diff --git a/package/lienol/luci-app-passwall/Makefile b/package/lienol/luci-app-passwall/Makefile
index 2d55f60dec..a4cb2f20d1 100644
--- a/package/lienol/luci-app-passwall/Makefile
+++ b/package/lienol/luci-app-passwall/Makefile
@@ -7,8 +7,8 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=3.6
-PKG_RELEASE:=32
-PKG_DATE:=20200326
+PKG_RELEASE:=33
+PKG_DATE:=20200403
 
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 
diff --git a/package/lienol/luci-app-passwall/luasrc/controller/passwall.lua b/package/lienol/luci-app-passwall/luasrc/controller/passwall.lua
index a0bffc6778..ef070663ce 100644
--- a/package/lienol/luci-app-passwall/luasrc/controller/passwall.lua
+++ b/package/lienol/luci-app-passwall/luasrc/controller/passwall.lua
@@ -172,7 +172,7 @@ function connect_status()
     local start_time = os.time()
     if luci.http.formvalue("type") == "google" then
         e.status = luci.sys.call(
-                       "echo $(/usr/share/passwall/test.sh test_url 'www.google.com') | grep 200 >/dev/null") ==
+                       "echo $(/usr/share/passwall/test.sh test_url 'www.google.com/generate_204') | grep 200 >/dev/null") ==
                        0
     else
         e.status = luci.sys.call(
diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
index ebdf74c676..148f8c78e3 100755
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
@@ -319,8 +319,10 @@ gen_start_config() {
 			local plugin=$(config_n_get $node ss_plugin)
 			if [ "$plugin" != "none" ]; then
 				[ "$plugin" == "v2ray-plugin" -o "$plugin" == "obfs-local" ] && {
+					local plugin_opts=""
 					local opts=$(config_n_get $node ss_plugin_opts)
-					plugin_params="--plugin $plugin --plugin-opts $opts"
+					[ -n "$opts" ] && plugin_opts="--plugin-opts $opts"
+					plugin_params="--plugin $plugin $plugin_opts"
 				}
 			fi
 			ln_start_bin $(find_bin ss-local) ss-local_socks_$5 "-c $config_file -b $bind -u $plugin_params" 
@@ -375,8 +377,10 @@ gen_start_config() {
 			local plugin=$(config_n_get $node ss_plugin)
 			if [ "$plugin" != "none" ]; then
 				[ "$plugin" == "v2ray-plugin" -o "$plugin" == "obfs-local" ] && {
+					local plugin_opts=""
 					local opts=$(config_n_get $node ss_plugin_opts)
-					plugin_params="--plugin $plugin --plugin-opts $opts"
+					[ -n "$opts" ] && plugin_opts="--plugin-opts $opts"
+					plugin_params="--plugin $plugin $plugin_opts"
 				}
 			fi
 			ln_start_bin $(find_bin ss-redir) ss-redir_udp_$5 "-c $config_file -U $plugin_params"
@@ -647,15 +651,14 @@ add_dnsmasq() {
 	}
 	
 	[ "$DNS_MODE" != "nonuse" ] && {
-		if [ -n "$UP_CHINA_DNS2" ]; then
-			[ -f "$RULES_PATH/whitelist_host" -a -s "$RULES_PATH/whitelist_host" ] && cat $RULES_PATH/whitelist_host | sed -e "/^$/d" | sort | awk '{print "server=/."$1"/'$UP_CHINA_DNS1'\nserver=/."$1"/'$UP_CHINA_DNS2'\nipset=/."$1"/whitelist"}' > $TMP_DNSMASQ_PATH/whitelist_host.conf
-			uci show $CONFIG | grep "@nodes" | grep "address" | cut -d "'" -f 2 | sed 's/^\(https:\/\/\|http:\/\/\)//g' | awk -F '/' '{print $1}' | grep -v "google.c" | grep -E '.*\..*$' | grep '[a-zA-Z]$' | sort | uniq | awk '{print "server=/."$1"/'$UP_CHINA_DNS1'\nserver=/."$1"/'$UP_CHINA_DNS2'\nipset=/."$1"/vpsiplist"}' > $TMP_DNSMASQ_PATH/vpsiplist_host.conf
+		[ -f "$RULES_PATH/whitelist_host" -a -s "$RULES_PATH/whitelist_host" ] && cat $RULES_PATH/whitelist_host | sed -e "/^$/d" | sort -u | awk '{if (mode != "chinadns-ng" && dns1 != "") print "server=/."$1"/'$UP_CHINA_DNS1'"; if (mode != "chinadns-ng" && dns2 != "") print "server=/."$1"/'$UP_CHINA_DNS2'"; print "ipset=/."$1"/whitelist"}' mode=$DNS_MODE dns1=$UP_CHINA_DNS1 dns2=$UP_CHINA_DNS2 > $TMP_DNSMASQ_PATH/whitelist_host.conf
+		uci show $CONFIG | grep "@nodes" | grep "address" | cut -d "'" -f 2 | sed 's/^\(https:\/\/\|http:\/\/\)//g' | awk -F '/' '{print $1}' | grep -v "google.c" | grep -E '.*\..*$' | grep '[a-zA-Z]$' | sort -u | awk '{if (dns1 != "") print "server=/."$1"/'$UP_CHINA_DNS1'"; if (dns2 != "") print "server=/."$1"/'$UP_CHINA_DNS2'"; print "ipset=/."$1"/vpsiplist"}' dns1=$UP_CHINA_DNS1 dns2=$UP_CHINA_DNS2 > $TMP_DNSMASQ_PATH/vpsiplist_host.conf
+		[ -f "$RULES_PATH/blacklist_host" -a -s "$RULES_PATH/blacklist_host" ] && cat $RULES_PATH/blacklist_host | sed -e "/^$/d" | sort -u | awk '{if (mode != "chinadns-ng") print "server=/."$1"/127.0.0.1#'$DNS_PORT'"; print "ipset=/."$1"/blacklist"}' mode=$DNS_MODE > $TMP_DNSMASQ_PATH/blacklist_host.conf
+		if [ "$DNS_MODE" != "chinadns-ng" ]; then
+			[ -f "$RULES_PATH/gfwlist.conf" -a -s "$RULES_PATH/gfwlist.conf" ] && ln -s $RULES_PATH/gfwlist.conf $TMP_DNSMASQ_PATH/gfwlist.conf
 		else
-			[ -f "$RULES_PATH/whitelist_host" -a -s "$RULES_PATH/whitelist_host" ] && cat $RULES_PATH/whitelist_host | sed -e "/^$/d" | sort | awk '{print "server=/."$1"/'$UP_CHINA_DNS1'\nipset=/."$1"/whitelist"}' > $TMP_DNSMASQ_PATH/whitelist_host.conf
-			uci show $CONFIG | grep "@nodes" | grep "address" | cut -d "'" -f 2 | sed 's/^\(https:\/\/\|http:\/\/\)//g' | awk -F '/' '{print $1}' | grep -v "google.c" | grep -E '.*\..*$' | grep '[a-zA-Z]$' | sort | uniq | awk '{print "server=/."$1"/'$UP_CHINA_DNS1'\nipset=/."$1"/vpsiplist"}' > $TMP_DNSMASQ_PATH/vpsiplist_host.conf
+			cat $TMP_PATH/gfwlist.txt | sed -e "/^$/d" | sort -u | awk '{print "ipset=/."$1"/gfwlist"}' > $TMP_DNSMASQ_PATH/gfwlist.conf
 		fi
-		[ -f "$RULES_PATH/blacklist_host" -a -s "$RULES_PATH/blacklist_host" ] && cat $RULES_PATH/blacklist_host | sed -e "/^$/d" | sort | awk '{print "server=/."$1"/127.0.0.1#'$DNS_PORT'\nipset=/."$1"/blacklist"}' > $TMP_DNSMASQ_PATH/blacklist_host.conf
-		[ -f "$RULES_PATH/gfwlist.conf" -a -s "$RULES_PATH/gfwlist.conf" ] && ln -s $RULES_PATH/gfwlist.conf $TMP_DNSMASQ_PATH/gfwlist.conf
 		
 		subscribe_proxy=$(config_t_get global_subscribe subscribe_proxy 0)
 		[ "$subscribe_proxy" -eq 1 ] && {
@@ -671,10 +674,10 @@ add_dnsmasq() {
 					local url=$(u_get $i url)
 					[ -n "$url" -a "$url" != "" ] && {
 						if [ -n "$(echo -n "$url" | grep "//")" ]; then
-							echo -n "$url" | awk -F '/' '{print $3}' | sed "s/^/server=&\/./g" | sed "s/$/\/127.0.0.1#$DNS_PORT/g" >>$TMP_DNSMASQ_PATH/subscribe.conf
+							[ "$DNS_MODE" != "chinadns-ng" ] && echo -n "$url" | awk -F '/' '{print $3}' | sed "s/^/server=&\/./g" | sed "s/$/\/127.0.0.1#$DNS_PORT/g" >>$TMP_DNSMASQ_PATH/subscribe.conf
 							echo -n "$url" | awk -F '/' '{print $3}' | sed "s/^/ipset=&\/./g" | sed "s/$/\/blacklist/g" >>$TMP_DNSMASQ_PATH/subscribe.conf
 						else
-							echo -n "$url" | awk -F '/' '{print $1}' | sed "s/^/server=&\/./g" | sed "s/$/\/127.0.0.1#$DNS_PORT/g" >>$TMP_DNSMASQ_PATH/subscribe.conf
+							[ "$DNS_MODE" != "chinadns-ng" ] && echo -n "$url" | awk -F '/' '{print $1}' | sed "s/^/server=&\/./g" | sed "s/$/\/127.0.0.1#$DNS_PORT/g" >>$TMP_DNSMASQ_PATH/subscribe.conf
 							echo -n "$url" | awk -F '/' '{print $1}' | sed "s/^/ipset=&\/./g" | sed "s/$/\/blacklist/g" >>$TMP_DNSMASQ_PATH/subscribe.conf
 						fi
 					}
@@ -696,7 +699,7 @@ add_dnsmasq() {
 			no-resolv
 		EOF
 	else
-		# 如果有某些人DNS设置了默认，但是没有设置上级DNS会上不了网，做个防呆...(真是服了你们这些xxx)
+		# 防呆
 		[ -z "$DEFAULT_DNS1" ] && {
 			local tmp=$(get_host_ip ipv4 www.baidu.com 1)
 			[ -z "$tmp" ] && {
diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh
index 45a605b240..ddec2dabe9 100755
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh
@@ -22,17 +22,6 @@ factor() {
 	fi
 }
 
-get_jump_mode() {
-	case "$1" in
-	disable)
-		echo "j"
-		;;
-	*)
-		echo "g"
-		;;
-	esac
-}
-
 dst() {
 	echo "-m set $2 --match-set $1 dst"
 }
@@ -41,22 +30,29 @@ comment() {
 	echo "-m comment --comment '$1'"
 }
 
-get_action_chain() {
+REDIRECT() {
+	local redirect="-j REDIRECT --to-ports $1"
+	[ "$2" == "TPROXY" ] && redirect="-j TPROXY --tproxy-mark 0x1/0x1 --on-port $1"
+	[ "$2" == "MARK" ] && redirect="-j MARK --set-mark $1"
+	echo $redirect
+}
+
+get_redirect_ipt() {
 	case "$1" in
 	disable)
-		echo "RETURN"
+		echo "-j RETURN"
 		;;
 	global)
-		echo "PSW_GLO"
+		echo "$(REDIRECT $2 $3)"
 		;;
 	gfwlist)
-		echo "PSW_GFW"
+		echo "$(dst $IPSET_GFW) $(REDIRECT $2 $3)"
 		;;
 	chnroute)
-		echo "PSW_CHN"
+		echo "$(dst $IPSET_CHN !) $(REDIRECT $2 $3)"
 		;;
 	returnhome)
-		echo "PSW_HOME"
+		echo "$(dst $IPSET_CHN) $(REDIRECT $2 $3)"
 		;;
 	esac
 }
@@ -67,16 +63,16 @@ get_action_chain_name() {
 		echo "不代理"
 		;;
 	global)
-		echo "全局"
+		echo "全局代理"
 		;;
 	gfwlist)
-		echo "GFW"
+		echo "GFW名单"
 		;;
 	chnroute)
 		echo "大陆白名单"
 		;;
 	returnhome)
-		echo "回国"
+		echo "回国模式"
 		;;
 	esac
 }
@@ -108,6 +104,7 @@ load_acl() {
 			local remarks=$(u_get $i remarks)
 			local ip=$(u_get $i ip)
 			local mac=$(u_get $i mac)
+			[ -z "$ip" -a -z "$mac" ] && continue
 			local tcp_proxy_mode=$(u_get $i tcp_proxy_mode default)
 			local udp_proxy_mode=$(u_get $i udp_proxy_mode default)
 			local tcp_node=$(u_get $i tcp_node 1)
@@ -126,35 +123,40 @@ load_acl() {
 			[ "$udp_redir_ports" = "default" ] && udp_redir_ports=$UDP_REDIR_PORTS
 			eval TCP_NODE=\$TCP_NODE$tcp_node
 			eval UDP_NODE=\$UDP_NODE$udp_node
-			if [ -n "$ip" ] || [ -n "$mac" ]; then
-				if [ -n "$ip" -a -n "$mac" ]; then
-					echolog "访问控制：IP：$ip，MAC：$mac，使用TCP_${tcp_node}节点，UDP_${udp_node}节点，TCP模式：$(get_action_chain_name $tcp_proxy_mode)，UDP模式：$(get_action_chain_name $udp_proxy_mode)"
-				else
-					[ -n "$ip" ] && echolog "访问控制：IP：$ip，使用TCP_${tcp_node}节点，UDP_${udp_node}节点，TCP模式：$(get_action_chain_name $tcp_proxy_mode)，UDP模式：$(get_action_chain_name $udp_proxy_mode)"
-					[ -n "$mac" ] && echolog "访问控制：MAC：$mac，使用TCP_${tcp_node}节点，UDP_${udp_node}节点，TCP模式：$(get_action_chain_name $tcp_proxy_mode)，UDP模式：$(get_action_chain_name $udp_proxy_mode)"
-				fi
-				
-				[ "$tcp_proxy_mode" != "disable" ] && {
-					[ "$TCP_NODE" != "nil" ] && {
-						local ipt_tmp=$ipt_n
-						eval TCP_NODE_TYPE=$(echo $(config_n_get $TCP_NODE type) | tr 'A-Z' 'a-z')
-						[ "$TCP_NODE_TYPE" == "brook" -a "$(config_n_get $TCP_NODE brook_protocol client)" == "client" ] && ipt_tmp=$ipt_m
-						[ "$tcp_no_redir_ports" != "disable" ] && $ipt_tmp -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp -m multiport --dport $tcp_no_redir_ports -j RETURN
-						#eval tcp_redir_port=\$TCP_REDIR_PORT$tcp_node
-						$ipt_tmp -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(factor $tcp_redir_ports "-m multiport --dport") $(comment "$remarks") -$(get_jump_mode $tcp_proxy_mode) $(get_action_chain $tcp_proxy_mode)$tcp_node
-					}
-				}
-				$ipt_n -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(comment "$remarks") -j RETURN
-				
-				[ "$udp_proxy_mode" != "disable" ] && {
-					[ "$UDP_NODE" != "nil" ] && {
-						[ "$udp_no_redir_ports" != "disable" ] && $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp -m multiport --dport $udp_no_redir_ports -j RETURN
-						#eval udp_redir_port=\$UDP_REDIR_PORT$udp_node
-						$ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp $(factor $udp_redir_ports "-m multiport --dport") $(comment "$remarks") -$(get_jump_mode $udp_proxy_mode) $(get_action_chain $udp_proxy_mode)$udp_node
-					}
-				}
-				$ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp $(comment "$remarks") -j RETURN
+			
+			if [ -n "$ip" -a -n "$mac" ]; then
+				echolog "访问控制：IP：$ip，MAC：$mac，使用TCP_${tcp_node}节点，UDP_${udp_node}节点，TCP模式：$(get_action_chain_name $tcp_proxy_mode)，UDP模式：$(get_action_chain_name $udp_proxy_mode)"
+			else
+				[ -n "$ip" ] && echolog "访问控制：IP：$ip，使用TCP_${tcp_node}节点，UDP_${udp_node}节点，TCP模式：$(get_action_chain_name $tcp_proxy_mode)，UDP模式：$(get_action_chain_name $udp_proxy_mode)"
+				[ -n "$mac" ] && echolog "访问控制：MAC：$mac，使用TCP_${tcp_node}节点，UDP_${udp_node}节点，TCP模式：$(get_action_chain_name $tcp_proxy_mode)，UDP模式：$(get_action_chain_name $udp_proxy_mode)"
 			fi
+			
+			local ipt_tmp=$ipt_n
+			[ "$tcp_proxy_mode" != "disable" ] && {
+				[ "$TCP_NODE" != "nil" ] && {
+					eval TCP_NODE_TYPE=$(echo $(config_n_get $TCP_NODE type) | tr 'A-Z' 'a-z')
+					local is_tproxy
+					[ "$TCP_NODE_TYPE" == "brook" -a "$(config_n_get $TCP_NODE brook_protocol client)" == "client" ] && ipt_tmp=$ipt_m && is_tproxy="TPROXY"
+					[ "$tcp_no_redir_ports" != "disable" ] && $ipt_tmp -A PSW_ACL $(comment "$remarks") $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp -m multiport --dport $tcp_no_redir_ports -j RETURN
+					eval tcp_port=\$TCP_REDIR_PORT$tcp_node
+					$ipt_tmp -A PSW_ACL $(comment "$remarks") -p tcp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $tcp_redir_ports "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $tcp_port $is_tproxy)
+					$ipt_tmp -A PSW_ACL $(comment "$remarks") -p tcp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $tcp_redir_ports "-m multiport --dport") $(get_redirect_ipt $tcp_proxy_mode $tcp_port $is_tproxy)
+					unset is_tproxy
+					unset tcp_port
+				}
+			}
+			$ipt_tmp -A PSW_ACL $(comment "$remarks") $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp -j RETURN
+			
+			[ "$udp_proxy_mode" != "disable" ] && {
+				[ "$UDP_NODE" != "nil" ] && {
+					eval udp_port=\$UDP_REDIR_PORT$udp_node
+					[ "$udp_no_redir_ports" != "disable" ] && $ipt_m -A PSW_ACL $(comment "$remarks") $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp -m multiport --dport $udp_no_redir_ports -j RETURN
+					$ipt_m -A PSW_ACL $(comment "$remarks") -p udp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $udp_port TPROXY)
+					$ipt_m -A PSW_ACL $(comment "$remarks") -p udp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $udp_proxy_mode $udp_port TPROXY)
+					unset udp_port
+				}
+			}
+			$ipt_m -A PSW_ACL $(comment "$remarks") $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp -j RETURN
 		done
 	}
 }
@@ -206,12 +208,7 @@ filter_node() {
 }
 
 dns_hijack() {
-	if [ "$1" = "force" ]; then
-		[ -n "$lan_ifname" -a -n "$lan_ip" ] && {
-			local ip=$(echo $lan_ip | awk -F '/' '{print $1}')
-			$ipt_n -I PSW -i $lan_ifname -p udp --dport 53 -j DNAT --to $ip
-		}
-	fi
+	$ipt_n -I PSW -p udp --dport 53 -j REDIRECT --to-ports 53
 }
 
 add_firewall_rule() {
@@ -231,10 +228,10 @@ add_firewall_rule() {
 		$(gen_laniplist | sed -e "s/^/add $IPSET_LANIPLIST /")
 	EOF
 
-	ISP_DNS=$(cat /tmp/resolv.conf.auto 2>/dev/null | grep -E -o "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | sort -u | grep -v 0.0.0.0 | grep -v 127.0.0.1)
+	ISP_DNS=$(cat $RESOLVFILE 2>/dev/null | grep -E -o "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | sort -u | grep -v 0.0.0.0 | grep -v 127.0.0.1)
 	[ -n "$ISP_DNS" ] && {
 		for ispip in $ISP_DNS; do
-			ipset -! add $IPSET_LANIPLIST $ispip >/dev/null 2>&1 &
+			ipset -! add $IPSET_WHITELIST $ispip >/dev/null 2>&1 &
 		done
 	}
 
@@ -267,242 +264,128 @@ add_firewall_rule() {
 	$ipt_m -A PSW_OUTPUT $(dst $IPSET_VPSIPLIST) -j RETURN
 	$ipt_m -A PSW_OUTPUT $(dst $IPSET_WHITELIST) -j RETURN
 
-	if [[ "$TCP_NODE_NUM" -ge 1 ]] || [[ "$UDP_NODE_NUM" -ge 1 ]]; then
-		local max_num=1
-		[ "$TCP_NODE_NUM" -ge "$UDP_NODE_NUM" ] && max_num=$TCP_NODE_NUM
-		if [ "$max_num" -ge 1 ]; then
-			for i in $(seq 1 $max_num); do
-				$ipt_n -N PSW_GLO$i
-				$ipt_n -N PSW_GFW$i
-				$ipt_n -N PSW_CHN$i
-				$ipt_n -N PSW_HOME$i
-			
-				$ipt_m -N PSW_GLO$i
-				$ipt_m -N PSW_GFW$i
-				$ipt_m -N PSW_CHN$i
-				$ipt_m -N PSW_HOME$i
-			done
-			ip rule add fwmark 1 lookup 100
-			ip route add local 0.0.0.0/0 dev lo table 100
-		fi
-	fi
+	ip rule add fwmark 1 lookup 100
+	ip route add local 0.0.0.0/0 dev lo table 100
 
 	for k in $(seq 1 $SOCKS5_NODE_NUM); do
 		eval node=\$SOCKS5_NODE$k
 		[ "$node" != "nil" ] && filter_node $node
 	done
-
-	# 加载TCP防火墙
-	if [ "$TCP_NODE_NUM" -ge 1 ]; then
-		for k in $(seq 1 $TCP_NODE_NUM); do
-			eval node=\$TCP_NODE$k
-			eval local_port=\$TCP_REDIR_PORT$k
-			# 生成TCP转发规则
-			if [ "$node" != "nil" ]; then
-				filter_node $node
-				local TCP_NODE_TYPE=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z')
-				if [ "$TCP_NODE_TYPE" == "brook" -a "$(config_n_get $node brook_protocol client)" == "client" ]; then
-					$ipt_n -X PSW_GLO$k
-					$ipt_n -X PSW_GFW$k
-					$ipt_n -X PSW_CHN$k
-					$ipt_n -X PSW_HOME$k
-					
-					$ipt_m -A PSW_ACL -p tcp -m socket -j MARK --set-mark 1
-
-					# 全局模式
-					$ipt_m -A PSW_GLO$k -p tcp $(dst $IPSET_BLACKLIST) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-					$ipt_m -A PSW_GLO$k -p tcp -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-
-					# GFWLIST模式
-					$ipt_m -A PSW_GFW$k -p tcp $(dst $IPSET_BLACKLIST) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-					$ipt_m -A PSW_GFW$k -p tcp $(dst $IPSET_GFW) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-
-					# 大陆白名单模式
-					$ipt_m -A PSW_CHN$k -p tcp $(dst $IPSET_BLACKLIST) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-					$ipt_m -A PSW_CHN$k -p tcp $(dst $IPSET_CHN !) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-
-					# 回国模式
-					$ipt_m -A PSW_HOME$k -p tcp $(dst $IPSET_BLACKLIST) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-					$ipt_m -A PSW_HOME$k -p tcp $(dst $IPSET_CHN) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-				else
-					# 全局模式
-					$ipt_n -A PSW_GLO$k -p tcp $(dst $IPSET_BLACKLIST) -j REDIRECT --to-ports $local_port
-					$ipt_n -A PSW_GLO$k -p tcp -j REDIRECT --to-ports $local_port
-
-					# GFWLIST模式
-					$ipt_n -A PSW_GFW$k -p tcp $(dst $IPSET_BLACKLIST) -j REDIRECT --to-ports $local_port
-					$ipt_n -A PSW_GFW$k -p tcp $(dst $IPSET_GFW) -j REDIRECT --to-ports $local_port
-
-					# 大陆白名单模式
-					$ipt_n -A PSW_CHN$k -p tcp $(dst $IPSET_BLACKLIST) -j REDIRECT --to-ports $local_port
-					$ipt_n -A PSW_CHN$k -p tcp $(dst $IPSET_CHN !) -j REDIRECT --to-ports $local_port
-					#$ipt_n -A PSW_CHN$k -p tcp -m geoip ! --destination-country CN -j REDIRECT --to-ports $local_port
-
-					# 回国模式
-					$ipt_n -A PSW_HOME$k -p tcp $(dst $IPSET_BLACKLIST) -j REDIRECT --to-ports $local_port
-					$ipt_n -A PSW_HOME$k -p tcp $(dst $IPSET_CHN) -j REDIRECT --to-ports $local_port
-					#$ipt_n -A PSW_HOME$k -p tcp -m geoip --destination-country CN -j REDIRECT --to-ports $local_port
-				fi
-				
-				[ "$k" == 1 ] && {
-					if [ "$TCP_NODE_TYPE" == "brook" -a "$(config_n_get $node brook_protocol client)" == "client" ]; then
-						[ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && {
-							for dns in $DNS_FORWARD
-							do
-								local dns_ip=$(echo $dns | sed "s/:/#/g" | awk -F "#" '{print $1}')
-								ipset test $IPSET_LANIPLIST $dns_ip 2>/dev/null
-								[ $? == 0 ] && continue
-								local dns_port=$(echo $dns | sed "s/:/#/g" | awk -F "#" '{print $2}')
-								[ -z "$dns_port" ] && dns_port=53
-								$ipt_m -I PSW 2 -p tcp -d $dns_ip --dport $dns_port -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-							done
-						}
-						# 用于本机流量转发
-						$ipt_m -A OUTPUT -p tcp -j PSW_OUTPUT
-						[ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN
-						$ipt_m -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_BLACKLIST) $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j MARK --set-mark 1
-						[ "$LOCALHOST_TCP_PROXY_MODE" == "global" ] && $ipt_m -A PSW_OUTPUT -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j MARK --set-mark 1
-						[ "$LOCALHOST_TCP_PROXY_MODE" == "gfwlist" ] && $ipt_m -A PSW_OUTPUT -p tcp $(dst $IPSET_GFW) $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j MARK --set-mark 1
-						[ "$LOCALHOST_TCP_PROXY_MODE" == "chnroute" ] && $ipt_m -A PSW_OUTPUT -p tcp -m set ! --match-set $IPSET_CHN dst $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j MARK --set-mark 1
-					else
-						# 用于本机流量转发
-						$ipt_n -A OUTPUT -p tcp -j PSW_OUTPUT
-						[ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && {
-							for dns in $DNS_FORWARD
-							do
-								local dns_ip=$(echo $dns | sed "s/:/#/g" | awk -F "#" '{print $1}')
-								ipset test $IPSET_LANIPLIST $dns_ip 2>/dev/null
-								[ $? == 0 ] && continue
-								local dns_port=$(echo $dns | sed "s/:/#/g" | awk -F "#" '{print $2}')
-								[ -z "$dns_port" ] && dns_port=53
-								local ADD_INDEX=2
-								$ipt_n -I PSW_OUTPUT $ADD_INDEX -p tcp -d $dns_ip --dport $dns_port -j REDIRECT --to-ports $TCP_REDIR_PORT1
-							done
-						}
-						[ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_n -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN
-						$ipt_n -A PSW_OUTPUT -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j $(get_action_chain $LOCALHOST_TCP_PROXY_MODE)1
-					fi
-					# 重定所有流量到透明代理端口
-					# $ipt_n -A PSW -p tcp -m ttl --ttl-eq $ttl -j REDIRECT --to $local_port
-				}
-				
-				if [ "$PROXY_IPV6" == "1" ]; then
-					[ -n "$lan_ifname" ] && {
-						lan_ipv6=$(ip address show $lan_ifname | grep -w "inet6" | awk '{print $2}') #当前LAN IPv6段
-						[ -n "$lan_ipv6" ] && {
-							$ip6t_n -N PSW
-							$ip6t_n -N PSW_ACL
-							$ip6t_n -A PREROUTING -j PSW
-							[ -n "$lan_ipv6" ] && {
-								for ip in $lan_ipv6; do
-									$ip6t_n -A PSW -d $ip -j RETURN
-								done
-							}
-							[ "$use_ipv6" == "1" -a -n "$server_ip" ] && $ip6t_n -A PSW -d $server_ip -j RETURN
-							$ip6t_n -N PSW_GLO$k
-							$ip6t_n -N PSW_GFW$k
-							$ip6t_n -N PSW_CHN$k
-							$ip6t_n -N PSW_HOME$k
-							$ip6t_n -A PSW_GLO$k -p tcp -j REDIRECT --to $TCP_REDIR_PORT
-							$ip6t_n -A PSW -j PSW_GLO$k
-							#$ip6t_n -I OUTPUT -p tcp -j PSW
-						}
-					}
-				fi
-			fi
-		done
-		$ipt_n -A PSW -j PSW_ACL
-		
-		PRE_INDEX=1
-		ADBYBY_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "ADBYBY" | sed -n '$p' | awk '{print $1}')
-		if [ -n "$ADBYBY_INDEX" ]; then
-			PRE_INDEX=$(expr $ADBYBY_INDEX + 1)
+	
+	# 加载路由器自身代理 TCP
+	if [ "$TCP_NODE1" != "nil" ]; then
+		filter_node $TCP_NODE1
+		TCP_NODE1_TYPE=$(echo $(config_n_get $TCP_NODE1 type) | tr 'A-Z' 'a-z')
+		if [ "$TCP_NODE1_TYPE" == "brook" -a "$(config_n_get $TCP_NODE1 brook_protocol client)" == "client" ]; then
+			[ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && {
+				for dns in $DNS_FORWARD ; do
+					local dns_ip=$(echo $dns | sed "s/:/#/g" | awk -F "#" '{print $1}')
+					ipset test $IPSET_LANIPLIST $dns_ip 2>/dev/null
+					[ $? == 0 ] && continue
+					local dns_port=$(echo $dns | sed "s/:/#/g" | awk -F "#" '{print $2}')
+					[ -z "$dns_port" ] && dns_port=53
+					$ipt_m -I PSW 2 -p tcp -d $dns_ip --dport $dns_port $(REDIRECT $TCP_REDIR_PORT1 TPROXY)
+				done
+			}
+			$ipt_m -A OUTPUT -p tcp -j PSW_OUTPUT
+			[ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN
+			$ipt_m -A PSW_OUTPUT -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT 1 MARK)
+			$ipt_m -A PSW_OUTPUT -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $LOCALHOST_TCP_PROXY_MODE 1 MARK)
 		else
-			PR_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "prerouting_rule" | sed -n '$p' | awk '{print $1}')
-			[ -n "$PR_INDEX" ] && PRE_INDEX=$(expr $PR_INDEX + 1)
+			[ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && {
+				for dns in $DNS_FORWARD ; do
+					local dns_ip=$(echo $dns | sed "s/:/#/g" | awk -F "#" '{print $1}')
+					ipset test $IPSET_LANIPLIST $dns_ip 2>/dev/null
+					[ $? == 0 ] && continue
+					local dns_port=$(echo $dns | sed "s/:/#/g" | awk -F "#" '{print $2}')
+					[ -z "$dns_port" ] && dns_port=53
+					local ADD_INDEX=2
+					$ipt_n -I PSW_OUTPUT $ADD_INDEX -p tcp -d $dns_ip --dport $dns_port $(REDIRECT $TCP_REDIR_PORT1)
+				done
+			}
+			$ipt_n -A OUTPUT -p tcp -j PSW_OUTPUT
+			[ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_n -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN
+			$ipt_n -A PSW_OUTPUT -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $TCP_REDIR_PORT1)
+			$ipt_n -A PSW_OUTPUT -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $LOCALHOST_TCP_PROXY_MODE $TCP_REDIR_PORT1)
 		fi
-		$ipt_n -I PREROUTING $PRE_INDEX -p tcp -j PSW
 	fi
-
-	# 加载UDP防火墙
-	if [ "$UDP_NODE_NUM" -ge 1 ]; then
-		for k in $(seq 1 $UDP_NODE_NUM); do
-			eval node=\$UDP_NODE$k
-			eval local_port=\$UDP_REDIR_PORT$k
-			#  生成UDP转发规则
-			if [ "$node" != "nil" ]; then
-				filter_node $node
-				local UDP_NODE_TYPE=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z')
-				[ "$UDP_NODE_TYPE" == "brook" -a "$(config_n_get $node brook_protocol client)" == "client" ] && $ipt_m -A PSW_ACL -p udp -m socket -j MARK --set-mark 1
-				#  全局模式
-				$ipt_m -A PSW_GLO$k -p udp $(dst $IPSET_BLACKLIST) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-				$ipt_m -A PSW_GLO$k -p udp -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-
-				#  GFWLIST模式
-				$ipt_m -A PSW_GFW$k -p udp $(dst $IPSET_BLACKLIST) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-				$ipt_m -A PSW_GFW$k -p udp $(dst $IPSET_GFW) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-
-				#  大陆白名单模式（游戏模式）
-				$ipt_m -A PSW_CHN$k -p udp $(dst $IPSET_BLACKLIST) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-				$ipt_m -A PSW_CHN$k -p udp $(dst $IPSET_CHN !) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-
-				#  回国模式
-				$ipt_m -A PSW_HOME$k -p udp $(dst $IPSET_BLACKLIST) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-				$ipt_m -A PSW_HOME$k -p udp $(dst $IPSET_CHN) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-				
-				[ "$k" == 1 ] && {
-					# 用于本机流量转发
-					$ipt_m -A OUTPUT -p udp -j PSW_OUTPUT
-					[ "$use_udp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && {
-						for dns in $DNS_FORWARD
-						do
-							local dns_ip=$(echo $dns | sed "s/:/#/g" | awk -F "#" '{print $1}')
-							ipset test $IPSET_LANIPLIST $dns_ip 2>/dev/null
-							[ $? == 0 ] && continue
-							local dns_port=$(echo $dns | sed "s/:/#/g" | awk -F "#" '{print $2}')
-							[ -z "$dns_port" ] && dns_port=53
-							local ADD_INDEX=2
-							$ipt_m -I PSW $ADD_INDEX -p udp -d $dns_ip --dport $dns_port -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-							$ipt_m -I PSW_OUTPUT $ADD_INDEX -p udp -d $dns_ip --dport $dns_port -j MARK --set-mark 1
-						done
-					}
-					
-					[ "$UDP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN
-					$ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_BLACKLIST) -j MARK --set-mark 1
-					[ "$LOCALHOST_UDP_PROXY_MODE" == "global" ] && $ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS -j MARK --set-mark 1
-					[ "$LOCALHOST_UDP_PROXY_MODE" == "gfwlist" ] && $ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_GFW) -j MARK --set-mark 1
-					[ "$LOCALHOST_UDP_PROXY_MODE" == "chnroute" ] && $ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS -m set ! --match-set $IPSET_CHN dst -j MARK --set-mark 1
+	
+	$ipt_n -A PSW -j PSW_ACL
+	local PRE_INDEX=1
+	ADBYBY_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "ADBYBY" | sed -n '$p' | awk '{print $1}')
+	if [ -n "$ADBYBY_INDEX" ]; then
+		PRE_INDEX=$(expr $ADBYBY_INDEX + 1)
+	else
+		PR_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "prerouting_rule" | sed -n '$p' | awk '{print $1}')
+		[ -n "$PR_INDEX" ] && PRE_INDEX=$(expr $PR_INDEX + 1)
+	fi
+	$ipt_n -I PREROUTING $PRE_INDEX -p tcp -j PSW
+	
+	if [ "$PROXY_IPV6" == "1" ]; then
+		[ -n "$lan_ifname" ] && {
+			lan_ipv6=$(ip address show $lan_ifname | grep -w "inet6" | awk '{print $2}') #当前LAN IPv6段
+			[ -n "$lan_ipv6" ] && {
+				$ip6t_n -N PSW
+				$ip6t_n -N PSW_ACL
+				$ip6t_n -A PREROUTING -j PSW
+				[ -n "$lan_ipv6" ] && {
+					for ip in $lan_ipv6; do
+						$ip6t_n -A PSW -d $ip -j RETURN
+					done
 				}
-			fi
-		done
-		$ipt_m -A PSW -j PSW_ACL
-		$ipt_m -A PREROUTING -j PSW
+				[ "$use_ipv6" == "1" -a -n "$server_ip" ] && $ip6t_n -A PSW -d $server_ip -j RETURN
+				$ip6t_n -A PSW -p tcp $(REDIRECT $TCP_REDIR_PORT1)
+				#$ip6t_n -I OUTPUT -p tcp -j PSW
+			}
+		}
 	fi
 	
+	# 加载路由器自身代理 UDP
+	if [ "$UDP_NODE1" != "nil" ]; then
+		filter_node $UDP_NODE1
+		local UDP_NODE1_TYPE=$(echo $(config_n_get $UDP_NODE1 type) | tr 'A-Z' 'a-z')
+		[ "$use_udp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && {
+			for dns in $DNS_FORWARD ; do
+				local dns_ip=$(echo $dns | sed "s/:/#/g" | awk -F "#" '{print $1}')
+				ipset test $IPSET_LANIPLIST $dns_ip 2>/dev/null
+				[ $? == 0 ] && continue
+				local dns_port=$(echo $dns | sed "s/:/#/g" | awk -F "#" '{print $2}')
+				[ -z "$dns_port" ] && dns_port=53
+				local ADD_INDEX=2
+				$ipt_m -I PSW $ADD_INDEX -p udp -d $dns_ip --dport $dns_port $(REDIRECT $UDP_REDIR_PORT1 TPROXY)
+				$ipt_m -I PSW_OUTPUT $ADD_INDEX -p udp -d $dns_ip --dport $dns_port $(REDIRECT 1 MARK)
+			done
+		}
+		$ipt_m -A OUTPUT -p udp -j PSW_OUTPUT
+		[ "$UDP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN
+		$ipt_m -A PSW_OUTPUT -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT 1 MARK)
+		$ipt_m -A PSW_OUTPUT -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $LOCALHOST_UDP_PROXY_MODE 1 MARK)
+	fi
+	
+	$ipt_m -A PSW -j PSW_ACL
+	$ipt_m -A PREROUTING -j PSW
+	
 	#  加载ACLS
 	load_acl
 
 	#  加载TCP默认代理模式
-	[ "$TCP_PROXY_MODE" != "disable" ] && {
-		[ "$TCP_NODE1" != "nil" ] && {
-			local ipt_tmp=$ipt_n
-			local TCP_NODE_TYPE1=$(echo $(config_n_get $TCP_NODE1 type) | tr 'A-Z' 'a-z')
-			[ "$TCP_NODE_TYPE1" == "brook" -a "$(config_n_get $TCP_NODE1 brook_protocol client)" == "client" ] && ipt_tmp=$ipt_m
-			[ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_tmp -A PSW_ACL -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS $(comment "Default") -j RETURN
-			$ipt_tmp -A PSW_ACL -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(comment "Default") -j $(get_action_chain $TCP_PROXY_MODE)1
-		}
+	local ipt_tmp=$ipt_n
+	[ "$TCP_NODE1" != "nil" -a "$TCP_PROXY_MODE" != "disable" ] && {
+		local TCP_NODE1_TYPE=$(echo $(config_n_get $TCP_NODE1 type) | tr 'A-Z' 'a-z')
+		local is_tproxy
+		[ "$TCP_NODE1_TYPE" == "brook" -a "$(config_n_get $TCP_NODE1 brook_protocol client)" == "client" ] && ipt_tmp=$ipt_m && is_tproxy="TPROXY"
+		[ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_tmp -A PSW_ACL $(comment "默认") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN
+		$ipt_tmp -A PSW_ACL $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $TCP_PROXY_MODE $TCP_REDIR_PORT1 $is_tproxy)
 	}
-	$ipt_n -A PSW_ACL -p tcp $(comment "Default") -j RETURN
+	$ipt_tmp -A PSW_ACL $(comment "默认") -p tcp -j RETURN
 	echolog "TCP默认代理模式：$(get_action_chain_name $TCP_PROXY_MODE)"
 	
 	#  加载UDP默认代理模式
-	[ "$UDP_PROXY_MODE" != "disable" ] && {
-		[ "$UDP_NODE1" != "nil" ] && {
-			[ "$UDP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_ACL -p udp -m multiport --dport $UDP_NO_REDIR_PORTS $(comment "Default") -j RETURN
-			$ipt_m -A PSW_ACL -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(comment "Default") -j $(get_action_chain $UDP_PROXY_MODE)1
-		}
+	[ "$UDP_NODE1" != "nil" -a "$UDP_PROXY_MODE" != "disable" ] && {
+		[ "$UDP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_ACL $(comment "默认") -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN
+		$ipt_m -A PSW_ACL $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $UDP_PROXY_MODE $UDP_REDIR_PORT1 TPROXY)
 	}
-	$ipt_m -A PSW_ACL -p udp $(comment "Default") -j RETURN
+	$ipt_m -A PSW_ACL $(comment "默认") -p udp -j RETURN
 	echolog "UDP默认代理模式：$(get_action_chain_name $UDP_PROXY_MODE)"
 	
 	#  过滤所有节点IP
@@ -532,23 +415,6 @@ del_firewall_rule() {
 	$ip6t_n -F PSW 2>/dev/null && $ip6t_n -X PSW 2>/dev/null
 	$ip6t_n -F PSW_ACL 2>/dev/null && $ip6t_n -X PSW_ACL 2>/dev/null
 	$ip6t_n -F PSW_OUTPUT 2>/dev/null && $ip6t_n -X PSW_OUTPUT 2>/dev/null
-
-	for k in $(seq 1 3); do
-		$ipt_n -F PSW_GLO$k 2>/dev/null && $ipt_n -X PSW_GLO$k 2>/dev/null
-		$ipt_n -F PSW_GFW$k 2>/dev/null && $ipt_n -X PSW_GFW$k 2>/dev/null
-		$ipt_n -F PSW_CHN$k 2>/dev/null && $ipt_n -X PSW_CHN$k 2>/dev/null
-		$ipt_n -F PSW_HOME$k 2>/dev/null && $ipt_n -X PSW_HOME$k 2>/dev/null
-		
-		$ipt_m -F PSW_GLO$k 2>/dev/null && $ipt_m -X PSW_GLO$k 2>/dev/null
-		$ipt_m -F PSW_GFW$k 2>/dev/null && $ipt_m -X PSW_GFW$k 2>/dev/null
-		$ipt_m -F PSW_CHN$k 2>/dev/null && $ipt_m -X PSW_CHN$k 2>/dev/null
-		$ipt_m -F PSW_HOME$k 2>/dev/null && $ipt_m -X PSW_HOME$k 2>/dev/null
-		
-		$ip6t_n -F PSW_GLO$k 2>/dev/null && $ip6t_n -X PSW_GLO$k 2>/dev/null
-		$ip6t_n -F PSW_GFW$k 2>/dev/null && $ip6t_n -X PSW_GFW$k 2>/dev/null
-		$ip6t_n -F PSW_CHN$k 2>/dev/null && $ip6t_n -X PSW_CHN$k 2>/dev/null
-		$ip6t_n -F PSW_HOME$k 2>/dev/null && $ip6t_n -X PSW_HOME$k 2>/dev/null
-	done
 	
 	ip rule del fwmark 1 lookup 100 2>/dev/null
 	ip route del local 0.0.0.0/0 dev lo table 100 2>/dev/null
diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/test.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/test.sh
index 6e10ffea25..0949a4bb36 100755
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/test.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/test.sh
@@ -21,7 +21,7 @@ test_url() {
 	[ -n "$2" ] && try=$2
 	local timeout=2
 	[ -n "$3" ] && timeout=$3
-	status=$(/usr/bin/wget --no-check-certificate --spider --timeout=$timeout --tries $try "$url" 2>/dev/null)
+	status=$(/usr/bin/wget -4 --no-check-certificate --spider --timeout=$timeout --tries $try "$url" 2>/dev/null)
 	[ "$?" == 0 ] && status=200
 	echo $status
 }
@@ -29,7 +29,7 @@ test_url() {
 test_proxy() {
 	local try=5
 	result=0
-	status=$(test_url "https://www.google.com" $try)
+	status=$(test_url "https://www.google.com/generate_204" $try)
 	if [ "$status" = "200" ]; then
 		result=0
 	else
@@ -120,4 +120,4 @@ test_url)
 *)
 	start
 	;;
-esac
\ No newline at end of file
+esac