diff --git a/openwrt_clash_v2.yml b/openwrt_clash_v2.yml
index bd5b5ab..1d02bbe 100644
--- a/openwrt_clash_v2.yml
+++ b/openwrt_clash_v2.yml
@@ -163,6 +163,7 @@ proxies:
   # vless://3e7dab20-a75f-4da0-a338-6bc5d5b6d0c1@dmit01.likezgq.top:2053?type=ws&encryption=none&path=%2Fws&host=dmcf.likezgq.top&security=tls&fp=chrome&alpn=h2%2Chttp%2F1.1&sni=dmcf.likezgq.top#vless%2Bwebsocket-ifnkvalb
   - name: "vless_dmitcf_likezgq"
     type: vless
+    udp: true
     server: dmitcf.likezgq.top
     port: 2053
     uuid: 3e7dab20-a75f-4da0-a338-6bc5d5b6d0c1
@@ -178,6 +179,7 @@ proxies:
   # vless://56cc48b8-0603-43b0-b5f4-0b4f9f62bd7d@dmit02.likezgq.top:33666?type=tcp&encryption=none&security=reality&pbk=M771aZAjU3l8XeOq9U3mY0JrbcOZPE00fLMYQH2L3xI&fp=chrome&sni=www.amazon.com&sid=c8e608f37b8f2a21&spx=%2F#tcp%2Breality-ntu1wls4
   - name: "vless_dmit02_reality_likezgq"
     type: vless
+    udp: true
     server: dmit02.likezgq.top
     port: 33666
     uuid: 56cc48b8-0603-43b0-b5f4-0b4f9f62bd7d
@@ -621,56 +623,103 @@ rule-providers:
     path: ./ruleset/tiktok.yaml
     interval: 86400
 rules:
+  # A matching proxy without UDP support must reject, not resume at DIRECT.
   - AND,((NETWORK,UDP),(DST-PORT,443)),REJECT
   - DST-PORT,22,EXIT_SELF_HOSTED
+  - AND,((NETWORK,udp),(DST-PORT,22)),REJECT
   - DOMAIN-SUFFIX,ipinfo.io,POLICY_IP_CHECK
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,ipinfo.io)),REJECT
   - DOMAIN-SUFFIX,scamalytics.com,POLICY_IP_CHECK
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,scamalytics.com)),REJECT
   - DOMAIN-SUFFIX,ping0.cc,POLICY_IP_CHECK
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,ping0.cc)),REJECT
   - DOMAIN,huggingface.co,EXIT_SELF_HOSTED
+  - AND,((NETWORK,udp),(DOMAIN,huggingface.co)),REJECT
   - RULE-SET,service_twitter,POLICY_TWITTER
+  - AND,((NETWORK,udp),(RULE-SET,service_twitter)),REJECT
   - RULE-SET,service_anthropic,POLICY_ANTHROPIC
+  - AND,((NETWORK,udp),(RULE-SET,service_anthropic)),REJECT
   - RULE-SET,service_openai,POLICY_OPENAI
+  - AND,((NETWORK,udp),(RULE-SET,service_openai)),REJECT
   - RULE-SET,service_binance,POLICY_BINANCE
+  - AND,((NETWORK,udp),(RULE-SET,service_binance)),REJECT
   # YouTube overlaps Google; keep its independent business policy first.
   - RULE-SET,service_youtube,POLICY_YOUTUBE
+  - AND,((NETWORK,udp),(RULE-SET,service_youtube)),REJECT
   - RULE-SET,service_google,POLICY_GOOGLE
+  - AND,((NETWORK,udp),(RULE-SET,service_google)),REJECT
   - DOMAIN-SUFFIX,cursor.sh,POLICY_XAI
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,cursor.sh)),REJECT
   - DOMAIN-KEYWORD,grok,POLICY_XAI
+  - AND,((NETWORK,udp),(DOMAIN-KEYWORD,grok)),REJECT
   - DOMAIN-SUFFIX,intercomcdn.com,POLICY_DEFAULT
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,intercomcdn.com)),REJECT
   - DOMAIN-SUFFIX,cdn.usefathom.com,POLICY_DEFAULT
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,cdn.usefathom.com)),REJECT
   - DOMAIN-SUFFIX,stripe.com,POLICY_STRIPE
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,stripe.com)),REJECT
 
   - DOMAIN-KEYWORD,discord,EXIT_AMERICA
+  - AND,((NETWORK,udp),(DOMAIN-KEYWORD,discord)),REJECT
   - DOMAIN-KEYWORD,us-api,EXIT_AMERICA
+  - AND,((NETWORK,udp),(DOMAIN-KEYWORD,us-api)),REJECT
   - DOMAIN-KEYWORD,paypal,EXIT_AMERICA
+  - AND,((NETWORK,udp),(DOMAIN-KEYWORD,paypal)),REJECT
   - DOMAIN-KEYWORD,paypa1,EXIT_AMERICA
+  - AND,((NETWORK,udp),(DOMAIN-KEYWORD,paypa1)),REJECT
   - DOMAIN-KEYWORD,schwab,POLICY_SCHWAB
+  - AND,((NETWORK,udp),(DOMAIN-KEYWORD,schwab)),REJECT
   - DOMAIN-KEYWORD,thinkorswim,POLICY_SCHWAB
+  - AND,((NETWORK,udp),(DOMAIN-KEYWORD,thinkorswim)),REJECT
   - DOMAIN-SUFFIX,wise.com,POLICY_WISE
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,wise.com)),REJECT
 
   - DOMAIN-SUFFIX,bybit.com,POLICY_BYBIT
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,bybit.com)),REJECT
   - DOMAIN-SUFFIX,bybit.biz,POLICY_BYBIT
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,bybit.biz)),REJECT
   - DOMAIN-SUFFIX,bybitglobal.com,POLICY_BYBIT
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,bybitglobal.com)),REJECT
   - DOMAIN-SUFFIX,mexc.com,POLICY_MEXC
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,mexc.com)),REJECT
   - DOMAIN-SUFFIX,greentreeone.com,POLICY_MEXC
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,greentreeone.com)),REJECT
   - DOMAIN-SUFFIX,flytogarden.com,POLICY_MEXC
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,flytogarden.com)),REJECT
   - DOMAIN-SUFFIX,hotbookzone.com,POLICY_MEXC
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,hotbookzone.com)),REJECT
   - DOMAIN-SUFFIX,coldbookfly.ru,POLICY_MEXC
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,coldbookfly.ru)),REJECT
   - DOMAIN-SUFFIX,maya.ph,POLICY_PAYMAYA
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,maya.ph)),REJECT
   - DOMAIN-SUFFIX,paymaya.com,POLICY_PAYMAYA
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,paymaya.com)),REJECT
   - DOMAIN-SUFFIX,mayabank.ph,POLICY_PAYMAYA
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,mayabank.ph)),REJECT
   - DOMAIN-SUFFIX,polymarket.com,POLICY_POLYMARKET
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,polymarket.com)),REJECT
   - DOMAIN-KEYWORD,reddit.com,POLICY_EASY_IPBLOCK
+  - AND,((NETWORK,udp),(DOMAIN-KEYWORD,reddit.com)),REJECT
   - DOMAIN-KEYWORD,avgle,POLICY_COLOR
+  - AND,((NETWORK,udp),(DOMAIN-KEYWORD,avgle)),REJECT
   - DOMAIN-KEYWORD,porn,POLICY_COLOR
+  - AND,((NETWORK,udp),(DOMAIN-KEYWORD,porn)),REJECT
   - DOMAIN-KEYWORD,xvideo,POLICY_COLOR
+  - AND,((NETWORK,udp),(DOMAIN-KEYWORD,xvideo)),REJECT
   - DOMAIN-KEYWORD,xhamster,POLICY_COLOR
+  - AND,((NETWORK,udp),(DOMAIN-KEYWORD,xhamster)),REJECT
   - DOMAIN-SUFFIX,ycombinator.com,POLICY_DEFAULT
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,ycombinator.com)),REJECT
   - DOMAIN-SUFFIX,distrowatch.com,POLICY_DEFAULT
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,distrowatch.com)),REJECT
   - DOMAIN-SUFFIX,pypi.org,POLICY_DEFAULT
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,pypi.org)),REJECT
   - DOMAIN-SUFFIX,pythonhosted.org,POLICY_DEFAULT
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,pythonhosted.org)),REJECT
   - DOMAIN-SUFFIX,nvidia.com,POLICY_DEFAULT
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,nvidia.com)),REJECT
   - DOMAIN-SUFFIX,tailscale.com,POLICY_DEFAULT
+  - AND,((NETWORK,udp),(DOMAIN-SUFFIX,tailscale.com)),REJECT
   - DOMAIN-KEYWORD,time.windows.com,DIRECT
   - DOMAIN-SUFFIX,likezgq.top,DIRECT
   - DOMAIN-KEYWORD,ra2web.com,DIRECT
@@ -689,7 +738,9 @@ rules:
   - PROCESS-NAME,tailscaled,DIRECT
   - PROCESS-NAME,Tailscale,DIRECT
   - RULE-SET,github,EXIT_SELF_HOSTED
+  - AND,((NETWORK,udp),(RULE-SET,github)),REJECT
   - RULE-SET,tiktok,EXIT_AMERICA
+  - AND,((NETWORK,udp),(RULE-SET,tiktok)),REJECT
   - RULE-SET,applications,DIRECT
   - RULE-SET,private,DIRECT
   - RULE-SET,reject,REJECT
@@ -698,7 +749,9 @@ rules:
   # - RULE-SET,google,DIRECT
   - RULE-SET,direct,DIRECT
   - RULE-SET,proxy,POLICY_DEFAULT
+  - AND,((NETWORK,udp),(RULE-SET,proxy)),REJECT
   - RULE-SET,telegramcidr,POLICY_DEFAULT,no-resolve
+  - AND,((NETWORK,udp),(RULE-SET,telegramcidr,no-resolve)),REJECT
   - IP-CIDR,104.27.80.65/32,DIRECT,no-resolve
   - IP-CIDR,104.16.29.191/32,DIRECT,no-resolve
   - IP-CIDR,141.101.115.236/32,DIRECT,no-resolve
@@ -709,6 +762,9 @@ rules:
   - RULE-SET,cncidr,DIRECT,no-resolve
   - GEOIP,LAN,DIRECT,no-resolve
   - GEOIP,CN,DIRECT
+  # Default UDP never falls through to the core's implicit DIRECT exit.
+  - NETWORK,udp,EXIT_SELF_HOSTED_STABLE
+  - NETWORK,udp,REJECT
   - MATCH,POLICY_DEFAULT
 find-process-mode: off
 ipv6: true
@@ -745,11 +801,25 @@ dns:
   default-nameserver:
     - 223.5.5.5
     - 223.6.6.6
+  # Independent node bootstrap; never use these as fallback for ordinary queries.
   proxy-server-nameserver:
-    - https://223.5.5.5/dns-query
-    - https://223.6.6.6/dns-query
+    - https://223.5.5.5/dns-query#DIRECT
+    - https://223.6.6.6/dns-query#DIRECT
+  # Local split DNS and known domestic domains stay on the LAN resolver.
+  nameserver-policy:
+    'geosite:cn': 192.168.11.100
+    '+.lan': 192.168.11.100
+    '+.local': 192.168.11.100
+    '+.home.arpa': 192.168.11.100
+    '+.in-addr.arpa': 192.168.11.100
+    '+.ip6.arpa': 192.168.11.100
+    '+.likezgq.top': 192.168.11.100
+    '+.likezgq.pub': 192.168.11.100
+    '+.home.pub': 192.168.11.100
+  # Unknown domains also use the proxy. Do not add domestic parallel/fallback DNS.
   nameserver:
-    - 192.168.11.100
+    - https://1.1.1.1/dns-query#EXIT_SELF_HOSTED_STABLE
+    - https://8.8.8.8/dns-query#EXIT_SELF_HOSTED_STABLE
 profile:
   store-selected: true
   store-fake-ip: true
diff --git a/phone_clash_v2.yml b/phone_clash_v2.yml
index 76f2db1..b4740f0 100644
--- a/phone_clash_v2.yml
+++ b/phone_clash_v2.yml
@@ -174,6 +174,7 @@ proxy-providers:
 proxies:
 - name: vless_dmitcf_likezgq
   type: vless
+  udp: true
   server: dmitcf.likezgq.top
   port: 2053
   uuid: 3e7dab20-a75f-4da0-a338-6bc5d5b6d0c1
@@ -187,6 +188,7 @@ proxies:
     path: /ws
 - name: vless_dmit02_reality_likezgq
   type: vless
+  udp: true
   server: dmit02.likezgq.top
   port: 33666
   uuid: 56cc48b8-0603-43b0-b5f4-0b4f9f62bd7d
@@ -618,51 +620,97 @@ rule-providers:
     interval: 86400
 rules:
 - DST-PORT,22,EXIT_SELF_HOSTED
+- AND,((NETWORK,udp),(DST-PORT,22)),REJECT
 - DOMAIN-SUFFIX,ipinfo.io,POLICY_IP_CHECK
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,ipinfo.io)),REJECT
 - DOMAIN-SUFFIX,scamalytics.com,POLICY_IP_CHECK
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,scamalytics.com)),REJECT
 - DOMAIN-SUFFIX,ping0.cc,POLICY_IP_CHECK
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,ping0.cc)),REJECT
 - DOMAIN,huggingface.co,EXIT_SELF_HOSTED
+- AND,((NETWORK,udp),(DOMAIN,huggingface.co)),REJECT
 - RULE-SET,service_twitter,POLICY_TWITTER
+- AND,((NETWORK,udp),(RULE-SET,service_twitter)),REJECT
 - RULE-SET,service_anthropic,POLICY_ANTHROPIC
+- AND,((NETWORK,udp),(RULE-SET,service_anthropic)),REJECT
 - RULE-SET,service_openai,POLICY_OPENAI
+- AND,((NETWORK,udp),(RULE-SET,service_openai)),REJECT
 - RULE-SET,service_binance,POLICY_BINANCE
+- AND,((NETWORK,udp),(RULE-SET,service_binance)),REJECT
 - RULE-SET,service_youtube,POLICY_YOUTUBE
+- AND,((NETWORK,udp),(RULE-SET,service_youtube)),REJECT
 - RULE-SET,service_google,POLICY_GOOGLE
+- AND,((NETWORK,udp),(RULE-SET,service_google)),REJECT
 - DOMAIN-SUFFIX,cursor.sh,POLICY_XAI
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,cursor.sh)),REJECT
 - DOMAIN-KEYWORD,grok,POLICY_XAI
+- AND,((NETWORK,udp),(DOMAIN-KEYWORD,grok)),REJECT
 - DOMAIN-SUFFIX,intercomcdn.com,POLICY_DEFAULT
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,intercomcdn.com)),REJECT
 - DOMAIN-SUFFIX,cdn.usefathom.com,POLICY_DEFAULT
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,cdn.usefathom.com)),REJECT
 - DOMAIN-SUFFIX,stripe.com,POLICY_STRIPE
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,stripe.com)),REJECT
 - DOMAIN-KEYWORD,discord,EXIT_AMERICA
+- AND,((NETWORK,udp),(DOMAIN-KEYWORD,discord)),REJECT
 - DOMAIN-KEYWORD,us-api,EXIT_AMERICA
+- AND,((NETWORK,udp),(DOMAIN-KEYWORD,us-api)),REJECT
 - DOMAIN-KEYWORD,paypal,EXIT_AMERICA
+- AND,((NETWORK,udp),(DOMAIN-KEYWORD,paypal)),REJECT
 - DOMAIN-KEYWORD,paypa1,EXIT_AMERICA
+- AND,((NETWORK,udp),(DOMAIN-KEYWORD,paypa1)),REJECT
 - DOMAIN-KEYWORD,schwab,POLICY_SCHWAB
+- AND,((NETWORK,udp),(DOMAIN-KEYWORD,schwab)),REJECT
 - DOMAIN-KEYWORD,thinkorswim,POLICY_SCHWAB
+- AND,((NETWORK,udp),(DOMAIN-KEYWORD,thinkorswim)),REJECT
 - DOMAIN-SUFFIX,wise.com,POLICY_WISE
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,wise.com)),REJECT
 - DOMAIN-SUFFIX,bybit.com,POLICY_BYBIT
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,bybit.com)),REJECT
 - DOMAIN-SUFFIX,bybit.biz,POLICY_BYBIT
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,bybit.biz)),REJECT
 - DOMAIN-SUFFIX,bybitglobal.com,POLICY_BYBIT
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,bybitglobal.com)),REJECT
 - DOMAIN-SUFFIX,mexc.com,POLICY_MEXC
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,mexc.com)),REJECT
 - DOMAIN-SUFFIX,greentreeone.com,POLICY_MEXC
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,greentreeone.com)),REJECT
 - DOMAIN-SUFFIX,flytogarden.com,POLICY_MEXC
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,flytogarden.com)),REJECT
 - DOMAIN-SUFFIX,hotbookzone.com,POLICY_MEXC
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,hotbookzone.com)),REJECT
 - DOMAIN-SUFFIX,coldbookfly.ru,POLICY_MEXC
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,coldbookfly.ru)),REJECT
 - DOMAIN-SUFFIX,maya.ph,POLICY_PAYMAYA
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,maya.ph)),REJECT
 - DOMAIN-SUFFIX,paymaya.com,POLICY_PAYMAYA
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,paymaya.com)),REJECT
 - DOMAIN-SUFFIX,mayabank.ph,POLICY_PAYMAYA
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,mayabank.ph)),REJECT
 - DOMAIN-SUFFIX,polymarket.com,POLICY_POLYMARKET
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,polymarket.com)),REJECT
 - DOMAIN-KEYWORD,reddit.com,POLICY_EASY_IPBLOCK
+- AND,((NETWORK,udp),(DOMAIN-KEYWORD,reddit.com)),REJECT
 - DOMAIN-KEYWORD,avgle,POLICY_COLOR
+- AND,((NETWORK,udp),(DOMAIN-KEYWORD,avgle)),REJECT
 - DOMAIN-KEYWORD,porn,POLICY_COLOR
+- AND,((NETWORK,udp),(DOMAIN-KEYWORD,porn)),REJECT
 - DOMAIN-KEYWORD,xvideo,POLICY_COLOR
+- AND,((NETWORK,udp),(DOMAIN-KEYWORD,xvideo)),REJECT
 - DOMAIN-KEYWORD,xhamster,POLICY_COLOR
+- AND,((NETWORK,udp),(DOMAIN-KEYWORD,xhamster)),REJECT
 - DOMAIN-SUFFIX,ycombinator.com,POLICY_DEFAULT
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,ycombinator.com)),REJECT
 - DOMAIN-SUFFIX,distrowatch.com,POLICY_DEFAULT
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,distrowatch.com)),REJECT
 - DOMAIN-SUFFIX,pypi.org,POLICY_DEFAULT
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,pypi.org)),REJECT
 - DOMAIN-SUFFIX,pythonhosted.org,POLICY_DEFAULT
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,pythonhosted.org)),REJECT
 - DOMAIN-SUFFIX,nvidia.com,POLICY_DEFAULT
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,nvidia.com)),REJECT
 - DOMAIN-SUFFIX,tailscale.com,POLICY_DEFAULT
+- AND,((NETWORK,udp),(DOMAIN-SUFFIX,tailscale.com)),REJECT
 - DOMAIN-KEYWORD,time.windows.com,DIRECT
 - DOMAIN-SUFFIX,likezgq.top,DIRECT
 - DOMAIN-KEYWORD,ra2web.com,DIRECT
@@ -681,7 +729,9 @@ rules:
 - PROCESS-NAME,tailscaled,DIRECT
 - PROCESS-NAME,Tailscale,DIRECT
 - RULE-SET,github,EXIT_SELF_HOSTED
+- AND,((NETWORK,udp),(RULE-SET,github)),REJECT
 - RULE-SET,tiktok,EXIT_AMERICA
+- AND,((NETWORK,udp),(RULE-SET,tiktok)),REJECT
 - RULE-SET,applications,DIRECT
 - RULE-SET,private,DIRECT
 - RULE-SET,reject,REJECT
@@ -691,7 +741,9 @@ rules:
 - RULE-SET,apple,DIRECT
 - RULE-SET,direct,DIRECT
 - RULE-SET,proxy,POLICY_DEFAULT
+- AND,((NETWORK,udp),(RULE-SET,proxy)),REJECT
 - RULE-SET,telegramcidr,POLICY_DEFAULT,no-resolve
+- AND,((NETWORK,udp),(RULE-SET,telegramcidr,no-resolve)),REJECT
 - IP-CIDR,104.27.80.65/32,DIRECT,no-resolve
 - IP-CIDR,104.16.29.191/32,DIRECT,no-resolve
 - IP-CIDR,141.101.115.236/32,DIRECT,no-resolve
@@ -702,4 +754,6 @@ rules:
 - RULE-SET,cncidr,DIRECT,no-resolve
 - GEOIP,LAN,DIRECT,no-resolve
 - GEOIP,CN,DIRECT
+- NETWORK,udp,EXIT_SELF_HOSTED_STABLE
+- NETWORK,udp,REJECT
 - MATCH,POLICY_DEFAULT
diff --git a/phone_singbox_v2.json b/phone_singbox_v2.json
index 45debc3..f65d01f 100644
--- a/phone_singbox_v2.json
+++ b/phone_singbox_v2.json
@@ -785,6 +785,11 @@
         "action": "route",
         "outbound": "EXIT_SELF_HOSTED"
       },
+      {
+        "network": "udp",
+        "port": 22,
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "ipinfo.io"
@@ -792,6 +797,13 @@
         "action": "route",
         "outbound": "POLICY_IP_CHECK"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "ipinfo.io"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "scamalytics.com"
@@ -799,6 +811,13 @@
         "action": "route",
         "outbound": "POLICY_IP_CHECK"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "scamalytics.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "ping0.cc"
@@ -806,6 +825,13 @@
         "action": "route",
         "outbound": "POLICY_IP_CHECK"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "ping0.cc"
+        ],
+        "action": "reject"
+      },
       {
         "domain": [
           "huggingface.co"
@@ -813,6 +839,13 @@
         "action": "route",
         "outbound": "EXIT_SELF_HOSTED"
       },
+      {
+        "network": "udp",
+        "domain": [
+          "huggingface.co"
+        ],
+        "action": "reject"
+      },
       {
         "rule_set": [
           "service_twitter"
@@ -820,6 +853,13 @@
         "action": "route",
         "outbound": "POLICY_TWITTER"
       },
+      {
+        "network": "udp",
+        "rule_set": [
+          "service_twitter"
+        ],
+        "action": "reject"
+      },
       {
         "rule_set": [
           "service_anthropic"
@@ -827,6 +867,13 @@
         "action": "route",
         "outbound": "POLICY_ANTHROPIC"
       },
+      {
+        "network": "udp",
+        "rule_set": [
+          "service_anthropic"
+        ],
+        "action": "reject"
+      },
       {
         "rule_set": [
           "service_openai"
@@ -834,6 +881,13 @@
         "action": "route",
         "outbound": "POLICY_OPENAI"
       },
+      {
+        "network": "udp",
+        "rule_set": [
+          "service_openai"
+        ],
+        "action": "reject"
+      },
       {
         "rule_set": [
           "service_binance"
@@ -841,6 +895,13 @@
         "action": "route",
         "outbound": "POLICY_BINANCE"
       },
+      {
+        "network": "udp",
+        "rule_set": [
+          "service_binance"
+        ],
+        "action": "reject"
+      },
       {
         "rule_set": [
           "service_youtube"
@@ -848,6 +909,13 @@
         "action": "route",
         "outbound": "POLICY_YOUTUBE"
       },
+      {
+        "network": "udp",
+        "rule_set": [
+          "service_youtube"
+        ],
+        "action": "reject"
+      },
       {
         "rule_set": [
           "service_google"
@@ -855,6 +923,13 @@
         "action": "route",
         "outbound": "POLICY_GOOGLE"
       },
+      {
+        "network": "udp",
+        "rule_set": [
+          "service_google"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "cursor.sh"
@@ -862,6 +937,13 @@
         "action": "route",
         "outbound": "POLICY_XAI"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "cursor.sh"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "grok"
@@ -869,6 +951,13 @@
         "action": "route",
         "outbound": "POLICY_XAI"
       },
+      {
+        "network": "udp",
+        "domain_keyword": [
+          "grok"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "intercomcdn.com"
@@ -876,6 +965,13 @@
         "action": "route",
         "outbound": "POLICY_DEFAULT"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "intercomcdn.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "cdn.usefathom.com"
@@ -883,6 +979,13 @@
         "action": "route",
         "outbound": "POLICY_DEFAULT"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "cdn.usefathom.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "stripe.com"
@@ -890,6 +993,13 @@
         "action": "route",
         "outbound": "POLICY_STRIPE"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "stripe.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "discord"
@@ -897,6 +1007,13 @@
         "action": "route",
         "outbound": "EXIT_AMERICA"
       },
+      {
+        "network": "udp",
+        "domain_keyword": [
+          "discord"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "us-api"
@@ -904,6 +1021,13 @@
         "action": "route",
         "outbound": "EXIT_AMERICA"
       },
+      {
+        "network": "udp",
+        "domain_keyword": [
+          "us-api"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "paypal"
@@ -911,6 +1035,13 @@
         "action": "route",
         "outbound": "EXIT_AMERICA"
       },
+      {
+        "network": "udp",
+        "domain_keyword": [
+          "paypal"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "paypa1"
@@ -918,6 +1049,13 @@
         "action": "route",
         "outbound": "EXIT_AMERICA"
       },
+      {
+        "network": "udp",
+        "domain_keyword": [
+          "paypa1"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "schwab"
@@ -925,6 +1063,13 @@
         "action": "route",
         "outbound": "POLICY_SCHWAB"
       },
+      {
+        "network": "udp",
+        "domain_keyword": [
+          "schwab"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "thinkorswim"
@@ -932,6 +1077,13 @@
         "action": "route",
         "outbound": "POLICY_SCHWAB"
       },
+      {
+        "network": "udp",
+        "domain_keyword": [
+          "thinkorswim"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "wise.com"
@@ -939,6 +1091,13 @@
         "action": "route",
         "outbound": "POLICY_WISE"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "wise.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "bybit.com"
@@ -946,6 +1105,13 @@
         "action": "route",
         "outbound": "POLICY_BYBIT"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "bybit.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "bybit.biz"
@@ -953,6 +1119,13 @@
         "action": "route",
         "outbound": "POLICY_BYBIT"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "bybit.biz"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "bybitglobal.com"
@@ -960,6 +1133,13 @@
         "action": "route",
         "outbound": "POLICY_BYBIT"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "bybitglobal.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "mexc.com"
@@ -967,6 +1147,13 @@
         "action": "route",
         "outbound": "POLICY_MEXC"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "mexc.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "greentreeone.com"
@@ -974,6 +1161,13 @@
         "action": "route",
         "outbound": "POLICY_MEXC"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "greentreeone.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "flytogarden.com"
@@ -981,6 +1175,13 @@
         "action": "route",
         "outbound": "POLICY_MEXC"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "flytogarden.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "hotbookzone.com"
@@ -988,6 +1189,13 @@
         "action": "route",
         "outbound": "POLICY_MEXC"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "hotbookzone.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "coldbookfly.ru"
@@ -995,6 +1203,13 @@
         "action": "route",
         "outbound": "POLICY_MEXC"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "coldbookfly.ru"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "maya.ph"
@@ -1002,6 +1217,13 @@
         "action": "route",
         "outbound": "POLICY_PAYMAYA"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "maya.ph"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "paymaya.com"
@@ -1009,6 +1231,13 @@
         "action": "route",
         "outbound": "POLICY_PAYMAYA"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "paymaya.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "mayabank.ph"
@@ -1016,6 +1245,13 @@
         "action": "route",
         "outbound": "POLICY_PAYMAYA"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "mayabank.ph"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "polymarket.com"
@@ -1023,6 +1259,13 @@
         "action": "route",
         "outbound": "POLICY_POLYMARKET"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "polymarket.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "reddit.com"
@@ -1030,6 +1273,13 @@
         "action": "route",
         "outbound": "POLICY_EASY_IPBLOCK"
       },
+      {
+        "network": "udp",
+        "domain_keyword": [
+          "reddit.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "avgle"
@@ -1037,6 +1287,13 @@
         "action": "route",
         "outbound": "POLICY_COLOR"
       },
+      {
+        "network": "udp",
+        "domain_keyword": [
+          "avgle"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "porn"
@@ -1044,6 +1301,13 @@
         "action": "route",
         "outbound": "POLICY_COLOR"
       },
+      {
+        "network": "udp",
+        "domain_keyword": [
+          "porn"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "xvideo"
@@ -1051,6 +1315,13 @@
         "action": "route",
         "outbound": "POLICY_COLOR"
       },
+      {
+        "network": "udp",
+        "domain_keyword": [
+          "xvideo"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "xhamster"
@@ -1058,6 +1329,13 @@
         "action": "route",
         "outbound": "POLICY_COLOR"
       },
+      {
+        "network": "udp",
+        "domain_keyword": [
+          "xhamster"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "ycombinator.com"
@@ -1065,6 +1343,13 @@
         "action": "route",
         "outbound": "POLICY_DEFAULT"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "ycombinator.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "distrowatch.com"
@@ -1072,6 +1357,13 @@
         "action": "route",
         "outbound": "POLICY_DEFAULT"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "distrowatch.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "pypi.org"
@@ -1079,6 +1371,13 @@
         "action": "route",
         "outbound": "POLICY_DEFAULT"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "pypi.org"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "pythonhosted.org"
@@ -1086,6 +1385,13 @@
         "action": "route",
         "outbound": "POLICY_DEFAULT"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "pythonhosted.org"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "nvidia.com"
@@ -1093,6 +1399,13 @@
         "action": "route",
         "outbound": "POLICY_DEFAULT"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "nvidia.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_suffix": [
           "tailscale.com"
@@ -1100,6 +1413,13 @@
         "action": "route",
         "outbound": "POLICY_DEFAULT"
       },
+      {
+        "network": "udp",
+        "domain_suffix": [
+          "tailscale.com"
+        ],
+        "action": "reject"
+      },
       {
         "domain_keyword": [
           "time.windows.com"
@@ -1226,6 +1546,13 @@
         "action": "route",
         "outbound": "EXIT_SELF_HOSTED"
       },
+      {
+        "network": "udp",
+        "rule_set": [
+          "github"
+        ],
+        "action": "reject"
+      },
       {
         "rule_set": [
           "tiktok"
@@ -1233,6 +1560,13 @@
         "action": "route",
         "outbound": "EXIT_AMERICA"
       },
+      {
+        "network": "udp",
+        "rule_set": [
+          "tiktok"
+        ],
+        "action": "reject"
+      },
       {
         "rule_set": [
           "applications"
@@ -1295,6 +1629,13 @@
         "action": "route",
         "outbound": "POLICY_DEFAULT"
       },
+      {
+        "network": "udp",
+        "rule_set": [
+          "proxy"
+        ],
+        "action": "reject"
+      },
       {
         "rule_set": [
           "telegramcidr"
@@ -1302,6 +1643,13 @@
         "action": "route",
         "outbound": "POLICY_DEFAULT"
       },
+      {
+        "network": "udp",
+        "rule_set": [
+          "telegramcidr"
+        ],
+        "action": "reject"
+      },
       {
         "ip_cidr": [
           "104.27.80.65/32"
@@ -1369,6 +1717,15 @@
         ],
         "action": "route",
         "outbound": "DIRECT"
+      },
+      {
+        "network": "udp",
+        "action": "route",
+        "outbound": "EXIT_SELF_HOSTED_STABLE"
+      },
+      {
+        "network": "udp",
+        "action": "reject"
       }
     ],
     "rule_set": [