v0.3.46

Issue #91 , Issue #94

.github/workflows/build.yml

@@ -11,6 +11,22 @@ jobs:
     steps:
       - uses: actions/checkout@v4.2.1
 
+      - name: Check version match
+        run: |
+          PODKOP_VERSION=$(grep '^PKG_VERSION:=' podkop/Makefile | cut -d '=' -f 2)
+          LUCI_APP_PODKOP_VERSION=$(grep '^PKG_VERSION:=' luci-app-podkop/Makefile | cut -d '=' -f 2)
+
+          TAG_VERSION=${GITHUB_REF#refs/tags/v}
+
+          echo "Podkop version: $PODKOP_VERSION"
+          echo "Luci-app-podkop version: $LUCI_APP_PODKOP_VERSION"
+          echo "Tag version: $TAG_VERSION"
+
+          if [ "$PODKOP_VERSION" != "$TAG_VERSION" ] || [ "$LUCI_APP_PODKOP_VERSION" != "$TAG_VERSION" ]; then
+            echo "Error: Version mismatch"
+            exit 1
+          fi
+
       - name: Build and push
         uses: docker/build-push-action@v6.9.0
         with:

README.md

@@ -11,164 +11,31 @@
 - Если у вас не что-то не работает, то следуюет сходить в телеграм чат, прочитать закрепы и выполнить что там написано..
 - Если у вас установлен Getdomains, его следует удалить.
 
-# Удаление GetDomains скриптом
+# Документация
-```
+https://podkop.net/
-sh <(wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwrt/refs/heads/master/getdomains-uninstall.sh)
-```
-
-Оставляет туннели, зоны, forwarding. А также stubby и dnscrypt. Они не помешают. Конфиг sing-box будет перезаписан в podkop.
 
 # Установка Podkop
-Пакет работает на всех архитектурах.
+Полная информация в [документации](https://podkop.net/docs/install/)
-Тестировался на **ванильной** OpenWrt 23.05 и OpenWrt 24.10.
-На FriendlyWrt 23.05 присуствуют зависимости от iptables, которые ломают tproxy. Если у вас появляется warning про это в логах, следуйте инструкции по приведённой там ссылке.
 
-Поддержки APK на данный момент нет. APK будет сделан после того как разгребу основное.
+Вкратце, достаточно одного скрипта:
-
-## Автоматическая
 ```
 sh <(wget -O - https://raw.githubusercontent.com/itdoginfo/podkop/refs/heads/main/install.sh)
 ```
 
-Скрипт также предложит выбрать, какой туннель будет использоваться. Для выбранного туннеля будут установлены нужные пакеты, а для Wireguard и AmneziaWG также будет предложена автоматическая настройка - прямо в консоли скрипт запросит данные конфига. Для AmneziaWG можно также выбрать вариант с использованием конфига обычного Wireguard и автоматической обфускацией до AmneziaWG.
+## Обновление
-
-Для AmneziaWG скрипт проверяет наличие пакетов под вашу платформу в [стороннем репозитории](https://github.com/Slava-Shchipunov/awg-openwrt/releases), так как в официальном репозитории OpenWRT они отсутствуют, и автоматически их устанавливает.
-
-## Вручную
-Сделать `opkg update`, чтоб установились зависимости.
-Скачать пакеты `podkop_*.ipk` и `luci-app-podkop_*.ipk` из релиза. `opkg install` сначала первый, потом второй.
-
-# Обновление
-Та же самая команда, что для установки. Скрипт обнаружит уже установленный podkop и предложит обновиться.
 ```
-sh <(wget -O - https://raw.githubusercontent.com/itdoginfo/podkop/refs/heads/main/install.sh)
+sh <(wget -qO- https://raw.githubusercontent.com/itdoginfo/podkop/refs/heads/main/install.sh) --upgrade
 ```
 
-# Удаление
-```
-opkg remove luci-i18n-podkop-ru luci-app-podkop podkop
-```
-
-# Использование
-Конфиг: /etc/config/podkop
-
-Luci: Services/podkop
-
-## Режимы
-
-### Proxy
-Для VLESS и Shadowsocks. Другие протоколы тоже будут, кидайте в чат примеры строк без чувствительных данных.
-
-В этом режиме просто копируйте строку в **Proxy String** и из неё автоматически настроится sing-box.
-
-### VPN
-Здесь у вас должен быть уже настроен WG/OpenVPN/OpenConnect etc, зона Zone и Forwarding не обязательны.
-
-Просто выбрать интерфейс из списка.
-
-## Настройка доменов и подсетей
-**Community Lists** - Включить списки комьюнити
-
-**Custom domains enable** - Добавить свои домены
-
-**Custom subnets enable** - Добавить подсети или IP-адреса. Для подсетей задать маску.
-
-# Известные баги
-- [x] Не отрабатывает service podkop stop, если podkop запущен и не может, к пример, зарезолвить домен с сломанным DNS
-- [x] Update list из remote url domain не удаляет старые домены. А добавляет новые. Для подсетей тоже самое скорее всего. Пересоздавать ruleset?
-
 # ToDo
 Этот раздел не означает задачи, которые нужно брать и делать. Это общий список хотелок. Если вы хотите помочь, пожалуйста, спросите сначала в телеграмме.
 
-- [ ] Проверка, что версия в makefile совпадает с тегом
+Основные задачи в issues.
-- [ ] Сделать галку запрещающую подкопу редачить dhcp. Допилить в исключение вместе с пустыми полями proxy и vpn
-- [x] Обработка ошибки `sing-box[9345]: FATAL[0000] start service: initialize DNS rule[2]: rule-set not found: main`. Когда не задана строка\интерфейс
-- [x] Проверка `/etc/resolv.conf` на наличие DNS-серверов
-- [x] Отслеживание интерфейса wan в sing-box
-- [ ] Рестарт сервиса без рестарта dnsmasq
-- [ ] `ash: can't kill pid 9848: No such process` при обновлении и stop
 
 Низкий приоритет
 - [ ] Галочка, которая режет доступ к doh серверам
 - [ ] IPv6. Только после наполнения Wiki
 
 Рефактор
-- [ ] Handle для sing-box
-- [ ] Handle для dnsmasq
 - [ ] Unit тесты (BATS)
 - [ ] Интеграционые тесты бекенда (OpenWrt rootfs + BATS)
-
-# Разработка
-Есть два варианта:
-- Просто поставить пакет на роутер или виртуалку и прям редактировать через SFTP (opkg install openssh-sftp-server)
-- SDK, чтоб собирать пакеты
-
-Для сборки пакетов нужен SDK, один из вариантов скачать прям файл и разархивировать
-https://downloads.openwrt.org/releases/23.05.5/targets/x86/64/
-Нужен файл с SDK в имени
-
-```
-wget https://downloads.openwrt.org/releases/23.05.5/targets/x86/64/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64.tar.xz
-tar xf openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64.tar.xz
-mv openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64 SDK
-```
-Последнее для удобства.
-
-Создаём директорию для пакета
-```
-mkdir package/utilites
-```
-
-Симлинк из репозитория
-```
-ln -s ~/podkop/podkop package/utilites/podkop
-ln -s ~/podkop/luci-app-podkop package/luci-app-podkop
-```
-
-В первый раз для сборки luci-app необходимо обновить пакеты
-```
-./scripts/feeds update -a
-```
-
-Для make можно добавить флаг -j N, где N - количество ядер для сборки. Первый раз пройдёт быстрее.
-
-При первом make выводится менюшка, можно просто save, exit и всё. Первый раз долго грузит зависимости.
-
-Сборка пакета. Сами пакеты собираются быстро.
-```
-make package/podkop/{clean,compile} V=s
-```
-
-Также для luci
-```
-make package/luci-app-podkop/{clean,compile} V=s
-```
-
-.ipk лежат в `bin/packages/x86_64/base/`
-
-## Примеры строк
-https://github.com/itdoginfo/podkop/blob/main/String-example.md
-
-## Ошибки
-```
-Makefile:17: /SDK/feeds/luci/luci.mk: No such file or directory
-make[2]: *** No rule to make target '/SDK/feeds/luci/luci.mk'.  Stop.
-time: package/luci/luci-app-podkop/clean#0.00#0.00#0.00
-    ERROR: package/luci/luci-app-podkop failed to build.
-make[1]: *** [package/Makefile:129: package/luci/luci-app-podkop/clean] Error 1
-make[1]: Leaving directory '/SDK'
-make: *** [/SDK/include/toplevel.mk:226: package/luci-app-podkop/clean] Error 2
-```
-
-Не загружены пакеты для luci
-
-## make зависимости
-https://openwrt.org/docs/guide-developer/toolchain/install-buildsystem
-
-Ubuntu
-```
-sudo apt update
-sudo apt install build-essential clang flex bison g++ gawk \
-gcc-multilib g++-multilib gettext git libncurses-dev libssl-dev \
-python3-distutils rsync unzip zlib1g-dev file wget
-```

install.sh

@@ -5,10 +5,17 @@ REPO="https://api.github.com/repos/itdoginfo/podkop/releases/latest"
 IS_SHOULD_RESTART_NETWORK=
 DOWNLOAD_DIR="/tmp/podkop"
 COUNT=3
+UPGRADE=0
 
 rm -rf "$DOWNLOAD_DIR"
 mkdir -p "$DOWNLOAD_DIR"
 
+for arg in "$@"; do
+    if [ "$arg" = "--upgrade" ]; then
+        UPGRADE=1
+    fi
+done
+
 main() {
     check_system
     sing_box
@@ -16,11 +23,16 @@ main() {
     opkg update
   
     if [ -f "/etc/init.d/podkop" ]; then
-        printf "\033[32;1mPodkop is already installed. Just upgrade it? (y/n)\033[0m\n"
+        if [ "$UPGRADE" -eq 1 ]; then
+            echo "Upgraded podkop with flag..."
+            break
+        else
+            printf "\033[32;1mPodkop is already installed. Just upgrade it?\033[0m\n"
             printf "\033[32;1my - Only upgrade podkop\033[0m\n"
             printf "\033[32;1mn - Upgrade and install tunnels (WG, AWG, OpenVPN, OC)\033[0m\n"
 
             while true; do
+                printf "\033[32;1mEnter (y/n): \033[0m"
                 read -r -p '' UPDATE
                 case $UPDATE in
                 y)
@@ -38,11 +50,21 @@ main() {
                     ;;
                 esac
             done
+        fi
     else
         echo "Installed podkop..."
         add_tunnel
     fi
     
+    if command -v curl &> /dev/null; then
+        check_response=$(curl -s "https://api.github.com/repos/itdoginfo/podkop/releases/latest")
+
+        if echo "$check_response" | grep -q 'API rate limit '; then
+            echo "You've reached rate limit from GitHub. Repeat in five minutes."
+            exit 1
+        fi
+    fi
+
     download_success=0
     while read -r url; do
         filename=$(basename "$url")
@@ -151,13 +173,13 @@ add_tunnel() {
             ;;
 
         3)
-            opkg install opkg install openvpn-openssl luci-app-openvpn
+            opkg install openvpn-openssl luci-app-openvpn
             printf "\e[1;32mUse these instructions to configure https://itdog.info/nastrojka-klienta-openvpn-na-openwrt/\e[0m\n"
             break
             ;;
 
         4)
-            opkg install opkg install openconnect luci-proto-openconnect
+            opkg install openconnect luci-proto-openconnect
             printf "\e[1;32mUse these instructions to configure https://itdog.info/nastrojka-klienta-openconnect-na-openwrt/\e[0m\n"
             break
             ;;
@@ -239,8 +261,8 @@ install_awg_packages() {
         fi
     fi
     
-    if opkg list-installed | grep -q luci-app-amneziawg; then
+    if opkg list-installed | grep -qE 'luci-app-amneziawg|luci-proto-amneziawg'; then
-        echo "luci-app-amneziawg already installed"
+        echo "luci-app-amneziawg or luci-proto-amneziawg already installed"
     else
         LUCI_APP_AMNEZIAWG_FILENAME="luci-app-amneziawg${PKGPOSTFIX}"
         DOWNLOAD_URL="${BASE_URL}v${VERSION}/${LUCI_APP_AMNEZIAWG_FILENAME}"
@@ -416,7 +438,26 @@ check_system() {
         exit 1
     fi
 
-    if opkg list-installed | grep -qE "iptables|kmod-iptab"; then
+    if opkg list-installed | grep -q https-dns-proxy; then
+        printf "\033[31;1mСonflicting package detected: https-dns-proxy. Remove? yes/no\033[0m\n"
+
+        while true; do
+                read -r -p '' DNSPROXY
+                case $DNSPROXY in
+
+                yes|y|Y|yes)
+                    opkg remove --force-depends luci-app-https-dns-proxy https-dns-proxy luci-i18n-https-dns-proxy*
+                    break
+                    ;;
+                *)
+                    echo "Exit"
+                    exit 1
+                    ;;
+        esac
+    done
+    fi
+
+    if opkg list-installed | grep -q "iptables-mod-extra"; then
         printf "\033[31;1mFound incompatible iptables packages. If you're using FriendlyWrt: https://t.me/itdogchat/44512/181082\033[0m\n"
     fi
 }

luci-app-podkop/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-podkop
-PKG_VERSION:=0.3.27
+PKG_VERSION:=0.3.46
 PKG_RELEASE:=1
 
 LUCI_TITLE:=LuCI podkop app

luci-app-podkop/po/ru/podkop.po

@@ -40,8 +40,8 @@ msgstr "Конфигурация Outbound"
 msgid "Proxy Configuration URL"
 msgstr "URL конфигурации прокси"
 
-msgid "Enter connection string starting with vless:// or ss:// for proxy configuration"
+msgid "Enter connection string starting with vless:// or ss:// for proxy configuration. Add comments with // for saving other configs"
-msgstr "Введите строку подключения, начинающуюся с vless:// или ss:// для настройки прокси"
+msgstr "Введите строку подключения, начинающуюся с vless:// или ss:// для настройки прокси. Добавляйте комментарии с // для сохранения других конфигураций"
 
 msgid "Outbound Configuration"
 msgstr "Конфигурация исходящего соединения"
@@ -88,8 +88,8 @@ msgstr "Введите имена доменов без протоколов (п
 msgid "User Domains List"
 msgstr "Список пользовательских доменов"
 
-msgid "Enter domain names separated by comma, space or newline (example: sub.example.com, example.com or one domain per line)"
+msgid "Enter domain names separated by comma, space or newline. You can add comments after //"
-msgstr "Введите имена доменов через запятую, пробел или новую строку (пример: sub.example.com, example.com или один домен на строку)"
+msgstr "Введите имена доменов, разделяя их запятой, пробелом или с новой строки. Вы можете добавлять комментарии после //"
 
 msgid "Local Domain Lists"
 msgstr "Локальные списки доменов"
@@ -556,6 +556,9 @@ msgstr "Путь должен содержать хотя бы одну дире
 msgid "Invalid path format. Must be like /tmp/cache.db"
 msgstr "Неверный формат пути. Пример: /tmp/cache.db"
 
+msgid "Select the network interface from which the traffic will originate"
+msgstr "Выберите сетевой интерфейс, с которого будет исходить трафик"
+
 msgid "Copy to Clipboard"
 msgstr "Копировать в буфер обмена"
 
@@ -747,3 +750,96 @@ msgstr "не работает в браузере"
 
 msgid "not works on router"
 msgstr "не работает на роутере"
+
+msgid "Diagnostics"
+msgstr "Диагностика"
+
+msgid "DNS Status"
+msgstr "Статус DNS"
+
+msgid "Bypass Status"
+msgstr "Статус обхода"
+
+msgid "proxy working correctly"
+msgstr "прокси работает корректно"
+
+msgid "vpn working correctly"
+msgstr "vpn работает корректно"
+
+msgid "proxy not working"
+msgstr "прокси не работает"
+
+msgid "vpn not working"
+msgstr "vpn не работает"
+
+msgid "proxy not running"
+msgstr "прокси не запущен"
+
+msgid "vpn not running"
+msgstr "vpn не запущен"
+
+msgid "proxy routing incorrect"
+msgstr "маршрутизация прокси некорректна"
+
+msgid "vpn routing incorrect"
+msgstr "маршрутизация vpn некорректна"
+
+msgid "First endpoint check failed"
+msgstr "Проверка первой конечной точки не удалась"
+
+msgid "IP comparison failed"
+msgstr "Сравнение IP-адресов не удалось"
+
+msgid "Bypass check error"
+msgstr "Ошибка проверки обхода"
+
+msgid "Main config"
+msgstr "Основная конфигурация"
+
+msgid "Config without description"
+msgstr "Конфигурация без описания"
+
+msgid "DNS working"
+msgstr "DNS работает"
+
+msgid "Router DNS working"
+msgstr "DNS роутера работает"
+
+msgid "Router DNS not working"
+msgstr "DNS роутера не работает"
+
+msgid "DNS check error"
+msgstr "Ошибка проверки DNS"
+
+msgid "available"
+msgstr "доступен"
+
+msgid "unavailable"
+msgstr "недоступен"
+
+msgid "Apply for SS2022"
+msgstr "Применить для SS2022"
+
+msgid "PODKOP CONFIGURATION"
+msgstr "КОНФИГУРАЦИЯ PODKOP"
+
+msgid "FAKEIP ROUTER TEST"
+msgstr "ПРОВЕРКА FAKEIP НА РОУТЕРЕ"
+
+msgid "FAKEIP BROWSER TEST"
+msgstr "ПРОВЕРКА FAKEIP В БРАУЗЕРЕ"
+
+msgid "FakeIP is working correctly on router (198.18.x.x)"
+msgstr "FakeIP работает корректно на роутере (198.18.x.x)"
+
+msgid "Click here for all the info"
+msgstr "Нажмите для просмотра всей информации"
+
+msgid "Check DNS server on current device (PC, phone)"
+msgstr "Проверьте DNS сервер на текущем устройстве (ПК, телефон)"
+
+msgid "Its must be router!"
+msgstr "Это должен быть роутер!"
+
+msgid "Global check"
+msgstr "Глобальная проверка"

luci-app-podkop/po/templates/podkop.pot

@@ -1101,3 +1101,96 @@ msgstr ""
 
 msgid "not works on router"
 msgstr ""
+
+msgid "Diagnostics"
+msgstr ""
+
+msgid "DNS Status"
+msgstr ""
+
+msgid "Bypass Status"
+msgstr ""
+
+msgid "proxy working correctly"
+msgstr ""
+
+msgid "vpn working correctly"
+msgstr ""
+
+msgid "proxy not working"
+msgstr ""
+
+msgid "vpn not working"
+msgstr ""
+
+msgid "proxy not running"
+msgstr ""
+
+msgid "vpn not running"
+msgstr ""
+
+msgid "proxy routing incorrect"
+msgstr ""
+
+msgid "vpn routing incorrect"
+msgstr ""
+
+msgid "First endpoint check failed"
+msgstr ""
+
+msgid "IP comparison failed"
+msgstr ""
+
+msgid "Bypass check error"
+msgstr ""
+
+msgid "Main config"
+msgstr ""
+
+msgid "Enter connection string starting with vless:// or ss:// for proxy configuration. Add comments with // for backup configs"
+msgstr ""
+
+msgid "Config without description"
+msgstr ""
+
+msgid "DNS working"
+msgstr ""
+
+msgid "Router DNS working"
+msgstr ""
+
+msgid "Router DNS not working"
+msgstr ""
+
+msgid "DNS check error"
+msgstr ""
+
+msgid "available"
+msgstr ""
+
+msgid "unavailable"
+msgstr ""
+
+msgid "PODKOP CONFIGURATION"
+msgstr ""
+
+msgid "FAKEIP ROUTER TEST"
+msgstr ""
+
+msgid "FAKEIP BROWSER TEST"
+msgstr ""
+
+msgid "FakeIP is working correctly on router (198.18.x.x)"
+msgstr ""
+
+msgid "Click here for all the info"
+msgstr ""
+
+msgid "Check DNS server on current device (PC, phone)"
+msgstr ""
+
+msgid "Its must be router!"
+msgstr ""
+
+msgid "Global check"
+msgstr ""

podkop/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=podkop
-PKG_VERSION:=0.3.27
+PKG_VERSION:=0.3.46
 PKG_RELEASE:=1
 
 PKG_MAINTAINER:=ITDog <podkop@itdog.info>
@@ -13,8 +13,9 @@ define Package/podkop
 	SECTION:=net
 	CATEGORY:=Network
 	DEPENDS:=+sing-box +curl +jq +kmod-nft-tproxy +coreutils-base64
+	CONFLICTS:=https-dns-proxy
 	TITLE:=Domain routing app
-	URL:=https://itdog.info
+	URL:=https://podkop.net
 	PKGARCH:=all
 endef
 

podkop/files/etc/config/podkop

@@ -35,3 +35,8 @@ config main 'main'
 	option dns_server '8.8.8.8'
 	option dns_rewrite_ttl '60'
 	option cache_file '/tmp/cache.db'
+	list iface 'br-lan'
+	option mon_restart_ifaces '0'
+	#list restart_ifaces 'wan'
+	option ss_uot '0'
+	option detour '0'

podkop/files/etc/init.d/podkop

@@ -6,38 +6,16 @@ USE_PROCD=1
 script=$(readlink "$initscript")
 NAME="$(basename ${script:-$initscript})"
 config_load "$NAME"
-resolv_conf="/etc/resolv.conf"
 
 start_service() {
     echo "Start podkop"
 
-    sing_box_version=$(sing-box version | head -n 1 | awk '{print $3}')
+	config_get mon_restart_ifaces "main" "mon_restart_ifaces"
-    required_version="1.11.1"
+	config_get restart_ifaces "main" "restart_ifaces"
-
-    if [ "$(echo -e "$sing_box_version\n$required_version" | sort -V | head -n 1)" != "$required_version" ]; then
-        echo "The version of sing-box ($sing_box_version) is lower than the minimum version. Update sing-box: opkg update && opkg remove sing-box && opkg install sing-box"
-        exit 1
-    fi
-
-    if grep -q FriendlyWrt /etc/banner; then
-        printf "\033[31;1mYou use FriendlyWrt. If you have problems, check out: https://t.me/itdogchat/44512/181082\033[0m\n"
-    fi
-
-    if grep -qE 'doh_backup_noresolv|doh_backup_server|doh_server' /etc/config/dhcp; then
-        printf "\033[31;1mDetected https-dns-proxy. Disable or uninstall it for correct functionality.\033[0m\n"
-    fi
-
-    if ! ip addr | grep -q "br-lan"; then
-        echo "Interface br-lan not found"
-        exit 1
-    fi
-
-    if ! grep -q "search lan" "$resolv_conf" || ! grep -q "nameserver 127.0.0.1" "$resolv_conf"; then
-        echo "/etc/resolv.conf does not contain 'search lan' or 'nameserver 127.0.0.1' entries"
-    fi
 
 	procd_open_instance
-	procd_set_param command /bin/sh -c "/usr/bin/podkop start"
+	procd_set_param command /usr/bin/podkop start
+	[ "$mon_restart_ifaces" = "1" ] && [ -n "$restart_ifaces" ] && procd_set_param netdev $restart_ifaces
 	procd_set_param stdout 1
 	procd_set_param stderr 1
 	procd_close_instance
@@ -47,17 +25,23 @@ stop_service() {
     /usr/bin/podkop stop
 }
 
-restart_service() {
-    stop
-    start
-}
-
 reload_service() {
-    stop
+    /usr/bin/podkop reload > /dev/null 2>&1
-    start
 }
 
 service_triggers() {
     echo "service_triggers start"
-    procd_add_config_trigger "config.change" "$NAME" "$initscript" reload 'on_config_change'
+
+	config_get mon_restart_ifaces "main" "mon_restart_ifaces"
+	config_get restart_ifaces "main" "restart_ifaces"
+
+	procd_open_trigger
+		procd_add_config_trigger "config.change" "$NAME" "$initscript" restart 'on_config_change'
+
+        if [ "$mon_restart_ifaces" = "1" ]; then
+			for iface in $restart_ifaces; do
+				procd_add_reload_interface_trigger $iface
+			done
+		fi
+	procd_close_trigger
 }

podkop/files/usr/bin/podkop

@@ -15,20 +15,21 @@ SUBNETS_TWITTER="${GITHUB_RAW_URL}/Subnets/IPv4/twitter.lst"
 SUBNETS_META="${GITHUB_RAW_URL}/Subnets/IPv4/meta.lst"
 SUBNETS_DISCORD="${GITHUB_RAW_URL}/Subnets/IPv4/discord.lst"
 SUBNETS_TELERAM="${GITHUB_RAW_URL}/Subnets/IPv4/telegram.lst"
+SUBNETS_CLOUDFLARE="${GITHUB_RAW_URL}/Subnets/IPv4/cloudflare.lst"
 SING_BOX_CONFIG="/etc/sing-box/config.json"
 FAKEIP="198.18.0.0/15"
-VALID_SERVICES="russia_inside russia_outside ukraine_inside geoblock block porn news anime youtube discord meta twitter hdrezka tiktok telegram"
+VALID_SERVICES="russia_inside russia_outside ukraine_inside geoblock block porn news anime youtube discord meta twitter hdrezka tiktok telegram cloudflare"
 DNS_RESOLVERS="1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 9.9.9.9 9.9.9.11 94.140.14.14 94.140.15.15 208.67.220.220 208.67.222.222 77.88.8.1 77.88.8.8"
-TEST_DOMAIN="fakeip.tech-domain.club"
+TEST_DOMAIN="fakeip.podkop.fyi"
+INTERFACES_LIST=""
+SRC_INTERFACE=""
+RESOLV_CONF="/etc/resolv.conf"
+CLOUDFLARE_OCTETS="103.21 103.22 103.31 104.16 104.17 104.18 104.19 104.20 104.21 104.22 104.23 104.24 104.25 104.26 104.27 104.28 108.162 131.0 141.101 162.158 162.159 172.64 172.65 172.66 172.67 172.68 172.69 172.70 172.71 173.245 188.114 190.93 197.234 198.41"
 
 log() {
     local message="$1"
     local timestamp=$(date +"%Y-%m-%d %H:%M:%S")
-    local CYAN="\033[0;36m"
-    local GREEN="\033[0;32m"
-    local RESET="\033[0m"
 
-    echo -e "${CYAN}[$timestamp]${RESET} ${GREEN}$message${RESET}"
     logger -t "podkop" "$timestamp $message"
 }
 
@@ -42,12 +43,34 @@ nolog() {
     echo -e "${CYAN}[$timestamp]${RESET} ${GREEN}$message${RESET}"
 }
 
-start() {
+start_main() {
+    log "Starting podkop"
+
+    # checking
+    sing_box_version=$(sing-box version | head -n 1 | awk '{print $3}')
+    required_version="1.11.1"
+
+    if [ "$(echo -e "$sing_box_version\n$required_version" | sort -V | head -n 1)" != "$required_version" ]; then
+        log "[critical] The version of sing-box ($sing_box_version) is lower than the minimum version. Update sing-box: opkg update && opkg remove sing-box && opkg install sing-box"
+        exit 1
+    fi
+
+    if opkg list-installed | grep -q iptables-mod-extra; then
+        log "[critical] Conflicting package detected: iptables-mod-extra"
+    fi
+
+    if grep -qE 'doh_backup_noresolv|doh_backup_server|doh_server' /etc/config/dhcp; then
+        log "[critical] Detected https-dns-proxy in dhcp config. Edit /etc/config/dhcp"
+    fi
+
     migration
 
     config_foreach process_validate_service
 
-    sleep 3
+    # Sync time for DoH/DoT
+    /usr/sbin/ntpd -q -p 194.190.168.1 -p 216.239.35.0 -p 216.239.35.4 -p 162.159.200.1 -p 162.159.200.123
+
+    sleep 2
 
     mkdir -p /tmp/podkop
 
@@ -61,6 +84,7 @@ start() {
     sing_box_dns
     sing_box_dns_rule_fakeip
     sing_box_rule_dns
+    sing_box_create_bypass_ruleset
     sing_box_add_secure_dns_probe_domain
     sing_box_cache_file
     process_socks5
@@ -107,9 +131,20 @@ start() {
         sing_box_quic_reject
     fi
 
+    config_get_bool detour "main" "detour" "0"
+    if [ "$detour" -eq 1 ]; then
+        log "Detour mixed enable"
+        detour_mixed
+    fi
+
     sing_box_config_check
-    /etc/init.d/sing-box restart
+    /etc/init.d/sing-box start
-    /etc/init.d/sing-box enable
+    #/etc/init.d/sing-box enable
+    log "Nice"
+}
+
+start() {
+    start_main
 
     config_get proxy_string "main" "proxy_string"
     config_get interface "main" "interface"
@@ -123,13 +158,13 @@ start() {
     fi
 }
 
-stop() {
+stop_main() {
     log "Stopping the podkop"
 
     if [ -f /var/run/podkop_list_update.pid ]; then
         pid=$(cat /var/run/podkop_list_update.pid)
         if kill -0 "$pid"; then
-            kill "$pid"
+            kill "$pid" 2>/dev/null
             log "Stopped list_update"
         fi
         rm -f /var/run/podkop_list_update.pid
@@ -137,11 +172,6 @@ stop() {
 
     remove_cron_job
 
-    config_get_bool dont_touch_dhcp "main" "dont_touch_dhcp" "0"
-    if [ "$dont_touch_dhcp" -eq 0 ]; then
-        dnsmasq_restore
-    fi 
-
     rm -rf /tmp/podkop/*.lst
 
     log "Flush nft"
@@ -161,8 +191,28 @@ stop() {
 
     log "Stop sing-box"
     /etc/init.d/sing-box stop
-    /etc/init.d/sing-box disable
+    #/etc/init.d/sing-box disable
+}
 
+stop() {
+    config_get_bool dont_touch_dhcp "main" "dont_touch_dhcp" "0"
+    if [ "$dont_touch_dhcp" -eq 0 ]; then
+        dnsmasq_restore
+    fi
+
+    stop_main
+}
+
+reload() {
+    log "Podkop reload"
+    stop_main
+    start_main
+}
+
+restart() {
+    log "Podkop restart"
+    stop
+    start
 }
 
 # Migrations and validation funcs
@@ -261,20 +311,54 @@ route_table_rule_mark() {
     fi
 }
 
+process_interfaces() {
+    local iface="$1"
+    INTERFACES_LIST="$INTERFACES_LIST $iface"
+    iface_flag=1
+}
+
+nft_interfaces() {
+    local table=PodkopTable
+    iface_flag=0
+
+    config_list_foreach "main" "iface" "process_interfaces"
+    if [ "$iface_flag" -eq 0 ]; then
+        SRC_INTERFACE="br-lan"
+    elif [ $(echo "$INTERFACES_LIST" | wc -w) -eq 1 ]; then
+        SRC_INTERFACE=$INTERFACES_LIST
+    else
+        local set_name="interfaces"
+        if ! nft list set inet $table $set_name &>/dev/null; then
+            nft add set inet $table $set_name { type ifname\; flags interval\; }
+        fi
+
+        for interface in $INTERFACES_LIST; do
+            if ! nft list element inet $table $set_name { $interface } &>/dev/null; then
+            nft add element inet $table $set_name { $interface }
+            fi
+        done
+
+        SRC_INTERFACE=@$set_name
+    fi
+}
+
 create_nft_table() {
     local table="PodkopTable"
 
     nft add table inet $table
+
+    nft_interfaces
+
     log "Create nft rules"
     nft add chain inet $table mangle { type filter hook prerouting priority -150 \; policy accept \;}
     nft add chain inet $table proxy { type filter hook prerouting priority -100 \; policy accept \;}
 
     nft add set inet $table podkop_subnets { type ipv4_addr\; flags interval\; auto-merge\; }
 
-    nft add rule inet $table mangle iifname "br-lan" ip daddr @podkop_subnets meta l4proto tcp meta mark set 0x105 counter
+    nft add rule inet $table mangle iifname "$SRC_INTERFACE" ip daddr @podkop_subnets meta l4proto tcp meta mark set 0x105 counter
-    nft add rule inet $table mangle iifname "br-lan" ip daddr @podkop_subnets meta l4proto udp meta mark set 0x105 counter
+    nft add rule inet $table mangle iifname "$SRC_INTERFACE" ip daddr @podkop_subnets meta l4proto udp meta mark set 0x105 counter
-    nft add rule inet $table mangle iifname "br-lan" ip daddr "$FAKEIP" meta l4proto tcp meta mark set 0x105 counter
+    nft add rule inet $table mangle iifname "$SRC_INTERFACE" ip daddr "$FAKEIP" meta l4proto tcp meta mark set 0x105 counter
-    nft add rule inet $table mangle iifname "br-lan" ip daddr "$FAKEIP" meta l4proto udp meta mark set 0x105 counter
+    nft add rule inet $table mangle iifname "$SRC_INTERFACE" ip daddr "$FAKEIP" meta l4proto udp meta mark set 0x105 counter
 
     nft add rule inet $table proxy meta mark 0x105 meta l4proto tcp tproxy ip to :1602 counter
     nft add rule inet $table proxy meta mark 0x105 meta l4proto udp tproxy ip to :1602 counter
@@ -300,7 +384,8 @@ dnsmasq_add_resolver() {
     uci -q delete dhcp.@dnsmasq[0].podkop_server
     for server in $(uci get dhcp.@dnsmasq[0].server 2>/dev/null); do
         if [[ "$server" == "127.0.0.42" ]]; then
-            log "Dnsmasq save config error: server=127.0.0.42"
+            log "Dnsmasq save config error: server=127.0.0.42 is already configured. Skip editing DHCP"
+            return
         else
             uci add_list dhcp.@dnsmasq[0].podkop_server="$server"
         fi
@@ -490,10 +575,19 @@ list_update() {
     fi
 
     for i in $(seq 1 60); do
+        config_get_bool detour "main" "detour" "0"
+        if [ "$detour" -eq 1 ]; then
+            if http_proxy="http://127.0.0.1:4534" https_proxy="http://127.0.0.1:4534" curl -s -m 3 https://github.com >/dev/null; then
+                log "GitHub is available"
+                break
+            fi
+        else
             if curl -s -m 3 https://github.com >/dev/null; then
                 log "GitHub is available"
                 break
             fi
+        fi
+
         log "GitHub is unavailable [$i/60]"
         sleep 3
     done
@@ -531,10 +625,12 @@ sing_box_uci() {
         log "Change sing-box UCI config"
     fi
 
-    if grep -q '#\s*list ifaces' "$config"; then
+    [ -f /etc/rc.d/S99sing-box ] && log "Disable sing-box" && /etc/init.d/sing-box disable
-        sed -i '/ifaces/s/#//g' $config
+
-        log "Uncommented list ifaces"
+    # if grep -q '#\s*list ifaces' "$config"; then
-    fi
+    #     sed -i '/ifaces/s/#//g' $config
+    #     log "Uncommented list ifaces"
+    # fi
 }
 
 add_socks5_for_section() {
@@ -690,6 +786,42 @@ sing_box_dns() {
         }' $SING_BOX_CONFIG > /tmp/sing-box-config-tmp.json && mv /tmp/sing-box-config-tmp.json $SING_BOX_CONFIG
 }
 
+sing_box_create_bypass_ruleset() {
+    log "Creating bypass ruleset for direct access"
+    
+    jq '
+    .route.rule_set += [{
+        "tag": "bypass",
+        "type": "inline",
+        "rules": [
+            {
+                "domain_suffix": [
+                    "ip.podkop.fyi"
+                ]
+            }
+        ]
+    }]' $SING_BOX_CONFIG >/tmp/sing-box-config-tmp.json && mv /tmp/sing-box-config-tmp.json $SING_BOX_CONFIG
+    
+    # Add a rule to route bypass domains to direct-out outbound
+    jq '
+    .route.rules += [{
+        "inbound": ["tproxy-in"],
+        "rule_set": ["bypass"],
+        "outbound": "main",
+        "action": "route"
+    }]' $SING_BOX_CONFIG >/tmp/sing-box-config-tmp.json && mv /tmp/sing-box-config-tmp.json $SING_BOX_CONFIG
+    
+    # Make sure the bypass ruleset is in the fakeip DNS rule
+    jq '
+    .dns.rules = (.dns.rules | map(
+        if .server == "fakeip-server" then 
+            .rule_set += ["bypass"] 
+        else 
+            . 
+        end
+    ))' $SING_BOX_CONFIG >/tmp/sing-box-config-tmp.json && mv /tmp/sing-box-config-tmp.json $SING_BOX_CONFIG
+}
+
 sing_box_dns_rule_fakeip() {
     local rewrite_ttl
     config_get rewrite_ttl "main" "dns_rewrite_ttl" "600"
@@ -769,7 +901,7 @@ sing_box_outdound() {
         config_get interface "$section" "interface"
         
         if [ -z "$interface" ]; then
-            log "VPN interface is not set. Exit"
+            log "[critical] VPN interface is not set. Exit"
             exit 1
         fi
 
@@ -795,12 +927,13 @@ sing_box_outdound() {
             active_proxy_string=$(echo "$proxy_string" | grep -v "^[[:space:]]*\/\/" | head -n 1)
             
             if [ -z "$active_proxy_string" ]; then
-                log "Proxy string is not set. Exit"
+                log "[critical] Proxy string is not set. Exit"
                 exit 1
             fi
             
             if [[ "$active_proxy_string" =~ ^ss:// ]]; then
-                sing_box_config_shadowsocks "$section" "$active_proxy_string"
+                config_get ss_uot $section "ss_uot"
+                sing_box_config_shadowsocks "$section" "$active_proxy_string" "$ss_uot"
             elif [[ "$active_proxy_string" =~ ^vless:// ]]; then
                 sing_box_config_vless "$section" "$active_proxy_string"
             else
@@ -809,6 +942,9 @@ sing_box_outdound() {
             fi
         fi
         ;;
+    "block")
+        log "Block mode"
+        ;;
     *)
         log "Requires *vpn* or *proxy* value"
         return
@@ -867,7 +1003,7 @@ sing_box_rule_dns() {
 
 sing_box_config_check() {
     if ! sing-box -c $SING_BOX_CONFIG check >/dev/null 2>&1; then
-        log "Sing-box configuration is invalid"
+        log "[critical] Sing-box configuration is invalid"
         exit 1
     fi
 }
@@ -899,7 +1035,7 @@ sing_box_config_outbound_json() {
     if [ $? -eq 0 ]; then
         log "Outbound config updated successfully"
     else
-        log "Error: Invalid JSON config generated"
+        log "Error: Outbound invalid JSON config generated"
         return 1
     fi
 }
@@ -907,6 +1043,7 @@ sing_box_config_outbound_json() {
 sing_box_config_shadowsocks() {
     local section="$1"
     local STRING="$2"
+    ss_uot="${3:-0}"
 
     if echo "$STRING" | cut -d'/' -f3 | cut -d'@' -f1 | base64 -d 2>/dev/null | grep -q ":"; then
         local encrypted_part=$(echo "$STRING" | cut -d'/' -f3 | cut -d'@' -f1 | base64 -d 2>/dev/null )
@@ -930,6 +1067,7 @@ sing_box_config_shadowsocks() {
     --argjson port "$port" \
     --arg method "$method" \
     --arg password "$password" \
+    --argjson ss_uot "$ss_uot" \
     '. |
       .outbounds |= (
         map(
@@ -939,9 +1077,8 @@ sing_box_config_shadowsocks() {
               "server": $server,
               "server_port": ($port | tonumber),
               "method": $method,
-              "password": $password,
+              "password": $password
-              "udp_over_tcp": { "enabled": true, "version": 2 }
+            } + (if $ss_uot == 1 then { "udp_over_tcp": { "enabled": true, "version": 2 } } else {} end)
-            }
           else . end
         ) +
         (
@@ -952,17 +1089,16 @@ sing_box_config_shadowsocks() {
               "server": $server,
               "server_port": ($port | tonumber),
               "method": $method,
-              "password": $password,
+              "password": $password
-              "udp_over_tcp": { "enabled": true, "version": 2 }
+            } + (if $ss_uot == 1 then { "udp_over_tcp": { "enabled": true, "version": 2 } } else {} end)]
-            }]
           else [] end
         )
       )' $SING_BOX_CONFIG >/tmp/sing-box-config-tmp.json && mv /tmp/sing-box-config-tmp.json $SING_BOX_CONFIG
 
     if [ $? -eq 0 ]; then
-        log "Config updated successfully"
+        log "Config Shadowsocks updated successfully"
     else
-        log "Error: Invalid JSON config generated"
+        log "Error: Shadowsocks invalid JSON config generated"
         return 1
     fi
 }
@@ -1087,9 +1223,9 @@ sing_box_config_vless() {
 
 
     if [ $? -eq 0 ]; then
-        log "Config created successfully"
+        log "Config VLESS created successfully"
     else
-        log "Error: Invalid JSON config generated"
+        log "Error: VLESS invalid JSON config generated"
         return 1
     fi
 }
@@ -1243,6 +1379,7 @@ sing_box_ruleset_remote() {
     local tag=$1
     local type=$2
     local update_interval=$3
+    local detour=$4
 
     url="$SRS_MAIN_URL/$tag.srs"
 
@@ -1258,15 +1395,19 @@ sing_box_ruleset_remote() {
         --arg type "$type" \
         --arg url "$url" \
         --arg update_interval "$update_interval" \
+        --arg detour "$detour" \
         '
         .route.rule_set += [
+            (
                 {
                     "tag": $tag,
                     "type": $type,
                     "format": "binary",
                     "url": $url,
                     "update_interval": $update_interval
-            }
+                } +
+                    (if $detour == "1" then {"download_detour": "main"} else {} end)
+            )
         ]' "$SING_BOX_CONFIG" > /tmp/sing-box-config-tmp.json && mv /tmp/sing-box-config-tmp.json "$SING_BOX_CONFIG"
 
         log "Added new ruleset with tag $tag"
@@ -1287,10 +1428,13 @@ list_subnets_download() {
         "telegram")
             URL=$SUBNETS_TELERAM
             ;;
+        "cloudflare")
+            URL=$SUBNETS_CLOUDFLARE
+            ;;
         "discord")
             URL=$SUBNETS_DISCORD
             nft add set inet $table podkop_discord_subnets { type ipv4_addr\; flags interval\; auto-merge\; }
-            nft add rule inet $table mangle iifname "br-lan" ip daddr @podkop_discord_subnets udp dport { 50000-65535 } meta mark set 0x105 counter
+            nft add rule inet $table mangle iifname "$SRC_INTERFACE" ip daddr @podkop_discord_subnets udp dport { 50000-65535 } meta mark set 0x105 counter
             ;;
         *)
             return
@@ -1298,7 +1442,13 @@ list_subnets_download() {
     esac
 
     local filename=$(basename "$URL")
+
+    config_get_bool detour "main" "detour" "0"
+    if [ "$detour" -eq 1 ]; then
+        http_proxy="http://127.0.0.1:4534" https_proxy="http://127.0.0.1:4534" wget -O "/tmp/podkop/$filename" "$URL"
+    else
         wget -O "/tmp/podkop/$filename" "$URL"
+    fi
 
     while IFS= read -r subnet; do
         if [ "$service" = "discord" ]; then
@@ -1314,6 +1464,32 @@ sing_box_rules() {
     local rule_set="$1"
     local outbound="$2"
 
+    config_get mode "$section" "mode"
+
+    if [[ "$mode" == "block" ]]; then
+        # Action reject
+        # Check if there is an rule with reject"
+        local rule_exists=$(jq -r '.route.rules[] | select(.inbound == ["tproxy-in"] and .action == "reject")' "$SING_BOX_CONFIG")
+
+        if [[ -n "$rule_exists" ]]; then
+            # If a rule for rejectexists, add a new rule_set to the existing rule
+            jq \
+            --arg rule_set "$rule_set" \
+            '(.route.rules[] | select(.inbound == ["tproxy-in"] and .action == "reject") .rule_set) += [$rule_set]' \
+            "$SING_BOX_CONFIG" > /tmp/sing-box-config-tmp.json && mv /tmp/sing-box-config-tmp.json "$SING_BOX_CONFIG"
+        else
+            # If there is no rule for reject, create a new one with rule_set
+            jq \
+            --arg rule_set "$rule_set" \
+            '.route.rules += [{
+                "inbound": ["tproxy-in"],
+                "rule_set": [$rule_set],
+                "action": "reject"
+            }]' "$SING_BOX_CONFIG" > /tmp/sing-box-config-tmp.json && mv /tmp/sing-box-config-tmp.json "$SING_BOX_CONFIG"
+        fi
+        return
+    else
+        # Action route
         # Check if there is an outbound rule for "tproxy-in"
         local rule_exists=$(jq -r '.route.rules[] | select(.outbound == "'"$outbound"'" and .inbound == ["tproxy-in"])' "$SING_BOX_CONFIG")
 
@@ -1336,6 +1512,7 @@ sing_box_rules() {
                 "action": "route"
             }]' "$SING_BOX_CONFIG" >/tmp/sing-box-config-tmp.json && mv /tmp/sing-box-config-tmp.json "$SING_BOX_CONFIG"
         fi
+    fi
 }
 
 sing_box_quic_reject() {
@@ -1360,8 +1537,9 @@ sing_box_quic_reject() {
 process_remote_ruleset_srs() {
     config_get_bool domain_list_enabled "$section" "domain_list_enabled" "0"
     if [ "$domain_list_enabled" -eq 1 ]; then
+        config_get_bool detour "main" "detour" "0"
         log "Adding a srs list for $section"
-        config_list_foreach "$section" domain_list "sing_box_ruleset_remote" "remote" "1d"
+        config_list_foreach "$section" domain_list "sing_box_ruleset_remote" "remote" "1d" "$detour"
     fi
 }
 
@@ -1428,7 +1606,12 @@ list_custom_url_domains_create() {
     local URL="$1"
     local filename=$(basename "$URL")
 
-    wget -q -O "/tmp/podkop/${filename}" "$URL"
+    config_get_bool detour "main" "detour" "0"
+    if [ "$detour" -eq 1 ]; then
+        http_proxy="http://127.0.0.1:4534" https_proxy="http://127.0.0.1:4534" wget -O "/tmp/podkop/${filename}" "$URL"
+    else
+        wget -O "/tmp/podkop/${filename}" "$URL"
+    fi
 
     while IFS= read -r domain; do
         log "From downloaded file: $domain"
@@ -1468,7 +1651,12 @@ list_custom_url_subnets_create() {
     local URL="$1"
     local filename=$(basename "$URL")
 
-    wget -q -O "/tmp/podkop/${filename}" "$URL"
+    config_get_bool detour "main" "detour" "0"
+    if [ "$detour" -eq 1 ]; then
+        http_proxy="http://127.0.0.1:4534" https_proxy="http://127.0.0.1:4534" wget -O "/tmp/podkop/${filename}" "$URL"
+    else
+        wget -O "/tmp/podkop/${filename}" "$URL"
+    fi
 
     while IFS= read -r subnet; do
         log "From local file: $subnet"
@@ -1527,12 +1715,39 @@ sing_box_rules_source_ip_cidr() {
     fi
 }
 
+detour_mixed() {
+    local section="main"
+    local port="4534"
+    local tag="detour"
+    
+    log "Adding detour Socks5 for $section on port $port"
+    
+    jq \
+    --arg tag "$tag" \
+    --arg port "$port" \
+    --arg section "$section" \
+    '.inbounds += [{
+        "tag": $tag,
+        "type": "mixed",
+        "listen": "127.0.0.1",
+        "listen_port": ($port|tonumber),
+        "set_system_proxy": false
+    }] | 
+    .route.rules += [{
+        "inbound": [$tag],
+        "outbound": $section,
+        "action": "route"
+    }]' $SING_BOX_CONFIG >/tmp/sing-box-config-tmp.json && mv /tmp/sing-box-config-tmp.json $SING_BOX_CONFIG
+}
+
 ## nftables
 list_all_traffic_from_ip() {
     local ip="$1"
-    if ! nft list chain inet PodkopTable mangle | grep -q "ip saddr $ip"; then
+    local table="PodkopTable"
-        nft add set inet PodkopTable localv4 { type ipv4_addr\; flags interval\; }
+
-        nft add element inet PodkopTable localv4 { \
+    if ! nft list chain inet $table mangle | grep -q "ip saddr $ip"; then
+        nft add set inet $table localv4 { type ipv4_addr\; flags interval\; }
+        nft add element inet $table localv4 { \
             0.0.0.0/8, \
             10.0.0.0/8, \
             127.0.0.0/8, \
@@ -1546,8 +1761,8 @@ list_all_traffic_from_ip() {
             203.0.113.0/24, \
             224.0.0.0/4, \
             240.0.0.0-255.255.255.255 }
-        nft insert rule inet PodkopTable mangle iifname "br-lan" ip saddr $ip meta l4proto { tcp, udp } meta mark set 0x105 counter
+        nft insert rule inet $table mangle iifname "$SRC_INTERFACE" ip saddr $ip meta l4proto { tcp, udp } meta mark set 0x105 counter
-        nft insert rule inet PodkopTable mangle ip saddr $ip ip daddr @localv4 return
+        nft insert rule inet $table mangle ip saddr $ip ip daddr @localv4 return
     fi
 }
 
@@ -1659,7 +1874,14 @@ check_github() {
     for url in "$DOMAINS_RU_INSIDE" "$DOMAINS_RU_OUTSIDE" "$DOMAINS_UA" "$DOMAINS_YOUTUBE" \
               "$SUBNETS_TWITTER" "$SUBNETS_META" "$SUBNETS_DISCORD"; do
         local list_name=$(basename "$url")
+
+        config_get_bool detour "main" "detour" "0"
+        if [ "$detour" -eq 1 ]; then
+            http_proxy="http://127.0.0.1:4534" https_proxy="http://127.0.0.1:4534" wget -q -O /dev/null "$url"
+        else
             wget -q -O /dev/null "$url"
+        fi
+
         if [ $? -eq 0 ]; then
             nolog "- $list_name: available"
         else
@@ -1714,6 +1936,7 @@ check_sing_box_logs() {
 }
 
 check_fakeip() {
+    # Not used
     nolog "Checking fakeip functionality..."
     
     if ! command -v nslookup >/dev/null 2>&1; then
@@ -1781,12 +2004,24 @@ check_fakeip() {
 check_logs() {
     nolog "Showing podkop logs from system journal..."
     
-    if command -v logread >/dev/null 2>&1; then
+    if ! command -v logread >/dev/null 2>&1; then
-        logread -e podkop  | tail -n 50
-    else
         nolog "Error: logread command not found"
         return 1
     fi
+
+    # Get all logs first
+    local all_logs=$(logread)
+    
+    # Find the last occurrence of "Starting podkop"
+    local start_line=$(echo "$all_logs" | grep -n "podkop.*Starting podkop" | tail -n 1 | cut -d: -f1)
+    
+    if [ -z "$start_line" ]; then
+        nolog "No 'Starting podkop' message found in logs"
+        return 1
+    fi
+    
+    # Output all logs from the last start
+    echo "$all_logs" | tail -n +"$start_line"
 }
 
 show_sing_box_config() {
@@ -1824,8 +2059,6 @@ show_sing_box_config() {
 }
 
 show_config() {    
-    nolog "Current podkop configuration:"
-    
     if [ ! -f /etc/config/podkop ]; then
         nolog "Configuration file not found"
         return 1
@@ -1842,6 +2075,8 @@ show_config() {
         -e 's/\(ss:\/\/[^@]*@\)/ss:\/\/MASKED@/g' \
         -e 's/\(pbk=[^&]*\)/pbk=MASKED/g' \
         -e 's/\(sid=[^&]*\)/sid=MASKED/g' \
+        -e 's/\(option dns_server '\''[^'\'']*\.dns\.nextdns\.io'\''\)/option dns_server '\''MASKED.dns.nextdns.io'\''/g' \
+        -e "s|\(option dns_server 'dns\.nextdns\.io\)/[^']*|\1/MASKED|"
         > "$tmp_config"
 
     cat "$tmp_config"
@@ -1849,17 +2084,17 @@ show_config() {
 }
 
 show_version() {
-    local version=$(opkg info podkop | grep -m 1 "Version:" | cut -d' ' -f2)
+    local version=$(opkg list-installed podkop | awk '{print $3}')
     echo "$version"
 }
 
 show_luci_version() {
-    local version=$(opkg info luci-app-podkop | grep -m 1 "Version:" | cut -d' ' -f2)
+    local version=$(opkg list-installed luci-app-podkop | awk '{print $3}')
     echo "$version"
 }
 
 show_sing_box_version() {
-    local version=$(opkg info sing-box | grep -m 1 "Version:" | cut -d' ' -f2)
+    local version=$(sing-box version | head -n 1 | awk '{print $3}')
     echo "$version"
 }
 
@@ -1914,36 +2149,82 @@ get_sing_box_status() {
 }
 
 get_status() {
-    local running=0
     local enabled=0
     local status=""
 
     # Check if service is enabled
     if [ -x /etc/rc.d/S99podkop ]; then
         enabled=1
+        status="enabled"
+    else
+        status="disabled"
     fi
 
-    # Check if service is running
+    echo "{\"enabled\":$enabled,\"status\":\"$status\"}"
-    if pgrep -f "sing-box" >/dev/null; then
+}
-        running=1
+
+check_dns_available() {
+    local dns_type=$(uci get podkop.main.dns_type 2>/dev/null)
+    local dns_server=$(uci get podkop.main.dns_server 2>/dev/null)
+    local is_available=0
+    local status="unavailable"
+    local local_dns_working=0
+    local local_dns_status="unavailable"
+    
+    # Mask NextDNS ID if present
+    local display_dns_server="$dns_server"
+    if echo "$dns_server" | grep -q "\.dns\.nextdns\.io$"; then
+        local nextdns_id=$(echo "$dns_server" | cut -d'.' -f1)
+        display_dns_server="$(echo "$nextdns_id" | sed 's/./*/g').dns.nextdns.io"
+    elif echo "$dns_server" | grep -q "^dns\.nextdns\.io/"; then
+        local masked_path=$(echo "$dns_server" | cut -d'/' -f2- | sed 's/./*/g')
+        display_dns_server="dns.nextdns.io/$masked_path"
     fi
 
-    # Format status message
+    if [ "$dns_type" = "doh" ]; then
-    if [ $running -eq 1 ]; then
+        local result=""
-        if [ $enabled -eq 1 ]; then
+        
-            status="running & enabled"
+        if echo "$dns_server" | grep -q "quad9.net" || \
+           echo "$dns_server" | grep -qE "^9\.9\.9\.(9|10|11)$|^149\.112\.112\.(112|10|11)$|^2620:fe::(fe|9|10|11)$|^2620:fe::fe:(10|11)$"; then
+            result=$(curl --connect-timeout 5 -s -H "accept: application/dns-json" "https://$dns_server:5053/dns-query?name=itdog.info&type=A")
         else
-            status="running but disabled"
+            result=$(curl --connect-timeout 5 -s -H "accept: application/dns-json" "https://$dns_server/dns-query?name=itdog.info&type=A")
-        fi
+            if [ $? -eq 0 ] && echo "$result" | grep -q "data"; then
+                is_available=1
+                status="available"
             else
-        if [ $enabled -eq 1 ]; then
+                result=$(curl --connect-timeout 5 -s -H "accept: application/dns-json" "https://$dns_server/resolve?name=itdog.info&type=A")
-            status="stopped but enabled"
-        else
-            status="stopped & disabled"
             fi
         fi
         
-    echo "{\"running\":$running,\"enabled\":$enabled,\"status\":\"$status\"}"
+        if [ $? -eq 0 ] && echo "$result" | grep -q "data"; then
+            is_available=1
+            status="available"
+        fi
+    elif [ "$dns_type" = "dot" ]; then
+        (nc "$dns_server" 853 </dev/null >/dev/null 2>&1) & pid=$!
+        sleep 2
+        if kill -0 $pid 2>/dev/null; then
+            kill $pid 2>/dev/null
+            wait $pid 2>/dev/null
+        else
+            is_available=1
+            status="available"
+        fi
+    elif [ "$dns_type" = "udp" ]; then
+        if nslookup -timeout=2 itdog.info $dns_server >/dev/null 2>&1; then
+            is_available=1
+            status="available"
+        fi
+    fi
+    
+    # Check if local DNS resolver is working
+    if nslookup -timeout=2 $TEST_DOMAIN 127.0.0.1 >/dev/null 2>&1; then
+        local_dns_working=1
+        local_dns_status="available"
+    fi
+    
+    echo "{\"dns_type\":\"$dns_type\",\"dns_server\":\"$display_dns_server\",\"is_available\":$is_available,\"status\":\"$status\",\"local_dns_working\":$local_dns_working,\"local_dns_status\":\"$local_dns_status\"}"
 }
 
 sing_box_add_secure_dns_probe_domain() {
@@ -1975,6 +2256,154 @@ sing_box_add_secure_dns_probe_domain() {
     log "DNS probe domain ${domain} configured with override to port ${override_port}"
 }
 
+print_global() {
+    local message="$1"
+    echo "$message"
+}
+
+global_check() {
+    print_global "📡 Global check run!"
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "🛠️ System info"
+    print_global "🕳️ Podkop:     $(opkg list-installed podkop | awk '{print $3}')"
+    print_global "🕳️ LuCI App:   $(opkg list-installed luci-app-podkop | awk '{print $3}')"
+    print_global "📦 Sing-box:   $(sing-box version | head -n 1 | awk '{print $3}')"
+    print_global "🛜 OpenWrt:    $(grep OPENWRT_RELEASE /etc/os-release | cut -d'"' -f2)"
+    print_global "🛜 Device:     $(cat /tmp/sysinfo/model)"
+
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "📄 Podkop config"
+    show_config
+
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "🔧 System check"
+
+    if grep -E "^nameserver\s+([0-9]{1,3}\.){3}[0-9]{1,3}" "$RESOLV_CONF" | grep -vqE "127\.0\.0\.1|0\.0\.0\.0"; then
+        print_global "❌ /etc/resolv.conf contains external nameserver:"
+        cat /etc/resolv.conf
+        echo ""
+    else
+        print_global "✅ /etc/resolv.conf"
+    fi
+
+    cachesize="$(uci get dhcp.@dnsmasq[0].cachesize 2>/dev/null)"
+    noresolv="$(uci get dhcp.@dnsmasq[0].noresolv 2>/dev/null)"
+    server="$(uci get dhcp.@dnsmasq[0].server 2>/dev/null)"
+
+    if [ "$cachesize" != "0" ] || [ "$noresolv" != "1" ] || [ "$server" != "127.0.0.42" ]; then
+        print_global "❌ DHCP configuration differs from template. 📄 DHCP config:"
+        awk '/^config /{p=($2=="dnsmasq")} p' /etc/config/dhcp
+    elif [ "$(uci get podkop.main.dont_touch_dhcp 2>/dev/null)" = "1" ]; then
+        print_global "⚠️ dont_touch_dhcp is enabled. 📄 DHCP config:"
+        awk '/^config /{p=($2=="dnsmasq")} p' /etc/config/dhcp
+    else
+        print_global "✅ /etc/config/dhcp"
+    fi
+
+    if ! pgrep -f "sing-box" >/dev/null; then
+        print_global "❌ sing-box is not running"
+    else
+        print_global "✅ sing-box is running"
+    fi
+
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "🧱 NFT table"
+    if ! nft list table inet PodkopTable >/dev/null 2>&1; then
+        print_global "❌ PodkopTable not found"
+    else
+        nft list table inet PodkopTable
+    fi
+
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "📄 WAN config"
+    if uci show network.wan >/dev/null 2>&1; then
+        awk '
+            /^config / {
+                p = ($2 == "interface" && $3 == "'\''wan'\''")
+                proto = ""
+            }
+            p {
+                if ($1 == "option" && $2 == "proto") {
+                    proto = $3
+                    print
+                } else if (proto == "'\''static'\''" && $1 == "option" && ($2 == "ipaddr" || $2 == "netmask" || $2 == "gateway")) {
+                    print "        option", $2, "'\''******'\''"
+                } else if (proto == "'\''pppoe'\''" && $1 == "option" && ($2 == "username" || $2 == "password")) {
+                    print "        option", $2, "'\''******'\''"
+                } else {
+                    print
+                }
+            }
+        ' /etc/config/network
+    else
+        print_global "❌ WAN configuration not found"
+    fi
+
+    if uci show network | grep -q endpoint_host; then
+        uci show network | grep endpoint_host | cut -d'=' -f2 | tr -d "'\" " | while read -r host; do
+            if [ "$host" = "engage.cloudflareclient.com" ]; then
+                print_global "⚠️ WARP detected: $host"
+                continue
+            fi
+
+            ip_prefix=$(echo "$host" | cut -d'.' -f1,2)
+            if echo "$CLOUDFLARE_OCTETS" | grep -wq "$ip_prefix"; then
+                print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+                print_global "⚠️ WARP detected: $host"
+            fi
+        done
+    fi
+
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "➡️ DNS status"
+    dns_info=$(check_dns_available)
+    dns_type=$(echo "$dns_info" | jq -r '.dns_type')
+    dns_server=$(echo "$dns_info" | jq -r '.dns_server')
+    status=$(echo "$dns_info" | jq -r '.status')
+    print_global "$dns_type ($dns_server) is $status"
+
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "🔁 FakeIP"
+        
+    print_global "➡️ DNS resolution: system DNS server"
+    nslookup -timeout=2 $TEST_DOMAIN
+    
+    local working_resolver=$(find_working_resolver)
+    if [ -z "$working_resolver" ]; then
+        print_global "❌ No working external resolver found"
+    else      
+        print_global "➡️ DNS resolution: external resolver ($working_resolver)"
+        nslookup -timeout=2 $TEST_DOMAIN $working_resolver
+    fi
+    
+    print_global "➡️ DNS resolution: sing-box DNS server (127.0.0.42)"
+    local result=$(nslookup -timeout=2 $TEST_DOMAIN 127.0.0.42 2>&1)
+    echo "$result"
+    
+    if echo "$result" | grep -q "198.18"; then
+        print_global "✅ FakeIP is working correctly on router (198.18.x.x)"
+    else
+        print_global "❌ FakeIP test failed: Domain did not resolve to FakeIP range"
+        if ! pgrep -f "sing-box" >/dev/null; then
+            print_global " ❌ sing-box is not running"
+        else
+            print_global " 🤔 sing-box is running, checking configuration"
+            
+            if [ -f "$SING_BOX_CONFIG" ]; then
+                local fakeip_enabled=$(jq -r '.dns.fakeip.enabled' "$SING_BOX_CONFIG")
+                local fakeip_range=$(jq -r '.dns.fakeip.inet4_range' "$SING_BOX_CONFIG")
+                local dns_rules=$(jq -r '.dns.rules[] | select(.server == "fakeip-server") | .domain' "$SING_BOX_CONFIG")
+                
+                print_global "    📦 FakeIP enabled: $fakeip_enabled"
+                print_global "    📦 FakeIP range: $fakeip_range"
+                print_global "    📦 FakeIP domain: $dns_rules"
+            else
+                print_global "    ⛔ sing-box config file not found"
+            fi
+        fi
+    fi
+}
+
 case "$1" in
     start)
         start
@@ -1982,9 +2411,11 @@ case "$1" in
     stop)
         stop
         ;;
+    reload)
+        reload
+        ;;
     restart)
-        stop
+        restart
-        start
         ;;
     main)
         main
@@ -2040,8 +2471,14 @@ case "$1" in
     get_sing_box_status)
         get_sing_box_status
         ;;
+    check_dns_available)
+        check_dns_available
+        ;;
+    global_check)
+        global_check
+        ;;
     *)
-        echo "Usage: $0 {start|stop|restart|reload|enable|disable|main|list_update|check_proxy|check_nft|check_github|check_logs|check_sing_box_connections|check_sing_box_logs|check_fakeip|check_dnsmasq|show_config|show_version|show_sing_box_config|show_luci_version|show_sing_box_version|show_system_info|get_status|get_sing_box_status}"
+        echo "Usage: $0 {start|stop|reload|restart|enable|disable|main|list_update|check_proxy|check_nft|check_github|check_logs|check_sing_box_connections|check_sing_box_logs|check_fakeip|check_dnsmasq|show_config|show_version|show_sing_box_config|show_luci_version|show_sing_box_version|show_system_info|get_status|get_sing_box_status|check_dns_available|global_check}"
         exit 1
         ;;
 esac