diff --git a/config/flcalsh/flclash.yaml b/config/flcalsh/flclash.yaml
index bff014a..27f45b3 100644
--- a/config/flcalsh/flclash.yaml
+++ b/config/flcalsh/flclash.yaml
@@ -9,6 +9,15 @@ mode: rule
 log-level: info
 external-controller: 127.0.0.1:9090
 
+tun:
+  enable: true                # 1. 必须改为 true 才能真正启用
+  stack: mixed                # 2. 改为 mixed 性能最好，或者用 system
+  auto-route: true            
+  strict-route: true          # 3. 建议改为 true，开启严格路由模式，能够更彻底地封死特定软件绕过代理的行为
+  auto-detect-interface: true 
+  dns-hijack:
+    - any:53                  # 4. 修正了这里的空格缩进，强行劫持全部本地 DNS 请求
+
 dns:
   enable: true
   listen: 0.0.0.0:7874
@@ -17,11 +26,11 @@ dns:
   use-hosts: true
   use-system-hosts: true
   default-nameserver:
-  - 223.5.5.5
-  - 119.29.29.29
+    - 223.5.5.5
+    - 119.29.29.29
   nameserver:
-  - https://223.5.5.5/dns-query
-  - https://doh.pub/dns-query
+    - https://223.5.5.5/dns-query
+    - https://doh.pub/dns-query
   nameserver-policy:
    'geosite:cn,apple,private':
      - 223.5.5.5