diff --git a/package/lienol/luci-app-passwall/Makefile b/package/lienol/luci-app-passwall/Makefile
index 98b66bf641..1ea690e96f 100644
--- a/package/lienol/luci-app-passwall/Makefile
+++ b/package/lienol/luci-app-passwall/Makefile
@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=3.3
-PKG_RELEASE:=33-20200122
+PKG_RELEASE:=36-20200124
 
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 
@@ -66,7 +66,7 @@ config PACKAGE_$(PKG_NAME)_INCLUDE_pdnsd
 	
 config PACKAGE_$(PKG_NAME)_INCLUDE_dns2socks
 	bool "Include dns2socks"
-	default n
+	default y
 
 endmenu
 endef
@@ -85,6 +85,7 @@ define Package/$(PKG_NAME)
   +PACKAGE_$(PKG_NAME)_INCLUDE_ShadowsocksR_socks:shadowsocksr-libev-ssr-local \
   +PACKAGE_$(PKG_NAME)_INCLUDE_V2ray:v2ray \
   +PACKAGE_$(PKG_NAME)_INCLUDE_Trojan:trojan \
+  +PACKAGE_$(PKG_NAME)_INCLUDE_Trojan:ipt2socks \
   +PACKAGE_$(PKG_NAME)_INCLUDE_Brook:brook \
   +PACKAGE_$(PKG_NAME)_INCLUDE_kcptun:kcptun-client \
   +PACKAGE_$(PKG_NAME)_INCLUDE_haproxy:haproxy \
diff --git a/package/lienol/luci-app-passwall/luasrc/controller/passwall.lua b/package/lienol/luci-app-passwall/luasrc/controller/passwall.lua
index b797a3208b..997dbfdf18 100644
--- a/package/lienol/luci-app-passwall/luasrc/controller/passwall.lua
+++ b/package/lienol/luci-app-passwall/luasrc/controller/passwall.lua
@@ -225,8 +225,7 @@ function check_port()
     local uci = luci.model.uci.cursor()
 
     local retstring = "<br />"
-    retstring = retstring ..
-                    "<font color='red'>暂时不支持UDP检测</font><br />"
+    -- retstring = retstring .. "<font color='red'>暂时不支持UDP检测</font><br />"
 
     if luci.sys.exec("echo -n `uci -q get %s.@global_other[0].use_tcping`" %
                          appname) == "1" and
@@ -239,23 +238,24 @@ function check_port()
             if (s.use_kcp and s.use_kcp == "1" and s.kcp_port) or
                 (s.v2ray_transport and s.v2ray_transport == "mkcp" and s.port) then
             else
-                if s.type and s.address and s.port and s.remarks then
+                local type = s.type
+                if type and type ~= "V2ray_balancing" and s.address and s.port and
+                    s.remarks then
                     node_name = "[%s] [%s:%s]" % {s.remarks, s.address, s.port}
+                    result = luci.sys.exec(
+                                 "echo -n `tcping -q -c 1 -i 1 -p " .. s.port ..
+                                     " " .. s.address ..
+                                     " 2>&1 | grep -o 'time=[0-9]*' | awk -F '=' '{print$2}'`")
+                    if result and result ~= "" then
+                        retstring = retstring .. "<font color='green'>" ..
+                                        node_name .. "   " .. result ..
+                                        "ms.</font><br />"
+                    else
+                        retstring = retstring .. "<font color='red'>" ..
+                                        node_name .. "   Error.</font><br />"
+                    end
+                    ret = ""
                 end
-
-                result = luci.sys.exec("echo -n `tcping -q -c 1 -i 3 -p " ..
-                                           s.port .. " " .. s.address ..
-                                           " 2>&1 | grep -o 'time=[0-9]*' | awk -F '=' '{print$2}'`")
-                if result and result ~= "" then
-                    retstring =
-                        retstring .. "<font color='green'>" .. node_name ..
-                            "   " .. result .. "ms.</font><br />"
-                else
-                    retstring =
-                        retstring .. "<font color='red'>" .. node_name ..
-                            "   Error.</font><br />"
-                end
-                ret = ""
             end
         end)
     else
@@ -268,24 +268,24 @@ function check_port()
             if (s.use_kcp and s.use_kcp == "1" and s.kcp_port) or
                 (s.v2ray_transport and s.v2ray_transport == "mkcp" and s.port) then
             else
-                if s.type and s.address and s.port and s.remarks then
+                local type = s.type
+                if type and type ~= "V2ray_balancing" and s.address and s.port and
+                    s.remarks then
                     node_name = "%s：[%s] %s:%s" %
                                     {s.type, s.remarks, s.address, s.port}
+                    tcp_socket = nixio.socket("inet", "stream")
+                    tcp_socket:setopt("socket", "rcvtimeo", 3)
+                    tcp_socket:setopt("socket", "sndtimeo", 3)
+                    ret = tcp_socket:connect(s.address, s.port)
+                    if tostring(ret) == "true" then
+                        retstring = retstring .. "<font color='green'>" ..
+                                        node_name .. "   OK.</font><br />"
+                    else
+                        retstring = retstring .. "<font color='red'>" ..
+                                        node_name .. "   Error.</font><br />"
+                    end
+                    ret = ""
                 end
-                tcp_socket = nixio.socket("inet", "stream")
-                tcp_socket:setopt("socket", "rcvtimeo", 3)
-                tcp_socket:setopt("socket", "sndtimeo", 3)
-                ret = tcp_socket:connect(s.address, s.port)
-                if tostring(ret) == "true" then
-                    retstring =
-                        retstring .. "<font color='green'>" .. node_name ..
-                            "   OK.</font><br />"
-                else
-                    retstring =
-                        retstring .. "<font color='red'>" .. node_name ..
-                            "   Error.</font><br />"
-                end
-                ret = ""
             end
             if tcp_socket then tcp_socket:close() end
             if udp_socket then udp_socket:close() end
diff --git a/package/lienol/luci-app-passwall/root/etc/config/passwall b/package/lienol/luci-app-passwall/root/etc/config/passwall
index e75dfce1c5..d98b76991a 100644
--- a/package/lienol/luci-app-passwall/root/etc/config/passwall
+++ b/package/lienol/luci-app-passwall/root/etc/config/passwall
@@ -22,7 +22,7 @@ config global_delay
 
 config global_forwarding
 	option udp_redir_ports '1:65535'
-	option tcp_redir_ports '80,443'
+	option tcp_redir_ports '1:65535'
 	option process '1'
 
 config global_proxy
diff --git a/package/lienol/luci-app-passwall/root/etc/config/passwall_rule/blacklist_host b/package/lienol/luci-app-passwall/root/etc/config/passwall_rule/blacklist_host
index 9ea3d6783c..f40e9d7c67 100644
--- a/package/lienol/luci-app-passwall/root/etc/config/passwall_rule/blacklist_host
+++ b/package/lienol/luci-app-passwall/root/etc/config/passwall_rule/blacklist_host
@@ -1,4 +1,5 @@
 formyip.com
-myepisodecalendar.com
-subhd.com
-msi.com
\ No newline at end of file
+msi.com
+github.com
+github.io
+githubusercontent.com
\ No newline at end of file
diff --git a/package/lienol/luci-app-passwall/root/etc/config/passwall_rule/router b/package/lienol/luci-app-passwall/root/etc/config/passwall_rule/router
index f95a840650..75d07845c0 100644
--- a/package/lienol/luci-app-passwall/root/etc/config/passwall_rule/router
+++ b/package/lienol/luci-app-passwall/root/etc/config/passwall_rule/router
@@ -1,7 +1,8 @@
 google.com
 youtube.com
 github.com
-raw.githubusercontent.com
+github.io
+githubusercontent.com
 github-production-release-asset-2e65be.s3.amazonaws.com
 openwrt.proxy.ustclug.org
 easylist-downloads.adblockplus.org
diff --git a/package/lienol/luci-app-passwall/root/etc/uci-defaults/luci-app-passwall b/package/lienol/luci-app-passwall/root/etc/uci-defaults/luci-app-passwall
index b7a1cb7f64..89932c7dd0 100755
--- a/package/lienol/luci-app-passwall/root/etc/uci-defaults/luci-app-passwall
+++ b/package/lienol/luci-app-passwall/root/etc/uci-defaults/luci-app-passwall
@@ -7,6 +7,8 @@ uci -q batch <<-EOF >/dev/null
 	commit ucitrack
 EOF
 
-killall -9 kcptun haproxy shadowsocks-libev shadowsocksr-libev
+echo "" > /etc/dnsmasq.conf
+killall -q -9 kcptun haproxy shadowsocks-libev shadowsocksr-libev
+/etc/init.d/haproxy disable && /etc/init.d/haproxy stop
 rm -f /tmp/luci-indexcache
 exit 0
diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
index 7d7f747a33..122866fe59 100755
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
@@ -23,7 +23,7 @@ APP_PATH=/usr/share/$CONFIG
 TMP_DNSMASQ_PATH=/var/etc/dnsmasq-passwall.d
 DNSMASQ_PATH=/etc/dnsmasq.d
 RESOLVFILE=/tmp/resolv.conf.d/resolv.conf.auto
-lanip=$(uci get network.lan.ipaddr)
+lanip=$(uci -q get network.lan.ipaddr)
 DNS_PORT=7913
 API_GEN_V2RAY=/usr/lib/lua/luci/model/cbi/passwall/api/gen_v2ray_client_config_file.lua
 API_GEN_TROJAN=/usr/lib/lua/luci/model/cbi/passwall/api/gen_trojan_client_config_file.lua
@@ -48,14 +48,14 @@ find_bin() {
 }
 
 config_n_get() {
-	local ret=$(uci get $CONFIG.$1.$2 2>/dev/null)
+	local ret=$(uci -q get $CONFIG.$1.$2 2>/dev/null)
 	echo ${ret:=$3}
 }
 
 config_t_get() {
 	local index=0
 	[ -n "$4" ] && index=$4
-	local ret=$(uci get $CONFIG.@$1[$index].$2 2>/dev/null)
+	local ret=$(uci -q get $CONFIG.@$1[$index].$2 2>/dev/null)
 	echo ${ret:=$3}
 }
 
@@ -78,10 +78,10 @@ get_host_ip() {
 	if [ -z "$isip" ]; then
 		vpsrip=""
 		if [ "$use_ipv6" == "1" ]; then
-			vpsrip=$(resolveip -6 -t 2 $host | awk 'NR==1{print}')
+			vpsrip=$(resolveip -6 -t 3 $host | awk 'NR==1{print}')
 			[ -z "$vpsrip" ] && vpsrip=$(dig @208.67.222.222 $host AAAA 2>/dev/null | grep 'IN' | awk -F ' ' '{print $5}' | grep -E "([a-f0-9]{1,4}(:[a-f0-9]{1,4}){7}|[a-f0-9]{1,4}(:[a-f0-9]{1,4}){0,7}::[a-f0-9]{0,4}(:[a-f0-9]{1,4}){0,7})" | head -n1)
 		else
-			vpsrip=$(resolveip -4 -t 2 $host | awk 'NR==1{print}')
+			vpsrip=$(resolveip -4 -t 3 $host | awk 'NR==1{print}')
 			[ -z "$vpsrip" ] && vpsrip=$(dig @208.67.222.222 $host 2>/dev/null | grep 'IN' | awk -F ' ' '{print $5}' | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}" | head -n1)
 		fi
 		ip=$vpsrip
@@ -94,11 +94,11 @@ check_port_exists() {
 	protocol=$2
 	result=
 	if [ "$protocol" = "tcp" ]; then
-		result=$(netstat -tlpn | grep "\<$port\>")
+		result=$(netstat -tln | grep -c ":$port")
 	elif [ "$protocol" = "udp" ]; then
-		result=$(netstat -ulpn | grep "\<$port\>")
+		result=$(netstat -uln | grep -c ":$port")
 	fi
-	if [ -n "$result" ]; then
+	if [ "$result" = 1 ]; then
 		echo 1
 	else
 		echo 0
@@ -805,7 +805,7 @@ add_dnsmasq() {
 	# sed -i '/except-interface/d' /etc/dnsmasq.conf >/dev/null 2>&1 &
 	# for wanname in $(cat /var/state/network |grep pppoe|awk -F '.' '{print $2}')
 	# do
-	# echo "except-interface=$(uci get network.$wanname.ifname)" >>/etc/dnsmasq.conf
+	# echo "except-interface=$(uci -q get network.$wanname.ifname)" >>/etc/dnsmasq.conf
 	# done
 	# fi
 
@@ -842,7 +842,6 @@ add_dnsmasq() {
 		rm -rf $TMP_DNSMASQ_PATH/whitelist_host.conf
 	fi
 
-	echo "" > /etc/dnsmasq.conf
 	server="server=127.0.0.1#$DNS_PORT"
 	[ "$DNS_MODE" != "chinadns-ng" ] && {
 		local china_dns1=$(echo $UP_CHINA_DNS | awk -F "," '{print $1}')
@@ -859,7 +858,7 @@ add_dnsmasq() {
 	EOF
 	cp -rf /var/dnsmasq.d/dnsmasq-$CONFIG.conf $DNSMASQ_PATH/dnsmasq-$CONFIG.conf
 	echolog "dnsmasq：生成配置文件并重启服务。"
-	/etc/init.d/dnsmasq restart 2>/dev/null
+	/etc/init.d/dnsmasq restart >/dev/null 2>&1 &
 }
 
 gen_redsocks_config() {
@@ -1005,7 +1004,7 @@ stop_dnsmasq() {
 	rm -rf /var/dnsmasq.d/dnsmasq-$CONFIG.conf
 	rm -rf $DNSMASQ_PATH/dnsmasq-$CONFIG.conf
 	rm -rf $TMP_DNSMASQ_PATH
-	/etc/init.d/dnsmasq restart 2>/dev/null
+	/etc/init.d/dnsmasq restart >/dev/null 2>&1 &
 }
 
 start_haproxy() {
@@ -1147,7 +1146,6 @@ start() {
 	start_redir TCP REDIR tcp
 	start_redir UDP REDIR udp
 	source $APP_PATH/iptables.sh start
-	/etc/init.d/dnsmasq restart >/dev/null 2>&1 &
 	start_crontab
 	set_cru
 	rm -f "$LOCK_FILE"
diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh
index e32c2829d9..fb2b5d6eb8 100755
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh
@@ -244,12 +244,14 @@ add_firewall_rule() {
 	$iptables_nat -A PSW $(dst $IPSET_VPSIPLIST) -j RETURN
 	$iptables_nat -A PSW $(dst $IPSET_WHITELIST) -j RETURN
 	$iptables_nat -N PSW_ACL
+	$iptables_nat -N PSW_OUTPUT
 
 	$iptables_mangle -N PSW
 	$iptables_mangle -A PSW $(dst $IPSET_LANIPLIST) -j RETURN
 	$iptables_mangle -A PSW $(dst $IPSET_VPSIPLIST) -j RETURN
 	$iptables_mangle -A PSW $(dst $IPSET_WHITELIST) -j RETURN
 	$iptables_mangle -N PSW_ACL
+	$iptables_mangle -N PSW_OUTPUT
 
 	if [[ "$TCP_NODE_NUM" -ge 1 ]] || [[ "$UDP_NODE_NUM" -ge 1 ]]; then
 		local max_num=1
@@ -322,7 +324,7 @@ add_firewall_rule() {
 
 					# 用于本机流量转发，默认只走router
 					$iptables_mangle -A PSW -s $lan_ip -p tcp $(dst $IPSET_ROUTER) -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
-					$iptables_mangle -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_ROUTER) $iptables_comment -j MARK --set-mark 1
+					$iptables_mangle -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_ROUTER) -j MARK --set-mark 1
 				else
 					# 全局模式
 					$iptables_nat -A PSW_GLO$k -p tcp -j REDIRECT --to-ports $local_port
@@ -382,27 +384,27 @@ add_firewall_rule() {
 							fi
 							$iptables_nat -I PREROUTING $PR_INDEX -j PSW
 						fi
-						# 用于本机流量转发，默认只走router
-						#$iptables_nat -I OUTPUT -j PSW
-						$iptables_nat -A OUTPUT $(dst $IPSET_LANIPLIST) $iptables_comment -j RETURN
+						# 用于本机流量转发
+						$iptables_nat -A OUTPUT -j PSW_OUTPUT
+						$iptables_nat -A PSW_OUTPUT $(dst $IPSET_LANIPLIST) -j RETURN
 						[ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && {
 							for dns in $DNS_FORWARD
 							do
 								local dns_ip=$(echo $dns | awk -F "#" '{print $1}')
 								local dns_port=$(echo $dns | awk -F "#" '{print $2}')
 								[ -z "$dns_port" ] && dns_port=53
-								$iptables_nat -A OUTPUT -p tcp -d $dns_ip --dport $dns_port $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
+								$iptables_nat -A PSW_OUTPUT -p tcp -d $dns_ip --dport $dns_port -j REDIRECT --to-ports $TCP_REDIR_PORT1
 							done
 						}
-						$iptables_nat -A OUTPUT $(dst $IPSET_VPSIPLIST) $iptables_comment -j RETURN
-						$iptables_nat -A OUTPUT $(dst $IPSET_WHITELIST) $iptables_comment -j RETURN
-						$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_ROUTER) $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
-						$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_BLACKLIST) $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
+						$iptables_nat -A PSW_OUTPUT $(dst $IPSET_VPSIPLIST) -j RETURN
+						$iptables_nat -A PSW_OUTPUT $(dst $IPSET_WHITELIST) -j RETURN
+						$iptables_nat -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_ROUTER) -j REDIRECT --to-ports $TCP_REDIR_PORT1
+						$iptables_nat -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_BLACKLIST) -j REDIRECT --to-ports $TCP_REDIR_PORT1
 
-						[ "$LOCALHOST_PROXY_MODE" == "global" ] && $iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
-						[ "$LOCALHOST_PROXY_MODE" == "gfwlist" ] && $iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_GFW) $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
+						[ "$LOCALHOST_PROXY_MODE" == "global" ] && $iptables_nat -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -j REDIRECT --to-ports $TCP_REDIR_PORT1
+						[ "$LOCALHOST_PROXY_MODE" == "gfwlist" ] && $iptables_nat -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS $(dst $IPSET_GFW) -j REDIRECT --to-ports $TCP_REDIR_PORT1
 						[ "$LOCALHOST_PROXY_MODE" == "chnroute" ] && {
-							$iptables_nat -A OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set ! --match-set $IPSET_CHN dst $iptables_comment -j REDIRECT --to-ports $TCP_REDIR_PORT1
+							$iptables_nat -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_REDIR_PORTS -m set ! --match-set $IPSET_CHN dst -j REDIRECT --to-ports $TCP_REDIR_PORT1
 						}
 					}
 					# 重定所有流量到透明代理端口
@@ -467,27 +469,28 @@ add_firewall_rule() {
 				$iptables_mangle -A PSW_GAME$k -p udp $(dst $IPSET_CHN) -j RETURN
 				$iptables_mangle -A PSW_GAME$k -p udp -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
 				
-				# 用于本机流量转发，默认只走router
-				$iptables_mangle -A OUTPUT -p udp $(dst $IPSET_LANIPLIST) $iptables_comment -j RETURN
+				# 用于本机流量转发
+				$iptables_mangle -A OUTPUT -j PSW_OUTPUT
+				$iptables_mangle -A PSW_OUTPUT -p udp $(dst $IPSET_LANIPLIST) -j RETURN
 				[ "$use_udp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && {
 					for dns in $DNS_FORWARD
 					do
 						local dns_ip=$(echo $dns | awk -F "#" '{print $1}')
 						local dns_port=$(echo $dns | awk -F "#" '{print $2}')
 						[ -z "$dns_port" ] && dns_port=53
-						$iptables_mangle -A OUTPUT -p udp -d $dns_ip --dport $dns_port $iptables_comment -j MARK --set-mark 1
-						$iptables_mangle -I PSW 2 -p udp -d $dns_ip --dport $dns_port $iptables_comment -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
+						$iptables_mangle -A PSW_OUTPUT -p udp -d $dns_ip --dport $dns_port -j MARK --set-mark 1
+						$iptables_mangle -I PSW 2 -p udp -d $dns_ip --dport $dns_port -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port
 					done
 				}
-				$iptables_mangle -A OUTPUT -p udp $(dst $IPSET_VPSIPLIST) $iptables_comment -j RETURN
-				$iptables_mangle -A OUTPUT -p udp $(dst $IPSET_WHITELIST) $iptables_comment -j RETURN
-				$iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_ROUTER) $iptables_comment -j MARK --set-mark 1
-				$iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_BLACKLIST) $iptables_comment -j MARK --set-mark 1
+				$iptables_mangle -A PSW_OUTPUT -p udp $(dst $IPSET_VPSIPLIST) -j RETURN
+				$iptables_mangle -A PSW_OUTPUT -p udp $(dst $IPSET_WHITELIST) -j RETURN
+				$iptables_mangle -A PSW_OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_ROUTER) -j MARK --set-mark 1
+				$iptables_mangle -A PSW_OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_BLACKLIST) -j MARK --set-mark 1
 
-				[ "$LOCALHOST_PROXY_MODE" == "global" ] && $iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $iptables_comment -j MARK --set-mark 1
-				[ "$LOCALHOST_PROXY_MODE" == "gfwlist" ] && $iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_GFW) $iptables_comment -j MARK --set-mark 1
+				[ "$LOCALHOST_PROXY_MODE" == "global" ] && $iptables_mangle -A PSW_OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS -j MARK --set-mark 1
+				[ "$LOCALHOST_PROXY_MODE" == "gfwlist" ] && $iptables_mangle -A PSW_OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS $(dst $IPSET_GFW) -j MARK --set-mark 1
 				[ "$LOCALHOST_PROXY_MODE" == "chnroute" ] && {
-					$iptables_mangle -A OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS -m set ! --match-set $IPSET_CHN dst $iptables_comment -j MARK --set-mark 1
+					$iptables_mangle -A PSW_OUTPUT -p udp -m multiport --dport $UDP_REDIR_PORTS -m set ! --match-set $IPSET_CHN dst -j MARK --set-mark 1
 				}
 
 				echolog "IPv4 防火墙UDP转发规则加载完成！"
@@ -505,9 +508,9 @@ add_firewall_rule() {
 			local ip=$(echo $balancing_node | awk -F ":" '{print $1}')
 			local port=$(echo $balancing_node | awk -F ":" '{print $2}')
 			$iptables_nat -I PSW 2 -p tcp -d $ip --dport $port -j RETURN
-			$iptables_nat -I OUTPUT 2 -p tcp -d $ip --dport $port $iptables_comment -j RETURN
+			$iptables_nat -I PSW_OUTPUT 2 -p tcp -d $ip --dport $port -j RETURN
 			$iptables_mangle -I PSW 2 -p udp -d $ip --dport $port -j RETURN
-			$iptables_mangle -I OUTPUT 2 -p udp -d $ip --dport $port $iptables_comment -j RETURN
+			$iptables_mangle -I PSW_OUTPUT 2 -p udp -d $ip --dport $port -j RETURN
 		done
 	fi
 
@@ -534,30 +537,6 @@ add_firewall_rule() {
 
 del_firewall_rule() {
 	echolog "删除所有防火墙规则..."
-	ipv4_output_exist=$($iptables_nat -L OUTPUT 2>/dev/null | grep -c -E "PassWall")
-	[ -n "$ipv4_output_exist" ] && {
-		until [ "$ipv4_output_exist" = 0 ]; do
-			rules=$($iptables_nat -L OUTPUT --line-numbers | grep -E "PassWall" | awk '{print $1}')
-			for rule in $rules; do
-				$iptables_nat -D OUTPUT $rule 2>/dev/null
-				break
-			done
-			ipv4_output_exist=$(expr $ipv4_output_exist - 1)
-		done
-	}
-	
-	ipv4_output_exist=$($iptables_mangle -L OUTPUT 2>/dev/null | grep -c -E "PassWall")
-	[ -n "$ipv4_output_exist" ] && {
-		until [ "$ipv4_output_exist" = 0 ]; do
-			rules=$($iptables_mangle -L OUTPUT --line-numbers | grep -E "PassWall" | awk '{print $1}')
-			for rule in $rules; do
-				$iptables_mangle -D OUTPUT $rule 2>/dev/null
-				break
-			done
-			ipv4_output_exist=$(expr $ipv4_output_exist - 1)
-		done
-	}
-
 	ipv6_output_ss_exist=$($ip6tables_nat -L OUTPUT 2>/dev/null | grep -c "PSW")
 	[ -n "$ipv6_output_ss_exist" ] && {
 		until [ "$ipv6_output_ss_exist" = 0 ]; do
@@ -571,16 +550,22 @@ del_firewall_rule() {
 	}
 
 	$iptables_nat -D PREROUTING -j PSW 2>/dev/null
+	$iptables_nat -D OUTPUT -j PSW_OUTPUT 2>/dev/null
 	$iptables_nat -F PSW 2>/dev/null && $iptables_nat -X PSW 2>/dev/null
 	$iptables_nat -F PSW_ACL 2>/dev/null && $iptables_nat -X PSW_ACL 2>/dev/null
+	$iptables_nat -F PSW_OUTPUT 2>/dev/null && $iptables_nat -X PSW_OUTPUT 2>/dev/null
 	
-	$iptables_mangle -D PREROUTING -j PSW$k 2>/dev/null
+	$iptables_mangle -D PREROUTING -j PSW 2>/dev/null
+	$iptables_mangle -D OUTPUT -j PSW_OUTPUT 2>/dev/null
 	$iptables_mangle -F PSW 2>/dev/null && $iptables_mangle -X PSW 2>/dev/null
 	$iptables_mangle -F PSW_ACL 2>/dev/null && $iptables_mangle -X PSW_ACL 2>/dev/null
+	$iptables_mangle -F PSW_OUTPUT 2>/dev/null && $iptables_mangle -X PSW_OUTPUT 2>/dev/null
 
 	$ip6tables_nat -D PREROUTING -j PSW 2>/dev/null
+	$ip6tables_nat -D OUTPUT -j PSW_OUTPUT 2>/dev/null
 	$ip6tables_nat -F PSW 2>/dev/null && $ip6tables_nat -X PSW 2>/dev/null
 	$ip6tables_nat -F PSW_ACL 2>/dev/null && $ip6tables_nat -X PSW_ACL 2>/dev/null
+	$ip6tables_nat -F PSW_OUTPUT 2>/dev/null && $ip6tables_nat -X PSW_OUTPUT 2>/dev/null
 
 	local max_num=5
 	if [ "$max_num" -ge 1 ]; then
diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/monitor.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/monitor.sh
index 6f8bc69ef6..f767d9fa92 100755
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/monitor.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/monitor.sh
@@ -4,14 +4,14 @@ CONFIG=passwall
 CONFIG_PATH=/var/etc/$CONFIG
 
 config_n_get() {
-	local ret=$(uci get $CONFIG.$1.$2 2>/dev/null)
+	local ret=$(uci -q get $CONFIG.$1.$2 2>/dev/null)
 	echo ${ret:=$3}
 }
 
 config_t_get() {
 	local index=0
 	[ -n "$4" ] && index=$4
-	local ret=$(uci get $CONFIG.@$1[$index].$2 2>/dev/null)
+	local ret=$(uci -q get $CONFIG.@$1[$index].$2 2>/dev/null)
 	echo ${ret:=$3}
 }
 
diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/rule_update.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/rule_update.sh
index b612df6e5c..4117ed9cec 100755
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/rule_update.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/rule_update.sh
@@ -15,9 +15,9 @@ if [ -n "$update" ]; then
 	[ -n "$(echo $update | grep "chnroute_update")" ] && chnroute_update=1
 	[ -n "$(echo $update | grep "chnlist_update")" ] && chnlist_update=1
 else
-	gfwlist_update=$(uci get $CONFIG.@global_rules[0].gfwlist_update)
-	chnroute_update=$(uci get $CONFIG.@global_rules[0].chnroute_update)
-	chnlist_update=$(uci get $CONFIG.@global_rules[0].chnlist_update)
+	gfwlist_update=$(uci -q get $CONFIG.@global_rules[0].gfwlist_update)
+	chnroute_update=$(uci -q get $CONFIG.@global_rules[0].chnroute_update)
+	chnlist_update=$(uci -q get $CONFIG.@global_rules[0].chnlist_update)
 fi
 
 if [ "$gfwlist_update" == 0 -a "$chnroute_update" == 0 -a "$chnlist_update" == 0 ]; then
@@ -29,7 +29,7 @@ uci_get_by_type() {
 	if [ -n $4 ]; then
 		index=$4
 	fi
-	local ret=$(uci get $CONFIG.@$1[$index].$2 2>/dev/null)
+	local ret=$(uci -q get $CONFIG.@$1[$index].$2 2>/dev/null)
 	echo ${ret:=$3}
 }
 
diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/subscription.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/subscription.sh
index 60a9721427..2f570c6686 100755
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/subscription.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/subscription.sh
@@ -11,7 +11,7 @@ LOG_FILE=/var/log/$CONFIG.log
 config_t_get() {
 	local index=0
 	[ -n "$3" ] && index=$3
-	local ret=$(uci get $CONFIG.@$1[$index].$2 2>/dev/null)
+	local ret=$(uci -q get $CONFIG.@$1[$index].$2 2>/dev/null)
 	#echo ${ret:=$3}
 	echo $ret
 }
@@ -413,7 +413,7 @@ del_config(){
 		[ "`cat /usr/share/${CONFIG}/sub/all_onlinenodes |grep -c "$localaddress"`" -eq 0 ] && {
 			for localindex in $(uci show $CONFIG | grep -w "$localaddress" | grep -w "address=" |cut -d '[' -f2|cut -d ']' -f1)
 			do
-				del_type=$(uci get $CONFIG.@nodes[$localindex].type)
+				del_type=$(uci -q get $CONFIG.@nodes[$localindex].type)
 				uci delete $CONFIG.@nodes[$localindex]
 				uci commit $CONFIG
 				if [ "$del_type" == "SS" ]; then
@@ -434,17 +434,20 @@ del_config(){
 del_all_config(){
 	get_node_index
 	[ "`uci show $CONFIG | grep -c 'is_sub'`" -eq 0 ] && exit 0
-	TCP_NODE_NUM=$(uci get $CONFIG.@global_other[0].tcp_node_num)
+	TCP_NODE_NUM=$(uci -q get $CONFIG.@global_other[0].tcp_node_num)
+	[ -z "$TCP_NODE_NUM" ] && TCP_NODE_NUM=1
 	for i in $(seq 1 $TCP_NODE_NUM); do
 		eval TCP_NODE$i=$(config_t_get global tcp_node$i)
 	done
 
-	UDP_NODE_NUM=$(uci get $CONFIG.@global_other[0].udp_node_num)
+	UDP_NODE_NUM=$(uci -q get $CONFIG.@global_other[0].udp_node_num)
+	[ -z "$UDP_NODE_NUM" ] && UDP_NODE_NUM=1
 	for i in $(seq 1 $UDP_NODE_NUM); do
 		eval UDP_NODE$i=$(config_t_get global udp_node$i)
 	done
 
-	SOCKS5_NODE_NUM=$(uci get $CONFIG.@global_other[0].socks5_node_num)
+	SOCKS5_NODE_NUM=$(uci -q get $CONFIG.@global_other[0].socks5_node_num)
+	[ -z "$SOCKS5_NODE_NUM" ] && SOCKS5_NODE_NUM=1
 	for i in $(seq 1 $SOCKS5_NODE_NUM); do
 		eval SOCKS5_NODE$i=$(config_t_get global socks5_node$i)
 	done
diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/test.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/test.sh
index 13df42f446..366b4aff6f 100755
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/test.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/test.sh
@@ -56,7 +56,7 @@ test_auto_switch() {
 			let "failcount++"
 			[ "$failcount" -ge 5 ] && {
 				echolog "自动切换检测：检测异常，切换节点"
-				TCP_NODES=$(uci get $CONFIG.@auto_switch[0].tcp_node)
+				TCP_NODES=$(uci -q get $CONFIG.@auto_switch[0].tcp_node)
 				has_backup_server=$(echo $TCP_NODES | grep $TCP_NODES1)
 				setserver=
 				if [ -z "$has_backup_server" ]; then