14.04.2026 Update

mihomo/mihomo.go

@@ -176,7 +176,34 @@ func Status() map[string]interface{} {
 	return status
 }
 
+// forcedTproxyPort is the fixed transparent-proxy port that is always injected
+// into Mihomo's config. It matches firewall.TproxyPort (7893).
+const forcedTproxyPort = 7893
+
+// EnsureTproxyConfig patches the Mihomo config to always have tproxy-port set
+// to the fixed value. This is called before every Start() so the admin panel
+// cannot accidentally disable transparent proxy.
+func EnsureTproxyConfig() error {
+	cfg, err := LoadConfig()
+	if err != nil {
+		return fmt.Errorf("load mihomo config: %w", err)
+	}
+	if v, ok := cfg["tproxy-port"]; ok {
+		if n, ok2 := v.(int); ok2 && n == forcedTproxyPort {
+			return nil // already correct
+		}
+	}
+	cfg["tproxy-port"] = forcedTproxyPort
+	return SaveConfig(cfg)
+}
+
 func Start() error {
+	// Force tproxy-port before acquiring the process lock so that the config
+	// is always consistent regardless of what the admin panel has saved.
+	if err := EnsureTproxyConfig(); err != nil {
+		fmt.Fprintf(os.Stderr, "Warning: enforce tproxy config: %v\n", err)
+	}
+
 	mu.Lock()
 	defer mu.Unlock()