diff --git a/config/flcalsh/flclash.yaml b/config/flcalsh/flclash.yaml
index bc25da5..ca0758e 100644
--- a/config/flcalsh/flclash.yaml
+++ b/config/flcalsh/flclash.yaml
@@ -9,28 +9,40 @@ mode: rule
 log-level: info
 external-controller: 127.0.0.1:9090
 
+mixed-port: 7890
+allow-lan: true
+bind-address: "*"
+mode: rule
+log-level: info
+external-controller: 127.0.0.1:9090
+
 dns:
   enable: true
-  listen: 0.0.0.0:53
+  # listen: 0.0.0.0:53
   ipv6: false
 
-  default-nameserver:
-    - 223.5.5.5
-    - 119.29.29.29
+  default-nameserver: [223.5.5.5, 119.29.29.29]
   enhanced-mode: fake-ip
   fake-ip-range: 198.18.0.1/16
+  fake-ip-filter: 
+    - '*.lan'
+    - "rule-set:salem@cn,GitHub,fake-ip-filter"
+    - 'geosite:cn'
   use-hosts: true
-  nameserver:
-    - https://doh.pub/dns-query
-    - https://dns.alidns.com/dns-query
-  fallback:
-    - https://1.1.1.1/dns-query
+  nameserver: [https://223.5.5.5/dns-query, https://doh.pub/dns-query]
+  fallback: [https://1.1.1.1/dns-query, https://8.8.8.8/dns-query]
   fallback-filter:
     geoip: true
-    geoip-code: CN
+    geoip-code: CN                 # 关键核心：告诉 Stash 只要国内 DNS 解析出的 IP 不在中国境内，就代表被污染/泄露了，必须丢弃！
     ipcidr:
       - 240.0.0.0/4
       - 0.0.0.0/32
+    geosite:                       # 加上这个更保险
+      - gfw
+      - geolocation-!cn
+  nameserver-policy:
+    'geosite:cn': [https://223.5.5.5/dns-query, https://119.29.29.29/dns-query]
+    'rule-set:google,AI,geolocation-!cn': [https://1.1.1.1/dns-query, https://8.8.8.8/dns-query]
   fake-ip-filter: 
     - '*.lan'
     - "rule-set:salem@cn,GitHub,fake-ip-filter"