From 1e824c988038d35b42e1f224f1f95242fe814c38 Mon Sep 17 00:00:00 2001
From: CN_SZTL <cnsztl@project-openwrt.eu.org>
Date: Fri, 13 Mar 2020 04:27:07 +0800
Subject: [PATCH] OpenClash: sync with upstream source

---
 .../files/etc/config/openclash                |   3 +
 .../files/etc/init.d/openclash                |  47 +++++++-
 .../custom/openclash_custom_rules_2.list      |   8 ++
 .../files/etc/openclash/lhie1.yaml            |  26 +++--
 .../lua/luci/model/cbi/openclash/settings.lua | 110 ++++++++++++++++--
 .../usr/share/openclash/clash_version.sh      |   7 +-
 .../usr/share/openclash/openclash_core.sh     |   7 +-
 .../share/openclash/openclash_game_rule.sh    |   5 +-
 .../usr/share/openclash/openclash_rule.sh     |   9 +-
 .../usr/share/openclash/openclash_update.sh   |   5 +-
 .../usr/share/openclash/openclash_version.sh  |   6 +-
 .../usr/share/openclash/yml_proxys_set.sh     |  16 +++
 .../usr/share/openclash/yml_rules_change.sh   |  39 ++++++-
 .../i18n/zh_Hans/openclash.zh-cn.po           |  53 ++++++++-
 14 files changed, 302 insertions(+), 39 deletions(-)
 create mode 100644 package/ctcgfw/luci-app-openclash/files/etc/openclash/custom/openclash_custom_rules_2.list

diff --git a/package/ctcgfw/luci-app-openclash/files/etc/config/openclash b/package/ctcgfw/luci-app-openclash/files/etc/config/openclash
index 639b41cdbf..d7d32facb7 100644
--- a/package/ctcgfw/luci-app-openclash/files/etc/config/openclash
+++ b/package/ctcgfw/luci-app-openclash/files/etc/config/openclash
@@ -24,6 +24,9 @@ config openclash 'config'
 	option proxy_mode 'Rule'
 	option intranet_allowed '0'
 	option enable_udp_proxy '0'
+	option lan_ac_mode '0'
+	option operation_mode 'redir-host'
+	option enable_rule_proxy '0'
 	
 config dns_servers
 	option group 'nameserver'
diff --git a/package/ctcgfw/luci-app-openclash/files/etc/init.d/openclash b/package/ctcgfw/luci-app-openclash/files/etc/init.d/openclash
index 9e829676e4..31b3dc5329 100755
--- a/package/ctcgfw/luci-app-openclash/files/etc/init.d/openclash
+++ b/package/ctcgfw/luci-app-openclash/files/etc/init.d/openclash
@@ -513,11 +513,13 @@ yml_auth_custom()
       sed -i '/^dns:/i\#authentication' "$1" 2>/dev/null
       sed -i '/^authentication:/,/^#authentication/d' "$1" 2>/dev/null
    fi
-   [ -f /etc/openclash/config.auth ] && {
+   if [ -f /etc/openclash/config.auth ]; then
       sed -i '/^dns:/i\authentication:' "$1" 2>/dev/null
       sed -i '/^authentication:/r/etc/openclash/config.auth' "$1" 2>/dev/null
-      rm -rf /etc/openclash/config.auth 2>/dev/null
-   }
+      mv /etc/openclash/config.auth /tmp/openclash.auth 2>/dev/null
+   else
+      rm -rf /tmp/openclash.auth 2>/dev/null
+   fi
 }
 
 get_rule_file()
@@ -627,6 +629,16 @@ elif [ -f "/tmp/yaml_servers.yaml" ]; then
 fi
 }
 
+lan_ac()
+{
+	if [ -z "$1" ]; then
+      return
+  fi
+  
+  ipset add "$2" "$1" 2>/dev/null
+  
+}
+
 start()
 {
 #禁止多个实例
@@ -704,6 +716,9 @@ if [ "$enable" -eq 1 ] && [ -f "$CONFIG_FILE" ]; then
     proxy_mode=$(uci get openclash.config.proxy_mode 2>/dev/null)
     intranet_allowed=$(uci get openclash.config.intranet_allowed 2>/dev/null)
     enable_udp_proxy=$(uci get openclash.config.enable_udp_proxy 2>/dev/null)
+    operation_mode=$(uci get openclash.config.operation_mode 2>/dev/null)
+    lan_ac_mode=$(uci get openclash.config.lan_ac_mode 2>/dev/null)
+    enable_rule_proxy=$(uci get openclash.config.enable_rule_proxy 2>/dev/null)
 
     echo "第二步: 配置文件检查..." >$START_LOG
     yml_check "$en_mode" "$enable_custom_dns" "$CONFIG_FILE" "$BACKUP_FILE" "$START_BACKUP"
@@ -725,7 +740,7 @@ if [ "$enable" -eq 1 ] && [ -f "$CONFIG_FILE" ]; then
           yml_cut "$CHANGE_FILE" "$RULE_FILE" "$DNS_FILE" "$CONFIG_FILE" "$PROXY_FILE" "$PROXY_PROVIDER_FILE" "$GROUP_FILE"
           yml_dns_custom "$enable_custom_dns" "$DNS_FILE"
           sh /usr/share/openclash/yml_change.sh >/dev/null 2>&1 "$LOGTIME" "$en_mode" "$enable_custom_dns" "$da_password" "$cn_port" "$proxy_port" "$CHANGE_FILE" "$ipv6_enable" "$http_port" "$socks_port" "$lan_ip" "$log_level" "$proxy_mode" "$intranet_allowed" "$en_mode_tun" &
-          sh /usr/share/openclash/yml_rules_change.sh >/dev/null 2>&1 "$LOGTIME" "$rule_source" "$enable_custom_clash_rules" "$RULE_FILE" "$set_rule_file" "$en_mode" &
+          sh /usr/share/openclash/yml_rules_change.sh >/dev/null 2>&1 "$LOGTIME" "$rule_source" "$enable_custom_clash_rules" "$RULE_FILE" "$set_rule_file" "$en_mode" "$enable_rule_proxy" &
           wait
           yml_game_custom
           echo "第四步: DNS设置检查..." >$START_LOG
@@ -769,10 +784,25 @@ mkdir -p /var/etc
 cat > "/var/etc/openclash.include" <<-EOF
 /etc/init.d/openclash restart
 EOF
+             #lan_ac
+             if [ "$operation_mode" = "redir-host" ] && [ "$en_mode" = "redir-host" ]; then
+                if [ "$lan_ac_mode" = "0" ] && [ ! -z "$(uci get openclash.config.lan_ac_black_ips 2>/dev/null)" ]; then
+                   ipset create lan_ac_black_ips hash:net
+                   config_load "openclash"
+                   config_list_foreach "config" "lan_ac_black_ips" lan_ac "lan_ac_black_ips"
+                elif [ "$lan_ac_mode" = "1" ] && [ ! -z "$(uci get openclash.config.lan_ac_white_ips 2>/dev/null)" ]; then
+                   ipset create lan_ac_white_ips hash:net
+                   config_load "openclash"
+                   config_list_foreach "config" "lan_ac_white_ips" lan_ac "lan_ac_white_ips"
+                fi
+             fi
+             
              if [ -z "$en_mode_tun" ]; then
              	
              	  #tcp
                 iptables -t nat -N openclash
+                iptables -t nat -A openclash -m set --match-set lan_ac_black_ips src -j RETURN >/dev/null 2>&1
+                iptables -t nat -A openclash -m set ! --match-set lan_ac_white_ips src -j RETURN >/dev/null 2>&1
                 iptables -t nat -A openclash -d 0.0.0.0/8 -j RETURN
                 iptables -t nat -A openclash -d 10.0.0.0/8 -j RETURN
                 iptables -t nat -A openclash -d 127.0.0.0/8 -j RETURN
@@ -796,6 +826,8 @@ EOF
                 ip rule add fwmark 1 table 100
                 ip route add local default dev lo table 100
                 iptables -t mangle -N openclash
+                iptables -t mangle -A openclash -m set --match-set lan_ac_black_ips src -j RETURN >/dev/null 2>&1
+                iptables -t mangle -A openclash -m set ! --match-set lan_ac_white_ips src -j RETURN >/dev/null 2>&1
                 iptables -t mangle -A openclash -d 0.0.0.0/8 -j RETURN
                 iptables -t mangle -A openclash -d 10.0.0.0/8 -j RETURN
                 iptables -t mangle -A openclash -d 127.0.0.0/8 -j RETURN
@@ -884,6 +916,8 @@ EOF
                    iptables -t mangle -A openclash -d 198.18.0.0/16 -j MARK --set-mark "$PROXY_FWMARK"
                 fi
                 iptables -t mangle -I OUTPUT -j openclash
+                iptables -t mangle -I PREROUTING -m set --match-set lan_ac_black_ips src -j RETURN >/dev/null 2>&1
+                iptables -t mangle -I PREROUTING -m set ! --match-set lan_ac_white_ips src -j RETURN >/dev/null 2>&1
                 iptables -t mangle -I PREROUTING -m set ! --match-set localnetwork dst -j MARK --set-mark "$PROXY_FWMARK"
                 iptables -t nat -I PREROUTING -p tcp --dport 53 -j ACCEPT
              #ipv6
@@ -1010,6 +1044,9 @@ stop()
     iptables -t nat -D PREROUTING -p tcp -j openclash >/dev/null 2>&1
     iptables -t nat -X openclash >/dev/null 2>&1
     
+    ipset destroy lan_ac_white_ips >/dev/null 2>&1
+    ipset destroy lan_ac_black_ips >/dev/null 2>&1
+    
     out_lines=$(iptables -nvL OUTPUT -t mangle |sed 1,2d |sed -n '/198.18.0.0\/16/=' 2>/dev/null |sort -rn)
     for out_line in $out_lines; do
         iptables -t mangle -D OUTPUT "$out_line" >/dev/null 2>&1
@@ -1042,6 +1079,8 @@ stop()
     ip rule del fwmark "$PROXY_FWMARK" table "$PROXY_ROUTE_TABLE" >/dev/null 2>&1
 
     iptables -t mangle -D OUTPUT -j openclash >/dev/null 2>&1
+    iptables -t mangle -D PREROUTING -m set --match-set lan_ac_black_ips src -j RETURN >/dev/null 2>&1
+    iptables -t mangle -D PREROUTING -m set ! --match-set lan_ac_white_ips src -j RETURN >/dev/null 2>&1
     iptables -t mangle -D PREROUTING -m set ! --match-set localnetwork dst -j MARK --set-mark "$PROXY_FWMARK" >/dev/null 2>&1
     ip6tables -t mangle -D PREROUTING -j MARK --set-mark "$PROXY_FWMARK" >/dev/null 2>&1
     iptables -t mangle -F openclash >/dev/null 2>&1
diff --git a/package/ctcgfw/luci-app-openclash/files/etc/openclash/custom/openclash_custom_rules_2.list b/package/ctcgfw/luci-app-openclash/files/etc/openclash/custom/openclash_custom_rules_2.list
new file mode 100644
index 0000000000..371e38b5c6
--- /dev/null
+++ b/package/ctcgfw/luci-app-openclash/files/etc/openclash/custom/openclash_custom_rules_2.list
@@ -0,0 +1,8 @@
+##- DOMAIN-SUFFIX,google.com,Proxy 匹配域名后缀(交由Proxy代理服务器组)
+##- DOMAIN-KEYWORD,google,Proxy 匹配域名关键字(交由Proxy代理服务器组)
+##- DOMAIN,google.com,Proxy 匹配域名(交由Proxy代理服务器组)
+##- DOMAIN-SUFFIX,ad.com,REJECT 匹配域名后缀(拒绝)
+##- IP-CIDR,127.0.0.0/8,DIRECT 匹配数据目标IP(直连)
+##- SRC-IP-CIDR,192.168.1.201/32,DIRECT 匹配数据发起IP(直连)
+##- DST-PORT,80,DIRECT 匹配数据目标端口(直连)
+##- SRC-PORT,7777,DIRECT 匹配数据源端口(直连)
diff --git a/package/ctcgfw/luci-app-openclash/files/etc/openclash/lhie1.yaml b/package/ctcgfw/luci-app-openclash/files/etc/openclash/lhie1.yaml
index fcded61309..2483983e88 100644
--- a/package/ctcgfw/luci-app-openclash/files/etc/openclash/lhie1.yaml
+++ b/package/ctcgfw/luci-app-openclash/files/etc/openclash/lhie1.yaml
@@ -8668,7 +8668,15 @@ Rule:
 
 
 
-# > NeteaseMusic
+# > PayPal
+# - USER-AGENT,PayPal*,PayPal
+- DOMAIN-KEYWORD,paypal,PayPal
+- DOMAIN-SUFFIX,paypal.com,PayPal
+- DOMAIN-SUFFIX,paypalobjects.com,PayPal
+
+
+
+# > Netease Music
 # - USER-AGENT,%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90,Netease Music
 # - USER-AGENT,NeteaseMusic*,Netease Music
 - DOMAIN-SUFFIX,music.126.net,Netease Music
@@ -8741,6 +8749,13 @@ Rule:
 - DOMAIN-SUFFIX,office.net,Proxy
 - DOMAIN-SUFFIX,skype.com,Proxy
 
+# > Sony
+- DOMAIN-SUFFIX,playstation.com,Proxy
+- DOMAIN-SUFFIX,playstation.net,Proxy
+- DOMAIN-SUFFIX,playstationnetwork.com,Proxy
+- DOMAIN-SUFFIX,sony.com,Proxy
+- DOMAIN-SUFFIX,sonyentertainmentnetwork.com,Proxy
+
 # > Spark
 - DOMAIN-SUFFIX,api.amplitude.com,Proxy
 - DOMAIN-SUFFIX,app.smartmailcloud.com,Proxy
@@ -9488,13 +9503,6 @@ Rule:
 - DOMAIN-SUFFIX,alphassl.com,Domestic
 - DOMAIN-SUFFIX,edu.cn,Domestic
 
-# > Sony
-- DOMAIN-SUFFIX,playstation.com,Domestic
-- DOMAIN-SUFFIX,playstation.net,Domestic
-- DOMAIN-SUFFIX,playstationnetwork.com,Domestic
-- DOMAIN-SUFFIX,sony.com,Domestic
-- DOMAIN-SUFFIX,sonyentertainmentnetwork.com,Domestic
-
 # > TeamViewer
 - IP-CIDR,185.188.32.0/24,Domestic
 - IP-CIDR,185.188.33.0/24,Domestic
@@ -9648,8 +9656,6 @@ Rule:
 - DOMAIN-SUFFIX,ourbits.club,Domestic
 - DOMAIN-SUFFIX,ourdvs.com,Domestic
 - DOMAIN-SUFFIX,passthepopcorn.me,Domestic
-- DOMAIN-SUFFIX,paypal.com,Domestic
-- DOMAIN-SUFFIX,paypalobjects.com,Domestic
 - DOMAIN-SUFFIX,pgyer.com,Domestic
 - DOMAIN-SUFFIX,pniao.com,Domestic
 - DOMAIN-SUFFIX,privatehd.to,Domestic
diff --git a/package/ctcgfw/luci-app-openclash/files/usr/lib/lua/luci/model/cbi/openclash/settings.lua b/package/ctcgfw/luci-app-openclash/files/usr/lib/lua/luci/model/cbi/openclash/settings.lua
index 8ccde05761..34534b0ba3 100644
--- a/package/ctcgfw/luci-app-openclash/files/usr/lib/lua/luci/model/cbi/openclash/settings.lua
+++ b/package/ctcgfw/luci-app-openclash/files/usr/lib/lua/luci/model/cbi/openclash/settings.lua
@@ -12,19 +12,57 @@ font_off = [[</font>]]
 bold_on  = [[<strong>]]
 bold_off = [[</strong>]]
 
+local op_mode = string.sub(luci.sys.exec('uci get openclash.config.operation_mode 2>/dev/null'),0,-2)
+if not op_mode then op_mode = "redir-host" end
+
 m = Map("openclash", translate("Global Settings(Will Modify The Config File Or Subscribe According To The Settings On This Page)"))
 m.pageaction = false
 s = m:section(TypedSection, "openclash")
 s.anonymous = true
 
+s:tab("op_mode", translate("Operation Mode"))
 s:tab("settings", translate("General Settings"))
 s:tab("dns", translate("DNS Setting"))
+s:tab("lan_ac", translate("Access Control"))
+if op_mode == "fake-ip" then
+s:tab("rules", translate("Rules Setting(Access Control)"))
+else
 s:tab("rules", translate("Rules Setting"))
+end
 s:tab("dashboard", translate("Dashboard Settings"))
 s:tab("rules_update", translate("Rules Update"))
 s:tab("geo_update", translate("GEOIP Update"))
 s:tab("version_update", translate("Version Update"))
 
+---- Operation Mode
+o = s:taboption("op_mode", ListValue, "operation_mode", font_red..bold_on..translate("Select Operation Mode")..bold_off..font_off)
+o:value("redir-host", translate("redir-host mode"))
+o:value("fake-ip", translate("fake-ip mode"))
+o.default = "redir-host"
+
+o = s:taboption("op_mode", ListValue, "en_mode", font_red..bold_on..translate("Select Mode")..bold_off..font_off)
+o.description = translate("Select Mode For OpenClash Work, Try Flush DNS Cache If Network Error")
+if op_mode == "redir-host" then
+o:value("redir-host", translate("redir-host"))
+o:value("redir-host-tun", translate("redir-host(tun mode)"))
+o:value("redir-host-vpn", translate("redir-host-vpn(game mode)"))
+o.default = "redir-host"
+else
+o:value("fake-ip", translate("fake-ip"))
+o:value("fake-ip-tun", translate("fake-ip(tun mode)"))
+o:value("fake-ip-vpn", translate("fake-ip-vpn(game mode)"))
+o.default = "fake-ip"
+end
+
+o = s:taboption("op_mode", Button, translate("Switch Operation Mode")) 
+o.title = translate("Switch Operation Mode")
+o.inputtitle = translate("Switch Mode")
+o.inputstyle = "reload"
+o.write = function()
+	m.uci:commit("openclash")
+  HTTP.redirect(DISP.build_url("admin", "services", "openclash", "settings"))
+end
+
 ---- General Settings
 local cpu_model=SYS.exec("opkg status libc 2>/dev/null |grep 'Architecture' |awk -F ': ' '{print $2}' 2>/dev/null")
 o = s:taboption("settings", ListValue, "core_version", font_red..bold_on..translate("Chose to Download")..bold_off..font_off)
@@ -44,16 +82,6 @@ o:value("linux-mipsle-hardfloat")
 o:value("0", translate("Not Set"))
 o.default=0
 
-o = s:taboption("settings", ListValue, "en_mode", font_red..bold_on..translate("Select Mode")..bold_off..font_off)
-o.description = translate("Select Mode For OpenClash Work, Try Flush DNS Cache If Network Error")
-o:value("redir-host", translate("redir-host"))
-o:value("fake-ip", translate("fake-ip"))
-o:value("redir-host-tun", translate("redir-host(tun mode)"))
-o:value("fake-ip-tun", translate("fake-ip(tun mode)"))
-o:value("redir-host-vpn", translate("redir-host-vpn(game mode)"))
-o:value("fake-ip-vpn", translate("fake-ip-vpn(game mode)"))
-o.default = "redir-host"
-
 o = s:taboption("settings", ListValue, "enable_udp_proxy", font_red..bold_on..translate("Proxy UDP Traffics")..bold_off..font_off)
 o.description = translate("Select Mode For UDP Traffics, The Servers Must Support UDP while Choose Proxy")
 o:depends("en_mode", "redir-host")
@@ -62,6 +90,12 @@ o:value("0", translate("Disable"))
 o:value("1", translate("Enable"))
 o.default = "0"
 
+o = s:taboption("settings", ListValue, "enable_rule_proxy", font_red..bold_on..translate("Rule Match Proxy Mode")..bold_off..font_off)
+o.description = translate("Only Proxy Rules Match, Prevent BT Passing")
+o:value("0", translate("Disable"))
+o:value("1", translate("Enable"))
+o.default=0
+
 o = s:taboption("settings", ListValue, "proxy_mode", font_red..bold_on..translate("Proxy Mode")..bold_off..font_off)
 o.description = translate("Select Proxy Mode")
 o:value("Rule", translate("Rule Proxy Mode"))
@@ -130,6 +164,7 @@ o:value("0", translate("Disable"))
 o:value("1", translate("Enable"))
 o.default=0
 
+if op_mode == "fake-ip" then
 o = s:taboption("dns", ListValue, "dns_advanced_setting", translate("Advanced Setting"))
 o.description = translate("DNS Advanced Settings")..font_red..bold_on..translate("(Please Don't Modify it at Will)")..bold_off..font_off
 o:value("0", translate("Disable"))
@@ -171,9 +206,40 @@ function custom_fake_black.write(self, section, value)
 		NXFS.writefile("/etc/openclash/custom/openclash_custom_fake_black.conf", value)
 	end
 end
+end
+
+---- Access Control
+if op_mode == "redir-host" then
+o = s:taboption("lan_ac", ListValue, "lan_ac_mode", translate("Access Control Mode"))
+o:value("0", translate("Black List Mode"))
+o:value("1", translate("White List Mode"))
+o.default=0
+
+o = s:taboption("lan_ac", DynamicList, "lan_ac_black_ips", translate("LAN Bypassed Host List"))
+o:depends("lan_ac_mode", "0")
+o.datatype = "ipaddr"
+luci.ip.neighbors({ family = 4 }, function(entry)
+		if entry.reachable then
+			o:value(entry.dest:string())
+		end
+end)
+
+o = s:taboption("lan_ac", DynamicList, "lan_ac_white_ips", translate("LAN Proxied Host List"))
+o:depends("lan_ac_mode", "1")
+o.datatype = "ipaddr"
+luci.ip.neighbors({ family = 4 }, function(entry)
+		if entry.reachable then
+			o:value(entry.dest:string())
+		end
+end)
+end
 
 ---- Rules Settings
+if op_mode == "fake-ip" then
+o = s:taboption("rules", ListValue, "enable_custom_clash_rules", font_red..bold_on..translate("Custom Clash Rules(Access Control)")..bold_off..font_off)
+else
 o = s:taboption("rules", ListValue, "enable_custom_clash_rules", font_red..bold_on..translate("Custom Clash Rules")..bold_off..font_off)
+end
 o.description = translate("Use Custom Rules")
 o:value("0", translate("Disable"))
 o:value("1", translate("Enable"))
@@ -243,6 +309,12 @@ o:depends("rule_source", "lhie1")
    end
    file:seek("set")
 o = s:taboption("rules", ListValue, "Telegram", translate("Telegram"))
+o:depends("rule_source", "lhie1")
+ for l in file:lines() do
+   o:value(l)
+   end
+   file:seek("set")
+o = s:taboption("rules", ListValue, "PayPal", translate("PayPal"))
 o:depends("rule_source", "lhie1")
  for l in file:lines() do
    o:value(l)
@@ -459,6 +531,23 @@ function custom_rules.write(self, section, value)
 	end
 end
 
+custom_rules_2 = s:option(Value, "custom_rules_2")
+custom_rules_2.template = "cbi/tvalue"
+custom_rules_2.description = translate("Custom Rules 2 Here, For More Go Github:https://github.com/Dreamacro/clash/blob/master/README.md, IP To CIDR: http://ip2cidr.com")
+custom_rules_2.rows = 20
+custom_rules_2.wrap = "off"
+
+function custom_rules_2.cfgvalue(self, section)
+	return NXFS.readfile("/etc/openclash/custom/openclash_custom_rules_2.list") or ""
+end
+function custom_rules_2.write(self, section, value)
+	if value then
+		value = value:gsub("\r\n?", "\n")
+		NXFS.writefile("/etc/openclash/custom/openclash_custom_rules_2.list", value)
+	end
+end
+
+if op_mode == "redir-host" then
 s = m:section(TypedSection, "openclash", translate("Set Custom Hosts, Only Work with Redir-Host Mode"))
 s.anonymous = true
 
@@ -477,6 +566,7 @@ function custom_hosts.write(self, section, value)
 		NXFS.writefile("/etc/openclash/custom/openclash_custom_hosts.list", value)
 	end
 end
+end
 
 local t = {
     {Commit, Apply}
diff --git a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/clash_version.sh b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/clash_version.sh
index 725b6b22fe..28d888a7bb 100755
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/clash_version.sh
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/clash_version.sh
@@ -6,10 +6,15 @@ CLASH_VERF=$(/etc/openclash/clash -v 2>/dev/null)
 CLASH_VER=$(echo "$CLASH_VERF" 2>/dev/null |awk -F ' ' '{print $2}' 2>/dev/null |awk -F '-' '{print $1$2}' 2>/dev/null |awk -F '.' '{print $2$3}' 2>/dev/null)
 HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
 PROXY_ADDR="127.0.0.1"
+
+if [ -s "/tmp/openclash.auth" ]; then
+   PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
+fi
+
 VERSION_URL="https://raw.githubusercontent.com/vernesong/OpenClash/master/core_version"
 if [ "$CKTIME" != "$(grep "CheckTime" $LAST_OPVER 2>/dev/null |awk -F ':' '{print $2}')" ]; then
 	 if pidof clash >/dev/null; then
-      curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT "$VERSION_URL" -o $LAST_OPVER >/dev/null 2>&1
+      curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" "$VERSION_URL" -o $LAST_OPVER >/dev/null 2>&1
    else
       curl -sL --connect-timeout 10 --retry 2 "$VERSION_URL" -o $LAST_OPVER >/dev/null 2>&1
    fi
diff --git a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_core.sh b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_core.sh
index 174b4c30c0..c6d11628c3 100755
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_core.sh
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_core.sh
@@ -9,12 +9,15 @@ LOG_FILE="/tmp/openclash.log"
 CPU_MODEL=$(uci get openclash.config.core_version 2>/dev/null)
 HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
 PROXY_ADDR="127.0.0.1"
-   
+if [ -s "/tmp/openclash.auth" ]; then
+   PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
+fi
+
 if [ "$(/etc/openclash/clash -v 2>/dev/null |awk -F ' ' '{print $2}')" != "$(sed -n 1p /tmp/clash_last_version 2>/dev/null)" ] || [ -z "$(/etc/openclash/clash -v 2>/dev/null |awk -F ' ' '{print $2}')" ] || [ ! -f /etc/openclash/clash ]; then
    if [ "$CPU_MODEL" != 0 ]; then
    echo "开始下载 OpenClash 内核..." >$START_LOG
    if pidof clash >/dev/null; then
-      curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT https://github.com/vernesong/OpenClash/releases/download/Clash/clash-"$CPU_MODEL".tar.gz -o /tmp/clash.tar.gz >/dev/null 2>&1
+      curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://github.com/vernesong/OpenClash/releases/download/Clash/clash-"$CPU_MODEL".tar.gz -o /tmp/clash.tar.gz >/dev/null 2>&1
    else
       curl -sL --connect-timeout 10 --retry 2 https://github.com/vernesong/OpenClash/releases/download/Clash/clash-"$CPU_MODEL".tar.gz -o /tmp/clash.tar.gz >/dev/null 2>&1
    fi
diff --git a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_game_rule.sh b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_game_rule.sh
index b2d4bc069f..d0d53f4fe3 100755
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_game_rule.sh
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_game_rule.sh
@@ -12,8 +12,11 @@
    LOG_FILE="/tmp/openclash.log"
    HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
    PROXY_ADDR="127.0.0.1"
+   if [ -s "/tmp/openclash.auth" ]; then
+      PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
+   fi
    if pidof clash >/dev/null; then
-   	  curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT https://raw.githubusercontent.com/FQrabbit/SSTap-Rule/master/rules/"$DOWNLOAD_PATH" -o "$TMP_RULE_DIR" >/dev/null 2>&1
+   	  curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://raw.githubusercontent.com/FQrabbit/SSTap-Rule/master/rules/"$DOWNLOAD_PATH" -o "$TMP_RULE_DIR" >/dev/null 2>&1
    else
       curl -sL --connect-timeout 10 --retry 2 https://raw.githubusercontent.com/FQrabbit/SSTap-Rule/master/rules/"$DOWNLOAD_PATH" -o "$TMP_RULE_DIR" >/dev/null 2>&1
    fi
diff --git a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_rule.sh b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_rule.sh
index 10f3010dbd..1dea76188a 100755
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_rule.sh
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_rule.sh
@@ -6,24 +6,27 @@
    RUlE_SOURCE=$(uci get openclash.config.rule_source 2>/dev/null)
    HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
    PROXY_ADDR="127.0.0.1"
+   if [ -s "/tmp/openclash.auth" ]; then
+	    PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
+   fi
    echo "开始下载使用中的第三方规则..." >$START_LOG
       if [ "$RUlE_SOURCE" = "lhie1" ]; then
       	 if pidof clash >/dev/null; then
-            curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT https://raw.githubusercontent.com/lhie1/Rules/master/Clash/Rule.yaml -o /tmp/rules.yaml >/dev/null 2>&1
+            curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://raw.githubusercontent.com/lhie1/Rules/master/Clash/Rule.yaml -o /tmp/rules.yaml >/dev/null 2>&1
       	 else
             curl -sL --connect-timeout 10 --retry 2 https://raw.githubusercontent.com/lhie1/Rules/master/Clash/Rule.yaml -o /tmp/rules.yaml >/dev/null 2>&1
          fi
          sed -i '1i Rule:' /tmp/rules.yaml
       elif [ "$RUlE_SOURCE" = "ConnersHua" ]; then
       	 if pidof clash >/dev/null; then
-            curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT https://raw.githubusercontent.com/ConnersHua/Profiles/master/Clash/Pro.yaml -o /tmp/rules.yaml >/dev/null 2>&1
+            curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://raw.githubusercontent.com/ConnersHua/Profiles/master/Clash/Pro.yaml -o /tmp/rules.yaml >/dev/null 2>&1
       	 else
             curl -sL --connect-timeout 10 --retry 2 https://raw.githubusercontent.com/ConnersHua/Profiles/master/Clash/Pro.yaml -o /tmp/rules.yaml >/dev/null 2>&1
          fi
          sed -i "/^rules:/c\^Rule:" /tmp/rules.yaml 2>/dev/null && sed -i -n '/^Rule:/,$p' /tmp/rules.yaml 2>/dev/null
       elif [ "$RUlE_SOURCE" = "ConnersHua_return" ]; then
       	 if pidof clash >/dev/null; then
-            curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT https://raw.githubusercontent.com/ConnersHua/Profiles/master/Clash/BacktoCN.yaml -o /tmp/rules.yaml >/dev/null 2>&1
+            curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://raw.githubusercontent.com/ConnersHua/Profiles/master/Clash/BacktoCN.yaml -o /tmp/rules.yaml >/dev/null 2>&1
       	 else
             curl -sL --connect-timeout 10 --retry 2 https://raw.githubusercontent.com/ConnersHua/Profiles/master/Clash/BacktoCN.yaml -o /tmp/rules.yaml >/dev/null 2>&1
          fi
diff --git a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_update.sh b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_update.sh
index 7379cdbe61..d07e9205e0 100755
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_update.sh
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_update.sh
@@ -10,11 +10,14 @@ LAST_OPVER="/tmp/openclash_last_version"
 LAST_VER=$(sed -n 1p "$LAST_OPVER" 2>/dev/null |sed "s/^v//g")
 HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
 PROXY_ADDR="127.0.0.1"
+if [ -s "/tmp/openclash.auth" ]; then
+   PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
+fi
 
 if [ "$(sed -n 1p /etc/openclash/openclash_version 2>/dev/null)" != "$(sed -n 1p $LAST_OPVER 2>/dev/null)" ] && [ -f "$LAST_OPVER" ]; then
    echo "开始下载 OpenClash-$LAST_VER ..." >$START_LOG
    if pidof clash >/dev/null; then
-      curl -sL --connect-timeout 10 --retry 5 -x http://$PROXY_ADDR:$HTTP_PORT https://github.com/vernesong/OpenClash/releases/download/v"$LAST_VER"/luci-app-openclash_"$LAST_VER"_all.ipk -o /tmp/openclash.ipk >/dev/null 2>&1
+      curl -sL --connect-timeout 10 --retry 5 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://github.com/vernesong/OpenClash/releases/download/v"$LAST_VER"/luci-app-openclash_"$LAST_VER"_all.ipk -o /tmp/openclash.ipk >/dev/null 2>&1
    else
       curl -sL --connect-timeout 10 --retry 5 https://github.com/vernesong/OpenClash/releases/download/v"$LAST_VER"/luci-app-openclash_"$LAST_VER"_all.ipk -o /tmp/openclash.ipk >/dev/null 2>&1
    fi
diff --git a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_version.sh b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_version.sh
index 91302f7d2c..9fbd7f8181 100755
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_version.sh
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_version.sh
@@ -3,10 +3,14 @@ CKTIME=$(date "+%Y-%m-%d-%H")
 LAST_OPVER="/tmp/openclash_last_version"
 HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
 PROXY_ADDR="127.0.0.1"
+if [ -s "/tmp/openclash.auth" ]; then
+   PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
+fi
+
 VERSION_URL="https://raw.githubusercontent.com/vernesong/OpenClash/master/version"
 if [ "$CKTIME" != "$(grep "CheckTime" $LAST_OPVER 2>/dev/null |awk -F ':' '{print $2}')" ]; then
    if pidof clash >/dev/null; then
-      curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT "$VERSION_URL" -o $LAST_OPVER >/dev/null 2>&1
+      curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" "$VERSION_URL" -o $LAST_OPVER >/dev/null 2>&1
    else
       curl -sL --connect-timeout 10 --retry 2 "$VERSION_URL" -o $LAST_OPVER >/dev/null 2>&1
    fi
diff --git a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_proxys_set.sh b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_proxys_set.sh
index 7eb6e81408..402c06334d 100755
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_proxys_set.sh
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_proxys_set.sh
@@ -578,6 +578,20 @@ EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
+- name: PayPal
+  type: select
+  proxies:
+  - DIRECT
+  - Proxy
+EOF
+cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
+if [ -f "/tmp/Proxy_Provider" ]; then
+cat >> "$SERVER_FILE" <<-EOF
+  use:
+EOF
+fi
+cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
+cat >> "$SERVER_FILE" <<-EOF
 - name: Netease Music
   type: select
   proxies:
@@ -603,6 +617,7 @@ uci set openclash.config.AdBlock="AdBlock"
 uci set openclash.config.Netease_Music="Netease Music"
 uci set openclash.config.Speedtest="Speedtest"
 uci set openclash.config.Telegram="Telegram"
+uci set openclash.config.PayPal="PayPal"
 uci set openclash.config.Domestic="Domestic"
 uci set openclash.config.Others="Others"
 [ "$config_auto_update" -eq 1 ] && {
@@ -616,6 +631,7 @@ uci set openclash.config.Others="Others"
 	uci add_list openclash.config.new_servers_group="Spotify"
 	uci add_list openclash.config.new_servers_group="Steam"
 	uci add_list openclash.config.new_servers_group="Telegram"
+	uci add_list openclash.config.new_servers_group="PayPal"
 	uci add_list openclash.config.new_servers_group="Speedtest"
 	uci add_list openclash.config.new_servers_group="Netease Music"
 }
diff --git a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_rules_change.sh b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_rules_change.sh
index 28ee1e21c1..b887115a5a 100755
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_rules_change.sh
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_rules_change.sh
@@ -33,6 +33,7 @@ if [ "$2" != 0 ]; then
     Netease_Music=$(grep '##Netease_Music:' "$4" |awk -F ':' '{print $2}')
     Speedtest=$(grep '##Speedtest:' "$4" |awk -F ':' '{print $2}')
     Telegram=$(grep '##Telegram:' "$4" |awk -F ':' '{print $2}')
+    PayPal=$(grep '##PayPal:' "$4" |awk -F ':' '{print $2}')
 
     if [ "$2" = "ConnersHua_return" ]; then
 	if [ "$(uci get openclash.config.Proxy)" != "$Proxy" ]\
@@ -61,6 +62,7 @@ if [ "$2" != 0 ]; then
 	 || [ "$(uci get openclash.config.Netease_Music)" != "$Netease_Music" ]\
 	 || [ "$(uci get openclash.config.Speedtest)" != "$Speedtest" ]\
    || [ "$(uci get openclash.config.Telegram)" != "$Telegram" ]\
+   || [ "$(uci get openclash.config.PayPal)" != "$PayPal" ]\
 	 || [ "$(uci get openclash.config.Others)" != "$Others" ]\
 	 || [ "$(uci get openclash.config.Domestic)" != "$Domestic" ]; then
          check_def=1
@@ -80,6 +82,7 @@ if [ "$2" != 0 ]; then
        Netease_Music=$(uci get openclash.config.Netease_Music 2>/dev/null)
        Speedtest=$(uci get openclash.config.Speedtest 2>/dev/null)
        Telegram=$(uci get openclash.config.Telegram 2>/dev/null)
+       PayPal=$(uci get openclash.config.PayPal 2>/dev/null)
        Domestic=$(uci get openclash.config.Domestic 2>/dev/null)
        Others=$(uci get openclash.config.Others 2>/dev/null)
        if [ "$2" = "lhie1" ]; then
@@ -96,6 +99,7 @@ if [ "$2" != 0 ]; then
             -e "s/,Netease Music/,${Netease_Music}#d/g" -e "/Rule:/a\##Netease_Music:${Netease_Music}"\
             -e "s/,Speedtest/,${Speedtest}#d/g" -e "/Rule:/a\##Speedtest:${Speedtest}"\
             -e "s/,Telegram/,${Telegram}#d/g" -e "/Rule:/a\##Telegram:${Telegram}"\
+            -e "s/,PayPal/,${PayPal}#d/g" -e "/Rule:/a\##PayPal:${PayPal}"\
             -e "s/,Domestic/,${Domestic}#d/g" -e "/Rule:/a\##Domestic:${Domestic}"\
             -e "s/,Others/,${Others}#d/g" -e "/Rule:/a\##Others:${Others}"\
             -e "s/#d//g" "$4"
@@ -132,16 +136,24 @@ elif [ "$2" = 0 ]; then
     	}
 fi
 
-      sed -i '/^##Custom Rules/,/^##Custom Rules End/d' "$4" 2>/dev/null
-      sed -i '/^##Custom Rules/d' "$4" 2>/dev/null
-      sed -i '/^##Custom Rules End/d' "$4" 2>/dev/null
+      sed -i '/^##Custom Rules##/,/^##Custom Rules End##/d' "$4" 2>/dev/null
+      sed -i '/^##Custom Rules##/d' "$4" 2>/dev/null
+      sed -i '/^##Custom Rules End##/d' "$4" 2>/dev/null
+      sed -i '/^##Custom Rules 2##/,/^##Custom Rules 2 End##/d' "$4" 2>/dev/null
+      sed -i '/^##Custom Rules 2##/d' "$4" 2>/dev/null
+      sed -i '/^##Custom Rules 2 End##/d' "$4" 2>/dev/null
+      sed -i '/- DOMAIN-KEYWORD,tracker,DIRECT/d' "$4" 2>/dev/null
+      
       if [ "$3" = 1 ]; then
          sed -i '/^Rule:/a\##Custom Rules End##' "$4" 2>/dev/null
          sed -i '/^Rule:/a\##Custom Rules##' "$4" 2>/dev/null
          sed -i '/^##Custom Rules##/r/etc/openclash/custom/openclash_custom_rules.list' "$4" 2>/dev/null
+         sed -i '/^ \{0,\}- MATCH,/i\##Custom Rules 2##' "$4" 2>/dev/null
+         sed -i '/^##Custom Rules 2##/a\##Custom Rules 2 End##' "$4" 2>/dev/null
+         sed -i '/^##Custom Rules 2##/r/etc/openclash/custom/openclash_custom_rules_2.list' "$4" 2>/dev/null
       fi
       
-      if [ "$5" = 1 ] || [ "$3" = 1 ] || [ -z "$(grep '- IP-CIDR,198.18.0.1/16,REJECT,no-resolve' "$4")" ]; then
+      if [ "$5" = 1 ] || [ "$3" = 1 ] || [ "$7" = 1 ] || [ -z "$(grep '- IP-CIDR,198.18.0.1/16,REJECT,no-resolve' "$4")" ]; then
          sed -i "s/^ \{0,\}-/-/" "$4" 2>/dev/null #修改参数空格
          sed -i "s/^\t\{0,\}-/-/" "$4" 2>/dev/null #修改参数tab
       fi
@@ -150,6 +162,23 @@ fi
          if [ ! -z "$(grep "^ \{0,\}- IP-CIDR,198.18.0.1/16" "$4")" ]; then
             sed -i "/^ \{0,\}- IP-CIDR,198.18.0.1\/16/c\- IP-CIDR,198.18.0.1\/16,REJECT,no-resolve" "$4"
          else
-            sed -i '1,/^ \{0,\}- GEOIP/{/^ \{0,\}- GEOIP/s/^ \{0,\}- GEOIP/- IP-CIDR,198.18.0.1\/16,REJECT,no-resolve\n&/}' "$4"
+            sed -i '1,/^ \{0,\}- GEOIP/{/^ \{0,\}- GEOIP/s/^ \{0,\}- GEOIP/- IP-CIDR,198.18.0.1\/16,REJECT,no-resolve\n&/}' "$4"\
+            || sed -i '1,/^ \{0,\}- MATCH/{/^ \{0,\}- MATCH/s/^ \{0,\}- MATCH/- IP-CIDR,198.18.0.1\/16,REJECT,no-resolve\n&/}' "$4"\
+            || sed -i '1,/^ \{0,\}- FINAL/{/^ \{0,\}- FINAL/s/^ \{0,\}- FINAL/- IP-CIDR,198.18.0.1\/16,REJECT,no-resolve\n&/}' "$4"
+         fi
+      fi
+      
+      if [ "$7" = 1 ]; then
+         sed -i '1,/^ \{0,\}- GEOIP/{/^ \{0,\}- GEOIP/s/^ \{0,\}- GEOIP/- DOMAIN-KEYWORD,tracker,DIRECT\n&/}' "$4"
+         if [ -z "$(grep "###- MATCH," "$4")" ] && [ -z "$(grep "###- FINAL," "$4")" ]; then
+            sed -i 's/- MATCH,/###&/' "$4" 2>/dev/null
+            sed -i 's/- FINAL,/###&/' "$4" 2>/dev/null
+            echo "- MATCH,DIRECT" >> "$4" 2>/dev/null
+         fi
+      else
+         if [ ! -z "$(grep "###- MATCH," "$4")" ] || [ ! -z "$(grep "###- FINAL," "$4")" ]; then
+            sed -i '/^- MATCH,DIRECT/d' "$4" 2>/dev/null
+            sed -i "s/###- MATCH,/- MATCH,/" "$4" 2>/dev/null
+            sed -i "s/###- FINAL,/- FINAL,/" "$4" 2>/dev/null
          fi
       fi
\ No newline at end of file
diff --git a/package/ctcgfw/luci-app-openclash/i18n/zh_Hans/openclash.zh-cn.po b/package/ctcgfw/luci-app-openclash/i18n/zh_Hans/openclash.zh-cn.po
index 9fdf5d0756..fd7323839f 100644
--- a/package/ctcgfw/luci-app-openclash/i18n/zh_Hans/openclash.zh-cn.po
+++ b/package/ctcgfw/luci-app-openclash/i18n/zh_Hans/openclash.zh-cn.po
@@ -235,6 +235,9 @@ msgstr ""
 "固件须配置好IPV6的NAT，如你不使用IPV6请关闭固件的相关服务，避免客户端连接出现异常"
 
 msgid "Rules Setting"
+msgstr "规则设置"
+
+msgid "Rules Setting(Access Control)"
 msgstr "规则设置（访问控制）"
 
 msgid "Config Manage"
@@ -443,10 +446,16 @@ msgid "Choose Proxy Group, Base On Your Servers Group in config.yaml"
 msgstr "指定流量(策略)的代理方式，只支持选择（服务器组），信息来源于您的配置文件"
 
 msgid "Custom Clash Rules"
+msgstr "自定义规则"
+
+msgid "Custom Clash Rules(Access Control)"
 msgstr "自定义规则(访问控制)"
 
 msgid "Custom Rules Here, For More Go Github:https://github.com/Dreamacro/clash/blob/master/README.md, IP To CIDR: http://ip2cidr.com"
-msgstr "设置自定义规则，详细信息请前往Github( https://github.com/Dreamacro/clash/blob/master/README.md )查询，在线IP段转CIDR地址：http://ip2cidr.com"
+msgstr "设置自定义规则（顶部），详细信息请前往Github( https://github.com/Dreamacro/clash/blob/master/README.md )查询，在线IP段转CIDR地址：http://ip2cidr.com"
+
+msgid "Custom Rules 2 Here, For More Go Github:https://github.com/Dreamacro/clash/blob/master/README.md, IP To CIDR: http://ip2cidr.com"
+msgstr "设置自定义规则（底部），详细信息请前往Github( https://github.com/Dreamacro/clash/blob/master/README.md )查询，在线IP段转CIDR地址：http://ip2cidr.com"
 
 msgid "Custom Hosts Here, For More Go Github:https://github.com/Dreamacro/clash/blob/master/README.md"
 msgstr "设置自定义Hosts，详细信息请前往Github( https://github.com/Dreamacro/clash/blob/master/README.md )查询"
@@ -785,3 +794,45 @@ msgstr "*代理UDP流量"
 
 msgid "Select Mode For UDP Traffics, The Servers Must Support UDP while Choose Proxy"
 msgstr "启用时服务器必须支持UDP转发"
+
+msgid "Operation Mode"
+msgstr "操作模式"
+
+msgid "Select Operation Mode"
+msgstr "*页面操作模式"
+
+msgid "redir-host mode"
+msgstr "Redir-Host 模式"
+
+msgid "fake-ip mode"
+msgstr "Fake-IP 模式"
+
+msgid "Switch Operation Mode"
+msgstr "切换操作模式"
+
+msgid "Switch Mode"
+msgstr "切换模式"
+
+msgid "Access Control"
+msgstr "访问控制"
+
+msgid "Access Control Mode"
+msgstr "访问控制模式"
+
+msgid "Black List Mode"
+msgstr "黑名单模式"
+
+msgid "White List Mode"
+msgstr "白名单模式"
+
+msgid "LAN Bypassed Host List"
+msgstr "不走代理的局域网LAN IP"
+
+msgid "LAN Proxied Host List"
+msgstr "走代理的局域网LAN IP"
+
+msgid "Rule Match Proxy Mode"
+msgstr "*仅代理命中规则流量"
+
+msgid "Only Proxy Rules Match, Prevent BT Passing"
+msgstr "仅允许代理命中规则的流量，防止BT下载流量经过代理"
\ No newline at end of file