OpenClash: bump to 0.40.10

2020-10-17 18:47:08 +08:00 · 2020-10-17 18:47:08 +08:00 · c1a84142ae
commit c1a84142ae
parent 566f57591d
27 changed files with 545 additions and 516 deletions
--- a/package/ctcgfw/luci-app-openclash/Makefile
+++ b/package/ctcgfw/luci-app-openclash/Makefile
@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-openclash
-PKG_VERSION:=0.40.7
+PKG_VERSION:=0.40.10
 PKG_RELEASE:=beta
 PKG_MAINTAINER:=vernesong <https://github.com/vernesong/OpenClash>

@ -9,12 +9,16 @@ PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)

 include $(INCLUDE_DIR)/package.mk

+define Package/$(PKG_NAME)/config
+	select PACKAGE_libcap-bin
+endef
+
 define Package/$(PKG_NAME)
 	CATEGORY:=LuCI
 	SUBMENU:=3. Applications
 	TITLE:=LuCI support for clash
 	PKGARCH:=all
-	DEPENDS:=+iptables +dnsmasq-full +coreutils +coreutils-nohup +bash +curl +jsonfilter +ca-certificates +ipset +ip-full +iptables-mod-tproxy
+	DEPENDS:=+iptables +dnsmasq-full +coreutils +coreutils-nohup +bash +curl +jsonfilter +ca-certificates +ipset +ip-full +iptables-mod-tproxy +iptables-mod-extra +libcap
 	MAINTAINER:=vernesong
 endef

@ -95,4 +99,4 @@ define Package/$(PKG_NAME)/install
 	$(CP) $(PKG_BUILD_DIR)/luasrc/* $(1)/usr/lib/lua/luci/
 endef

-$(eval $(call BuildPackage,$(PKG_NAME)))
+$(eval $(call BuildPackage,$(PKG_NAME)))
--- a/package/ctcgfw/luci-app-openclash/luasrc/model/cbi/openclash/servers-config.lua
+++ b/package/ctcgfw/luci-app-openclash/luasrc/model/cbi/openclash/servers-config.lua
@ -261,7 +261,7 @@ o:depends("type", "http")
 o:depends("type", "trojan")

 -- [[ TLS ]]--
-o = s:option(ListValue, "tls", translate("TLS"))
+o = s:option(ListValue, "tls", translate("tls"))
 o.rmempty = true
 o.default = "false"
 o:value("true")
@ -273,8 +273,9 @@ o:depends("obfs_vmess", "http")
 o:depends("type", "socks5")
 o:depends("type", "http")

-o = s:option(Value, "servername", translate("TLS Custom Host"))
+o = s:option(Value, "servername", translate("sni"))
 o.rmempty = true
+o.datatype = "host"
 o.placeholder = translate("example.com")
 o:depends("obfs_vmess", "websocket")

@ -285,18 +286,6 @@ o:value("true")
 o:value("false")
 o:depends("obfs_vmess", "http")

-- 验证用户名
-o = s:option(Value, "auth_name", translate("Auth Username"))
-o:depends("type", "socks5")
-o:depends("type", "http")
-o.rmempty = true
-
-- 验证密码
-o = s:option(Value, "auth_pass", translate("Auth Password"))
-o:depends("type", "socks5")
-o:depends("type", "http")
-o.rmempty = true
-
 -- [[ MUX ]]--
 o = s:option(ListValue, "mux", translate("mux"))
 o.rmempty = true
@ -311,6 +300,19 @@ o.datatype = "host"
 o.placeholder = translate("example.com")
 o.rmempty = true
 o:depends("type", "trojan")
+o:depends("type", "http")
+
+-- 验证用户名
+o = s:option(Value, "auth_name", translate("Auth Username"))
+o:depends("type", "socks5")
+o:depends("type", "http")
+o.rmempty = true
+
+-- 验证密码
+o = s:option(Value, "auth_pass", translate("Auth Password"))
+o:depends("type", "socks5")
+o:depends("type", "http")
+o.rmempty = true

 -- [[ alpn ]]--
 o = s:option(DynamicList, "alpn", translate("alpn"))
--- a/package/ctcgfw/luci-app-openclash/po/zh-cn/openclash.zh-cn.po
+++ b/package/ctcgfw/luci-app-openclash/po/zh-cn/openclash.zh-cn.po
@ -132,7 +132,7 @@ msgid "fake-ip-mix(tun mix mode)"
 msgstr "Fake-IP（TUN-混合）模式【依赖kmod-tun】【UDP-TUN，TCP-转发】"

 msgid "Select Mode For OpenClash Work, Try Flush DNS Cache If Network Error"
-msgstr "选择运行模式，Redir-Host模式下无法代理路由器自身流量，如客户端的网络异常请尝试清除DNS缓存"
+msgstr "选择运行模式，如客户端的网络异常请尝试清除DNS缓存"

 msgid "Proxy Mode"
 msgstr "*代理模式"
--- a/package/ctcgfw/luci-app-openclash/root/etc/init.d/openclash
+++ b/package/ctcgfw/luci-app-openclash/root/etc/init.d/openclash
@ -94,13 +94,15 @@ revert_dns() {
      uci delete dhcp.@dnsmasq[0].cachesize >/dev/null 2>&1
   }
   
-   if [ -s "/tmp/resolv.conf.d/resolv.conf.auto" ]; then
-      uci set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.d/resolv.conf.auto >/dev/null 2>&1
-   elif [ -s "/tmp/resolv.conf.auto" ]; then
-      uci set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.auto >/dev/null 2>&1
-   fi
-   uci set dhcp.@dnsmasq[0].noresolv=0 >/dev/null 2>&1
-
+   [ "$1" -eq 1 ] && {
+      if [ -s "/tmp/resolv.conf.d/resolv.conf.auto" ]; then
+         uci set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.d/resolv.conf.auto >/dev/null 2>&1
+      elif [ -s "/tmp/resolv.conf.auto" ]; then
+         uci set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.auto >/dev/null 2>&1
+      fi
+      uci set dhcp.@dnsmasq[0].noresolv=0 >/dev/null 2>&1
+   }
+   
   uci commit dhcp
   uci commit openclash
   rm -rf /tmp/dnsmasq.d/dnsmasq_openclash.conf >/dev/null 2>&1
@ -137,16 +139,7 @@ cat "$CHANGE_FILE" "$DNS_FILE" "$PROXY_PROVIDER_FILE" "$PROXY_FILE" "$GROUP_FILE

 yml_check()
 {
-   #格式替换
-   sed -i 's/\t/ /g' "$3" 2>/dev/null
-   sed -i "s/- \{2,\}/- /g" "$3" 2>/dev/null
-   sed -i "s/^\.\.\.$//g" "$3" 2>/dev/null
-   sed -i "s/^---$//g" "$3" 2>/dev/null
-   sed -i "s/^ \{1,\}dns:/dns:/g" "$3" 2>/dev/null
-
-   #检查关键字避免后续操作出错
-   /usr/share/openclash/yml_field_name_ch.sh "$3" 2>/dev/null
-
+	
   #创建启动备份
   cp "$3" "$5"
   
@ -154,6 +147,17 @@ yml_check()
   if [ ! -f "$4" ]; then
      cp "$3" "$4"
   fi
+   
+   #格式替换
+   sed -i 's/\t/ /g' "$3" 2>/dev/null
+   sed -i "s/- \{2,\}/- /g" "$3" 2>/dev/null
+   sed -i "s/^\.\.\.$//g" "$3" 2>/dev/null
+   sed -i "s/^---$//g" "$3" 2>/dev/null
+   sed -i "s/^ \{1,\}dns:/dns:/g" "$3" 2>/dev/null
+   sed -i '/OpenClash-General/d' "$3" 2>/dev/null
+
+   #检查关键字避免后续操作出错
+   /usr/share/openclash/yml_field_name_ch.sh "$3" 2>/dev/null

   #取出general部分
   /usr/share/openclash/yml_field_cut.sh "general" "$CHANGE_FILE" "$3"
@ -162,6 +166,11 @@ yml_check()
   nameserver_len=$(sed -n '/^ \{0,\}nameserver:/=' "$3" 2>/dev/null)
   if [ -n "$nameserver_len" ]; then
      /usr/share/openclash/yml_field_cut.sh "$nameserver_len" "$DNS_FILE" "$3"
+   else
+      fallback_len=$(sed -n '/^ \{0,\}fallback:/=' "$3" 2>/dev/null)
+      if [ -n "$fallback_len" ]; then
+   	     /usr/share/openclash/yml_field_cut.sh "$fallback_len" "$DNS_FILE" "$3"
+   	  fi
   fi 2>/dev/null
   
   #取出proxy部分
@ -243,65 +252,10 @@ yml_check()
      /usr/share/openclash/yml_field_cut.sh "$rule_bak_len" "$RULE_BAK_FILE" "$4"
   fi 2>/dev/null
   
-   #自定义DNS还原
-   if [ "$(grep -c '##Custom DNS##' "$CHANGE_FILE")" -gt 0 ] || [ "$(grep -c '##Custom DNS##' "$DNS_FILE")" -gt 0 ]; then
-      if [ "$2" = 0 ] && [ -f "$4" ]; then
-         #取出dns备份
-         nameserver_len=$(sed -n '/^ \{0,\}nameserver:/=' "$4" 2>/dev/null)
-         if [ -n "$nameserver_len" ]; then
-            /usr/share/openclash/yml_field_cut.sh "$nameserver_len" "/tmp/backdns.config" "$4" "dns"
-         fi 2>/dev/null
-         sed -i '/^ \{0,\}nameserver:/,$d' "$DNS_FILE" 2>/dev/null
-         sed -i '/##Custom DNS##/d' "$CHANGE_FILE" 2>/dev/null
-         cat "/tmp/backdns.config" >> "$DNS_FILE"
-         rm -rf /tmp/backdns.config 2>/dev/null
-      fi
-   fi 2>/dev/null
-
-}
-
-#检查DNS设置
-yml_dns_check()
-{
-
+   #检查DNS字段
   if [ -z "$(grep '^dns:' "$CHANGE_FILE")" ]; then
      echo "dns:" >> "$CHANGE_FILE" 2>/dev/null
   fi
-
-   if [ -z "$(grep '^ \{0,\}nameserver:' "$DNS_FILE")" ]; then
-      echo "  nameserver:" > "$DNS_FILE" 2>/dev/null
-      cat >> "$DNS_FILE" <<-EOF
-  - 114.114.114.114
-  - 119.29.29.29
-  fallback:
-  - https://cloudflare-dns.com/dns-query
-  - https://dns.google/dns-query
-  - https://1.1.1.1/dns-query
-  - tls://8.8.8.8:853
-EOF
-   fi
-
-   dns_port=$(grep "^ \{0,\}listen:" "$CHANGE_FILE" |awk -F ':' '{print $3}' |awk -F '#' '{print $1}' |tr -cd "[0-9]" 2>/dev/null)
-   if [ -z "$dns_port" ] || [ "$dns_port" -eq 53 ]; then
-      dns_port=7874
-   fi
-
-   if [ -n "$(grep "^ \{0,\}listen:" "$CHANGE_FILE")" ]; then
-      if [ "$ipv6_enable" != "1" ]; then
-         sed -i "/^ \{0,\}listen:/c\  listen: 127.0.0.1:${dns_port}" "$CHANGE_FILE" 2>/dev/null
-      else
-         sed -i "/^ \{0,\}listen:/c\  listen: 0.0.0.0:${dns_port}" "$CHANGE_FILE" 2>/dev/null
-      fi
-   else
-      if [ "$ipv6_enable" != "1" ]; then
-         sed -i "/^dns:/a\  listen: 127.0.0.1:${dns_port}" "$CHANGE_FILE" 2>/dev/null
-      else
-         sed -i "/^dns:/a\  listen: 0.0.0.0:${dns_port}" "$CHANGE_FILE" 2>/dev/null
-      fi
-   fi 2>/dev/null
-   
-   #保存DNS端口方便后续调用
-   uci set openclash.config.dns_port="$dns_port" && uci commit openclash
   
   #检查general部分的缩进
   if [ -n "$(grep "^ \{1,\}port:" "$CHANGE_FILE")" ] || [ -n "$(grep "^ \{1,\}mode:" "$CHANGE_FILE")" ] || [ -n "$(grep "^ \{1,\}log-level:" "$CHANGE_FILE")" ]; then
@ -311,10 +265,53 @@ EOF
      sed -n '/^dns:/,$p' "$CHANGE_FILE" >> /tmp/config.check 2>/dev/null
      mv /tmp/config.check "$CHANGE_FILE" 2>/dev/null
   fi
+   
+   #自定义DNS还原
+   if [ "$(grep -c '##Custom DNS##' "$CHANGE_FILE")" -gt 0 ] || [ "$(grep -c '##Custom DNS##' "$DNS_FILE")" -gt 0 ]; then
+      if [ "$2" = 0 ] && [ -f "$4" ]; then
+         #取出dns备份
+         nameserver_len=$(sed -n '/^ \{0,\}nameserver:/=' "$4" 2>/dev/null)
+         if [ -n "$nameserver_len" ]; then
+            /usr/share/openclash/yml_field_cut.sh "$nameserver_len" "/tmp/backdns.config" "$4"
+         else
+            fallback_len=$(sed -n '/^ \{0,\}fallback:/=' "$3" 2>/dev/null)
+            if [ -n "$fallback_len" ]; then
+               /usr/share/openclash/yml_field_cut.sh "$fallback_len" "/tmp/backdns.config" "$4"
+            fi
+         fi 2>/dev/null
+         rm -rf "$DNS_FILE" 2>/dev/null
+         rm -rf "$FALLBACK_FILTER_FILE" 2>/dev/null
+         sed -i '/##Custom DNS##/d' "$CHANGE_FILE" 2>/dev/null
+         cat "/tmp/backdns.config" >> "$DNS_FILE" 2>/dev/null
+         rm -rf /tmp/backdns.config 2>/dev/null
+      fi
+   fi 2>/dev/null
+   #检查DNS服务
+   if [ -z "$(grep '^ \{0,\}nameserver:' "$DNS_FILE")" ] || [ -z "$(sed '/^ \{0,\}fallback/,$d' "$DNS_FILE" 2>/dev/null |grep '^ \{0,\}- ')" ]; then
+      echo "检测到DNS选项下的Nameserver未设置服务器，开始补全..." >$START_LOG
+      echo "${LOGTIME} Nameserver Option Must Be Setted, Auto Completed" >>$LOG_FILE
+      echo "  nameserver:" > "$DNS_FILE" 2>/dev/null
+      cat >> "$DNS_FILE" <<-EOF
+    - 114.114.114.114
+    - 119.29.29.29
+  fallback:
+    - https://cloudflare-dns.com/dns-query
+    - https://dns.google/dns-query
+    - https://1.1.1.1/dns-query
+    - tls://8.8.8.8:853
+EOF
+   sleep 2
+   fi
+  
+   dns_port=$(grep "^ \{0,\}listen:" "$CHANGE_FILE" |awk -F ':' '{print $3}' |awk -F '#' '{print $1}' |tr -cd "[0-9]" 2>/dev/null)
+   if [ -z "$dns_port" ] || [ "$dns_port" -eq 53 ]; then
+      dns_port=7874
+   fi

+   #保存DNS端口方便后续调用
+   uci set openclash.config.dns_port="$dns_port" && uci commit openclash
+   
   #添加标识
-   sed -i '/OpenClash-General/d' "$DNS_FILE" 2>/dev/null
-   sed -i '/OpenClash-General/d' "$FALLBACK_FILTER_FILE" 2>/dev/null
   echo '#===================== OpenClash-General-Settings =====================#' >> "$FALLBACK_FILTER_FILE" 2>/dev/null
 }

@ -398,10 +395,10 @@ fi
 if [ -z "$(pidof clash)" ] && [ "$provider_path_exist" = 0 ]; then
   if [ "$2" = "proxy_provider" ]; then
      echo "错误: 代理集文件下载失败，请到日志页面查看详细错误信息！" >$START_LOG
-      echo "${LOGTIME} Faild to Download Proxy-Provider File, Please Check The Error Info And Try Again" >> $LOG_FILE
+      echo "${LOGTIME} Error: Faild to Download Proxy-Provider File, Please Check The Error Info And Try Again" >> $LOG_FILE
   else
      echo "错误: 规则集文件下载失败，请到日志页面查看详细错误信息！" >$START_LOG
-      echo "${LOGTIME} Faild to Download Rule-Provider File, Please Check The Error Info And Try Again" >> $LOG_FILE
+      echo "${LOGTIME} Error: Faild to Download Rule-Provider File, Please Check The Error Info And Try Again" >> $LOG_FILE
   fi
   sleep 10
   start_fail
@ -452,12 +449,15 @@ yml_dns_get()

   if [ -n "$group" ]; then
      if [ "$group" = "nameserver" ]; then
-         echo "  $dns_type$dns_address" >>/tmp/config.namedns
+      	 if [ -z "$(grep "nameserver:$" /tmp/config.namedns 2>/dev/null)" ]; then
+            echo "  nameserver:" >/tmp/config.namedns
+         fi
+         echo "    $dns_type$dns_address" >>/tmp/config.namedns
      else
         if [ -z "$(grep "fallback:$" /tmp/config.falldns 2>/dev/null)" ]; then
            echo "  fallback:" >/tmp/config.falldns
         fi
-         echo "  $dns_type$dns_address" >>/tmp/config.falldns
+         echo "    $dns_type$dns_address" >>/tmp/config.falldns
      fi
   else
      return
@ -468,18 +468,26 @@ yml_dns_get()
 yml_dns_custom()
 {
   if [ "$1" = 1 ]; then
-      echo "  nameserver:" >/tmp/config.namedns
-      echo "##Custom DNS##" >> /tmp/config.namedns 2>/dev/null
      config_load "openclash"
      config_foreach yml_dns_get "dns_servers"
-      sed -i '/^ \{0,\}nameserver:/,$d' "$2" 2>/dev/null
-      cat "/tmp/config.namedns" >> "$2" 2>/dev/null
-      cat "/tmp/config.falldns" >> "$2" 2>/dev/null
+      if [ -f "/tmp/config.namedns" ]; then
+         sed -i '/^ \{0,\}nameserver:/,$d' "$2" 2>/dev/null
+         sed -i "/^ \{0,\}nameserver:/a\##Custom DNS##" "/tmp/config.namedns"
+         cat "/tmp/config.namedns" >> "$2" 2>/dev/null
+         cat "/tmp/config.falldns" >> "$2" 2>/dev/null
+      else
+         echo "错误: 配置文件DNS选项下的Nameserver必须设置服务器，已停止设置自定义DNS服务器！" >$START_LOG
+         echo "${LOGTIME} Error: Nameserver Option Must Be Setted, Stop Customing DNS Servers" >>$LOG_FILE
+         sleep 3
+      fi
      rm -rf /tmp/config.namedns 2>/dev/null
      rm -rf /tmp/config.falldns 2>/dev/null
-   elif [ -z "$(grep "##Custom DNS##" "$2" 2>/dev/null)" ]; then
+   fi
+   
+   if [ -z "$(grep "##Custom DNS##" "$2" 2>/dev/null)" ]; then
      sed -i "/^ \{0,\}nameserver:/c\  nameserver:" "$2" 2>/dev/null
      sed -i "/^ \{0,\}fallback:/c\  fallback:" "$2" 2>/dev/null
+      sed -i "s/^ \{0,\}- /    - /g" "$2" 2>/dev/null
   fi

 #fallback-filter
@ -518,7 +526,7 @@ EOF
         sed -i "/ipcidr:/c\    ipcidr:" "$3" 2>/dev/null
      fi
      if [ -z "$(grep "^      - " "$3")" ]; then
-         sed -i '/^ \{0,\}ipcidr:/,/OpenClash-General-Settings/ {s/^ \{0,\}- /      - /}' "$3" 2>/dev/null #修改参数空格
+         sed -i '/^ \{0,\}ipcidr:/,/,$/ {s/^ \{0,\}- /      - /g}' "$3" 2>/dev/null #修改参数空格
      fi
   fi

@ -555,9 +563,7 @@ yml_auth_custom()
   if [ -f /tmp/config.auth ]; then
      sed -i '/^dns:/i\authentication:' "$1" 2>/dev/null
      sed -i '/^authentication:/r/tmp/config.auth' "$1" 2>/dev/null
-      mv /tmp/config.auth /tmp/openclash.auth 2>/dev/null
-   else
-      rm -rf /tmp/openclash.auth 2>/dev/null
+      rm -rf /tmp/config.auth 2>/dev/null
   fi
 }

@ -940,7 +946,7 @@ if [ ! -f "$CONFIG_FILE" ]; then
      exit 0
   elif [ ! -f "$CONFIG_FILE" ]; then
      echo "错误: 缺少配置文件，请上传或更新配置文件！" >$START_LOG
-      echo "${LOGTIME} Config Not Found" >> $LOG_FILE
+      echo "${LOGTIME} Error: Config Not Found" >> $LOG_FILE
      sleep 5
      exit 0
   fi
@ -988,14 +994,14 @@ do_run_file()

   if [ "$small_flash_memory" != "1" ]; then
      dev_core_path="/etc/openclash/core/clash"
-   	  tun_core_path="/etc/openclash/core/clash_tun"
-   	  game_core_path="/etc/openclash/core/clash_game"
-   	  geoip_path="/etc/openclash/Country.mmdb"
+      tun_core_path="/etc/openclash/core/clash_tun"
+      game_core_path="/etc/openclash/core/clash_game"
+      geoip_path="/etc/openclash/Country.mmdb"
   else
      dev_core_path="/tmp/etc/openclash/core/clash"
-   	  tun_core_path="/tmp/etc/openclash/core/clash_tun"
-   	  game_core_path="/tmp/etc/openclash/core/clash_game"
-   	  geoip_path="/tmp/etc/openclash/Country.mmdb"
+      tun_core_path="/tmp/etc/openclash/core/clash_tun"
+      game_core_path="/tmp/etc/openclash/core/clash_game"
+      geoip_path="/tmp/etc/openclash/Country.mmdb"
   fi
    
   rm -rf "/etc/openclash/clash" 2>/dev/null
@ -1045,7 +1051,7 @@ do_run_file()
   [ ! -x "$dev_core_path" ] && chmod 4755 "$dev_core_path" 2>/dev/null
   
   [ -f "$geoip_path" ] && [ "$small_flash_memory" = "1" ] && {
-   	  rm -rf "/etc/openclash/Country.mmdb" 2>/dev/null
+      rm -rf "/etc/openclash/Country.mmdb" 2>/dev/null
      ln -s "$geoip_path" /etc/openclash/Country.mmdb 2>/dev/null
   }
   
@ -1065,6 +1071,17 @@ do_run_file()
     nohup /usr/share/openclash/openclash_core.sh "$core_type" &
     exit 0
   }
+   
+   if ! capsh --is-uid=0 >/dev/null; then
+     echo "错误：Capsh异常，请尝试重新安装依赖【libcap】和相应的Capsh库，终止启动..." >$START_LOG
+     echo "${LOGTIME} Error: Could Not Load The Capsh Library, Please Verify The Capsh Shell Library Work Well" >> $LOG_FILE
+     echo "${LOGTIME} Tip: You Could Download And Re-Install The libcap & libcap-bin Library From The Address Below:" >> $LOG_FILE
+     echo "" >> $LOG_FILE
+     echo "---------- https://mirrors.cloud.tencent.com/lede/snapshots/packages/ ----------" >> $LOG_FILE
+     echo "" >> $LOG_FILE
+     sleep 5
+     start_fail
+   fi

 }

@ -1078,7 +1095,9 @@ start_run_core()
      curl -s --connect-timeout 5 -m 5 -H 'Content-Type: application/json' -H "Authorization: Bearer ${da_password}" -XPUT http://"$lan_ip":"$cn_port"/configs -d "{\"path\": \"$CONFIG_FILE\"}" 2>/dev/null
   else
      kill_clash
-      nohup "$CLASH" -d "$CLASH_CONFIG" -f "$CONFIG_FILE" >> $LOG_FILE 2>&1 &
+      #使用nobody启动内核方便代理路由自身流量
+      capabilties="cap_sys_resource,cap_dac_override,cap_net_raw,cap_net_bind_service,cap_net_admin"
+      capsh --caps="${capabilties}+eip" -- -c "capsh --user=nobody --addamb='${capabilties}' -- -c 'nohup $CLASH -d $CLASH_CONFIG -f \"$CONFIG_FILE\" >> $LOG_FILE 2>&1 &'" >> $LOG_FILE 2>&1
   fi
   uci set openclash.config.config_reload=1 2>/dev/null
   uci commit openclash
@ -1087,9 +1106,9 @@ start_run_core()
 check_core_status()
 {
   check_time=1
-   while ( [ "$check_time" -le 3 ] && [ -z "$(pidof clash)" ] )
+   while ( [ "$check_time" -le 3 ] && [ -n "$(pidof clash)" ] )
   do
-      sleep 2
+      sleep 1
      check_time=$(expr "$check_time" + 1)
   done
 }
@ -1105,17 +1124,17 @@ raw_config_start()
   if [ -z "$dns_port" ] || [ -z "$en_mode" ] || [ -z "$proxy_port" ]; then
      if [ -z "$dns_port" ]; then
         echo "错误: 无法获取DNS部分的监听端口设置, OpenClash 使用原始配置文件启动失败" >$START_LOG
-         echo "${LOGTIME} Get DNS 'listen' Option Error, OpenClash Can Not Start With Raw Config File" >> $LOG_FILE
+         echo "${LOGTIME} Error: Get DNS 'listen' Option Error, OpenClash Can Not Start With Raw Config File" >> $LOG_FILE
         sleep 3
      fi
      if [ -z "$en_mode" ]; then
         echo "错误: 无法获取DNS部分的运行模式设置, OpenClash 使用原始配置文件启动失败" >$START_LOG
-         echo "${LOGTIME} Get DNS 'enhanced-mode' Option Error, OpenClash Can Not Start With Raw Config File" >> $LOG_FILE
+         echo "${LOGTIME} Error: Get DNS 'enhanced-mode' Option Error, OpenClash Can Not Start With Raw Config File" >> $LOG_FILE
         sleep 3
      fi
      if [ -z "$proxy_port" ]; then
         echo "错误: 无法获取General部分的转发端口设置, OpenClash 使用原始配置文件启动失败" >$START_LOG
-         echo "${LOGTIME} Get General 'redir-port' Option Error, OpenClash Can Not Start With Raw Config File" >> $LOG_FILE
+         echo "${LOGTIME} Error: Get General 'redir-port' Option Error, OpenClash Can Not Start With Raw Config File" >> $LOG_FILE
         sleep 3
      fi
      start_fail
@ -1126,7 +1145,7 @@ raw_config_start()
   
   if ! pidof clash >/dev/null; then
      echo "错误: OpenClash 启动失败，请到日志页面查看详细错误信息！" >$START_LOG
-      echo "${LOGTIME} OpenClash Can Not Start, Please Check The Error Info And Try Again" >> $LOG_FILE
+      echo "${LOGTIME} Error: OpenClash Can Not Start, Please Check The Error Info And Try Again" >> $LOG_FILE
      sleep 5
      start_fail
   fi
@ -1162,10 +1181,10 @@ raw_config_start()
   fi
   
   dase=$(grep "^ \{0,\}Secret:" "$CONFIG_FILE" |awk -F ': ' '{print $2}' |awk -F '#' '{print $1}' |sed 's/^ \{0,\}//g' 2>/dev/null |sed 's/ \{0,\}$//g' 2>/dev/null |sed "s/\'//g" 2>/dev/null |sed "s/\'//g" 2>/dev/null)
-   uci set openclash.config.dashboard_password=dase 2>/dev/null
+   uci set openclash.config.dashboard_password="$dase" 2>/dev/null
   
   cn_port=$(grep "^ \{0,\}external-controller:" "$CONFIG_FILE" |awk -F ':' '{print $3}' |awk -F '#' '{print $1}' |tr -cd "[0-9]" 2>/dev/null)
-   uci set openclash.config.dashboard_password=cn_port 2>/dev/null
+   uci set openclash.config.dashboard_password="$cn_port" 2>/dev/null
   
   uci set openclash.config.restricted_mode=1
   
@ -1177,12 +1196,12 @@ try_restore_start()
   if [ -z "$(pidof clash)" ]; then
      if [ "$rule_source" = 0 ] && [ "$enable_custom_clash_rules" = 0 ]; then
         echo "错误: OpenClash 启动失败，尝试使用原始配置文件启动..." >$START_LOG
-         echo "${LOGTIME} OpenClash Can Not Start, Try Use Raw Config Restart Again" >> $LOG_FILE
+         echo "${LOGTIME} Error: OpenClash Can Not Start, Try Use Raw Config Restart Again" >> $LOG_FILE
         sleep 3
         raw_config_start
      else
         echo "错误: OpenClash 启动失败，尝试还原第三方规则并重新启动 Clash 主程序..." >$START_LOG
-         echo "${LOGTIME} OpenClash Can Not Start, Try Use Backup Rules Start Again" >> $LOG_FILE
+         echo "${LOGTIME} Error: OpenClash Can Not Start, Try Use Backup Rules Start Again" >> $LOG_FILE
         rm -rf /tmp/yaml_general 2>/dev/null
         #获取备份rule_provider
         rule_provider_bak_len=$(sed -n '/^rule-providers:/=' "$START_BACKUP" 2>/dev/null)
@ -1200,11 +1219,11 @@ try_restore_start()
            /usr/share/openclash/yml_field_cut.sh "$rule_bak_len" "$RULE_BAK_FILE" "$START_BACKUP"
         fi 2>/dev/null
         yml_rule_bak_merge
-         nohup "$CLASH" -d "$CLASH_CONFIG" -f "$CONFIG_FILE" >> $LOG_FILE 2>&1 &
+         start_run_core
         check_core_status
         if ! pidof clash >/dev/null; then
            echo "错误: OpenClash 启动失败，尝试使用原始配置文件启动..." >$START_LOG
-            echo "${LOGTIME} OpenClash Can Not Start, Try Use Raw Config Restart Again" >> $LOG_FILE
+            echo "${LOGTIME} Error: OpenClash Can Not Start, Try Use Raw Config Restart Again" >> $LOG_FILE
            sleep 3
            raw_config_start
         fi
@ -1231,15 +1250,18 @@ firewall_redirect_exclude()
   if [ -z "$src_dport" ]; then
      return
   fi
-   
-   if [ -z "$en_mode_tun" ]; then
-      iptables -t mangle -A openclash -p udp --dport "$src_dport" -j RETURN >/dev/null 2>&1
+
+   if [ -z "$en_mode_tun" ] || [ "$en_mode_tun" -eq 3 ]; then
+   	  iptables -t nat -I openclash_output -p tcp --sport "$src_dport" -j RETURN >/dev/null 2>&1
+   	  iptables -t mangle -I openclash_output -p udp --sport "$src_dport" -j RETURN >/dev/null 2>&1
+      iptables -t mangle -I openclash -p udp --dport "$src_dport" -j RETURN >/dev/null 2>&1
   elif [ "$en_mode_tun" -ne 3 ]; then
-      iptables -t mangle -A openclash -p tcp --dport "$src_dport" -j RETURN >/dev/null 2>&1
-      iptables -t mangle -A openclash -p udp --dport "$src_dport" -j RETURN >/dev/null 2>&1
-   else
-      iptables -t mangle -A openclash -p udp --dport "$src_dport" -j RETURN >/dev/null 2>&1
+   	  iptables -t mangle -I openclash_output -p tcp --sport "$src_dport" -j RETURN >/dev/null 2>&1
+   	  iptables -t mangle -I openclash_output -p udp --sport "$src_dport" -j RETURN >/dev/null 2>&1
+      iptables -t mangle -I openclash -p tcp --dport "$src_dport" -j RETURN >/dev/null 2>&1
+      iptables -t mangle -I openclash -p udp --dport "$src_dport" -j RETURN >/dev/null 2>&1
   fi
+
 }

 set_firewall()
@ -1369,6 +1391,7 @@ if [ -z "$en_mode_tun" ] || [ "$en_mode_tun" -eq 3 ]; then
         ip rule add fwmark "$PROXY_FWMARK" table "$PROXY_ROUTE_TABLE"
         ip route add local 0.0.0.0/0 dev lo table "$PROXY_ROUTE_TABLE"
         iptables -t mangle -N openclash
+         iptables -t mangle -F openclash
         iptables -t mangle -A openclash -m set --match-set localnetwork dst -j RETURN
         iptables -t mangle -A openclash -m set --match-set wan_ac_black_ips dst -j RETURN >/dev/null 2>&1
         iptables -t mangle -A openclash -m set --match-set lan_ac_black_macs src -j RETURN >/dev/null 2>&1
@ -1379,21 +1402,19 @@ if [ -z "$en_mode_tun" ] || [ "$en_mode_tun" -eq 3 ]; then
            iptables -t mangle -A openclash -m set --match-set china_ip_route dst -j RETURN >/dev/null 2>&1
         fi
         iptables -t mangle -A openclash -p udp --dport 53 -j RETURN >/dev/null 2>&1
-         #端口转发
-         config_load "firewall"
-         config_foreach firewall_redirect_exclude "redirect"
         iptables -t mangle -A openclash -p udp -j TPROXY --on-port "$proxy_port" --on-ip 0.0.0.0 --tproxy-mark "$PROXY_FWMARK"
         iptables -t mangle -A PREROUTING -p udp -j openclash
      fi
   fi

-   if [ "$en_mode" = "fake-ip" ]; then
+   #if [ "$en_mode" = "fake-ip" ]; then
      iptables -t nat -N openclash_output
      iptables -t nat -F openclash_output
      iptables -t nat -A openclash_output -m set --match-set localnetwork dst -j RETURN
-      iptables -t nat -A openclash_output -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$proxy_port"
-      iptables -t nat -A OUTPUT -p tcp -j openclash_output
-   fi
+      #iptables -t nat -A openclash_output -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$proxy_port"
+      iptables -t nat -A openclash_output -m owner ! --uid-owner 65534 -p tcp -j REDIRECT --to-ports "$proxy_port"
+      iptables -t nat -I OUTPUT -j openclash_output
+   #fi

   #if [ "$ipv6_enable" -eq 1 ]; then
   #   #tcp
@ -1439,24 +1460,21 @@ if [ -n "$en_mode_tun" ]; then
   fi
   ip rule add fwmark "$PROXY_FWMARK" table "$PROXY_ROUTE_TABLE"
   
+   #设置防火墙
+   iptables -t mangle -N openclash_output
+   iptables -t mangle -F openclash_output
+   iptables -t mangle -A openclash_output -m set --match-set localnetwork dst -j RETURN
   if [ "$en_mode_tun" -ne 3 ]; then
-      #设置防火墙
-      iptables -t mangle -N openclash_output
-      iptables -t mangle -F openclash_output
-      iptables -t mangle -A openclash_output -m set --match-set localnetwork dst -j RETURN
-      if [ "$en_mode" = "fake-ip" ]; then
-         iptables -t mangle -A openclash_output -d 198.18.0.0/16 -j MARK --set-mark "$PROXY_FWMARK"
-      fi
-      iptables -t mangle -I OUTPUT -j openclash_output
+      iptables -t mangle -A openclash_output -m owner ! --uid-owner 65534 -j MARK --set-mark "$PROXY_FWMARK"
+   else
+      iptables -t mangle -A openclash_output -m owner ! --uid-owner 65534 -p udp -j MARK --set-mark "$PROXY_FWMARK"
   fi
+   iptables -t mangle -I OUTPUT -j openclash_output
   
   iptables -t mangle -N openclash
   iptables -t mangle -F openclash
   iptables -t mangle -N openclash_dns_hijack
   iptables -t mangle -F openclash_dns_hijack
-   #端口转发
-   config_load "firewall"
-   config_foreach firewall_redirect_exclude "redirect"
   #其他流量
   iptables -t mangle -A openclash -m set --match-set localnetwork dst -j RETURN >/dev/null 2>&1
   iptables -t mangle -A openclash -m set --match-set wan_ac_black_ips dst -j RETURN >/dev/null 2>&1
@ -1486,6 +1504,10 @@ if [ -n "$en_mode_tun" ]; then
   #        ip6tables -t mangle -I PREROUTING -j MARK --set-mark "$PROXY_FWMARK"
   #    fi
 fi
+
+#端口转发
+config_load "firewall"
+config_foreach firewall_redirect_exclude "redirect"
 }

 revert_firewall()
@ -1503,7 +1525,13 @@ revert_firewall()
   for out_line in $out_lines; do
      iptables -t nat -D OUTPUT "$out_line" >/dev/null 2>&1
   done >/dev/null 2>&1
-   iptables -t nat -D OUTPUT -p tcp -j openclash_output >/dev/null 2>&1
+   iptables -t nat -D OUTPUT -j openclash_output >/dev/null 2>&1
+   
+   out_lines=$(iptables -nvL OUTPUT -t mangle |sed 1,2d |sed -n '/openclash/=' 2>/dev/null |sort -rn)
+   for out_line in $out_lines; do
+      iptables -t mangle -D OUTPUT "$out_line" >/dev/null 2>&1
+   done >/dev/null 2>&1
+   iptables -t mangle -D OUTPUT -j openclash_output >/dev/null 2>&1

   pre_lines=$(iptables -nvL PREROUTING -t nat |sed 1,2d |sed -n '/8\.8\./=' 2>/dev/null |sort -rn)
   for pre_line in $pre_lines; do
@ -1598,10 +1626,10 @@ start()
 {
   #禁止多个实例
   status=$(unify_ps_status "/etc/init.d/openclash")
-   [ "$status" -gt "3" ] && echo "Multiple Start Scripts Running, Exit..." >> $LOG_FILE && exit 0
+   [ "$status" -gt "3" ] && echo "${LOGTIME} Warning: Multiple Start Scripts Running, Exit..." >> $LOG_FILE && exit 0
   
   enable=$(uci get openclash.config.enable 2>/dev/null)
-   [ "$enable" != "1" ] && echo "OpenClash Now Disabled, Need Start From Luci Page, Exit..." >> $LOG_FILE && exit 0
+   [ "$enable" != "1" ] && echo "${LOGTIME} Warning: OpenClash Now Disabled, Need Start From Luci Page, Exit..." >> $LOG_FILE && exit 0

   config_choose

@ -1616,30 +1644,22 @@ start()
   
   echo "第二步: 配置文件检查..." >$START_LOG
   yml_check "$en_mode" "$enable_custom_dns" "$CONFIG_FILE" "$BACKUP_FILE" "$START_BACKUP"
-   yml_dns_check
-   
+
   echo "第三步: 修改配置文件..." >$START_LOG
   config_load "openclash"
   config_foreach yml_auth_get "authentication"
   yml_auth_custom "$CHANGE_FILE"
   yml_dns_custom "$enable_custom_dns" "$DNS_FILE" "$FALLBACK_FILTER_FILE"
-   /usr/share/openclash/yml_change.sh >/dev/null 2>&1 "$LOGTIME" "$en_mode" "$enable_custom_dns" "$da_password" "$cn_port" "$proxy_port" "$CHANGE_FILE" "$ipv6_enable" "$http_port" "$socks_port" "$lan_ip" "$log_level" "$proxy_mode" "$intranet_allowed" "$en_mode_tun" "$stack_type" &
+   /usr/share/openclash/yml_change.sh >/dev/null 2>&1 "$LOGTIME" "$en_mode" "$enable_custom_dns" "$da_password" "$cn_port" "$proxy_port" "$CHANGE_FILE" "$ipv6_enable" "$http_port" "$socks_port" "$lan_ip" "$log_level" "$proxy_mode" "$intranet_allowed" "$en_mode_tun" "$stack_type" "$dns_port" &
   /usr/share/openclash/yml_rules_change.sh >/dev/null 2>&1 "$LOGTIME" "$rule_source" "$enable_custom_clash_rules" "$RULE_FILE" "$set_rule_file" "$en_mode" "$enable_rule_proxy" "$BACKUP_FILE" "$RULE_PROVIDER_FILE" &
   wait
   yml_provider_path "$PROXY_PROVIDER_FILE" "proxy_provider"
   yml_provider_path "$RULE_PROVIDER_FILE" "rule_provider"
   yml_custom_rule_provider
   yml_game_custom
-   yml_merge
   
-   echo "第四步: DNS设置检查..." >$START_LOG
-   if [ -n "$(sed -n '/^ \{0,\}nameserver:/{n;p}' "$CONFIG_FILE" |grep '^ \{0,\}fallback:')" ] || [ -n "$(sed -n '/^ \{0,\}nameserver:/{n;p}' "$CONFIG_FILE" |grep 'OpenClash-General')" ]; then
-      echo "错误: 配置文件DNS选项下的Nameserver必须设置服务器，已自动还原配置文件，请重新设置！" >$START_LOG
-      echo "${LOGTIME} Nameserver Must Be Set, Please Change Your Configrations In Config.yaml" >>$LOG_FILE
-      mv "$START_BACKUP" "$CONFIG_FILE"
-      sleep 5
-      start_fail
-   fi
+   echo "第四步: 合并配置文件修改..." >$START_LOG
+   yml_merge
   
   echo "第五步: 启动主程序..." >$START_LOG
   sleep 1
@ -1675,12 +1695,12 @@ start()
      sleep 5
   elif [ -n "$(uci get dhcp.lan.dhcpv6 2>/dev/null)" ]; then
      echo "OpenClash 启动成功，检测到您启用了IPV6的DHCP服务，可能会造成连接异常！" >$START_LOG
-      echo "${LOGTIME} OpenClash Start Successful, Please Note That Network May Abnormal With IPV6's DHCP Server" >> $LOG_FILE
+      echo "${LOGTIME} Warning: OpenClash Start Successful, Please Note That Network May Abnormal With IPV6's DHCP Server" >> $LOG_FILE
      sleep 5
   fi
   if [ "$(uci get openclash.config.restricted_mode 2>/dev/null)" = "1" ]; then
      echo "OpenClash 使用原始配置文件启动成功，部分设置可能未生效！" >$START_LOG
-      echo "${LOGTIME} OpenClash Start Successful With Raw Config File, Please Note That It's Restricted Mode Now" >> $LOG_FILE
+      echo "${LOGTIME} Warning: OpenClash Start Successful With Raw Config File, Please Note That It's Restricted Mode Now" >> $LOG_FILE
      sleep 5
   fi
   echo "OpenClash Already Start"
--- a/package/ctcgfw/luci-app-openclash/root/etc/openclash/Country.mmdb
+++ b/package/ctcgfw/luci-app-openclash/root/etc/openclash/Country.mmdb
--- a/package/ctcgfw/luci-app-openclash/root/etc/openclash/custom/openclash_custom_fake_filter.list
+++ b/package/ctcgfw/luci-app-openclash/root/etc/openclash/custom/openclash_custom_fake_filter.list
@ -73,10 +73,10 @@ music.migu.cn
 #QQ快捷登录
 localhost.ptlogin2.qq.com
 #Nintendo Switch
-*.*.*.srv.nintendo.net
+*.*.*.*.srv.nintendo.net
 #Sony PlayStation
-*.*.stun.playstation.net
+*.*.*.stun.playstation.net
 #Microsoft Xbox
-xbox.*.*.microsoft.com
-*.*.xboxlive.com
+xbox.*.microsoft.com
+*.*.*.xboxlive.com
 proxy.golang.org
--- a/package/ctcgfw/luci-app-openclash/root/etc/openclash/custom/openclash_custom_rules.list
+++ b/package/ctcgfw/luci-app-openclash/root/etc/openclash/custom/openclash_custom_rules.list
@ -25,6 +25,8 @@
 ##- SRC-IP-CIDR,192.168.1.208/28,DIRECT
 ##- SRC-IP-CIDR,192.168.1.224/27,DIRECT

+##- SRC-IP-CIDR,198.18.0.1/32,DIRECT
+
 ##此时IP为192.168.1.1和192.168.1.201的客户端流量走代理（策略），其余客户端不走代理
-##因为Fake-IP模式下，IP地址为192.168.1.1的路由器自身流量可走代理（策略），所以需要排除
+##因为Fake-IP模式下，IP地址为192.168.1.1、198.18.0.1的路由器自身流量可走代理（策略），所以需要排除
 ##在线IP段转CIDR地址：http://ip2cidr.com
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/clash_version.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/clash_version.sh
@ -7,17 +7,10 @@ status=$(unify_ps_status "clash_version.sh")

 CKTIME=$(date "+%Y-%m-%d-%H")
 LAST_OPVER="/tmp/clash_last_version"
-HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
-PROXY_ADDR=$(uci get network.lan.ipaddr 2>/dev/null |awk -F '/' '{print $1}' 2>/dev/null)

-if [ -s "/tmp/openclash.auth" ]; then
-   PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
-fi
-
-VERSION_URL="https://raw.githubusercontent.com/vernesong/OpenClash/master/core_version"
 if [ "$CKTIME" != "$(grep "CheckTime" $LAST_OPVER 2>/dev/null |awk -F ':' '{print $2}')" ]; then
 	 if pidof clash >/dev/null; then
-      curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" "$VERSION_URL" -o $LAST_OPVER >/dev/null 2>&1
+      curl -sL --connect-timeout 10 --retry 2 https://raw.githubusercontent.com/vernesong/OpenClash/master/core_version -o $LAST_OPVER >/dev/null 2>&1
   else
      curl -sL --connect-timeout 10 --retry 2 https://cdn.jsdelivr.net/gh/vernesong/OpenClash@master/core_version -o $LAST_OPVER >/dev/null 2>&1
   fi
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash.sh
@ -153,6 +153,8 @@ change_dns()
         uci commit dhcp
         /etc/init.d/dnsmasq restart >/dev/null 2>&1
      fi
+      iptables -t nat -I OUTPUT -j openclash_output >/dev/null 2>&1
+      iptables -t mangle -I OUTPUT -j openclash_output >/dev/null 2>&1
      nohup /usr/share/openclash/openclash_watchdog.sh &
   fi
 }
@ -170,6 +172,9 @@ config_download_direct()
      uci delete dhcp.@dnsmasq[0].cachesize >/dev/null 2>&1
      uci commit dhcp
      /etc/init.d/dnsmasq restart >/dev/null 2>&1
+      
+      iptables -t nat -D OUTPUT -j openclash_output >/dev/null 2>&1
+      iptables -t mangle -D OUTPUT -j openclash_output >/dev/null 2>&1
      sleep 3

      config_download
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_chnroute.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_chnroute.sh
@ -7,16 +7,11 @@
   START_LOG="/tmp/openclash_start.log"
   LOGTIME=$(date "+%Y-%m-%d %H:%M:%S")
   LOG_FILE="/tmp/openclash.log"
-   HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
-   PROXY_ADDR=$(uci get network.lan.ipaddr 2>/dev/null |awk -F '/' '{print $1}' 2>/dev/null)
   china_ip_route=$(uci get openclash.config.china_ip_route 2>/dev/null)
-   
-   if [ -s "/tmp/openclash.auth" ]; then
-      PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
-   fi
+
   echo "开始下载大陆IP白名单..." >$START_LOG
   if pidof clash >/dev/null; then
-      curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://raw.githubusercontent.com/DivineEngine/Profiles/master/Clash/RuleSet/Extra/ChinaIP.yaml -o /tmp/ChinaIP.yaml >/dev/null 2>&1
+      curl -sL --connect-timeout 10 --retry 2 https://raw.githubusercontent.com/DivineEngine/Profiles/master/Clash/RuleSet/Extra/ChinaIP.yaml -o /tmp/ChinaIP.yaml >/dev/null 2>&1
   else
      curl -sL --connect-timeout 10 --retry 2 https://cdn.jsdelivr.net/gh/DivineEngine/Profiles@master/Clash/RuleSet/Extra/ChinaIP.yaml -o /tmp/ChinaIP.yaml >/dev/null 2>&1
   fi
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_core.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_core.sh
@ -1,5 +1,6 @@
 #!/bin/sh
 . /lib/functions.sh
+. /usr/share/openclash/openclash_ps.sh

 START_LOG="/tmp/openclash_start.log"
 LOGTIME=$(date "+%Y-%m-%d %H:%M:%S")
@ -9,8 +10,7 @@ CORE_TYPE="$1"
 en_mode=$(uci get openclash.config.en_mode 2>/dev/null)
 small_flash_memory=$(uci get openclash.config.small_flash_memory 2>/dev/null)
 CPU_MODEL=$(uci get openclash.config.core_version 2>/dev/null)
-HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
-PROXY_ADDR=$(uci get network.lan.ipaddr 2>/dev/null |awk -F '/' '{print $1}' 2>/dev/null)
+
 [ ! -f "/tmp/clash_last_version" ] && /usr/share/openclash/clash_version.sh 2>/dev/null
 if [ "$small_flash_memory" != "1" ]; then
   dev_core_path="/etc/openclash/core/clash"
@ -24,19 +24,13 @@ else
   mkdir -p /tmp/etc/openclash/core
 fi

-
-[ -s "/tmp/openclash.auth" ] && {
-   PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
-}
-
 case $CORE_TYPE in
 	"Tun")
   CORE_CV=$($tun_core_path -v 2>/dev/null |awk -F ' ' '{print $2}')
   CORE_LV=$(sed -n 2p /tmp/clash_last_version 2>/dev/null)
-   echo $CORE_CV >>/tmp/1
   if [ -z "$CORE_LV" ]; then
      echo "获取【Tun】内核最新版本信息失败，请稍后再试..." >$START_LOG
-      echo "${LOGTIME} 【Tun】Core Version Check Error, Please Try Again After A few seconds" >>$LOG_FILE
+      echo "${LOGTIME} Error: 【Tun】Core Version Check Error, Please Try Again After A few Seconds" >>$LOG_FILE
      sleep 5
      echo "" >$START_LOG
      exit 0
@ -68,15 +62,15 @@ if [ "$CORE_CV" != "$CORE_LV" ] || [ -z "$CORE_CV" ]; then
 			case $CORE_TYPE in
      	"Tun")
      	echo "正在下载【Tun】版本内核，如下载失败请尝试手动下载并上传..." >$START_LOG
-				curl -sL -m 30 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://github.com/vernesong/OpenClash/releases/download/TUN-Premium/clash-"$CPU_MODEL"-"$CORE_LV".gz -o /tmp/clash_tun.gz >/dev/null 2>&1
+				curl -sL -m 30 --retry 2 https://github.com/vernesong/OpenClash/releases/download/TUN-Premium/clash-"$CPU_MODEL"-"$CORE_LV".gz -o /tmp/clash_tun.gz >/dev/null 2>&1
 				;;
 				"Game")
 				echo "正在下载【Game】版本内核，如下载失败请尝试手动下载并上传..." >$START_LOG
-				curl -sL -m 30 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://github.com/vernesong/OpenClash/releases/download/TUN/clash-"$CPU_MODEL".tar.gz -o /tmp/clash_game.tar.gz >/dev/null 2>&1
+				curl -sL -m 30 --retry 2 https://github.com/vernesong/OpenClash/releases/download/TUN/clash-"$CPU_MODEL".tar.gz -o /tmp/clash_game.tar.gz >/dev/null 2>&1
 				;;
 				*)
 				echo "正在下载【Dev】版本内核，如下载失败请尝试手动下载并上传..." >$START_LOG
-				curl -sL -m 30 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://github.com/vernesong/OpenClash/releases/download/Clash/clash-"$CPU_MODEL".tar.gz -o /tmp/clash.tar.gz >/dev/null 2>&1
+				curl -sL -m 30 --retry 2 https://github.com/vernesong/OpenClash/releases/download/Clash/clash-"$CPU_MODEL".tar.gz -o /tmp/clash.tar.gz >/dev/null 2>&1
 			esac
   else
 			case $CORE_TYPE in
@ -131,7 +125,7 @@ if [ "$CORE_CV" != "$CORE_LV" ] || [ -z "$CORE_CV" ]; then
      
      if [ "$?" -ne "0" ]; then
      	echo "【"$CORE_TYPE"】版本内核更新失败，请检查网络或稍后再试！" >$START_LOG
-        echo "${LOGTIME} OpenClash 【"$CORE_TYPE"】 Core Update Error" >>$LOG_FILE
+        echo "${LOGTIME} Error: OpenClash 【"$CORE_TYPE"】 Core Update Error" >>$LOG_FILE
        case $CORE_TYPE in
            "Tun")
 				    rm -rf /tmp/clash_tun >/dev/null 2>&1
@ -170,11 +164,11 @@ if [ "$CORE_CV" != "$CORE_LV" ] || [ -z "$CORE_CV" ]; then
         	 uci set openclash.config.config_reload=0
         	 uci commit openclash
         fi
-         [ "$if_restart" -eq 1 ] && /etc/init.d/openclash restart
+         [ "$if_restart" -eq 1 ] && [ "$(unify_ps_prevent)" -eq 0 ] && /etc/init.d/openclash restart
         echo "" >$START_LOG
      else
         echo "【"$CORE_TYPE"】版本内核更新失败，请确认设备闪存空间足够后再试！" >$START_LOG
-         echo "${LOGTIME} OpenClash 【"$CORE_TYPE"】 Core Update Error" >>$LOG_FILE
+         echo "${LOGTIME} Error: OpenClash 【"$CORE_TYPE"】 Core Update Error" >>$LOG_FILE
         case $CORE_TYPE in
            "Tun")
 				    rm -rf /tmp/clash_tun >/dev/null 2>&1
@ -189,7 +183,7 @@ if [ "$CORE_CV" != "$CORE_LV" ] || [ -z "$CORE_CV" ]; then
      fi
   else
      echo "【"$CORE_TYPE"】版本内核下载失败，请检查网络或稍后再试！" >$START_LOG
-      echo "${LOGTIME} OpenClash 【"$CORE_TYPE"】 Core Update Error" >>$LOG_FILE
+      echo "${LOGTIME} Error: OpenClash 【"$CORE_TYPE"】 Core Update Error" >>$LOG_FILE
      case $CORE_TYPE in
         "Tun")
 			   rm -rf /tmp/clash_tun >/dev/null 2>&1
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_debug.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_debug.sh
@ -98,6 +98,9 @@ ca-certificates: $(ts_re "$(opkg status ca-certificates 2>/dev/null |grep 'Statu
 ipset: $(ts_re "$(opkg status ipset 2>/dev/null |grep 'Status' |awk -F ': ' '{print $2}' 2>/dev/null)")
 ip-full: $(ts_re "$(opkg status ip-full 2>/dev/null |grep 'Status' |awk -F ': ' '{print $2}' 2>/dev/null)")
 iptables-mod-tproxy: $(ts_re "$(opkg status iptables-mod-tproxy 2>/dev/null |grep 'Status' |awk -F ': ' '{print $2}' 2>/dev/null)")
+iptables-mod-extra: $(ts_re "$(opkg status iptables-mod-extra 2>/dev/null |grep 'Status' |awk -F ': ' '{print $2}' 2>/dev/null)")
+libcap: $(ts_re "$(opkg status libcap 2>/dev/null |grep 'Status' |awk -F ': ' '{print $2}' 2>/dev/null)")
+libcap-bin: $(ts_re "$(opkg status libcap-bin 2>/dev/null |grep 'Status' |awk -F ': ' '{print $2}' 2>/dev/null)")
 kmod-tun(TUN模式): $(ts_re "$(opkg status kmod-tun 2>/dev/null |grep 'Status' |awk -F ': ' '{print $2}' 2>/dev/null)")
 luci-compat(Luci-19.07): $(ts_re "$(opkg status luci-compat 2>/dev/null |grep 'Status' |awk -F ': ' '{print $2}' 2>/dev/null)")
 EOF
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_download_rule_list.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_download_rule_list.sh
@ -19,20 +19,16 @@
   TMP_RULE_DIR="/tmp/$RULE_FILE_NAME"
   LOGTIME=$(date "+%Y-%m-%d %H:%M:%S")
   LOG_FILE="/tmp/openclash.log"
-   HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
-   PROXY_ADDR=$(uci get network.lan.ipaddr 2>/dev/null |awk -F '/' '{print $1}' 2>/dev/null)
-   if [ -s "/tmp/openclash.auth" ]; then
-      PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
-   fi
+   
   if [ "$RULE_TYPE" = "game" ]; then
      if pidof clash >/dev/null; then
-   	     curl -sL --connect-timeout 5 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://raw.githubusercontent.com/FQrabbit/SSTap-Rule/master/rules/"$DOWNLOAD_PATH" -o "$TMP_RULE_DIR" >/dev/null 2>&1
+   	     curl -sL --connect-timeout 5 --retry 2 https://raw.githubusercontent.com/FQrabbit/SSTap-Rule/master/rules/"$DOWNLOAD_PATH" -o "$TMP_RULE_DIR" >/dev/null 2>&1
      else
         curl -sL --connect-timeout 5 --retry 2 https://cdn.jsdelivr.net/gh/FQrabbit/SSTap-Rule@master/rules/"$DOWNLOAD_PATH" -o "$TMP_RULE_DIR" >/dev/null 2>&1
      fi
   elif [ "$RULE_TYPE" = "provider" ]; then
      if pidof clash >/dev/null; then
-   	     curl -sL --connect-timeout 5 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://raw.githubusercontent.com/"$DOWNLOAD_PATH" -o "$TMP_RULE_DIR" >/dev/null 2>&1
+   	     curl -sL --connect-timeout 5 --retry 2 https://raw.githubusercontent.com/"$DOWNLOAD_PATH" -o "$TMP_RULE_DIR" >/dev/null 2>&1
      else
         curl -sL --connect-timeout 5 --retry 2 https://cdn.jsdelivr.net/gh/"$(echo "$DOWNLOAD_PATH" |awk -F '/master' '{print $1}' 2>/dev/null)"@master"$(echo "$DOWNLOAD_PATH" |awk -F 'master' '{print $2}')" -o "$TMP_RULE_DIR" >/dev/null 2>&1
      fi
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_fake_filter.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_fake_filter.sh
@ -13,7 +13,7 @@ if [ -s "$CUSTOM_FILE" ]; then
   cat "$CUSTOM_FILE" |while read -r line || [[ -n ${line} ]];
   do
      if [ -z "$(echo $line |grep '^ \{0,\}#' 2>/dev/null)" ]; then
-         echo "  - '$line'" >> "$FAKE_FILTER_FILE"
+         echo "    - '$line'" >> "$FAKE_FILTER_FILE"
      else
         continue
 	    fi
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_history_set.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_history_set.sh
@ -27,7 +27,7 @@ restore_history() {
   NOW_NAME=$(echo $line |awk -F '#*#' '{print $3}')
   GROUP_STATE=$(GROUP_STATE "$GROUP_NAME")
   GROUP_STATE_NUM=0
-   while ( [ ! -z "$(pidof clash)" ] && [ "$GROUP_STATE" != "200" ] && [ "$GROUP_STATE_NUM" -le 1 ] )
+   while ( [ ! -z "$(pidof clash)" ] && [ "$GROUP_STATE" != "200" ] && [ "$GROUP_STATE_NUM" -le 3 ] )
   do
      sleep 3
      GROUP_STATE_NUM=$(expr "$GROUP_STATE_NUM" + 1)
@ -41,7 +41,7 @@ close_all_conection() {
 }

 if [ -s "$HISTORY_PATH" ]; then
-   cat "$HISTORY_PATH" |while read line
+   cat "$HISTORY_PATH" |while read -r line
   do
      GROUP_NAME=$(echo $line |awk -F '#*#' '{print $1}')
      if [ "$GROUP_NAME" != "GLOBAL" ]; then
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_ipdb.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_ipdb.sh
@ -8,11 +8,7 @@
   LOGTIME=$(date "+%Y-%m-%d %H:%M:%S")
   LOG_FILE="/tmp/openclash.log"
   small_flash_memory=$(uci get openclash.config.small_flash_memory 2>/dev/null)
-   HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
-   PROXY_ADDR=$(uci get network.lan.ipaddr 2>/dev/null |awk -F '/' '{print $1}' 2>/dev/null)
-   if [ -s "/tmp/openclash.auth" ]; then
-      PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
-   fi
+   
   if [ "$small_flash_memory" != "1" ]; then
   	  geoip_path="/etc/openclash/Country.mmdb"
   	  mkdir -p /etc/openclash
@ -22,7 +18,7 @@
   fi
   echo "开始下载 GEOIP 数据库..." >$START_LOG
   if pidof clash >/dev/null; then
-      curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://raw.githubusercontent.com/alecthw/mmdb_china_ip_list/release/Country.mmdb -o /tmp/Country.mmdb >/dev/null 2>&1
+      curl -sL --connect-timeout 10 --retry 2 https://raw.githubusercontent.com/alecthw/mmdb_china_ip_list/release/Country.mmdb -o /tmp/Country.mmdb >/dev/null 2>&1
   else
      curl -sL --connect-timeout 10 --retry 2 http://www.ideame.top/mmdb/Country.mmdb -o /tmp/Country.mmdb >/dev/null 2>&1
   fi
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_rule.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_rule.sh
@ -10,26 +10,21 @@
   LOG_FILE="/tmp/openclash.log"
   echo "开始获取使用中的第三方规则名称..." >$START_LOG
   RUlE_SOURCE=$(uci get openclash.config.rule_source 2>/dev/null)
-   HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
-   PROXY_ADDR=$(uci get network.lan.ipaddr 2>/dev/null |awk -F '/' '{print $1}' 2>/dev/null)
   OTHER_RULE_PROVIDER_FILE="/tmp/other_rule_provider.yaml"
   OTHER_SCRIPT_FILE="/tmp/other_rule_script.yaml"
   OTHER_RULE_FILE="/tmp/other_rule.yaml"

-   if [ -s "/tmp/openclash.auth" ]; then
-	    PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
-   fi
   echo "开始下载使用中的第三方规则..." >$START_LOG
      if [ "$RUlE_SOURCE" = "lhie1" ]; then
      	 if pidof clash >/dev/null; then
-            curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://raw.githubusercontent.com/lhie1/Rules/master/Clash/Rule.yaml -o /tmp/rules.yaml >/dev/null 2>&1
+            curl -sL --connect-timeout 10 --retry 2 https://raw.githubusercontent.com/lhie1/Rules/master/Clash/Rule.yaml -o /tmp/rules.yaml >/dev/null 2>&1
      	 else
            curl -sL --connect-timeout 10 --retry 2 https://cdn.jsdelivr.net/gh/lhie1/Rules@master/Clash/Rule.yaml -o /tmp/rules.yaml >/dev/null 2>&1
         fi
         sed -i '1i rules:' /tmp/rules.yaml
      elif [ "$RUlE_SOURCE" = "ConnersHua" ]; then
      	 if pidof clash >/dev/null; then
-            curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://raw.githubusercontent.com/DivineEngine/Profiles/master/Clash/Global.yaml -o /tmp/rules.yaml >/dev/null 2>&1
+            curl -sL --connect-timeout 10 --retry 2 https://raw.githubusercontent.com/DivineEngine/Profiles/master/Clash/Global.yaml -o /tmp/rules.yaml >/dev/null 2>&1
      	 else
            curl -sL --connect-timeout 10 --retry 2 https://cdn.jsdelivr.net/gh/DivineEngine/Profiles@master/Clash/Global.yaml -o /tmp/rules.yaml >/dev/null 2>&1
         fi
@ -38,7 +33,7 @@
         sed -i "s/- GEOIP,/#- GEOIP,/g" /tmp/rules.yaml 2>/dev/null
      elif [ "$RUlE_SOURCE" = "ConnersHua_return" ]; then
      	 if pidof clash >/dev/null; then
-            curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://raw.githubusercontent.com/ConnersHua/Profiles/master/Clash/China.yaml -o /tmp/rules.yaml >/dev/null 2>&1
+            curl -sL --connect-timeout 10 --retry 2 https://raw.githubusercontent.com/ConnersHua/Profiles/master/Clash/China.yaml -o /tmp/rules.yaml >/dev/null 2>&1
      	 else
            curl -sL --connect-timeout 10 --retry 2 https://cdn.jsdelivr.net/gh/DivineEngine/Profiles@master/Clash/China.yaml -o /tmp/rules.yaml >/dev/null 2>&1
         fi
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_update.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_update.sh
@ -22,16 +22,11 @@ LAST_OPVER="/tmp/openclash_last_version"
 LAST_VER=$(sed -n 1p "$LAST_OPVER" 2>/dev/null |sed "s/^v//g")
 OP_CV=$(sed -n 1p /usr/share/openclash/res/openclash_version 2>/dev/null |awk -F '-' '{print $1}' |awk -F 'v' '{print $2}' |awk -F '.' '{print $2$3}' 2>/dev/null)
 OP_LV=$(sed -n 1p $LAST_OPVER 2>/dev/null |awk -F '-' '{print $1}' |awk -F 'v' '{print $2}' |awk -F '.' '{print $2$3}' 2>/dev/null)
-HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
-PROXY_ADDR=$(uci get network.lan.ipaddr 2>/dev/null |awk -F '/' '{print $1}' 2>/dev/null)
-if [ -s "/tmp/openclash.auth" ]; then
-   PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
-fi

 if [ "$(expr "$OP_LV" \> "$OP_CV")" -eq 1 ] && [ -f "$LAST_OPVER" ]; then
   echo "开始下载 OpenClash-$LAST_VER ..." >$START_LOG
   if pidof clash >/dev/null; then
-      curl -sL -m 30 --retry 5 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://github.com/vernesong/OpenClash/releases/download/v"$LAST_VER"/luci-app-openclash_"$LAST_VER"_all.ipk -o /tmp/openclash.ipk >/dev/null 2>&1
+      curl -sL -m 30 --retry 5 https://github.com/vernesong/OpenClash/releases/download/v"$LAST_VER"/luci-app-openclash_"$LAST_VER"_all.ipk -o /tmp/openclash.ipk >/dev/null 2>&1
   else
      curl -sL -m 30 --retry 5 https://cdn.jsdelivr.net/gh/vernesong/OpenClash@master/luci-app-openclash_"$LAST_VER"_all.ipk -o /tmp/openclash.ipk >/dev/null 2>&1
   fi
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_version.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_version.sh
@ -3,17 +3,10 @@ CKTIME=$(date "+%Y-%m-%d-%H")
 LAST_OPVER="/tmp/openclash_last_version"
 OP_CV=$(sed -n 1p /usr/share/openclash/res/openclash_version 2>/dev/null |awk -F '-' '{print $1}' |awk -F 'v' '{print $2}' |awk -F '.' '{print $2$3}' 2>/dev/null)
 OP_LV=$(sed -n 1p $LAST_OPVER 2>/dev/null |awk -F '-' '{print $1}' |awk -F 'v' '{print $2}' |awk -F '.' '{print $2$3}' 2>/dev/null)
-HTTP_PORT=$(uci get openclash.config.http_port 2>/dev/null)
-PROXY_ADDR=$(uci get network.lan.ipaddr 2>/dev/null |awk -F '/' '{print $1}' 2>/dev/null)

-if [ -s "/tmp/openclash.auth" ]; then
-   PROXY_AUTH=$(cat /tmp/openclash.auth |awk -F '- ' '{print $2}' |sed -n '1p' 2>/dev/null)
-fi
-
-VERSION_URL="https://raw.githubusercontent.com/vernesong/OpenClash/master/version"
 if [ "$CKTIME" != "$(grep "CheckTime" $LAST_OPVER 2>/dev/null |awk -F ':' '{print $2}')" ]; then
   if pidof clash >/dev/null; then
-      curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" "$VERSION_URL" -o $LAST_OPVER >/dev/null 2>&1
+      curl -sL --connect-timeout 10 --retry 2 https://raw.githubusercontent.com/vernesong/OpenClash/master/version -o $LAST_OPVER >/dev/null 2>&1
   else
      curl -sL --connect-timeout 10 --retry 2 https://cdn.jsdelivr.net/gh/vernesong/OpenClash@master/version -o $LAST_OPVER >/dev/null 2>&1
   fi
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_watchdog.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_watchdog.sh
@ -43,7 +43,8 @@ if [ "$enable" -eq 1 ]; then
 		 if [ "$CRASH_NUM" -le 3 ]; then
 	      CONFIG_FILE=$(uci get openclash.config.config_path 2>/dev/null)
 	      echo "${LOGTIME} Watchdog: Clash Core Problem, Restart." >> $LOG_FILE
-	      nohup "$CLASH" -d "$CLASH_CONFIG" -f "$CONFIG_FILE" >> $LOG_FILE 2>&1 &
+	      capabilties="cap_sys_resource,cap_dac_override,cap_net_raw,cap_net_bind_service,cap_net_admin"
+        capsh --caps="${capabilties}+eip" -- -c "capsh --user=nobody --addamb='${capabilties}' -- -c 'nohup $CLASH -d $CLASH_CONFIG -f \"$CONFIG_FILE\" >> $LOG_FILE 2>&1 &'" >> $LOG_FILE 2>&1
 	      sleep 3
 	      if [ "$core_type" = "Tun" ]; then
 	         ip route replace default dev utun table "$PROXY_ROUTE_TABLE" 2>/dev/null
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/res/openclash_version
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/res/openclash_version
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/yml_change.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/yml_change.sh
@ -136,6 +136,20 @@
    sed -i '/bind-address:/d' "$7" 2>/dev/null
    sed -i "/^allow-lan:/a\bind-address: \"${bind_address}\"" "$7"
    
+    if [ -n "$(grep "^ \{0,\}listen:" "$7")" ]; then
+       if [ "$8" != "1" ]; then
+          sed -i "/^ \{0,\}listen:/c\  listen: 127.0.0.1:${17}" "$7" 2>/dev/null
+       else
+          sed -i "/^ \{0,\}listen:/c\  listen: 0.0.0.0:${17}" "$7" 2>/dev/null
+       fi
+    else
+       if [ "$8" != "1" ]; then
+          sed -i "/^dns:/a\  listen: 127.0.0.1:${17}" "$7" 2>/dev/null
+       else
+          sed -i "/^dns:/a\  listen: 0.0.0.0:${17}" "$7" 2>/dev/null
+       fi
+    fi 2>/dev/null
+    
    if [ -z "$(grep '^external-ui: "/usr/share/openclash/dashboard"' "$7")" ]; then
       if [ ! -z "$(grep "^ \{0,\}external-ui:" "$7")" ]; then
          sed -i '/^ \{0,\}external-ui:/c\external-ui: "/usr/share/openclash/dashboard"' "$7"
@ -165,9 +179,9 @@
       fi
       sed -i "/^dns:/i\  dns-hijack:" "$7"
 #       sed -i "/^dns:/i\  - 8.8.8.8:53" "$7"
-       sed -i "/^dns:/i\  - tcp://8.8.8.8:53" "$7"
+       sed -i "/^dns:/i\    - tcp://8.8.8.8:53" "$7"
 #       sed -i "/^dns:/i\  - 8.8.4.4:53" "$7"
-       sed -i "/^dns:/i\  - tcp://8.8.4.4:53" "$7"
+       sed -i "/^dns:/i\    - tcp://8.8.4.4:53" "$7"
    elif [ "$15" -eq 2 ]; then
       sed -i "/^dns:/i\tun:" "$7"
       sed -i "/^dns:/i\  enable: true" "$7"
@ -198,9 +212,9 @@
 	     sed -i "/^hosts:/,/^dns:/ {s/^ \{0,\}'/  '/}" "$7" 2>/dev/null #修改参数空格
 	  fi
 	  
-	  sed -i "s/^ \{0,\}- /  - /" "$7" 2>/dev/null
 	  if [ ! -z "$(grep "^ \{0,\}default-nameserver:" "$7")" ]; then
       sed -i "/^ \{0,\}default-nameserver:/c\  default-nameserver:" "$7"
+       sed -i "/^ \{0,\}default-nameserver:/,/,$/ {s/^ \{0,\}- /  - /g}" "$7" 2>/dev/null #修改参数空格
    fi
    
 #fake-ip-filter
@ -217,6 +231,7 @@
      	if [ ! -z "$(grep "^ \{0,\}fake-ip-filter:" "$7")" ]; then
      	   sed -i "/^ \{0,\}fake-ip-filter:/c\  fake-ip-filter:" "$7"
      	   sed -i '/^ \{0,\}fake-ip-filter:/r/etc/openclash/fake_filter.list' "$7" 2>/dev/null
+      	   sed -i "/^ \{0,\}fake-ip-filter:/,/,$/ {s/^ \{0,\}- /    - /g}" "$7" 2>/dev/null #修改参数空格
      	else
      	   echo "  fake-ip-filter:" >> "$7"
      	   sed -i '/^ \{0,\}fake-ip-filter:/r/etc/openclash/fake_filter.list' "$7" 2>/dev/null
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/yml_field_cut.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/yml_field_cut.sh
@ -12,13 +12,24 @@ field_cut()
      rule_provider_len=$(sed -n '/^rule-providers:/=' "$3" 2>/dev/null)
      script_len=$(sed -n '/^script:/=' "$3" 2>/dev/null)
      nameserver_len=$(sed -n '/^ \{0,\}nameserver:/=' "$3" 2>/dev/null)
-      lines="$general_len $nameserver_len $proxy_len $provider_len $group_len $rule_len $rule_provider_len $script_len"
+      if [ -z "$nameserver_len" ]; then
+         fallback_len=$(sed -n '/^ \{0,\}fallback:/=' "$3" 2>/dev/null)
+         lines="$general_len $fallback_len $proxy_len $provider_len $group_len $rule_len $rule_provider_len $script_len"
+      else
+         lines="$general_len $nameserver_len $proxy_len $provider_len $group_len $rule_len $rule_provider_len $script_len"
+      fi
   else
      fallback_filter_len=$(sed -n '/^ \{0,\}fallback-filter:/=' "$3" 2>/dev/null)
      cfw_bypass_len=$(sed -n '/^ \{0,\}cfw-bypass:/=' "$3" 2>/dev/null)
      cfw_latency_timeout_len=$(sed -n '/^ \{0,\}cfw-latency-timeout:/=' "$3" 2>/dev/null)
      nameserver_len=$(sed -n '/^ \{0,\}nameserver:/=' "$3" 2>/dev/null)
-      lines="$nameserver_len $fallback_filter_len $cfw_bypass_len $cfw_latency_timeout_len"
+      if [ -z "$nameserver_len" ]; then
+         fallback_len=$(sed -n '/^ \{0,\}fallback:/=' "$3" 2>/dev/null)
+         lines="$fallback_len $fallback_filter_len $cfw_bypass_len $cfw_latency_timeout_len"
+      else
+         lines="$nameserver_len $fallback_filter_len $cfw_bypass_len $cfw_latency_timeout_len"
+      fi
+      
   fi
   
   for i in $lines; do
@ -103,6 +114,8 @@ fi
   fi
   sed -i '/^ \{0,\}tun:/,/^ \{0,\}enable:/d' "$2" 2>/dev/null
   sed -i '/^ \{0,\}dns-hijack:/d' "$2" 2>/dev/null
+   sed -i '/^ \{0,\}macOS-auto-route:/d' "$2" 2>/dev/null
+   sed -i '/^ \{0,\}macOS-auto-detect-interface:/d' "$2" 2>/dev/null
   sed -i '/^ \{0,\}stack:/d' "$2" 2>/dev/null
   sed -i '/^ \{0,\}device-url:/d' "$2" 2>/dev/null
   sed -i '/^ \{0,\}dns-listen:/d' "$2" 2>/dev/null
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/yml_groups_set.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/yml_groups_set.sh
@ -38,7 +38,7 @@ set_groups()

 	if [ "$1" = "$3" ]; then
 	   set_group=1
-	   echo "  - \"${2}\"" >>$GROUP_FILE
+	   echo "      - \"${2}\"" >>$GROUP_FILE
 	fi

 }
@ -56,7 +56,7 @@ set_relay_groups()

  if [ ! -z "$server_relay_num" ] && [ "$server_group_name" = "$3" ]; then
     set_group=1
-     echo "$server_relay_num #  - \"${2}\"" >>/tmp/relay_server
+     echo "$server_relay_num #      - \"${2}\"" >>/tmp/relay_server
 	fi
 }

@ -97,7 +97,7 @@ set_other_groups()
      return
   fi
   set_group=1
-   echo "  - ${1}" >>$GROUP_FILE
+   echo "      - ${1}" >>$GROUP_FILE

 }

@ -134,7 +134,7 @@ set_provider_groups()

 	if [ "$1" = "$3" ]; then
 	   set_proxy_provider=1
-	   echo "  - ${2}" >>$GROUP_FILE
+	   echo "      - ${2}" >>$GROUP_FILE
 	fi

 }
@ -181,10 +181,10 @@ yml_groups_set()
   
   echo "正在写入【$type】-【$name】策略组到配置文件【$CONFIG_NAME】..." >$START_LOG
   
-   echo "- name: $name" >>$GROUP_FILE
-   echo "  type: $type" >>$GROUP_FILE
+   echo "  - name: $name" >>$GROUP_FILE
+   echo "    type: $type" >>$GROUP_FILE
   group_name="$name"
-   echo "  proxies: $group_name" >>$GROUP_FILE
+   echo "    proxies: $group_name" >>$GROUP_FILE
   
   #名字变化时处理规则部分
   if [ "$name" != "$old_name" ] && [ ! -z "$old_name" ]; then
@ -211,30 +211,30 @@ yml_groups_set()
 	    rm -rf /tmp/relay_server 2>/dev/null
 	 fi

-   echo "  use: $group_name" >>$GROUP_FILE
+   echo "    use: $group_name" >>$GROUP_FILE
   
   config_foreach set_proxy_provider "proxy-provider" "$group_name" #加入代理集

   if [ "$set_group" -eq 1 ]; then
-      sed -i "/^ \{0,\}proxies: ${group_name}/c\  proxies:" $GROUP_FILE
+      sed -i "/^ \{0,\}proxies: ${group_name}/c\    proxies:" $GROUP_FILE
   else
      sed -i "/proxies: ${group_name}/d" $GROUP_FILE 2>/dev/null
   fi
   
   if [ "$set_proxy_provider" -eq 1 ]; then
-      sed -i "/^ \{0,\}use: ${group_name}/c\  use:" $GROUP_FILE
+      sed -i "/^ \{0,\}use: ${group_name}/c\    use:" $GROUP_FILE
   else
      sed -i "/use: ${group_name}/d" $GROUP_FILE 2>/dev/null
   fi
   
   [ ! -z "$test_url" ] && {
-   	  echo "  url: $test_url" >>$GROUP_FILE
+   	  echo "    url: $test_url" >>$GROUP_FILE
   }
   [ ! -z "$test_interval" ] && {
-      echo "  interval: \"$test_interval\"" >>$GROUP_FILE
+      echo "    interval: \"$test_interval\"" >>$GROUP_FILE
   }
   [ ! -z "$tolerance" ] && {
-      echo "  tolerance: \"$tolerance\"" >>$GROUP_FILE
+      echo "    tolerance: \"$tolerance\"" >>$GROUP_FILE
   }
 }

--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/yml_proxys_get.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/yml_proxys_get.sh
@ -559,6 +559,11 @@ do
      password="$(cfg_get "password:" "$single_server")"
   fi
   
+   if [ "$server_type" = "http" ]; then
+      #sni:
+      sni="$(cfg_get "sni:" "$single_server")"
+   fi
+   
   if [ "$server_type" = "snell" ]; then
      #psk:
      psk="$(cfg_get "psk:" "$single_server")"
@ -660,13 +665,17 @@ do
      else
         ${uci_set}password="$password"
 	    fi
+	    
+      if [ "$server_type" = "http" ]; then
+         ${uci_set}sni="$sni"
+      fi
 	   
 	    if [ "$server_type" = "trojan" ]; then
-        ${uci_set}sni="$sni"
-        ${uci_del}alpn >/dev/null 2>&1
-        for alpn in $alpns; do
-           ${uci_add}alpn="$alpn" >/dev/null 2>&1
-        done
+         ${uci_set}sni="$sni"
+         ${uci_del}alpn >/dev/null 2>&1
+         for alpn in $alpns; do
+            ${uci_add}alpn="$alpn" >/dev/null 2>&1
+         done
 	    fi
   else
 #添加新节点
@ -755,6 +764,10 @@ do
      else
         ${uci_set}password="$password"
 	    fi
+	    
+	    if [ "$server_type" = "http" ]; then
+         ${uci_set}sni="$sni"
+      fi
 	   
 	    if [ "$server_type" = "trojan" ]; then
         ${uci_set}sni="$sni"
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/yml_proxys_set.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/yml_proxys_set.sh
@ -120,7 +120,7 @@ set_alpn()
      return
   fi
 cat >> "$SERVER_FILE" <<-EOF
-    - $1
+      - $1
 EOF
 }

@ -130,7 +130,7 @@ set_http_path()
      return
   fi
 cat >> "$SERVER_FILE" <<-EOF
-      - '$1'
+        - '$1'
 EOF
 }

@ -259,54 +259,54 @@ yml_servers_set()
 #ss
   if [ "$type" = "ss" ]; then
 cat >> "$SERVER_FILE" <<-EOF
- name: "$name"
-  type: $type
-  server: $server
-  port: $port
-  cipher: $cipher
-  password: "$password"
+  - name: "$name"
+    type: $type
+    server: $server
+    port: $port
+    cipher: $cipher
+    password: "$password"
 EOF
      if [ ! -z "$udp" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  udp: $udp
+    udp: $udp
 EOF
     fi
     if [ ! -z "$obfss" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  $obfss
-  plugin-opts:
-    mode: $obfs
+    $obfss
+    plugin-opts:
+      mode: $obfs
 EOF
        if [ ! -z "$host" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-    host: $host
+      host: $host
 EOF
        fi
        if [  "$obfss" = "plugin: v2ray-plugin" ]; then
           if [ ! -z "$tls" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-    tls: $tls
+      tls: $tls
 EOF
           fi
           if [ ! -z "$skip_cert_verify" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-    skip-cert-verify: $skip_cert_verify
+      skip-cert-verify: $skip_cert_verify
 EOF
           fi
           if [ ! -z "$path" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-    $path
+      $path
 EOF
           fi
           if [ ! -z "$mux" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-    mux: $mux
+      mux: $mux
 EOF
           fi
           if [ ! -z "$custom" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-    headers:
-      custom: $custom
+      headers:
+        custom: $custom
 EOF
           fi
        fi
@ -316,28 +316,28 @@ EOF
 #ssr
 if [ "$type" = "ssr" ]; then
 cat >> "$SERVER_FILE" <<-EOF
- name: "$name"
-  type: $type
-  server: $server
-  port: $port
-  cipher: $cipher_ssr
-  password: "$password"
-  obfs: "$obfs_ssr"
-  protocol: "$protocol"
+  - name: "$name"
+    type: $type
+    server: $server
+    port: $port
+    cipher: $cipher_ssr
+    password: "$password"
+    obfs: "$obfs_ssr"
+    protocol: "$protocol"
 EOF
   if [ ! -z "$obfs_param" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  obfs-param: $obfs_param
+    obfs-param: $obfs_param
 EOF
   fi
   if [ ! -z "$protocol_param" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  protocol-param: $protocol_param
+    protocol-param: $protocol_param
 EOF
   fi
   if [ ! -z "$udp" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  udp: $udp
+    udp: $udp
 EOF
   fi
 fi
@ -345,62 +345,62 @@ fi
 #vmess
   if [ "$type" = "vmess" ]; then
 cat >> "$SERVER_FILE" <<-EOF
- name: "$name"
-  type: $type
-  server: $server
-  port: $port
-  uuid: $uuid
-  alterId: $alterId
-  cipher: $securitys
+  - name: "$name"
+    type: $type
+    server: $server
+    port: $port
+    uuid: $uuid
+    alterId: $alterId
+    cipher: $securitys
 EOF
      if [ ! -z "$udp" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  udp: $udp
+    udp: $udp
 EOF
      fi
      if [ ! -z "$skip_cert_verify" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  skip-cert-verify: $skip_cert_verify
+    skip-cert-verify: $skip_cert_verify
 EOF
      fi
      if [ ! -z "$tls" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  tls: $tls
+    tls: $tls
 EOF
      fi
      if [ ! -z "$servername" ] && [ "$tls" = "true" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  servername: $servername
+    servername: $servername
 EOF
      fi
      if [ "$obfs_vmess" != "none" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  $obfs_vmess
+    $obfs_vmess
 EOF
         if [ ! -z "$path" ] && [ "$obfs_vmess" = "network: ws" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  $path
+    $path
 EOF
         fi
         if [ ! -z "$custom" ] && [ "$obfs_vmess" = "network: ws" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  ws-headers:
-    $custom
+    ws-headers:
+      $custom
 EOF
         fi
         if [ ! -z "$http_path" ] && [ "$obfs_vmess" = "network: http" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  http-opts:
-    method: "GET"
-    path:
+    http-opts:
+      method: "GET"
+      path:
 EOF
            config_list_foreach "$section" "http_path" set_http_path
         fi
         if [ "$keep_alive" = "true" ] && [ "$obfs_vmess" = "network: http" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-    headers:
-      Connection:
-        - keep-alive
+      headers:
+        Connection:
+          - keep-alive
 EOF
         fi
      fi
@ -409,34 +409,34 @@ EOF
 #socks5
   if [ "$type" = "socks5" ]; then
 cat >> "$SERVER_FILE" <<-EOF
- name: "$name"
-  type: $type
-  server: $server
-  port: $port
+  - name: "$name"
+    type: $type
+    server: $server
+    port: $port
 EOF
      if [ ! -z "$auth_name" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  username: $auth_name
+    username: $auth_name
 EOF
      fi
      if [ ! -z "$auth_pass" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  password: $auth_pass
+    password: $auth_pass
 EOF
      fi
      if [ ! -z "$udp" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  udp: $udp
+    udp: $udp
 EOF
      fi
      if [ ! -z "$skip_cert_verify" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  skip-cert-verify: $skip_cert_verify
+    skip-cert-verify: $skip_cert_verify
 EOF
      fi
      if [ ! -z "$tls" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  tls: $tls
+    tls: $tls
 EOF
      fi
   fi
@ -444,29 +444,34 @@ EOF
 #http
   if [ "$type" = "http" ]; then
 cat >> "$SERVER_FILE" <<-EOF
- name: "$name"
-  type: $type
-  server: $server
-  port: $port
+  - name: "$name"
+    type: $type
+    server: $server
+    port: $port
 EOF
      if [ ! -z "$auth_name" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  username: $auth_name
+    username: $auth_name
 EOF
      fi
      if [ ! -z "$auth_pass" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  password: $auth_pass
+    password: $auth_pass
 EOF
      fi
      if [ ! -z "$skip_cert_verify" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  skip-cert-verify: $skip_cert_verify
+    skip-cert-verify: $skip_cert_verify
 EOF
      fi
      if [ ! -z "$tls" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  tls: $tls
+    tls: $tls
+EOF
+      fi
+      if [ ! -z "$sni" ]; then
+cat >> "$SERVER_FILE" <<-EOF
+    sni: $sni
 EOF
      fi
   fi
@ -474,31 +479,31 @@ EOF
 #trojan
   if [ "$type" = "trojan" ]; then
 cat >> "$SERVER_FILE" <<-EOF
- name: "$name"
-  type: $type
-  server: $server
-  port: $port
-  password: "$password"
+  - name: "$name"
+    type: $type
+    server: $server
+    port: $port
+    password: "$password"
 EOF
   if [ ! -z "$udp" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  udp: $udp
+    udp: $udp
 EOF
   fi
   if [ ! -z "$sni" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  sni: $sni
+    sni: $sni
 EOF
   fi
   if [ ! -z "$alpn" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  alpn:
+    alpn:
 EOF
      config_list_foreach "$section" "alpn" set_alpn
   fi
   if [ ! -z "$skip_cert_verify" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  skip-cert-verify: $skip_cert_verify
+    skip-cert-verify: $skip_cert_verify
 EOF
   fi
   fi
@ -506,17 +511,17 @@ EOF
 #snell
   if [ "$type" = "snell" ]; then
 cat >> "$SERVER_FILE" <<-EOF
- name: "$name"
-  type: $type
-  server: $server
-  port: $port
-  psk: $psk
+  - name: "$name"
+    type: $type
+    server: $server
+    port: $port
+    psk: $psk
 EOF
   if [ "$obfs_snell" != "none" ] && [ ! -z "$host" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  obfs-opts:
-    mode: $obfs_snell
-    host: $host
+    obfs-opts:
+      mode: $obfs_snell
+      host: $host
 EOF
   fi
   fi
@ -573,7 +578,7 @@ echo "开始写入配置文件【$CONFIG_NAME】的代理集信息..." >$START_L
 echo "proxy-providers:" >$PROXY_PROVIDER_FILE
 rm -rf /tmp/Proxy_Provider
 config_foreach yml_proxy_provider_set "proxy-provider"
-sed -i "s/^ \{0,\}/  - /" /tmp/Proxy_Provider 2>/dev/null #添加参数
+sed -i "s/^ \{0,\}/      - /" /tmp/Proxy_Provider 2>/dev/null #添加参数
 if [ "$(grep "-" /tmp/Proxy_Provider 2>/dev/null |wc -l)" -eq 0 ]; then
   rm -rf $PROXY_PROVIDER_FILE
   rm -rf /tmp/Proxy_Provider
@ -588,7 +593,7 @@ echo "Proxy:" >$SERVER_FILE
 config_foreach yml_servers_set "servers"
 egrep '^ {0,}-' $SERVER_FILE |grep name: |awk -F 'name: ' '{print $2}' |sed 's/,.*//' 2>/dev/null >/tmp/Proxy_Server 2>&1
 if [ -s "/tmp/Proxy_Server" ]; then
-   sed -i "s/^ \{0,\}/  - /" /tmp/Proxy_Server 2>/dev/null #添加参数
+   sed -i "s/^ \{0,\}/      - /" /tmp/Proxy_Server 2>/dev/null #添加参数
 else
   rm -rf $SERVER_FILE
   rm -rf /tmp/Proxy_Server
@ -600,74 +605,74 @@ if [ "$rule_sources" = "ConnersHua" ] && [ "$servers_if_update" != "1" ] && [ -z
 echo "使用ConnersHua(规则集)规则创建中..." >$START_LOG
 echo "proxy-groups:" >>$SERVER_FILE
 cat >> "$SERVER_FILE" <<-EOF
- name: Auto - UrlTest
-  type: url-test
+  - name: Auto - UrlTest
+    type: url-test
 EOF
 if [ -f "/tmp/Proxy_Server" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  proxies:
+    proxies:
 EOF
 fi
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
-  url: https://cp.cloudflare.com/generate_204
-  interval: "600"
-  tolerance: "150"
- name: Proxy
-  type: select
-  proxies:
-  - Auto - UrlTest
-  - DIRECT
+    url: https://cp.cloudflare.com/generate_204
+    interval: "600"
+    tolerance: "150"
+  - name: Proxy
+    type: select
+    proxies:
+      - Auto - UrlTest
+      - DIRECT
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
- name: Domestic
-  type: select
-  proxies:
-  - DIRECT
-  - Proxy
- name: Others
-  type: select
-  proxies:
-  - Proxy
-  - DIRECT
-  - Domestic
- name: AsianTV
-  type: select
-  proxies:
-  - DIRECT
-  - Proxy
+  - name: Domestic
+    type: select
+    proxies:
+      - DIRECT
+      - Proxy
+  - name: Others
+    type: select
+    proxies:
+      - Proxy
+      - DIRECT
+      - Domestic
+  - name: AsianTV
+    type: select
+    proxies:
+      - DIRECT
+      - Proxy
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
- name: GlobalTV
-  type: select
-  proxies:
-  - Proxy
-  - DIRECT
+  - name: GlobalTV
+    type: select
+    proxies:
+      - Proxy
+      - DIRECT
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
@ -689,188 +694,188 @@ elif [ "$rule_sources" = "lhie1" ] && [ "$servers_if_update" != "1" ] && [ -z "$
 echo "使用lhie1规则创建中..." >$START_LOG
 echo "proxy-groups:" >>$SERVER_FILE
 cat >> "$SERVER_FILE" <<-EOF
- name: Auto - UrlTest
-  type: url-test
+  - name: Auto - UrlTest
+    type: url-test
 EOF
 if [ -f "/tmp/Proxy_Server" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  proxies:
+    proxies:
 EOF
 fi
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
-  url: https://cp.cloudflare.com/generate_204
-  interval: "600"
-  tolerance: "150"
- name: Proxy
-  type: select
-  proxies:
-  - Auto - UrlTest
-  - DIRECT
+    url: https://cp.cloudflare.com/generate_204
+    interval: "600"
+    tolerance: "150"
+  - name: Proxy
+    type: select
+    proxies:
+      - Auto - UrlTest
+      - DIRECT
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
- name: Domestic
-  type: select
-  proxies:
-  - DIRECT
-  - Proxy
- name: Others
-  type: select
-  proxies:
-  - Proxy
-  - DIRECT
-  - Domestic
- name: Apple
-  type: select
-  proxies:
-  - DIRECT
-  - Proxy
- name: Microsoft
-  type: select
-  proxies:
-  - DIRECT
-  - Proxy
- name: Netflix
-  type: select
-  proxies:
-  - GlobalTV
-  - DIRECT
+  - name: Domestic
+    type: select
+    proxies:
+      - DIRECT
+      - Proxy
+  - name: Others
+    type: select
+    proxies:
+      - Proxy
+      - DIRECT
+      - Domestic
+  - name: Apple
+    type: select
+    proxies:
+      - DIRECT
+      - Proxy
+  - name: Microsoft
+    type: select
+    proxies:
+      - DIRECT
+      - Proxy
+  - name: Netflix
+    type: select
+    proxies:
+      - GlobalTV
+      - DIRECT
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
- name: Youtube
-  type: select
-  proxies:
-  - GlobalTV
-  - DIRECT
+  - name: Youtube
+    type: select
+    proxies:
+      - GlobalTV
+      - DIRECT
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
- name: Spotify
-  type: select
-  proxies:
-  - GlobalTV
-  - DIRECT
+  - name: Spotify
+    type: select
+    proxies:
+      - GlobalTV
+      - DIRECT
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
- name: Steam
-  type: select
-  proxies:
-  - DIRECT
-  - Proxy
+  - name: Steam
+    type: select
+    proxies:
+      - DIRECT
+      - Proxy
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
- name: AdBlock
-  type: select
-  proxies:
-  - REJECT
-  - DIRECT
-  - Proxy
- name: AsianTV
-  type: select
-  proxies:
-  - DIRECT
-  - Proxy
+  - name: AdBlock
+    type: select
+    proxies:
+      - REJECT
+      - DIRECT
+      - Proxy
+  - name: AsianTV
+    type: select
+    proxies:
+      - DIRECT
+      - Proxy
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
- name: GlobalTV
-  type: select
-  proxies:
-  - Proxy
-  - DIRECT
+  - name: GlobalTV
+    type: select
+    proxies:
+      - Proxy
+      - DIRECT
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
- name: Speedtest
-  type: select
-  proxies:
-  - Proxy
-  - DIRECT
+  - name: Speedtest
+    type: select
+    proxies:
+      - Proxy
+      - DIRECT
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
- name: Telegram
-  type: select
-  proxies:
-  - Proxy
-  - DIRECT
+  - name: Telegram
+    type: select
+    proxies:
+      - Proxy
+      - DIRECT
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
- name: PayPal
-  type: select
-  proxies:
-  - DIRECT
-  - Proxy
+  - name: PayPal
+    type: select
+    proxies:
+      - DIRECT
+      - Proxy
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
@ -908,44 +913,44 @@ elif [ "$rule_sources" = "ConnersHua_return" ] && [ "$servers_if_update" != "1"
 echo "使用ConnersHua回国规则创建中..." >$START_LOG
 echo "proxy-groups:" >>$SERVER_FILE
 cat >> "$SERVER_FILE" <<-EOF
- name: Auto - UrlTest
-  type: url-test
+  - name: Auto - UrlTest
+    type: url-test
 EOF
 if [ -f "/tmp/Proxy_Server" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  proxies:
+    proxies:
 EOF
 fi
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
-  url: https://cp.cloudflare.com/generate_204
-  interval: "600"
-  tolerance: "150"
- name: Proxy
-  type: select
-  proxies:
-  - Auto - UrlTest
-  - DIRECT
+    url: https://cp.cloudflare.com/generate_204
+    interval: "600"
+    tolerance: "150"
+  - name: Proxy
+    type: select
+    proxies:
+      - Auto - UrlTest
+      - DIRECT
 EOF
 cat /tmp/Proxy_Server >> $SERVER_FILE 2>/dev/null
 if [ -f "/tmp/Proxy_Provider" ]; then
 cat >> "$SERVER_FILE" <<-EOF
-  use:
+    use:
 EOF
 fi
 cat /tmp/Proxy_Provider >> $SERVER_FILE 2>/dev/null
 cat >> "$SERVER_FILE" <<-EOF
- name: Others
-  type: select
-  proxies:
-  - Proxy
-  - DIRECT
+  - name: Others
+    type: select
+    proxies:
+      - Proxy
+      - DIRECT
 EOF
 ${UCI_SET}rule_source="ConnersHua_return"
 ${UCI_SET}Proxy="Proxy"
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/yml_rules_change.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/yml_rules_change.sh
@ -29,17 +29,6 @@ yml_other_set()
      sed -i '/- DOMAIN-KEYWORD,find_node,DIRECT/d' "$4" 2>/dev/null
      sed -i '/- DOMAIN-KEYWORD,BitTorrent,DIRECT/d' "$4" 2>/dev/null
      sed -i '/- DOMAIN-KEYWORD,announce_peer,DIRECT/d' "$4" 2>/dev/null
-      
-      if [ -z "$(grep '^ \{0,\}- IP-CIDR,198.18.0.1/16,REJECT,no-resolve' "$4")" ] && [ "$6" = "fake-ip" ]; then
-         if [ ! -z "$(grep "^ \{0,\}- IP-CIDR,198.18.0.1/16" "$4")" ]; then
-            sed -i "/^ \{0,\}- IP-CIDR,198.18.0.1\/16/c\- IP-CIDR,198.18.0.1\/16,REJECT,no-resolve" "$4" 2>/dev/null
-         else
-            sed -i '1,/^ \{0,\}- GEOIP/{/^ \{0,\}- GEOIP/s/^ \{0,\}- GEOIP/- IP-CIDR,198.18.0.1\/16,REJECT,no-resolve\n&/}' "$4" 2>/dev/null
-            if [ -z "$(grep '^- IP-CIDR,198.18.0.1/16,REJECT,no-resolve' "$4")" ]; then
-               sed -i '1,/^ \{0,\}- MATCH/{/^ \{0,\}- MATCH/s/^ \{0,\}- MATCH/- IP-CIDR,198.18.0.1\/16,REJECT,no-resolve\n&/}' "$4" 2>/dev/null
-            fi
-         fi
-      fi

      if [ "$7" = 1 ]; then
         sed -i '1,/^ \{0,\}- GEOIP/{/^ \{0,\}- GEOIP/s/^ \{0,\}- GEOIP/- DOMAIN-KEYWORD,tracker,DIRECT\n&/}' "$4" 2>/dev/null