diff --git a/frontend/src/pages/inbounds/form/protocols/tun.tsx b/frontend/src/pages/inbounds/form/protocols/tun.tsx
index 062d74f4e..94229d85b 100644
--- a/frontend/src/pages/inbounds/form/protocols/tun.tsx
+++ b/frontend/src/pages/inbounds/form/protocols/tun.tsx
@@ -46,9 +46,10 @@ function StringList({ name, label, tooltip, placeholder }: StringListProps) {
   );
 }
 
-// xray-core 26.9.30 accepts exactly these autoSystemWfpBlockLeak values.
+// Named autoSystemWfpBlockLeak values; xray-core 26.10.31 also takes typed "tcp/<port>" or "udp/<port>".
 const WFP_BLOCK_LEAK_OPTIONS = [
   { value: 'dns', label: 'dns' },
+  { value: 'windnsclient', label: 'windnsclient' },
   { value: 'misconfigtun', label: 'misconfigtun' },
 ];
 
@@ -110,7 +111,8 @@ export default function TunFields() {
       >
         <Select
           id="tun-wfp-block-leak"
-          mode="multiple"
+          mode="tags"
+          tokenSeparators={[',', ' ']}
           allowClear
           options={WFP_BLOCK_LEAK_OPTIONS}
         />
diff --git a/frontend/src/schemas/protocols/inbound/tun.ts b/frontend/src/schemas/protocols/inbound/tun.ts
index f9d421c30..d4af1c2cb 100644
--- a/frontend/src/schemas/protocols/inbound/tun.ts
+++ b/frontend/src/schemas/protocols/inbound/tun.ts
@@ -10,7 +10,7 @@ export const TunInboundSettingsSchema = z.object({
   userLevel: z.number().int().min(0).default(0),
   autoSystemRoutingTable: z.array(z.string()).default([]),
   autoOutboundsInterface: z.string().default('auto'),
-  // xray-core 26.9.30: the first acts on Linux, the second ("dns", "misconfigtun") on Windows.
+  // xray-core 26.9.30: the first acts on Linux, the second (named values or "tcp/<port>") on Windows.
   autoSystemDnsToGateway: z.boolean().optional(),
   autoSystemWfpBlockLeak: z.array(z.string()).optional(),
 });
diff --git a/internal/web/service/inbound.go b/internal/web/service/inbound.go
index 50a875721..447bee557 100644
--- a/internal/web/service/inbound.go
+++ b/internal/web/service/inbound.go
@@ -1328,6 +1328,9 @@ func (s *InboundService) AddInbound(inbound *model.Inbound) (*model.Inbound, boo
 	if err := validateShadowsocks2022Inbound(inbound.Protocol, inbound.Settings); err != nil {
 		return inbound, false, err
 	}
+	if err := validateTunWfpBlockLeak(string(inbound.Protocol), inbound.Settings); err != nil {
+		return inbound, false, err
+	}
 	s.normalizeMtprotoSecret(inbound)
 	if err := s.normalizeMtprotoXrayPort(inbound, ""); err != nil {
 		return inbound, false, err
@@ -2033,6 +2036,9 @@ func (s *InboundService) UpdateInbound(inbound *model.Inbound) (*model.Inbound,
 	if err := validateShadowsocks2022Inbound(inbound.Protocol, inbound.Settings); err != nil {
 		return inbound, false, err
 	}
+	if err := validateTunWfpBlockLeak(string(inbound.Protocol), inbound.Settings); err != nil {
+		return inbound, false, err
+	}
 	s.normalizeMtprotoSecret(inbound)
 
 	oldInbound, err := s.GetInbound(inbound.Id)
diff --git a/internal/web/service/inbound_protocol.go b/internal/web/service/inbound_protocol.go
index 10762a2a6..aa82a6564 100644
--- a/internal/web/service/inbound_protocol.go
+++ b/internal/web/service/inbound_protocol.go
@@ -7,6 +7,7 @@ import (
 	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
 	"github.com/mhsanaei/3x-ui/v3/internal/util/common"
 	"github.com/mhsanaei/3x-ui/v3/internal/util/version"
+	"github.com/mhsanaei/3x-ui/v3/internal/xray"
 
 	"gorm.io/gorm"
 )
@@ -161,3 +162,21 @@ func streamSupportsFallbacks(streamSettings string) bool {
 	}
 	return stream.Security == "tls" || stream.Security == "reality"
 }
+
+// validateTunWfpBlockLeak refuses at save the autoSystemWfpBlockLeak values xray-core 26.10.31
+// (#7288) refuses when the core starts, which stops every inbound with it.
+func validateTunWfpBlockLeak(protocol, settings string) error {
+	if protocol != "tun" {
+		return nil
+	}
+	var tunSettings struct {
+		AutoSystemWfpBlockLeak []string `json:"autoSystemWfpBlockLeak"`
+	}
+	if json.Unmarshal([]byte(settings), &tunSettings) != nil {
+		return nil
+	}
+	if err := xray.ValidateTunWfpBlockLeak(tunSettings.AutoSystemWfpBlockLeak); err != nil {
+		return common.NewError("TUN autoSystemWfpBlockLeak: ", err)
+	}
+	return nil
+}
diff --git a/internal/web/service/inbound_protocol_test.go b/internal/web/service/inbound_protocol_test.go
index fb2deef3f..c6ab30a2c 100644
--- a/internal/web/service/inbound_protocol_test.go
+++ b/internal/web/service/inbound_protocol_test.go
@@ -1,6 +1,7 @@
 package service
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
@@ -88,3 +89,30 @@ func TestInboundCanHostFallbacks_StaysTcpOnly(t *testing.T) {
 		t.Errorf("inboundCanHostFallbacks(nil) = true, want false")
 	}
 }
+
+// xray-core 26.10.31 (#7288) refuses an unknown autoSystemWfpBlockLeak value when the core starts.
+func TestAddInboundRefusesTunWfpBlockLeakTheCoreRefuses(t *testing.T) {
+	tests := []struct{ name, leaks, want string }{
+		{"port zero", `["tcp/0"]`, "unknown autoSystemWfpBlockLeak value: tcp/0"},
+		{"unknown protocol", `["icmp/1"]`, "unknown autoSystemWfpBlockLeak value: icmp/1"},
+		{"named values and ports", `["DNS","windnsclient","misconfigtun","udp/853","tcp/7215"]`, ""},
+	}
+	for i, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			setupBulkDB(t)
+			_, _, err := (&InboundService{}).AddInbound(&model.Inbound{
+				Enable: true, Port: 18520 + i, Protocol: model.Protocol("tun"),
+				Settings: `{"name":"xray0","autoSystemWfpBlockLeak":` + tc.leaks + `}`,
+			})
+			if tc.want == "" {
+				if err != nil {
+					t.Fatalf("AddInbound = %v, want values the core accepts saved", err)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), tc.want) {
+				t.Fatalf("AddInbound = %v, want one containing %q", err, tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/web/service/xray_setting.go b/internal/web/service/xray_setting.go
index 048a75f3e..c5f41f46e 100644
--- a/internal/web/service/xray_setting.go
+++ b/internal/web/service/xray_setting.go
@@ -98,6 +98,9 @@ func (s *XraySettingService) CheckXrayConfig(XrayTemplateConfig string) error {
 		if err := validateXDriveInbound(inbound.Protocol, string(inbound.Settings), string(inbound.StreamSettings)); err != nil {
 			return common.NewError("xray template inbound \""+inbound.Tag+"\":", err)
 		}
+		if err := validateTunWfpBlockLeak(inbound.Protocol, string(inbound.Settings)); err != nil {
+			return common.NewError("xray template inbound \""+inbound.Tag+"\":", err)
+		}
 	}
 	if len(xrayConfig.OutboundConfigs) > 0 {
 		var outbounds []json.RawMessage
diff --git a/internal/web/translation/ar-EG.json b/internal/web/translation/ar-EG.json
index 4aee49632..c89343738 100644
--- a/internal/web/translation/ar-EG.json
+++ b/internal/web/translation/ar-EG.json
@@ -762,7 +762,7 @@
         "autoSystemDnsToGateway": "DNS النظام إلى البوابة",
         "autoSystemDnsToGatewayTooltip": "على لينكس بس: بيوجّه systemd-resolved لبوابة TUN عشان استعلامات النظام تعدّي من Xray. محتاج بوابة، والـTUN مش هيشتغل لو ده فشل.",
         "autoSystemWfpBlockLeak": "منع التسريب (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "على ويندوز بس، مع Auto system routes: ‏dns بيخلّي DNS جوّه الـTUN (محتاج سيرفرات DNS)، وmisconfigtun بيمنع نسخة IP مفيش مسار بيوديها للـTUN.",
+        "autoSystemWfpBlockLeakTooltip": "على ويندوز بس، مع Auto system routes: ‏dns بيخلّي DNS (البورتات 53 و853 وخدمة DNS Client) جوّه الـTUN ومحتاج سيرفرات DNS؛ ‏windnsclient بيغطي الخدمة دي بس؛ اكتب tcp/PORT أو udp/PORT لأي بورت تاني؛ وmisconfigtun بيمنع نسخة IP مفيش مسار بيوديها للـTUN.",
         "maxVersion": "الحد الأقصى للإصدار",
         "headerName": "اسم الترويسة",
         "headerValue": "قيمة الترويسة"
diff --git a/internal/web/translation/en-US.json b/internal/web/translation/en-US.json
index 28320955c..6578a9292 100644
--- a/internal/web/translation/en-US.json
+++ b/internal/web/translation/en-US.json
@@ -763,7 +763,7 @@
         "autoSystemDnsToGateway": "System DNS to gateway",
         "autoSystemDnsToGatewayTooltip": "Linux only: points systemd-resolved at the TUN gateway so system lookups go through Xray. Needs a gateway, and the TUN does not start if this fails.",
         "autoSystemWfpBlockLeak": "Block leaks (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "Windows only, with Auto system routes: dns keeps DNS inside the TUN (needs DNS servers), misconfigtun blocks an IP version that no route sends into the TUN.",
+        "autoSystemWfpBlockLeakTooltip": "Windows only, with Auto system routes: dns keeps DNS (ports 53 and 853 and the DNS Client service) inside the TUN and needs DNS servers; windnsclient covers only that service; type tcp/PORT or udp/PORT for any other port; misconfigtun blocks an IP version that no route sends into the TUN.",
         "maxVersion": "Max version",
         "headerName": "Header name",
         "headerValue": "Header value"
diff --git a/internal/web/translation/es-ES.json b/internal/web/translation/es-ES.json
index f9cbf2208..6fb602d31 100644
--- a/internal/web/translation/es-ES.json
+++ b/internal/web/translation/es-ES.json
@@ -762,7 +762,7 @@
         "autoSystemDnsToGateway": "DNS del sistema a la puerta de enlace",
         "autoSystemDnsToGatewayTooltip": "Solo Linux: apunta systemd-resolved a la puerta de enlace del TUN para que las consultas del sistema pasen por Xray. Necesita una puerta de enlace y el TUN no arranca si esto falla.",
         "autoSystemWfpBlockLeak": "Bloquear fugas (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "Solo Windows, con Auto system routes: dns mantiene el DNS dentro del TUN (necesita servidores DNS) y misconfigtun bloquea una versión de IP que ninguna ruta envía al TUN.",
+        "autoSystemWfpBlockLeakTooltip": "Solo Windows, con Auto system routes: dns mantiene el DNS (puertos 53 y 853 y el servicio Cliente DNS) dentro del TUN y necesita servidores DNS; windnsclient cubre solo ese servicio; escribe tcp/PUERTO o udp/PUERTO para cualquier otro puerto; misconfigtun bloquea una versión de IP que ninguna ruta envía al TUN.",
         "maxVersion": "Versión máxima",
         "headerName": "Nombre de cabecera",
         "headerValue": "Valor de cabecera"
diff --git a/internal/web/translation/fa-IR.json b/internal/web/translation/fa-IR.json
index b07d71b8b..f01c53540 100644
--- a/internal/web/translation/fa-IR.json
+++ b/internal/web/translation/fa-IR.json
@@ -762,7 +762,7 @@
         "autoSystemDnsToGateway": "DNS سیستم به گیت‌وی",
         "autoSystemDnsToGatewayTooltip": "فقط لینوکس: systemd-resolved را به گیت‌وی TUN می‌برد تا کوئری‌های سیستم از Xray عبور کنند. به گیت‌وی نیاز دارد و اگر این کار شکست بخورد TUN اجرا نمی‌شود.",
         "autoSystemWfpBlockLeak": "جلوگیری از نشت (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "فقط ویندوز، همراه با مسیریابی خودکار سیستم: dns ترافیک DNS را داخل TUN نگه می‌دارد (به سرور DNS نیاز دارد) و misconfigtun نسخه‌ای از IP را که هیچ مسیری به TUN نمی‌فرستد مسدود می‌کند.",
+        "autoSystemWfpBlockLeakTooltip": "فقط ویندوز، همراه با مسیریابی خودکار سیستم: dns ترافیک DNS (پورت‌های ۵۳ و ۸۵۳ و سرویس DNS Client) را داخل TUN نگه می‌دارد و به سرور DNS نیاز دارد؛ windnsclient فقط همان سرویس را پوشش می‌دهد؛ برای هر پورت دیگر tcp/PORT یا udp/PORT بنویسید؛ misconfigtun نسخه‌ای از IP را که هیچ مسیری به TUN نمی‌فرستد مسدود می‌کند.",
         "maxVersion": "حداکثر نسخه",
         "headerName": "نام هدر",
         "headerValue": "مقدار هدر"
diff --git a/internal/web/translation/id-ID.json b/internal/web/translation/id-ID.json
index 2a2822290..f0b8ac109 100644
--- a/internal/web/translation/id-ID.json
+++ b/internal/web/translation/id-ID.json
@@ -762,7 +762,7 @@
         "autoSystemDnsToGateway": "DNS sistem ke gateway",
         "autoSystemDnsToGatewayTooltip": "Khusus Linux: mengarahkan systemd-resolved ke gateway TUN agar lookup sistem lewat Xray. Butuh gateway, dan TUN tidak berjalan jika ini gagal.",
         "autoSystemWfpBlockLeak": "Blokir kebocoran (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "Khusus Windows, bersama Auto system routes: dns menjaga DNS tetap di dalam TUN (butuh server DNS), misconfigtun memblokir versi IP yang tidak dikirim rute mana pun ke TUN.",
+        "autoSystemWfpBlockLeakTooltip": "Khusus Windows, bersama Auto system routes: dns menjaga DNS (port 53 dan 853 serta layanan DNS Client) tetap di dalam TUN dan butuh server DNS; windnsclient hanya mencakup layanan itu; ketik tcp/PORT atau udp/PORT untuk port lain; misconfigtun memblokir versi IP yang tidak dikirim rute mana pun ke TUN.",
         "maxVersion": "Versi maksimum",
         "headerName": "Nama header",
         "headerValue": "Nilai header"
diff --git a/internal/web/translation/ja-JP.json b/internal/web/translation/ja-JP.json
index 12cd2af39..0bfeeb5be 100644
--- a/internal/web/translation/ja-JP.json
+++ b/internal/web/translation/ja-JP.json
@@ -762,7 +762,7 @@
         "autoSystemDnsToGateway": "システム DNS をゲートウェイへ",
         "autoSystemDnsToGatewayTooltip": "Linux のみ：systemd-resolved を TUN のゲートウェイに向け、システムの名前解決を Xray 経由にします。ゲートウェイが必要で、失敗すると TUN は起動しません。",
         "autoSystemWfpBlockLeak": "リーク遮断 (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "Windows のみ（自動システムルートと併用）：dns は DNS を TUN 内に留め（DNS サーバーが必要）、misconfigtun は TUN へのルートがない IP バージョンを遮断します。",
+        "autoSystemWfpBlockLeakTooltip": "Windows のみ（自動システムルートと併用）：dns は DNS（ポート 53・853 と DNS Client サービス）を TUN 内に留め、DNS サーバーが必要です。windnsclient はそのサービスのみを対象にします。その他のポートは tcp/ポート または udp/ポート と入力します。misconfigtun は TUN へのルートがない IP バージョンを遮断します。",
         "maxVersion": "最大バージョン",
         "headerName": "ヘッダー名",
         "headerValue": "ヘッダー値"
diff --git a/internal/web/translation/pt-BR.json b/internal/web/translation/pt-BR.json
index c24280532..01ff63735 100644
--- a/internal/web/translation/pt-BR.json
+++ b/internal/web/translation/pt-BR.json
@@ -762,7 +762,7 @@
         "autoSystemDnsToGateway": "DNS do sistema para o gateway",
         "autoSystemDnsToGatewayTooltip": "Somente Linux: aponta o systemd-resolved para o gateway do TUN para que as consultas do sistema passem pelo Xray. Precisa de um gateway, e o TUN não inicia se isso falhar.",
         "autoSystemWfpBlockLeak": "Bloquear vazamentos (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "Somente Windows, com Auto system routes: dns mantém o DNS dentro do TUN (precisa de servidores DNS) e misconfigtun bloqueia uma versão de IP que nenhuma rota envia ao TUN.",
+        "autoSystemWfpBlockLeakTooltip": "Somente Windows, com Auto system routes: dns mantém o DNS (portas 53 e 853 e o serviço Cliente DNS) dentro do TUN e precisa de servidores DNS; windnsclient cobre só esse serviço; digite tcp/PORTA ou udp/PORTA para qualquer outra porta; misconfigtun bloqueia uma versão de IP que nenhuma rota envia ao TUN.",
         "maxVersion": "Versão máxima",
         "headerName": "Nome do cabeçalho",
         "headerValue": "Valor do cabeçalho"
diff --git a/internal/web/translation/ru-RU.json b/internal/web/translation/ru-RU.json
index 6b55abdb0..eba1e20e4 100644
--- a/internal/web/translation/ru-RU.json
+++ b/internal/web/translation/ru-RU.json
@@ -763,7 +763,7 @@
         "autoSystemDnsToGateway": "Системный DNS на шлюз",
         "autoSystemDnsToGatewayTooltip": "Только Linux: направляет systemd-resolved на шлюз TUN, чтобы системные запросы шли через Xray. Нужен шлюз; при ошибке TUN не запустится.",
         "autoSystemWfpBlockLeak": "Блокировка утечек (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "Только Windows, вместе с авто-маршрутами системы: dns удерживает DNS внутри TUN (нужны DNS-серверы), misconfigtun блокирует версию IP, которую ни один маршрут не ведёт в TUN.",
+        "autoSystemWfpBlockLeakTooltip": "Только Windows, вместе с авто-маршрутами системы: dns удерживает DNS (порты 53 и 853 и службу DNS-клиента) внутри TUN, нужны DNS-серверы; windnsclient охватывает только эту службу; для любого другого порта введите tcp/ПОРТ или udp/ПОРТ; misconfigtun блокирует версию IP, которую ни один маршрут не ведёт в TUN.",
         "maxVersion": "Максимальная версия",
         "headerName": "Имя заголовка",
         "headerValue": "Значение заголовка"
diff --git a/internal/web/translation/sk-SK.json b/internal/web/translation/sk-SK.json
index 3e11a3dc5..95449f105 100644
--- a/internal/web/translation/sk-SK.json
+++ b/internal/web/translation/sk-SK.json
@@ -763,7 +763,7 @@
         "autoSystemDnsToGateway": "Systémové DNS cez bránu",
         "autoSystemDnsToGatewayTooltip": "Iba pre Linux: nasmerovať systemd-resolved na bránu TUN, aby systémové DNS dotazy prechádzali cez Xray. Vyžaduje bránu. Ak nastavenie zlyhá, TUN sa nespustí.",
         "autoSystemWfpBlockLeak": "Blokovať úniky (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "Iba pre Windows s automatickými systémovými trasami: dns ponechá DNS v TUN (vyžaduje DNS servery), misconfigtun zablokuje verziu IP, pre ktorú nevedie žiadna trasa do TUN.",
+        "autoSystemWfpBlockLeakTooltip": "Iba pre Windows s automatickými systémovými trasami: dns ponechá DNS (porty 53 a 853 a službu DNS Client) v TUN a vyžaduje DNS servery; windnsclient pokrýva iba túto službu; pre akýkoľvek iný port zadajte tcp/PORT alebo udp/PORT; misconfigtun zablokuje verziu IP, pre ktorú nevedie žiadna trasa do TUN.",
         "maxVersion": "Maximálna verzia",
         "headerName": "Názov hlavičky",
         "headerValue": "Hodnota hlavičky"
diff --git a/internal/web/translation/tr-TR.json b/internal/web/translation/tr-TR.json
index 1b23d182b..adc69e513 100644
--- a/internal/web/translation/tr-TR.json
+++ b/internal/web/translation/tr-TR.json
@@ -762,7 +762,7 @@
         "autoSystemDnsToGateway": "Sistem DNS'ini ağ geçidine yönlendir",
         "autoSystemDnsToGatewayTooltip": "Yalnızca Linux: sistem sorguları Xray üzerinden gitsin diye systemd-resolved'ı TUN ağ geçidine yönlendirir. Ağ geçidi gerekir ve bu başarısız olursa TUN başlamaz.",
         "autoSystemWfpBlockLeak": "Sızıntıları engelle (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "Yalnızca Windows, Auto system routes ile: dns, DNS'i TUN içinde tutar (DNS sunucuları gerekir); misconfigtun, hiçbir rotanın TUN'a göndermediği IP sürümünü engeller.",
+        "autoSystemWfpBlockLeakTooltip": "Yalnızca Windows, Auto system routes ile: dns, DNS'i (53 ve 853 portları ile DNS İstemcisi hizmeti) TUN içinde tutar ve DNS sunucuları gerekir; windnsclient yalnızca o hizmeti kapsar; başka bir port için tcp/PORT veya udp/PORT yazın; misconfigtun, hiçbir rotanın TUN'a göndermediği IP sürümünü engeller.",
         "maxVersion": "Maksimum sürüm",
         "headerName": "Başlık adı",
         "headerValue": "Başlık değeri"
diff --git a/internal/web/translation/uk-UA.json b/internal/web/translation/uk-UA.json
index 4d69d7ae0..cc824b81d 100644
--- a/internal/web/translation/uk-UA.json
+++ b/internal/web/translation/uk-UA.json
@@ -762,7 +762,7 @@
         "autoSystemDnsToGateway": "Системний DNS на шлюз",
         "autoSystemDnsToGatewayTooltip": "Лише Linux: спрямовує systemd-resolved на шлюз TUN, щоб системні запити йшли через Xray. Потрібен шлюз; у разі помилки TUN не запуститься.",
         "autoSystemWfpBlockLeak": "Блокування витоків (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "Лише Windows, разом з авто-маршрутами системи: dns утримує DNS усередині TUN (потрібні DNS-сервери), misconfigtun блокує версію IP, яку жоден маршрут не веде в TUN.",
+        "autoSystemWfpBlockLeakTooltip": "Лише Windows, разом з авто-маршрутами системи: dns утримує DNS (порти 53 і 853 та службу DNS-клієнта) усередині TUN, потрібні DNS-сервери; windnsclient охоплює лише цю службу; для будь-якого іншого порту введіть tcp/ПОРТ або udp/ПОРТ; misconfigtun блокує версію IP, яку жоден маршрут не веде в TUN.",
         "maxVersion": "Максимальна версія",
         "headerName": "Назва заголовка",
         "headerValue": "Значення заголовка"
diff --git a/internal/web/translation/vi-VN.json b/internal/web/translation/vi-VN.json
index 38f8c92ba..25e17db14 100644
--- a/internal/web/translation/vi-VN.json
+++ b/internal/web/translation/vi-VN.json
@@ -762,7 +762,7 @@
         "autoSystemDnsToGateway": "DNS hệ thống tới gateway",
         "autoSystemDnsToGatewayTooltip": "Chỉ Linux: trỏ systemd-resolved tới gateway của TUN để truy vấn của hệ thống đi qua Xray. Cần có gateway, và TUN sẽ không khởi động nếu việc này thất bại.",
         "autoSystemWfpBlockLeak": "Chặn rò rỉ (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "Chỉ Windows, cùng với Auto system routes: dns giữ DNS bên trong TUN (cần máy chủ DNS), misconfigtun chặn phiên bản IP mà không tuyến nào đưa vào TUN.",
+        "autoSystemWfpBlockLeakTooltip": "Chỉ Windows, cùng với Auto system routes: dns giữ DNS (cổng 53 và 853 và dịch vụ DNS Client) bên trong TUN và cần máy chủ DNS; windnsclient chỉ áp dụng cho dịch vụ đó; nhập tcp/CỔNG hoặc udp/CỔNG cho cổng khác; misconfigtun chặn phiên bản IP mà không tuyến nào đưa vào TUN.",
         "maxVersion": "Phiên bản tối đa",
         "headerName": "Tên header",
         "headerValue": "Giá trị header"
diff --git a/internal/web/translation/zh-CN.json b/internal/web/translation/zh-CN.json
index 66b40ca8f..2684cda56 100644
--- a/internal/web/translation/zh-CN.json
+++ b/internal/web/translation/zh-CN.json
@@ -762,7 +762,7 @@
         "autoSystemDnsToGateway": "系统 DNS 指向网关",
         "autoSystemDnsToGatewayTooltip": "仅限 Linux：将 systemd-resolved 指向 TUN 网关，使系统解析经过 Xray。需要设置网关，失败时 TUN 不会启动。",
         "autoSystemWfpBlockLeak": "阻止泄漏 (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "仅限 Windows，需配合自动系统路由：dns 让 DNS 只走 TUN（需设置 DNS 服务器），misconfigtun 阻止没有任何路由指向 TUN 的 IP 版本。",
+        "autoSystemWfpBlockLeakTooltip": "仅限 Windows，需配合自动系统路由：dns 让 DNS（端口 53、853 及 DNS Client 服务）只走 TUN，需设置 DNS 服务器；windnsclient 只针对该服务；其他端口请输入 tcp/端口 或 udp/端口；misconfigtun 阻止没有任何路由指向 TUN 的 IP 版本。",
         "maxVersion": "最高版本",
         "headerName": "标头名称",
         "headerValue": "标头值"
diff --git a/internal/web/translation/zh-TW.json b/internal/web/translation/zh-TW.json
index 348c0856a..0bcc9bea3 100644
--- a/internal/web/translation/zh-TW.json
+++ b/internal/web/translation/zh-TW.json
@@ -762,7 +762,7 @@
         "autoSystemDnsToGateway": "系統 DNS 指向閘道",
         "autoSystemDnsToGatewayTooltip": "僅限 Linux：將 systemd-resolved 指向 TUN 閘道，使系統解析經過 Xray。需要設定閘道，失敗時 TUN 不會啟動。",
         "autoSystemWfpBlockLeak": "阻止洩漏 (WFP)",
-        "autoSystemWfpBlockLeakTooltip": "僅限 Windows，需搭配自動系統路由：dns 讓 DNS 只走 TUN（需設定 DNS 伺服器），misconfigtun 阻止沒有任何路由指向 TUN 的 IP 版本。",
+        "autoSystemWfpBlockLeakTooltip": "僅限 Windows，需搭配自動系統路由：dns 讓 DNS（連接埠 53、853 及 DNS Client 服務）只走 TUN，需設定 DNS 伺服器；windnsclient 只針對該服務；其他連接埠請輸入 tcp/連接埠 或 udp/連接埠；misconfigtun 阻止沒有任何路由指向 TUN 的 IP 版本。",
         "maxVersion": "最高版本",
         "headerName": "標頭名稱",
         "headerValue": "標頭值"
diff --git a/internal/xray/api.go b/internal/xray/api.go
index 0c5bdbba9..a03aac962 100644
--- a/internal/xray/api.go
+++ b/internal/xray/api.go
@@ -38,6 +38,7 @@ import (
 	"github.com/xtls/xray-core/proxy/shadowsocks"
 	"github.com/xtls/xray-core/proxy/shadowsocks_2022"
 	"github.com/xtls/xray-core/proxy/trojan"
+	"github.com/xtls/xray-core/proxy/tun"
 	"github.com/xtls/xray-core/proxy/vless"
 	vlessEncryption "github.com/xtls/xray-core/proxy/vless/encryption"
 	vlessOutbound "github.com/xtls/xray-core/proxy/vless/outbound"
@@ -229,6 +230,13 @@ func ValidateOutboundConfig(outbound []byte) (err error) {
 	return validateHandlerSettings(built.ProxySettings)
 }
 
+// ValidateTunWfpBlockLeak runs the core's own check of a TUN inbound's autoSystemWfpBlockLeak,
+// which xray-core 26.10.31 (#7288) widened to "windnsclient" and "tcp/<port>" / "udp/<port>".
+func ValidateTunWfpBlockLeak(values []string) error {
+	_, err := tun.ExpandWfpBlockLeak(values)
+	return err
+}
+
 // validateXhttpDownloadSettings refuses what conf.Build() lets through but the core's XHTTP
 // dialer panics on at every dial: a downloadSettings block without an address or not on xhttp.
 func validateXhttpDownloadSettings(settings *serial.TypedMessage) error {