diff --git a/package/lienol/luci-app-passwall/Makefile b/package/lienol/luci-app-passwall/Makefile
index 88b6f11aab..15c3cd92a2 100644
--- a/package/lienol/luci-app-passwall/Makefile
+++ b/package/lienol/luci-app-passwall/Makefile
@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=2.0
-PKG_RELEASE:=89-20191101
+PKG_RELEASE:=90-20191103
 
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 PO2LMO:=./po2lmo
diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray_client_config_file.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray_client_config_file.lua
index 07b28c8b38..e7bf79de33 100644
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray_client_config_file.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray_client_config_file.lua
@@ -60,7 +60,11 @@ local v2ray = {
         streamSettings = {
             network = server.v2ray_transport,
             security = server.v2ray_stream_security,
-            tlsSettings = (server.v2ray_tls) and {} or nil,
+            tlsSettings = (server.v2ray_stream_security == "tls") and {
+                serverName = server.tls_serverName,
+                allowInsecure = (server.tls_allowInsecure == "1") and true or
+                    false
+            } or nil,
             kcpSettings = (server.v2ray_transport == "mkcp") and {
                 mtu = tonumber(server.v2ray_mkcp_mtu),
                 tti = tonumber(server.v2ray_mkcp_tti),
diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/serverconfig.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/serverconfig.lua
index e1a42b8539..fd45573cbf 100644
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/serverconfig.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/serverconfig.lua
@@ -11,8 +11,8 @@ end
 local function is_installed(e) return ipkg.installed(e) end
 
 local ss_encrypt_method = {
-    "rc4-md5", "aes-128-cfb", "aes-192-cfb", "aes-256-cfb",
-    "aes-128-ctr", "aes-192-ctr", "aes-256-ctr", "bf-cfb", "camellia-128-cfb",
+    "rc4-md5", "aes-128-cfb", "aes-192-cfb", "aes-256-cfb", "aes-128-ctr",
+    "aes-192-ctr", "aes-256-ctr", "bf-cfb", "camellia-128-cfb",
     "camellia-192-cfb", "camellia-256-cfb", "salsa20", "chacha20",
     "chacha20-ietf", -- aead
     "aes-128-gcm", "aes-192-gcm", "aes-256-gcm", "chacha20-ietf-poly1305",
@@ -184,6 +184,16 @@ o:value("none", "none")
 o:value("tls", "tls")
 o:depends("server_type", "V2ray")
 
+-- [[ TLS部分 ]] --
+o = s:option(Value, "tls_serverName", translate("Domain"))
+o:depends("v2ray_stream_security", "tls")
+
+o = s:option(Flag, "tls_allowInsecure", translate("allowInsecure"), translate(
+                 "Whether unsafe connections are allowed. When checked, V2Ray does not check the validity of the TLS certificate provided by the remote host."))
+o.default = "0"
+o.rmempty = false
+o:depends("v2ray_stream_security", "tls")
+
 o = s:option(ListValue, "v2ray_transport", translate("Transport"))
 o:value("tcp", "TCP")
 o:value("mkcp", "mKCP")
diff --git a/package/lienol/luci-app-passwall/po/zh-cn/passwall.po b/package/lienol/luci-app-passwall/po/zh-cn/passwall.po
index a590c0e49f..0bc0dcabba 100644
--- a/package/lienol/luci-app-passwall/po/zh-cn/passwall.po
+++ b/package/lienol/luci-app-passwall/po/zh-cn/passwall.po
@@ -667,6 +667,9 @@ msgstr "传输层加密"
 msgid "Whether or not transport layer encryption is enabled, the supported options are \"none\" for unencrypted (default) and \"TLS\" for using TLS."
 msgstr "是否启入传输层加密，支持的选项有 \"none\" 表示不加密（默认值），\"tls\" 表示使用 TLS。"
 
+msgid "Whether unsafe connections are allowed. When checked, V2Ray does not check the validity of the TLS certificate provided by the remote host."
+msgstr "是否允许不安全连接。当勾选时，V2Ray 不会检查远端主机所提供的 TLS 证书的有效性。"
+
 msgid "<br>none: default, no masquerade, data sent is packets with no characteristics.<br>srtp: disguised as an SRTP packet, it will be recognized as video call data (such as FaceTime).<br>utp: packets disguised as uTP will be recognized as bittorrent downloaded data.<br>wechat-video: packets disguised as WeChat video calls.<br>dtls: disguised as DTLS 1.2 packet.<br>wireguard: disguised as a WireGuard packet. (not really WireGuard protocol)"
 msgstr "<br>none：默认值，不进行伪装，发送的数据是没有特征的数据包。<br>srtp：伪装成 SRTP 数据包，会被识别为视频通话数据（如 FaceTime）。<br>utp：伪装成 uTP 数据包，会被识别为 BT 下载数据。<br>wechat-video：伪装成微信视频通话的数据包。<br>dtls：伪装成 DTLS 1.2 数据包。<br>wireguard：伪装成 WireGuard 数据包。(并不是真正的 WireGuard 协议)"
 
diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
index 5a9ffd263d..bcebda3efa 100755
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
@@ -917,7 +917,7 @@ start_haproxy() {
 		haproxy_bin=$(find_bin haproxy)
 		[ -n "$haproxy_bin" ] && {
 			bport=$(config_t_get global_haproxy haproxy_port)
-			cat <<-EOF >$HAPROXY_FILE
+			cat <<-EOF > $HAPROXY_FILE
 				global
 				    log         127.0.0.1 local2
 				    chroot      /usr/bin
@@ -926,6 +926,7 @@ start_haproxy() {
 				    stats socket  $RUN_PID_PATH/haproxy.sock
 				    user        root
 				    daemon
+					
 				defaults
 				    mode                    tcp
 				    log                     global
@@ -943,7 +944,8 @@ start_haproxy() {
 				    timeout http-keep-alive 10s
 				    timeout check           10s
 				    maxconn                 3000
-				listen shadowsocks
+					
+				listen passwall
 				    bind 0.0.0.0:$bport
 				    mode tcp
 			EOF
@@ -958,20 +960,20 @@ start_haproxy() {
 				fi
 				if [ "$bbackup" = "1" ]; then
 					bbackup=" backup"
-					echolog "添加故障转移备服务器$bips"
+					echolog "添加故障转移备服务器:$bips"
 				else
 					bbackup=""
-					echolog "添加负载均衡主服务器$bips"
+					echolog "添加负载均衡主服务器:$bips"
 				fi
-				si=$(echo $bips | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}")
-				if [ -z "$si" ]; then
-					bips=$(resolveip -4 -t 2 $bips | awk 'NR==1{print}')
-					if [ -z "$bips" ]; then
-						bips=$(nslookup $bips localhost | sed '1,4d' | awk '{print $3}' | grep -v : | awk 'NR==1{print}')
-					fi
-					echolog "服务器IP为：$bips"
-				fi
-				echo "    server ss$i $bips:$bports weight $bweight check inter 1500 rise 1 fall 3 $bbackup" >>$HAPROXY_FILE
+				#si=$(echo $bips | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}")
+				#if [ -z "$si" ]; then
+				#	bips=$(resolveip -4 -t 2 $bips | awk 'NR==1{print}')
+				#	if [ -z "$bips" ]; then
+				#		bips=$(nslookup $bips localhost | sed '1,4d' | awk '{print $3}' | grep -v : | awk 'NR==1{print}')
+				#	fi
+				#	echolog "负载均衡${i} IP为：$bips"
+				#fi
+				echo "    server server_$i $bips:$bports weight $bweight check inter 1500 rise 1 fall 3 $bbackup" >> $HAPROXY_FILE
 				if [ "$exports" != "0" ]; then
 					failcount=0
 					while [ "$failcount" -lt "10" ]; do
@@ -996,15 +998,16 @@ start_haproxy() {
 				adminport=$(config_t_get global_haproxy admin_port)
 				adminuser=$(config_t_get global_haproxy admin_user)
 				adminpassword=$(config_t_get global_haproxy admin_password)
-				cat <<-EOF >>$HAPROXY_FILE
+				cat <<-EOF >> $HAPROXY_FILE
+					
 					listen status
-						bind 0.0.0.0:$adminport
-						mode http                   
-						stats refresh 30s
-						stats uri  /  
-						stats auth $adminuser:$adminpassword
-						#stats hide-version
-						stats admin if TRUE
+					    bind 0.0.0.0:$adminport
+					    mode http                   
+					    stats refresh 30s
+					    stats uri  /  
+					    stats auth $adminuser:$adminpassword
+					    #stats hide-version
+					    stats admin if TRUE
 				EOF
 			fi
 			nohup $haproxy_bin -f $HAPROXY_FILE 2>&1