diff --git a/package/lean/luci-app-unblockmusic/Makefile b/package/lean/luci-app-unblockmusic/Makefile
index bdde3e25ed..129b04f8e2 100644
--- a/package/lean/luci-app-unblockmusic/Makefile
+++ b/package/lean/luci-app-unblockmusic/Makefile
@@ -10,11 +10,11 @@
 include $(TOPDIR)/rules.mk
 
 LUCI_TITLE:=LuCI support for Unblock NeteaseCloudMusic
-LUCI_DEPENDS:=+node +bash
+LUCI_DEPENDS:=+node +bash +dnsmasq-full +ipsec
 LUCI_PKGARCH:=all
 PKG_NAME:=luci-app-unblockmusic
-PKG_VERSION:=1
-PKG_RELEASE:=36
+PKG_VERSION:=1.2
+PKG_RELEASE:=37
 
 PKG_MAINTAINER:=<https://github.com/maxlicheng/luci-app-unblockmusic>
 
diff --git a/package/lean/luci-app-unblockmusic/luasrc/model/cbi/unblockmusic.lua b/package/lean/luci-app-unblockmusic/luasrc/model/cbi/unblockmusic.lua
index 263bf982f4..7de780c274 100644
--- a/package/lean/luci-app-unblockmusic/luasrc/model/cbi/unblockmusic.lua
+++ b/package/lean/luci-app-unblockmusic/luasrc/model/cbi/unblockmusic.lua
@@ -16,6 +16,13 @@ enabled = s:option(Flag, "strict_mode", translate("启用严格模式"))
 enabled.description = translate("若将服务部署到公网，则强烈建议使用严格模式，此模式下仅放行网易云音乐所属域名的请求")
 enabled.default = 0
 enabled.rmempty = false
+enabled:depends("enabled", 1)
+
+enabled = s:option(Flag, "enable_ipsec_forward", translate("启用IPSec转发相关流量"))
+enabled.description = translate("开启后，所有网易云音乐流量都会重定向到UnblockNeteaseMusic进行处理，但会导致无法正常访问云音乐网页端")
+enabled.default = 0
+enabled.rmempty = false
+enabled:depends("enabled", 1)
 
 speedtype = s:option(ListValue, "musicapptype", translate("音源选择"))
 speedtype:value("default", translate("默认"))
@@ -28,14 +35,17 @@ speedtype:value("kuwo", translate("酷我音乐"))
 speedtype:value("migu", translate("咕咪音乐"))
 speedtype:value("joox", translate("JOOX音乐"))
 speedtype:value("all", translate("所有平台"))
+speedtype:depends("enabled", 1)
 
 account = s:option(Value, "port", translate("端口号"))
 account.datatype = "string"
+account:depends("enabled", 1)
 
 enabled = s:option(Flag, "set_netease_server_ip", translate("自定义网易云服务器IP"))
 enabled.description = translate("自定义网易云服务器IP地址；如使用Hosts方式则必选，否则将会导致连接死循环")
 enabled.default = 0
 enabled.rmempty = false
+enabled:depends("enabled", 1)
 
 account = s:option(Value, "netease_server_ip", translate("网易云服务器IP"))
 account.description = translate("通过 ping music.163.com 即可获得IP地址，仅限填写一个")
@@ -47,6 +57,7 @@ enabled = s:option(Flag, "enable_proxy", translate("使用代理服务器"))
 enabled.description = translate("如您的OpenWRT系统部署在海外，则此选项必选，否则可能无法正常使用")
 enabled.default = 0
 enabled.rmempty = false
+enabled:depends("enabled", 1)
 
 account = s:option(Value, "proxy_server_ip", translate("代理服务器IP"))
 account.description = translate("具体格式请参考：https://github.com/nondanee/UnblockNeteaseMusic")
diff --git a/package/lean/luci-app-unblockmusic/root/etc/config/unblockmusic b/package/lean/luci-app-unblockmusic/root/etc/config/unblockmusic
index 54bc0d8499..0c840d97b5 100644
--- a/package/lean/luci-app-unblockmusic/root/etc/config/unblockmusic
+++ b/package/lean/luci-app-unblockmusic/root/etc/config/unblockmusic
@@ -1,9 +1,9 @@
 
 config unblockmusic
 	option enabled '0'
-	option port '5200'
-	option enable_proxy '0'
-	option musicapptype 'all'
-	option set_netease_server_ip '0'
-	option netease_server_ip '59.111.181.38'
 	option strict_mode '0'
+	option enable_ipsec_forward '0'
+	option musicapptype 'all'
+	option port '5200'
+	option set_netease_server_ip '0'
+	option enable_proxy '0'
diff --git a/package/lean/luci-app-unblockmusic/root/etc/init.d/unblockmusic b/package/lean/luci-app-unblockmusic/root/etc/init.d/unblockmusic
index 9bab453d5a..acea32681b 100755
--- a/package/lean/luci-app-unblockmusic/root/etc/init.d/unblockmusic
+++ b/package/lean/luci-app-unblockmusic/root/etc/init.d/unblockmusic
@@ -25,12 +25,31 @@ start()
 	else
 		node /usr/share/unblockmusic/app.js -p ${port} -o ${type} ${netease_server_ip} ${proxy_server_ip} ${strict_mode} >/tmp/unblockmusic.log 2>&1 &
 	fi
-
-	/usr/share/unblockmusic/logcheck.sh >/dev/null 2>&1 &
+	
+	if [ "$(uci get unblockmusic.@unblockmusic[0].enable_ipsec_forward)" -ne "0" ]; then
+		echo -e "ipset=/.music.163.com/music" >> /etc/dnsmasq.conf
+		/etc/init.d/dnsmasq restart >/dev/null 2>&1
+	
+		mkdir -p /var/etc
+		cat > "/var/etc/unblockmusic.include" <<-EOF
+if ! ipset list music >/dev/null; then ipset create music hash:ip; fi
+iptables -t nat -N cloud_music
+iptables -t nat -A cloud_music -i br-lan -p tcp -j REDIRECT --to-ports ${port}
+iptables -t nat -A prerouting_rule -i br-lan -p tcp -m set --match-set music dst -j cloud_music
+		EOF
+		/etc/init.d/firewall restart >/dev/null 2>&1
+	
+		/usr/share/unblockmusic/logcheck.sh >/dev/null 2>&1 &
+	fi
 }
 
 stop()
 {
 	kill -9 "$(ps | grep app.js | grep -v grep | awk '{print $1}')" >/dev/null 2>&1
 	kill -9 "$(ps | grep logcheck.sh | grep -v grep | awk '{print $1}')" >/dev/null 2>&1
+	rm -f /tmp/unblockmusic.log
+	echo "" > /var/etc/unblockmusic.include
+	/etc/init.d/firewall reload >/dev/null 2>&1
+	sed -i '/ipset=\/.music.163.com\/music/d' /etc/dnsmasq.conf
+	/etc/init.d/dnsmasq restart >/dev/null 2>&1
 }
diff --git a/package/lean/luci-app-unblockmusic/root/etc/uci-defaults/unblockmusic b/package/lean/luci-app-unblockmusic/root/etc/uci-defaults/unblockmusic
index da27538389..7f68d06190 100755
--- a/package/lean/luci-app-unblockmusic/root/etc/uci-defaults/unblockmusic
+++ b/package/lean/luci-app-unblockmusic/root/etc/uci-defaults/unblockmusic
@@ -5,6 +5,13 @@ uci -q batch <<-EOF >/dev/null
 	add ucitrack unblockmusic
 	set ucitrack.@unblockmusic[-1].init=unblockmusic
 	commit ucitrack
+	delete firewall.unblockmusic
+	set firewall.unblockmusic=include
+	set firewall.unblockmusic.type=script
+	set firewall.unblockmusic.path=/var/etc/unblockmusic.include
+	set firewall.unblockmusic.reload=1
+	commit firewall
+
 EOF
 
 rm -f /tmp/luci-indexcache