dns_server: multi-threading

smartdns: some minor fix
readme: update readme.
2023-02-02 14:53:00 +08:00 · 2023-02-02 14:10:00 +08:00 · 2023-02-01 22:52:58 +08:00 · 2023-01-31 22:51:08 +08:00 · 2023-01-30 23:26:08 +08:00 · 2023-01-29 23:26:16 +08:00
74 changed files with 3536 additions and 929 deletions
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/ReadMe.md
+++ b/ReadMe.md
@@ -99,31 +99,31 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
 1. **多 DNS 上游服务器**  
   支持配置多个上游 DNS 服务器，并同时进行查询，即使其中有 DNS 服务器异常，也不会影响查询。  

-2. **返回最快 IP 地址**  
+1. **返回最快 IP 地址**  
   支持从域名所属 IP 地址列表中查找到访问速度最快的 IP 地址，并返回给客户端，提高网络访问速度。

-3. **支持多种查询协议**  
-   支持 UDP、TCP、DOT 和 DOH 查询，以及非 53 端口查询。
+1. **支持多种查询协议**  
+   支持 UDP、TCP、DOT 和 DOH 查询，以及非 53 端口查询；支持通过socks5，HTTP代理查询。

-4. **特定域名 IP 地址指定**  
+1. **特定域名 IP 地址指定**  
   支持指定域名的 IP 地址，达到广告过滤效果、避免恶意网站的效果。

-5. **域名高性能后缀匹配**  
+1. **域名高性能后缀匹配**  
   支持域名后缀匹配模式，简化过滤配置，过滤 20 万条记录时间 < 1ms。

-6. **域名分流**  
+1. **域名分流**  
   支持域名分流，不同类型的域名向不同的 DNS 服务器查询，支持iptable和nftable更好的分流。

-7. **Windows / Linux 多平台支持**  
+1. **Windows / Linux 多平台支持**  
   支持标准 Linux 系统（树莓派）、OpenWrt 系统各种固件和华硕路由器原生固件。同时还支持 WSL（Windows Subsystem for Linux，适用于 Linux 的 Windows 子系统）。

-8. **支持 IPv4、IPv6 双栈**  
+1. **支持 IPv4、IPv6 双栈**  
   支持 IPv4 和 IPV 6网络，支持查询 A 和 AAAA 记录，支持双栈 IP 速度优化，并支持完全禁用 IPv6 AAAA 解析。

-9. **高性能、占用资源少**  
+1. **高性能、占用资源少**  
   多线程异步 IO 模式，cache 缓存查询结果。

-10. **主流系统官方支持**
+1. **主流系统官方支持**
   主流路由系统官方软件源安装smartdns。

 ## 架构
@@ -131,9 +131,9 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
 ![Architecture](https://github.com/pymumu/test/releases/download/blob/architecture.png)

 1. SmartDNS 接收本地网络设备的DNS 查询请求，如 PC、手机的查询请求；
-2. 然后将查询请求发送到多个上游 DNS 服务器，可支持 UDP 标准端口或非标准端口查询，以及 TCP 查询；
-3. 上游 DNS 服务器返回域名对应的服务器 IP 地址列表，SmartDNS 则会检测从本地网络访问速度最快的服务器 IP；
-4. 最后将访问速度最快的服务器 IP 返回给本地客户端。
+1. 然后将查询请求发送到多个上游 DNS 服务器，可支持 UDP 标准端口或非标准端口查询，以及 TCP 查询；
+1. 上游 DNS 服务器返回域名对应的服务器 IP 地址列表，SmartDNS 则会检测从本地网络访问速度最快的服务器 IP；
+1. 最后将访问速度最快的服务器 IP 返回给本地客户端。

 ## 下载

@@ -143,10 +143,10 @@ smartdns已经合入主流系统的软件仓库，可以直接使用系统安装

 系统|安装方式|说明|
 --|--|--
-openwrt|opkg update<br>opkg install luci-app-smartdns<br>opkg install smartdns|22.03之后的系统。软件源路径：https://downloads.openwrt.org/releases/
-ddwrt|官方最新固件service页面->SmartDNS Resolver->启用。|选择界面参考：https://forum.dd-wrt.com/demo/Services.html
+openwrt|opkg update<br />opkg install luci-app-smartdns<br />opkg install smartdns|22.03之后的系统。软件源路径：<https://downloads.openwrt.org/releases/>
+ddwrt|官方最新固件service页面->SmartDNS Resolver->启用。|选择界面参考：<https://forum.dd-wrt.com/demo/Services.html>
 debian|apt-get install smartdns|
-entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entware.net/
+entware|ipkg update<br />ipkg install smartdns|软件源路径：<https://bin.entware.net/>

 ### 手工下载安装

@@ -174,9 +174,9 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa

 **请注意：**

-* Release 释出的软件包采取静态编译，无外部依赖，但体积大。若需要小体积软件包，请自行编译或从 OpenWrt / Entware 仓库获取。
+- Release 释出的软件包采取静态编译，无外部依赖，但体积大。若需要小体积软件包，请自行编译或从 OpenWrt / Entware 仓库获取。

-* 静态编译的软件包未强制判断 CPU 架构，安装不正确的软件包将会导致服务无法启动，请确保正确安装对应的版本。
+- 静态编译的软件包未强制判断 CPU 架构，安装不正确的软件包将会导致服务无法启动，请确保正确安装对应的版本。

 ## 安装和使用

@@ -185,40 +185,46 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
 --------------

 1. 安装
-   
-    下载配套安装包，并上传到 Linux 系统中。 
+
+    下载配套安装包，并上传到 Linux 系统中。

    标准 Linux 系统（X86 / X86_64）请执行如下命令安装：

    ```shell
-    $ tar zxf smartdns.1.yyyy.MM.dd-REL.x86_64-linux-all.tar.gz
-    $ cd smartdns
-    $ chmod +x ./install
-    $ ./install -i
+    tar zxf smartdns.1.yyyy.MM.dd-REL.x86_64-linux-all.tar.gz
+    cd smartdns
+    chmod +x ./install
+    ./install -i
    ```

    树莓派或其他 Debian 系系统（ARM / ARM64）请执行如下命令安装：

    ```shell
-    # dpkg -i smartdns.1.yyyy.MM.dd-REL.arm-debian-all.deb
+    dpkg -i smartdns.1.yyyy.MM.dd-REL.arm-debian-all.deb
    ```

-2. 修改配置
-   
+    **对于Ubuntu系统：**
+    - `systemd-resolved`会占用TCP53和UDP53端口。你需要手动解决端口占用问题或者修改smartdns监听端口
+
+    - 日志文件在`/var/log/smartdns/smartdns.log`
+
+1. 修改配置
+
    安装完成后，可配置 SmartDNS 的上游服务器信息。

-    一般情况下，只需要增加 `server `[`IP`]`:port` 和 `server-tcp `[`IP`]`:port` 配置项。
+    一般情况下，只需要增加 `server`[`IP`]`:port` 和 `server-tcp`[`IP`]`:port` 配置项。

    请尽可能配置多个上游 DNS 服务器，包括国内外的服务器。

    具体配置参数请参考[配置文件说明](#配置文件说明)。  
-   
+
    ```shell
-    # vi /etc/smartdns/smartdns.conf
+    vi /etc/smartdns/smartdns.conf
    ```

    `/etc/smartdns/smartdns.conf`配置包含如下基本内容：
-    ```
+
+    ```shell
    # 指定监听的端口号
    bind []:53 
    # 指定上游服务器
@@ -229,33 +235,33 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
    domain-rule /example.com/ -address 1.2.3.4
    ```

-3. 启动服务
-   
+1. 启动服务
+
    ```shell
-    # systemctl enable smartdns
-    # systemctl start smartdns
+    systemctl enable smartdns
+    systemctl start smartdns
    ```

-4. 将 DNS 请求转发到 SmartDNS 解析
-   
+1. 将 DNS 请求转发到 SmartDNS 解析
+
    修改本地路由器的 DNS 服务器，将 DNS 服务器配置为 SmartDNS。
-   
-   * 登录到本地网络的路由器中，配置树莓派，分配其静态 IP 地址。
-   * 修改 WAN 口或者 DHCP DNS 为树莓派 IP 地址。
+
+   - 登录到本地网络的路由器中，配置树莓派，分配其静态 IP 地址。
+   - 修改 WAN 口或者 DHCP DNS 为树莓派 IP 地址。
     **注意：**
      I. 每款路由器配置方法不尽相同，请在网络上搜索对应配置方法。
      II. 华为等路由器可能不支持配置 DNS 为本地 IP，可修改电脑端或手机端的 DNS 服务器为树莓派 IP。

-5. 检测服务是否配置成功
-   
+1. 检测服务是否配置成功
+
    执行
-   
+
   ```shell
-   $ nslookup -querytype=ptr smartdns
+   nslookup -querytype=ptr smartdns
   ```
-   
+
    查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
-   
+
   ```shell
   $ nslookup -querytype=ptr smartdns
   Server:         192.168.1.1
@@ -270,57 +276,57 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
 --------------

 1. 安装
-   
+
    将软件包（使用 WinSCP 等）上传到路由器的 `/root` 目录，执行如下命令安装
-   
+
   ```shell
-   # opkg install smartdns.1.yyyy.MM.dd-REL.xxxx.ipk
-   # opkg install luci-app-smartdns.1.yyyy.MM.dd-REL.all.ipk
+   opkg install smartdns.1.yyyy.MM.dd-REL.xxxx.ipk
+   opkg install luci-app-smartdns.1.yyyy.MM.dd-REL.all.ipk
   ```
-   
-   * **注意：** 19.07 之前的版本，请务必安装 `luci-app-smartdns.1.yyyy.MM.dd-REL.all-luci-compat-all.ipk`。

-2. 修改配置
-   
+   - **注意：** 19.07 之前的版本，请务必安装 `luci-app-smartdns.1.yyyy.MM.dd-REL.all-luci-compat-all.ipk`。
+
+1. 修改配置
+
    登录 OpenWrt 管理页面，打开 `Services` -> `SmartDNS` 进行配置。
-   
-   * 在 `Upstream Servers` 增加上游 DNS 服务器配置，建议配置多个国内外 DNS 服务器。
-   * 在 `Domain Address` 指定特定域名的 IP 地址，可用于广告屏蔽。

-3. 启用服务
-     
-  * 替换默认Dndmasq为主DNS。
-    
-    登录 OpenWrt 管理界面，点击 `Services` -> `SmartDNS` -> `port`，设置端口号为`53`，smartdns会自动接管主DNS服务器。
+   - 在 `Upstream Servers` 增加上游 DNS 服务器配置，建议配置多个国内外 DNS 服务器。
+   - 在 `Domain Address` 指定特定域名的 IP 地址，可用于广告屏蔽。

-  * 检测转发服务是否配置成功
-    
-    执行
-    
-    ```shell
-    $ nslookup -querytype=ptr smartdns
-    ```
-    
-    查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
-    
-    ```shell
-    $ nslookup -querytype=ptr smartdns
-    Server:         192.168.1.1
-    Address:        192.168.1.1#53
-    
-    Non-authoritative answer:
-    smartdns        name = smartdns.
-       ```
+1. 启用服务
+
+   - 替换默认Dnsmasq为主DNS。
+
+     登录 OpenWrt 管理界面，点击 `Services` -> `SmartDNS` -> `port`，设置端口号为`53`，smartdns会自动接管主DNS服务器。
+
+   - 检测转发服务是否配置成功
+
+     执行
+
+     ```shell
+     nslookup -querytype=ptr smartdns
+     ```
+
+     查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
+
+     ```shell
+     $ nslookup -querytype=ptr smartdns
+     Server:         192.168.1.1
+     Address:        192.168.1.1#53
+        
+     Non-authoritative answer:
+     smartdns        name = smartdns.
+     ```
+
+1. 启动服务

-4. 启动服务
-   
    勾选配置页面中的 `Enable（启用）`来启动 SmartDNS。

-5. **注意：**
-   
-   * 如已经安装 ChinaDNS，建议将 ChinaDNS 的上游配置为 SmartDNS。
-   * 当smartdns的端口为53时，将自动接管dnsmasq为主dns。配置其他端口时，会重新启用dnsmasq为主dns。
-   * 若在此过程中发生异常，可使用如下命令还原dnsmasq为主DNS
+1. **注意：**
+
+   - 如已经安装 ChinaDNS，建议将 ChinaDNS 的上游配置为 SmartDNS。
+   - 当smartdns的端口为53时，将自动接管dnsmasq为主dns。配置其他端口时，会重新启用dnsmasq为主dns。
+   - 若在此过程中发生异常，可使用如下命令还原dnsmasq为主DNS

   ```shell
   uci delete dhcp.@dnsmasq[0].port
@@ -335,37 +341,37 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
 **说明：** 梅林固件派生自华硕固件，理论上可以直接使用华硕配套的安装包使用。但目前未经验证，如有问题，请提交 Issue。

 1. 准备
-   
+
    在使用此软件时，需要确认路由器是否支持 U 盘，并准备好 U 盘一个。

-2. 启用 SSH 登录
-   
+1. 启用 SSH 登录
+
    登录管理界面，点击 `系统管理` -> `系统设置`，配置 `Enable SSH` 为 `Lan Only`。  
    SSH 登录用户名密码与管理界面相同。

-3. 下载 `Download Master`
-   
+1. 下载 `Download Master`
+
    在管理界面点击 `USB 相关应用` -> `Download Master` 下载。  
    下载完成后，启用 `Download Master`，如果不需要下载功能，此时可以卸载 `Download Master`，但要保证卸载前 `Download Master` 是启用的。  

-4. 安装 SmartDNS
-   
+1. 安装 SmartDNS
+
    将软件包（使用 WinSCP 等）上传到路由器的 `/tmp/mnt/sda1` 目录（或网上邻居复制到 sda1 共享目录），执行如下命令安装
-   
+
   ```shell
-   # ipkg install smartdns.1.yyyy.MM.dd-REL.mipsbig.ipk
+   ipkg install smartdns.1.yyyy.MM.dd-REL.mipsbig.ipk
   ```

-5. 重启路由器使服务生效
-   
+1. 重启路由器使服务生效
+
    待路由器启动后， 执行
-   
+
   ```shell
-   $ nslookup -querytype=ptr smartdns
+   nslookup -querytype=ptr smartdns
   ```
-   
+
    查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
-   
+
   ```shell
   $ nslookup -querytype=ptr smartdns
   Server:         192.168.1.1
@@ -375,11 +381,11 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
   smartdns        name = smartdns.
   ```

-6. **额外说明**
-   
+1. **额外说明**
+
    上述过程，SmartDNS 将安装到 U 盘根目录，采用 Optware 的模式运行。
-    其目录结构如下（此处仅列出 SmartDNS 相关文件）： 
-   
+    其目录结构如下（此处仅列出 SmartDNS 相关文件）：
+
   ```shell
   U 盘
   └── asusware.mipsbig
@@ -396,15 +402,16 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
           |          └── smartdns
           ....
   ```
-   
+
    如要修改配置，可以 SSH 登录路由器，使用 vi 命令修改
-   
+
   ```shell
-   # vi /opt/etc/smartdns/smartdns.conf
+   vi /opt/etc/smartdns/smartdns.conf
   ```

    `/opt/etc/smartdns/smartdns.conf`配置包含如下基本内容：
-    ```
+
+    ```shell
    # 指定监听的端口号
    bind []:53 
    # 指定上游服务器
@@ -414,9 +421,9 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
    address /example.com/1.2.3.4
    domain-rule /example.com/ -address 1.2.3.4
    ```
-   
+
   也可以通过网上邻居修改，网上邻居共享目录 `sda1` 看不到 `asusware.mipsbig` 目录，但可以直接在`文件管理器`中输入 `asusware.mipsbig\etc\init.d` 访问
-   
+
   ```shell
   \\192.168.1.1\sda1\asusware.mipsbig\etc\init.d
   ```
@@ -426,25 +433,26 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
 --------------

 1. 准备
-   
+
    在使用此软件时，需要确认路由器是否支持 U 盘，并准备好 U 盘一个。

-2. 安装 SmartDNS
-   
+1. 安装 SmartDNS
+
    将软件（使用 WinSCP 等）上传到路由器的 `/tmp` 目录，执行如下命令安装
-   
+
   ```shell
-   # ipkg install smartdns.1.yyyy.MM.dd-REL.mipsbig.ipk
+   ipkg install smartdns.1.yyyy.MM.dd-REL.mipsbig.ipk
   ```

-3. 修改 SmartDNS 配置
-   
+1. 修改 SmartDNS 配置
+
   ```shell
-   # vi /opt/etc/smartdns/smartdns.conf
+   vi /opt/etc/smartdns/smartdns.conf
   ```

   `/opt/etc/smartdns/smartdns.conf`配置包含如下基本内容：
-    ```
+
+    ```shell
    # 指定监听的端口号
    bind []:53 
    # 指定上游服务器
@@ -454,23 +462,23 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
    address /example.com/1.2.3.4
    domain-rule /example.com/ -address 1.2.3.4
    ```
-   
+
    另外，如需支持 IPv6，可设置工作模式为 `2`，将 DNSmasq 的 DNS 服务禁用，设置 SmartDNS 为主用 DNS 服务器。将文件 `/opt/etc/smartdns/smartdns-opt.conf` 中的 `SMARTDNS_WORKMODE` 的值修改为 `2`
-   
+
   ```shell
   SMARTDNS_WORKMODE="2"
   ```

-4. 重启路由器使服务生效
-   
+1. 重启路由器使服务生效
+
    待路由器启动后， 执行
-   
+
   ```shell
-   $ nslookup -querytype=ptr smartdns
+   nslookup -querytype=ptr smartdns
   ```
-   
+
    查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
-   
+
   ```shell
   $ nslookup -querytype=ptr smartdns
   Server:         192.168.1.1
@@ -479,7 +487,7 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
   Non-authoritative answer:
   smartdns        name = smartdns.
   ```
-   
+
    **注意：** 若服务没有自动启动，则需要设置 Optware / Entware 自动启动，具体方法请参考 Optware/Entware 的文档。

 ### WSL
@@ -487,13 +495,13 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
 --------------

 1. 安装 WSL
-   
+
    安装 WSL 运行环境，发行版本选择 Ubuntu 系统为例。安装步骤请参考 [WSL 安装说明](https://docs.microsoft.com/zh-CN/windows/wsl/install)

-2. 安装 SmartDNS
-   
+1. 安装 SmartDNS
+
    下载适用于 WSL 的安装包，并解压到如 D 盘根目录。解压后目录如下：
-   
+
   ```shell
   D:\SMARTDNS
   ├─etc
@@ -505,19 +513,20 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
   ├─src
   └─systemd
   ```
-   
+
     双击 `D:\smartdns\package\windows` 目录下的 `install.bat` 进行安装。要求输入密码时，请输入 `WLS ubuntu` 的密码。

-3. 修改配置
-   
+1. 修改配置
+
    用记事本等打开 `D:\smartdns\etc\smartdns` 目录中的 `smartdns.conf` 配置文件配置 SmartDNS。
-   
+
    一般情况下，只需要增加 `server [IP]:port` 和 `server-tcp [IP]:port` 配置项，
    尽可能配置多个上游DNS服务器，包括国内外的服务器。
-   
+
    具体配置请参考[配置文件说明](#配置文件说明)。
     `smartdns.conf` 配置包含如下基本内容：
-    ```
+
+    ```shell
    # 指定监听的端口号
    bind []:53 
    # 指定上游服务器
@@ -528,24 +537,24 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
    domain-rule /example.com/ -address 1.2.3.4
    ```

-4. 重新加载配置
-   
+1. 重新加载配置
+
    双击 `D:\smartdns\package\windows` 目录下的 `reload.bat` 进行重新加载。要求输入密码时，请输入 `WLS ubuntu` 的密码。

-5. 将 DNS 请求转发到 SmartDNS 解析
-   
+1. 将 DNS 请求转发到 SmartDNS 解析
+
    将 Windows 的默认 DNS 服务器修改为 `127.0.0.1`，具体步骤参考 Windows [更改 TCP/IP 设置](https://support.microsoft.com/zh-cn/help/15089/windows-change-tcp-ip-settings)。

-6. 检测服务是否配置成功
-   
+1. 检测服务是否配置成功
+
    执行
-   
+
   ```shell
-   $ nslookup -querytype=ptr smartdns
+   nslookup -querytype=ptr smartdns
   ```
-   
+
    查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
-   
+
   ```shell
   $ nslookup -querytype=ptr smartdns
   Server:         192.168.1.1
@@ -555,7 +564,6 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
   smartdns        name = smartdns.
   ```

-
 ## 配置文件说明

 配置建议：**smartdns默认已设置为最优模式，适合大部分场景的DNS查询体验改善，一般情况只需要增加上游服务器地址即可，无需做其他配置修改；如有其他配置修改，请务必了解其用途，避免修改后起到反作用。**
@@ -563,11 +571,11 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
 | 键名 | 功能说明 | 默认值 | 可用值/要求 | 举例 |
 | :--- | :--- | :--- | :--- | :--- |
 | server-name | DNS 服务器名称 | 操作系统主机名 / smartdns | 符合主机名规格的字符串 | server-name smartdns |
-| bind | DNS 监听端口号  | [::]:53 | 可绑定多个端口。<br>IP:PORT: 服务器 IP:端口号<br>[-group]: 请求时使用的 DNS 服务器组<br>[-no-rule-addr]：跳过 address 规则<br>[-no-rule-nameserver]：跳过 Nameserver 规则<br>[-no-rule-ipset]：跳过 ipset 和 nftset 规则<br>[-no-rule-soa]：跳过 SOA(#) 规则<br>[-no-dualstack-selection]：停用双栈测速<br>[-no-speed-check]：停用测速<br>[-no-cache]：停止缓存 | bind :53 |
-| bind-tcp | DNS TCP 监听端口号 | [::]:53 | 可绑定多个端口。<br>IP:PORT: 服务器 IP:端口号<br>[-group]: 请求时使用的 DNS 服务器组<br>[-no-rule-addr]：跳过 address 规则<br>[-no-rule-nameserver]：跳过 nameserver 规则<br>[-no-rule-ipset]：跳过 ipset 和 nftset 规则。<br>[-no-rule-soa]：跳过 SOA(#) 规则<br>[-no-dualstack-selection]：停用双栈测速<br>[-no-speed-check]：停用测速<br>[-no-cache]：停止缓存 | bind-tcp :53 |
+| bind | DNS 监听端口号  | [::]:53 | 可绑定多个端口。<br />IP:PORT@DEVICE: 服务器 IP:端口号@设备名<br />[-group]: 请求时使用的 DNS 服务器组<br />[-no-rule-addr]：跳过 address 规则<br />[-no-rule-nameserver]：跳过 Nameserver 规则<br />[-no-rule-ipset]：跳过 ipset 和 nftset 规则<br />[-no-rule-soa]：跳过 SOA(#) 规则<br />[-no-dualstack-selection]：停用双栈测速<br />[-no-speed-check]：停用测速<br />[-no-cache]：停止缓存 | bind :53@eth0 |
+| bind-tcp | DNS TCP 监听端口号 | [::]:53 | 可绑定多个端口。<br />IP:PORT@DEVICE: 服务器 IP:端口号@设备名<br />[-group]: 请求时使用的 DNS 服务器组<br />[-no-rule-addr]：跳过 address 规则<br />[-no-rule-nameserver]：跳过 nameserver 规则<br />[-no-rule-ipset]：跳过 ipset 和 nftset 规则。<br />[-no-rule-soa]：跳过 SOA(#) 规则<br />[-no-dualstack-selection]：停用双栈测速<br />[-no-speed-check]：停用测速<br />[-no-cache]：停止缓存 | bind-tcp :53 |
 | cache-size | 域名结果缓存个数 | 512 | 大于等于 0 的数字 | cache-size 512 |
-| cache-persist | 是否持久化缓存 | 自动。<br>当 cache-file 所在的位置有超过 128 MB 的可用空间时启用，否则禁用。 | [yes\|no] | cache-persist yes |
-| cache-file | 缓存持久化文件路径 | /tmp/smartdns.cache | 合法路径字符串 | cache-file /tmp/smartdns.cache |
+| cache-persist | 是否持久化缓存 | 自动。<br />当 cache-file 所在的位置有超过 128 MB 的可用空间时启用，否则禁用。 | [yes\|no] | cache-persist yes |
+| cache-file | 缓存持久化文件路径 | /tmp/<br />smartdns.cache | 合法路径字符串 | cache-file /tmp/smartdns.cache |
 | tcp-idle-time | TCP 链接空闲超时时间 | 120 | 大于等于 0 的数字 | tcp-idle-time 120 |
 | rr-ttl | 域名结果 TTL | 远程查询结果 | 大于 0 的数字 | rr-ttl 600 |
 | rr-ttl-min | 允许的最小 TTL 值 | 远程查询结果 | 大于 0 的数字 | rr-ttl-min 60 |
@@ -576,35 +584,38 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
 | local-ttl | 本地HOST，address的TTL值 | rr-ttl-min | 大于 0 的数字 | local-ttl  60 |
 | max-reply-ip-num | 允许返回给客户的最大IP数量 | IP数量 | 大于 0 的数字 | max-reply-ip-num 1 |
 | log-level | 设置日志级别 | error | fatal、error、warn、notice、info 或 debug | log-level error |
-| log-file | 日志文件路径 | /var/log/smartdns/smartdns.log | 合法路径字符串 | log-file /var/log/smartdns/smartdns.log |
+| log-file | 日志文件路径 | /var/log/<br />smartdns/<br />smartdns.log | 合法路径字符串 | log-file /var/log/smartdns/smartdns.log |
 | log-size | 日志大小 | 128K | 数字 + K、M 或 G | log-size 128K |
-| log-num | 日志归档个数 | 2 | 大于等于 0 的数字 | log-num 2 |
+| log-num | 日志归档个数 | openwrt为2， 其他系统为8 | 大于等于 0 的数字，0表示禁用日志 | log-num 2 |
+| log-file-mode | 日志归档文件权限 | 0640 | 文件权限 | log-file-mode 644 |
 | audit-enable | 设置审计启用 | no | [yes\|no] | audit-enable yes |
-| audit-file | 审计文件路径 | /var/log/smartdns/smartdns-audit.log | 合法路径字符串 | audit-file /var/log/smartdns/smartdns-audit.log |
+| audit-file | 审计文件路径 | /var/log/<br />smartdns/<br />smartdns-audit.log | 合法路径字符串 | audit-file /var/log/smartdns/smartdns-audit.log |
 | audit-size | 审计大小 | 128K | 数字 + K、M 或 G | audit-size 128K |
 | audit-num | 审计归档个数 | 2 | 大于等于 0 的数字 | audit-num 2 |
+| audit-file-mode | 审计归档文件权限 | 0640 | 文件权限 | log-file-mode 644 |
 | conf-file | 附加配置文件 | 无 | 合法路径字符串 | conf-file /etc/smartdns/smartdns.more.conf |
-| server | 上游 UDP DNS | 无 | 可重复。<br>[ip][:port]：服务器 IP:端口（可选）<br>[-blacklist-ip]：配置 IP 过滤结果。<br>[-whitelist-ip]：指定仅接受参数中配置的 IP 范围<br>[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br>[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br>[-set-mark]：设置数据包标记so-mark| server 8.8.8.8:53 -blacklist-ip -group g1 |
-| server-tcp | 上游 TCP DNS | 无 | 可重复。<br>[ip][:port]：服务器 IP:端口（可选）<br>[-blacklist-ip]：配置 IP 过滤结果<br>[-whitelist-ip]：指定仅接受参数中配置的 IP 范围。<br>[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br>[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br>[-set-mark]：设置数据包标记so-mark | server-tcp 8.8.8.8:53 |
-| server-tls | 上游 TLS DNS | 无 | 可重复。<br>[ip][:port]：服务器 IP:端口（可选)<br>[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br>[-host-name]：TLS SNI 名称, 名称设置为-，表示停用SNI名称<br>[-tls-host-verify]：TLS 证书主机名校验<br> [-no-check-certificate]：跳过证书校验<br>[-blacklist-ip]：配置 IP 过滤结果<br>[-whitelist-ip]：仅接受参数中配置的 IP 范围<br>[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br>[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br>[-set-mark]：设置数据包标记so-mark | server-tls 8.8.8.8:853 |
-| server-https | 上游 HTTPS DNS | 无 | 可重复。<br>https://[host][:port]/path：服务器 IP:端口（可选）<br>[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br>[-host-name]：TLS SNI 名称<br>[-http-host]：http 协议头主机名<br>[-tls-host-verify]：TLS 证书主机名校验<br> [-no-check-certificate]：跳过证书校验<br>[-blacklist-ip]：配置 IP 过滤结果<br>[-whitelist-ip]：仅接受参数中配置的 IP 范围。<br>[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br>[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br>[-set-mark]：设置数据包标记so-mark | server-https https://cloudflare-dns.com/dns-query |
+| server | 上游 UDP DNS | 无 | 可重复。<br />[ip][:port]\|URL：服务器 IP:端口（可选）或 URL <br />[-blacklist-ip]：配置 IP 过滤结果。<br />[-whitelist-ip]：指定仅接受参数中配置的 IP 范围<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 | server 8.8.8.8:53 -blacklist-ip -group g1 -proxy proxy<br /> server tls://8.8.8.8|
+| server-tcp | 上游 TCP DNS | 无 | 可重复。<br />[ip][:port]：服务器 IP:端口（可选）<br />[-blacklist-ip]：配置 IP 过滤结果<br />[-whitelist-ip]：指定仅接受参数中配置的 IP 范围。<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 | server-tcp 8.8.8.8:53 |
+| server-tls | 上游 TLS DNS | 无 | 可重复。<br />[ip][:port]：服务器 IP:端口（可选)<br />[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br />[-host-name]：TLS SNI 名称, 名称设置为-，表示停用SNI名称<br />[-tls-host-verify]：TLS 证书主机名校验<br /> [-no-check-certificate]：跳过证书校验<br />[-blacklist-ip]：配置 IP 过滤结果<br />[-whitelist-ip]：仅接受参数中配置的 IP 范围<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 | server-tls 8.8.8.8:853 |
+| server-https | 上游 HTTPS DNS | 无 | 可重复。<br /><https://[host>][:port]/path：服务器 IP:端口（可选）<br />[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br />[-host-name]：TLS SNI 名称<br />[-http-host]：http 协议头主机名<br />[-tls-host-verify]：TLS 证书主机名校验<br /> [-no-check-certificate]：跳过证书校验<br />[-blacklist-ip]：配置 IP 过滤结果<br />[-whitelist-ip]：仅接受参数中配置的 IP 范围。<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 | server-https <https://cloudflare-dns.com/dns-query> |
+| proxy-server | 代理服务器 | 无 | 可重复。<br />proxy-server URL <br />[URL]: [socks5\|http]://[username:password@]host:port<br />[-name]: 代理服务器名称。 |proxy-server socks5://user:pass@1.2.3.4:1080 -name proxy|
 | speed-check-mode | 测速模式选择 | 无 | [ping\|tcp:[80]\|none] | speed-check-mode ping,tcp:80,tcp:443 |
-| response-mode | 首次查询响应模式 | first-ping |模式：[fisrt-ping\|fastest-ip\|fastest-response]<br> [first-ping]: 最快ping响应地址模式，DNS上游最快查询时延+ping时延最短，查询等待与链接体验最佳;<br>[fastest-ip]: 最快IP地址模式，查询到的所有IP地址中ping最短的IP。需等待IP测速; <br>[fastest-response]: 最快响应的DNS结果，DNS查询等待时间最短，返回的IP地址可能不是最快。| response-mode first-ping |
-| address | 指定域名 IP 地址 | 无 | address /domain/[ip\|-\|-4\|-6\|#\|#4\|#6] <br>- 表示忽略 <br># 表示返回 SOA <br>4 表示 IPv4 <br>6 表示 IPv6 | address /www.example.com/1.2.3.4 |
+| response-mode | 首次查询响应模式 | first-ping |模式：[first-ping\|fastest-ip\|fastest-response]<br /> [first-ping]: 最快ping响应地址模式，DNS上游最快查询时延+ping时延最短，查询等待与链接体验最佳;<br />[fastest-ip]: 最快IP地址模式，查询到的所有IP地址中ping最短的IP。需等待IP测速; <br />[fastest-response]: 最快响应的DNS结果，DNS查询等待时间最短，返回的IP地址可能不是最快。| response-mode first-ping |
+| address | 指定域名 IP 地址 | 无 | address /domain/[ip\|-\|-4\|-6\|#\|#4\|#6] <br />- 表示忽略 <br /># 表示返回 SOA <br />4 表示 IPv4 <br />6 表示 IPv6 | address /www.example.com/1.2.3.4 |
 | nameserver | 指定域名使用 server 组解析 | 无 | nameserver /domain/[group\|-], group 为组名，- 表示忽略此规则，配套 server 中的 -group 参数使用 | nameserver /www.example.com/office |
 | ipset | 域名 ipset | 无 | ipset /domain/[ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]]，-表示忽略 | ipset /www.example.com/#4:dns4,#6:- |
 | ipset-timeout | 设置 ipset 超时功能启用  | no | [yes\|no] | ipset-timeout yes |
-| nftset | 域名 nftset | 无 | nftset /domain/[#4\|#6\|-]:[family#nftable#nftset\|-][,#[4\|6]:[family#nftable#nftset\|-]]]，-表示忽略；ipv4 地址的 family 只支持 inet 和 ip；ipv6 地址的 family 只支持 inet 和 ip6；由于 nft 限制，两种地址只能分开存放于两个 set 中。| nftset /www.example.com/#4:inet#mytab#dns4,#6:- |
+| nftset | 域名 nftset | 无 | nftset /domain/[#4\|#6\|-]:[family#nftable#nftset\|-][,#[4\|6]:[family#nftable#nftset\|-]]]，-表示忽略；ipv4 地址的 family 只支持 inet 和 ip；ipv6 地址的 family 只支持 inet 和 ip6；由于 nft 限制，两种地址只能分开存放于两个 set 中。| nftset /www.example.com/#4:inet#tab#dns4,#6:- |
 | nftset-timeout | 设置 nftset 超时功能启用  | no | [yes\|no] | nftset-timeout yes |
 | nftset-debug | 设置 nftset 调试功能启用  | no | [yes\|no] | nftset-debug yes |
-| domain-rules | 设置域名规则 | 无 | domain-rules /domain/ [-rules...]<br>[-c\|-speed-check-mode]：测速模式，参考 speed-check-mode 配置<br>[-a\|-address]：参考 address 配置<br>[-n\|-nameserver]：参考 nameserver 配置<br>[-p\|-ipset]：参考ipset配置<br>[-t\|-nftset]：参考nftset配置<br>[-d\|-dualstack-ip-selection]：参考 dualstack-ip-selection<br> [-no-serve-expired]：禁用过期缓存 | domain-rules /www.example.com/ -speed-check-mode none |
-| domain-set | 设置域名集合 | 无 | domain-set [options...]<br>[-n\|-name]：域名集合名称 <br>[-t\|-type]：域名集合类型，当前仅支持list，格式为域名列表，一行一个域名。<br>[-f\|-file]：域名集合文件路径。<br> 选项需要配合address, nameserver, ipset, nftset等需要指定域名的地方使用，使用方式为 /domain-set:[name]/| domain-set -name set -type list -file /path/to/list <br> address /domain-set:set/1.2.4.8 |
+| domain-rules | 设置域名规则 | 无 | domain-rules /domain/ [-rules...]<br />[-c\|-speed-check-mode]：测速模式，参考 speed-check-mode 配置<br />[-a\|-address]：参考 address 配置<br />[-n\|-nameserver]：参考 nameserver 配置<br />[-p\|-ipset]：参考ipset配置<br />[-t\|-nftset]：参考nftset配置<br />[-d\|-dualstack-ip-selection]：参考 dualstack-ip-selection<br /> [-no-serve-expired]：禁用过期缓存<br />[-delete]：删除对应的规则 | domain-rules /www.example.com/ -speed-check-mode none |
+| domain-set | 设置域名集合 | 无 | domain-set [options...]<br />[-n\|-name]：域名集合名称 <br />[-t\|-type]：域名集合类型，当前仅支持list，格式为域名列表，一行一个域名。<br />[-f\|-file]：域名集合文件路径。<br /> 选项需要配合address, nameserver, ipset, nftset等需要指定域名的地方使用，使用方式为 /domain-set:[name]/| domain-set -name set -type list -file /path/to/list <br /> address /domain-set:set/1.2.4.8 |
 | bogus-nxdomain | 假冒 IP 地址过滤 | 无 | [ip/subnet]，可重复 | bogus-nxdomain 1.2.3.4/16 |
 | ignore-ip | 忽略 IP 地址 | 无 | [ip/subnet]，可重复 | ignore-ip 1.2.3.4/16 |
 | whitelist-ip | 白名单 IP 地址 | 无 | [ip/subnet]，可重复 | whitelist-ip 1.2.3.4/16 |
 | blacklist-ip | 黑名单 IP 地址 | 无 | [ip/subnet]，可重复 | blacklist-ip 1.2.3.4/16 |
 | force-AAAA-SOA | 强制 AAAA 地址返回 SOA | no | [yes\|no] | force-AAAA-SOA yes |
-| force-qtype-SOA | 强制指定 qtype 返回 SOA | qtype id | [<qtypeid> \| ...] | force-qtype-SOA 65 28
+| force-qtype-SOA | 强制指定 qtype 返回 SOA | qtype id | [qtypeid\|...] | force-qtype-SOA 65 28
 | prefetch-domain | 域名预先获取功能 | no | [yes\|no] | prefetch-domain yes |
 | dnsmasq-lease-file | 支持读取dnsmasq dhcp文件解析本地主机名功能 | 无 | dnsmasq dhcp lease文件路径 | dnsmasq-lease-file /var/lib/misc/dnsmasq.leases |
 | serve-expired | 过期缓存服务功能 | yes | [yes\|no]，开启此功能后，如果有请求时尝试回应 TTL 为 0 的过期记录，并发查询记录，以避免查询等待 |
@@ -613,77 +624,77 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
 | dualstack-ip-selection | 双栈 IP 优选 | yes | [yes\|no] | dualstack-ip-selection yes |
 | dualstack-ip-selection-threshold | 双栈 IP 优选阈值 | 15ms | 单位为毫秒（ms） | dualstack-ip-selection-threshold [0-1000] |
 | user | 进程运行用户 | root | user [username] | user nobody |
-| ca-file | 证书文件 | /etc/ssl/certs/ca-certificates.crt | 合法路径字符串 | ca-file /etc/ssl/certs/ca-certificates.crt |
+| ca-file | 证书文件 | /etc/ssl/<br />certs/ca-certificates.crt | 合法路径字符串 | ca-file /etc/ssl/certs/ca-certificates.crt |
 | ca-path | 证书文件路径 | /etc/ssl/certs | 合法路径字符串 | ca-path /etc/ssl/certs |

 ## 常见问题

 1. SmartDNS 和 DNSmasq 有什么区别？
-   
+
    SmartDNS 在设计上并不是 DNSmasq 的替代品，它的主要功能集中在 DNS 解析增强上，增强部分有：
-   
-   * 多上游服务器并发请求，对结果进行测速后，返回最佳结果；
-   * address、ipset 域名匹配采用高效算法，查询匹配更加快速，即使是路由器设备也依然高效；
-   * 域名匹配支持忽略特定域名，可单独匹配 IPv4 和 IPv6，支持多样化定制；
-   * 针对广告屏蔽功能做增强，返回 SOA，屏蔽广告效果更佳；
-   * IPv4、IPv6 双栈 IP 优选机制，在双网情况下，选择最快的网络通讯；
-   * 支持最新的 TLS 和 HTTPS 协议，提供安全的 DNS 查询能力；
-   * ECS 支持，使查询结果更佳准确；
-   * IP 黑名单和忽略 IP 机制，使域名查询更佳准确；
-   * 域名预查询，访问常用网站更加快速；
-   * 域名 TTL 可指定，使访问更快速；
-   * 高速缓存机制，使访问更快速；
-   * 异步日志，审计机制，在记录信息的同时不影响 DNS 查询性能；
-   * 域名组（group）机制，特定域名使用特定上游服务器组查询，避免隐私泄漏；
-   * 第二 DNS 支持自定义更多行为。

-2. 如何配置上游服务器最佳？
-   
+   - 多上游服务器并发请求，对结果进行测速后，返回最佳结果；
+   - address、ipset 域名匹配采用高效算法，查询匹配更加快速，即使是路由器设备也依然高效；
+   - 域名匹配支持忽略特定域名，可单独匹配 IPv4 和 IPv6，支持多样化定制；
+   - 针对广告屏蔽功能做增强，返回 SOA，屏蔽广告效果更佳；
+   - IPv4、IPv6 双栈 IP 优选机制，在双网情况下，选择最快的网络通讯；
+   - 支持最新的 TLS 和 HTTPS 协议，提供安全的 DNS 查询能力；
+   - ECS 支持，使查询结果更佳准确；
+   - IP 黑名单和忽略 IP 机制，使域名查询更佳准确；
+   - 域名预查询，访问常用网站更加快速；
+   - 域名 TTL 可指定，使访问更快速；
+   - 高速缓存机制，使访问更快速；
+   - 异步日志，审计机制，在记录信息的同时不影响 DNS 查询性能；
+   - 域名组（group）机制，特定域名使用特定上游服务器组查询，避免隐私泄漏；
+   - 第二 DNS 支持自定义更多行为。
+
+1. 如何配置上游服务器最佳？
+
    SmartDNS 有测速机制，在配置上游服务器时，建议配置多个上游 DNS 服务器，包含多个不同区域的服务器，但总数建议在 10 个左右。推荐搭配
-   
-   * 运营商 DNS。
-   * 国内公共 DNS，如 `119.29.29.29`, `223.5.5.5`。
-   * 国外公共 DNS，如 `8.8.8.8`, `8.8.4.4`。

-3. 如何启用审计日志？
-   
+   - 运营商 DNS。
+   - 国内公共 DNS，如 `119.29.29.29`, `223.5.5.5`。
+   - 国外公共 DNS，如 `8.8.8.8`, `8.8.4.4`。
+
+1. 如何启用审计日志？
+
    审计日志记录客户端请求的域名，记录信息包括，请求时间，请求 IP，请求域名，请求类型，如果要启用审计日志，在配置界面配置 `audit-enable yes` 启用，`audit-size`、 `audit-file`、`audit-num` 分别配置审计日志文件大小，审计日志文件路径，和审计日志文件个数。审计日志文件将会压缩存储以节省空间。

-4. 如何避免隐私泄漏？
-   
-    默认情况下，SmartDNS 会将请求发送到所有配置的DNS服务器，若上游 DNS 服务器使用DNS，或记录日志，将会导致隐私泄漏。为避免隐私泄漏，请尽量：  
-   
-   * 配置使用可信的DNS服务器。
-   * 优先使用 TLS 查询。
-   * 设置上游 DNS 服务器组。
+1. 如何避免隐私泄漏？
+
+    默认情况下，SmartDNS 会将请求发送到所有配置的DNS服务器，若上游 DNS 服务器使用DNS，或记录日志，将会导致隐私泄漏。为避免隐私泄漏，请尽量：  
+
+   - 配置使用可信的DNS服务器。
+   - 优先使用 TLS 查询。
+   - 设置上游 DNS 服务器组。
+
+1. 如何屏蔽广告？

-5. 如何屏蔽广告？
-   
    SmartDNS 具备高性能域名匹配算法，通过域名方式过滤广告非常高效，如要屏蔽广告，只需要配置类似如下记录即可，如，屏蔽 `*.ad.com`，则配置：
-   
-   ```sh
+
+   ```shell
   address /ad.com/#
   ```
-   
+
    域名的使后缀模式，过滤 `*.ad.com`，`#` 表示返回 SOA，使屏蔽广告更加高效，如果要单独屏蔽 IPv4 或 IPv6， 在 `#` 后面增加数字，如 `#4` 表示对 IPv4 生效。若想忽略特定子域名的屏蔽，如忽略 `pass.ad.com`，可配置如下：
-   
-   ```sh
+
+   ```shell
   address /pass.ad.com/-
   ```

-6. 如何使用 DNS 查询分流？
-   
+1. 如何使用 DNS 查询分流？
+
    某些情况下，需要将有些域名使用特定的 DNS 服务器来查询来做到 DNS 分流。比如
-   
-   ```sh
+
+   ```shell
   .home -> 192.168.1.1 # .home 结尾的域名发送到 192.168.1.1 解析
   .office -> 10.0.0.1  # .office 结尾的域名发送到 10.0.0.1 解析
   ```
-   
+
    其他域名采用默认的模式解析。
    这种情况的分流配置如下：
-   
-   ```sh
+
+   ```shell
   # 配置上游，用 -group 指定组名，用 -exclude-default-group 将服务器从默认组中排除。
   server 192.168.1.1 -group home -exclude-default-group
   server 10.0.0.1 -group office -exclude-default-group
@@ -693,106 +704,184 @@ entware|ipkg update<br>ipkg install smartdns|软件源路径：https://bin.entwa
   nameserver /.home/home
   nameserver /.office/office
   ```
-   
+
    通过上述配置即可实现 DNS 解析分流，如果需要实现按请求端端口分流，可以配置第二 DNS 服务器，`bind` 配置增加 `--group` 参数指定分流名称。
-   
-   ```sh
+
+   ```shell
   bind :7053 -group office
   bind :8053 -group home
   ```

-7. IPv4、IPv6 双栈 IP 优选功能如何使用？
-   
+1. IPv4、IPv6 双栈 IP 优选功能如何使用？
+
    目前 IPv6 已经开始普及，但 IPv6 网络在速度上，某些情况下还不如 IPv4。为在双栈网络下获得较好的体验，SmartDNS 提供来双栈IP优选机制，同一个域名，若 IPv4 的速度远快与 IPv6，那么 SmartDNS 就会阻止IPv6的解析、使用 IPv4 访问。可在配置文件中通过设置 `dualstack-ip-selection yes` 启用此功能，通过 `dualstack-ip-selection-threshold [time]` 来修改阈值。如果要完全禁止 IPv6 AAAA记录解析，可设置 `force-AAAA-SOA yes`。

-8. 如何提高缓存效率，加快访问速度？
-   
+1. 如何提高缓存效率，加快访问速度？
+
    SmartDNS 提供了域名缓存机制，对查询的域名，进行缓存，缓存时间符合 DNS TTL 规范。为提高缓存命中率，可采用如下措施：  
-   
-   * 适当增大缓存的记录数
-     
+
+   - 适当增大缓存的记录数
+
     通过 `cache-size` 来设置缓存记录数。  
-     
+
     查询压力大的环境下，并且有内存大的机器的情况下，可适当调大。  
-   
-   * 适当设置最小 TTL 值
-     
+
+   - 适当设置最小 TTL 值
+
     通过 `rr-ttl-min` 将最低 DNS TTL 时间设置为一个合理值，延长缓存时间。
-     
+
     建议是超时时间设置在 10～30 分钟，避免服务器域名变化时，查询到失效域名。
-   
-   * 开启域名预获取功能
-     
+
+   - 开启域名预获取功能
+
     通过 `prefetch-domain yes` 来启用域名预先获取功能，提高查询命中率。
-     
+
     配合上述 TTL 超时时间，SmartDNS 将在域名 TTL 即将超时时，再次发送查询请求，并缓存查询结果供后续使用。频繁访问的域名将会持续缓存。此功能将在空闲时消耗更多的 CPU。
-   
-   * 过期缓存服务功能  
-     
+
+   - 过期缓存服务功能  
+
     通过 `serve-expired` 来启用过期缓存服务功能，可提高缓存命中率的同时，降低CPU占用。
-     
+
     此功能会在TTL超时后，将返回 TTL=0 给客户端，并且同时再次发送查询请求，并缓存新的结果给后续使用。

-9. 第二 DNS 如何自定义更多行为？
-   
+1. 第二 DNS 如何自定义更多行为？
+
   第二 DNS 可以作为其他 DNS 服务器的上游，提供更多的查询行为，通过 bind 配置支持可以绑定多个端口，不同端口可设置不同的标志，实现不同的功能，如
-   
-   ```sh
+
+   ```shell
   # 绑定 6053 端口，6053 端口的请求将采用配置 office 组的上游查询，且不对结果进行测速，忽略 address 的配置地址
   bind [::]:6053 -no-speed-check -group office -no-rule-addr
   ```

-10. DoT 的 SPKI 如何获取？
+1. DoT 的 SPKI 如何获取？
    SPKI 可以通过 DNS 服务商发布的页面获取，如果没有发布，可以通过如下命令获取，其中将对应IP地址更换为要获取 SPKI 的 IP 地址。

-    ```sh
-    $ echo | openssl s_client -connect '1.0.0.1:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
+    ```shell
+    echo | openssl s_client -connect '1.0.0.1:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
    ```

-11. iOS系统解析缓慢问题怎么解决？  
+1. iOS系统解析缓慢问题怎么解决？  
    IOS14开始，苹果支持了DNS HTTPS(TYPE65)记录的解析，此功能用于快速DNS查询和解决HTTPS链接相关的问题，但当前还是草案，另外会导致广告屏蔽等功能失效，建议通过如下配置关闭TYPE65记录查询。

-    ```sh
+    ```shell
    force-qtype-SOA 65
    ```

-12. 如何解析本地主机名称？  
+1. 如何解析本地主机名称？  
    smartdns可以配合DNSMASQ的dhcp lease文件支持本地主机名->IP地址的解析，可以配置smartdns读取dnsmasq的lease文件，并支持解析。具体配置参数如下，（注意，DNSMASQ lease文件每个系统可能不一样，需要按实际情况配置）

-    ```
+    ```shell
    dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
    ```

    配置完成后，可以直接使用主机名连接对应的机器。但需要注意：

-    * Windows系统默认使用mDNS解析地址，如需要在windows下用使用smartdns解析，则需要在主机名后面增加`.`，表示使用DNS解析。如`ping smartdns.`
+    - Windows系统默认使用mDNS解析地址，如需要在windows下用使用smartdns解析，则需要在主机名后面增加`.`，表示使用DNS解析。如`ping smartdns.`

-13. 域名集合如何使用？  
+1. 域名集合如何使用？  
    为方便按集合配置域名，对于有/domain/的配置，可以指定域名集合，方便维护。具体方法为：
-    
-    * 使用`domain-set`配置集合文件，如
-    
-    ```sh
+
+    - 使用`domain-set`配置集合文件，如
+
+    ```shell
    domain-set -name ad -file /etc/smartdns/ad-list.conf
    ```

    ad-list.conf的格式为一个域名一行，如
-    
-    ```
+
+    ```shell
    ad.com
    site.com
    ```

-    * 在有/domain/配置的选项使用域名集合，只需要将`/domain/`配置为`/domain-set:[集合名称]/`即可，如：
+    - 在有/domain/配置的选项使用域名集合，只需要将`/domain/`配置为`/domain-set:[集合名称]/`即可，如：

-    ```sh
+    ```shell
    address /domain-set:ad/#
    domain-rules /domain-set:ad/ -a #
    nameserver /domain-set:ad/server
    ...
    ```

-14. 更多问题  
+1. 如何使用ipset和nftset  
+    和Dnsmasq类似，smartdns支持ipset和nftset，可以将特定的域名通过TPROXY进行透明转发，透明转发涉工具模式对比如下：
+
+    1. 工具：iptable，nftable
+
+        iptable：成熟的路由规则配置工具。  
+        nftable：更加强大的规则配置工具，正在成为主流。
+
+    1. 模式：TPROXY，REDIRECT
+
+        TPROXY：支持UDP，TCP的转发，配置稍复杂。  
+        REDIRECT：仅支持TCP，配置简单。
+
+
+    1. 配置REDIRECT或TPROXY转发规则
+
+        - 在smartdns.conf中设置需要透明转发的域名列表，比如要将`example.com`进行透明转发。则使用ipset选项，设置`example.com`的ipset规则为`proxy`。
+
+        ```shell
+        # 设置规则
+        # -ipset proxy: 匹配的域名设置到ipset:tproxy中。
+        # -c none: 停用测速
+        # -address #6: 停用IPV6解析。
+        domain-rules /example.com/ -ipset proxy -c none -address #6
+        ```
+        1. 方式一: TCP REDIRECT转发
+
+            - 此方式配置简单，仅支持TCP的转发。  
+              执行shell命令，设置iptable规则，如果仅转发TCP则可以直接使用REDIRECT的规则，如果需要同时转发UDP和TCP，可以使用TPROXY的转发规则。如下规则按实际需求选择。具体配置如下：
+
+
+            ```shell
+            # 创建ipset集合
+            ipset create proxy hash:net
+            # 设置转发规则，将匹配的请求转发到本机的1081端口
+            iptables -t nat -I PREROUTING -p tcp -m set --match-set proxy dst -j REDIRECT --to-ports 1081
+            ```
+
+            - 在本机1081端口开启REDIRECT模式的转发程序。
+
+        1. 方式二：TCP/UDP TPROXY转发
+        
+            - 此方式可同时转发TCP和UDP。  
+              执行shell命令，设置iptable规则，将匹配的域名TCP/UDP请求进行TPROXY方式透明转发，规则参考如下：
+
+            ```shell
+            # 设置路由规则
+            ip rule add fwmark 1104 lookup 1104
+            ip route add local 0.0.0.0/0 dev lo table 1104
+
+            # 创建ipset集合
+            ipset create proxy hash:net
+
+            # 设置转发规则，UDP，TCP方式的TPROXY转发
+            iptables -t mangle -N SMARTDNS
+            iptables -t mangle -A SMARTDNS -p tcp -m set --match-set proxy dst -j TPROXY --on-ip 127.0.0.1 --on-port 1081 --tproxy-mark 1104
+            iptables -t mangle -A SMARTDNS -p udp -m set --match-set proxy dst -j TPROXY --on-ip 127.0.0.1 --on-port 1081 --tproxy-mark 1104
+            iptables -t mangle -A SMARTDNS -j ACCEPT
+            iptables -t mangle -A PREROUTING -j SMARTDNS
+            ```
+
+            - 在本机的1081端口启动IP透明转发程序。
+    
+
+    1. 额外说明  
+      为保证DNS查询结果的位置亲和性，可以使用smartdns的`server`代理参数，将对应域名的查询请求，通过代理查询，使结果位置更好。如：
+
+        ```shell
+        # 增加DNS上游，并设置通过名称为proxy的代理查询，查询组为pass
+        server 1.2.3.4 -proxy proxy -group pass -exclude-default-group
+        # 设置代理服务器信息，代理的名称为proxy
+        proxy-server socks5://user:name@1.2.3.4 -name proxy
+        # 设置域名规则，对匹配的域名使用代理查询结果，并将结果设置到ipset中。
+        domain-rules /example.com/ -ipset proxy -c none -address #6 -nameserver pass
+        ```
+
+    如果使用openwrt的luci界面，可以直接在界面配置相关的域名分流规则。
+
+1. 更多问题  
    如有更多问题，请查阅或提交issue: [https://github.com/pymumu/smartdns/issues](https://github.com/pymumu/smartdns/issues)

 ## 编译
--- a/ReadMe_en.md
+++ b/ReadMe_en.md
@@ -17,7 +17,7 @@ Support Raspberry Pi, openwrt, ASUS router, Windows and other devices.
  - [Usage](#usage)
    - [Use official installation source](#use-official-installation-source)
    - [Download the package](#download-the-package)
-    - [Standard Linux system installation/Raspberry Pi, X86_64 system](#standard-linux-system-installationraspberry-pi-x86_64-system)
+    - [Standard Linux system installation/Raspberry Pi, X86\_64 system](#standard-linux-system-installationraspberry-pi-x86_64-system)
    - [openwrt](#openwrt)
    - [ASUS router native firmware / Merlin firmware](#asus-router-native-firmware--merlin-firmware)
    - [optware/entware](#optwareentware)
@@ -97,28 +97,28 @@ From the comparison, smartdns found the fastest IP address to visit www.baidu.co
 1. **Multiple upstream DNS servers**  
   Support configuring multiple upstream DNS servers and query at the same time.the query will not be affected, Even if there is a DNS server exception.  

-2. **Return the fastest IP address**  
+1. **Return the fastest IP address**  
   Supports finding the fastest access IP address from the IP address list of the domain name and returning it to the client to avoid DNS pollution and improve network access speed.

-3. **Support for multiple query protocols**  
-   Support UDP, TCP, DOT(DNS over TLS), DOH(DNS over HTTPS) queries, and non-53 port queries, effectively avoiding DNS pollution and protect privacy.
+1. **Support for multiple query protocols**  
+   Support UDP, TCP, DOT(DNS over TLS), DOH(DNS over HTTPS) queries, and non-53 port queries, effectively avoiding DNS pollution and protect privacy, and support query DNS over socks5, http proxy.

-4. **Domain IP address specification**  
+1. **Domain IP address specification**  
   Support configuring IP address of specific domain to achieve the effect of advertising filtering, and avoid malicious websites.

-5. **Domain name high performance rule filtering**  
+1. **Domain name high performance rule filtering**  
   Support domain name suffix matching mode, simplify filtering configuration, filter 200,000 recording and take time <1ms.

-6. **Linux/Windows multi-platform support**  
+1. **Linux/Windows multi-platform support**  
   Support standard Linux system (Raspberry Pi), openwrt system various firmware, ASUS router native firmware. Support Windows 10 WSL (Windows Subsystem for Linux).

-7. **Support IPV4, IPV6 dual stack**  
-   Support IPV4, IPV6 network, support query A, AAAA record, dual-stack IP selection, and disale IPV6 AAAA record.
+1. **Support IPV4, IPV6 dual stack**  
+   Support IPV4, IPV6 network, support query A, AAAA record, dual-stack IP selection, and filter IPV6 AAAA record.

-8. **High performance, low resource consumption**  
+1. **High performance, low resource consumption**  
   Multi-threaded asynchronous IO mode, cache cache query results.

-9. **DNS domain forwarding**
+1. **DNS domain forwarding**
   Support DNS forwarding, ipset and nftables.

 ## Architecture
@@ -126,9 +126,9 @@ From the comparison, smartdns found the fastest IP address to visit www.baidu.co
 ![Architecture](doc/architecture.png)

 1. SmartDNS receives DNS query requests from local network devices, such as PCs and mobile phone query requests.
-2. SmartDNS sends query requests to multiple upstream DNS servers, using standard UDP queries, non-standard port UDP queries, and TCP queries.
-3. The upstream DNS server returns a list of Server IP addresses corresponding to the domain name. SmartDNS detects the fastest Server IP with local network access.
-4. Return the fastest accessed Server IP to the local client.
+1. SmartDNS sends query requests to multiple upstream DNS servers, using standard UDP queries, non-standard port UDP queries, and TCP queries.
+1. The upstream DNS server returns a list of Server IP addresses corresponding to the domain name. SmartDNS detects the fastest Server IP with local network access.
+1. Return the fastest accessed Server IP to the local client.

 ## Usage

@@ -138,10 +138,10 @@ smartdns can already be installed using system package management tools.

 System|Installation|Instructions|
 --|--|--
-openwrt|opkg update<br>opkg install luci-app-smartdns<br>opkg install smartdns|systems after 22.03. Software source: https://downloads.openwrt.org/releases/
-ddwrt|latest firmware. goto services page abd enable SmartDNS Resolver. |Demo: https://forum.dd-wrt.com/demo/Services.html
+openwrt|opkg update<br />opkg install luci-app-smartdns<br />opkg install smartdns|systems after 22.03. Software source: <https://downloads.openwrt.org/releases/>
+ddwrt|latest firmware. goto services page abd enable SmartDNS Resolver. |Demo: <https://forum.dd-wrt.com/demo/Services.html>
 debian|apt-get install smartdns|
-entware|ipkg update<br>ipkg install smartdns|Software source: https://bin.entware.net/
+entware|ipkg update<br />ipkg install smartdns|Software source: <https://bin.entware.net/>

 ### Download the package

@@ -165,15 +165,15 @@ Download the matching version of the SmartDNS installation package. The correspo
 |openwrt LUCI|luci-app-smartdns.xxxxxxxxx.all.ipk|Openwrt management interface.
 |openwrt LUCI|luci-app-smartdns.xxxxxxxxx.all-luci-compat-all|Compat Openwrt management interface for early openwrt.

-* The released packages are statically compiled. If you need a small size package, please compile it yourself or obtain it from the openwrt / entware repository.
+- The released packages are statically compiled. If you need a small size package, please compile it yourself or obtain it from the openwrt / entware repository.

-* **Please download from the Release page: [Download here](https://github.com/pymumu/smartdns/releases)**
+- **Please download from the Release page: [Download here](https://github.com/pymumu/smartdns/releases)**

 ```shell
 https://github.com/pymumu/smartdns/releases
 ```

-* For the installation procedure, please refer to the following sections.
+- For the installation procedure, please refer to the following sections.

 ### Standard Linux system installation/Raspberry Pi, X86_64 system

@@ -196,6 +196,11 @@ https://github.com/pymumu/smartdns/releases
    ./install -i
    ```

+    **For Ubuntu system:**
+    - `systemd-resolved` occupies TCP53 and UDP53 ports. You need to manually resolve the port occupancy problem or modify the SmartDNS listening port
+
+    - Log files in `/var/log/smartdns/smartdns.log`
+
 1. Configuration

    After the installation is complete, you can configure the upstream server to  smartdns. Refer to the `Configuration Parameters` for specific configuration parameters.  
@@ -207,7 +212,8 @@ https://github.com/pymumu/smartdns/releases
    ```

    `smartdns.conf` example:
-    ```
+
+    ```shell
    # set listen port
    bind []:53 
    # set upstream servers
@@ -228,8 +234,8 @@ https://github.com/pymumu/smartdns/releases
 1. Forwarding DNS request to SmartDNS

    Modify the DNS server of the local router and configure the DNS server as SmartDNS.
-    * Log in to the router on the local network and configure the Raspberry Pi to assign a static IP address.
-    * Modify the WAN port or DHCP DNS to the Raspberry Pi IP address.
+    - Log in to the router on the local network and configure the Raspberry Pi to assign a static IP address.
+    - Modify the WAN port or DHCP DNS to the Raspberry Pi IP address.
    Note:
    I. Each router configuration method is different. Please search Baidu for related configuration methods.
    II. some routers may not support configuring custom DNS server. in this case, please modify the PC's, mobile phone's DNS server to the ip of Raspberry Pi.
@@ -261,26 +267,26 @@ https://github.com/pymumu/smartdns/releases
    opkg install luci-app-smartdns.xxxxxxxx.xxxx.all.ipk
    ```

-    * Note: For versions before openwrt 19.07, please install `luci-app-smartdns.xxxxxxxxx.all-luci-compat-all` package.
+    - Note: For versions before openwrt 19.07, please install `luci-app-smartdns.xxxxxxxxx.all-luci-compat-all` package.

 1. Configuration

    Log in to the openwrt management page and open `Services`->`SmartDNS` to configure SmartDNS.
-    * Add upstream DNS server configuration to `Upstream Servers`. It is recommended to configure multiple DNS servers at home and abroad.
-    * Specify the IP address of a specific domain name in `Domain Address`, which can be used for ad blocking.
+    - Add upstream DNS server configuration to `Upstream Servers`. It is recommended to configure multiple DNS servers at home and abroad.
+    - Specify the IP address of a specific domain name in `Domain Address`, which can be used for ad blocking.

 1. Start Service

   There are two ways to use the SmartDNS service, `one is directly as the primary DNS service`, `the other is as the upstream of dnsmasq`.  
   By default, SmartDNS uses the first method. You can choose according to your needs in the following two ways.

-1. Method 1: SmartDNS as primary DNS Server 
+1. Method 1: SmartDNS as primary DNS Server

-    * **Enable SmartDNS as primary DNS Server**
+    - **Enable SmartDNS as primary DNS Server**

        Log in to the router, click on `Services`->`SmartDNS`->`port`, input port `53`, smartdns will run as primary DNS Server.

-    * **Check if the service is configured successfully**
+    - **Check if the service is configured successfully**

        Query domain name with `nslookup -querytype=ptr smartdns`
        See if the `name` item in the command result is displayed as `smartdns` or `hostname`, such as `smartdns`
@@ -300,8 +306,8 @@ https://github.com/pymumu/smartdns/releases

 1. Note

-   * When the port of smartdns is 53, it will automatically take over dnsmasq as the primary dns. When configuring other ports, dnsmasq is re-enabled as primary dns.
-   * If an exception occurs during this process, you can use the following command to restore dnsmasq as the primary DNS
+   - When the port of smartdns is 53, it will automatically take over dnsmasq as the primary dns. When configuring other ports, dnsmasq is re-enabled as primary dns.
+   - If an exception occurs during this process, you can use the following command to restore dnsmasq as the primary DNS

   ```shell
   uci delete dhcp.@dnsmasq[0].port
@@ -324,7 +330,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    Log in to the management interface, click `System Management`-> Click `System Settings` and configure `Enable SSH` to `Lan Only`.  
    The SSH login username and password are the same as the management interface.

-1. Insstall `Download Master`
+1. Install `Download Master`

    In the management interface, click `USB related application`-> click `Download Master` to download.  
    After the download is complete, enable `Download Master`. If you do not need the download function, you can uninstall `Download Master` here, but make sure that Download Master is enabled before uninstalling.  
@@ -378,9 +384,10 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    ```shell
    vi /opt/etc/smartdns/smartdns.conf
    ```
-    
+
    `smartdns.conf` example:
-    ```
+
+    ```shell
    # set listen port
    bind []:53 
    # set upstream servers
@@ -407,7 +414,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use

 1. Install SmartDNS

-    Upload the software to `/tmp` directory of the router using winscp, and run the flollowing command to install.
+    Upload the software to `/tmp` directory of the router using winscp, and run the following command to install.

    ```shell
    ipkg install smartdns.xxxxxxx.mipsbig.ipk
@@ -420,7 +427,8 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    ```

    `smartdns.conf` example:
-    ```
+
+    ```shell
    # set listen port
    bind []:53 
    # set upstream servers
@@ -431,7 +439,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    domain-rule /example.com/ -address 1.2.3.4
    ```

-    Note: if you need to support IPV6, you can set the worke-mode to `2`, this will disable the DNS service of dnsmasq, and smartdns run as the primary DNS server. Change `SMARTDNS_WORKMODE` in the file `/opt/etc/smartdns/smartdns-opt.conf` to 2.
+    Note: if you need to support IPV6, you can set the work-mode to `2`, this will disable the DNS service of dnsmasq, and smartdns run as the primary DNS server. Change `SMARTDNS_WORKMODE` in the file `/opt/etc/smartdns/smartdns-opt.conf` to `2`.

    ```shell
    SMARTDNS_WORKMODE="2"
@@ -451,7 +459,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    smartdns        name = smartdns.
    ```

-    Note: If the service does not start automatically, you need to set optwre/entware to start automatically. For details, see the optware/entware documentation.
+    Note: If the service does not start automatically, you need to set optware/entware to start automatically. For details, see the optware/entware documentation.

 ### Windows 10 WSL Installation/WSL ubuntu

@@ -463,7 +471,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use

 1. Install smartdns

-    download install package `smartdns.xxxxxxxx.x86_64-linux-all.tar.gz`，and unzip to the `D:\` directory, after decompression, the directory is as follows: 
+    download install package `smartdns.xxxxxxxx.x86_64-linux-all.tar.gz`，and unzip to the `D:\` directory, after decompression, the directory is as follows:

    ```shell
    D:\SMARTDNS
@@ -487,7 +495,8 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    Configure as many upstream DNS servers as possible, including servers at home and abroad. Please refer to the `Configuration Parameters` section for configuration parameters.  

    `smartdns.conf` example:
-    ```
+
+    ```shell
    # set listen port
    bind []:53 
    # set upstream servers
@@ -497,7 +506,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    address /example.com/1.2.3.4
    domain-rule /example.com/ -address 1.2.3.4
    ```
-    
+
 1. Start Service

    Double-click `reload.bat` in the `D:\smartdns\package\windows` directory for reload.
@@ -524,12 +533,12 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use

 |parameter|Parameter function|Default value|Value type|Example|
 |--|--|--|--|--|
-|server-name|DNS name|host name/smartdns|any string like hosname|server-name smartdns
-|bind|DNS listening port number|[::]:53|Support binding multiple ports<br>`IP:PORT`: server IP, port number. <br>`[-group]`: The DNS server group used when requesting. <br>`[-no-rule-addr]`: Skip the address rule. <br>`[-no-rule-nameserver]`: Skip the Nameserver rule. <br>`[-no-rule-ipset]`: Skip the Ipset or nftset rules. <br>`[-no-rule-soa]`: Skip address SOA(#) rules.<br>`[-no-dualstack-selection]`: Disable dualstack ip selection.<br>`[-no-speed-check]`: Disable speed measurement. <br>`[-no-cache]`: stop caching |bind :53
-|bind-tcp|TCP mode DNS listening port number|[::]:53|Support binding multiple ports<br>`IP:PORT`: server IP, port number. <br>`[-group]`: The DNS server group used when requesting. <br>`[-no-rule-addr]`: Skip the address rule. <br>`[-no-rule-nameserver]`: Skip the Nameserver rule. <br>`[-no-rule-ipset]`: Skip the Ipset or nftset rules. <br>`[-no-rule-soa]`: Skip address SOA(#) rules.<br>`[-no-dualstack-selection]`: Disable dualstack ip selection.<br>`[-no-speed-check]`: Disable speed measurement. <br>`[-no-cache]`: stop caching |bind-tcp :53
+|server-name|DNS name|host name/smartdns|any string like hostname|server-name smartdns
+|bind|DNS listening port number|[::]:53|Support binding multiple ports<br />`IP:PORT@DEVICE`: server IP, port number, and device. <br />`[-group]`: The DNS server group used when requesting. <br />`[-no-rule-addr]`: Skip the address rule. <br />`[-no-rule-nameserver]`: Skip the Nameserver rule. <br />`[-no-rule-ipset]`: Skip the Ipset or nftset rules. <br />`[-no-rule-soa]`: Skip address SOA(#) rules.<br />`[-no-dualstack-selection]`: Disable dualstack ip selection.<br />`[-no-speed-check]`: Disable speed measurement. <br />`[-no-cache]`: stop caching |bind :53@eth0
+|bind-tcp|TCP mode DNS listening port number|[::]:53|Support binding multiple ports<br />`IP:PORT@DEVICE`: server IP, port number and device. <br />`[-group]`: The DNS server group used when requesting. <br />`[-no-rule-addr]`: Skip the address rule. <br />`[-no-rule-nameserver]`: Skip the Nameserver rule. <br />`[-no-rule-ipset]`: Skip the Ipset or nftset rules. <br />`[-no-rule-soa]`: Skip address SOA(#) rules.<br />`[-no-dualstack-selection]`: Disable dualstack ip selection.<br />`[-no-speed-check]`: Disable speed measurement. <br />`[-no-cache]`: stop caching |bind-tcp :53
 |cache-size|Domain name result cache number|512|integer|cache-size 512
 |cache-persist|enable persist cache|Auto: Enabled if the location of `cache-file` has more than 128MB of free space.|[yes\|no]|cache-persist yes
-|cache-file|cache persist file|/tmp/smartdns.cache|路径|cache-file /tmp/smartdns.cache
+|cache-file|cache persist file|/tmp/<br />smartdns.cache|path|cache-file /tmp/smartdns.cache
 |tcp-idle-time|TCP connection idle timeout|120|integer|tcp-idle-time 120
 |rr-ttl|Domain name TTL|Remote query result|number greater than 0|rr-ttl 600
 |rr-ttl-min|Domain name Minimum TTL|Remote query result|number greater than 0|rr-ttl-min 60
@@ -538,70 +547,73 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 |rr-ttl-max|Domain name Maximum TTL|Remote query result|number greater than 0|rr-ttl-max 600
 |max-reply-ip-num|Maximum number of IPs returned to the client|8|number of IPs, 1~16 |max-reply-ip-num 1
 |log-level|log level|error|fatal,error,warn,notice,info,debug|log-level error
-|log-file|log path|/var/log/smartdns/smartdns.log|File Pah|log-file /var/log/smartdns/smartdns.log
+|log-file|log path|/var/log/<br />smartdns/<br />smartdns.log|File Pah|log-file /var/log/smartdns/smartdns.log
 |log-size|log size|128K|number+K,M,G|log-size 128K
-|log-num|archived log number|2|Integer|log-num 2
+|log-num|archived log number|2 for openwrt, 8 for other system|Integer, 0 means turn off the log|log-num 2
+|log-file-mode|archived log file mode|0640|Integer|log-file-mode 644
 |audit-enable|audit log enable|no|[yes\|no]|audit-enable yes
-|audit-file|audit log file|/var/log/smartdns/smartdns-audit.log|File Path|audit-file /var/log/smartdns/smartdns-audit.log
+|audit-file|audit log file|/var/log/<br />smartdns/<br />smartdns-audit.log|File Path|audit-file /var/log/smartdns/smartdns-audit.log
 |audit-size|audit log size|128K|number+K,M,G|audit-size 128K
-|audit-num|archived audit log number|2|Integer|audit-num 2
+|audit-num|archived audit log number|2|Integer, 0 means turn off the log|audit-num 2
+|audit-file-mode|archived audit log file mode|0640|Integer|audit-file-mode 644
 |conf-file|additional conf file|None|File path|conf-file /etc/smartdns/smartdns.more.conf
-|server|Upstream UDP DNS server|None|Repeatable <br>`[ip][:port]`: Server IP, port optional. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group. <br>`[-set-mark]`：set mark on packets | server 8.8.8.8:53 -blacklist-ip
-|server-tcp|Upstream TCP DNS server|None|Repeatable <br>`[ip][:port]`: Server IP, port optional. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group <br>`[-set-mark]`：set mark on packets | server-tcp 8.8.8.8:53
-|server-tls|Upstream TLS DNS server|None|Repeatable <br>`[ip][:port]`: Server IP, port optional. <br>`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br>`[-host-name]`:TLS Server name. `-` to disable SNI name.<br>`[-tls-host-verify]`: TLS cert hostname to verify. <br>`-no-check-certificate:`: No check certificate. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group <br> `[-set-mark]`：set mark on packets | server-tls 8.8.8.8:853
-|server-https|Upstream HTTPS DNS server|None|Repeatable <br>`https://[host][:port]/path`: Server IP, port optional. <br>`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br>`[-host-name]`:TLS Server name<br>`[-http-host]`：http header host. <br>`[-tls-host-verify]`: TLS cert hostname to verify. <br>`-no-check-certificate:`: No check certificate. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group <br> `[-set-mark]`：set mark on packets | server-https https://cloudflare-dns.com/dns-query
+|server|Upstream UDP DNS server|None|Repeatable <br />`[ip][:port]\|URL`: Server IP, port optional OR URL. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group. <br />`[-set-mark mark]`：set mark on packets <br /> `[-proxy name]`: set proxy server| server 8.8.8.8:53 -blacklist-ip<br />server tls://8.8.8.8
+|server-tcp|Upstream TCP DNS server|None|Repeatable <br />`[ip][:port]`: Server IP, port optional. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group <br />`[-set-mark mark]`：set mark on packets <br /> `[-proxy name]`: set proxy server| server-tcp 8.8.8.8:53
+|server-tls|Upstream TLS DNS server|None|Repeatable <br />`[ip][:port]`: Server IP, port optional. <br />`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br />`[-host-name]`:TLS Server name. `-` to disable SNI name.<br />`[-tls-host-verify]`: TLS cert hostname to verify. <br />`-no-check-certificate:`: No check certificate. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group <br /> `[-set-mark mark]`：set mark on packets <br /> `[-proxy name]`: set proxy server| server-tls 8.8.8.8:853
+|server-https|Upstream HTTPS DNS server|None|Repeatable <br />`https://[host][:port]/path`: Server IP, port optional. <br />`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br />`[-host-name]`:TLS Server name<br />`[-http-host]`：http header host. <br />`[-tls-host-verify]`: TLS cert hostname to verify. <br />`-no-check-certificate:`: No check certificate. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group <br /> `[-set-mark mark]`：set mark on packets <br /> `[-proxy name]`: set proxy server| server-https <https://cloudflare-dns.com/dns-query>
+|proxy-server| proxy server | None | Repeatable. <br />`proxy-server URL` <br />[URL]: `[socks5\|http]://[username:password@]host:port`<br />[-name]:  proxy server name. |proxy-server socks5://user:pass@1.2.3.4:1080 -name proxy|
 |speed-check-mode|Speed mode|None|[ping\|tcp:[80]\|none]|speed-check-mode ping,tcp:80,tcp:443
-|response-mode|First query response mode|first-ping|Mode: [fisrt-ping\|fastest-ip\|fastest-response]<br> [first-ping]: The fastest dns + ping response mode, DNS query delay + ping delay is the shortest;<br>[fastest-ip]: The fastest IP address mode, return the fastest ip address, may take some time to test speed. <br>[fastest-response]: The fastest response DNS result mode, the DNS query waiting time is the shortest. | response-mode first-ping |
+|response-mode|First query response mode|first-ping|Mode: [first-ping\|fastest-ip\|fastest-response]<br /> [first-ping]: The fastest dns + ping response mode, DNS query delay + ping delay is the shortest;<br />[fastest-ip]: The fastest IP address mode, return the fastest ip address, may take some time to test speed. <br />[fastest-response]: The fastest response DNS result mode, the DNS query waiting time is the shortest. | response-mode first-ping |
 |address|Domain IP address|None|address /domain/[ip\|-\|-4\|-6\|#\|#4\|#6], `-` for ignore, `#` for return SOA, `4` for IPV4, `6` for IPV6| address /www.example.com/1.2.3.4
 |nameserver|To query domain with specific server group|None|nameserver /domain/[group\|-], `group` is the group name, `-` means ignore this rule, use the `-group` parameter in the related server|nameserver /www.example.com/office
 |ipset|Domain IPSet|None|ipset /domain/[ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]], `-` for ignore|ipset /www.example.com/#4:dns4,#6:-
 |ipset-timeout|ipset timeout enable|no|[yes\|no]|ipset-timeout yes
-|nftset|Domain nftset|None|nftset /domain/[#4\|#6\|-]:[family#nftable#nftset\|-][,#[4\|6]:[family#nftable#nftset\|-]]], `-` to ignore; the valid families are inet and ip for ipv4 addresses while the valid ones are inet and ip6 for ipv6 addresses; due to the limitation of nft, two types of addresses have to be stored in two sets|nftset /www.example.com/#4:inet#mytab#dns4,#6:-
+|nftset|Domain nftset|None|nftset /domain/[#4\|#6\|-]:[family#nftable#nftset\|-][,#[4\|6]:[family#nftable#nftset\|-]]], `-` to ignore; the valid families are inet and ip for ipv4 addresses while the valid ones are inet and ip6 for ipv6 addresses; due to the limitation of nft, two types of addresses have to be stored in two sets|nftset /www.example.com/#4:inet#tab#dns4,#6:-
 |nftset-timeout|nftset timeout enable|no|[yes\|no]|nftset-timeout yes
 |nftset-debug|nftset debug enable|no|[yes\|no]|nftset-debug yes
-|domain-rules|set domain rules|None|domain-rules /domain/ [-rules...]<br>[-c\|-speed-check-mode]: set speed check mode，same as parameter speed-check-mode<br>[-a\|-address]: same as  parameter `address` <br>[-n\|-nameserver]: same as parameter `nameserver`<br>[-p\|-ipset]: same as parameter `nftset`<br>[-t\|-nftset]: same as parameter `nftset`<br>[-d\|-dualstack-ip-selection]: same as parameter `dualstack-ip-selection`<br>  [-no-serve-expired]：disable serve expired|domain-rules /www.example.com/ -speed-check-mode none
-| domain-set | collection of domains|None| domain-set [options...]<br>[-n\|-name]：name of set <br>[-t\|-type] [list]: set type, only support list, one domain per line <br>[-f\|-file]：file path of domain set<br> used with address, nameserver, ipset, nftset, example: /domain-set:[name]/ | domain-set -name set -type list -file /path/to/list <br> address /domain-set:set/1.2.4.8 |
+|domain-rules|set domain rules|None|domain-rules /domain/ [-rules...]<br />[-c\|-speed-check-mode]: set speed check mode，same as parameter speed-check-mode<br />[-a\|-address]: same as  parameter `address` <br />[-n\|-nameserver]: same as parameter `nameserver`<br />[-p\|-ipset]: same as parameter `nftset`<br />[-t\|-nftset]: same as parameter `nftset`<br />[-d\|-dualstack-ip-selection]: same as parameter `dualstack-ip-selection`<br />  [-no-serve-expired]：disable serve expired<br />[-delete]：delete rule|domain-rules /www.example.com/ -speed-check-mode none
+| domain-set | collection of domains|None| domain-set [options...]<br />[-n\|-name]：name of set <br />[-t\|-type] [list]: set type, only support list, one domain per line <br />[-f\|-file]：file path of domain set<br /> used with address, nameserver, ipset, nftset, example: /domain-set:[name]/ | domain-set -name set -type list -file /path/to/list <br /> address /domain-set:set/1.2.4.8 |
 |bogus-nxdomain|bogus IP address|None|[IP/subnet], Repeatable| bogus-nxdomain 1.2.3.4/16
 |ignore-ip|ignore ip address|None|[ip/subnet], Repeatable| ignore-ip 1.2.3.4/16
 |whitelist-ip|ip whitelist|None|[ip/subnet], Repeatable，When the filtering server responds IPs in the IP whitelist, only result in whitelist will be accepted| whitelist-ip 1.2.3.4/16
 |blacklist-ip|ip blacklist|None|[ip/subnet], Repeatable，When the filtering server responds IPs in the IP blacklist, The result will be discarded directly| blacklist-ip 1.2.3.4/16
 |force-AAAA-SOA|force AAAA query return SOA|no|[yes\|no]|force-AAAA-SOA yes
-|force-qtype-SOA|force specific qtype return SOA|qtype id|[qtypeid | ...]|force-qtype-SOA 65 28
+|force-qtype-SOA|force specific qtype return SOA|qtype id|[qtypeid \| ...]|force-qtype-SOA 65 28
 |prefetch-domain|domain prefetch feature|no|[yes\|no]|prefetch-domain yes
 |dnsmasq-lease-file|Support reading dnsmasq dhcp file to resolve local hostname|None|dnsmasq dhcp lease file| dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
 |serve-expired|Cache serve expired feature|yes|[yes\|no], Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish.|serve-expired yes
-|serve-expired-ttl|Cache serve expired limite TTL|0|second，0：disable，> 0  seconds after expiration|serve-expired-ttl 0
+|serve-expired-ttl|Cache serve expired limit TTL|0|second，0：disable，> 0  seconds after expiration|serve-expired-ttl 0
 |serve-expired-reply-ttl|TTL value to use when replying with expired data|5|second，0：disable，> 0  seconds after expiration|serve-expired-reply-ttl 30
 |dualstack-ip-selection|Dualstack ip selection|yes|[yes\|no]|dualstack-ip-selection yes
-|dualstack-ip-selection-threshold|Dualstack ip select threadhold|15ms|millisecond|dualstack-ip-selection-threshold [0-1000]
+|dualstack-ip-selection-threshold|Dualstack ip select thresholds|15ms|millisecond|dualstack-ip-selection-threshold [0-1000]
 |user|run as user|root|user [username]|user nobody
-|ca-file|certificate file|/etc/ssl/certs/ca-certificates.crt|path|ca-file /etc/ssl/certs/ca-certificates.crt
+|ca-file|certificate file|/etc/ssl/certs/<br />ca-certificates.crt|path|ca-file /etc/ssl/certs/ca-certificates.crt
 |ca-path|certificates path|/etc/ssl/certs|path|ca-path /etc/ssl/certs

 ## FAQ

 1. What is the difference between SmartDNS and DNSMASQ?  
    Smartdns is not designed to replace DNSMASQ. The main function of Smartdns is focused on DNS resolution enhancement, the difference are:  
-    * Multiple upstream server concurrent requests, after the results are measured, return the best results;
-    * `address`, `ipset` domain name matching uses efficient algorithms, query matching is faster and more efficient, and router devices are still efficient.
-    * Domain name matching supports ignoring specific domain names, and can be individually matched to IPv4, IPV6, and supports diversified customization.
-    * Enhance the ad blocking feature, return SOA record, this block ads better;
-    * IPV4, IPV6 dual stack IP optimization mechanism, in the case of dual network, choose the fastest network.
-    * Supports the latest TLS, HTTPS protocol and provides secure DNS query capabilities.
-    * DNS anti-poison mechanism, and a variety of mechanisms to avoid DNS pollution.
-    * ECS support, the query results are better and more accurate.
-    * IP blacklist support, ignoring the blacklist IP to make domain name queries better and more accurate.
-    * Domain name pre-fetch, more faster to access popular websites.
-    * Domain name TTL can be specified to make access faster.
-    * Cache mechanism to make access faster.
-    * Asynchronous log, audit log mechanism, does not affect DNS query performance while recording information.
-    * Domain group mechanism, specific domain names use specific upstream server group queries to avoid privacy leakage.
-    * The second DNS supports customizing more behavior.
+    - Multiple upstream server concurrent requests, after the results are measured, return the best results;
+    - `address`, `ipset` domain name matching uses efficient algorithms, query matching is faster and more efficient, and router devices are still efficient.
+    - Domain name matching supports ignoring specific domain names, and can be individually matched to IPv4, IPV6, and supports diversified customization.
+    - Enhance the ad blocking feature, return SOA record, this block ads better;
+    - IPV4, IPV6 dual stack IP optimization mechanism, in the case of dual network, choose the fastest network.
+    - Supports the latest TLS, HTTPS protocol and provides secure DNS query capabilities.
+    - DNS anti-poison mechanism, and a variety of mechanisms to avoid DNS pollution.
+    - ECS support, the query results are better and more accurate.
+    - IP blacklist support, ignoring the blacklist IP to make domain name queries better and more accurate.
+    - Domain name pre-fetch, more faster to access popular websites.
+    - Domain name TTL can be specified to make access faster.
+    - Cache mechanism to make access faster.
+    - Asynchronous log, audit log mechanism, does not affect DNS query performance while recording information.
+    - Domain group mechanism, specific domain names use specific upstream server group queries to avoid privacy leakage.
+    - The second DNS supports customizing more behavior.

 1. What is the best practices for upstream server configuration?  
    Smartdns has a speed measurement mechanism. When configuring an upstream server, it is recommended to configure multiple upstream DNS servers, including servers in different regions, but the total number is recommended to be around 10. Recommended configuration
-    * Carrier DNS.
-    * Public DNS, such as `8.8.8.8`, `8.8.4.4`, `1.1.1.1`.
+    - Carrier DNS.
+    - Public DNS, such as `8.8.8.8`, `8.8.4.4`, `1.1.1.1`.

    For specific domain names, if there is a pollution, you can enable the anti-pollution mechanism.

@@ -610,27 +622,27 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use

 1. How to avoid DNS privacy leaks  
    By default, smartdns will send requests to all configured DNS servers. If the upstream DNS servers record DNS logs, it will result in a DNS privacy leak. To avoid privacy leaks, try the following steps:
-    * Use trusted DNS servers.
-    * Use TLS servers.
-    * Set up an upstream DNS server group.
+    - Use trusted DNS servers.
+    - Use TLS servers.
+    - Set up an upstream DNS server group.

 1. How to block ads  
    Smartdns has a high-performance domain name matching algorithm. It is very efficient to filter advertisements by domain name. To block ads, you only need to configure records like the following configure. For example, if you block `*.ad.com`, configure as follows:

-    ```sh
+    ```shell
    Address /ad.com/#
    ```

    The suffix mode of the domain name, filtering *.ad.com, `#` means returning SOA record. If you want to only block IPV4 or IPV6 separately, add a number after `#`, such as `#4` is for IPV4 blocking. If you want to ignore some specific subdomains, you can configure it as follows. e.g., if you ignore `pass.ad.com`, you can configure it as follows:

-    ```sh
+    ```shell
    Address /pass.ad.com/-
    ```

 1. DNS query diversion  
    In some cases, some domain names need to be queried using a specific DNS server to do DNS diversion. such as.

-    ```sh
+    ```shell
    .home -> 192.168.1.1
    .office -> 10.0.0.1
    ```
@@ -640,7 +652,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    Other domain names are resolved using the default mode.
    The diversion configuration for this case is as follows:

-    ```sh
+    ```shell
    # Upstream configuration, use -group to specify the group name, and -exclude-default-group to exclude the server from the default group.
    Server 192.168.1.1 -group home -exclude-default-group
    Server 10.0.0.1 -group office -exclude-default-group
@@ -653,7 +665,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use

    You can use the above configuration to implement DNS resolution and offload. If you need to implement traffic distribution on the requesting port, you can configure the second DNS server. The bind configuration is added. The group parameter specifies the traffic distribution name.

-    ```sh
+    ```shell
    Bind :7053 -group office
    Bind :8053 -group home
    ```
@@ -661,28 +673,28 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 1. How to use the IPV4, IPV6 dual stack IP optimization feature  
    At present, IPV6 network is not as fast as IPV4 in some cases. In order to get a better experience in the dual-stack network, SmartDNS provides a dual-stack IP optimization mechanism, the same domain name, and the speed of IPV4. Far faster than IPV6, then SmartDNS will block the resolution of IPV6, let the PC use IPV4, the feature is enabled by `dualstack-ip-selection yes`, `dualstack-ip-selection-threshold [time]` is for threshold. if you want to disable IPV6 AAAA record complete, please try `force-AAAA-SOA yes`.

-1. How to improve cache performace  
+1. How to improve cache performance  
    Smartdns provides a domain name caching mechanism to cache the queried domain name, and the caching time is in accordance with the DNS TTL specification. To increase the cache hit rate, the following configuration can be taken:
-    * Increase the number of cache records appropriately  
+    - Increase the number of cache records appropriately  
    Set the number of cache records by `cache-size`.
    In the case of a query with a high pressure environment and a machine with a large memory, it can be appropriately adjusted.

-    * Set the minimum TTL value as appropriate  
+    - Set the minimum TTL value as appropriate  
    Set the minimum DNS TTL time to a appropriate value by `rr-ttl-min` to extend the cache time.
    It is recommended that the timeout period be set to 10 to 30 minutes to avoid then invalid domain names when domain ip changes.

-    * Enable domain pre-acquisition  
+    - Enable domain pre-acquisition  
    Enable pre-fetching of domain names with `prefetch-domain yes` to improve query hit rate.
    by default, Smartdns will send domain query request again before cache expire, and cache the result for the next query. Frequently accessed domain names will continue to be cached. This feature will consume more CPU when idle.

-    * Cache serve expired feature  
+    - Cache serve expired feature  
    Enable cache serve expired feature with `serve-expired yes` to improve the cache hit rate and reduce the CPU consumption.
    This feature will return TTL = 0 to the client after the TTL timeout, and send a new query request again at the same time, and cache the new results for later query.

 1. How does the second DNS customize more behavior?  
    The second DNS can be used as the upstream of other DNS servers to provide more query behaviors. Bind configuration support can bind multiple ports. Different ports can be set with different flags to implement different functions, such as

-    ```sh
+    ```shell
    # Binding 6053 port, request for port 6053 will be configured with the upstream query of the office group, and the result will not be measured. The address configuration address is ignored.
    bind [::]:6053 -no-speed-check -group office -no-rule-addr
    ```
@@ -690,61 +702,97 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 1. How to get SPKI of DOT  
    The SPKI can be obtained from the page published by the DNS service provider. If it is not published, it can be obtained by the following command, replace IP with your own IP.

-    ```sh
+    ```shell
    echo | openssl s_client -connect '1.0.0.1:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
    ```

-1. How to solve the problem of slow DNS resolution in iOS system?    
+1. How to solve the problem of slow DNS resolution in iOS system?
    Since iOS14, Apple has supported the resolution of DNS HTTPS (TYPE65) records. This function is used for solving problems related to HTTPS connections, but it is still a draft, and it will cause some functions such as adblocking fail. It is recommended to disable it through the following configuration.

-    ```sh
+    ```shell
    force-qtype-SOA 65
    ```

 1. How to resolve localhost ip by hostname?  
    smartdns can cooperate with the dhcp server of DNSMASQ to support the resolution of local host name to IP address. You can configure smartdns to read the lease file of dnsmasq and support the resolution. The specific configuration parameters are as follows, (note that the DNSMASQ lease file may be different for each system and needs to be configured according to the actual situation)

-    ```sh
+    ```shell
    dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
    ```

    After the configuration is complete, you can directly use the host name to connect to the local machine. But need to pay attention:

-    * Windows system uses mDNS to resolve addresses by default. If you need to use smartdns to resolve addresses under Windows, you need to add `.` after the host name, indicating that DNS resolution is used. Such as `ping smartdns.`
+    - Windows system uses mDNS to resolve addresses by default. If you need to use smartdns to resolve addresses under Windows, you need to add `.` after the host name, indicating that DNS resolution is used. Such as `ping smartdns.`

 1. How to use the domain set?  
    To facilitate configuring domain names by set, for configurations with /domain/, you can specify a domain name set for easy maintenance. The specific method is:
-    
-    * Use `domain-set` configuration domain set file:
-    
-    ````sh
+
+    - Use `domain-set` configuration domain set file:
+
+    ````shell
    domain-set -name ad -file /etc/smartdns/ad-list.conf
    ````

    The format of ad-list.conf is one domain per line:
-    
-    ````
+
+    ```shell
    ad.com
    site.com
-    ````
+    ```

-    * To use the domain set, you only need to configure `/domain/` to `/domain-set:[collection name]/`, such as:
+    - To use the domain set, you only need to configure `/domain/` to `/domain-set:[collection name]/`, such as:

-    ````sh
+    ````shell
    address /domain-set:ad/#
    domain-rules /domain-set:ad/ -a #
    nameserver /domain-set:ad/server
    ...
    ````

-1. More questions    
+1. How to use ipset and nftset?  
+    Similar to Dnsmasq, smartdns supports ipset and nftset, and can transparently forward specific domain names through TPROXY. The comparison of transparent forwarding and tool modes is as follows:
+
+    1. Tools: iptable, nftable
+
+        iptable: a mature routing rule configuration tool.
+        nftable: A more powerful rule configuration tool that is becoming mainstream.
+
+    1. Mode: TPROXY, REDIRECT
+
+        TPROXY: supports UDP and TCP forwarding, and the configuration is a little complicated.
+        REDIRECT: only supports TCP, easy to configure.
+
+    Here we only take the configuration of the most commonly used iptable/REDIRECT with ipset as an example. The specific forwarding configuration is as follows:
+
+    - Set the list of domain names that need to be transparently forwarded in smartdns.conf, for example, `example.com` needs to be transparently forwarded. Then use the ipset option and set the ipset rule of `example.com` to `proxy`.
+
+    ```shell
+    # set rules
+    # -ipset proxy: The matching domain name is set to ipset:proxy.
+    # -c none: Disable speed check.
+    # -address #6: Filter IPV6 record.
+    domain-rules /example.com/ -ipset proxy -c none -address #6
+    ```
+
+    - Execute shell commands, set iptable rules, and transparently forward matching domain name requests. The rules are as follows:
+
+    ```shell
+    # create ipset
+    ipset create proxy hash:net
+    # Set forwarding rules to forward matching requests to port 1081 of this machine
+    iptables -t nat -I PREROUTING -p tcp -m set --match-set proxy dst -j REDIRECT --to-ports 1081
+    ```
+
+    - Open the forwarding program of REDIRECT mode on port 1081 of this machine.
+
+1. More questions  
    More questions, please read issue: [https://github.com/pymumu/smartdns/issues](https://github.com/pymumu/smartdns/issues)

 ## Compile

-smartdns contains scripts for compiling packages, supports compiling luci, debian, openwrt, opare installation packages, and can execute `package/build-pkg.sh` compilation.
+smartdns contains scripts for compiling packages, supports compiling luci, debian, openwrt, optware installation packages, and can execute `package/build-pkg.sh` compilation.

-## [Donate](#Donate)  
+## [Donate](#donate)  

 If you feel that this project is helpful to you, please donate to us so that the project can continue to develop and be more perfect.

--- a/etc/init.d/smartdns
+++ b/etc/init.d/smartdns
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -93,7 +93,7 @@ case $1 in
 			exit 1
 		fi
 		echo "smartdns server is running."
-		status=$?
+		status=0
 		;;
 	*)
 		echo "Usage: $0 {start|stop|restart|status}"
--- a/etc/smartdns/smartdns.conf
+++ b/etc/smartdns/smartdns.conf
@@ -19,9 +19,9 @@

 # dns server bind ip and port, default dns server port is 53, support binding multi ip and port
 # bind udp server
-#   bind [IP]:[port] [-group [group]] [-no-rule-addr] [-no-rule-nameserver] [-no-rule-ipset] [-no-speed-check] [-no-cache] [-no-rule-soa] [-no-dualstack-selection]
+#   bind [IP]:[port][@device] [-group [group]] [-no-rule-addr] [-no-rule-nameserver] [-no-rule-ipset] [-no-speed-check] [-no-cache] [-no-rule-soa] [-no-dualstack-selection]
 # bind tcp server
-#   bind-tcp [IP]:[port] [-group [group]] [-no-rule-addr] [-no-rule-nameserver] [-no-rule-ipset] [-no-speed-check] [-no-cache] [-no-rule-soa] [-no-dualstack-selection]
+#   bind-tcp [IP]:[port][@device] [-group [group]] [-no-rule-addr] [-no-rule-nameserver] [-no-rule-ipset] [-no-speed-check] [-no-cache] [-no-rule-soa] [-no-dualstack-selection]
 # option:
 #   -group: set domain request to use the appropriate server group.
 #   -no-rule-addr: skip address rule.
@@ -36,9 +36,11 @@
 # example: 
 #  IPV4: 
 #    bind :53
+#    bind :53@eth0
 #    bind :6053 -group office -no-speed-check
 #  IPV6:
 #    bind [::]:53
+#    bind [::]:53@eth0
 #    bind-tcp [::]:53
 bind [::]:53

@@ -48,10 +50,10 @@ bind [::]:53
 # dns cache size
 # cache-size [number]
 #   0: for no cache
-cache-size 16384
+cache-size 32768

 # enable persist cache when restart
-# cache-persist yes
+# cache-persist no

 # cache persist file
 # cache-file /tmp/smartdns.cache
@@ -133,12 +135,13 @@ force-qtype-SOA 65
 # log-level: [level], level=fatal, error, warn, notice, info, debug
 # log-file: file path of log file.
 # log-size: size of each log file, support k,m,g
-# log-num: number of logs
+# log-num: number of logs, 0 means disable log
 log-level info

 # log-file /var/log/smartdns/smartdns.log
 # log-size 128k
 # log-num 2
+# log-file-mode [mode]: file mode of log file.

 # dns audit
 # audit-enable [yes|no]: enable or disable audit.
@@ -146,6 +149,7 @@ log-level info
 # audit-SOA [yes|no]: enable or disable log soa result.
 # audit-size size of each audit file, support k,m,g
 # audit-file /var/log/smartdns-audit.log
+# audit-file-mode [mode]: file mode of audit file.
 # audit-size 128k
 # audit-num 2

@@ -161,14 +165,17 @@ log-level info
 # ca-path /etc/ss/certs

 # remote udp dns server list
-# server [IP]:[PORT] [-blacklist-ip] [-whitelist-ip] [-check-edns] [-group [group] ...] [-exclude-default-group]
+# server [IP]:[PORT]|URL [-blacklist-ip] [-whitelist-ip] [-check-edns] [-group [group] ...] [-exclude-default-group]
 # default port is 53
 #   -blacklist-ip: filter result with blacklist ip
-#   -whitelist-ip: filter result whth whitelist ip,  result in whitelist-ip will be accepted.
+#   -whitelist-ip: filter result with whitelist ip,  result in whitelist-ip will be accepted.
 #   -check-edns: result must exist edns RR, or discard result.
 #   -group [group]: set server to group, use with nameserver /domain/group.
 #   -exclude-default-group: exclude this server from default group.
+#   -proxy [proxy-name]: use proxy to connect to server.
 # server 8.8.8.8 -blacklist-ip -check-edns -group g1 -group g2
+# server tls://dns.google:853 
+# server https://dns.google/dns-query

 # remote tcp dns server list
 # server-tcp [IP]:[PORT] [-blacklist-ip] [-whitelist-ip] [-group [group] ...] [-exclude-default-group]
@@ -181,6 +188,7 @@ log-level info
 #   -tls-host-verify: cert hostname to verify.
 #   -host-name: TLS sni hostname.
 #   -no-check-certificate: no check certificate.
+#   -proxy [proxy-name]: use proxy to connect to server.
 # Get SPKI with this command:
 #    echo | openssl s_client -connect '[ip]:853' | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
 # default port is 853
@@ -194,9 +202,19 @@ log-level info
 #   -host-name: TLS sni hostname.
 #   -http-host: http host.
 #   -no-check-certificate: no check certificate.
+#   -proxy [proxy-name]: use proxy to connect to server.
 # default port is 443
 # server-https https://cloudflare-dns.com/dns-query

+# socks5 and http proxy list
+# proxy-server URL -name [proxy name]
+#   URL: socks5://[username:password@]host:port
+#        http://[username:password@]host:port
+#   -name: proxy name, use with server -proxy [proxy-name]
+# example:
+#   proxy-server socks5://user:pass@1.2.3.4:1080 -name proxy
+#   proxy-server http://user:pass@1.2.3.4:3128 -name proxy
+
 # specific nameserver to domain
 # nameserver /domain/[group|-]
 # nameserver /www.example.com/office, Set the domain name to use the appropriate server group.
@@ -217,10 +235,12 @@ log-level info
 # ipset /www.example.com/-, ignore this domain

 # enable nftset timeout by ttl feature
-# nftset-timeout [yes]
+# nftset-timeout [yes|no]
+# nftset-timeout yes

 # enable nftset debug, check nftset setting result, output log when error.
-# nftset-debug [no]
+# nftset-debug [yes|no]
+# nftset-debug yes

 # specific nftset to domain
 # nftset /domain/[#4:ip#table#set,#6:ipv6#table#setv6]
@@ -239,6 +259,7 @@ log-level info
 #   [-t] -nftset [nftset|-]: same as nftset option
 #   [-d] -dualstack-ip-selection [yes|no]: same as dualstack-ip-selection option
 #   -no-serve-expired: ignore expired domain
+#   -delete: delete domain rule

 # collection of domains 
 # the domain-set can be used with /domain/ for address, nameserver, ipset, etc.
--- a/package/debian/make.sh
+++ b/package/debian/make.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/linux/install
+++ b/package/linux/install
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/luci-compat/control/postinst
+++ b/package/luci-compat/control/postinst
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/luci-compat/control/prerm
+++ b/package/luci-compat/control/prerm
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/luci-compat/files/etc/uci-defaults/50_luci-smartdns
+++ b/package/luci-compat/files/etc/uci-defaults/50_luci-smartdns
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/luci-compat/files/luci/controller/smartdns.lua
+++ b/package/luci-compat/files/luci/controller/smartdns.lua
@@ -1,5 +1,5 @@
 --
-- Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+-- Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 --
 -- smartdns is free software: you can redistribute it and/or modify
 -- it under the terms of the GNU General Public License as published by
--- a/package/luci-compat/files/luci/i18n/smartdns.zh-cn.po
+++ b/package/luci-compat/files/luci/i18n/smartdns.zh-cn.po
@@ -25,6 +25,15 @@ msgstr "自动设置Dnsmasq"
 msgid "Automatically set as upstream of dnsmasq when port changes."
 msgstr "自动设置为Dnsmasq的上游服务器"

+msgid "Bind Device"
+msgstr "绑定到设备"
+
+msgid "Bind Device Name"
+msgstr "绑定的设备名称"
+
+msgid "Cache Persist"
+msgstr "持久化缓存"
+
 msgid "Cache Size"
 msgstr "缓存大小"

@@ -171,6 +180,15 @@ msgstr "文件类型"
 msgid "Filtering IP with blacklist"
 msgstr "使用IP黑名单过滤"

+msgid "First Ping"
+msgstr "最快PING"
+
+msgid "Fastest IP"
+msgstr "最快IP"
+
+msgid "Fastest Response"
+msgstr "最快响应"
+
 msgid "Force AAAA SOA"
 msgstr "停用IPV6地址解析"

@@ -227,6 +245,9 @@ msgstr "包含配置文件，路径为/etc/smartdns/conf.d，或自定义配置
 msgid "List of files to download."
 msgstr "下载的文件列表。"

+msgid "Listen only on the specified interfaces."
+msgstr "监听在指定的设备上，避免非本地网络的DNS查询请求。"
+
 msgid "Local Port"
 msgstr "本地端口"

@@ -242,6 +263,9 @@ msgstr "所有域名的最大 TTL 值。"
 msgid "Minimum TTL for all domain result."
 msgstr "所有域名的最小 TTL 值。"

+msgid "Name of device name listen on."
+msgstr "绑定的设备名称。"
+
 msgid "NFTset Name"
 msgstr "NFTSet名称"

@@ -257,6 +281,21 @@ msgstr "未运行"
 msgid "No check certificate"
 msgstr "停用证书校验"

+msgid "Please set proxy server first."
+msgstr "请先设置代理服务器。"
+
+msgid "Proxy Server"
+msgstr "代理服务器"
+
+msgid "Proxy Server URL, format: [socks5|http]://user:pass@ip:port."
+msgstr "代理服务器地址，格式：[socks5|http]://user:pass@ip:port。"
+
+msgid "Proxy server URL format error, format: [socks5|http]://user:pass@ip:port."
+msgstr "代理服务器地址格式错误，格式：[socks5|http]://user:pass@ip:port。"
+
+msgid "Proxy Server Settings"
+msgstr "代理服务器设置"
+
 msgid "Query DNS through specific dns server group, such as office, home."
 msgstr "使用指定服务器组查询，比如office, home。"

@@ -281,6 +320,9 @@ msgstr "重启"
 msgid "Restart smartdns"
 msgstr "重启服务"

+msgid "Response Mode"
+msgstr "响应模式"
+
 msgid "Second Server Settings"
 msgstr "第二DNS服务器"

@@ -390,6 +432,14 @@ msgstr "测速模式"
 msgid "Smartdns speed check mode. "
 msgstr "SmartDns测速模式设置。"

+msgid ""
+"Smartdns response mode, First Ping: return the first ping IP, "
+"Fastest IP: return the fastest IP, Fastest Response: return the fastest "
+"DNS response."
+msgstr ""
+"SmartDNS响应模式，最快PING： 返回最早有ping结果的IP，速度适中；最快IP： "
+"返回最快IP，查询请求可能延长； 最快响应：返回最快响应的结果。查询请求时间短。"
+
 msgid ""
 "Specify an IP address to return for any host in the given domains, Queries "
 "in the domains are never forwarded and always replied to with the specified "
@@ -419,6 +469,12 @@ msgstr "设置所有域名的 TTL 值。"
 msgid "Technical Support"
 msgstr "技术支持"

+msgid "Use Proxy"
+msgstr "使用代理"
+
+msgid "Use proxy to connect to upstream DNS server."
+msgstr "使用代理连接上游DNS服务器。"
+
 msgid "URL"
 msgstr "URL"

@@ -429,7 +485,7 @@ msgid "Update Files"
 msgstr "更新文件"

 msgid "Upload Config File"
-msgstr "上传域名列表文件"
+msgstr "上传配置文件"

 msgid "Upload Domain List File"
 msgstr "上传域名列表文件"
@@ -469,6 +525,9 @@ msgstr ""
 "用于校验 TLS 服务器的有效性，数值为 Base64 编码的 SPKI 指纹，留空表示不验证 "
 "TLS 的合法性。"

+msgid "Write cache to disk on exit and load on startup."
+msgstr "退出时保存cache到磁盘，启动时加载。"
+
 msgid "domain list (/etc/smartdns/domain-set)"
 msgstr "域名列表（/etc/smartdns/domain-set）"

--- a/package/luci-compat/files/luci/model/cbi/smartdns/smartdns.lua
+++ b/package/luci-compat/files/luci/model/cbi/smartdns/smartdns.lua
@@ -1,5 +1,5 @@
 --
-- Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+-- Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 --
 -- smartdns is free software: you can redistribute it and/or modify
 -- it under the terms of the GNU General Public License as published by
@@ -34,6 +34,7 @@ s.anonymous = true
 s:tab("settings", translate("General Settings"))
 s:tab("advanced", translate('Advanced Settings'))
 s:tab("seconddns", translate("Second Server Settings"))
+s:tab("proxy", translate("Proxy Server Settings"))
 s:tab("custom", translate("Custom Settings"))

 ---- Eanble
@@ -101,6 +102,16 @@ function o.validate (section_id, value)
    return value
 end

+---- response mode;
+o = s:taboption("advanced", ListValue, "response_mode", translate("Response Mode"), 
+    translate("Smartdns response mode, First Ping: return the first ping IP, Fastest IP: return the fastest IP, Fastest Response: return the fastest DNS response."))
+o.rmempty     = true
+o.placeholder = "default"
+o:value("", translate("default"))
+o:value("first-ping", translate("First Ping"))
+o:value("fastest-ip", translate("Fastest IP"))
+o:value("fastest-response", translate("Fastest Response"))
+
 ---- Enable TCP server
 o = s:taboption("advanced", Flag, "tcp_server", translate("TCP Server"), translate("Enable TCP DNS Server"))
 o.rmempty     = false
@@ -117,6 +128,20 @@ o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "1"
 end

+---- bind to device;
+o = s:taboption("advanced", Flag, "bind_device", translate("Bind Device"), translate("Listen only on the specified interfaces."))
+o.rmempty     = false
+o.default     = o.enabled
+o.cfgvalue    = function(...)
+    return Flag.cfgvalue(...) or "1"
+end
+
+---- bind device name;
+o = s:taboption("advanced", Value, "bind_device_name", translate("Bind Device Name"), translate("Name of device name listen on."))
+o.placeholder = "default"
+o.rempty      = true
+o.datatype    = "string"
+
 ---- Support DualStack ip selection
 o = s:taboption("advanced", Flag, "dualstack_ip_selection", translate("Dual-stack IP Selection"), translate("Enable IP selection between IPV4 and IPV6"))
 o.rmempty     = false
@@ -146,6 +171,14 @@ end
 o = s:taboption("advanced", Value, "cache_size", translate("Cache Size"), translate("DNS domain result cache size"))
 o.rempty      = true

+---- cache-persist;
+o = s:taboption("advanced", Flag, "cache_persist", translate("Cache Persist"), translate("Write cache to disk on exit and load on startup."))
+o.rmempty      = false;
+o.default     = o.enabled;
+o.cfgvalue    = function(...)
+    return Flag.cfgvalue(...) or "1"
+end
+
 -- cache-size
 o = s:taboption("advanced", Flag, "resolve_local_hostnames", translate("Resolve Local Hostnames"), translate("Resolve local hostnames by reading Dnsmasq lease file."))
 o.rmempty     = false
@@ -298,6 +331,21 @@ o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "0"
 end

+----- Proxy server settings
+o = s:taboption("proxy", Value, "proxy_server", translate("Proxy Server"), translate("Proxy Server URL, format: [socks5|http]://user:pass@ip:port."));
+o.datatype = 'string';
+function o.validate(self, value)
+    if (value == "") then
+        return true
+    end
+
+    if (not value:match("^http://") and not value:match("^socks5://")) then
+        return nil, translate("Proxy server URL format error, format: [socks5|http]://user:pass@ip:port.")
+    end
+
+    return value
+end
+
 ----- custom settings
 custom = s:taboption("custom", Value, "Custom Settings",
 	translate(""), 
--- a/package/luci-compat/files/luci/model/cbi/smartdns/upstream.lua
+++ b/package/luci-compat/files/luci/model/cbi/smartdns/upstream.lua
@@ -1,5 +1,5 @@
 --
-- Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+-- Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 --
 -- smartdns is free software: you can redistribute it and/or modify
 -- it under the terms of the GNU General Public License as published by
@@ -133,6 +133,23 @@ o.default     = ""
 o.rempty      = true
 o.datatype    = "uinteger"

+---- use proxy
+o = s:option(Flag, "use_proxy", translate("Use Proxy"), translate("Use proxy to connect to upstream DNS server."))
+o.rmempty     = true
+o.default     = o.disabled
+o.cfgvalue    = function(...)
+    return Flag.cfgvalue(...) or "0"
+end
+function o.validate(self, value, section)
+    if value == "1" then
+        local proxy = m.uci:get_first("smartdns", "smartdns", "proxy_server")
+        if proxy == nil or proxy == "" then
+            return nil, translate("Please set proxy server first.")
+        end
+    end
+    return value
+end
+
 ---- other args
 o = s:option(Value, "addition_arg", translate("Additional Server Args"), translate("Additional Args for upstream dns servers"))
 o.default     = ""
--- a/package/luci-compat/files/luci/model/smartdns.lua
+++ b/package/luci-compat/files/luci/model/smartdns.lua
@@ -1,5 +1,5 @@
 --
-- Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+-- Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 --
 -- smartdns is free software: you can redistribute it and/or modify
 -- it under the terms of the GNU General Public License as published by
--- a/package/luci-compat/files/luci/view/smartdns/smartdns_status.htm
+++ b/package/luci-compat/files/luci/view/smartdns/smartdns_status.htm
@@ -7,7 +7,7 @@ XHR.poll(3, '<%=luci.dispatcher.build_url("admin", "services", "smartdns", "stat
 			if (data.running) {
 				links = '<b><font color=green>SmartDNS - <%:RUNNING%></font></b></em>';
 				if (data.dnsmasq_redirect_failure == 1) {
-					links += "<br></br><b><font color=red><%:Dnsmasq Forwared To Smartdns Failure%></font></b>"
+					links += "<br></br><b><font color=red><%:Dnsmasq Forwarded To Smartdns Failure%></font></b>"
 				}
 			} else {
 				links = '<b><font color=red>SmartDNS - <%:NOT RUNNING%></font></b>';
--- a/package/luci-compat/make.sh
+++ b/package/luci-compat/make.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/luci/control/postinst
+++ b/package/luci/control/postinst
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/luci/control/prerm
+++ b/package/luci/control/prerm
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/luci/files/luci/i18n/smartdns.zh-cn.po
+++ b/package/luci/files/luci/i18n/smartdns.zh-cn.po
@@ -25,11 +25,20 @@ msgstr "自动设置Dnsmasq"
 msgid "Automatically set as upstream of dnsmasq when port changes."
 msgstr "端口更改时自动设为 dnsmasq 的上游。"

-msgid "Block domain type"
-msgstr "屏蔽域名类型"
+msgid "Bind Device"
+msgstr "绑定到设备"

-msgid "Block domain type."
-msgstr "屏蔽域名类型。"
+msgid "Bind Device Name"
+msgstr "绑定的设备名称"
+
+msgid "Block domain"
+msgstr "屏蔽域名"
+
+msgid "Block domain."
+msgstr "屏蔽域名。"
+
+msgid "Cache Persist"
+msgstr "持久化缓存"

 msgid "Cache Size"
 msgstr "缓存大小"
@@ -87,7 +96,7 @@ msgstr "默认"
 msgid "Description"
 msgstr "描述"

-msgid "Dnsmasq Forwared To Smartdns Failure"
+msgid "Dnsmasq Forwarded To Smartdns Failure"
 msgstr "重定向dnsmasq到smartdns失败"

 msgid "Do not check certificate."
@@ -192,6 +201,15 @@ msgstr "文件类型"
 msgid "Filtering IP with blacklist"
 msgstr "使用IP黑名单过滤"

+msgid "First Ping"
+msgstr "最快PING"
+
+msgid "Fastest IP"
+msgstr "最快IP"
+
+msgid "Fastest Response"
+msgstr "最快响应"
+
 msgid "Force AAAA SOA"
 msgstr "停用IPV6地址解析"

@@ -253,6 +271,9 @@ msgstr ""
 msgid "List of files to download."
 msgstr "下载文件列表"

+msgid "Listen only on the specified interfaces."
+msgstr "监听在指定的设备上，避免非本地网络的DNS查询请求。"
+
 msgid "Local Port"
 msgstr "本地端口"

@@ -268,6 +289,9 @@ msgstr "所有域名的最大 TTL 值。"
 msgid "Minimum TTL for all domain result."
 msgstr "所有域名的最小 TTL 值。"

+msgid "Name of device name listen on."
+msgstr "绑定的设备名称。"
+
 msgid "NFTset Name"
 msgstr "NFTSet名称"

@@ -289,6 +313,24 @@ msgstr "停用证书校验"
 msgid "None"
 msgstr "无"

+msgid "Only socks5 proxy support udp server."
+msgstr "仅SOCKS5代理支持UDP服务器。"
+
+msgid "Please set proxy server first."
+msgstr "请先设置代理服务器。"
+
+msgid "Proxy Server"
+msgstr "代理服务器"
+
+msgid "Proxy Server URL, format: [socks5|http]://user:pass@ip:port."
+msgstr "代理服务器地址，格式：[socks5|http]://user:pass@ip:port。"
+
+msgid "Proxy server URL format error, format: [socks5|http]://user:pass@ip:port."
+msgstr "代理服务器地址格式错误，格式：[socks5|http]://user:pass@ip:port。"
+
+msgid "Proxy Server Settings"
+msgstr "代理服务器设置"
+
 msgid "Query DNS through specific dns server group, such as office, home."
 msgstr "使用指定服务器组查询，比如office, home。"

@@ -310,6 +352,9 @@ msgstr "解析本地主机名"
 msgid "Resolve local hostnames by reading Dnsmasq lease file."
 msgstr "读取Dnsmasq的租约文件解析本地主机名。"

+msgid "Response Mode"
+msgstr "响应模式"
+
 msgid "Restart"
 msgstr "重启"

@@ -422,6 +467,14 @@ msgstr "SmartDNS的服务器名称，默认为smartdns，留空为主机名"
 msgid "Smartdns speed check mode."
 msgstr "SmartDNS测速模式。"

+msgid ""
+"Smartdns response mode, First Ping: return the first ping IP, "
+"Fastest IP: return the fastest IP, Fastest Response: return the fastest "
+"DNS response."
+msgstr ""
+"SmartDNS响应模式，最快PING： 返回最早有ping结果的IP，速度适中；最快IP： "
+"返回最快IP，查询请求可能延长； 最快响应：返回最快响应的结果。查询请求时间短。"
+
 msgid "Speed Check Mode"
 msgstr "测速模式"

@@ -451,6 +504,12 @@ msgstr "设置所有域名的 TTL 值。"
 msgid "Technical Support"
 msgstr "技术支持"

+msgid "Use Proxy"
+msgstr "使用代理"
+
+msgid "Use proxy to connect to upstream DNS server."
+msgstr "使用代理连接上游DNS服务器。"
+
 msgid "URL"
 msgstr "URL"

@@ -501,6 +560,9 @@ msgstr ""
 "用于校验 TLS 服务器的有效性，数值为 Base64 编码的 SPKI 指纹，留空表示不验证 "
 "TLS 的合法性。"

+msgid "Write cache to disk on exit and load on startup."
+msgstr "退出时保存cache到磁盘，启动时加载。"
+
 msgid "domain list (/etc/smartdns/domain-set)"
 msgstr "域名列表（/etc/smartdns/domain-set）"

--- a/package/luci/files/root/www/luci-static/resources/view/smartdns/smartdns.js
+++ b/package/luci/files/root/www/luci-static/resources/view/smartdns/smartdns.js
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -38,11 +38,11 @@ var pollAdded = false;
 function getServiceStatus() {
 	return L.resolveDefault(callServiceList(conf), {})
 		.then(function (res) {
-			var isrunning = false;
+			var is_running = false;
 			try {
-				isrunning = res[conf]['instances']['smartdns']['running'];
+				is_running = res[conf]['instances']['smartdns']['running'];
 			} catch (e) { }
-			return isrunning;
+			return is_running;
 		});
 }

@@ -73,7 +73,7 @@ function smartdnsRenderStatus(res) {
 		uci.unload('dhcp');
 		uci.load('dhcp');
 		if (dnsmasqServer == undefined || dnsmasqServer.indexOf(matchLine) < 0) {
-			renderHTML += "<br /><span style=\"color:red;font-weight:bold\">" + _("Dnsmasq Forwared To Smartdns Failure") + "</span>";
+			renderHTML += "<br /><span style=\"color:red;font-weight:bold\">" + _("Dnsmasq Forwarded To Smartdns Failure") + "</span>";
 		}
 	}

@@ -90,7 +90,7 @@ return view.extend({
 	render: function (stats) {
 		var m, s, o;
 		var ss, so;
-		var servers, downlfiles;
+		var servers, download_files;

 		m = new form.Map('smartdns', _('SmartDNS'));
 		m.title = _("SmartDNS Server");
@@ -132,6 +132,7 @@ return view.extend({
 		s.tab("advanced", _('Advanced Settings'));
 		s.tab("seconddns", _("Second Server Settings"));
 		s.tab("files", _("Download Files Setting"), _("Download domain list files for domain-rule and include config files, please refresh the page after download to take effect."));
+		s.tab("proxy", _("Proxy Server Settings"));
 		s.tab("custom", _("Custom Settings"));

 		///////////////////////////////////////
@@ -198,6 +199,16 @@ return view.extend({
 			return true;
 		}

+		// response mode;
+		o = s.taboption("advanced", form.ListValue, "response_mode", _("Response Mode"),
+			_("Smartdns response mode, First Ping: return the first ping IP, Fastest IP: return the fastest IP, Fastest Response: return the fastest DNS response."));
+		o.rmempty = true;
+		o.placeholder = "default";
+		o.value("", _("default"));
+		o.value("first-ping", _("First Ping"));
+		o.value("fastest-ip", _("Fastest IP"));
+		o.value("fastest-response", _("Fastest Response"));
+
 		// Enable TCP server;
 		o = s.taboption("advanced", form.Flag, "tcp_server", _("TCP Server"), _("Enable TCP DNS Server"));
 		o.rmempty = false;
@@ -208,6 +219,17 @@ return view.extend({
 		o.rmempty = false;
 		o.default = o.enabled;

+		// bind to device;
+		o = s.taboption("advanced", form.Flag, "bind_device", _("Bind Device"), _("Listen only on the specified interfaces."));
+		o.rmempty = false;
+		o.default = o.enabled;
+
+		// bind device name;
+		o = s.taboption("advanced", form.Value, "bind_device_name", _("Bind Device Name"), _("Name of device name listen on."));
+		o.placeholder = "default";
+		o.rempty = true;
+		o.datatype = "string";
+
 		// Support DualStack ip selection;
 		o = s.taboption("advanced", form.Flag, "dualstack_ip_selection", _("Dual-stack IP Selection"),
 			_("Enable IP selection between IPV4 and IPV6"));
@@ -230,6 +252,11 @@ return view.extend({
 		o = s.taboption("advanced", form.Value, "cache_size", _("Cache Size"), _("DNS domain result cache size"));
 		o.rempty = true;

+		// cache-persist;
+		o = s.taboption("advanced", form.Flag, "cache_persist", _("Cache Persist"), _("Write cache to disk on exit and load on startup."));
+		o.rmempty = false;
+		o.default = o.enabled;
+
 		// cache-size;
 		o = s.taboption("advanced", form.Flag, "resolve_local_hostnames", _("Resolve Local Hostnames"), _("Resolve local hostnames by reading Dnsmasq lease file."));
 		o.rmempty = false;
@@ -273,25 +300,25 @@ return view.extend({
 		o.rempty = true;

 		// include config
-		downlfiles = uci.sections('smartdns', 'download-file');
+		download_files = uci.sections('smartdns', 'download-file');
 		o = s.taboption("advanced", form.DynamicList, "conf_files", _("Include Config Files<br>/etc/smartdns/conf.d"),
 			_("Include other config files from /etc/smartdns/conf.d or custom path, can be downloaded from the download page."));
-		for (var i = 0; i < downlfiles.length; i++) {
-			if (downlfiles[i].type == undefined) {
+		for (var i = 0; i < download_files.length; i++) {
+			if (download_files[i].type == undefined) {
 				continue;
 			}

-			if (downlfiles[i].type != 'config') {
+			if (download_files[i].type != 'config') {
 				continue
 			}

-			o.value(downlfiles[i].name);
+			o.value(download_files[i].name);
 		}

 		///////////////////////////////////////
 		// second dns server;
 		///////////////////////////////////////
-		// Eanble;
+		// Enable;
 		o = s.taboption("seconddns", form.Flag, "seconddns_enabled", _("Enable"),
 			_("Enable or disable second DNS server."));
 		o.default = o.disabled;
@@ -433,6 +460,23 @@ return view.extend({
 		so.rmempty = true;
 		so.datatype = 'string';

+		///////////////////////////////////////
+		// Proxy server settings;
+		///////////////////////////////////////
+		o = s.taboption("proxy", form.Value, "proxy_server", _("Proxy Server"), _("Proxy Server URL, format: [socks5|http]://user:pass@ip:port."));
+		o.datatype = 'string';
+		o.validate = function (section_id, value) {
+			if (value == "") {
+				return true;
+			}
+
+			if (!value.match(/^(socks5|http):\/\//)) {
+				return _("Proxy server URL format error, format: [socks5|http]://user:pass@ip:port.");
+			}
+
+			return true;
+		}
+
 		///////////////////////////////////////
 		// custom settings;
 		///////////////////////////////////////
@@ -591,7 +635,33 @@ return view.extend({
 		o.rempty = true
 		o.datatype = "uinteger"
 		o.modalonly = true;
-		
+
+		// use proxy
+		o = s.taboption("advanced", form.Flag, "use_proxy", _("Use Proxy"),
+			_("Use proxy to connect to upstream DNS server."))
+		o.default = o.disabled
+		o.modalonly = true;
+		o.optional = true;
+		o.rempty = true;
+		o.validate = function (section_id, value) {
+			var flag = this.formvalue(section_id);
+			if (flag == "0") {
+				return true;
+			}
+
+			var proxy_server = uci.sections("smartdns", "smartdns")[0].proxy_server;
+			var server_type = this.section.formvalue(section_id, "type");
+			if (proxy_server == "" || proxy_server == undefined) {
+				return _("Please set proxy server first.");
+			}
+
+			if (server_type == "udp" && !proxy_server.match(/^(socks5):\/\//)) {
+				return _("Only socks5 proxy support udp server.");
+			}
+
+			return true;
+		}
+
 		// other args
 		o = s.taboption("advanced", form.Value, "addition_arg", _("Additional Server Args"),
 			_("Additional Args for upstream dns servers"))
@@ -786,7 +856,7 @@ return view.extend({
 		so.rempty = true
 		so.root_directory = "/etc/smartdns/domain-set"

-		so = ss.option(form.ListValue, "block_domain_type", _("Block domain type"), _("Block domain type."));
+		so = ss.option(form.ListValue, "block_domain_type", _("Block domain"), _("Block domain."));
 		so.rmempty = true;
 		so.value("none", _("None"));
 		so.value("all", "IPv4/IPv6");
--- a/package/luci/make.sh
+++ b/package/luci/make.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/openwrt/Makefile
+++ b/package/openwrt/Makefile
@@ -47,10 +47,13 @@ define Package/smartdns/conffiles
 /etc/smartdns/address.conf
 /etc/smartdns/blacklist-ip.conf
 /etc/smartdns/custom.conf
+/etc/smartdns/domain-block.list
+/etc/smartdns/domain-forwarding.list
 endef

 define Package/smartdns/install
 	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/config $(1)/etc/init.d $(1)/etc/smartdns
+	$(INSTALL_DIR) $(1)/etc/smartdns/conf.d $(1)/etc/smartdns/domain-set
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/smartdns $(1)/usr/sbin/smartdns
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/package/openwrt/files/etc/init.d/smartdns $(1)/etc/init.d/smartdns
 	$(INSTALL_CONF) $(PKG_BUILD_DIR)/package/openwrt/address.conf $(1)/etc/smartdns/address.conf
--- a/package/openwrt/control/conffiles
+++ b/package/openwrt/control/conffiles
@@ -2,3 +2,5 @@
 /etc/smartdns/address.conf
 /etc/smartdns/blacklist-ip.conf
 /etc/smartdns/custom.conf
+/etc/smartdns/domain-block.list
+/etc/smartdns/domain-forwarding.list
--- a/package/openwrt/control/postinst
+++ b/package/openwrt/control/postinst
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/openwrt/control/prerm
+++ b/package/openwrt/control/prerm
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -17,6 +17,9 @@

 . ${IPKG_INSTROOT}/lib/functions.sh
 default_prerm $0 $@
+/etc/init.d/smartdns disable
 rm /var/etc/smartdns.conf -f
 rm /var/etc/smartdns/smartdns.conf -f
+rm /var/log/smartdns/ -fr
+rm /etc/smartdns/smartdns.cache -f
 exit 0
--- a/package/openwrt/files/etc/init.d/smartdns
+++ b/package/openwrt/files/etc/init.d/smartdns
@@ -1,6 +1,6 @@
 #!/bin/sh /etc/rc.common
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,6 +16,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

 START=19
+STOP=82
 NAME=smartdns
 USE_PROCD=1
 SERVICE_USE_PID=1
@@ -184,6 +185,7 @@ load_server()
 	config_get spki_pin "$section" "spki_pin" ""
 	config_get addition_arg "$section" "addition_arg" ""
 	config_get set_mark "$section" "set_mark" ""
+	config_get_bool use_proxy "$section" "use_proxy" "0"

 	[ "$enabled" = "0" ] && return

@@ -216,6 +218,7 @@ load_server()
 	[ "$check_edns" = "0" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -check-edns"
 	[ -z "$spki_pin" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -spki-pin $spki_pin"
 	[ -z "$set_mark" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -set-mark $set_mark"
+	[ "$use_proxy" = "0" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -proxy default-proxy"

 	if [ -z "$port" ]; then
 		DNS_ADDRESS="$ip"
@@ -236,12 +239,12 @@ restart_crond()
 disable_auto_update()
 {
 	local no_restart="$1"
-	grep "/etc/init.d/smartdns" /etc/crontabs/root 1>/dev/null 2>&1
+	grep "/etc/init.d/smartdns updatefiles" /etc/crontabs/root 1>/dev/null 2>&1
 	if [ $? -ne 0 ]; then
 		return 
 	fi

-	sed -i '\@/etc/init.d/smartdns@d' /etc/crontabs/root
+	sed -i '\@/etc/init.d/smartdns updatefiles@d' /etc/crontabs/root

 	if [ "$no_restart" = "1" ]; then
 		return
@@ -348,11 +351,46 @@ load_domain_rule_list()
 	conf_append "domain-rules" "/domain-set:domain-rule-list-${domain_set_name}/ $domain_set_args"	
 }

+conf_append_bind()
+{
+	local ADDR=""
+	local port="$1"
+	local devices="$2"
+	local tcp_server="$3"
+	local ipv6_server="$4"
+	local ARGS="$5"
+
+	if [ "$ipv6_server" = "1" ]; then
+		ADDR="[::]"
+	else
+		ADDR=""
+	fi
+
+	devices=$(echo "$devices" | sed 's/,/ /g')
+	[ ! -z "$devices" ] && devices="$devices lo"
+	[ -z "$devices" ] && devices="-"
+
+	for device in $devices; do
+		device="@$device"
+		[ "$device" = "@-" ] && device=""
+		conf_append "bind" "$ADDR:$port$device $ARGS"
+	done
+
+	[ "$tcp_server" = "1" ] && {
+		for device in $devices; do
+			device="@$device"
+			[ "$device" = "@-" ] && device=""
+			conf_append "bind-tcp" "$ADDR:$port$device $ARGS"
+		done
+	}
+}
+
 load_second_server()
 {
 	local section="$1"
 	local ARGS=""
 	local ADDR=""
+	local device=""

 	config_get_bool seconddns_enabled "$section" "seconddns_enabled" "0"
 	[ "$seconddns_enabled" = "0" ] && return
@@ -386,16 +424,14 @@ load_second_server()
 	config_get_bool seconddns_force_aaaa_soa "$section" "seconddns_force_aaaa_soa" "0"
 	[ "$seconddns_force_aaaa_soa" = "1" ] && ARGS="$ARGS -force-aaaa-soa"

-	config_get ipv6_server "$section" "ipv6_server" "1"
-	if [ "$ipv6_server" = "1" ]; then
-		ADDR="[::]"
-	else
-		ADDR=""
-	fi
+	config_get_bool bind_device "$section" "bind_device" "0"
+	config_get bind_device_name "$section" "bind_device_name" "${lan_device}"
+	[ ! -z "$bind_device_name" ] && [ "$bind_device" = "1" ] && device="${bind_device_name}"

-	conf_append "bind" "$ADDR:$seconddns_port $ARGS"
 	config_get_bool "seconddns_tcp_server" "$section" "seconddns_tcp_server" "1"
-	[ "$seconddns_tcp_server" = "1" ] && conf_append "bind-tcp" "$ADDR:$seconddns_port $ARGS"
+	config_get ipv6_server "$section" "ipv6_server" "1"
+
+	conf_append_bind "$seconddns_port" "$device" "$seconddns_tcp_server" "$ipv6_server" "$ARGS"
 }

 conf_append_conf_files()
@@ -417,9 +453,12 @@ load_service()
 {
 	local section="$1"
 	args=""
+	local device=""
 	dnsmasq_lease_file="$(uci -q get dhcp.@dnsmasq[0].leasefile)"
 	dnsmasq_port="$(uci -q get dhcp.@dnsmasq[0].port)"
 	resolve_file="$(uci -q get dhcp.@dnsmasq[0].resolvfile)"
+	lan_device="$(uci -q get network.lan.device)"
+
 	[ -z "$dnsmasq_lease_file" ] && dnsmasq_lease_file="/tmp/dhcp.leases"
 	[ -z "$dnsmasq_port" ] && dnsmasq_port="53"
 	[ -z "$resolve_file" ] && resolve_file="/tmp/resolv.conf.d/resolv.conf.auto"
@@ -491,8 +530,31 @@ load_service()
 	config_get log_file "$section" "log_file" ""
 	[ -z "$log_file" ] || conf_append "log-file" "$log_file"

+	config_get response_mode "$section" "response_mode" ""
+	[ -z "$response_mode" ] || conf_append "response-mode" "$response_mode"
+
 	config_get_bool enable_auto_update "$section" "enable_auto_update" "0"
 	[ "$enable_auto_update" = "1" ] && enable_auto_update || disable_auto_update
+
+	config_get_bool bind_device "$section" "bind_device" "0"
+	config_get bind_device_name "$section" "bind_device_name" "${lan_device}"
+	[ ! -z "$bind_device_name" ] && [ "$bind_device" = "1" ] && device="${bind_device_name}"
+
+	config_get cache_file "$section" "cache_file" "$SMARTDNS_CONF_DIR/smartdns.cache"
+
+	config_get_bool cache_persist "$section" "cache_persist" "0"
+	[ "$cache_persist" = "1" ] && {
+		conf_append "cache-persist" "yes"
+		conf_append "cache-file" "$cache_file"
+	}
+
+	[ "$cache_persist" = "0" ] && {
+		conf_append "cache-persist" "no"
+		[ -f "$cache_file" ] && rm -f "$cache_file"
+	}
+
+	config_get proxy_server "$section" "proxy_server" ""
+	[ -z "$proxy_server" ] || conf_append "proxy-server" "$proxy_server -name default-proxy"
 	
 	config_get redirect "$section" "redirect" ""
 	config_get old_port "$section" "old_port" "0"
@@ -560,21 +622,9 @@ load_service()
 		[ "$auto_set_dnsmasq" = "0" ] && [ "$old_auto_set_dnsmasq" = "1" ] && stop_forward_dnsmasq "$old_port" "0"
 	}

-	if [ "$ipv6_server" = "1" ]; then
-		conf_append "bind" "[::]:$port"
-	else
-		conf_append "bind" ":$port"
-	fi
+	conf_append_bind "$port" "$device" "$tcp_server" "$ipv6_server" "$ARGS"

-	[ "$tcp_server" = "1" ] && {
-		if [ "$ipv6_server" = "1" ]; then
-			conf_append "bind-tcp" "[::]:$port"
-		else
-			conf_append "bind-tcp" ":$port"
-		fi
-	}
-
-	load_second_server $section
+	load_second_server "$section"

 	config_foreach load_server "server"

@@ -655,6 +705,33 @@ download_file() {
 	fi
 }

+check_and_add_entry() {
+	local docommit=0
+	uci -q get smartdns.@smartdns[0] >/dev/null
+	if [ $? -ne 0 ]; then
+		uci -q add smartdns smartdns >/dev/null
+		docommit=1
+	fi
+	
+	uci -q get smartdns.@domain-rule[0] >/dev/null
+	if [ $? -ne 0 ]; then
+		uci -q add smartdns domain-rule >/dev/null
+		docommit=1
+	fi
+
+	if [ "$docommit" = "1" ]; then
+		uci -q commit smartdns >/dev/null
+	fi
+
+	if [ ! -d "$SMARTDNS_DOMAIN_LIST_DOWNLOAD_DIR" ]; then
+		mkdir -p "$SMARTDNS_DOMAIN_LIST_DOWNLOAD_DIR"
+	fi
+
+	if [ ! -d "$SMARTDNS_CONF_DOWNLOAD_DIR" ]; then
+		mkdir -p "$SMARTDNS_CONF_DOWNLOAD_DIR"
+	fi
+}
+
 updatefiles() {
 	config_load "smartdns"
 	config_foreach download_file "download-file"
@@ -669,6 +746,7 @@ service_stopped()

 start_service()
 {
+	check_and_add_entry
 	config_load "smartdns"
 	config_foreach load_service "smartdns"
 }
--- a/package/openwrt/make.sh
+++ b/package/openwrt/make.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/optware/S50smartdns
+++ b/package/optware/S50smartdns
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -29,7 +29,7 @@ SMARTDNS_OPT=/opt/etc/smartdns/smartdns-opt.conf
 SMARTDNS_WORKMODE="1"

 if [ -f "$SMARTDNS_OPT" ]; then
-. $SMARTDNS_OPT
+. "$SMARTDNS_OPT"
 fi


@@ -37,7 +37,7 @@ set_iptable()
 {
 	local redirect_tcp

-	redirect_tcp=0;
+	redirect_tcp=0

 	grep ^bind-tcp $SMARTDNS_CONF > /dev/null 2>&1
 	if [ $? -eq 0 ]; then
@@ -155,7 +155,7 @@ add_dhcp_options6()
 		SERVER_TAG="$(echo "$DHCP_OPTION" | awk -F= '{print $2}' | awk -F, '{print $1}')"
 		LOCAL_SERVER_IP="$IP"

-		grep "dhcp-option *= *$SERVER_TAG, *6 *, *$LOCAL_SERVER_IP" $CONF_FILE 1>/dev/null 2>&1
+		grep "dhcp-option *= *$SERVER_TAG, *6 *, *$LOCAL_SERVER_IP" "$CONF_FILE" 1>/dev/null 2>&1
 		if [ $? -eq 0 ]; then
 			continue
 		fi
@@ -182,7 +182,7 @@ clear_dhcp_options6()
 		SERVER_TAG="$(echo "$DHCP_OPTION" | awk -F= '{print $2}' | awk -F, '{print $1}')"
 		LOCAL_SERVER_IP="$IP"

-		grep "dhcp-option *= *$SERVER_TAG, *6 *, *$LOCAL_SERVER_IP" $CONF_FILE 1>/dev/null 2>&1
+		grep "dhcp-option *= *$SERVER_TAG, *6 *, *$LOCAL_SERVER_IP" "$CONF_FILE" 1>/dev/null 2>&1
 		if [ $? -ne 0 ]; then
 			continue
 		fi
@@ -201,7 +201,7 @@ set_dnsmasq_conf()
 	local CONF_FILE=$1
 	local DHCP_OPTIONS=""

-	add_dhcp_options6 $CONF_FILE
+	add_dhcp_options6 "$CONF_FILE"

 	grep "^port *=0" "$CONF_FILE" > /dev/null 2>&1
 	if [ $? -ne 0 ]; then
@@ -340,7 +340,7 @@ case "$1" in

 	set_smartdns_port
 	get_tz
-	$SMARTDNS_BIN -c $SMARTDNS_CONF -p $SMARTDNS_PID
+	$SMARTDNS_BIN -c "$SMARTDNS_CONF" -p $SMARTDNS_PID
 	if [ $? -ne 0 ]; then
 		clear_rule
 	fi
@@ -368,7 +368,7 @@ case "$1" in
 	fi

 	kill -15 "$pid" 2>/dev/null
-	SLEEP=`which usleep`
+	SLEEP=$(which usleep 2>/dev/null)
 	SLEEPTIME=200000
 	if [ -z "$SLEEP" ]; then
 		SLEEP="sleep"
--- a/package/optware/control/postinst
+++ b/package/optware/control/postinst
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/optware/control/prerm
+++ b/package/optware/control/prerm
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/optware/make.sh
+++ b/package/optware/make.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/windows/install.bat
+++ b/package/windows/install.bat
@@ -12,7 +12,7 @@ IF NOT %ERRORLEVEL% == 0 (

 copy %CURR_PATH%\wsl-run.vbs "%STARTUP_PATH%/"
 IF NOT %ERRORLEVEL% == 0 (
-  echo Install startupt script failed.
+  echo Install startup script failed.
  pause
  exit 1
 )
--- a/src/Makefile
+++ b/src/Makefile
@@ -1,5 +1,5 @@

-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,7 +16,7 @@

 BIN=smartdns 
 OBJS_LIB=lib/rbtree.o lib/art.o lib/bitops.o lib/radix.o lib/conf.o lib/nftset.o
-OBJS=smartdns.o fast_ping.o dns_client.o dns_server.o dns.o util.o tlog.o dns_conf.o dns_cache.o http_parse.o $(OBJS_LIB)
+OBJS=smartdns.o fast_ping.o dns_client.o dns_server.o dns.o util.o tlog.o dns_conf.o dns_cache.o http_parse.o proxy.o $(OBJS_LIB)

 # cflags
 ifndef CFLAGS
@@ -24,6 +24,7 @@ CFLAGS =-O2 -g -Wall -Wstrict-prototypes -fno-omit-frame-pointer -Wstrict-aliasi
 endif
 override CFLAGS +=-Iinclude
 override CFLAGS += -DBASE_FILE_NAME='"$(notdir $<)"'
+override CFLAGS += $(EXTRA_CFLAGS)
 ifdef VER
 override CFLAGS += -DSMARTDNS_VERION='"$(VER)"'
 endif
--- a/src/dns.c
+++ b/src/dns.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -889,7 +889,7 @@ int dns_add_SOA(struct dns_packet *packet, dns_rr_type type, const char *domain,
 	/*| mname        |
 	 *| rname        |
 	 *| serial       |
-	 *| refersh      |
+	 *| refresh      |
 	 *| retry        |
 	 *| expire       |
 	 *| minimum      |
@@ -926,7 +926,7 @@ int dns_get_SOA(struct dns_rrs *rrs, char *domain, int maxsize, int *ttl, struct
 	/*| mname        |
 	 *| rname        |
 	 *| serial       |
-	 *| refersh      |
+	 *| refresh      |
 	 *| retry        |
 	 *| expire       |
 	 *| minimum      |
@@ -1017,7 +1017,7 @@ int dns_get_OPT_ECS(struct dns_rrs *rrs, unsigned short *opt_code, unsigned shor
 	return 0;
 }

-int dns_add_OPT_TCP_KEEYALIVE(struct dns_packet *packet, unsigned short timeout)
+int dns_add_OPT_TCP_KEEPALIVE(struct dns_packet *packet, unsigned short timeout)
 {
 	unsigned short timeout_net = htons(timeout);
 	int data_len = 0;
@@ -1029,7 +1029,7 @@ int dns_add_OPT_TCP_KEEYALIVE(struct dns_packet *packet, unsigned short timeout)
 	return _dns_add_opt_RAW(packet, DNS_OPT_T_TCP_KEEPALIVE, &timeout_net, data_len);
 }

-int dns_get_OPT_TCP_KEEYALIVE(struct dns_rrs *rrs, unsigned short *opt_code, unsigned short *opt_len,
+int dns_get_OPT_TCP_KEEPALIVE(struct dns_rrs *rrs, unsigned short *opt_code, unsigned short *opt_len,
 							  unsigned short *timeout)
 {
 	unsigned char opt_data[DNS_MAX_OPT_LEN];
@@ -1528,7 +1528,7 @@ static int _dns_encode_CNAME(struct dns_context *context, struct dns_rrs *rrs)
 		return -1;
 	}

-	/* when code domain, len must plus 1, because of length at the begining */
+	/* when code domain, len must plus 1, because of length at the beginning */
 	rr_len = 1;
 	ret = _dns_encode_rr_head(context, domain, qtype, qclass, ttl, rr_len, &rr_len_ptr);
 	if (ret < 0) {
@@ -1815,7 +1815,7 @@ static int _dns_decode_opt(struct dns_context *context, dns_rr_type type, unsign
 {
 	unsigned short opt_code = 0;
 	unsigned short opt_len = 0;
-	unsigned short ercode = (ttl >> 16) & 0xFFFF;
+	unsigned short errcode = (ttl >> 16) & 0xFFFF;
 	unsigned short ever = (ttl)&0xFFFF;
 	unsigned char *start = context->ptr;
 	struct dns_packet *packet = context->packet;
@@ -1858,7 +1858,7 @@ static int _dns_decode_opt(struct dns_context *context, dns_rr_type type, unsign
 		return -1;
 	}

-	if (ercode != 0) {
+	if (errcode != 0) {
 		tlog(TLOG_ERROR, "extend rcode invalid.");
 		return -1;
 	}
--- a/src/dns.h
+++ b/src/dns.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -81,7 +81,7 @@ typedef enum dns_opt_code {
 } dns_opt_code_t;

 /* https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-https/11/ */
-typedef enum dns_htts_svcparam {
+typedef enum dns_https_svcparam {
 	DNS_HTTPS_T_MANDATORY = 0,
 	DNS_HTTPS_T_ALPN = 1,
 	DNS_HTTPS_T_NO_DEFAULT_ALPN = 2,
@@ -90,7 +90,7 @@ typedef enum dns_htts_svcparam {
 	DNS_HTTPS_T_ECH = 5,
 	DNS_HTTPS_T_IPV6HINT = 6,
 	DNS_HTTPS_T_ALL = 255
-} dns_htts_svcparam_t;
+} dns_https_svcparam_t;

 typedef enum dns_opcode {
 	DNS_OP_QUERY = 0,
@@ -129,7 +129,7 @@ struct dns_head {
 	unsigned short qdcount; /* number of question entries */
 	unsigned short ancount; /* number of answer entries */
 	unsigned short nscount; /* number of authority entries */
-	unsigned short nrcount; /* number of addititional resource entries */
+	unsigned short nrcount; /* number of additional resource entries */
 } __attribute__((packed, aligned(2)));

 #define DNS_PACKET_DICT_SIZE 16
@@ -143,7 +143,7 @@ struct dns_packet_dict {
 	struct dns_packet_dict_item names[DNS_PACKET_DICT_SIZE];
 };

-/* packet haed */
+/* packet head */
 struct dns_packet {
 	struct dns_head head;
 	unsigned short questions;
@@ -272,8 +272,8 @@ int dns_get_OPT_payload_size(struct dns_packet *packet);
 int dns_add_OPT_ECS(struct dns_packet *packet, struct dns_opt_ecs *ecs);
 int dns_get_OPT_ECS(struct dns_rrs *rrs, unsigned short *opt_code, unsigned short *opt_len, struct dns_opt_ecs *ecs);

-int dns_add_OPT_TCP_KEEYALIVE(struct dns_packet *packet, unsigned short timeout);
-int dns_get_OPT_TCP_KEEYALIVE(struct dns_rrs *rrs, unsigned short *opt_code, unsigned short *opt_len,
+int dns_add_OPT_TCP_KEEPALIVE(struct dns_packet *packet, unsigned short timeout);
+int dns_get_OPT_TCP_KEEPALIVE(struct dns_rrs *rrs, unsigned short *opt_code, unsigned short *opt_len,
 							  unsigned short *timeout);

 int dns_add_HTTPS_start(struct dns_rr_nested *svcparam_buffer, struct dns_packet *packet,
--- a/src/dns_cache.c
+++ b/src/dns_cache.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/dns_cache.h
+++ b/src/dns_cache.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/dns_client.c
+++ b/src/dns_client.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -26,6 +26,7 @@
 #include "hashtable.h"
 #include "http_parse.h"
 #include "list.h"
+#include "proxy.h"
 #include "tlog.h"
 #include "util.h"
 #include <arpa/inet.h>
@@ -46,6 +47,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/epoll.h>
+#include <sys/random.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -91,6 +93,7 @@ struct dns_server_info {

 	char ip[DNS_HOSTNAME_LEN];
 	int port;
+	char proxy_name[DNS_HOSTNAME_LEN];
 	/* server type */
 	dns_server_type_t type;
 	long long so_mark;
@@ -103,6 +106,9 @@ struct dns_server_info {
 	int ssl_write_len;
 	SSL_CTX *ssl_ctx;
 	SSL_SESSION *ssl_session;
+
+	struct proxy_conn *proxy;
+
 	pthread_mutex_t lock;
 	char skip_check_cert;
 	dns_server_status status;
@@ -194,7 +200,7 @@ struct dns_client {
 	struct dns_client_ecs ecs_ipv4;
 	struct dns_client_ecs ecs_ipv6;

-	/* query doman hash table, key: sid + domain */
+	/* query domain hash table, key: sid + domain */
 	pthread_mutex_t domain_map_lock;
 	DECLARE_HASHTABLE(domain_map, 6);
 	DECLARE_HASHTABLE(group, 4);
@@ -249,11 +255,12 @@ struct dns_query_struct {
 };

 static struct dns_client client;
-static atomic_t dns_client_sid = ATOMIC_INIT(0);
 static LIST_HEAD(pending_servers);
 static pthread_mutex_t pending_server_mutex = PTHREAD_MUTEX_INITIALIZER;
 static int dns_client_has_bootstrap_dns = 0;

+static int _dns_client_send_udp(struct dns_server_info *server_info, void *packet, int len);
+
 static ssize_t _ssl_read(struct dns_server_info *server, void *buff, int num)
 {
 	ssize_t ret = 0;
@@ -625,7 +632,7 @@ errout:

 /* add server to group */
 static int _dns_client_add_to_group_pending(const char *group_name, char *server_ip, int port,
-											dns_server_type_t server_type, int ispending)
+											dns_server_type_t server_type, int is_pending)
 {
 	struct dns_server_info *server_info = NULL;

@@ -635,7 +642,7 @@ static int _dns_client_add_to_group_pending(const char *group_name, char *server

 	server_info = _dns_client_get_server(server_ip, port, server_type);
 	if (server_info == NULL) {
-		if (ispending == 0) {
+		if (is_pending == 0) {
 			tlog(TLOG_ERROR, "add server %s:%d to group %s failed", server_ip, port, group_name);
 			return -1;
 		}
@@ -1047,6 +1054,7 @@ static int _dns_client_server_add(char *server_ip, char *server_host, int port,
 	server_info->skip_check_cert = skip_check_cert;
 	server_info->prohibit = 0;
 	server_info->so_mark = flags->set_mark;
+	safe_strncpy(server_info->proxy_name, flags->proxyname, sizeof(server_info->proxy_name));
 	pthread_mutex_init(&server_info->lock, NULL);
 	memcpy(&server_info->flags, flags, sizeof(server_info->flags));

@@ -1141,7 +1149,13 @@ static void _dns_client_close_socket(struct dns_server_info *server_info)

 	/* remove fd from epoll */
 	epoll_ctl(client.epoll_fd, EPOLL_CTL_DEL, server_info->fd, NULL);
-	close(server_info->fd);
+
+	if (server_info->proxy) {
+		proxy_conn_free(server_info->proxy);
+		server_info->proxy = NULL;
+	} else {
+		close(server_info->fd);
+	}

 	server_info->fd = -1;
 	server_info->status = DNS_SERVER_STATUS_DISCONNECTED;
@@ -1331,7 +1345,7 @@ errout:
 }

 static int _dns_client_add_server_pending(char *server_ip, char *server_host, int port, dns_server_type_t server_type,
-										  struct client_dns_server_flags *flags, int ispending)
+										  struct client_dns_server_flags *flags, int is_pending)
 {
 	int ret = 0;

@@ -1340,7 +1354,7 @@ static int _dns_client_add_server_pending(char *server_ip, char *server_host, in
 		return -1;
 	}

-	if (check_is_ipaddr(server_ip) && ispending) {
+	if (check_is_ipaddr(server_ip) && is_pending) {
 		ret = _dns_client_server_pending(server_ip, port, server_type, flags);
 		if (ret == 0) {
 			tlog(TLOG_INFO, "add pending server %s", server_ip);
@@ -1400,7 +1414,7 @@ static void _dns_client_query_release(struct dns_query_struct *query)

 	/* notify caller query end */
 	if (query->callback) {
-		tlog(TLOG_DEBUG, "result: %s, qtype: %d, hasresult: %d, id %d", query->domain, query->qtype, query->has_result,
+		tlog(TLOG_DEBUG, "result: %s, qtype: %d, has-result: %d, id %d", query->domain, query->qtype, query->has_result,
 			 query->sid);
 		query->callback(query->domain, DNS_QUERY_END, NULL, NULL, NULL, 0, query->user_ptr);
 	}
@@ -1511,7 +1525,7 @@ static void _dns_client_check_tcp(void)
 	pthread_mutex_unlock(&client.server_list_lock);
 }

-static struct dns_query_struct *_dns_client_get_request(unsigned short sid, char *domain)
+static struct dns_query_struct *_dns_client_get_request(char *domain, int qtype, unsigned short sid)
 {
 	struct dns_query_struct *query = NULL;
 	struct dns_query_struct *query_result = NULL;
@@ -1521,6 +1535,7 @@ static struct dns_query_struct *_dns_client_get_request(unsigned short sid, char
 	/* get query by hash key : id + domain */
 	key = hash_string(domain);
 	key = jhash(&sid, sizeof(sid), key);
+	key = jhash(&qtype, sizeof(qtype), key);
 	pthread_mutex_lock(&client.domain_map_lock);
 	hash_for_each_possible_safe(client.domain_map, query, tmp, domain_node, key)
 	{
@@ -1528,6 +1543,10 @@ static struct dns_query_struct *_dns_client_get_request(unsigned short sid, char
 			continue;
 		}

+		if (qtype != query->qtype) {
+			continue;
+		}
+
 		if (strncmp(query->domain, domain, DNS_MAX_CNAME_LEN) != 0) {
 			continue;
 		}
@@ -1597,7 +1616,7 @@ static int _dns_client_recv(struct dns_server_info *server_info, unsigned char *
 	if (len != 0) {
 		char host_name[DNS_MAX_CNAME_LEN];
 		tlog(TLOG_INFO, "decode failed, packet len = %d, tc = %d, id = %d, from = %s\n", inpacket_len, packet->head.tc,
-			 packet->head.id, gethost_by_addr(host_name, sizeof(host_name), from));
+			 packet->head.id, get_host_by_addr(host_name, sizeof(host_name), from));
 		if (dns_save_fail_packet) {
 			dns_packet_save(dns_save_fail_packet_dir, "client", host_name, inpacket, inpacket_len);
 		}
@@ -1629,7 +1648,7 @@ static int _dns_client_recv(struct dns_server_info *server_info, unsigned char *
 	}

 	/* get query reference */
-	query = _dns_client_get_request(packet->head.id, domain);
+	query = _dns_client_get_request(domain, qtype, packet->head.id);
 	if (query == NULL) {
 		return 0;
 	}
@@ -1670,6 +1689,69 @@ static int _dns_client_recv(struct dns_server_info *server_info, unsigned char *
 	return 0;
 }

+static int _dns_client_create_socket_udp_proxy(struct dns_server_info *server_info)
+{
+	struct proxy_conn *proxy = NULL;
+	int fd = -1;
+	struct epoll_event event;
+	int ret = -1;
+
+	proxy = proxy_conn_new(server_info->proxy_name, server_info->ip, server_info->port, 1);
+	if (proxy == NULL) {
+		tlog(TLOG_ERROR, "create proxy failed, %s, proxy: %s", server_info->ip, server_info->proxy_name);
+		goto errout;
+	}
+
+	fd = proxy_conn_get_fd(proxy);
+	if (fd < 0) {
+		tlog(TLOG_ERROR, "get proxy fd failed, %s", server_info->ip);
+		goto errout;
+	}
+
+	if (server_info->so_mark >= 0) {
+		unsigned int so_mark = server_info->so_mark;
+		if (setsockopt(fd, SOL_SOCKET, SO_MARK, &so_mark, sizeof(so_mark)) != 0) {
+			tlog(TLOG_DEBUG, "set socket mark failed, %s", strerror(errno));
+		}
+	}
+
+	set_fd_nonblock(fd, 1);
+	set_sock_keepalive(fd, 15, 3, 4);
+
+	ret = proxy_conn_connect(proxy);
+	if (ret != 0) {
+		if (errno == ENETUNREACH || errno == EHOSTUNREACH || errno == EPERM || errno == EACCES) {
+			tlog(TLOG_DEBUG, "connect %s failed, %s", server_info->ip, strerror(errno));
+			goto errout;
+		}
+
+		if (errno != EINPROGRESS) {
+			tlog(TLOG_ERROR, "connect %s failed, %s", server_info->ip, strerror(errno));
+			goto errout;
+		}
+	}
+
+	server_info->fd = fd;
+	server_info->status = DNS_SERVER_STATUS_CONNECTING;
+	server_info->proxy = proxy;
+
+	memset(&event, 0, sizeof(event));
+	event.events = EPOLLIN | EPOLLOUT;
+	event.data.ptr = server_info;
+	if (epoll_ctl(client.epoll_fd, EPOLL_CTL_ADD, fd, &event) != 0) {
+		tlog(TLOG_ERROR, "epoll ctl failed, %s", strerror(errno));
+		return -1;
+	}
+
+	return 0;
+errout:
+	if (proxy) {
+		proxy_conn_free(proxy);
+	}
+
+	return -1;
+}
+
 static int _dns_client_create_socket_udp(struct dns_server_info *server_info)
 {
 	int fd = 0;
@@ -1679,15 +1761,36 @@ static int _dns_client_create_socket_udp(struct dns_server_info *server_info)
 	const int priority = SOCKET_PRIORITY;
 	const int ip_tos = SOCKET_IP_TOS;

+	if (server_info->proxy_name[0] != '\0') {
+		return _dns_client_create_socket_udp_proxy(server_info);
+	}
+
 	fd = socket(server_info->ai_family, SOCK_DGRAM, 0);
 	if (fd < 0) {
 		tlog(TLOG_ERROR, "create socket failed, %s", strerror(errno));
 		goto errout;
 	}

+	if (set_fd_nonblock(fd, 1) != 0) {
+		tlog(TLOG_ERROR, "set socket non block failed, %s", strerror(errno));
+		goto errout;
+	}
+
 	server_info->fd = fd;
 	server_info->status = DNS_SERVER_STATUS_CONNECTIONLESS;

+	if (connect(fd, &server_info->addr, server_info->ai_addrlen) != 0) {
+		if (errno == ENETUNREACH || errno == EHOSTUNREACH || errno == ECONNREFUSED) {
+			tlog(TLOG_WARN, "connect %s failed, %s", server_info->ip, strerror(errno));
+			goto errout;
+		}
+
+		if (errno != EINPROGRESS) {
+			tlog(TLOG_ERROR, "connect %s failed, %s", server_info->ip, strerror(errno));
+			goto errout;
+		}
+	}
+
 	memset(&event, 0, sizeof(event));
 	event.events = EPOLLIN;
 	event.data.ptr = server_info;
@@ -1708,7 +1811,7 @@ static int _dns_client_create_socket_udp(struct dns_server_info *server_info)
 	setsockopt(server_info->fd, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority));
 	setsockopt(server_info->fd, IPPROTO_IP, IP_TOS, &ip_tos, sizeof(ip_tos));
 	if (server_info->ai_family == AF_INET6) {
-		/* for recving ip ttl value */
+		/* for receiving ip ttl value */
 		setsockopt(server_info->fd, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &on, sizeof(on));
 		setsockopt(server_info->fd, IPPROTO_IPV6, IPV6_2292HOPLIMIT, &on, sizeof(on));
 		setsockopt(server_info->fd, IPPROTO_IPV6, IPV6_HOPLIMIT, &on, sizeof(on));
@@ -1733,8 +1836,20 @@ static int _DNS_client_create_socket_tcp(struct dns_server_info *server_info)
 	int yes = 1;
 	const int priority = SOCKET_PRIORITY;
 	const int ip_tos = SOCKET_IP_TOS;
+	struct proxy_conn *proxy = NULL;
+	int ret = 0;
+
+	if (server_info->proxy_name[0] != '\0') {
+		proxy = proxy_conn_new(server_info->proxy_name, server_info->ip, server_info->port, 0);
+		if (proxy == NULL) {
+			tlog(TLOG_ERROR, "create proxy failed, %s, proxy: %s", server_info->ip, server_info->proxy_name);
+			goto errout;
+		}
+		fd = proxy_conn_get_fd(proxy);
+	} else {
+		fd = socket(server_info->ai_family, SOCK_STREAM, 0);
+	}

-	fd = socket(server_info->ai_family, SOCK_STREAM, 0);
 	if (fd < 0) {
 		tlog(TLOG_ERROR, "create socket failed, %s", strerror(errno));
 		goto errout;
@@ -1764,8 +1879,14 @@ static int _DNS_client_create_socket_tcp(struct dns_server_info *server_info)
 	setsockopt(fd, IPPROTO_TCP, TCP_THIN_LINEAR_TIMEOUTS, &yes, sizeof(yes));
 	set_sock_keepalive(fd, 15, 3, 4);

-	if (connect(fd, &server_info->addr, server_info->ai_addrlen) != 0) {
-		if (errno == ENETUNREACH) {
+	if (proxy) {
+		ret = proxy_conn_connect(proxy);
+	} else {
+		ret = connect(fd, &server_info->addr, server_info->ai_addrlen);
+	}
+
+	if (ret != 0) {
+		if (errno == ENETUNREACH || errno == EHOSTUNREACH || errno == ECONNREFUSED) {
 			tlog(TLOG_DEBUG, "connect %s failed, %s", server_info->ip, strerror(errno));
 			goto errout;
 		}
@@ -1778,6 +1899,7 @@ static int _DNS_client_create_socket_tcp(struct dns_server_info *server_info)

 	server_info->fd = fd;
 	server_info->status = DNS_SERVER_STATUS_CONNECTING;
+	server_info->proxy = proxy;

 	memset(&event, 0, sizeof(event));
 	event.events = EPOLLIN | EPOLLOUT;
@@ -1797,9 +1919,14 @@ errout:

 	server_info->status = DNS_SERVER_STATUS_INIT;

-	if (fd > 0) {
+	if (fd > 0 && proxy == NULL) {
 		close(fd);
 	}
+
+	if (proxy) {
+		proxy_conn_free(proxy);
+	}
+
 	return -1;
 }

@@ -1808,22 +1935,35 @@ static int _DNS_client_create_socket_tls(struct dns_server_info *server_info, ch
 	int fd = 0;
 	struct epoll_event event;
 	SSL *ssl = NULL;
+	struct proxy_conn *proxy = NULL;
+
 	int yes = 1;
 	const int priority = SOCKET_PRIORITY;
 	const int ip_tos = SOCKET_IP_TOS;
+	int ret = -1;

 	if (server_info->ssl_ctx == NULL) {
 		tlog(TLOG_ERROR, "create ssl ctx failed, %s", server_info->ip);
 		goto errout;
 	}

+	if (server_info->proxy_name[0] != '\0') {
+		proxy = proxy_conn_new(server_info->proxy_name, server_info->ip, server_info->port, 0);
+		if (proxy == NULL) {
+			tlog(TLOG_ERROR, "create proxy failed, %s, proxy: %s", server_info->ip, server_info->proxy_name);
+			goto errout;
+		}
+		fd = proxy_conn_get_fd(proxy);
+	} else {
+		fd = socket(server_info->ai_family, SOCK_STREAM, 0);
+	}
+
 	ssl = SSL_new(server_info->ssl_ctx);
 	if (ssl == NULL) {
 		tlog(TLOG_ERROR, "new ssl failed, %s", server_info->ip);
 		goto errout;
 	}

-	fd = socket(server_info->ai_family, SOCK_STREAM, 0);
 	if (fd < 0) {
 		tlog(TLOG_ERROR, "create socket failed, %s", strerror(errno));
 		goto errout;
@@ -1853,8 +1993,14 @@ static int _DNS_client_create_socket_tls(struct dns_server_info *server_info, ch
 	setsockopt(fd, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority));
 	setsockopt(fd, IPPROTO_IP, IP_TOS, &ip_tos, sizeof(ip_tos));

-	if (connect(fd, &server_info->addr, server_info->ai_addrlen) != 0) {
-		if (errno == ENETUNREACH) {
+	if (proxy) {
+		ret = proxy_conn_connect(proxy);
+	} else {
+		ret = connect(fd, &server_info->addr, server_info->ai_addrlen);
+	}
+
+	if (ret != 0) {
+		if (errno == ENETUNREACH || errno == EHOSTUNREACH || errno == ECONNREFUSED) {
 			tlog(TLOG_DEBUG, "connect %s failed, %s", server_info->ip, strerror(errno));
 			goto errout;
 		}
@@ -1885,6 +2031,7 @@ static int _DNS_client_create_socket_tls(struct dns_server_info *server_info, ch
 	server_info->ssl = ssl;
 	server_info->ssl_write_len = -1;
 	server_info->status = DNS_SERVER_STATUS_CONNECTING;
+	server_info->proxy = proxy;

 	memset(&event, 0, sizeof(event));
 	event.events = EPOLLIN | EPOLLOUT;
@@ -1908,7 +2055,7 @@ errout:

 	server_info->status = DNS_SERVER_STATUS_INIT;

-	if (fd > 0) {
+	if (fd > 0 && proxy == NULL) {
 		close(fd);
 	}

@@ -1916,6 +2063,10 @@ errout:
 		SSL_free(ssl);
 	}

+	if (proxy) {
+		proxy_conn_free(proxy);
+	}
+
 	return -1;
 }

@@ -1947,6 +2098,103 @@ static int _dns_client_create_socket(struct dns_server_info *server_info)
 	return 0;
 }

+static int _dns_client_process_send_udp_buffer(struct dns_server_info *server_info, struct epoll_event *event,
+											   unsigned long now)
+{
+	int send_len = 0;
+	if (server_info->send_buff.len <= 0 || server_info->status != DNS_SERVER_STATUS_CONNECTED) {
+		return 0;
+	}
+
+	while (server_info->send_buff.len - send_len > 0) {
+		int ret = 0;
+		int packet_len = 0;
+		packet_len = *(int *)(server_info->send_buff.data + send_len);
+		send_len += sizeof(packet_len);
+		if (packet_len > server_info->send_buff.len - 1) {
+			goto errout;
+		}
+
+		ret = _dns_client_send_udp(server_info, server_info->send_buff.data + send_len, packet_len);
+		if (ret < 0) {
+			tlog(TLOG_ERROR, "sendto failed, %s", strerror(errno));
+			goto errout;
+		}
+		send_len += packet_len;
+	}
+
+	server_info->send_buff.len -= send_len;
+	if (server_info->send_buff.len < 0) {
+		server_info->send_buff.len = 0;
+	}
+
+	return 0;
+
+errout:
+	pthread_mutex_lock(&client.server_list_lock);
+	server_info->recv_buff.len = 0;
+	server_info->send_buff.len = 0;
+	_dns_client_close_socket(server_info);
+	pthread_mutex_unlock(&client.server_list_lock);
+	return -1;
+}
+
+static int _dns_client_process_udp_proxy(struct dns_server_info *server_info, struct epoll_event *event,
+										 unsigned long now)
+{
+	struct sockaddr_storage from;
+	socklen_t from_len = sizeof(from);
+	char from_host[DNS_MAX_CNAME_LEN];
+	unsigned char inpacket[DNS_IN_PACKSIZE];
+	int len = 0;
+	int ret = 0;
+
+	_dns_client_process_send_udp_buffer(server_info, event, now);
+
+	if (!(event->events & EPOLLIN)) {
+		return 0;
+	}
+
+	len = proxy_conn_recvfrom(server_info->proxy, inpacket, sizeof(inpacket), 0, (struct sockaddr *)&from, &from_len);
+	if (len < 0) {
+		tlog(TLOG_ERROR, "recvfrom failed, %s\n", strerror(errno));
+		goto errout;
+	} else if (len == 0) {
+		pthread_mutex_lock(&client.server_list_lock);
+		_dns_client_close_socket(server_info);
+		server_info->recv_buff.len = 0;
+		if (server_info->send_buff.len > 0) {
+			/* still remain request data, reconnect and send*/
+			ret = _dns_client_create_socket(server_info);
+		} else {
+			ret = 0;
+		}
+		pthread_mutex_unlock(&client.server_list_lock);
+		tlog(TLOG_DEBUG, "peer close, %s", server_info->ip);
+		return ret;
+	}
+
+	tlog(TLOG_DEBUG, "recv udp packet from %s, len: %d",
+		 get_host_by_addr(from_host, sizeof(from_host), (struct sockaddr *)&from), len);
+
+	/* update recv time */
+	time(&server_info->last_recv);
+
+	/* processing dns packet */
+	if (_dns_client_recv(server_info, inpacket, len, (struct sockaddr *)&from, from_len) != 0) {
+		return -1;
+	}
+
+	return 0;
+errout:
+	pthread_mutex_lock(&client.server_list_lock);
+	server_info->recv_buff.len = 0;
+	server_info->send_buff.len = 0;
+	_dns_client_close_socket(server_info);
+	pthread_mutex_unlock(&client.server_list_lock);
+	return -1;
+}
+
 static int _dns_client_process_udp(struct dns_server_info *server_info, struct epoll_event *event, unsigned long now)
 {
 	int len = 0;
@@ -1960,6 +2208,10 @@ static int _dns_client_process_udp(struct dns_server_info *server_info, struct e
 	int ttl = 0;
 	struct cmsghdr *cmsg = NULL;

+	if (server_info->proxy) {
+		return _dns_client_process_udp_proxy(server_info, event, now);
+	}
+
 	memset(&msg, 0, sizeof(msg));
 	iov.iov_base = (char *)inpacket;
 	iov.iov_len = sizeof(inpacket);
@@ -1972,8 +2224,17 @@ static int _dns_client_process_udp(struct dns_server_info *server_info, struct e

 	len = recvmsg(server_info->fd, &msg, MSG_DONTWAIT);
 	if (len < 0) {
-		tlog(TLOG_ERROR, "recvfrom failed, %s\n", strerror(errno));
-		return -1;
+		if (errno == EAGAIN || errno == EWOULDBLOCK) {
+			return 0;
+		}
+
+		if (errno == ECONNREFUSED) {
+			tlog(TLOG_DEBUG, "recvfrom %s failed, %s\n", server_info->ip, strerror(errno));
+			goto errout;
+		}
+
+		tlog(TLOG_ERROR, "recvfrom %s failed, %s\n", server_info->ip, strerror(errno));
+		goto errout;
 	}
 	from_len = msg.msg_namelen;

@@ -1993,7 +2254,7 @@ static int _dns_client_process_udp(struct dns_server_info *server_info, struct e
 	}

 	tlog(TLOG_DEBUG, "recv udp packet from %s, len: %d, ttl: %d",
-		 gethost_by_addr(from_host, sizeof(from_host), (struct sockaddr *)&from), len, ttl);
+		 get_host_by_addr(from_host, sizeof(from_host), (struct sockaddr *)&from), len, ttl);

 	/* update recv time */
 	time(&server_info->last_recv);
@@ -2004,6 +2265,15 @@ static int _dns_client_process_udp(struct dns_server_info *server_info, struct e
 	}

 	return 0;
+
+errout:
+	pthread_mutex_lock(&client.server_list_lock);
+	server_info->recv_buff.len = 0;
+	server_info->send_buff.len = 0;
+	_dns_client_close_socket(server_info);
+	pthread_mutex_unlock(&client.server_list_lock);
+
+	return -1;
 }

 static int _dns_client_socket_ssl_send(struct dns_server_info *server, const void *buf, int num)
@@ -2218,7 +2488,7 @@ static int _dns_client_process_tcp_buff(struct dns_server_info *server_info)
 			}

 			if (len > server_info->recv_buff.len - 2) {
-				/* len is not expceded, wait and recv */
+				/* len is not expected, wait and recv */
 				ret = 0;
 				goto out;
 			}
@@ -2273,16 +2543,17 @@ static int _dns_client_process_tcp(struct dns_server_info *server_info, struct e
 		len = _dns_client_socket_recv(server_info);
 		if (len < 0) {
 			/* no data to recv, try again */
-			if (errno == EAGAIN) {
+			if (errno == EAGAIN || errno == EWOULDBLOCK) {
 				return 0;
 			}

-			/* FOR GFW */
-			if (errno == ECONNRESET) {
+			if (errno == ECONNRESET || errno == ENETUNREACH || errno == EHOSTUNREACH) {
+				tlog(TLOG_DEBUG, "recv failed, server %s:%d, %s\n", server_info->ip, server_info->port,
+					 strerror(errno));
 				goto errout;
 			}

-			if (errno == ETIMEDOUT) {
+			if (errno == ETIMEDOUT || errno == ECONNREFUSED) {
 				tlog(TLOG_INFO, "recv failed, server %s:%d, %s\n", server_info->ip, server_info->port, strerror(errno));
 				goto errout;
 			}
@@ -2353,7 +2624,7 @@ static int _dns_client_process_tcp(struct dns_server_info *server_info, struct e
 			return 0;
 		}

-		/* clear epllout event */
+		/* clear epollout event */
 		struct epoll_event mod_event;
 		memset(&mod_event, 0, sizeof(mod_event));
 		mod_event.events = EPOLLIN;
@@ -2649,8 +2920,82 @@ errout:
 	return -1;
 }

+static int _dns_proxy_handshake(struct dns_server_info *server_info, struct epoll_event *event, unsigned long now)
+{
+	struct epoll_event fd_event;
+	proxy_handshake_state ret = proxy_conn_handshake(server_info->proxy);
+	int fd = server_info->fd;
+	int retval = -1;
+	int epoll_op = EPOLL_CTL_MOD;
+
+	if (ret == PROXY_HANDSHAKE_OK) {
+		return 0;
+	}
+
+	if (ret == PROXY_HANDSHAKE_ERR) {
+		goto errout;
+	}
+
+	memset(&fd_event, 0, sizeof(fd_event));
+	if (ret == PROXY_HANDSHAKE_CONNECTED) {
+		fd_event.events = EPOLLIN;
+		if (server_info->type == DNS_SERVER_UDP) {
+			server_info->status = DNS_SERVER_STATUS_CONNECTED;
+			epoll_ctl(client.epoll_fd, EPOLL_CTL_DEL, fd, NULL);
+			event->events = 0;
+			fd = proxy_conn_get_udpfd(server_info->proxy);
+			if (fd < 0) {
+				tlog(TLOG_ERROR, "get udp fd failed");
+				goto errout;
+			}
+
+			set_fd_nonblock(fd, 1);
+			if (server_info->so_mark >= 0) {
+				unsigned int so_mark = server_info->so_mark;
+				if (setsockopt(fd, SOL_SOCKET, SO_MARK, &so_mark, sizeof(so_mark)) != 0) {
+					tlog(TLOG_DEBUG, "set socket mark failed, %s", strerror(errno));
+				}
+			}
+			server_info->fd = fd;
+			epoll_op = EPOLL_CTL_ADD;
+		} else {
+			fd_event.events |= EPOLLOUT;
+		}
+		retval = 0;
+	}
+
+	if (ret == PROXY_HANDSHAKE_WANT_READ) {
+		fd_event.events = EPOLLIN;
+	} else if (ret == PROXY_HANDSHAKE_WANT_WRITE) {
+		fd_event.events = EPOLLOUT | EPOLLIN;
+	}
+
+	fd_event.data.ptr = server_info;
+	if (epoll_ctl(client.epoll_fd, epoll_op, fd, &fd_event) != 0) {
+		tlog(TLOG_ERROR, "epoll ctl failed, %s", strerror(errno));
+		goto errout;
+	}
+
+	return retval;
+
+errout:
+	pthread_mutex_lock(&client.server_list_lock);
+	server_info->recv_buff.len = 0;
+	server_info->send_buff.len = 0;
+	_dns_client_close_socket(server_info);
+	pthread_mutex_unlock(&client.server_list_lock);
+	return -1;
+}
+
 static int _dns_client_process(struct dns_server_info *server_info, struct epoll_event *event, unsigned long now)
 {
+	if (server_info->proxy) {
+		int ret = _dns_proxy_handshake(server_info, event, now);
+		if (ret != 0) {
+			return ret;
+		}
+	}
+
 	if (server_info->type == DNS_SERVER_UDP) {
 		/* receive from udp */
 		return _dns_client_process_udp(server_info, event, now);
@@ -2658,7 +3003,7 @@ static int _dns_client_process(struct dns_server_info *server_info, struct epoll
 		/* receive from tcp */
 		return _dns_client_process_tcp(server_info, event, now);
 	} else if (server_info->type == DNS_SERVER_TLS || server_info->type == DNS_SERVER_HTTPS) {
-		/* recive from tls */
+		/* receive from tls */
 		return _dns_client_process_tls(server_info, event, now);
 	} else {
 		return -1;
@@ -2667,19 +3012,68 @@ static int _dns_client_process(struct dns_server_info *server_info, struct epoll
 	return 0;
 }

+static int _dns_client_copy_data_to_buffer(struct dns_server_info *server_info, void *packet, int len)
+{
+	if (DNS_TCP_BUFFER - server_info->send_buff.len < len) {
+		errno = ENOMEM;
+		return -1;
+	}
+
+	memcpy(server_info->send_buff.data + server_info->send_buff.len, packet, len);
+	server_info->send_buff.len += len;
+
+	return 0;
+}
+
 static int _dns_client_send_udp(struct dns_server_info *server_info, void *packet, int len)
 {
 	int send_len = 0;
+	const struct sockaddr *addr = &server_info->addr;
+	socklen_t addrlen = server_info->ai_addrlen;
+	int ret = 0;
+
 	if (server_info->fd <= 0) {
 		return -1;
 	}

-	send_len = sendto(server_info->fd, packet, len, 0, &server_info->addr, server_info->ai_addrlen);
+	if (server_info->proxy) {
+		if (server_info->status != DNS_SERVER_STATUS_CONNECTED) {
+			/*set packet len*/
+			_dns_client_copy_data_to_buffer(server_info, &len, sizeof(len));
+			return _dns_client_copy_data_to_buffer(server_info, packet, len);
+		}
+
+		send_len = proxy_conn_sendto(server_info->proxy, packet, len, 0, addr, addrlen);
+		if (send_len != len) {
+			_dns_client_close_socket(server_info);
+			server_info->recv_buff.len = 0;
+			if (server_info->send_buff.len > 0) {
+				/* still remain request data, reconnect and send*/
+				ret = _dns_client_create_socket(server_info);
+			} else {
+				ret = 0;
+			}
+
+			if (ret != 0) {
+				return -1;
+			}
+
+			_dns_client_copy_data_to_buffer(server_info, &len, sizeof(len));
+			return _dns_client_copy_data_to_buffer(server_info, packet, len);
+		}
+
+		return 0;
+	}
+
+	send_len = sendto(server_info->fd, packet, len, 0, NULL, 0);
 	if (send_len != len) {
-		return -1;
+		goto errout;
 	}

 	return 0;
+
+errout:
+	return -1;
 }

 static int _dns_client_send_data_to_buffer(struct dns_server_info *server_info, void *packet, int len)
@@ -2902,7 +3296,7 @@ static int _dns_client_send_packet(struct dns_query_struct *query, void *packet,
 				send_err = errno;
 				break;
 			default:
-				/* unsupport query type */
+				/* unsupported query type */
 				ret = -1;
 				break;
 			}
@@ -2955,7 +3349,7 @@ static int _dns_client_dns_add_ecs(struct dns_query_struct *query, struct dns_pa
 	return dns_add_OPT_ECS(packet, &query->ecs.ecs);
 }

-static int _dns_client_send_query(struct dns_query_struct *query, const char *doamin)
+static int _dns_client_send_query(struct dns_query_struct *query, const char *domain)
 {
 	unsigned char packet_buff[DNS_PACKSIZE];
 	unsigned char inpacket[DNS_IN_PACKSIZE];
@@ -2979,13 +3373,13 @@ static int _dns_client_send_query(struct dns_query_struct *query, const char *do
 	}

 	/* add question */
-	if (dns_add_domain(packet, doamin, query->qtype, DNS_C_IN) != 0) {
+	if (dns_add_domain(packet, domain, query->qtype, DNS_C_IN) != 0) {
 		tlog(TLOG_ERROR, "add domain to packet failed.");
 		return -1;
 	}

 	dns_set_OPT_payload_size(packet, DNS_IN_PACKSIZE);
-	/* dns_add_OPT_TCP_KEEYALIVE(packet, 600); */
+	/* dns_add_OPT_TCP_KEEPALIVE(packet, 600); */
 	if (_dns_client_dns_add_ecs(query, packet) != 0) {
 		tlog(TLOG_ERROR, "add ecs failed.");
 		return -1;
@@ -3106,6 +3500,7 @@ int dns_client_query(const char *domain, int qtype, dns_client_callback callback
 	struct dns_query_struct *query = NULL;
 	int ret = 0;
 	uint32_t key = 0;
+	int unused __attribute__((unused));

 	if (domain == NULL) {
 		goto errout;
@@ -3129,7 +3524,9 @@ int dns_client_query(const char *domain, int qtype, dns_client_callback callback
 	query->qtype = qtype;
 	query->send_tick = 0;
 	query->has_result = 0;
-	query->sid = atomic_inc_return(&dns_client_sid);
+	if (getrandom(&query->sid, sizeof(query->sid), GRND_NONBLOCK) != sizeof(query->sid)) {
+		query->sid = random();
+	}
 	query->server_group = _dns_client_get_dnsserver_group(group_name);
 	if (query->server_group == NULL) {
 		tlog(TLOG_ERROR, "get dns server group %s failed.", group_name);
@@ -3145,6 +3542,7 @@ int dns_client_query(const char *domain, int qtype, dns_client_callback callback
 	/* add query to hashtable */
 	key = hash_string(domain);
 	key = jhash(&query->sid, sizeof(query->sid), key);
+	key = jhash(&query->qtype, sizeof(query->qtype), key);
 	pthread_mutex_lock(&client.domain_map_lock);
 	hash_add(client.domain_map, &query->domain_node, key);
 	pthread_mutex_unlock(&client.domain_map_lock);
@@ -3278,8 +3676,8 @@ static void _dns_client_remove_all_pending_servers(void)
 	list_for_each_entry_safe(pending, tmp, &remove_list, retry_list)
 	{
 		list_del_init(&pending->retry_list);
-		_dns_client_server_pending_release(pending);
 		_dns_client_server_pending_remove(pending);
+		_dns_client_server_pending_release(pending);
 	}
 }

@@ -3287,14 +3685,14 @@ static void _dns_client_add_pending_servers(void)
 {
 	struct dns_server_pending *pending = NULL;
 	struct dns_server_pending *tmp = NULL;
-	static int dely = 0;
+	static int delay = 0;
 	LIST_HEAD(retry_list);

 	/* add pending server after 3 seconds */
-	if (++dely < 3) {
+	if (++delay < 3) {
 		return;
 	}
-	dely = 0;
+	delay = 0;

 	pthread_mutex_lock(&pending_server_mutex);
 	if (list_empty(&pending_servers)) {
@@ -3376,9 +3774,13 @@ static void _dns_client_add_pending_servers(void)
 		if (dns_client_has_bootstrap_dns == 0) {
 			if (_dns_client_add_pendings(pending, pending->host) != 0) {
 				pthread_mutex_unlock(&pending_server_mutex);
-				tlog(TLOG_ERROR, "add pending DNS server %s failed", pending->host);
-				exit(1);
-				return;
+				tlog(TLOG_INFO, "add pending DNS server %s from resolv.conf failed, retry %d...", pending->host,
+					 pending->retry_cnt - 1);
+				if (pending->retry_cnt - 1 > DNS_PENDING_SERVER_RETRY) {
+					tlog(TLOG_WARN, "add pending DNS server %s from resolv.conf failed, exit...", pending->host);
+					exit(1);
+				}
+				continue;
 			}

 			_dns_client_server_pending_release(pending);
@@ -3460,10 +3862,12 @@ static void *_dns_client_work(void *arg)
 				sleep_time = 0;
 			}
 		}
-		last = now;

 		if (now >= expect_time) {
-			_dns_client_period_run();
+			if (last != now) {
+				_dns_client_period_run();
+			}
+
 			sleep_time = sleep - (now - expect_time);
 			if (sleep_time < 0) {
 				sleep_time = 0;
@@ -3471,6 +3875,7 @@ static void *_dns_client_work(void *arg)
 			}
 			expect_time += sleep;
 		}
+		last = now;

 		pthread_mutex_lock(&client.domain_map_lock);
 		if (list_empty(&client.dns_request_list) && atomic_read(&client.run_period) == 0) {
@@ -3553,6 +3958,8 @@ int dns_client_init(void)
 		return -1;
 	}

+	srandom(time(NULL));
+
 	memset(&client, 0, sizeof(client));
 	pthread_attr_init(&attr);
 	atomic_set(&client.dns_server_num, 0);
@@ -3622,7 +4029,7 @@ void dns_client_exit(void)
 		client.tid = 0;
 	}

-	/* free all resouces */
+	/* free all resources */
 	_dns_client_remove_all_pending_servers();
 	_dns_client_server_remove_all();
 	_dns_client_query_remove_all();
--- a/src/dns_client.h
+++ b/src/dns_client.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -80,8 +80,8 @@ struct dns_query_options {
 };

 /* query domain */
-int dns_client_query(const char *domain, int qtype, dns_client_callback callback, void *user_ptr, const char *group_name,
-					 struct dns_query_options *options);
+int dns_client_query(const char *domain, int qtype, dns_client_callback callback, void *user_ptr,
+					 const char *group_name, struct dns_query_options *options);

 void dns_client_exit(void);

@@ -102,6 +102,7 @@ struct client_dns_server_flag_https {
 	int spi_len;
 	char hostname[DNS_MAX_CNAME_LEN];
 	char httphost[DNS_MAX_CNAME_LEN];
+	char proxyname[DNS_MAX_CNAME_LEN];
 	char path[DNS_MAX_CNAME_LEN];
 	char tls_host_verify[DNS_MAX_CNAME_LEN];
 	char skip_check_cert;
@@ -112,7 +113,7 @@ struct client_dns_server_flags {
 	unsigned int server_flag;
 	unsigned int result_flag;
 	long long set_mark;
-
+	char proxyname[DNS_MAX_CNAME_LEN];
 	union {
 		struct client_dns_server_flag_udp udp;
 		struct client_dns_server_flag_tls tls;
--- a/src/dns_conf.c
+++ b/src/dns_conf.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -47,11 +47,11 @@ static struct dns_nftset_table dns_nftset_table;

 struct dns_qtype_soa_table dns_qtype_soa_table;

-struct dns_domain_set_rule_table dns_domain_set_rule_table;
 struct dns_domain_set_name_table dns_domain_set_name_table;

 /* dns groups */
 struct dns_group_table dns_group_table;
+struct dns_proxy_table dns_proxy_table;

 struct dns_ptr_table dns_ptr_table;

@@ -105,6 +105,7 @@ int dns_conf_log_level = TLOG_ERROR;
 char dns_conf_log_file[DNS_MAX_PATH];
 size_t dns_conf_log_size = 1024 * 1024;
 int dns_conf_log_num = 8;
+int dns_conf_log_file_mode;

 /* CA file */
 char dns_conf_ca_file[DNS_MAX_PATH];
@@ -119,6 +120,7 @@ int dns_conf_audit_log_SOA;
 char dns_conf_audit_file[DNS_MAX_PATH];
 size_t dns_conf_audit_size = 1024 * 1024;
 int dns_conf_audit_num = 2;
+int dns_conf_audit_file_mode;

 /* address rules */
 art_tree dns_conf_domain_rule;
@@ -141,7 +143,7 @@ int dns_conf_ipset_timeout_enable;
 int dns_conf_nftset_timeout_enable;
 int dns_conf_nftset_debug_enable;

-char dns_conf_user[DNS_CONF_USRNAME_LEN];
+char dns_conf_user[DNS_CONF_USERNAME_LEN];

 int dns_save_fail_packet;
 char dns_save_fail_packet_dir[DNS_MAX_PATH];
@@ -213,7 +215,7 @@ static void _dns_rule_put(struct dns_rule *rule)
 	}
 }

-static int _get_domain(char *value, char *domain, int max_dmain_size, char **ptr_after_domain)
+static int _get_domain(char *value, char *domain, int max_domain_size, char **ptr_after_domain)
 {
 	char *begin = NULL;
 	char *end = NULL;
@@ -243,7 +245,7 @@ static int _get_domain(char *value, char *domain, int max_dmain_size, char **ptr

 	/* Get domain */
 	len = end - begin;
-	if (len >= max_dmain_size) {
+	if (len >= max_domain_size) {
 		tlog(TLOG_ERROR, "domain name %s too long", value);
 		goto errout;
 	}
@@ -343,12 +345,108 @@ static void _config_group_table_destroy(void)
 	}
 }

+struct dns_proxy_names *dns_server_get_proxy_nams(const char *proxyname)
+{
+	uint32_t key = 0;
+	struct dns_proxy_names *proxy = NULL;
+
+	key = hash_string(proxyname);
+	hash_for_each_possible(dns_proxy_table.proxy, proxy, node, key)
+	{
+		if (strncmp(proxy->proxy_name, proxyname, DNS_MAX_IPLEN) == 0) {
+			return proxy;
+		}
+	}
+
+	return NULL;
+}
+
+/* create and get dns server group */
+static struct dns_proxy_names *_dns_conf_get_proxy(const char *proxy_name)
+{
+	uint32_t key = 0;
+	struct dns_proxy_names *proxy = NULL;
+
+	key = hash_string(proxy_name);
+	hash_for_each_possible(dns_proxy_table.proxy, proxy, node, key)
+	{
+		if (strncmp(proxy->proxy_name, proxy_name, DNS_MAX_IPLEN) == 0) {
+			return proxy;
+		}
+	}
+
+	proxy = malloc(sizeof(*proxy));
+	if (proxy == NULL) {
+		goto errout;
+	}
+
+	memset(proxy, 0, sizeof(*proxy));
+	safe_strncpy(proxy->proxy_name, proxy_name, PROXY_NAME_LEN);
+	hash_add(dns_proxy_table.proxy, &proxy->node, key);
+	INIT_LIST_HEAD(&proxy->server_list);
+
+	return proxy;
+errout:
+	if (proxy) {
+		free(proxy);
+	}
+
+	return NULL;
+}
+
+static int _dns_conf_proxy_servers_add(const char *proxy_name, struct dns_proxy_servers *server)
+{
+	struct dns_proxy_names *proxy = NULL;
+
+	proxy = _dns_conf_get_proxy(proxy_name);
+	if (proxy == NULL) {
+		return -1;
+	}
+
+	list_add_tail(&server->list, &proxy->server_list);
+
+	return 0;
+}
+
+static const char *_dns_conf_get_proxy_name(const char *proxy_name)
+{
+	struct dns_proxy_names *proxy = NULL;
+
+	proxy = _dns_conf_get_proxy(proxy_name);
+	if (proxy == NULL) {
+		return NULL;
+	}
+
+	return proxy->proxy_name;
+}
+
+static void _config_proxy_table_destroy(void)
+{
+	struct dns_proxy_names *proxy = NULL;
+	struct hlist_node *tmp = NULL;
+	unsigned int i;
+	struct dns_proxy_servers *server = NULL;
+	struct dns_proxy_servers *server_tmp = NULL;
+
+	hash_for_each_safe(dns_proxy_table.proxy, i, tmp, proxy, node)
+	{
+		hlist_del_init(&proxy->node);
+		list_for_each_entry_safe(server, server_tmp, &proxy->server_list, list)
+		{
+			list_del(&server->list);
+			free(server);
+		}
+		free(proxy);
+	}
+}
+
 static int _config_server(int argc, char *argv[], dns_server_type_t type, int default_port)
 {
 	int index = dns_conf_server_num;
 	struct dns_servers *server = NULL;
 	int port = -1;
 	char *ip = NULL;
+	char scheme[DNS_MAX_CNAME_LEN] = {0};
 	int opt = 0;
 	unsigned int result_flag = 0;
 	unsigned int server_flag = 0;
@@ -369,7 +467,8 @@ static int _config_server(int argc, char *argv[], dns_server_type_t type, int de
 		{"no-check-certificate", no_argument, NULL, 'N'}, /* do not check certificate */
 		{"tls-host-verify", required_argument, NULL, 'V' }, /* verify tls hostname */
 		{"group", required_argument, NULL, 'g'}, /* add to group */
-		{"exclude-default-group", no_argument, NULL, 'E'}, /* ecluse this from default group */
+		{"proxy", required_argument, NULL, 'P'}, /* proxy server */
+		{"exclude-default-group", no_argument, NULL, 'E'}, /* exclude this from default group */
 		{"set-mark", required_argument, NULL, 254}, /* set mark */
 		{NULL, no_argument, NULL, 0}
 	};
@@ -391,22 +490,38 @@ static int _config_server(int argc, char *argv[], dns_server_type_t type, int de
 	server->hostname[0] = '\0';
 	server->httphost[0] = '\0';
 	server->tls_host_verify[0] = '\0';
+	server->proxyname[0] = '\0';
 	server->set_mark = -1;

-	if (type == DNS_SERVER_HTTPS) {
-		if (parse_uri(ip, NULL, server->server, &port, server->path) != 0) {
+	if (parse_uri(ip, scheme, server->server, &port, server->path) != 0) {
+		return -1;
+	}
+
+	if (scheme[0] != '\0') {
+		if (strcasecmp(scheme, "https") == 0) {
+			type = DNS_SERVER_HTTPS;
+			default_port = DEFAULT_DNS_HTTPS_PORT;
+		} else if (strcasecmp(scheme, "tls") == 0) {
+			type = DNS_SERVER_TLS;
+			default_port = DEFAULT_DNS_TLS_PORT;
+		} else if (strcasecmp(scheme, "tcp") == 0) {
+			type = DNS_SERVER_TCP;
+			default_port = DEFAULT_DNS_PORT;
+		} else if (strcasecmp(scheme, "udp") == 0) {
+			type = DNS_SERVER_UDP;
+			default_port = DEFAULT_DNS_PORT;
+		} else {
+			tlog(TLOG_ERROR, "invalid scheme: %s", scheme);
 			return -1;
 		}
+	}
+
+	if (type == DNS_SERVER_HTTPS) {
 		safe_strncpy(server->hostname, server->server, sizeof(server->hostname));
 		safe_strncpy(server->httphost, server->server, sizeof(server->httphost));
 		if (server->path[0] == 0) {
 			safe_strncpy(server->path, "/", sizeof(server->path));
 		}
-	} else {
-		/* parse ip, port from ip */
-		if (parse_ip(ip, server->server, &port) != 0) {
-			return -1;
-		}
 	}

 	/* if port is not defined, set port to default 53 */
@@ -461,6 +576,14 @@ static int _config_server(int argc, char *argv[], dns_server_type_t type, int de
 			safe_strncpy(server->spki, optarg, DNS_MAX_SPKI_LEN);
 			break;
 		}
+		case 'P': {
+			if (_dns_conf_get_proxy_name(optarg) == NULL) {
+				tlog(TLOG_ERROR, "add proxy server failed.");
+				goto errout;
+			}
+			safe_strncpy(server->proxyname, optarg, PROXY_NAME_LEN);
+			break;
+		}
 		case 'V': {
 			safe_strncpy(server->tls_host_verify, optarg, DNS_MAX_CNAME_LEN);
 			break;
@@ -497,9 +620,8 @@ errout:
 	return -1;
 }

-static int _config_domain_iter_free(void *data, const unsigned char *key, uint32_t key_len, void *value)
+static int _config_domain_rule_free(struct dns_domain_rule *domain_rule)
 {
-	struct dns_domain_rule *domain_rule = value;
 	int i = 0;

 	if (domain_rule == NULL) {
@@ -519,6 +641,12 @@ static int _config_domain_iter_free(void *data, const unsigned char *key, uint32
 	return 0;
 }

+static int _config_domain_iter_free(void *data, const unsigned char *key, uint32_t key_len, void *value)
+{
+	struct dns_domain_rule *domain_rule = value;
+	return _config_domain_rule_free(domain_rule);
+}
+
 static void _config_domain_destroy(void)
 {
 	art_iter(&dns_conf_domain_rule, _config_domain_iter_free, NULL);
@@ -539,71 +667,90 @@ static void _config_address_destroy(radix_node_t *node, void *cbctx)
 	node->data = NULL;
 }

-static int _config_domain_set_rule_add_ext(const char *set_name, enum domain_rule type, void *rule, unsigned int flags,
-										   int is_clear_flag)
+typedef int (*domain_set_rule_add_func)(const char *domain, void *priv);
+static int _config_domain_rule_each_from_list(const char *file, domain_set_rule_add_func callback, void *priv)
 {
-	struct dns_domain_set_rule *set_rule = NULL;
-	struct dns_domain_set_rule_list *set_rule_list = NULL;
+	FILE *fp = NULL;
+	char line[MAX_LINE_LEN];
+	char domain[DNS_MAX_CNAME_LEN];
+	int ret = 0;
+	int line_no = 0;
+	int filed_num = 0;
+
+	fp = fopen(file, "r");
+	if (fp == NULL) {
+		tlog(TLOG_WARN, "open file %s error, %s", file, strerror(errno));
+		return 0;
+	}
+
+	line_no = 0;
+	while (fgets(line, MAX_LINE_LEN, fp)) {
+		line_no++;
+		filed_num = sscanf(line, "%256s", domain);
+		if (filed_num <= 0) {
+			continue;
+		}
+
+		if (domain[0] == '#' || domain[0] == '\n') {
+			continue;
+		}
+
+		ret = callback(domain, priv);
+		if (ret != 0) {
+			tlog(TLOG_WARN, "process file %s failed at line %d.", file, line_no);
+			continue;
+		}
+	}
+
+	fclose(fp);
+	return ret;
+}
+
+static int _config_domain_rule_set_each(const char *domain_set, domain_set_rule_add_func callback, void *priv)
+{
+	struct dns_domain_set_name_list *set_name_list = NULL;
+	struct dns_domain_set_name *set_name_item = NULL;
+
 	uint32_t key = 0;

-	if (set_name == NULL) {
-		return -1;
-	}
-
-	set_rule = malloc(sizeof(struct dns_domain_set_rule));
-	if (set_rule == NULL) {
-		goto errout;
-	}
-	memset(set_rule, 0, sizeof(struct dns_domain_set_rule));
-
-	set_rule->type = type;
-	set_rule->rule = rule;
-	set_rule->flags = flags;
-	set_rule->is_clear_flag = is_clear_flag;
-
-	if (rule) {
-		_dns_rule_get(rule);
-	}
-
-	key = hash_string(set_name);
-	hash_for_each_possible(dns_domain_set_rule_table.rule_list, set_rule_list, node, key)
+	key = hash_string(domain_set);
+	hash_for_each_possible(dns_domain_set_name_table.names, set_name_list, node, key)
 	{
-		if (strncmp(set_rule_list->domain_set, set_name, DNS_MAX_CNAME_LEN) == 0) {
+		if (strcmp(set_name_list->name, domain_set) == 0) {
 			break;
 		}
 	}

-	if (set_rule_list == NULL) {
-		set_rule_list = malloc(sizeof(struct dns_domain_set_rule_list));
-		if (set_rule_list == NULL) {
-			goto errout;
+	if (set_name_list == NULL) {
+		tlog(TLOG_WARN, "domain set %s not found.", domain_set);
+		return -1;
+	}
+
+	list_for_each_entry(set_name_item, &set_name_list->set_name_list, list)
+	{
+		switch (set_name_item->type) {
+		case DNS_DOMAIN_SET_LIST:
+			_config_domain_rule_each_from_list(set_name_item->file, callback, priv);
+			break;
+		case DNS_DOMAIN_SET_GEOSITE:
+			break;
+		default:
+			tlog(TLOG_WARN, "domain set %s type %d not support.", set_name_list->name, set_name_item->type);
+			break;
 		}
-		memset(set_rule_list, 0, sizeof(struct dns_domain_set_rule_list));
-		INIT_LIST_HEAD(&set_rule_list->domain_ruls_list);
-		safe_strncpy(set_rule_list->domain_set, set_name, DNS_MAX_CNAME_LEN);
-		hash_add(dns_domain_set_rule_table.rule_list, &set_rule_list->node, key);
 	}

-	list_add_tail(&set_rule->list, &set_rule_list->domain_ruls_list);
 	return 0;
-errout:
-	if (set_rule) {
-		free(set_rule);
-	}
-	return -1;
 }

-static int _config_domian_set_rule_flags(const char *set_name, unsigned int flags, int is_clear_flag)
+static int _config_domain_rule_add(const char *domain, enum domain_rule type, void *rule);
+static int _config_domain_rule_add_callback(const char *domain, void *priv)
 {
-	return _config_domain_set_rule_add_ext(set_name, DOMAIN_RULE_FLAGS, NULL, flags, is_clear_flag);
+	struct dns_set_rule_add_callback_args *args = (struct dns_set_rule_add_callback_args *)priv;
+	return _config_domain_rule_add(domain, args->type, args->rule);
 }

-static int _config_domain_set_rule_add(char *set_name, enum domain_rule type, void *rule)
-{
-	return _config_domain_set_rule_add_ext(set_name, type, rule, 0, 0);
-}
-
-static int _config_domain_rule_add(char *domain, enum domain_rule type, void *rule)
+static int _config_domain_rule_add(const char *domain, enum domain_rule type, void *rule)
 {
 	struct dns_domain_rule *domain_rule = NULL;
 	struct dns_domain_rule *old_domain_rule = NULL;
@@ -620,7 +767,11 @@ static int _config_domain_rule_add(char *domain, enum domain_rule type, void *ru
 	}

 	if (strncmp(domain, "domain-set:", sizeof("domain-set:") - 1) == 0) {
-		return _config_domain_set_rule_add(domain + sizeof("domain-set:") - 1, type, rule);
+		struct dns_set_rule_add_callback_args args;
+		args.type = type;
+		args.rule = rule;
+		return _config_domain_rule_set_each(domain + sizeof("domain-set:") - 1, _config_domain_rule_add_callback,
+											&args);
 	}

 	reverse_string(domain_key, domain, len, 1);
@@ -656,7 +807,7 @@ static int _config_domain_rule_add(char *domain, enum domain_rule type, void *ru
 	if (add_domain_rule) {
 		old_domain_rule = art_insert(&dns_conf_domain_rule, (unsigned char *)domain_key, len, add_domain_rule);
 		if (old_domain_rule) {
-			free(old_domain_rule);
+			_config_domain_rule_free(old_domain_rule);
 		}
 	}

@@ -666,10 +817,57 @@ errout:
 		free(add_domain_rule);
 	}

-	tlog(TLOG_ERROR, "add doamin %s rule failed", domain);
+	tlog(TLOG_ERROR, "add domain %s rule failed", domain);
 	return -1;
 }

+static int _config_domain_rule_delete(const char *domain);
+static int _config_domain_rule_delete_callback(const char *domain, void *priv)
+{
+	return _config_domain_rule_delete(domain);
+}
+
+static int _config_domain_rule_delete(const char *domain)
+{
+	char domain_key[DNS_MAX_CONF_CNAME_LEN];
+	int len = 0;
+
+	/* Reverse string, for suffix match */
+	len = strlen(domain);
+	if (len >= (int)sizeof(domain_key)) {
+		tlog(TLOG_ERROR, "domain name %s too long", domain);
+		goto errout;
+	}
+
+	if (strncmp(domain, "domain-set:", sizeof("domain-set:") - 1) == 0) {
+		return _config_domain_rule_set_each(domain + sizeof("domain-set:") - 1, _config_domain_rule_delete_callback,
+											NULL);
+	}
+
+	reverse_string(domain_key, domain, len, 1);
+	domain_key[len] = '.';
+	len++;
+	domain_key[len] = 0;
+
+	/* delete existing rules */
+	void *rule = art_delete(&dns_conf_domain_rule, (unsigned char *)domain_key, len);
+	if (rule) {
+		_config_domain_rule_free(rule);
+	}
+
+	return 0;
+errout:
+	tlog(TLOG_ERROR, "delete domain %s rule failed", domain);
+	return -1;
+}
+
+static int _config_domain_rule_flag_set(const char *domain, unsigned int flag, unsigned int is_clear);
+static int _config_domain_rule_flag_callback(const char *domain, void *priv)
+{
+	struct dns_set_rule_flags_callback_args *args = (struct dns_set_rule_flags_callback_args *)priv;
+	return _config_domain_rule_flag_set(domain, args->flags, args->is_clear_flag);
+}
+
 static int _config_domain_rule_flag_set(const char *domain, unsigned int flag, unsigned int is_clear)
 {
 	struct dns_domain_rule *domain_rule = NULL;
@@ -681,7 +879,11 @@ static int _config_domain_rule_flag_set(const char *domain, unsigned int flag, u
 	int len = 0;

 	if (strncmp(domain, "domain-set:", sizeof("domain-set:") - 1) == 0) {
-		return _config_domian_set_rule_flags(domain + sizeof("domain-set:") - 1, flag, is_clear);
+		struct dns_set_rule_flags_callback_args args;
+		args.flags = flag;
+		args.is_clear_flag = is_clear;
+		return _config_domain_rule_set_each(domain + sizeof("domain-set:") - 1, _config_domain_rule_flag_callback,
+											&args);
 	}

 	len = strlen(domain);
@@ -724,7 +926,7 @@ static int _config_domain_rule_flag_set(const char *domain, unsigned int flag, u
 	if (add_domain_rule) {
 		old_domain_rule = art_insert(&dns_conf_domain_rule, (unsigned char *)domain_key, len, add_domain_rule);
 		if (old_domain_rule) {
-			free(old_domain_rule);
+			_config_domain_rule_free(old_domain_rule);
 		}
 	}

@@ -734,7 +936,7 @@ errout:
 		free(add_domain_rule);
 	}

-	tlog(TLOG_ERROR, "add doamin %s rule failed", domain);
+	tlog(TLOG_ERROR, "add domain %s rule failed", domain);
 	return 0;
 }

@@ -835,6 +1037,7 @@ static int _conf_domain_rule_ipset(char *domain, const char *ipsetname)
 			goto errout;
 		}
 		_dns_rule_put(&ipset_rule->head);
+		ipset_rule = NULL;
 	}

 	goto clear;
@@ -1487,6 +1690,107 @@ errout:
 	return 0;
 }

+static int _config_proxy_server(void *data, int argc, char *argv[])
+{
+	char *servers_name = NULL;
+	struct dns_proxy_servers *server = NULL;
+	proxy_type_t type = PROXY_TYPE_END;
+
+	char *ip = NULL;
+	int opt = 0;
+	int use_domain = 0;
+	char scheme[DNS_MAX_CNAME_LEN] = {0};
+	int port = PORT_NOT_DEFINED;
+
+	/* clang-format off */
+	static struct option long_options[] = {
+		{"name", required_argument, NULL, 'n'}, 
+		{"use-domain", no_argument, NULL, 'd'},
+		{NULL, no_argument, NULL, 0}
+	};
+	/* clang-format on */
+
+	if (argc <= 1) {
+		return 0;
+	}
+
+	server = malloc(sizeof(*server));
+	if (server == NULL) {
+		tlog(TLOG_WARN, "malloc memory failed.");
+		goto errout;
+	}
+	memset(server, 0, sizeof(*server));
+
+	ip = argv[1];
+	if (parse_uri_ext(ip, scheme, server->username, server->password, server->server, &port, NULL) != 0) {
+		goto errout;
+	}
+
+	/* process extra options */
+	optind = 1;
+	while (1) {
+		opt = getopt_long_only(argc, argv, "n:d", long_options, NULL);
+		if (opt == -1) {
+			break;
+		}
+
+		switch (opt) {
+		case 'n': {
+			servers_name = optarg;
+			break;
+		}
+		case 'd': {
+			use_domain = 1;
+			break;
+		}
+		default:
+			break;
+		}
+	}
+
+	if (strcasecmp(scheme, "socks5") == 0) {
+		if (port == PORT_NOT_DEFINED) {
+			port = 1080;
+		}
+
+		type = PROXY_SOCKS5;
+	} else if (strcasecmp(scheme, "http") == 0) {
+		if (port == PORT_NOT_DEFINED) {
+			port = 3128;
+		}
+
+		type = PROXY_HTTP;
+	} else {
+		tlog(TLOG_ERROR, "invalid scheme %s", scheme);
+		return -1;
+	}
+
+	if (servers_name == NULL) {
+		tlog(TLOG_ERROR, "please set name");
+		goto errout;
+	}
+
+	if (_dns_conf_proxy_servers_add(servers_name, server) != 0) {
+		tlog(TLOG_ERROR, "add group failed.");
+		goto errout;
+	}
+
+	/* add new server */
+	server->type = type;
+	server->port = port;
+	server->use_domain = use_domain;
+	tlog(TLOG_DEBUG, "add proxy server %s", ip);
+
+	return 0;
+
+errout:
+	if (server) {
+		free(server);
+	}
+
+	return -1;
+}
+
 static radix_node_t *_create_addr_node(char *addr)
 {
 	radix_node_t *node = NULL;
@@ -1617,29 +1921,6 @@ static void _config_domain_set_name_table_destroy(void)
 	}
 }

-static void _config_domain_set_rule_table_destroy(void)
-{
-	struct dns_domain_set_rule_list *set_rule_list = NULL;
-	struct hlist_node *tmp = NULL;
-	struct dns_domain_set_rule *set_rule = NULL;
-	struct dns_domain_set_rule *tmp1 = NULL;
-	unsigned long i = 0;
-
-	hash_for_each_safe(dns_domain_set_rule_table.rule_list, i, tmp, set_rule_list, node)
-	{
-		hlist_del_init(&set_rule_list->node);
-		list_for_each_entry_safe(set_rule, tmp1, &set_rule_list->domain_ruls_list, list)
-		{
-			list_del(&set_rule->list);
-			if (set_rule->rule) {
-				_dns_rule_put(set_rule->rule);
-			}
-			free(set_rule);
-		}
-		free(set_rule_list);
-	}
-}
-
 static int _config_blacklist_ip(void *data, int argc, char *argv[])
 {
 	if (argc <= 1) {
@@ -1853,6 +2134,11 @@ static int _conf_domain_rule_no_serve_expired(const char *domain)
 	return _config_domain_rule_flag_set(domain, DOMAIN_FLAG_NO_SERVE_EXPIRED, 0);
 }

+static int _conf_domain_rule_delete(const char *domain)
+{
+	return _config_domain_rule_delete(domain);
+}
+
 static int _conf_domain_rules(void *data, int argc, char *argv[])
 {
 	int opt = 0;
@@ -1868,6 +2154,7 @@ static int _conf_domain_rules(void *data, int argc, char *argv[])
 		{"nameserver", required_argument, NULL, 'n'},
 		{"dualstack-ip-selection", required_argument, NULL, 'd'},
 		{"no-serve-expired", no_argument, NULL, 254},
+		{"delete", no_argument, NULL, 255},
 		{NULL, no_argument, NULL, 0}
 	};
 	/* clang-format on */
@@ -1972,6 +2259,14 @@ static int _conf_domain_rules(void *data, int argc, char *argv[])

 			break;
 		}
+		case 255: {
+			if (_conf_domain_rule_delete(domain) != 0) {
+				tlog(TLOG_ERROR, "delete domain rule failed.");
+				goto errout;
+			}
+
+			return 0;
+		}
 		default:
 			break;
 		}
@@ -2398,6 +2693,7 @@ static struct config_item _config_item[] = {
 	CONF_CUSTOM("server-https", _config_server_https, NULL),
 	CONF_CUSTOM("nameserver", _config_nameserver, NULL),
 	CONF_CUSTOM("address", _config_address, NULL),
+	CONF_CUSTOM("proxy-server", _config_proxy_server, NULL),
 	CONF_YESNO("ipset-timeout", &dns_conf_ipset_timeout_enable),
 	CONF_CUSTOM("ipset", _config_ipset, NULL),
 	CONF_YESNO("nftset-timeout", &dns_conf_nftset_timeout_enable),
@@ -2420,9 +2716,11 @@ static struct config_item _config_item[] = {
 	CONF_STRING("log-file", (char *)dns_conf_log_file, DNS_MAX_PATH),
 	CONF_SIZE("log-size", &dns_conf_log_size, 0, 1024 * 1024 * 1024),
 	CONF_INT("log-num", &dns_conf_log_num, 0, 1024),
+	CONF_INT_BASE("log-file-mode", &dns_conf_log_file_mode, 0, 511, 8),
 	CONF_YESNO("audit-enable", &dns_conf_audit_enable),
 	CONF_YESNO("audit-SOA", &dns_conf_audit_log_SOA),
 	CONF_STRING("audit-file", (char *)&dns_conf_audit_file, DNS_MAX_PATH),
+	CONF_INT_BASE("audit-file-mode", &dns_conf_audit_file_mode, 0, 511, 8),
 	CONF_SIZE("audit-size", &dns_conf_audit_size, 0, 1024 * 1024 * 1024),
 	CONF_INT("audit-num", &dns_conf_audit_num, 0, 1024),
 	CONF_INT("rr-ttl", &dns_conf_rr_ttl, 0, CONF_INT_MAX),
@@ -2450,7 +2748,7 @@ static struct config_item _config_item[] = {
 	CONF_YESNO("debug-save-fail-packet", &dns_save_fail_packet),
 	CONF_STRING("resolv-file", (char *)&dns_resolv_file, sizeof(dns_resolv_file)),
 	CONF_STRING("debug-save-fail-packet-dir", (char *)&dns_save_fail_packet_dir, sizeof(dns_save_fail_packet_dir)),
-	CONF_CUSTOM("conf-file", config_addtional_file, NULL),
+	CONF_CUSTOM("conf-file", config_additional_file, NULL),
 	CONF_END(),
 };

@@ -2471,7 +2769,7 @@ static int _conf_printf(const char *file, int lineno, int ret)
 	return 0;
 }

-int config_addtional_file(void *data, int argc, char *argv[])
+int config_additional_file(void *data, int argc, char *argv[])
 {
 	char *conf_file = NULL;
 	char file_path[DNS_MAX_PATH];
@@ -2507,96 +2805,6 @@ int config_addtional_file(void *data, int argc, char *argv[])
 	return load_conf(file_path, _config_item, _conf_printf);
 }

-static int _update_domain_set_from_list(const char *file, struct dns_domain_set_rule_list *set_rule_list)
-{
-	FILE *fp = NULL;
-	char line[MAX_LINE_LEN];
-	char domain[DNS_MAX_CNAME_LEN];
-	int ret = 0;
-	int line_no = 0;
-	int filed_num = 0;
-	struct dns_domain_set_rule *set_rule = NULL;
-
-	fp = fopen(file, "r");
-	if (fp == NULL) {
-		tlog(TLOG_WARN, "open file %s error, %s", file, strerror(errno));
-		return 0;
-	}
-
-	line_no = 0;
-	while (fgets(line, MAX_LINE_LEN, fp)) {
-		line_no++;
-		filed_num = sscanf(line, "%256s", domain);
-		if (filed_num <= 0) {
-			continue;
-		}
-
-		if (domain[0] == '#' || domain[0] == '\n') {
-			continue;
-		}
-
-		list_for_each_entry(set_rule, &set_rule_list->domain_ruls_list, list)
-		{
-			if (set_rule->type == DOMAIN_RULE_FLAGS) {
-				ret = _config_domain_rule_flag_set(domain, set_rule->flags, set_rule->is_clear_flag);
-			} else {
-				ret = _config_domain_rule_add(domain, set_rule->type, set_rule->rule);
-			}
-
-			if (ret != 0) {
-				tlog(TLOG_WARN, "process file %s failed at line %d.", file, line_no);
-				continue;
-			}
-		}
-	}
-
-	fclose(fp);
-	return ret;
-}
-
-static int _update_domain_set(void)
-{
-	struct dns_domain_set_rule_list *set_rule_list = NULL;
-
-	struct dns_domain_set_name_list *set_name_list = NULL;
-	struct dns_domain_set_name *set_name_item = NULL;
-
-	unsigned long i = 0;
-	uint32_t key = 0;
-
-	hash_for_each(dns_domain_set_rule_table.rule_list, i, set_rule_list, node)
-	{
-		key = hash_string(set_rule_list->domain_set);
-		hash_for_each_possible(dns_domain_set_name_table.names, set_name_list, node, key)
-		{
-			if (strcmp(set_name_list->name, set_rule_list->domain_set) == 0) {
-				break;
-			}
-		}
-
-		if (set_name_list == NULL) {
-			tlog(TLOG_WARN, "domain set %s not found.", set_rule_list->domain_set);
-			continue;
-		}
-
-		list_for_each_entry(set_name_item, &set_name_list->set_name_list, list)
-		{
-			switch (set_name_item->type) {
-			case DNS_DOMAIN_SET_LIST:
-				_update_domain_set_from_list(set_name_item->file, set_rule_list);
-				break;
-			case DNS_DOMAIN_SET_GEOSITE:
-				break;
-			default:
-				tlog(TLOG_WARN, "domain set %s type %d not support.", set_name_list->name, set_name_item->type);
-				break;
-			}
-		}
-	}
-
-	return 0;
-}
-
 static int _dns_server_load_conf_init(void)
 {
 	dns_conf_address_rule.ipv4 = New_Radix();
@@ -2614,7 +2822,6 @@ static int _dns_server_load_conf_init(void)
 	hash_init(dns_group_table.group);
 	hash_init(dns_hosts_table.hosts);
 	hash_init(dns_ptr_table.ptr);
-	hash_init(dns_domain_set_rule_table.rule_list);
 	hash_init(dns_domain_set_name_table.names);

 	return 0;
@@ -2631,6 +2838,7 @@ void dns_server_load_exit(void)
 	_config_ptr_table_destroy();
 	_config_host_table_destroy();
 	_config_qtype_soa_table_destroy();
+	_config_proxy_table_destroy();
 }

 static int _dns_conf_speed_check_mode_verify(void)
@@ -2671,7 +2879,7 @@ static int _dns_ping_cap_check(void)
 	has_ping = has_unprivileged_ping();
 	if (has_ping == 0) {
 		if (errno == EACCES && has_raw_cap == 0) {
-			tlog(TLOG_WARN, "unpriviledged ping is disabled, please enable by setting net.ipv4.ping_group_range");
+			tlog(TLOG_WARN, "unprivileged ping is disabled, please enable by setting net.ipv4.ping_group_range");
 		}
 	}

@@ -2725,9 +2933,7 @@ static int _dns_conf_load_post(void)
 		safe_strncpy(dns_resolv_file, DNS_RESOLV_FILE, sizeof(dns_resolv_file));
 	}

-	_update_domain_set();
 	_config_domain_set_name_table_destroy();
-	_config_domain_set_rule_table_destroy();

 	return 0;
 }
--- a/src/dns_conf.h
+++ b/src/dns_conf.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -27,6 +27,7 @@
 #include "hash.h"
 #include "hashtable.h"
 #include "list.h"
+#include "proxy.h"
 #include "radix.h"

 #ifdef __cpluscplus
@@ -41,9 +42,14 @@ extern "C" {
 #define DNS_MAX_NFTSET_FAMILYLEN 8
 #define DNS_MAX_NFTSET_NAMELEN 256
 #define DNS_GROUP_NAME_LEN 32
+
+#define PROXY_NAME_LEN 32
+#define PROXY_MAX_SERVERS 128
+
 #define DNS_NAX_GROUP_NUMBER 16
 #define DNS_MAX_IPLEN 64
-#define DNS_CONF_USRNAME_LEN 32
+#define DNS_PROXY_MAX_LEN 128
+#define DNS_CONF_USERNAME_LEN 32
 #define DNS_MAX_SPKI_LEN 64
 #define DNS_MAX_URL_LEN 256
 #define DNS_MAX_PATH 1024
@@ -114,7 +120,6 @@ typedef enum {
 struct dns_rule {
 	atomic_t refcnt;
 	enum domain_rule rule;
-	char rule_data[];
 };

 struct dns_rule_flags {
@@ -224,6 +229,17 @@ struct dns_hosts_table {
 extern struct dns_hosts_table dns_hosts_table;
 extern int dns_hosts_record_num;

+struct dns_proxy_names {
+	struct hlist_node node;
+	char proxy_name[PROXY_NAME_LEN];
+	struct list_head server_list;
+};
+
+struct dns_proxy_table {
+	DECLARE_HASHTABLE(proxy, 4);
+};
+extern struct dns_proxy_table dns_proxy_table;
+
 struct dns_servers {
 	char server[DNS_MAX_IPLEN];
 	unsigned short port;
@@ -238,6 +254,17 @@ struct dns_servers {
 	char httphost[DNS_MAX_CNAME_LEN];
 	char tls_host_verify[DNS_MAX_CNAME_LEN];
 	char path[DNS_MAX_URL_LEN];
+	char proxyname[PROXY_NAME_LEN];
+};
+
+struct dns_proxy_servers {
+	struct list_head list;
+	char server[DNS_MAX_IPLEN];
+	proxy_type_t type;
+	unsigned short port;
+	char username[DNS_PROXY_MAX_LEN];
+	char password[DNS_PROXY_MAX_LEN];
+	int use_domain;
 };

 /* ip address lists of domain */
@@ -301,17 +328,6 @@ struct dns_domain_set_rule {
 	unsigned int is_clear_flag;
 };

-struct dns_domain_set_rule_list {
-	struct hlist_node node;
-	char domain_set[DNS_MAX_CNAME_LEN];
-	struct list_head domain_ruls_list;
-};
-
-struct dns_domain_set_rule_table {
-	DECLARE_HASHTABLE(rule_list, 4);
-};
-extern struct dns_domain_set_rule_table dns_domain_set_rule_table;
-
 enum dns_domain_set_type {
 	DNS_DOMAIN_SET_LIST = 0,
 	DNS_DOMAIN_SET_GEOSITE = 1,
@@ -333,6 +349,16 @@ struct dns_domain_set_name_table {
 };
 extern struct dns_domain_set_name_table dns_domain_set_name_table;

+struct dns_set_rule_add_callback_args {
+	enum domain_rule type;
+	void *rule;
+};
+
+struct dns_set_rule_flags_callback_args {
+	unsigned int flags;
+	int is_clear_flag;
+};
+
 extern struct dns_bind_ip dns_conf_bind_ip[DNS_MAX_BIND_IP];
 extern int dns_conf_bind_ip_num;

@@ -346,10 +372,15 @@ extern int dns_conf_serve_expired_reply_ttl;
 extern struct dns_servers dns_conf_servers[DNS_MAX_SERVERS];
 extern int dns_conf_server_num;

+/* proxy servers */
+extern struct dns_proxy_servers dns_conf_proxy_servers[PROXY_MAX_SERVERS];
+extern int dns_conf_proxy_server_num;
+
 extern int dns_conf_log_level;
 extern char dns_conf_log_file[DNS_MAX_PATH];
 extern size_t dns_conf_log_size;
 extern int dns_conf_log_num;
+extern int dns_conf_log_file_mode;

 extern char dns_conf_ca_file[DNS_MAX_PATH];
 extern char dns_conf_ca_path[DNS_MAX_PATH];
@@ -367,6 +398,7 @@ extern int dns_conf_audit_log_SOA;
 extern char dns_conf_audit_file[DNS_MAX_PATH];
 extern size_t dns_conf_audit_size;
 extern int dns_conf_audit_num;
+extern int dns_conf_audit_file_mode;

 extern char dns_conf_server_name[DNS_MAX_SERVER_NAME_LEN];
 extern art_tree dns_conf_domain_rule;
@@ -396,7 +428,7 @@ extern int dns_conf_local_ttl;

 extern int dns_conf_force_no_cname;

-extern char dns_conf_user[DNS_CONF_USRNAME_LEN];
+extern char dns_conf_user[DNS_CONF_USERNAME_LEN];

 extern struct dns_edns_client_subnet dns_conf_ipv4_ecs;
 extern struct dns_edns_client_subnet dns_conf_ipv6_ecs;
@@ -413,7 +445,9 @@ int dns_server_load_conf(const char *file);

 int dns_server_check_update_hosts(void);

-extern int config_addtional_file(void *data, int argc, char *argv[]);
+struct dns_proxy_names *dns_server_get_proxy_nams(const char *proxyname);
+
+extern int config_additional_file(void *data, int argc, char *argv[]);
 #ifdef __cpluscplus
 }
 #endif
--- a/src/dns_server.c
+++ b/src/dns_server.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -34,6 +34,7 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <ifaddrs.h>
+#include <net/if.h>
 #include <netinet/ip.h>
 #include <netinet/tcp.h>
 #include <pthread.h>
@@ -42,6 +43,7 @@
 #include <string.h>
 #include <sys/epoll.h>
 #include <sys/eventfd.h>
+#include <sys/ioctl.h>
 #include <sys/socket.h>
 #include <sys/types.h>

@@ -58,8 +60,9 @@
 #define SOCKET_IP_TOS (IPTOS_LOWDELAY | IPTOS_RELIABILITY)
 #define SOCKET_PRIORITY (6)
 #define CACHE_AUTO_ENABLE_SIZE (1024 * 1024 * 128)
-#define EXPIRED_DOMAIN_PREFTCH_TIME (3600 * 8)
+#define EXPIRED_DOMAIN_PREFETCH_TIME (3600 * 8)
 #define DNS_MAX_DOMAIN_REFETCH_NUM 16
+#define DNS_WORKER_NUM 4

 #define RECV_ERROR_AGAIN 1
 #define RECV_ERROR_OK 0
@@ -250,9 +253,26 @@ struct dns_request {
 	struct dns_request_pending_list *request_pending_list;
 };

+struct dns_server_work_event {
+	struct list_head list;
+	struct dns_server_conn_head *conn;
+	unsigned char inpacket[DNS_IN_PACKSIZE];
+	int inpacket_len;
+	struct sockaddr_storage local;
+	socklen_t local_len;
+	struct sockaddr_storage from;
+	socklen_t from_len;
+};
+
 /* dns server data */
 struct dns_server {
 	atomic_t run;
+
+	pthread_t worker[DNS_WORKER_NUM];
+	pthread_mutex_t worker_notify_lock;
+	pthread_cond_t worker_notify_cond;
+	struct list_head work_list;
+
 	int epoll_fd;
 	int event_fd;
 	struct list_head conn_list;
@@ -277,10 +297,10 @@ static int _dns_server_get_answer(struct dns_server_post_context *context);
 static void _dns_server_request_get(struct dns_request *request);
 static void _dns_server_request_release(struct dns_request *request);
 static void _dns_server_request_release_complete(struct dns_request *request, int do_complete);
-static int _dns_server_reply_passthrouth(struct dns_server_post_context *context);
+static int _dns_server_reply_passthrough(struct dns_server_post_context *context);
 static int _dns_server_do_query(struct dns_request *request, int skip_notify_event);

-static void _dns_server_wakup_thread(void)
+static void _dns_server_wakeup_thread(void)
 {
 	uint64_t u = 1;
 	int unused __attribute__((unused));
@@ -325,7 +345,6 @@ static int _dns_server_epoll_ctl(struct dns_server_conn_head *head, int op, uint
 	event.data.ptr = head;

 	if (epoll_ctl(server.epoll_fd, op, head->fd, &event) != 0) {
-		tlog(TLOG_ERROR, "epoll ctl failed, fd = %d, %s", head->fd, strerror(errno));
 		return -1;
 	}

@@ -341,7 +360,7 @@ static void *_dns_server_get_dns_rule(struct dns_request *request, enum domain_r
 	return request->domain_rule.rules[rule];
 }

-static int _dns_server_is_dns_rule_extact_match(struct dns_request *request, enum domain_rule rule)
+static int _dns_server_is_dns_rule_extract_match(struct dns_request *request, enum domain_rule rule)
 {
 	if (rule >= DOMAIN_RULE_MAX || request == NULL) {
 		return 0;
@@ -603,7 +622,7 @@ static void _dns_server_audit_log(struct dns_server_post_context *context)
 		}
 	}

-	gethost_by_addr(req_host, sizeof(req_host), &request->addr);
+	get_host_by_addr(req_host, sizeof(req_host), &request->addr);
 	tlog_localtime(&tm);

 	if (req_host[0] == '\0') {
@@ -805,7 +824,7 @@ static int _dns_add_rrs(struct dns_server_post_context *context)
 	}

 	if (request->rcode != DNS_RC_NOERROR) {
-		tlog(TLOG_INFO, "result %s, qtype: %d, rtcode: %d", domain, context->qtype, request->rcode);
+		tlog(TLOG_INFO, "result: %s, qtype: %d, rtcode: %d", domain, context->qtype, request->rcode);
 	}

 	return ret;
@@ -1000,7 +1019,7 @@ static int _dns_server_reply_udp(struct dns_request *request, struct dns_server_
 use_send:
 	send_len = sendto(udpserver->head.fd, inpacket, inpacket_len, 0, &request->addr, request->addr_len);
 	if (send_len != inpacket_len) {
-		tlog(TLOG_ERROR, "send failed, %s", strerror(errno));
+		tlog(TLOG_DEBUG, "send failed, %s", strerror(errno));
 		return -1;
 	}

@@ -1594,7 +1613,7 @@ static int _dns_request_post(struct dns_server_post_context *context)

 	ret = _dns_reply_inpacket(request, context->inpacket, context->inpacket_len);
 	if (ret != 0) {
-		tlog(TLOG_WARN, "replay raw packet to client failed.");
+		tlog(TLOG_WARN, "reply raw packet to client failed.");
 		return -1;
 	}

@@ -1659,7 +1678,7 @@ static int _dns_server_reply_all_pending_list(struct dns_request *request, struc
 		context_pending.do_force_soa = context->do_force_soa;
 		context_pending.do_ipset = 0;
 		context_pending.reply_ttl = request->ip_ttl;
-		_dns_server_reply_passthrouth(&context_pending);
+		_dns_server_reply_passthrough(&context_pending);

 		req->request_pending_list = NULL;
 		list_del_init(&req->pending_list);
@@ -1706,7 +1725,7 @@ static int _dns_server_force_dualstack(struct dns_request *request)
 	}

 	/* if ipv4 is fasting than ipv6, add ipv4 to cache, and return SOA for AAAA request */
-	tlog(TLOG_INFO, "result: %s, qtype: %d, force %s perfered, id: %d, time1: %d, time2: %d", request->domain,
+	tlog(TLOG_INFO, "result: %s, qtype: %d, force %s preferred, id: %d, time1: %d, time2: %d", request->domain,
 		 request->qtype, request->qtype == DNS_T_AAAA ? "IPv4" : "IPv6", request->id, request->ping_time,
 		 request->dualstack_selection_ping_time);
 	request->dualstack_selection_force_soa = 1;
@@ -1717,7 +1736,7 @@ static int _dns_server_force_dualstack(struct dns_request *request)
 static int _dns_server_request_complete_with_all_IPs(struct dns_request *request, int with_all_ips)
 {
 	int ttl = 0;
-	int reply_ttl = ttl;
+	int reply_ttl = 0;

 	if (request->rcode == DNS_RC_SERVFAIL || request->rcode == DNS_RC_NXDOMAIN) {
 		ttl = DNS_SERVER_FAIL_TTL;
@@ -1837,7 +1856,7 @@ static int _dns_ip_address_check_add(struct dns_request *request, char *cname, u
 	addr_map = malloc(sizeof(*addr_map));
 	if (addr_map == NULL) {
 		pthread_mutex_unlock(&request->ip_map_lock);
-		tlog(TLOG_ERROR, "malloc addrmap failed");
+		tlog(TLOG_ERROR, "malloc addr map failed");
 		return -1;
 	}
 	memset(addr_map, 0, sizeof(*addr_map));
@@ -2388,7 +2407,7 @@ static int _dns_server_ip_rule_check(struct dns_request *request, unsigned char
 		goto rule_not_found;
 	}

-	/* bogux-nxdomain */
+	/* bogus-nxdomain */
 	rule = node->data;
 	if (rule->bogus) {
 		goto match;
@@ -2506,7 +2525,7 @@ static int _dns_server_process_answer_A(struct dns_rrs *rrs, struct dns_request
 		}
 	}

-	/* add this ip to reqeust */
+	/* add this ip to request */
 	if (_dns_ip_address_check_add(request, cname, addr, DNS_T_A) != 0) {
 		_dns_server_request_release(request);
 		return -1;
@@ -2583,7 +2602,7 @@ static int _dns_server_process_answer_AAAA(struct dns_rrs *rrs, struct dns_reque
 		}
 	}

-	/* add this ip to reqeust */
+	/* add this ip to request */
 	if (_dns_ip_address_check_add(request, cname, addr, DNS_T_AAAA) != 0) {
 		_dns_server_request_release(request);
 		return -1;
@@ -2870,7 +2889,7 @@ static int _dns_server_get_answer(struct dns_server_post_context *context)
 				}

 				memcpy(request->ip_addr, addr, DNS_RR_A_LEN);
-				/* add this ip to reqeust */
+				/* add this ip to request */
 				request->ip_ttl = _dns_server_get_conf_ttl(ttl);
 				request->has_ip = 1;
 				request->rcode = packet->head.rcode;
@@ -2950,7 +2969,7 @@ static int _dns_server_get_answer(struct dns_server_post_context *context)
 	return 0;
 }

-static int _dns_server_reply_passthrouth(struct dns_server_post_context *context)
+static int _dns_server_reply_passthrough(struct dns_server_post_context *context)
 {
 	struct dns_request *request = context->request;

@@ -3105,7 +3124,7 @@ static int dns_server_resolve_callback(const char *domain, dns_result_type rtype
 			context.do_reply = 1;
 			context.do_ipset = 1;
 			context.reply_ttl = ttl;
-			return _dns_server_reply_passthrouth(&context);
+			return _dns_server_reply_passthrough(&context);
 		}

 		if (request->prefetch == 0 && dns_conf_response_mode == DNS_RESPONSE_MODE_FASTEST_RESPONSE &&
@@ -3122,7 +3141,7 @@ static int dns_server_resolve_callback(const char *domain, dns_result_type rtype
 				context.reply_ttl = 2;
 				context.cache_ttl = 2;
 				context.no_check_add_ip = 1;
-				_dns_server_reply_passthrouth(&context);
+				_dns_server_reply_passthrough(&context);
 				request->cname[0] = 0;
 				request->has_ip = 0;
 				request->has_cname = 0;
@@ -3621,7 +3640,7 @@ static int _dns_server_pre_process_rule_flags(struct dns_request *request)
 	switch (request->qtype) {
 	case DNS_T_A:
 		if (flags & DOMAIN_FLAG_ADDR_IPV4_IGN) {
-			/* ignore this domain for A reqeust */
+			/* ignore this domain for A request */
 			goto out;
 		}

@@ -3632,7 +3651,7 @@ static int _dns_server_pre_process_rule_flags(struct dns_request *request)
 		break;
 	case DNS_T_AAAA:
 		if (flags & DOMAIN_FLAG_ADDR_IPV6_IGN) {
-			/* ignore this domain for A reqeust */
+			/* ignore this domain for A request */
 			goto out;
 		}

@@ -3839,7 +3858,7 @@ static int _dns_server_process_cache_packet(struct dns_request *request, struct
 	context.do_reply = 1;
 	context.reply_ttl = _dns_server_get_expired_ttl_reply(dns_cache);

-	return _dns_server_reply_passthrouth(&context);
+	return _dns_server_reply_passthrough(&context);
 }

 static int _dns_server_process_cache_data(struct dns_request *request, struct dns_cache *dns_cache)
@@ -3925,7 +3944,7 @@ static int _dns_server_process_cache(struct dns_request *request)
 			if ((dualstack_dns_cache->info.speed + (dns_conf_dualstack_ip_selection_threshold * 10)) <
 					dns_cache->info.speed ||
 				dns_cache->info.speed < 0) {
-				tlog(TLOG_DEBUG, "cache result: %s, qtype: %d, force %s perfered, id: %d, time1: %d, time2: %d",
+				tlog(TLOG_DEBUG, "cache result: %s, qtype: %d, force %s preferred, id: %d, time1: %d, time2: %d",
 					 request->domain, request->qtype, request->qtype == DNS_T_AAAA ? "IPv4" : "IPv6", request->id,
 					 dns_cache->info.speed, dualstack_dns_cache->info.speed);
 				ret = _dns_server_reply_SOA(DNS_RC_NOERROR, request);
@@ -4094,7 +4113,7 @@ static int _dns_server_process_smartdns_domain(struct dns_request *request)
 		return -1;
 	}

-	if (_dns_server_is_dns_rule_extact_match(request, DOMAIN_RULE_FLAGS) == 0) {
+	if (_dns_server_is_dns_rule_extract_match(request, DOMAIN_RULE_FLAGS) == 0) {
 		return -1;
 	}

@@ -4132,7 +4151,7 @@ static int _dns_server_process_special_query(struct dns_request *request)

 		break;
 	default:
-		tlog(TLOG_DEBUG, "unsupport qtype: %d, domain: %s", request->qtype, request->domain);
+		tlog(TLOG_DEBUG, "unsupported qtype: %d, domain: %s", request->qtype, request->domain);
 		request->passthrough = 1;
 		/* pass request to upstream server */
 		break;
@@ -4389,7 +4408,7 @@ static int _dns_server_do_query(struct dns_request *request, int skip_notify_eve

 	pthread_mutex_lock(&server.request_list_lock);
 	if (list_empty(&server.request_list) && skip_notify_event == 1) {
-		_dns_server_wakup_thread();
+		_dns_server_wakeup_thread();
 	}
 	list_add_tail(&request->list, &server.request_list);
 	pthread_mutex_unlock(&server.request_list_lock);
@@ -4487,9 +4506,9 @@ errout:
 	return -1;
 }

-static int _dns_server_recv(struct dns_server_conn_head *conn, unsigned char *inpacket, int inpacket_len,
-							struct sockaddr_storage *local, socklen_t local_len, struct sockaddr_storage *from,
-							socklen_t from_len)
+static int _dns_server_process_work(struct dns_server_conn_head *conn, unsigned char *inpacket, int inpacket_len,
+									struct sockaddr_storage *local, socklen_t local_len, struct sockaddr_storage *from,
+									socklen_t from_len)
 {
 	int decode_len = 0;
 	int ret = -1;
@@ -4500,7 +4519,7 @@ static int _dns_server_recv(struct dns_server_conn_head *conn, unsigned char *in

 	/* decode packet */
 	tlog(TLOG_DEBUG, "recv query packet from %s, len = %d, type = %d",
-		 gethost_by_addr(name, sizeof(name), (struct sockaddr *)from), inpacket_len, conn->type);
+		 get_host_by_addr(name, sizeof(name), (struct sockaddr *)from), inpacket_len, conn->type);
 	decode_len = dns_decode(packet, DNS_PACKSIZE, inpacket, inpacket_len);
 	if (decode_len < 0) {
 		tlog(TLOG_DEBUG, "decode failed.\n");
@@ -4534,7 +4553,7 @@ static int _dns_server_recv(struct dns_server_conn_head *conn, unsigned char *in
 		goto errout;
 	}

-	tlog(TLOG_INFO, "query server %s from %s, qtype = %d\n", request->domain, name, request->qtype);
+	tlog(TLOG_INFO, "query server %s from %s, qtype: %d\n", request->domain, name, request->qtype);

 	ret = _dns_server_do_query(request, 1);
 	if (ret != 0) {
@@ -4552,6 +4571,34 @@ errout:
 	return ret;
 }

+static int _dns_server_recv(struct dns_server_conn_head *conn, unsigned char *inpacket, int inpacket_len,
+							struct sockaddr_storage *local, socklen_t local_len, struct sockaddr_storage *from,
+							socklen_t from_len)
+{
+	struct dns_server_work_event *event = NULL;
+	event = (struct dns_server_work_event *)malloc(sizeof(struct dns_server_work_event));
+	if (event == NULL) {
+		tlog(TLOG_ERROR, "malloc failed.\n");
+		return -1;
+	}
+	memset(event, 0, sizeof(struct dns_server_work_event));
+	event->conn = conn;
+	memcpy(event->inpacket, inpacket, inpacket_len);
+	event->inpacket_len = inpacket_len;
+	memcpy(&event->local, local, local_len);
+	event->local_len = local_len;
+	memcpy(&event->from, from, from_len);
+	event->from_len = from_len;
+	INIT_LIST_HEAD(&event->list);
+
+	pthread_mutex_lock(&server.worker_notify_lock);
+	list_add_tail(&event->list, &server.work_list);
+	pthread_mutex_unlock(&server.worker_notify_lock);
+	pthread_cond_signal(&server.worker_notify_cond);
+
+	return 0;
+}
+
 static int _dns_server_setup_server_query_options(struct dns_request *request,
 												  struct dns_server_query_option *server_query_option)
 {
@@ -4736,7 +4783,7 @@ static int _dns_server_tcp_accept(struct dns_server_conn_tcp_server *tcpserver,
 		return -1;
 	}

-	if (getsocknet_inet(tcpclient->head.fd, (struct sockaddr *)&tcpclient->localaddr, &tcpclient->localaddr_len) != 0) {
+	if (getsocket_inet(tcpclient->head.fd, (struct sockaddr *)&tcpclient->localaddr, &tcpclient->localaddr_len) != 0) {
 		tlog(TLOG_ERROR, "get local addr failed, %s", strerror(errno));
 		goto errout;
 	}
@@ -4774,6 +4821,10 @@ static int _dns_server_tcp_recv(struct dns_server_conn_tcp_client *tcpclient)
 				return RECV_ERROR_AGAIN;
 			}

+			if (errno == ECONNRESET) {
+				return RECV_ERROR_CLOSE;
+			}
+
 			tlog(TLOG_ERROR, "recv failed, %s\n", strerror(errno));
 			return RECV_ERROR_FAIL;
 		} else if (len == 0) {
@@ -4806,7 +4857,7 @@ static int _dns_server_tcp_process_one_request(struct dns_server_conn_tcp_client
 		request_len = ntohs(*((unsigned short *)(request_data)));

 		if (request_len >= sizeof(tcpclient->recvbuff.buf)) {
-			tlog(TLOG_ERROR, "request length is invalid.");
+			tlog(TLOG_DEBUG, "request length is invalid.");
 			return RECV_ERROR_FAIL;
 		}

@@ -4859,7 +4910,7 @@ static int _dns_server_tcp_process_requests(struct dns_server_conn_tcp_client *t
 		request_ret = _dns_server_tcp_process_one_request(tcpclient);
 		if (request_ret < 0) {
 			/* failed */
-			tlog(TLOG_ERROR, "process one request failed.");
+			tlog(TLOG_DEBUG, "process one request failed.");
 			return RECV_ERROR_FAIL;
 		}

@@ -4914,7 +4965,7 @@ static int _dns_server_process_tcp(struct dns_server_conn_tcp_client *dnsserver,
 			if (ret == RECV_ERROR_CLOSE) {
 				return 0;
 			}
-			tlog(TLOG_ERROR, "process tcp request failed.");
+			tlog(TLOG_DEBUG, "process tcp request failed.");
 			return RECV_ERROR_FAIL;
 		}
 	}
@@ -4922,7 +4973,7 @@ static int _dns_server_process_tcp(struct dns_server_conn_tcp_client *dnsserver,
 	if (event->events & EPOLLOUT) {
 		if (_dns_server_tcp_send(dnsserver) != 0) {
 			_dns_server_client_close(&dnsserver->head);
-			tlog(TLOG_ERROR, "send tcp failed.");
+			tlog(TLOG_DEBUG, "send tcp failed.");
 			return RECV_ERROR_FAIL;
 		}
 	}
@@ -4946,14 +4997,14 @@ static int _dns_server_process(struct dns_server_conn_head *conn, struct epoll_e
 		ret = _dns_server_process_tcp(tcpclient, event, now);
 		if (ret != 0) {
 			char name[DNS_MAX_CNAME_LEN];
-			tlog(TLOG_ERROR, "process TCP packet from %s failed.",
-				 gethost_by_addr(name, sizeof(name), (struct sockaddr *)&tcpclient->addr));
+			tlog(TLOG_DEBUG, "process TCP packet from %s failed.",
+				 get_host_by_addr(name, sizeof(name), (struct sockaddr *)&tcpclient->addr));
 		}
 	} else if (conn->type == DNS_CONN_TYPE_TLS_SERVER) {
-		tlog(TLOG_ERROR, "unsupport dns server type %d", conn->type);
+		tlog(TLOG_ERROR, "unsupported dns server type %d", conn->type);
 		ret = -1;
 	} else {
-		tlog(TLOG_ERROR, "unsupport dns server type %d", conn->type);
+		tlog(TLOG_ERROR, "unsupported dns server type %d", conn->type);
 		ret = -1;
 	}
 	_dns_server_conn_release(conn);
@@ -5099,8 +5150,8 @@ static void _dns_server_period_run_second(void)

 				if (prefetch_time == 0) {
 					prefetch_time = dns_conf_serve_expired_ttl / 2;
-					if (prefetch_time == 0 || prefetch_time > EXPIRED_DOMAIN_PREFTCH_TIME) {
-						prefetch_time = EXPIRED_DOMAIN_PREFTCH_TIME;
+					if (prefetch_time == 0 || prefetch_time > EXPIRED_DOMAIN_PREFETCH_TIME) {
+						prefetch_time = EXPIRED_DOMAIN_PREFETCH_TIME;
 					}
 				}
 				dns_cache_invalidate(NULL, 0, DNS_MAX_DOMAIN_REFETCH_NUM, _dns_server_prefetch_expired_domain,
@@ -5132,7 +5183,7 @@ static void _dns_server_period_run(unsigned int msec)
 	struct dns_request *tmp = NULL;
 	LIST_HEAD(check_list);

-	if (msec % 10 == 0) {
+	if ((msec % 10) == 0) {
 		_dns_server_period_run_second();
 	}

@@ -5193,6 +5244,34 @@ static void _dns_server_close_socket_server(void)
 	}
 }

+static void *_dns_server_worker(void *args)
+{
+	struct dns_server_work_event *work_event = NULL;
+
+	while (atomic_read(&server.run)) {
+		pthread_mutex_lock(&server.worker_notify_lock);
+		if (list_empty(&server.work_list)) {
+			pthread_cond_wait(&server.worker_notify_cond, &server.worker_notify_lock);
+		}
+
+		work_event = list_first_entry_or_null(&server.work_list, struct dns_server_work_event, list);
+		if (work_event) {
+			list_del_init(&work_event->list);
+		}
+		pthread_mutex_unlock(&server.worker_notify_lock);
+
+		if (work_event == NULL) {
+			continue;
+		}
+
+		_dns_server_process_work(work_event->conn, work_event->inpacket, work_event->inpacket_len, &work_event->local,
+								 work_event->local_len, &work_event->from, work_event->from_len);
+		free(work_event);
+	}
+
+	return NULL;
+}
+
 int dns_server_run(void)
 {
 	struct epoll_event events[DNS_MAX_EVENTS + 1];
@@ -5222,11 +5301,12 @@ int dns_server_run(void)
 			expect_time -= cnt * sleep;
 			sleep_time -= cnt * sleep;
 		}
-		last = now;

 		if (now >= expect_time) {
 			msec++;
-			_dns_server_period_run(msec);
+			if (last != now) {
+				_dns_server_period_run(msec);
+			}
 			sleep_time = sleep - (now - expect_time);
 			if (sleep_time < 0) {
 				sleep_time = 0;
@@ -5245,6 +5325,7 @@ int dns_server_run(void)
 			pthread_mutex_unlock(&server.request_list_lock);
 			expect_time += sleep;
 		}
+		last = now;

 		num = epoll_wait(server.epoll_fd, events, DNS_MAX_EVENTS, sleep_time);
 		if (num < 0) {
@@ -5333,14 +5414,23 @@ static int _dns_create_socket(const char *host_ip, int type)
 	struct addrinfo *gai = NULL;
 	char port_str[8];
 	char ip[MAX_IP_LEN];
+	char host_ip_device[MAX_IP_LEN * 2];
 	int port = 0;
 	char *host = NULL;
 	int optval = 1;
 	int yes = 1;
 	const int priority = SOCKET_PRIORITY;
 	const int ip_tos = SOCKET_IP_TOS;
+	const char *ifname = NULL;

-	if (parse_ip(host_ip, ip, &port) == 0) {
+	safe_strncpy(host_ip_device, host_ip, sizeof(host_ip_device));
+	ifname = strstr(host_ip_device, "@");
+	if (ifname) {
+		*(char *)ifname = '\0';
+		ifname++;
+	}
+
+	if (parse_ip(host_ip_device, ip, &port) == 0) {
 		host = ip;
 	}

@@ -5375,6 +5465,17 @@ static int _dns_create_socket(const char *host_ip, int type)
 	setsockopt(fd, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority));
 	setsockopt(fd, IPPROTO_IP, IP_TOS, &ip_tos, sizeof(ip_tos));

+	if (ifname != NULL) {
+		struct ifreq ifr;
+		memset(&ifr, 0, sizeof(struct ifreq));
+		safe_strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
+		ioctl(fd, SIOCGIFINDEX, &ifr);
+		if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, (void *)&ifr, sizeof(struct ifreq)) < 0) {
+			tlog(TLOG_ERROR, "bind socket to device %s failed, %s\n", ifr.ifr_name, strerror(errno));
+			goto errout;
+		}
+	}
+
 	if (bind(fd, gai->ai_addr, gai->ai_addrlen) != 0) {
 		tlog(TLOG_ERROR, "bind service %s failed, %s\n", host_ip, strerror(errno));
 		goto errout;
@@ -5532,6 +5633,10 @@ static int _dns_server_audit_init(void)
 		return -1;
 	}

+	if (dns_conf_audit_file_mode > 0) {
+		tlog_set_permission(dns_audit, dns_conf_audit_file_mode, dns_conf_audit_file_mode);
+	}
+
 	return 0;
 }

@@ -5651,7 +5756,10 @@ int dns_server_init(void)
 	}

 	pthread_mutex_init(&server.request_list_lock, NULL);
+	pthread_mutex_init(&server.worker_notify_lock, NULL);
+	pthread_cond_init(&server.worker_notify_cond, NULL);
 	INIT_LIST_HEAD(&server.request_list);
+	INIT_LIST_HEAD(&server.work_list);
 	server.epoll_fd = epollfd;
 	atomic_set(&server.run, 1);

@@ -5669,6 +5777,14 @@ int dns_server_init(void)
 		goto errout;
 	}

+	for (int i = 0; i < DNS_WORKER_NUM; i++) {
+		ret = pthread_create(&server.worker[i], &attr, _dns_server_worker, NULL);
+		if (ret != 0) {
+			tlog(TLOG_ERROR, "create server work thread failed, %s\n", strerror(ret));
+			goto errout;
+		}
+	}
+
 	return 0;
 errout:
 	atomic_set(&server.run, 0);
@@ -5688,7 +5804,7 @@ errout:
 void dns_server_stop(void)
 {
 	atomic_set(&server.run, 0);
-	_dns_server_wakup_thread();
+	_dns_server_wakeup_thread();
 }

 void dns_server_exit(void)
@@ -5697,6 +5813,15 @@ void dns_server_exit(void)
 		close(server.event_fd);
 		server.event_fd = -1;
 	}
+
+	for (int i = 0; i < DNS_WORKER_NUM; i++) {
+		if (server.worker[i]) {
+			pthread_cond_broadcast(&server.worker_notify_cond);
+			pthread_join(server.worker[i], NULL);
+			server.worker[i] = 0;
+		}
+	}
+
 	_dns_server_close_socket();
 	_dns_server_cache_save();
 	_dns_server_request_remove_all();
--- a/src/dns_server.h
+++ b/src/dns_server.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/fast_ping.c
+++ b/src/fast_ping.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -63,8 +63,8 @@ struct ping_dns_head {
 	unsigned short flag;
 	unsigned short qdcount;
 	unsigned short ancount;
-	unsigned short aucount;
-	unsigned short adcount;
+	unsigned short nscount;
+	unsigned short nrcount;
 	char qd_name;
 	unsigned short q_qtype;
 	unsigned short q_qclass;
@@ -171,7 +171,7 @@ static int bool_print_log = 1;

 static void _fast_ping_host_put(struct ping_host_struct *ping_host);

-static void _fast_ping_wakup_thread(void)
+static void _fast_ping_wakeup_thread(void)
 {
 	uint64_t u = 1;
 	int unused __attribute__((unused));
@@ -521,11 +521,11 @@ static int _fast_ping_sendping_v6(struct ping_host_struct *ping_host)
 				 ping_host->addr_len);
 	if (len < 0 || len != sizeof(struct fast_ping_packet)) {
 		int err = errno;
-		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL) {
+		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL || errno == EHOSTUNREACH) {
 			goto errout;
 		}

-		if (errno == EACCES) {
+		if (errno == EACCES || errno == EPERM) {
 			if (bool_print_log == 0) {
 				goto errout;
 			}
@@ -534,7 +534,7 @@ static int _fast_ping_sendping_v6(struct ping_host_struct *ping_host)

 		char ping_host_name[PING_MAX_HOSTLEN];
 		tlog(TLOG_ERROR, "sendto %s, id %d, %s",
-			 gethost_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
+			 get_host_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
 			 ping_host->sid, strerror(err));
 		goto errout;
 	}
@@ -569,12 +569,12 @@ static int _fast_ping_sendping_v4(struct ping_host_struct *ping_host)
 	len = sendto(ping.fd_icmp, packet, sizeof(struct fast_ping_packet), 0, &ping_host->addr, ping_host->addr_len);
 	if (len < 0 || len != sizeof(struct fast_ping_packet)) {
 		int err = errno;
-		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL) {
+		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL || errno == EPERM || errno == EACCES) {
 			goto errout;
 		}
 		char ping_host_name[PING_MAX_HOSTLEN];
 		tlog(TLOG_ERROR, "sendto %s, id %d, %s",
-			 gethost_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
+			 get_host_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
 			 ping_host->sid, strerror(err));
 		goto errout;
 	}
@@ -621,12 +621,12 @@ static int _fast_ping_sendping_udp(struct ping_host_struct *ping_host)
 	len = sendto(fd, &dns_head, sizeof(dns_head), 0, &ping_host->addr, ping_host->addr_len);
 	if (len < 0 || len != sizeof(dns_head)) {
 		int err = errno;
-		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL) {
+		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL || errno == EPERM || errno == EACCES) {
 			goto errout;
 		}
 		char ping_host_name[PING_MAX_HOSTLEN];
 		tlog(TLOG_ERROR, "sendto %s, id %d, %s",
-			 gethost_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
+			 get_host_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
 			 ping_host->sid, strerror(err));
 		goto errout;
 	}
@@ -668,11 +668,11 @@ static int _fast_ping_sendping_tcp(struct ping_host_struct *ping_host)
 	if (connect(fd, &ping_host->addr, ping_host->addr_len) != 0) {
 		if (errno != EINPROGRESS) {
 			char ping_host_name[PING_MAX_HOSTLEN];
-			if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL) {
+			if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL || errno == EHOSTUNREACH) {
 				goto errout;
 			}

-			if (errno == EACCES) {
+			if (errno == EACCES || errno == EPERM) {
 				if (bool_print_log == 0) {
 					goto errout;
 				}
@@ -680,7 +680,7 @@ static int _fast_ping_sendping_tcp(struct ping_host_struct *ping_host)
 			}

 			tlog(TLOG_ERROR, "connect %s, id %d, %s",
-				 gethost_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
+				 get_host_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
 				 ping_host->sid, strerror(errno));
 			goto errout;
 		}
@@ -1205,7 +1205,7 @@ struct ping_host_struct *fast_ping_start(PING_TYPE type, const char *host, int c
 	pthread_mutex_lock(&ping.map_lock);
 	_fast_ping_host_get(ping_host);
 	if (hash_empty(ping.addrmap)) {
-		_fast_ping_wakup_thread();
+		_fast_ping_wakeup_thread();
 	}
 	hash_add(ping.addrmap, &ping_host->addr_node, addrkey);
 	ping_host->run = 1;
@@ -1326,7 +1326,7 @@ static struct fast_ping_packet *_fast_ping_icmp_packet(struct ping_host_struct *

 	if (ping.no_unprivileged_ping) {
 		if (ip->ip_p != IPPROTO_ICMP) {
-			tlog(TLOG_ERROR, "ip type faild, %d:%d", ip->ip_p, IPPROTO_ICMP);
+			tlog(TLOG_ERROR, "ip type failed, %d:%d", ip->ip_p, IPPROTO_ICMP);
 			return NULL;
 		}

@@ -1407,7 +1407,7 @@ static int _fast_ping_process_icmp(struct ping_host_struct *ping_host, struct ti
 		}

 		tlog(TLOG_DEBUG, "recv ping packet from %s failed.",
-			 gethost_by_addr(name, sizeof(name), (struct sockaddr *)&from));
+			 get_host_by_addr(name, sizeof(name), (struct sockaddr *)&from));
 		goto errout;
 	}

@@ -1780,10 +1780,11 @@ static void *_fast_ping_work(void *arg)
 				sleep_time = 0;
 			}
 		}
-		last = now;

 		if (now >= expect_time) {
-			_fast_ping_period_run();
+			if (last != now) {
+				_fast_ping_period_run();
+			}
 			sleep_time = sleep - (now - expect_time);
 			if (sleep_time < 0) {
 				sleep_time = 0;
@@ -1791,6 +1792,7 @@ static void *_fast_ping_work(void *arg)
 			}
 			expect_time += sleep;
 		}
+		last = now;

 		pthread_mutex_lock(&ping.map_lock);
 		if (hash_empty(ping.addrmap)) {
@@ -1899,7 +1901,7 @@ int fast_ping_init(void)

 	ret = pthread_create(&ping.notify_tid, &attr, _fast_ping_notify_worker, NULL);
 	if (ret != 0) {
-		tlog(TLOG_ERROR, "create ping notifyer work thread failed, %s\n", strerror(ret));
+		tlog(TLOG_ERROR, "create ping notifier work thread failed, %s\n", strerror(ret));
 		goto errout;
 	}

@@ -1923,7 +1925,7 @@ errout:
 	if (ping.tid) {
 		void *retval = NULL;
 		atomic_set(&ping.run, 0);
-		_fast_ping_wakup_thread();
+		_fast_ping_wakeup_thread();
 		pthread_join(ping.tid, &retval);
 		ping.tid = 0;
 	}
@@ -1982,7 +1984,7 @@ void fast_ping_exit(void)
 	if (ping.tid) {
 		void *ret = NULL;
 		atomic_set(&ping.run, 0);
-		_fast_ping_wakup_thread();
+		_fast_ping_wakeup_thread();
 		pthread_join(ping.tid, &ret);
 		ping.tid = 0;
 	}
--- a/src/fast_ping.h
+++ b/src/fast_ping.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/http_parse.c
+++ b/src/http_parse.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/http_parse.h
+++ b/src/http_parse.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/atomic.h
+++ b/src/include/atomic.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/bitmap.h
+++ b/src/include/bitmap.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/bitops.h
+++ b/src/include/bitops.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/conf.h
+++ b/src/include/conf.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -21,7 +21,7 @@

 #include <unistd.h>

-#define MAX_LINE_LEN 1024
+#define MAX_LINE_LEN 8192
 #define MAX_KEY_LEN 64
 #define CONF_INT_MAX (~(1 << 31))
 #define CONF_INT_MIN (1 << 31)
@@ -49,6 +49,13 @@ struct config_item_int {
 	int max;
 };

+struct config_item_int_base {
+	int *data;
+	int min;
+	int max;
+	int base;
+};
+
 struct config_item_string {
 	char *data;
 	size_t size;
@@ -81,6 +88,13 @@ struct config_enum {
 			.data = value, .min = min_value, .max = max_value                                                          \
 		}                                                                                                              \
 	}
+#define CONF_INT_BASE(key, value, min_value, max_value, base_value)                                                    \
+	{                                                                                                                  \
+		key, conf_int_base, &(struct config_item_int_base)                                                             \
+		{                                                                                                              \
+			.data = value, .min = min_value, .max = max_value, .base = base_value                                      \
+		}                                                                                                              \
+	}
 #define CONF_STRING(key, value, len_value)                                                                             \
 	{                                                                                                                  \
 		key, conf_string, &(struct config_item_string)                                                                 \
@@ -131,6 +145,8 @@ extern int conf_custom(const char *item, void *data, int argc, char *argv[]);

 extern int conf_int(const char *item, void *data, int argc, char *argv[]);

+extern int conf_int_base(const char *item, void *data, int argc, char *argv[]);
+
 extern int conf_string(const char *item, void *data, int argc, char *argv[]);

 extern int conf_yesno(const char *item, void *data, int argc, char *argv[]);
--- a/src/include/findbit.h
+++ b/src/include/findbit.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/gcc_builtin.h
+++ b/src/include/gcc_builtin.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/hash.h
+++ b/src/include/hash.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/hashtable.h
+++ b/src/include/hashtable.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/jhash.h
+++ b/src/include/jhash.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/list.h
+++ b/src/include/list.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/rbtree.h
+++ b/src/include/rbtree.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/stringutil.h
+++ b/src/include/stringutil.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/lib/art.c
+++ b/src/lib/art.c
@@ -1090,7 +1090,7 @@ void art_substring_walk(const art_tree *t, const unsigned char *str, int str_len
            // Check if the expanded path matches
            if (!str_prefix_matches((art_leaf*)n, str, str_len)) {
                found = (art_leaf*)n;
-				stop_search = func(found->key, found->key_len, found->key_len != (uint32_t)str_len, found->value, arg);
+				func(found->key, found->key_len, found->key_len != (uint32_t)str_len, found->value, arg);
 			}
            break;
        }
--- a/src/lib/bitops.c
+++ b/src/lib/bitops.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -24,7 +24,7 @@
 * find_next_and_bit. The differences are:
 *  - The "invert" argument, which is XORed with each fetched word before
 *    searching it for one bits.
- *  - The optional "addr2", which is anded with "addr1" if present.
+ *  - The optional "addr2", which is addr2 with "addr1" if present.
 */
 static inline unsigned long _find_next_bit(const unsigned long *addr1,
 		const unsigned long *addr2, unsigned long nbits,
--- a/src/lib/conf.c
+++ b/src/lib/conf.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -87,6 +87,27 @@ int conf_int(const char *item, void *data, int argc, char *argv[])
 	return 0;
 }

+int conf_int_base(const char *item, void *data, int argc, char *argv[])
+{
+	struct config_item_int_base *item_int = data;
+	int value = 0;
+	if (argc < 2) {
+		return -1;
+	}
+
+	value = strtol(argv[1], NULL, item_int->base);
+
+	if (value < item_int->min) {
+		value = item_int->min;
+	} else if (value > item_int->max) {
+		value = item_int->max;
+	}
+
+	*(item_int->data) = value;
+
+	return 0;
+}
+
 int conf_string(const char *item, void *data, int argc, char *argv[])
 {
 	struct config_item_string *item_string = data;
@@ -278,7 +299,7 @@ static int load_conf_printf(const char *file, int lineno, int ret)
 static int load_conf_file(const char *file, struct config_item *items, conf_error_handler handler)
 {
 	FILE *fp = NULL;
-	char line[MAX_LINE_LEN];
+	char line[MAX_LINE_LEN + MAX_KEY_LEN];
 	char key[MAX_KEY_LEN];
 	char value[MAX_LINE_LEN];
 	int filed_num = 0;
@@ -288,6 +309,8 @@ static int load_conf_file(const char *file, struct config_item *items, conf_erro
 	int ret = 0;
 	int call_ret = 0;
 	int line_no = 0;
+	int line_len = 0;
+	int read_len = 0;

 	if (handler == NULL) {
 		handler = load_conf_printf;
@@ -299,9 +322,17 @@ static int load_conf_file(const char *file, struct config_item *items, conf_erro
 	}

 	line_no = 0;
-	while (fgets(line, MAX_LINE_LEN, fp)) {
+	while (fgets(line + line_len, MAX_LINE_LEN - line_len, fp)) {
 		line_no++;
-		filed_num = sscanf(line, "%63s %1023[^\r\n]s", key, value);
+		read_len = strnlen(line + line_len, sizeof(line));
+		if (read_len >= 2 && *(line + line_len + read_len - 2) == '\\') {
+			line_len += read_len - 2;
+			line[line_len] = '\0';
+			continue;
+		}
+		line_len = 0;
+
+		filed_num = sscanf(line, "%63s %8192[^\r\n]s", key, value);
 		if (filed_num <= 0) {
 			continue;
 		}
--- a/src/lib/nftset.c
+++ b/src/lib/nftset.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2022 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -89,7 +89,9 @@ static int _nftset_addattr(struct nlmsghdr *n, int maxlen, __u16 type, const voi

 	void *rta_data = RTA_DATA(attr);

-	memcpy(rta_data, data, alen);
+	if ((data != NULL) && (alen > 0)) {
+		memcpy(rta_data, data, alen);
+	}
 	memset((uint8_t *)rta_data + alen, 0, RTA_ALIGN(len) - len);

 	n->nlmsg_len = newlen;
@@ -202,7 +204,6 @@ static int _nftset_socket_request(void *msg, int msg_len, void *ret_msg, int ret
 	int ret = -1;
 	struct pollfd pfds;
 	int do_recv = 0;
-	int last_errno = 0;
 	int len = 0;

 	if (_nftset_socket_init() != 0) {
@@ -260,10 +261,6 @@ static int _nftset_socket_request(void *msg, int msg_len, void *ret_msg, int ret
 				break;
 			}

-			if (errno == EAGAIN && last_errno != 0) {
-				errno = last_errno;
-			}
-
 			return -1;
 		}

@@ -275,7 +272,6 @@ static int _nftset_socket_request(void *msg, int msg_len, void *ret_msg, int ret
 			struct nlmsgerr *err = (struct nlmsgerr *)NLMSG_DATA(nlh);
 			if (err->error != 0) {
 				errno = -err->error;
-				last_errno = errno;
 				return -1;
 			}

--- a/src/lib/radix.c
+++ b/src/lib/radix.c
@@ -436,8 +436,10 @@ radix_node_t

 		node->parent = new_node;
 	} else {
-		if ((glue = malloc(sizeof(*glue))) == NULL)
+		if ((glue = malloc(sizeof(*glue))) == NULL) {
+			free(new_node);
 			return (NULL);
+		}
 		memset(glue, '\0', sizeof(*glue));
 		glue->bit = differ_bit;
 		glue->prefix = NULL;
--- a/src/lib/rbtree.c
+++ b/src/lib/rbtree.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/lib/stringutil.c
+++ b/src/lib/stringutil.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/proxy.c
+++ b/src/proxy.c
--- a/src/proxy.h
+++ b/src/proxy.h
@@ -0,0 +1,88 @@
+/*************************************************************************
+ *
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ *
+ * smartdns is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * smartdns is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef SMART_DNS_PROXY_H
+#define SMART_DNS_PROXY_H
+
+#include <sys/socket.h>
+#include <sys/types.h>
+
+#define PROXY_MAX_IPLEN 256
+#define PROXY_MAX_NAMELEN 128
+
+#ifdef __cplusplus
+extern "C" {
+#endif /*__cplusplus */
+
+typedef enum {
+	PROXY_SOCKS5,
+	PROXY_HTTP,
+	PROXY_TYPE_END,
+} proxy_type_t;
+
+typedef enum {
+	PROXY_HANDSHAKE_ERR = -1,
+	PROXY_HANDSHAKE_OK = 0,
+	PROXY_HANDSHAKE_CONNECTED = 1,
+	PROXY_HANDSHAKE_WANT_READ = 2,
+	PROXY_HANDSHAKE_WANT_WRITE = 3,
+} proxy_handshake_state;
+
+struct proxy_info {
+	proxy_type_t type;
+	char server[PROXY_MAX_IPLEN];
+	unsigned short port;
+	int use_domain;
+	char username[PROXY_MAX_NAMELEN];
+	char password[PROXY_MAX_NAMELEN];
+};
+
+struct proxy_conn;
+
+int proxy_init(void);
+
+int proxy_exit(void);
+
+int proxy_add(const char *proxy_name, struct proxy_info *info);
+
+int proxy_remove(const char *proxy_name);
+
+struct proxy_conn *proxy_conn_new(const char *proxy_name, const char *host, int port, int is_udp);
+
+int proxy_conn_get_fd(struct proxy_conn *proxy_conn);
+
+int proxy_conn_get_udpfd(struct proxy_conn *proxy_conn);
+
+int proxy_conn_is_udp(struct proxy_conn *proxy_conn);
+
+void proxy_conn_free(struct proxy_conn *proxy_conn);
+
+int proxy_conn_connect(struct proxy_conn *proxy_conn);
+
+int proxy_conn_sendto(struct proxy_conn *proxy_conn, const void *buf, size_t len, int flags,
+					  const struct sockaddr *dest_addr, socklen_t addrlen);
+
+int proxy_conn_recvfrom(struct proxy_conn *proxy_conn, void *buf, size_t len, int flags, struct sockaddr *src_addr,
+						socklen_t *addrlen);
+
+proxy_handshake_state proxy_conn_handshake(struct proxy_conn *proxy_conn);
+
+#ifdef __cplusplus
+}
+#endif /*__cplusplus */
+#endif
--- a/src/smartdns.c
+++ b/src/smartdns.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -45,7 +45,6 @@
 #include <sys/types.h>
 #include <ucontext.h>

-#define MAX_LINE_LEN 1024
 #define MAX_KEY_LEN 64
 #define SMARTDNS_PID_FILE "/var/run/smartdns.pid"
 #define TMP_BUFF_LEN_32 32
@@ -148,7 +147,7 @@ static void _help(void)
 		"  -p [pid]      pid file path, '-' means don't create pid file.\n"
 		"  -S            ignore segment fault signal.\n"
 		"  -x            verbose screen.\n"
-		"  -v            dispaly version.\n"
+		"  -v            display version.\n"
 		"  -h            show this help message.\n"

 		"Online help: http://pymumu.github.io/smartdns\n"
@@ -177,7 +176,7 @@ static int _smartdns_load_from_resolv(void)
 {
 	FILE *fp = NULL;
 	char line[MAX_LINE_LEN];
-	char key[MAX_KEY_LEN];
+	char key[MAX_KEY_LEN] = {0};
 	char value[MAX_LINE_LEN];
 	char ns_ip[DNS_MAX_IPLEN];
 	int port = PORT_NOT_DEFINED;
@@ -270,6 +269,7 @@ static int _smartdns_add_servers(void)
 		flags.server_flag = dns_conf_servers[i].server_flag;
 		flags.result_flag = dns_conf_servers[i].result_flag;
 		flags.set_mark = dns_conf_servers[i].set_mark;
+		safe_strncpy(flags.proxyname, dns_conf_servers[i].proxyname, sizeof(flags.proxyname));
 		ret = dns_client_add_server(dns_conf_servers[i].server, dns_conf_servers[i].port, dns_conf_servers[i].type,
 									&flags);
 		if (ret != 0) {
@@ -302,6 +302,33 @@ static int _smartdns_add_servers(void)
 	return 0;
 }

+static int _proxy_add_servers(void)
+{
+	unsigned long i = 0;
+	struct hlist_node *tmp = NULL;
+	struct dns_proxy_names *proxy = NULL;
+	struct dns_proxy_servers *server = NULL;
+	struct dns_proxy_servers *server_tmp = NULL;
+
+	hash_for_each_safe(dns_proxy_table.proxy, i, tmp, proxy, node)
+	{
+		list_for_each_entry_safe(server, server_tmp, &proxy->server_list, list)
+		{
+			struct proxy_info info;
+			memset(&info, 0, sizeof(info));
+			info.type = server->type;
+			info.port = server->port;
+			safe_strncpy(info.server, server->server, PROXY_MAX_IPLEN);
+			safe_strncpy(info.username, server->username, PROXY_MAX_NAMELEN);
+			safe_strncpy(info.password, server->password, PROXY_MAX_NAMELEN);
+			info.use_domain = server->use_domain;
+			proxy_add(proxy->proxy_name, &info);
+		}
+	}
+
+	return 0;
+}
+
 static int _smartdns_set_ecs_ip(void)
 {
 	int ret = 0;
@@ -352,6 +379,7 @@ static int _smartdns_init(void)
 {
 	int ret = 0;
 	const char *logfile = _smartdns_log_path();
+	int i = 0;

 	ret = tlog_init(logfile, dns_conf_log_size, dns_conf_log_num, 0, 0);
 	if (ret != 0) {
@@ -361,6 +389,9 @@ static int _smartdns_init(void)

 	tlog_setlogscreen(verbose_screen);
 	tlog_setlevel(dns_conf_log_level);
+	if (dns_conf_log_file_mode > 0) {
+		tlog_set_permission(tlog_get_root(), dns_conf_log_file_mode, dns_conf_log_file_mode);
+	}

 	tlog(TLOG_NOTICE, "smartdns starting...(Copyright (C) Nick Peng <pymumu@gmail.com>, build: %s %s)", __DATE__,
 		 __TIME__);
@@ -370,11 +401,19 @@ static int _smartdns_init(void)
 		goto errout;
 	}

-	if (dns_conf_server_num <= 0) {
-		if (_smartdns_load_from_resolv() != 0) {
-			tlog(TLOG_ERROR, "load dns from resolv failed.");
-			goto errout;
+	for (i = 0; i < 60 && dns_conf_server_num <= 0; i++) {
+		ret = _smartdns_load_from_resolv();
+		if (ret == 0) {
+			continue;
 		}
+
+		tlog(TLOG_DEBUG, "load dns from resolv failed, retry after 1s, retry times %d.", i + 1);
+		sleep(1);
+	}
+
+	if (dns_conf_server_num <= 0) {
+		tlog(TLOG_ERROR, "no dns server found, exit...");
+		goto errout;
 	}

 	ret = fast_ping_init();
@@ -383,6 +422,17 @@ static int _smartdns_init(void)
 		goto errout;
 	}

+	ret = proxy_init();
+	if (ret != 0) {
+		tlog(TLOG_ERROR, "start proxy failed.\n");
+		goto errout;
+	}
+
+	ret = _proxy_add_servers();
+	if (ret != 0) {
+		tlog(TLOG_ERROR, "add proxy servers failed.");
+	}
+
 	ret = dns_server_init();
 	if (ret != 0) {
 		tlog(TLOG_ERROR, "start dns server failed.\n");
@@ -394,6 +444,7 @@ static int _smartdns_init(void)
 		tlog(TLOG_ERROR, "start dns client failed.\n");
 		goto errout;
 	}
+
 	ret = _smartdns_add_servers();
 	if (ret != 0) {
 		tlog(TLOG_ERROR, "add servers failed.");
@@ -420,6 +471,7 @@ static void _smartdns_exit(void)
 {
 	tlog(TLOG_INFO, "smartdns exit...");
 	dns_client_exit();
+	proxy_exit();
 	fast_ping_exit();
 	dns_server_exit();
 	_smartdns_destroy_ssl();
--- a/src/tlog.c
+++ b/src/tlog.c
@@ -1,6 +1,6 @@
 /*
 * tinylog
- * Copyright (C) 2018-2020 Nick Peng <pymumu@gmail.com>
+ * Copyright (C) 2018-2023 Nick Peng <pymumu@gmail.com>
 * https://github.com/pymumu/tinylog
 */
 #ifndef _GNU_SOURCE
@@ -79,9 +79,9 @@ struct tlog_log {
    int zip_pid;
    int multi_log;
    int logscreen;
-    int no_write_log;
    int segment_log;
    int max_line_size;
+    int print_errmsg;

    tlog_output_func output_func;
    void *private_data;
@@ -90,6 +90,7 @@ struct tlog_log {
    time_t last_waitpid;
    mode_t file_perm;
    mode_t archive_perm;
+    int mode_changed;

    int waiters;
    int is_exit;
@@ -315,10 +316,24 @@ void tlog_set_maxline_size(struct tlog_log *log, int size)
    log->max_line_size = size;
 }

+void tlog_logcount(struct tlog_log *log, int count)
+{
+    if (log == NULL) {
+        return;
+    }
+
+    if (count < 0) {
+        count = 0;
+    }
+
+    log->logcount = count;
+}
+
 void tlog_set_permission(struct tlog_log *log, unsigned int file, unsigned int archive)
 {
    log->file_perm = file;
    log->archive_perm = archive;
+    log->mode_changed = 1;
 }

 int tlog_localtime(struct tlog_time *tm)
@@ -427,7 +442,7 @@ static int _tlog_root_log_buffer(char *buff, int maxlen, void *userptr, const ch
        log_len++;
    }

-    if (tlog.root->segment_log) {
+    if (tlog.root->segment_log && log_head != NULL) {
        if (len + 1 < maxlen - 1) {
            *(buff + len) = '\0';
            len++;
@@ -505,6 +520,10 @@ static int _tlog_vprintf(struct tlog_log *log, vprint_callback print_callback, v
        return -1;
    }

+    if (unlikely(log->logcount <= 0 && log->logscreen == 0) ) {
+        return 0;
+    }
+
    if (_tlog_need_drop(log) == 0) {
        return -1;
    }
@@ -901,14 +920,14 @@ static void _tlog_wait_pid(struct tlog_log *log, int wait_hang)
    log->zip_pid = -1;
    char gzip_file[PATH_MAX * 2];

-    /* rename ziped file */
+    /* rename zipped file */
    snprintf(gzip_file, sizeof(gzip_file), "%s/%s.pending.gz", log->logdir, log->logname);
    if (_tlog_rename_logfile(log, gzip_file) != 0) {
        _tlog_log_unlock(log);
        return;
    }

-    /* remove oldes file */
+    /* remove oldest file */
    _tlog_remove_oldlog(log);
    _tlog_log_unlock(log);
 }
@@ -1071,7 +1090,7 @@ static int _tlog_archive_log_nocompress(struct tlog_log *log)
        goto errout;
    }

-    /* remove oldes file */
+    /* remove oldest file */
    _tlog_remove_oldlog(log);
    _tlog_log_unlock(log);

@@ -1130,7 +1149,7 @@ static int _tlog_write(struct tlog_log *log, const char *buff, int bufflen)
        unused = write(STDOUT_FILENO, buff, bufflen);
    }

-    if (log->no_write_log) {
+    if (log->logcount <= 0) {
        return 0;
    }

@@ -1153,7 +1172,6 @@ static int _tlog_write(struct tlog_log *log, const char *buff, int bufflen)

    if (log->fd <= 0) {
        /* open a new log file to write */
-        static int print_errmsg = 1;
        time_t now;

        time(&now);
@@ -1164,14 +1182,15 @@ static int _tlog_write(struct tlog_log *log, const char *buff, int bufflen)

        char logfile[PATH_MAX * 2];
        if (_tlog_mkdir(log->logdir) != 0) {
-            if (print_errmsg == 0) {
+            if (log->print_errmsg == 0) {
                return -1;
            }
-            print_errmsg = 0;
+            log->print_errmsg = 0;
            fprintf(stderr, "create log dir %s failed, %s\n", log->logdir, strerror(errno));
            if (errno == EACCES && log->logscreen == 0) {
                fprintf(stderr, "no permission to write log file, output log to console\n");
-                tlog_logscreen_only(log, 1);
+                tlog_logscreen(log, 1);
+                tlog_logcount(log, 0);
            }
            return -1;
        }
@@ -1179,17 +1198,21 @@ static int _tlog_write(struct tlog_log *log, const char *buff, int bufflen)
        log->filesize = 0;
        log->fd = open(logfile, O_APPEND | O_CREAT | O_WRONLY | O_CLOEXEC, log->file_perm);
        if (log->fd < 0) {
-            if (print_errmsg == 0) {
+            if (log->print_errmsg == 0) {
                return -1;
            }

            fprintf(stderr, "open log file %s failed, %s\n", logfile, strerror(errno));
-            print_errmsg = 0;
+            log->print_errmsg = 0;
            return -1;
        }

+        if (log->mode_changed != 0) {
+            fchmod(log->fd, log->file_perm);
+        }
+
        log->last_try = 0;
-        print_errmsg = 1;
+        log->print_errmsg = 1;
        /* get log file size */
        log->filesize = lseek(log->fd, 0, SEEK_END);
    }
@@ -1414,7 +1437,7 @@ static void _tlog_work_write(struct tlog_log *log, int log_len, int log_extlen,
    if (log_dropped > 0) {
        /* if there is dropped log, record dropped log number */
        char dropmsg[TLOG_TMP_LEN];
-        snprintf(dropmsg, sizeof(dropmsg), "[Totoal Dropped %d Messages]\n", log_dropped);
+        snprintf(dropmsg, sizeof(dropmsg), "[Total Dropped %d Messages]\n", log_dropped);
        log->output_func(log, dropmsg, strnlen(dropmsg, sizeof(dropmsg)));
    }
 }
@@ -1577,6 +1600,11 @@ const char *tlog_get_level_string(tlog_level level)
    return tlog_level_str[level];
 }

+void tlog_set_maxlog_count(int count)
+{
+    tlog_logcount(tlog.root, count);
+}
+
 static void _tlog_log_setlogscreen(struct tlog_log *log, int enable)
 {
    if (log == NULL) {
@@ -1586,26 +1614,11 @@ static void _tlog_log_setlogscreen(struct tlog_log *log, int enable)
    log->logscreen = (enable != 0) ? 1 : 0;
 }

-static void _tlog_log_setlogscreen_only(struct tlog_log *log, int enable)
-{
-    if (log == NULL) {
-        return;
-    }
-
-    log->logscreen = (enable != 0) ? 1 : 0;
-    log->no_write_log = (enable != 0) ? 1 : 0;
-}
-
 void tlog_setlogscreen(int enable)
 {
    _tlog_log_setlogscreen(tlog.root, enable);
 }

-void tlog_setlogscreen_only(int enable)
-{
-    _tlog_log_setlogscreen_only(tlog.root, enable);
-}
-
 int tlog_write_log(char *buff, int bufflen)
 {
    if (unlikely(tlog.root == NULL)) {
@@ -1624,15 +1637,6 @@ void tlog_logscreen(tlog_log *log, int enable)
    _tlog_log_setlogscreen(log, enable);
 }

-void tlog_logscreen_only(tlog_log *log, int enable)
-{
-    if (log == NULL) {
-        return;
-    }
-
-    _tlog_log_setlogscreen_only(log, enable);
-}
-
 int tlog_reg_output_func(tlog_log *log, tlog_output_func output)
 {
    if (log == NULL) {
@@ -1704,12 +1708,13 @@ tlog_log *tlog_open(const char *logfile, int maxlogsize, int maxlogcount, int bu
    log->dropped = 0;
    log->buffsize = (buffsize > 0) ? buffsize : TLOG_BUFF_SIZE;
    log->logsize = (maxlogsize >= 0) ? maxlogsize : TLOG_LOG_SIZE;
-    log->logcount = (maxlogcount > 0) ? maxlogcount : TLOG_LOG_COUNT;
+    log->logcount = (maxlogcount <= 0) ? 0 : maxlogcount;
    log->fd = -1;
    log->filesize = 0;
    log->zip_pid = -1;
    log->is_exit = 0;
    log->fail = 0;
+    log->print_errmsg = 1;
    log->waiters = 0;
    log->block = ((flag & TLOG_NONBLOCK) == 0) ? 1 : 0;
    log->nocompress = ((flag & TLOG_NOCOMPRESS) == 0) ? 0 : 1;
@@ -1840,7 +1845,7 @@ int tlog_init(const char *logfile, int maxlogsize, int maxlogcount, int buffsize
    struct tlog_log *log = NULL;

    if (tlog_format != NULL) {
-        fprintf(stderr, "tlog already initilized.\n");
+        fprintf(stderr, "tlog already initialized.\n");
        return -1;
    }

--- a/src/tlog.h
+++ b/src/tlog.h
@@ -52,7 +52,7 @@ struct tlog_time {

 /*
 multiwrite: enable multi process write mode.
-            NOTICE: maxlogsize in all prcesses must be same when enable this mode.
+            NOTICE: maxlogsize in all processes must be same when enable this mode.
 */
 #define TLOG_MULTI_WRITE (1 << 2)

@@ -62,7 +62,7 @@ struct tlog_time {
 /* enable log to screen */
 #define TLOG_SCREEN (1 << 4)

-/* enable suppport fork process */
+/* enable support fork process */
 #define TLOG_SUPPORT_FORK (1 << 5)

 struct tlog_loginfo {
@@ -101,18 +101,18 @@ extern tlog_level tlog_getlevel(void);
 /* set log file */
 extern void tlog_set_logfile(const char *logfile);

-/* enalbe log to screen */
+/* enable log to screen */
 extern void tlog_setlogscreen(int enable);

-/* output log to screen only */
-extern void tlog_setlogscreen_only(int enable);
-
-/* enalbe early log to screen */
+/* enable early log to screen */
 extern void tlog_set_early_printf(int enable);

 /* Get log level in string */
 extern const char *tlog_get_level_string(tlog_level level);

+/* set max log count */
+extern void tlog_set_maxlog_count(int count);
+
 /*
 Function: Initialize log module
 logfile: log file.
@@ -184,12 +184,9 @@ va_list: args list
 */
 extern int tlog_vprintf(tlog_log *log, const char *format, va_list ap);

-/* enalbe log to screen */
+/* enable log to screen */
 extern void tlog_logscreen(tlog_log *log, int enable);

-/* enalbe log to screen only*/
-extern void tlog_logscreen_only(tlog_log *log, int enable);
-
 /* register output callback */
 typedef int (*tlog_output_func)(struct tlog_log *log, const char *buff, int bufflen);
 extern int tlog_reg_output_func(tlog_log *log, tlog_output_func output);
@@ -206,6 +203,9 @@ extern int tlog_localtime(struct tlog_time *tm);
 /* set max line size */
 extern void tlog_set_maxline_size(struct tlog_log *log, int size);

+/* set max log count */
+extern void tlog_logcount(struct tlog_log *log, int count);
+
 /*
 Function: set log file and archive permission
 log: log stream
--- a/src/util.c
+++ b/src/util.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -24,6 +24,7 @@
 #include "tlog.h"
 #include "util.h"
 #include <arpa/inet.h>
+#include <ctype.h>
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -108,7 +109,7 @@ unsigned long get_tick_count(void)
 	return (ts.tv_sec * 1000 + ts.tv_nsec / 1000000);
 }

-char *gethost_by_addr(char *host, int maxsize, struct sockaddr *addr)
+char *get_host_by_addr(char *host, int maxsize, struct sockaddr *addr)
 {
 	struct sockaddr_storage *addr_store = (struct sockaddr_storage *)addr;
 	host[0] = 0;
@@ -172,7 +173,7 @@ errout:
 	return -1;
 }

-int getsocknet_inet(int fd, struct sockaddr *addr, socklen_t *addr_len)
+int getsocket_inet(int fd, struct sockaddr *addr, socklen_t *addr_len)
 {
 	struct sockaddr_storage addr_store;
 	socklen_t addr_store_len = sizeof(addr_store);
@@ -389,11 +390,54 @@ int check_is_ipaddr(const char *ip)
 }

 int parse_uri(char *value, char *scheme, char *host, int *port, char *path)
+{
+	return parse_uri_ext(value, scheme, NULL, NULL, host, port, path);
+}
+
+void urldecode(char *dst, const char *src)
+{
+	char a, b;
+	while (*src) {
+		if ((*src == '%') && ((a = src[1]) && (b = src[2])) && (isxdigit(a) && isxdigit(b))) {
+			if (a >= 'a') {
+				a -= 'a' - 'A';
+			}
+
+			if (a >= 'A') {
+				a -= ('A' - 10);
+			} else {
+				a -= '0';
+			}
+
+			if (b >= 'a') {
+				b -= 'a' - 'A';
+			}
+
+			if (b >= 'A') {
+				b -= ('A' - 10);
+			} else {
+				b -= '0';
+			}
+			*dst++ = 16 * a + b;
+			src += 3;
+		} else if (*src == '+') {
+			*dst++ = ' ';
+			src++;
+		} else {
+			*dst++ = *src++;
+		}
+	}
+	*dst++ = '\0';
+}
+
+int parse_uri_ext(char *value, char *scheme, char *user, char *password, char *host, int *port, char *path)
 {
 	char *scheme_end = NULL;
 	int field_len = 0;
 	char *process_ptr = value;
-	char host_name[PATH_MAX];
+	char user_pass_host_part[PATH_MAX];
+	char *user_password = NULL;
+	char *host_part = NULL;

 	char *host_end = NULL;

@@ -413,24 +457,44 @@ int parse_uri(char *value, char *scheme, char *host, int *port, char *path)

 	host_end = strstr(process_ptr, "/");
 	if (host_end == NULL) {
-		return parse_ip(process_ptr, host, port);
+		host_end = process_ptr + strlen(process_ptr);
 	};

 	field_len = host_end - process_ptr;
-	if (field_len >= (int)sizeof(host_name)) {
+	if (field_len >= (int)sizeof(user_pass_host_part)) {
 		return -1;
 	}
-	memcpy(host_name, process_ptr, field_len);
-	host_name[field_len] = 0;
+	memcpy(user_pass_host_part, process_ptr, field_len);
+	user_pass_host_part[field_len] = 0;

-	if (parse_ip(host_name, host, port) != 0) {
+	host_part = strstr(user_pass_host_part, "@");
+	if (host_part != NULL) {
+		*host_part = '\0';
+		host_part = host_part + 1;
+		user_password = user_pass_host_part;
+		char *sep = strstr(user_password, ":");
+		if (sep != NULL) {
+			*sep = '\0';
+			sep = sep + 1;
+			if (password) {
+				urldecode(password, sep);
+			}
+		}
+		if (user) {
+			urldecode(user, user_password);
+		}
+	} else {
+		host_part = user_pass_host_part;
+	}
+
+	if (host != NULL && parse_ip(host_part, host, port) != 0) {
 		return -1;
 	}

 	process_ptr += field_len;

 	if (path) {
-		strncpy(path, process_ptr, PATH_MAX);
+		strcpy(path, process_ptr);
 	}
 	return 0;
 }
@@ -538,7 +602,7 @@ static int _ipset_support_timeout(void)
 	return -1;
 }

-static int _ipset_operate(const char *ipsetname, const unsigned char addr[], int addr_len, unsigned long timeout,
+static int _ipset_operate(const char *ipset_name, const unsigned char addr[], int addr_len, unsigned long timeout,
 						  int operate)
 {
 	struct nlmsghdr *netlink_head = NULL;
@@ -569,7 +633,7 @@ static int _ipset_operate(const char *ipsetname, const unsigned char addr[], int
 		return -1;
 	}

-	if (strlen(ipsetname) >= IPSET_MAXNAMELEN) {
+	if (strlen(ipset_name) >= IPSET_MAXNAMELEN) {
 		errno = ENAMETOOLONG;
 		return -1;
 	}
@@ -589,7 +653,7 @@ static int _ipset_operate(const char *ipsetname, const unsigned char addr[], int

 	proto = IPSET_PROTOCOL;
 	_ipset_add_attr(netlink_head, IPSET_ATTR_PROTOCOL, sizeof(proto), &proto);
-	_ipset_add_attr(netlink_head, IPSET_ATTR_SETNAME, strlen(ipsetname) + 1, ipsetname);
+	_ipset_add_attr(netlink_head, IPSET_ATTR_SETNAME, strlen(ipset_name) + 1, ipset_name);

 	nested[0] = (struct ipset_netlink_attr *)(buffer + NETLINK_ALIGN(netlink_head->nlmsg_len));
 	netlink_head->nlmsg_len += NETLINK_ALIGN(sizeof(struct ipset_netlink_attr));
@@ -628,14 +692,14 @@ static int _ipset_operate(const char *ipsetname, const unsigned char addr[], int
 	return rc;
 }

-int ipset_add(const char *ipsetname, const unsigned char addr[], int addr_len, unsigned long timeout)
+int ipset_add(const char *ipset_name, const unsigned char addr[], int addr_len, unsigned long timeout)
 {
-	return _ipset_operate(ipsetname, addr, addr_len, timeout, IPSET_ADD);
+	return _ipset_operate(ipset_name, addr, addr_len, timeout, IPSET_ADD);
 }

-int ipset_del(const char *ipsetname, const unsigned char addr[], int addr_len)
+int ipset_del(const char *ipset_name, const unsigned char addr[], int addr_len)
 {
-	return _ipset_operate(ipsetname, addr, addr_len, 0, IPSET_DEL);
+	return _ipset_operate(ipset_name, addr, addr_len, 0, IPSET_DEL);
 }

 unsigned char *SSL_SHA256(const unsigned char *d, size_t n, unsigned char *md)
@@ -684,6 +748,24 @@ errout:
 	return -1;
 }

+int SSL_base64_encode(const void *in, int in_len, char *out)
+{
+	int outlen = 0;
+
+	if (in_len == 0) {
+		return 0;
+	}
+
+	outlen = EVP_EncodeBlock((unsigned char *)out, in, in_len);
+	if (outlen < 0) {
+		goto errout;
+	}
+
+	return outlen;
+errout:
+	return -1;
+}
+
 int create_pid_file(const char *pid_file)
 {
 	int fd = 0;
@@ -812,7 +894,7 @@ static int parse_extensions(const char *, size_t, char *, const char **);
 static int parse_server_name_extension(const char *, size_t, char *, const char **);

 /* Parse a TLS packet for the Server Name Indication extension in the client
- * hello handshake, returning the first servername found (pointer to static
+ * hello handshake, returning the first server name found (pointer to static
 * array)
 *
 * Returns:
@@ -941,7 +1023,7 @@ static int parse_extensions(const char *data, size_t data_len, char *hostname, c
 		/* Check if it's a server name extension */
 		if (data[pos] == 0x00 && data[pos + 1] == 0x00) {
 			/* There can be only one extension of each type, so we break
-			 * our state and move p to beinnging of the extension here */
+			 * our state and move p to beginning of the extension here */
 			if (pos + 4 + len > data_len) {
 				return -5;
 			}
@@ -1194,27 +1276,27 @@ int dns_packet_save(const char *dir, const char *type, const char *from, const v

 	struct tm *ptm;
 	struct tm tm;
-	struct timeval tmval;
+	struct timeval tm_val;
 	struct stat sb;

 	if (stat(dir, &sb) != 0) {
 		mkdir(dir, 0750);
 	}

-	if (gettimeofday(&tmval, NULL) != 0) {
+	if (gettimeofday(&tm_val, NULL) != 0) {
 		return -1;
 	}

-	ptm = localtime_r(&tmval.tv_sec, &tm);
+	ptm = localtime_r(&tm_val.tv_sec, &tm);
 	if (ptm == NULL) {
 		return -1;
 	}

-	ret = snprintf(time_s, sizeof(time_s) - 1, "%.4d-%.2d-%.2d %.2d:%.2d:%.2d.%.3d", ptm->tm_year + 1900,
-				   ptm->tm_mon + 1, ptm->tm_mday, ptm->tm_hour, ptm->tm_min, ptm->tm_sec, (int)(tmval.tv_usec / 1000));
-	ret = snprintf(filename, sizeof(filename) - 1, "%s/%s-%.4d%.2d%.2d-%.2d%.2d%.2d%.1d.packet", dir, type,
-				   ptm->tm_year + 1900, ptm->tm_mon + 1, ptm->tm_mday, ptm->tm_hour, ptm->tm_min, ptm->tm_sec,
-				   (int)(tmval.tv_usec / 100000));
+	snprintf(time_s, sizeof(time_s) - 1, "%.4d-%.2d-%.2d %.2d:%.2d:%.2d.%.3d", ptm->tm_year + 1900, ptm->tm_mon + 1,
+			 ptm->tm_mday, ptm->tm_hour, ptm->tm_min, ptm->tm_sec, (int)(tm_val.tv_usec / 1000));
+	snprintf(filename, sizeof(filename) - 1, "%s/%s-%.4d%.2d%.2d-%.2d%.2d%.2d%.1d.packet", dir, type,
+			 ptm->tm_year + 1900, ptm->tm_mon + 1, ptm->tm_mday, ptm->tm_hour, ptm->tm_min, ptm->tm_sec,
+			 (int)(tm_val.tv_usec / 100000));

 	data = malloc(PACKET_BUF_SIZE);
 	if (data == NULL) {
@@ -1468,7 +1550,8 @@ int dns_packet_debug(const char *packet_file)
 	struct _dns_read_packet_info *info = NULL;
 	char buff[DNS_PACKSIZE];

-	tlog_setlogscreen_only(1);
+	tlog_set_maxlog_count(0);
+	tlog_setlogscreen(1);
 	tlog_setlevel(TLOG_DEBUG);

 	info = _dns_read_packet_file(packet_file);
--- a/src/util.h
+++ b/src/util.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -55,11 +55,11 @@ void bug_ext(const char *file, int line, const char *func, const char *errfmt, .

 unsigned long get_tick_count(void);

-char *gethost_by_addr(char *host, int maxsize, struct sockaddr *addr);
+char *get_host_by_addr(char *host, int maxsize, struct sockaddr *addr);

 int getaddr_by_host(const char *host, struct sockaddr *addr, socklen_t *addr_len);

-int getsocknet_inet(int fd, struct sockaddr *addr, socklen_t *addr_len);
+int getsocket_inet(int fd, struct sockaddr *addr, socklen_t *addr_len);

 int fill_sockaddr_by_ip(unsigned char *ip, int ip_len, int port, struct sockaddr *addr, socklen_t *addr_len);

@@ -69,6 +69,10 @@ int check_is_ipaddr(const char *ip);

 int parse_uri(char *value, char *scheme, char *host, int *port, char *path);

+int parse_uri_ext(char *value, char *scheme, char *user, char *password, char *host, int *port, char *path);
+
+void urldecode(char *dst, const char *src);
+
 int set_fd_nonblock(int fd, int nonblock);

 char *reverse_string(char *output, const char *input, int len, int to_lower_case);
@@ -77,9 +81,9 @@ char *to_lower_case(char *output, const char *input, int len);

 void print_stack(void);

-int ipset_add(const char *ipsetname, const unsigned char addr[], int addr_len, unsigned long timeout);
+int ipset_add(const char *ipset_name, const unsigned char addr[], int addr_len, unsigned long timeout);

-int ipset_del(const char *ipsetname, const unsigned char addr[], int addr_len);
+int ipset_del(const char *ipset_name, const unsigned char addr[], int addr_len);

 void SSL_CRYPTO_thread_setup(void);

@@ -89,10 +93,12 @@ unsigned char *SSL_SHA256(const unsigned char *d, size_t n, unsigned char *md);

 int SSL_base64_decode(const char *in, unsigned char *out);

+int SSL_base64_encode(const void *in, int in_len, char *out);
+
 int create_pid_file(const char *pid_file);

 /* Parse a TLS packet for the Server Name Indication extension in the client
- * hello handshake, returning the first servername found (pointer to static
+ * hello handshake, returning the first server name found (pointer to static
 * array)
 *
 * Returns:
Author	SHA1	Message	Date
Nick Peng	b1c4ad7afb	dns_server: multi-threading	2023-02-02 14:53:00 +08:00
Nick Peng	07ee91dd2d	smartdns: some minor fix	2023-02-02 14:10:00 +08:00
Nick Peng	108f514b83	readme: update readme.	2023-02-01 22:52:58 +08:00
Nick Peng	26d16eb9dc	dns_client: make DNS query ID random	2023-01-31 22:51:08 +08:00
Nick Peng	1e29f1fa63	dns_client: add retry when bootstrap from system DNS.	2023-01-30 23:26:08 +08:00
Nick Peng	3cb644d728	log: optimize proxy log	2023-01-29 23:26:16 +08:00
Nick Peng	c6ac69a8d8	domain-set: keep domain rules orders	2023-01-29 22:06:05 +08:00
Nick Peng	8bbbcd5e86	luci: add response mode option	2023-01-29 21:27:31 +08:00
Nick Peng	13d028df0d	smartdns: bump copyright to 2023, and fix some typo	2023-01-20 00:05:14 +08:00
Nick Peng	1f40577ef0	openwrt: save cache to disk when reboot system	2023-01-16 20:29:56 +08:00
Nick Peng	ee4816da5c	luci: support proxy server settings.	2023-01-08 22:33:54 +08:00
Nick Peng	5392857539	proxy: Configure proxy options using URI scheme	2023-01-08 03:18:01 +08:00
Nick Peng	e416a15684	dns_server: fix bind device issue	2023-01-08 01:58:18 +08:00
Nick Peng	3ed8150ac6	luci: support bind muti devices	2023-01-07 21:11:23 +08:00
Nick Peng	3b680f9455	luci: support bind device option	2023-01-05 23:36:17 +08:00
Nick Peng	5a3f53b487	server: support bind to device	2023-01-05 19:34:40 +08:00
Nick Peng	83c4901190	proxy: simple add socks5 and https proxy support	2023-01-05 00:27:28 +08:00
Nick Peng	d792e5f7f7	log: optimize log	2023-01-02 15:36:23 +08:00
Nick Peng	98ce7fd38c	luci: fix translate typo	2023-01-01 09:37:10 +08:00
PikuZheng	f571b8714b	fix Ubuntu service name (#1224 ) Author: PikuZheng <cba321123@gmail.com> Date: Sat Dec 31 18:00:57 2022 +0800	2022-12-31 21:17:47 +08:00
Nick Peng	fffe4caf08	log: optimize log	2022-12-31 09:38:27 +08:00
Nick Peng	98498bf444	luci: fix option description	2022-12-31 09:27:38 +08:00
Nick Peng	69ab9585d7	log: optimize log	2022-12-30 21:13:50 +08:00
Nick Peng	dd9cf62d10	luci: fix UI not display after upgrade issue.	2022-12-28 19:45:37 +08:00
Nick Peng	58aaaa5d5b	dns_server: use connect udp socket	2022-12-22 14:12:35 +08:00
孟古一	13a6892c17	Update ReadMe_en.md	2022-12-22 14:08:28 +08:00
孟古一	3099ef6ade	readme: update readme for ubuntu installation (#1212 )	2022-12-22 09:33:27 +08:00
Nick Peng	95524cab6b	makefile: add extra cflags	2022-12-22 00:20:22 +08:00
Nick Peng	f7f1f37faa	log: add option to set file permissions	2022-12-21 21:32:29 +08:00
Nick Peng	945653667f	feature: support marking packet on upstream server	2022-12-21 18:40:55 +08:00
Nick Peng	4c2b8847f0	readme_en: fix link	2022-12-21 18:40:55 +08:00
Nick Peng	70df7938f3	conf: support disable expired cache on specific domain.	2022-12-21 18:40:55 +08:00
Nick Peng	4b42e1ef85	readme: update readme	2022-12-21 18:40:55 +08:00
Nick Peng	5bc8b3ad62	luci: support config speed check mode	2022-12-21 18:40:55 +08:00
Nick Peng	f300d6ba82	luci: add domain rule list tab	2022-12-21 18:40:55 +08:00
Nick Peng	cdf12f3cb4	luci: add report bugs button	2022-12-21 18:40:55 +08:00
Nick Peng	53593ba5b6	conf: support space in filename	2022-12-21 18:40:55 +08:00
Nick Peng	52e036ac96	dns_server: support force no cname for A,AAAA records	2022-12-21 18:40:55 +08:00
Nick Peng	0b723168bb	luci-compat: support dns forwarding feature	2022-12-21 18:40:55 +08:00
Nick Peng	15427ffdf1	luci: support DNS forwarding and block	2022-12-21 18:40:55 +08:00
Nick Peng	3a1ba73386	log: support disable log	2022-12-14 22:26:45 +08:00