diff --git a/luci-app-passwall/luasrc/controller/passwall.lua b/luci-app-passwall/luasrc/controller/passwall.lua
index ba84fc9b9..620d8b0c3 100644
--- a/luci-app-passwall/luasrc/controller/passwall.lua
+++ b/luci-app-passwall/luasrc/controller/passwall.lua
@@ -66,6 +66,7 @@ function index()
 	entry({"admin", "services", appname, "get_now_use_node"}, call("get_now_use_node")).leaf = true
 	entry({"admin", "services", appname, "get_redir_log"}, call("get_redir_log")).leaf = true
 	entry({"admin", "services", appname, "get_socks_log"}, call("get_socks_log")).leaf = true
+	entry({"admin", "services", appname, "get_chinadns_log"}, call("get_chinadns_log")).leaf = true
 	entry({"admin", "services", appname, "get_log"}, call("get_log")).leaf = true
 	entry({"admin", "services", appname, "clear_log"}, call("clear_log")).leaf = true
 	entry({"admin", "services", appname, "index_status"}, call("index_status")).leaf = true
@@ -211,6 +212,18 @@ function get_socks_log()
 	end
 end
 
+function get_chinadns_log()
+	local flag = luci.http.formvalue("flag")
+	local path = "/tmp/etc/passwall/acl/" .. flag .. "/chinadns_ng.log"
+	if fs.access(path) then
+		local content = luci.sys.exec("cat ".. path)
+		content = content:gsub("\n", "<br />")
+		luci.http.write(content)
+	else
+		luci.http.write(string.format("<script>alert('%s');window.close();</script>", i18n.translate("Not enabled log")))
+	end
+end
+
 function get_log()
 	-- luci.sys.exec("[ -f /tmp/log/passwall.log ] && sed '1!G;h;$!d' /tmp/log/passwall.log > /tmp/log/passwall_show.log")
 	luci.http.write(luci.sys.exec("[ -f '/tmp/log/passwall.log' ] && cat /tmp/log/passwall.log"))
diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua
index fee631579..c5ed6e209 100644
--- a/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua
+++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua
@@ -418,4 +418,6 @@ o:value("direct", translate("Direct DNS"))
 o.description = desc .. "</ul>"
 o:depends({dns_shunt = "dnsmasq", tcp_proxy_mode = "proxy", chn_list = "direct"})
 
+m:append(Template(appname .. "/acl/footer"))
+
 return m
diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
index 1b62d0b55..952e4c8ed 100644
--- a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
+++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
@@ -666,11 +666,11 @@ end
 
 s:tab("log", translate("Log"))
 o = s:taboption("log", Flag, "log_tcp", translate("Enable") .. " " .. translatef("%s Node Log", "TCP"))
-o.default = "1"
+o.default = "0"
 o.rmempty = false
 
 o = s:taboption("log", Flag, "log_udp", translate("Enable") .. " " .. translatef("%s Node Log", "UDP"))
-o.default = "1"
+o.default = "0"
 o.rmempty = false
 
 o = s:taboption("log", ListValue, "loglevel", "Sing-Box/Xray " .. translate("Log Level"))
@@ -700,8 +700,17 @@ o:depends("advanced_log_feature", "1")
 o = s:taboption("log", Value, "log_event_cmd", translate("Shell Command"), translate("Shell command to execute, replace log content with %s."))
 o:depends("advanced_log_feature", "1")
 
-s:tab("faq", "FAQ")
+o = s:taboption("log", Flag, "log_chinadns_ng", translate("Enable") .. " ChinaDNS-NG " .. translate("Log"))
+o.default = "0"
+o.rmempty = false
 
+o = s:taboption("log", DummyValue, "_log_tips", " ")
+o.rawhtml = true
+o.cfgvalue = function(t, n)
+	return string.format('<font color="red">%s</font>', translate("It is recommended to disable logging during regular use to reduce system overhead."))
+end
+
+s:tab("faq", "FAQ")
 o = s:taboption("faq", DummyValue, "")
 o.template = appname .. "/global/faq"
 
diff --git a/luci-app-passwall/luasrc/view/passwall/acl/footer.htm b/luci-app-passwall/luasrc/view/passwall/acl/footer.htm
new file mode 100644
index 000000000..6026e6dc9
--- /dev/null
+++ b/luci-app-passwall/luasrc/view/passwall/acl/footer.htm
@@ -0,0 +1,41 @@
+<%
+local api = require "luci.passwall.api"
+-%>
+<script type="text/javascript">
+	//<![CDATA[
+	document.addEventListener("DOMContentLoaded", function () {
+		setTimeout(function () {
+			var url = window.location.href;
+			var sid_match = url.match(/\/acl_config\/(cfg[0-9a-f]+)/);
+			var sid = sid_match ? sid_match[1] : null;
+			if (!sid) {
+				return;
+			}
+			var selects = document.querySelectorAll("select[id*='dns_shunt']");
+			selects.forEach(function (select) {
+				if (select.value === "chinadns-ng") {
+					addLogLink(select);
+				}
+				select.addEventListener("change", function () {
+					var existingLogLink = select.parentElement.querySelector("a.log-link");
+					if (existingLogLink) {
+						existingLogLink.remove();
+					}
+					if (select.value === "chinadns-ng") {
+						addLogLink(select);
+					}
+				});
+			});
+			function addLogLink(select) {
+				var logLink = document.createElement("a");
+				logLink.innerHTML = "<%:Log%>";
+				logLink.href = "#";
+				logLink.className = "log-link";
+				logLink.style.marginLeft = "10px";
+				logLink.setAttribute("onclick", "window.open('" + '<%=api.url("get_chinadns_log")%>' + "?flag=" + sid + "', '_blank')");
+				select.insertAdjacentElement("afterend", logLink);
+			}
+		}, 1000);
+	});
+	//]]>
+</script>
diff --git a/luci-app-passwall/luasrc/view/passwall/global/footer.htm b/luci-app-passwall/luasrc/view/passwall/global/footer.htm
index 82a381f67..5093f9c08 100644
--- a/luci-app-passwall/luasrc/view/passwall/global/footer.htm
+++ b/luci-app-passwall/luasrc/view/passwall/global/footer.htm
@@ -148,5 +148,33 @@ local api = require "luci.passwall.api"
 	}
 	setTimeout("go()", 1000);
 
+	document.addEventListener("DOMContentLoaded", function () {
+		setTimeout(function () {
+			var selects = document.querySelectorAll("select[id*='dns_shunt']");
+			selects.forEach(function (select, index) {
+				if (select.value === "chinadns-ng") {
+					addLogLink(select);
+				}
+				select.addEventListener("change", function () {
+					var existingLogLink = select.parentElement.querySelector("a.log-link");
+					if (existingLogLink) {
+						existingLogLink.remove();
+					}
+					if (select.value === "chinadns-ng") {
+						addLogLink(select);
+					}
+				});
+			});
+			function addLogLink(select) {
+				var logLink = document.createElement("a");
+				logLink.innerHTML = "<%:Log%>";
+				logLink.href = "#";
+				logLink.className = "log-link";
+				logLink.style.marginLeft = "10px";
+				logLink.setAttribute("onclick", "window.open('" + '<%=api.url("get_chinadns_log")%>' + "?flag=default', '_blank')");
+				select.insertAdjacentElement("afterend", logLink);
+			}
+		}, 1000);
+	});
 	//]]>
 </script>
diff --git a/luci-app-passwall/po/zh-cn/passwall.po b/luci-app-passwall/po/zh-cn/passwall.po
index 42884cf41..92144fb22 100644
--- a/luci-app-passwall/po/zh-cn/passwall.po
+++ b/luci-app-passwall/po/zh-cn/passwall.po
@@ -1510,6 +1510,9 @@ msgstr "要执行的 Shell 命令，用 %s 代替日志内容。"
 msgid "Not enabled log"
 msgstr "未启用日志"
 
+msgid "It is recommended to disable logging during regular use to reduce system overhead."
+msgstr "正常使用时建议关闭日志，以减少系统开销。"
+
 msgid "UDP Forward"
 msgstr "UDP 转发"
 
diff --git a/luci-app-passwall/root/usr/share/passwall/0_default_config b/luci-app-passwall/root/usr/share/passwall/0_default_config
index 2a6a814bc..427dc3a80 100644
--- a/luci-app-passwall/root/usr/share/passwall/0_default_config
+++ b/luci-app-passwall/root/usr/share/passwall/0_default_config
@@ -21,10 +21,11 @@ config global
 	option localhost_proxy '1'
 	option client_proxy '1'
 	option acl_enable '0'
-	option log_tcp '1'
-	option log_udp '1'
+	option log_tcp '0'
+	option log_udp '0'
 	option loglevel 'error'
 	option trojan_loglevel '4'
+	option log_chinadns_ng '0'
 
 config global_haproxy
 	option balancing_enable '0'
diff --git a/luci-app-passwall/root/usr/share/passwall/app.sh b/luci-app-passwall/root/usr/share/passwall/app.sh
index 499aa420c..803b6eede 100755
--- a/luci-app-passwall/root/usr/share/passwall/app.sh
+++ b/luci-app-passwall/root/usr/share/passwall/app.sh
@@ -296,7 +296,10 @@ ln_run() {
 	fi
 	#echo "${file_func} $*" >&2
 	[ -n "${file_func}" ] || echolog "  - 找不到 ${ln_name}，无法启动..."
-	[ "${output}" != "/dev/null" ] && local persist_log_path=$(config_t_get global persist_log_path) && local sys_log=$(config_t_get global sys_log "0")
+	[ "${output}" != "/dev/null" ] && [ "${ln_name}" != "chinadns-ng" ] && {
+		local persist_log_path=$(config_t_get global persist_log_path)
+		local sys_log=$(config_t_get global sys_log "0")
+	}
 	if [ -z "$persist_log_path" ] && [ "$sys_log" != "1" ]; then
 		${file_func:-echolog " - ${ln_name}"} "$@" >${output} 2>&1 &
 	else
@@ -570,13 +573,14 @@ run_chinadns_ng() {
 	eval_set_val $@
 
 	local _CONF_FILE=$TMP_ACL_PATH/$_flag/chinadns_ng.conf
-	local _LOG_FILE=$TMP_ACL_PATH/$_flag/chinadns_ng.log
-	_LOG_FILE="/dev/null"
+	local _LOG_FILE="/dev/null"
+	[ "$(config_t_get global log_chinadns_ng "0")" == "1" ] &&  _LOG_FILE=$TMP_ACL_PATH/$_flag/chinadns_ng.log
 
 	_extra_param="-FLAG ${_flag} -TCP_NODE ${_tcp_node} -LISTEN_PORT ${_listen_port} -DNS_LOCAL ${_dns_local} -DNS_TRUST ${_dns_trust}"
 	_extra_param="${_extra_param} -USE_DIRECT_LIST ${_use_direct_list} -USE_PROXY_LIST ${_use_proxy_list} -USE_BLOCK_LIST ${_use_block_list}"
 	_extra_param="${_extra_param} -GFWLIST ${_gfwlist} -CHNLIST ${_chnlist} -NO_IPV6_TRUST ${_no_ipv6_trust} -DEFAULT_MODE ${_default_mode}"
 	_extra_param="${_extra_param} -DEFAULT_TAG ${_default_tag} -NFTFLAG ${nftflag} -NO_LOGIC_LOG ${_no_logic_log} -REMOTE_FAKEDNS ${_remote_fakedns}"
+	_extra_param="${_extra_param} -LOG_FILE ${_LOG_FILE}"
 
 	lua $APP_PATH/helper_chinadns_add.lua ${_extra_param} > ${_CONF_FILE}
 	ln_run "$(first_type chinadns-ng)" chinadns-ng "${_LOG_FILE}" -C ${_CONF_FILE}
diff --git a/luci-app-passwall/root/usr/share/passwall/helper_chinadns_add.lua b/luci-app-passwall/root/usr/share/passwall/helper_chinadns_add.lua
index 765d04264..981578adb 100644
--- a/luci-app-passwall/root/usr/share/passwall/helper_chinadns_add.lua
+++ b/luci-app-passwall/root/usr/share/passwall/helper_chinadns_add.lua
@@ -19,6 +19,7 @@ local NO_LOGIC_LOG = var["-NO_LOGIC_LOG"]
 local TCP_NODE = var["-TCP_NODE"]
 local NFTFLAG = var["-NFTFLAG"]
 local REMOTE_FAKEDNS = var["-REMOTE_FAKEDNS"]
+local LOG_FILE = var["-LOG_FILE"]
 
 local uci = api.libuci
 local sys = api.sys
@@ -104,7 +105,7 @@ local setflag = (NFTFLAG == "1") and "inet@passwall@" or ""
 local only_global = (DEFAULT_MODE == "proxy" and CHNLIST == "0" and GFWLIST == "0") and 1
 
 config_lines = {
-	--"verbose",
+	LOG_FILE ~= "/dev/null" and "verbose" or "",
 	"bind-addr 127.0.0.1",
 	"bind-port " .. LISTEN_PORT,
 	"china-dns " .. DNS_LOCAL,
@@ -270,7 +271,7 @@ if USE_PROXY_LIST == "1" and is_file_nonzero(file_proxy_host) then
 		"group proxylist",
 		"group-dnl " .. file_proxy_host,
 		"group-upstream " .. DNS_TRUST,
-		REMOTE_FAKEDNS ~= "1" and "group-ipset " .. table.concat(sets, ",") or nil
+		REMOTE_FAKEDNS ~= "1" and "group-ipset " .. table.concat(sets, ",") or ""
 	}
 	if NO_IPV6_TRUST == "1" then table.insert(tmp_lines, "no-ipv6 tag:proxylist") end
 	insert_array_after(config_lines, tmp_lines, "#--3")
@@ -292,7 +293,7 @@ if GFWLIST == "1" and is_file_nonzero(RULES_PATH .. "/gfwlist") then
 	end
 	tmp_lines = {
 		"gfwlist-file " .. RULES_PATH .. "/gfwlist",
-		REMOTE_FAKEDNS ~= "1" and "add-taggfw-ip " .. table.concat(sets, ",") or nil
+		REMOTE_FAKEDNS ~= "1" and "add-taggfw-ip " .. table.concat(sets, ",") or ""
 	}
 	if NO_IPV6_TRUST == "1" then table.insert(tmp_lines, "no-ipv6 tag:gfw") end
 	merge_array(config_lines, tmp_lines)
@@ -323,7 +324,7 @@ if CHNLIST ~= "0" and is_file_nonzero(RULES_PATH .. "/chnlist") then
 			"group chn_proxy",
 			"group-dnl " .. RULES_PATH .. "/chnlist",
 			"group-upstream " .. DNS_TRUST,
-			REMOTE_FAKEDNS ~= "1" and "group-ipset " .. table.concat(sets, ",") or nil
+			REMOTE_FAKEDNS ~= "1" and "group-ipset " .. table.concat(sets, ",") or ""
 		}
 		if NO_IPV6_TRUST == "1" then table.insert(tmp_lines, "no-ipv6 tag:chn_proxy") end
 		insert_array_after(config_lines, tmp_lines, "#--1")
@@ -448,7 +449,7 @@ if uci:get(appname, TCP_NODE, "protocol") == "_shunt" then
 			"group shuntlist",
 			"group-dnl " .. file_shunt_host,
 			"group-upstream " .. DNS_TRUST,
-			(not only_global and REMOTE_FAKEDNS == "1") and nil or ("group-ipset " .. table.concat(sets, ","))
+			(not only_global and REMOTE_FAKEDNS == "1") and "" or ("group-ipset " .. table.concat(sets, ","))
 		}
 		if NO_IPV6_TRUST == "1" then table.insert(tmp_lines, "no-ipv6 tag:shuntlist") end
 		insert_array_after(config_lines, tmp_lines, "#--2")
diff --git a/patch-luci-app-passwall.patch b/patch-luci-app-passwall.patch
index 42b332b71..5ecf502ee 100644
--- a/patch-luci-app-passwall.patch
+++ b/patch-luci-app-passwall.patch
@@ -20,10 +20,10 @@ index 7b625ea..3997cd8 100644
  
  define Package/$(PKG_NAME)/postrm
 diff --git a/luci-app-passwall/luasrc/controller/passwall.lua b/luci-app-passwall/luasrc/controller/passwall.lua
-index 99c620f..ba84fc9 100644
+index 2ed0db4..620d8b0 100644
 --- a/luci-app-passwall/luasrc/controller/passwall.lua
 +++ b/luci-app-passwall/luasrc/controller/passwall.lua
-@@ -283,7 +283,7 @@ function connect_status()
+@@ -296,7 +296,7 @@ function connect_status()
  			url = "-x socks5h://" .. socks_server .. " " .. url
  		end
  	end
@@ -33,7 +33,7 @@ index 99c620f..ba84fc9 100644
  	if code ~= 0 then
  		local use_time = luci.sys.exec("echo -n '" .. result .. "' | awk -F ':' '{print $2}'")
 diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
-index 620f3f5..1b62d0b 100644
+index 3f6dd8c..952e4c8 100644
 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
 +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
 @@ -492,6 +492,12 @@ o:value("9.9.9.9", "9.9.9.9 (Quad9)")
@@ -142,10 +142,10 @@ index e8d76ec..a872950 100644
  				<div class="pure-u-1-3">
  					<div class="img-con">
 diff --git a/luci-app-passwall/root/usr/share/passwall/0_default_config b/luci-app-passwall/root/usr/share/passwall/0_default_config
-index 551c824..2a6a814 100644
+index acacfed..427dc3a 100644
 --- a/luci-app-passwall/root/usr/share/passwall/0_default_config
 +++ b/luci-app-passwall/root/usr/share/passwall/0_default_config
-@@ -31,7 +31,7 @@ config global_haproxy
+@@ -32,7 +32,7 @@ config global_haproxy
  
  config global_delay
  	option start_daemon '1'