diff --git a/web/assets/js/model/outbound.js b/web/assets/js/model/outbound.js
index 6be2ec1b..5bcc8550 100644
--- a/web/assets/js/model/outbound.js
+++ b/web/assets/js/model/outbound.js
@@ -1425,14 +1425,16 @@ Outbound.FreedomSettings = class extends CommonClass {
         redirect = '',
         fragment = {},
         noises = [],
-        ipsBlocked = [],
+        finalRules = [],
     ) {
         super();
         this.domainStrategy = domainStrategy;
         this.redirect = redirect;
         this.fragment = fragment || {};
         this.noises = Array.isArray(noises) ? noises : [];
-        this.ipsBlocked = Array.isArray(ipsBlocked) ? ipsBlocked : [];
+        this.finalRules = Array.isArray(finalRules)
+            ? finalRules.map(rule => rule instanceof Outbound.FreedomSettings.FinalRule ? rule : Outbound.FreedomSettings.FinalRule.fromJson(rule))
+            : [];
     }
 
     addNoise() {
@@ -1443,13 +1445,30 @@ Outbound.FreedomSettings = class extends CommonClass {
         this.noises.splice(index, 1);
     }
 
+    addFinalRule(action = 'block') {
+        this.finalRules.push(new Outbound.FreedomSettings.FinalRule(action));
+    }
+
+    delFinalRule(index) {
+        this.finalRules.splice(index, 1);
+    }
+
     static fromJson(json = {}) {
+        const finalRules = Array.isArray(json.finalRules)
+            ? json.finalRules.map(rule => Outbound.FreedomSettings.FinalRule.fromJson(rule))
+            : [];
+
+        // Backward compatibility: map legacy ipsBlocked entries to blocking finalRules.
+        if (finalRules.length === 0 && Array.isArray(json.ipsBlocked) && json.ipsBlocked.length > 0) {
+            finalRules.push(new Outbound.FreedomSettings.FinalRule('block', '', '', json.ipsBlocked, ''));
+        }
+
         return new Outbound.FreedomSettings(
             json.domainStrategy,
             json.redirect,
             json.fragment ? Outbound.FreedomSettings.Fragment.fromJson(json.fragment) : {},
             json.noises ? json.noises.map(noise => Outbound.FreedomSettings.Noise.fromJson(noise)) : [],
-            json.ipsBlocked || [],
+            finalRules,
         );
     }
 
@@ -1459,7 +1478,7 @@ Outbound.FreedomSettings = class extends CommonClass {
             redirect: ObjectUtil.isEmpty(this.redirect) ? undefined : this.redirect,
             fragment: Object.keys(this.fragment).length === 0 ? undefined : this.fragment,
             noises: this.noises.length === 0 ? undefined : Outbound.FreedomSettings.Noise.toJsonArray(this.noises),
-            ipsBlocked: this.ipsBlocked.length === 0 ? undefined : this.ipsBlocked,
+            finalRules: this.finalRules.length === 0 ? undefined : Outbound.FreedomSettings.FinalRule.toJsonArray(this.finalRules),
         };
     }
 };
@@ -1521,6 +1540,37 @@ Outbound.FreedomSettings.Noise = class extends CommonClass {
     }
 };
 
+Outbound.FreedomSettings.FinalRule = class extends CommonClass {
+    constructor(action = 'block', network = '', port = '', ip = [], blockDelay = '') {
+        super();
+        this.action = action;
+        this.network = network;
+        this.port = port;
+        this.ip = Array.isArray(ip) ? ip : [];
+        this.blockDelay = blockDelay;
+    }
+
+    static fromJson(json = {}) {
+        return new Outbound.FreedomSettings.FinalRule(
+            json.action,
+            Array.isArray(json.network) ? json.network.join(',') : json.network,
+            json.port,
+            json.ip || [],
+            json.blockDelay,
+        );
+    }
+
+    toJson() {
+        return {
+            action: ['allow', 'block'].includes(this.action) ? this.action : 'block',
+            network: ObjectUtil.isEmpty(this.network) ? undefined : this.network,
+            port: ObjectUtil.isEmpty(this.port) ? undefined : this.port,
+            ip: this.ip.length === 0 ? undefined : this.ip,
+            blockDelay: this.action === 'block' && !ObjectUtil.isEmpty(this.blockDelay) ? this.blockDelay : undefined,
+        };
+    }
+};
+
 Outbound.BlackholeSettings = class extends CommonClass {
     constructor(type) {
         super();
diff --git a/web/html/form/outbound.html b/web/html/form/outbound.html
index 400e55d6..90eb24c9 100644
--- a/web/html/form/outbound.html
+++ b/web/html/form/outbound.html
@@ -28,12 +28,70 @@
         <a-form-item label="Redirect">
           <a-input v-model="outbound.settings.redirect"></a-input>
         </a-form-item>
-        <a-form-item label="IPs Blocked">
-          <a-select mode="tags" v-model="outbound.settings.ipsBlocked" :style="{ width: '100%' }"
-            :dropdown-class-name="themeSwitcher.currentTheme" :token-separators="[',']"
-            placeholder="IP/CIDR/geoip:*/ext:*">
-          </a-select>
+        <a-form-item label="Final Rules">
+          <a-button icon="plus" type="primary" size="small" @click="outbound.settings.addFinalRule()"></a-button>
         </a-form-item>
+        <a-form v-for="(rule, index) in outbound.settings.finalRules" :key="index" :colon="false"
+          :label-col="{ md: {span:8} }" :wrapper-col="{ md: {span:14} }">
+          <a-divider :style="{ margin: '0' }">
+            Final Rule [[ index + 1 ]]
+            <a-icon type="delete" @click="() => outbound.settings.delFinalRule(index)"
+              :style="{ color: 'rgb(255, 77, 79)', cursor: 'pointer' }"></a-icon>
+          </a-divider>
+
+          <a-form-item label="Action">
+            <a-select v-model="rule.action" :dropdown-class-name="themeSwitcher.currentTheme">
+              <a-select-option value="allow">allow</a-select-option>
+              <a-select-option value="block">block</a-select-option>
+            </a-select>
+          </a-form-item>
+
+          <a-form-item>
+            <template slot="label">
+              <a-tooltip>
+                <template slot="title">
+                  <span>Optional: tcp, udp, tcp,udp</span>
+                </template>
+                Network
+                <a-icon type="question-circle"></a-icon>
+              </a-tooltip>
+            </template>
+            <a-input v-model.trim="rule.network" placeholder="tcp,udp"></a-input>
+          </a-form-item>
+
+          <a-form-item>
+            <template slot="label">
+              <a-tooltip>
+                <template slot="title">
+                  <span>Optional: same format as routing port, e.g. 53,443,1000-2000</span>
+                </template>
+                Port
+                <a-icon type="question-circle"></a-icon>
+              </a-tooltip>
+            </template>
+            <a-input v-model.trim="rule.port" placeholder="53,443"></a-input>
+          </a-form-item>
+
+          <a-form-item>
+            <template slot="label">
+              <a-tooltip>
+                <template slot="title">
+                  <span>Optional IP/CIDR/geoip list, e.g. geoip:cn, 10.0.0.0/8</span>
+                </template>
+                IP
+                <a-icon type="question-circle"></a-icon>
+              </a-tooltip>
+            </template>
+            <a-select mode="tags" v-model="rule.ip" :style="{ width: '100%' }"
+              :dropdown-class-name="themeSwitcher.currentTheme" :token-separators="[',']"
+              placeholder="geoip:cn,10.0.0.0/8">
+            </a-select>
+          </a-form-item>
+
+          <a-form-item label="Block Delay" v-if="rule.action === 'block'">
+            <a-input v-model.trim="rule.blockDelay" placeholder="30-90"></a-input>
+          </a-form-item>
+        </a-form>
         <a-form-item label="Fragment">
           <a-switch :checked="Object.keys(outbound.settings.fragment).length >0"
             @change="checked => outbound.settings.fragment = checked ? new Outbound.FreedomSettings.Fragment() : {}">