)
 	DNS_REDIRECT=$(config_n_get @global[0] dns_redirect 1)
@@ -1812,8 +1846,8 @@ get_local_dns() {
 	RESOLVFILE=/tmp/resolv.conf.d/resolv.conf.auto
 	[ -f "${RESOLVFILE}" ] && [ -s "${RESOLVFILE}" ] || RESOLVFILE=/tmp/resolv.conf.auto

-	ISP_DNS=$(cat $RESOLVFILE 2>/dev/null | grep -E -o "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | grep -v -E '^(0\.0\.0\.0|127\.0\.0\.1)$' | awk '!seen[$0]++')
-	ISP_DNS6=$(cat $RESOLVFILE 2>/dev/null | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | awk -F % '{print $1}' | awk -F " " '{print $2}' | grep -v -Fx ::1 | grep -v -Fx :: | awk '!seen[$0]++')
+	ISP_DNS=$(grep -Eo "$IPv4_REGEX" "$RESOLVFILE" 2>/dev/null | grep -Ev '^(0\.0\.0\.0|127\.0\.0\.1)$' | awk '!seen[$0]++')
+	ISP_DNS6=$(grep -Eo "$IPv6_REGEX" "$RESOLVFILE" 2>/dev/null | awk -F% '{print $1}' | grep -Ev '^::1$|^::$' | awk '!seen[$0]++')

 	DEFAULT_DNS=$(uci show dhcp.@dnsmasq[0] | grep "\.server=" | awk -F '=' '{print $2}' | sed "s/'//g" | tr ' ' '\n' | grep -v "\/" | sed ':label;N;s/\n/,/;b label')
 	[ -z "${DEFAULT_DNS}" ] && [ "$(echo $ISP_DNS | tr ' ' '\n' | wc -l)" -ge 1 ] && DEFAULT_DNS=$(echo -n $ISP_DNS | tr ' ' '\n' | tr '\n' ',' | sed 's/,$//')
@@ -109,20 +109,26 @@ api.uci_foreach_c("haproxy_config", function(t)
 			t.origin_port = server_port
 			if health_check_type == "script_logic" then
 				if server_node.type ~= "Socks" then
-					local relay_port = server_node.port
-					local new_port = api.get_new_port()
-					local config_file = string.format("%s_%s.json", t[".name"], new_port)
-					sys.call(string.format('/usr/share/%s/app.sh run_socks "%s"> /dev/null',
-						appname,
-						string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s",
-							new_port, --flag
-							server_node[".name"], --node
-							"127.0.0.1", --bind
-							new_port, --socks port
-							config_file --config file
+					local new_port
+					local cache = api.get_socks_port_by_cache(server_node[".name"])
+					if cache then
+						new_port = cache
+					else
+						new_port = api.get_new_port()
+						local config_file = string.format("%s_%s.json", t[".name"], new_port)
+						sys.call(string.format('/usr/share/%s/app.sh run_socks "%s"> /dev/null',
+							appname,
+							string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s",
+								new_port, --flag
+								server_node[".name"], --node
+								"127.0.0.1", --bind
+								new_port, --socks port
+								config_file --config file
+								)
 							)
 						)
-					)
+						api.set_socks_port_to_cache(server_node[".name"], new_port)
+					end
 					server_address = "127.0.0.1"
 					server_port = new_port
 				end
@@ -236,6 +236,12 @@ load_acl() {
 			}
 			[ -n "$(get_cache_var "ACL_${sid}_dns_port")" ] && dns_redirect_port=$(get_cache_var "ACL_${sid}_dns_port")
 			[ -n "$(get_cache_var "ACL_${sid}_fakedns")" ] && use_fakedns=$(get_cache_var "ACL_${sid}_fakedns")
+
+			([ -n "$node" ] && ([ "$node" = "default" ] || [ "$node" = "$NODE" ])) && {
+				use_global_config=1
+				unset node
+			}
+
 			[ -n "$node" ] && {
 				if [ "$(config_get_type $node)" = "socks" ]; then
 					node_remark="Socks 配置($(config_n_get $node port) 端口)"
@@ -385,16 +391,16 @@ load_acl() {
 							local shunt_id
 							for shunt_id in $shunt_ids; do
 								[ "${shunt_group}" != "$(config_n_get ${shunt_id} group)" ] && continue
-								config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $shunt_set_name &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-								config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $shunt6_set_name &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+								config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv4_REGEX" | sed -e "s/^/add $shunt_set_name &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+								config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv6_REGEX" | sed -e "s/^/add $shunt6_set_name &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 								[ "$USE_GEOVIEW" = "1" ] && {
 									local geoip_code=$(config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 									[ -n "$geoip_code" ] && GEOIP_CODE="${GEOIP_CODE:+$GEOIP_CODE,}$geoip_code"
 								}
 							done
 							if [ -n "$GEOIP_CODE" ]; then
-								get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $shunt_set_name &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-								get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $shunt6_set_name &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+								get_geoip $GEOIP_CODE ipv4 | sed -e "s/^/add $shunt_set_name &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+								get_geoip $GEOIP_CODE ipv6 | sed -e "s/^/add $shunt6_set_name &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 							fi
 						}
 					}
@@ -411,7 +417,7 @@ load_acl() {
 					[ "$_ipv4" != "1" ] && $ip6t_n -A PSW_DNS $(comment "$remarks") -p udp ${_ipt_source} --dport 53 -j REDIRECT --to-ports ${dns_redirect} 2>/dev/null
 					$ipt_n -A PSW_DNS $(comment "$remarks") -p tcp ${_ipt_source} --dport 53 -j REDIRECT --to-ports ${dns_redirect}
 					[ "$_ipv4" != "1" ] && $ip6t_n -A PSW_DNS $(comment "$remarks") -p tcp ${_ipt_source} --dport 53 -j REDIRECT --to-ports ${dns_redirect} 2>/dev/null
-					[ -z "$(get_cache_var "ACL_${sid}_default")" ] && echolog "     - ${msg}使用与全局配置不相同节点，已将DNS强制重定向到专用 DNS 服务器。"
+					[ -z "$(get_cache_var "ACL_${sid}_default")" ] && echolog "     - ${msg}节点不同于全局配置，DNS 重定向到专用服务器[${dns_redirect}]。"
 				fi

 				[ -n "$tcp_port" ] || [ -n "$udp_port" ] && {
@@ -757,12 +763,12 @@ filter_haproxy() {

 filter_vpsip() {
 	local vps_addrs=$(uci show $CONFIG | grep -E "(\.address=|\.download_address=|\.domain_resolver_dns=|\.domain_resolver_dns_https=)" | cut -d "'" -f 2 | grep -Ev "$EXCLUDE_VPSIP")
-	local ipv4_addrs=$(echo "$vps_addrs" | grep -Eo "([0-9]{1,3}\.){3}[0-9]{1,3}")
+	local ipv4_addrs=$(echo "$vps_addrs" | grep -Eo "$IPv4_REGEX")
 	[ -n "$ipv4_addrs" ] && {
 		echo "$ipv4_addrs" | sed "s/^/add $IPSET_VPS /" | awk '1; END{print "COMMIT"}' | ipset -! -R
 		echolog "  - [$?]加入所有IPv4节点服务器IP到ipset[$IPSET_VPS]直连完成"
 	}
-	local ipv6_addrs=$(echo "$vps_addrs" | grep -Eo "\[?[A-Fa-f0-9:]*:[A-Fa-f0-9:]+\]?")
+	local ipv6_addrs=$(echo "$vps_addrs" | grep -Eo "$IPv6_REGEX")
 	[ -n "$ipv6_addrs" ] && {
 		echo "$ipv6_addrs" | sed "s/^/add $IPSET_VPS6 /" | awk '1; END{print "COMMIT"}' | ipset -! -R
 		echolog "  - [$?]加入所有IPv6节点服务器IP到ipset[$IPSET_VPS6]直连完成"
@@ -770,8 +776,8 @@ filter_vpsip() {
 	#订阅方式为直连时
 	local subscribe_host=$(get_subscribe_host | grep -Ev "$EXCLUDE_VPSIP")
 	[ -n "$subscribe_host" ] && {
-		echo "$subscribe_host" | grep -Eo "([0-9]{1,3}\.){3}[0-9]{1,3}" | sed "s/^/add $IPSET_VPS /" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
-		echo "$subscribe_host" | grep -Eo "\[?[A-Fa-f0-9:]*:[A-Fa-f0-9:]+\]?" | sed "s/^/add $IPSET_VPS6 /" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
+		echo "$subscribe_host" | grep -Eo "$IPv4_REGEX" | sed "s/^/add $IPSET_VPS /" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
+		echo "$subscribe_host" | grep -Eo "$IPv6_REGEX" | sed "s/^/add $IPSET_VPS6 /" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
 	}
 }

@@ -779,8 +785,8 @@ filter_server_port() {
 	local address="$1"
 	local port=$(echo "$2" | tr '-' ':' | tr -d ' ')
 	local stream=$(echo "$3" | tr 'A-Z' 'a-z')
-	local ipt_tmp="$ipt_n" _is_tproxy _ipt_cmd _ver multi_ports p ports
-	[ "$(config_n_get @global_forwarding[0] tcp_proxy_way redirect)" = "tproxy" ] && _is_tproxy="TPROXY"
+	local _is_tproxy="$4"
+	local ipt_tmp="$ipt_n" _ipt_cmd _ver multi_ports p ports
 	[ "$stream" = "udp" ] && _is_tproxy="TPROXY"
 	[ -n "$_is_tproxy" ] && ipt_tmp="$ipt_m"
 	for _ver in 4 6; do
@@ -807,7 +813,7 @@ filter_server_port() {
 }

 filter_node() {
-	local node="$1" stream="$2"
+	local node="$1" stream="$2" _is_tproxy="$3"
 	[ -z "$node" ] && return 1
 	local address=$(config_n_get "$node" address)
 	local port=$(config_n_get "$node" port)
@@ -816,13 +822,15 @@ filter_node() {
 	[ -z "$address" ] && return 1
 	echo "$address" | grep -Eq "$EXCLUDE_VPSIP" && return 1
 	[ -z "$port" ] && return 1
-	filter_server_port "$address" "$port" "$stream"
+	filter_server_port "$address" "$port" "$stream" "$_is_tproxy"
 }

 filter_direct_node_list() {
 	[ ! -s "$TMP_PATH/direct_node_list" ] && return
+	local _is_tproxy
+	[ "$(config_n_get @global_forwarding[0] tcp_proxy_way redirect)" = "tproxy" ] && _is_tproxy="TPROXY"
 	awk '!seen[$0]++' "$TMP_PATH/direct_node_list" | while read -r _node_id; do
-		filter_node "$_node_id" TCP
+		filter_node "$_node_id" TCP "$_is_tproxy"
 		filter_node "$_node_id" UDP
 		unset _node_id
 	done
@@ -921,13 +929,13 @@ add_firewall_rule() {

 	#直连列表
 	[ "$USE_DIRECT_LIST_ALL" = "1" ] && {
-		cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_WHITE &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-		cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_WHITE6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+		cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv4_REGEX" | sed -e "s/^/add $IPSET_WHITE &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+		cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv6_REGEX" | sed -e "s/^/add $IPSET_WHITE6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 		[ "$USE_GEOVIEW" = "1" ] && {
 			local GEOIP_CODE=$(cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 			if [ -n "$GEOIP_CODE" ]; then
-				get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_WHITE &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-				get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_WHITE6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+				get_geoip $GEOIP_CODE ipv4 | sed -e "s/^/add $IPSET_WHITE &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+				get_geoip $GEOIP_CODE ipv6 | sed -e "s/^/add $IPSET_WHITE6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 				echolog "  - [$?]解析并加入[直连列表] GeoIP 到 IPSET 完成"
 			fi
 		}
@@ -935,13 +943,13 @@ add_firewall_rule() {

 	#代理列表
 	[ "$USE_PROXY_LIST_ALL" = "1" ] && {
-		cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_BLACK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-		cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_BLACK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+		cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv4_REGEX" | sed -e "s/^/add $IPSET_BLACK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+		cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv6_REGEX" | sed -e "s/^/add $IPSET_BLACK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 		[ "$USE_GEOVIEW" = "1" ] && {
 			local GEOIP_CODE=$(cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 			if [ -n "$GEOIP_CODE" ]; then
-				get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_BLACK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-				get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_BLACK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+				get_geoip $GEOIP_CODE ipv4 | sed -e "s/^/add $IPSET_BLACK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+				get_geoip $GEOIP_CODE ipv6 | sed -e "s/^/add $IPSET_BLACK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 				echolog "  - [$?]解析并加入[代理列表] GeoIP 到 IPSET 完成"
 			fi
 		}
@@ -949,13 +957,13 @@ add_firewall_rule() {

 	#屏蔽列表
 	[ "$USE_BLOCK_LIST_ALL" = "1" ] && {
-		cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_BLOCK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-		cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_BLOCK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+		cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv4_REGEX" | sed -e "s/^/add $IPSET_BLOCK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+		cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv6_REGEX" | sed -e "s/^/add $IPSET_BLOCK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 		[ "$USE_GEOVIEW" = "1" ] && {
 			local GEOIP_CODE=$(cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 			if [ -n "$GEOIP_CODE" ]; then
-				get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_BLOCK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-				get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_BLOCK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+				get_geoip $GEOIP_CODE ipv4 | sed -e "s/^/add $IPSET_BLOCK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+				get_geoip $GEOIP_CODE ipv6 | sed -e "s/^/add $IPSET_BLOCK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 				echolog "  - [$?]解析并加入[屏蔽列表] GeoIP 到 IPSET 完成"
 			fi
 		}
@@ -969,16 +977,16 @@ add_firewall_rule() {
 		local shunt_id
 		for shunt_id in $shunt_ids; do
 			[ "${shunt_group}" != "$(config_n_get ${shunt_id} group)" ] && continue
-			config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_SHUNT &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-			config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_SHUNT6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+			config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv4_REGEX" | sed -e "s/^/add $IPSET_SHUNT &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+			config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv6_REGEX" | sed -e "s/^/add $IPSET_SHUNT6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 			[ "$USE_GEOVIEW" = "1" ] && {
 				local geoip_code=$(config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 				[ -n "$geoip_code" ] && GEOIP_CODE="${GEOIP_CODE:+$GEOIP_CODE,}$geoip_code"
 			}
 		done
 		if [ -n "$GEOIP_CODE" ]; then
-			get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_SHUNT &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-			get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_SHUNT6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+			get_geoip $GEOIP_CODE ipv4 | sed -e "s/^/add $IPSET_SHUNT &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+			get_geoip $GEOIP_CODE ipv6 | sed -e "s/^/add $IPSET_SHUNT6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 			echolog "  - [$?]解析并加入[分流节点] GeoIP 到 IPSET 完成"
 		fi
 	}
@@ -1090,7 +1098,7 @@ add_firewall_rule() {

 	insert_rule_before "$ipt_m" "PREROUTING" "mwan3" "-j PSW"
 	# Only TCP, UDP Invalid.
-	insert_rule_before "$ipt_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT"
+	insert_rule_before "$ipt_m" "PREROUTING" "PSW" "-p tcp -m socket --transparent -j PSW_DIVERT"

 	$ipt_m -N PSW_OUTPUT
 	$ipt_m -A PSW_OUTPUT $(dst $IPSET_LAN) -j RETURN
@@ -1164,7 +1172,7 @@ add_firewall_rule() {

 	insert_rule_before "$ip6t_m" "PREROUTING" "mwan3" "-j PSW"
 	# Only TCP, UDP Invalid.
-	insert_rule_before "$ip6t_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT"
+	insert_rule_before "$ip6t_m" "PREROUTING" "PSW" "-p tcp -m socket --transparent -j PSW_DIVERT"

 	$ip6t_m -N PSW_OUTPUT
 	$ip6t_m -A PSW_OUTPUT -m mark --mark 0xff/0xff -j RETURN
@@ -1469,7 +1477,7 @@ gen_include() {
 		[ -z "${_ipt}" ] && return

 		echo "*$2"
-		${_ipt}-save -t $2 | grep "PSW" | grep -v "\-j PSW$" | grep -v "mangle\-OUTPUT\-PSW" | grep -v "socket \-j PSW_DIVERT$" | sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/"
+		${_ipt}-save -t $2 | grep "PSW" | grep -v "\-j PSW$" | grep -v "mangle\-OUTPUT\-PSW" | grep -v "\-m socket .*\-j PSW_DIVERT$" | sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/"
 		echo 'COMMIT'
 	}
 	local __ipt=""
@@ -1493,7 +1501,7 @@ gen_include() {
 			[ -z "${is_tproxy}" ] && \$(${MY_PATH} insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "-p tcp -j PSW")

 			\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "mwan3" "-j PSW")
-			\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT")
+			\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "PSW" "-p tcp -m socket --transparent -j PSW_DIVERT")
 		EOF
 		)
 	}
@@ -1514,7 +1522,7 @@ gen_include() {
 			[ "$accept_icmpv6" = "1" ] && $ip6t_n -A PREROUTING -p ipv6-icmp -j PSW

 			\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "mwan3" "-j PSW")
-			\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT")
+			\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "PSW" "-p tcp -m socket --transparent -j PSW_DIVERT")
 		EOF
 		)
 	}
@@ -4,8 +4,7 @@

 . /usr/share/passwall/utils.sh
 LOCK_FILE=${LOCK_PATH}/${CONFIG}_lease2hosts.lock
-LEASE_FILE=$(uci -q get "dhcp.@dnsmasq[0].leasefile")
-LEASE_FILE=${LEASE_FILE:="/tmp/dhcp.leases"}
+LEASE_FILE=$(uci -q get dhcp.@dnsmasq[0].leasefile || echo "/tmp/dhcp.leases")
 HOSTS_FILE="$TMP_PATH2/dhcp-hosts"
 TMP_FILE="/tmp/dhcp-hosts.tmp"

@@ -296,6 +296,12 @@ load_acl() {
 			}
 			[ -n "$(get_cache_var "ACL_${sid}_dns_port")" ] && dns_redirect_port=$(get_cache_var "ACL_${sid}_dns_port")
 			[ -n "$(get_cache_var "ACL_${sid}_fakedns")" ] && use_fakedns=$(get_cache_var "ACL_${sid}_fakedns")
+
+			([ -n "$node" ] && ([ "$node" = "default" ] || [ "$node" = "$NODE" ])) && {
+				use_global_config=1
+				unset node
+			}
+
 			[ -n "$node" ] && {
 				if [ "$(config_get_type $node)" = "socks" ]; then
 					node_remark="Socks 配置($(config_n_get $node port) 端口)"
@@ -446,16 +452,16 @@ load_acl() {
 							local shunt_id
 							for shunt_id in $shunt_ids; do
 								[ "${shunt_group}" != "$(config_n_get ${shunt_id} group)" ] && continue
-								config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $shunt_set_name_static
-								config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $shunt6_set_name_static
+								config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "$IPv4_REGEX" | insert_nftset $shunt_set_name_static
+								config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "$IPv6_REGEX" | insert_nftset $shunt6_set_name_static
 								[ "$USE_GEOVIEW" = "1" ] && {
 									local geoip_code=$(config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 									[ -n "$geoip_code" ] && GEOIP_CODE="${GEOIP_CODE:+$GEOIP_CODE,}$geoip_code"
 								}
 							done
 							if [ -n "$GEOIP_CODE" ]; then
-								get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $shunt_set_name_static
-								get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $shunt6_set_name_static
+								get_geoip $GEOIP_CODE ipv4 | insert_nftset $shunt_set_name_static
+								get_geoip $GEOIP_CODE ipv6 | insert_nftset $shunt6_set_name_static
 							fi
 						}
 					}
@@ -463,16 +469,28 @@ load_acl() {
 				else
 					[ -n "${DIRECT_DNSMASQ_PORT}" ] && dns_redirect=${DIRECT_DNSMASQ_PORT}
 				fi
-				if [ -n "${dns_redirect}" ]; then
-					nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
-					[ "$_ipv4" != "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
-					nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
-					[ "$_ipv4" != "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
-					#nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp ${_ipt_source} udp dport 53 counter redirect to :${dns_redirect} comment \"$remarks\""
-					#nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter redirect to :${dns_redirect} comment \"$remarks\""
-					nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter redirect to :${dns_redirect} comment \"$remarks\""
-					nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter redirect to :${dns_redirect} comment \"$remarks\""
-					[ -z "$(get_cache_var "ACL_${sid}_default")" ] && echolog "     - ${msg}使用与全局配置不相同节点，已将DNS强制重定向到专用 DNS 服务器。"
+
+				if ([ -n "$tcp_port" ] || [ -n "$udp_port" ]) && [ -n "$dns_redirect" ]; then
+					if [ "$PROXY_IPV6" = "1" ]; then
+						nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} udp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} tcp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter redirect to :$dns_redirect comment \"$remarks\""
+						nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter redirect to :$dns_redirect comment \"$remarks\""
+					else
+						nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} udp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol tcp ${_ipt_source} tcp dport 53 counter accept"
+						nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp ${_ipt_source} udp dport 53 counter redirect to :$dns_redirect comment \"$remarks\""
+						nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter redirect to :$dns_redirect comment \"$remarks\""
+					fi
+					[ -z "$(get_cache_var "ACL_${sid}_default")" ] && echolog "     - ${msg}节点不同于全局配置，DNS 重定向到专用服务器[${dns_redirect}]。"
+				else
+					if [ "$PROXY_IPV6" = "1" ]; then
+						nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
+						nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
+					else
+						nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
+						nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
+					fi
 				fi

 				[ -n "$tcp_port" ] || [ -n "$udp_port" ] && {
@@ -651,15 +669,26 @@ load_acl() {
 			[ -n "${DIRECT_DNSMASQ_PORT}" ] && DNS_REDIRECT=${DIRECT_DNSMASQ_PORT}
 		fi

-		if [ -n "${DNS_REDIRECT}" ]; then
-			nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp udp dport 53 counter return comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp udp dport 53 counter return comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol tcp tcp dport 53 counter return comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp tcp dport 53 counter return comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp udp dport 53 counter redirect to :${DNS_REDIRECT} comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp tcp dport 53 counter redirect to :${DNS_REDIRECT} comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp udp dport 53 counter redirect to :${DNS_REDIRECT} comment \"默认\""
-			nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp tcp dport 53 counter redirect to :${DNS_REDIRECT} comment \"默认\""
+		if ([ -n "${TCP_PROXY_MODE}" ] || [ -n "${UDP_PROXY_MODE}" ]) && [ -n "$DNS_REDIRECT" ]; then
+			if [ "$PROXY_IPV6" = "1" ]; then
+				nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp udp dport 53 counter accept"
+				nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp tcp dport 53 counter accept"
+				nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp udp dport 53 counter redirect to :$DNS_REDIRECT comment \"默认\""
+				nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp tcp dport 53 counter redirect to :$DNS_REDIRECT comment \"默认\""
+			else
+				nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp udp dport 53 counter accept"
+				nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol tcp tcp dport 53 counter accept"
+				nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp udp dport 53 counter redirect to :$DNS_REDIRECT comment \"默认\""
+				nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp tcp dport 53 counter redirect to :$DNS_REDIRECT comment \"默认\""
+			fi
+		else
+			if [ "$PROXY_IPV6" = "1" ]; then
+				nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp udp dport 53 counter return comment \"默认\""
+				nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp tcp dport 53 counter return comment \"默认\""
+			else
+				nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp udp dport 53 counter return comment \"默认\""
+				nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp tcp dport 53 counter return comment \"默认\""
+			fi
 		fi

 		[ -n "${TCP_PROXY_MODE}" ] || [ -n "${UDP_PROXY_MODE}" ] && {
@@ -829,12 +858,12 @@ filter_vps_addr() {

 filter_vpsip() {
 	local vps_addrs=$(uci show $CONFIG | grep -E "(\.address=|\.download_address=|\.domain_resolver_dns=|\.domain_resolver_dns_https=)" | cut -d "'" -f 2 | grep -Ev "$EXCLUDE_VPSIP")
-	local ipv4_addrs=$(echo "$vps_addrs" | grep -Eo "([0-9]{1,3}\.){3}[0-9]{1,3}")
+	local ipv4_addrs=$(echo "$vps_addrs" | grep -Eo "$IPv4_REGEX")
 	[ -n "$ipv4_addrs" ] && {
 		echo "$ipv4_addrs" | insert_nftset $NFTSET_VPS
 		echolog "  - [$?]加入所有IPv4节点服务器IP到nftset[$NFTSET_VPS]直连完成"
 	}
-	local ipv6_addrs=$(echo "$vps_addrs" | grep -Eo "\[?[A-Fa-f0-9:]*:[A-Fa-f0-9:]+\]?")
+	local ipv6_addrs=$(echo "$vps_addrs" | grep -Eo "$IPv6_REGEX")
 	[ -n "$ipv6_addrs" ] && {
 		echo "$ipv6_addrs" | insert_nftset $NFTSET_VPS6
 		echolog "  - [$?]加入所有IPv6节点服务器IP到nftset[$NFTSET_VPS6]直连完成"
@@ -842,8 +871,8 @@ filter_vpsip() {
 	#订阅方式为直连时
 	local subscribe_host=$(get_subscribe_host | grep -Ev "$EXCLUDE_VPSIP")
 	[ -n "$subscribe_host" ] && {
-		echo "$subscribe_host" | grep -Eo "([0-9]{1,3}\.){3}[0-9]{1,3}" | grep -Ev "$EXCLUDE_VPSIP" | insert_nftset $NFTSET_VPS
-		echo "$subscribe_host" | grep -Eo "\[?[A-Fa-f0-9:]*:[A-Fa-f0-9:]+\]?" | insert_nftset $NFTSET_VPS6
+		echo "$subscribe_host" | grep -Eo "$IPv4_REGEX" | grep -Ev "$EXCLUDE_VPSIP" | insert_nftset $NFTSET_VPS
+		echo "$subscribe_host" | grep -Eo "$IPv6_REGEX" | insert_nftset $NFTSET_VPS6
 	}
 }

@@ -851,9 +880,9 @@ filter_server_port() {
 	local address="$1"
 	local port=$(echo "$2" | tr ':' '-' | tr -d ' ')
 	local stream=$(echo "$3" | tr 'A-Z' 'a-z')
-	local _ip_type _port_expr _ver _is_tproxy
+	local _is_tproxy="$4"
+	local _ip_type _port_expr _ver
 	local _nft_output_chain="PSW_OUTPUT_NAT"
-	[ "$(config_n_get @global_forwarding[0] tcp_proxy_way redirect)" = "tproxy" ] && _is_tproxy="TPROXY"
 	[ "$stream" = "udp" ] && _is_tproxy="TPROXY"
 	[ -n "$_is_tproxy" ] && _nft_output_chain="PSW_OUTPUT_MANGLE"
 	case "$port" in
@@ -869,7 +898,7 @@ filter_server_port() {
 }

 filter_node() {
-	local node="$1" stream="$2"
+	local node="$1" stream="$2" _is_tproxy="$3"
 	[ -z "$node" ] && return 1
 	local address=$(config_n_get "$node" address)
 	local port=$(config_n_get "$node" port)
@@ -878,13 +907,15 @@ filter_node() {
 	[ -z "$address" ] && return 1
 	echo "$address" | grep -Eq "$EXCLUDE_VPSIP" && return 1
 	[ -z "$port" ] && return 1
-	filter_server_port "$address" "$port" "$stream"
+	filter_server_port "$address" "$port" "$stream" "$_is_tproxy"
 }

 filter_direct_node_list() {
 	[ ! -s "$TMP_PATH/direct_node_list" ] && return
+	local _is_tproxy
+	[ "$(config_n_get @global_forwarding[0] tcp_proxy_way redirect)" = "tproxy" ] && _is_tproxy="TPROXY"
 	awk '!seen[$0]++' "$TMP_PATH/direct_node_list" | while read -r _node_id; do
-		filter_node "$_node_id" TCP
+		filter_node "$_node_id" TCP "$_is_tproxy"
 		filter_node "$_node_id" UDP
 		unset _node_id
 	done
@@ -902,16 +933,22 @@ add_script_mwan3() {
 	}
 }

+MWAN3_RULE_ARGS="-m connmark --mark ${FWMARK}/0xffffffff -j RETURN"
+
 mwan3_stop() {
+	nft list chain ip mangle mwan3_hook >/dev/null 2>&1 || return 0
 	local handles=$(nft -a list chain ip mangle mwan3_hook 2>/dev/null | grep "${FWMARK}" | awk -F '# handle ' '{print$2}')
 	for handle in $handles; do
 		nft delete rule ip mangle mwan3_hook handle ${handle} 2>/dev/null
 	done
+	while iptables -w 5 -t mangle -D mwan3_hook ${MWAN3_RULE_ARGS} >/dev/null 2>&1; do :; done
 }

 mwan3_start() {
+	nft list chain ip mangle mwan3_hook >/dev/null 2>&1 || return 0
 	mwan3_stop
-	nft list chain ip mangle mwan3_hook >/dev/null 2>&1 && nft insert rule ip mangle mwan3_hook ct mark ${FWMARK} counter return >/dev/null 2>&1
+	iptables -w 5 -t mangle -I mwan3_hook 1 ${MWAN3_RULE_ARGS} >/dev/null 2>&1 || \
+		logger -t passwall "mwan3: failed to add ${FWMARK} exemption rule to mangle/mwan3_hook"
 }

 update_wan_sets() {
@@ -1024,13 +1061,13 @@ add_firewall_rule() {

 	#直连列表
 	[ "$USE_DIRECT_LIST_ALL" = "1" ] && {
-		cat $RULES_PATH/direct_ip | sed 's/#.*//' | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $NFTSET_WHITE_STATIC
-		cat $RULES_PATH/direct_ip | sed 's/#.*//' | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $NFTSET_WHITE6_STATIC
+		cat $RULES_PATH/direct_ip | sed 's/#.*//' | grep -E "$IPv4_REGEX" | insert_nftset $NFTSET_WHITE_STATIC
+		cat $RULES_PATH/direct_ip | sed 's/#.*//' | grep -E "$IPv6_REGEX" | insert_nftset $NFTSET_WHITE6_STATIC
 		[ "$USE_GEOVIEW" = "1" ] && {
 			local GEOIP_CODE=$(cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 			if [ -n "$GEOIP_CODE" ]; then
-				get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $NFTSET_WHITE_STATIC
-				get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $NFTSET_WHITE6_STATIC
+				get_geoip $GEOIP_CODE ipv4 | insert_nftset $NFTSET_WHITE_STATIC
+				get_geoip $GEOIP_CODE ipv6 | insert_nftset $NFTSET_WHITE6_STATIC
 				echolog "  - [$?]解析并加入[直连列表] GeoIP 到 NFTSET 完成"
 			fi
 		}
@@ -1038,13 +1075,13 @@ add_firewall_rule() {

 	#代理列表
 	[ "$USE_PROXY_LIST_ALL" = "1" ] && {
-		cat $RULES_PATH/proxy_ip | sed 's/#.*//' | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $NFTSET_BLACK_STATIC
-		cat $RULES_PATH/proxy_ip | sed 's/#.*//' | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $NFTSET_BLACK6_STATIC
+		cat $RULES_PATH/proxy_ip | sed 's/#.*//' | grep -E "$IPv4_REGEX" | insert_nftset $NFTSET_BLACK_STATIC
+		cat $RULES_PATH/proxy_ip | sed 's/#.*//' | grep -E "$IPv6_REGEX" | insert_nftset $NFTSET_BLACK6_STATIC
 		[ "$USE_GEOVIEW" = "1" ] && {
 			local GEOIP_CODE=$(cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 			if [ -n "$GEOIP_CODE" ]; then
-				get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $NFTSET_BLACK_STATIC
-				get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $NFTSET_BLACK6_STATIC
+				get_geoip $GEOIP_CODE ipv4 | insert_nftset $NFTSET_BLACK_STATIC
+				get_geoip $GEOIP_CODE ipv6 | insert_nftset $NFTSET_BLACK6_STATIC
 				echolog "  - [$?]解析并加入[代理列表] GeoIP 到 NFTSET 完成"
 			fi
 		}
@@ -1052,13 +1089,13 @@ add_firewall_rule() {

 	#屏蔽列表
 	[ "$USE_BLOCK_LIST_ALL" = "1" ] && {
-		cat $RULES_PATH/block_ip | sed 's/#.*//' | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $NFTSET_BLOCK_STATIC
-		cat $RULES_PATH/block_ip | sed 's/#.*//' | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $NFTSET_BLOCK6_STATIC
+		cat $RULES_PATH/block_ip | sed 's/#.*//' | grep -E "$IPv4_REGEX" | insert_nftset $NFTSET_BLOCK_STATIC
+		cat $RULES_PATH/block_ip | sed 's/#.*//' | grep -E "$IPv6_REGEX" | insert_nftset $NFTSET_BLOCK6_STATIC
 		[ "$USE_GEOVIEW" = "1" ] && {
 			local GEOIP_CODE=$(cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 			if [ -n "$GEOIP_CODE" ]; then
-				get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $NFTSET_BLOCK_STATIC
-				get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $NFTSET_BLOCK6_STATIC
+				get_geoip $GEOIP_CODE ipv4 | insert_nftset $NFTSET_BLOCK_STATIC
+				get_geoip $GEOIP_CODE ipv6 | insert_nftset $NFTSET_BLOCK6_STATIC
 				echolog "  - [$?]解析并加入[屏蔽列表] GeoIP 到 NFTSET 完成"
 			fi
 		}
@@ -1072,16 +1109,16 @@ add_firewall_rule() {
 		local shunt_id
 		for shunt_id in $shunt_ids; do
 			[ "${shunt_group}" != "$(config_n_get ${shunt_id} group)" ] && continue
-			config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $NFTSET_SHUNT_STATIC
-			config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $NFTSET_SHUNT6_STATIC
+			config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "$IPv4_REGEX" | insert_nftset $NFTSET_SHUNT_STATIC
+			config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "$IPv6_REGEX" | insert_nftset $NFTSET_SHUNT6_STATIC
 			[ "$USE_GEOVIEW" = "1" ] && {
 				local geoip_code=$(config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 				[ -n "$geoip_code" ] && GEOIP_CODE="${GEOIP_CODE:+$GEOIP_CODE,}$geoip_code"
 			}
 		done
 		if [ -n "$GEOIP_CODE" ]; then
-			get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $NFTSET_SHUNT_STATIC
-			get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $NFTSET_SHUNT6_STATIC
+			get_geoip $GEOIP_CODE ipv4 | insert_nftset $NFTSET_SHUNT_STATIC
+			get_geoip $GEOIP_CODE ipv6 | insert_nftset $NFTSET_SHUNT6_STATIC
 			echolog "  - [$?]解析并加入[分流节点] GeoIP 到 NFTSET 完成"
 		fi
 	}
@@ -1296,10 +1333,15 @@ add_firewall_rule() {

 		if [ -n "$NODE" ] && ([ -n "${LOCALHOST_TCP_PROXY_MODE}" ] || [ -n "${LOCALHOST_UDP_PROXY_MODE}" ]); then
 			[ -n "$DNS_REDIRECT_PORT" ] && {
-				nft "add rule $NFTABLE_NAME nat_output ip protocol udp oif lo udp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
-				nft "add rule $NFTABLE_NAME nat_output ip protocol tcp oif lo tcp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
-				nft "add rule $NFTABLE_NAME nat_output meta l4proto udp oif lo udp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
-				nft "add rule $NFTABLE_NAME nat_output meta l4proto tcp oif lo tcp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
+				if [ "$PROXY_IPV6" == "1" ]; then
+					#nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto udp udp dport 53 counter accept"
+					#nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto tcp tcp dport 53 counter accept"
+					nft "add rule $NFTABLE_NAME nat_output oif lo meta l4proto udp udp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
+					nft "add rule $NFTABLE_NAME nat_output oif lo meta l4proto tcp tcp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
+				else
+					nft "add rule $NFTABLE_NAME nat_output oif lo ip protocol udp udp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
+					nft "add rule $NFTABLE_NAME nat_output oif lo ip protocol tcp tcp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
+				fi
 			}
 		fi

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
action	87faec277a	update 2026-09-14 10:58:48	2026-09-14 10:58:48 +08:00
action	d341a782d4	update 2026-09-14 06:01:57	2026-09-14 06:01:57 +08:00
action	205be274cd	update 2026-09-14 02:28:52	2026-09-14 02:28:52 +08:00
action	622dd92021	update 2026-09-13 23:28:56	2026-09-13 23:28:56 +08:00
action	141863e6d4	update 2026-09-13 16:42:22	2026-09-13 16:42:22 +08:00
action	2e55e363ac	update 2026-09-13 10:43:38	2026-09-13 10:43:38 +08:00
action	86d911baf4	update 2026-09-13 05:53:41	2026-09-13 05:53:41 +08:00
action	65075cb38f	update 2026-09-13 02:01:59	2026-09-13 02:01:59 +08:00
action	aff13cf0c6	update 2026-09-12 22:51:39	2026-09-12 22:51:39 +08:00
action	7497dff620	update 2026-09-12 16:17:58	2026-09-12 16:17:58 +08:00
action	639738b05d	update 2026-09-12 10:45:42	2026-09-12 10:45:42 +08:00
action	419c580042	update 2026-09-12 06:09:18	2026-09-12 06:09:18 +08:00
action	7a00e14e57	update 2026-09-12 02:55:35	2026-09-12 02:55:35 +08:00
action	8daa9142b3	update 2026-09-11 23:43:33	2026-09-11 23:43:33 +08:00
action	42846bd15f	update 2026-09-11 16:29:42	2026-09-11 16:29:42 +08:00
action	e964d3fab4	update 2026-09-11 10:36:18	2026-09-11 10:36:18 +08:00
action	7a1c066f8e	update 2026-09-11 06:12:18	2026-09-11 06:12:18 +08:00
action	7f998ecef4	update 2026-09-11 02:53:12	2026-09-11 02:53:12 +08:00
action	eb846719e6	update 2026-09-10 23:42:03	2026-09-10 23:42:03 +08:00
action	11dbae0135	update 2026-09-10 16:35:06	2026-09-10 16:35:06 +08:00
action	52a65b099b	update 2026-09-10 10:43:10	2026-09-10 10:43:10 +08:00
action	eda104d43a	update 2026-09-10 06:10:14	2026-09-10 06:10:14 +08:00
action	be31648233	update 2026-09-10 03:01:51	2026-09-10 03:01:51 +08:00
action	542084a121	update 2026-09-09 23:46:59	2026-09-09 23:47:00 +08:00
action	fe313e7d23	update 2026-09-09 16:33:06	2026-09-09 16:33:06 +08:00
action	09f0910b78	update 2026-09-09 03:12:17	2026-09-09 03:12:17 +08:00
action	8778465a55	update 2026-09-08 23:51:28	2026-09-08 23:51:28 +08:00
action	b81fb0f1c5	update 2026-09-08 16:30:31	2026-09-08 16:30:31 +08:00
action	f12aa6537d	update 2026-09-08 10:40:39	2026-09-08 10:40:39 +08:00
action	9e7a5c5caf	update 2026-09-08 06:27:12	2026-09-08 06:27:12 +08:00
action	28c0067490	update 2026-09-08 01:05:17	2026-09-08 01:05:17 +08:00
action	2ff8b68fd7	update 2026-09-07 16:50:29	2026-09-07 16:50:29 +08:00
action	e7e55d191d	update 2026-09-07 10:27:50	2026-09-07 10:27:50 +08:00
action	344aea7ec2	update 2026-09-07 05:54:25	2026-09-07 05:54:25 +08:00
action	4a4dfac1a2	update 2026-09-07 01:57:13	2026-09-07 01:57:13 +08:00