diff --git a/zapret/Makefile b/zapret/Makefile
index 9c059f7..8da57b1 100644
--- a/zapret/Makefile
+++ b/zapret/Makefile
@@ -78,9 +78,7 @@ define Package/$(PKG_NAME)/install
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/init.d/openwrt/90-zapret $(1)/etc/hotplug.d/iface/90-zapret
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/init.d/openwrt/zapret $(1)/etc/init.d/zapret
-	$(INSTALL_DIR) $(1)/etc/config
-	$(INSTALL_CONF) ./zapret.config $(1)/etc/config/zapret
-	$(INSTALL_CONF) ./config        $(1)/opt/zapret/config
+	$(INSTALL_CONF) ./config.default $(1)/opt/zapret/config.default
 	#$(INSTALL_CONF) ./ipset/zapret-hosts-auto.txt         $(1)/opt/zapret/ipset/zapret-hosts-auto.txt
 	$(INSTALL_CONF) ./ipset/zapret-hosts-user.txt         $(1)/opt/zapret/ipset/zapret-hosts-user.txt
 	$(INSTALL_CONF) ./ipset/zapret-hosts-user-exclude.txt $(1)/opt/zapret/ipset/zapret-hosts-user-exclude.txt
@@ -91,6 +89,9 @@ define Package/$(PKG_NAME)/install
 	$(INSTALL_CONF) ./ipset/zapret-ip-user-exclude.txt    $(1)/opt/zapret/ipset/zapret-ip-user-exclude.txt
 	$(INSTALL_CONF) ./ipset/zapret-ip-user-ipban.txt      $(1)/opt/zapret/ipset/zapret-ip-user-ipban.txt
 	$(INSTALL_BIN) ./sync_config.sh $(1)/opt/zapret/sync_config.sh
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./uci-def-cfg.sh $(1)/etc/uci-defaults/zapret-uci-def-cfg.sh
+	$(INSTALL_BIN) ./uci-def-cfg.sh $(1)/opt/zapret/uci-def-cfg.sh
 endef
 
 define Package/$(PKG_NAME)/preinst
@@ -116,26 +117,20 @@ define Package/$(PKG_NAME)/postinst
 #!/bin/sh
 # check if we are on real system
 if [ -z "$${IPKG_INSTROOT}" ]; then
-	NEWCFGNAME=zapret-opkg
-	NEWCFGFILE=/etc/config/$${NEWCFGNAME}
-	if [ -f "$${NEWCFGFILE}" ]; then
-		uci -m -f /etc/config/zapret import "$${NEWCFGNAME}"
-		uci commit "$${NEWCFGNAME}"
-		uci -m -f "$${NEWCFGFILE}" import zapret
-		uci commit zapret
-		rm -f "$${NEWCFGFILE}"
-		echo "File /etc/config/zapret merged from IPK"
+	ZAPRET_CONFIG=/opt/zapret/config
+	ZAPRET_CONFIG_DEF="/opt/zapret/config.default"
+	# check existing uci-config
+	[ -f "/etc/config/zapret" ] && ZAPRET_CFG_EXISTS=1 || ZAPRET_CFG_EXISTS=0
+	# create or merge uci-config
+	/opt/zapret/uci-def-cfg.sh
+	[ "$${ZAPRET_CFG_EXISTS}" = "1" ] && echo "Config /etc/config/zapret merged with default uci-config"
+	# remove uci-default script from system dir (used into /etc/init.d/boot)
+	rm -f /etc/uci-defaults/zapret-uci-def-cfg.sh
+	# creating main config if its not exists
+	if [ ! -f "$${ZAPRET_CONFIG}" ]; then
+		cp -f "$${ZAPRET_CONFIG_DEF}" "$${ZAPRET_CONFIG}"
+		/opt/zapret/sync_config.sh
 	fi
-	NEWCONFIG=/opt/zapret/config-opkg
-	if [ -f "$${NEWCONFIG}" ]; then
-		# backup current main config
-		mv -f /opt/zapret/config /opt/zapret/config.backup
-		# renew main config
-		mv -f "$${NEWCONFIG}" /opt/zapret/config
-		echo "File /opt/zapret/config replaced from IPK"
-	fi
-	# synchnonize main config
-	/opt/zapret/sync_config.sh
 	# enable main service
 	/etc/init.d/zapret enable
 	# stop all
@@ -178,7 +173,7 @@ define Package/$(PKG_NAME)/postrm
 # check if we are on real system
 if [ -z "$${IPKG_INSTROOT}" ]; then
 	[ -f "/etc/config/zapret-opkg" ] && rm -f "/etc/config/zapret-opkg"
-	[ -f "/opt/zapret/config" ] && cp -f /opt/zapret/config "/opt/zapret/config.backup2"
+	[ -f "/opt/zapret/config" ] && cp -f /opt/zapret/config "/opt/zapret/config.backup"
 	#rm -rf /opt/zapret
 	#echo "Directory /opt/zapret removed!"
 fi
diff --git a/zapret/config b/zapret/config.default
similarity index 99%
rename from zapret/config
rename to zapret/config.default
index ca7770b..d8fe637 100644
--- a/zapret/config
+++ b/zapret/config.default
@@ -141,4 +141,3 @@ DISABLE_IPV6=1
 # possible values : get_user.sh get_antizapret.sh get_combined.sh get_reestr.sh get_hostlist.sh
 # comment if not required
 #GETLIST=get_antizapret_domains.sh
-#GETLIST=get_antifilter_ipsmart.sh
diff --git a/zapret/sync_config.sh b/zapret/sync_config.sh
index 0edf660..d71bb2f 100755
--- a/zapret/sync_config.sh
+++ b/zapret/sync_config.sh
@@ -4,6 +4,7 @@
 EXEDIR=/opt/zapret
 ZAPRET_BASE=/opt/zapret
 ZAPRET_CONFIG="$ZAPRET_BASE/config"
+ZAPRET_CONFIG_DEF="$ZAPRET_BASE/config.default"
 ZAPRET_CFG=/etc/config/zapret
 
 function get_sed_compat
@@ -60,6 +61,14 @@ function sync_param
 	fi
 }
 
+if [ ! -f "$ZAPRET_CONFIG" ]; then
+	if [ ! -f "$ZAPRET_CONFIG_DEF" ]; then
+		touch "$ZAPRET_CONFIG"
+	else
+		cp -f "$ZAPRET_CONFIG_DEF" "$ZAPRET_CONFIG"
+	fi
+fi
+
 sync_param MODE
 sync_param FLOWOFFLOAD
 sync_param INIT_APPLY_FW
diff --git a/zapret/uci-def-cfg.sh b/zapret/uci-def-cfg.sh
new file mode 100755
index 0000000..81e13ef
--- /dev/null
+++ b/zapret/uci-def-cfg.sh
@@ -0,0 +1,119 @@
+#!/bin/sh
+# Copyright (c) 2024 remittor
+
+SCRIPT_SOURCED=0
+case ${0##*/} in ash|-ash) SCRIPT_SOURCED=1;; esac
+#[[ $_ != $0 ]] && echo "Script is being sourced" || echo "Script is a subshell"
+
+ZAPRET_BASE=/opt/zapret
+ZAPRET_CONFIG="$ZAPRET_BASE/config"
+ZAPRET_CONFIG_DEF="$ZAPRET_BASE/config.default"
+ZAPRET_CFG_FILE=/etc/config/zapret
+ZAPRET_CFG_NAME=zapret
+
+CFG_OPT_FORCE=0
+CFG_OPT_MERGE=0
+CFG_OPT_SYNC_CFG=0
+
+
+function set_default_values
+{
+	local cfgname=${1:-$ZAPRET_CFG_NAME}
+	uci batch <<-EOF
+		set $cfgname.config.autostart='0'
+		set $cfgname.config.FWTYPE='nftables'
+		set $cfgname.config.MODE='nfqws'
+		set $cfgname.config.FLOWOFFLOAD='none'
+		set $cfgname.config.INIT_APPLY_FW='1'
+		set $cfgname.config.DISABLE_IPV4='0'
+		set $cfgname.config.DISABLE_IPV6='1'
+		set $cfgname.config.MODE_FILTER='hostlist'
+		set $cfgname.config.DESYNC_MARK='0x40000000'
+		set $cfgname.config.DESYNC_MARK_POSTNAT='0x20000000'
+		set $cfgname.config.NFQWS_OPT_DESYNC='--dpi-desync=fake,split2 --dpi-desync-ttl=7 --dpi-desync-ttl6=0 --dpi-desync-repeats=20 --dpi-desync-fooling=md5sig,badseq --dpi-desync-fake-tls=/opt/zapret/files/fake/tls_clienthello_www_google_com.bin'
+		set $cfgname.config.NFQWS_OPT_DESYNC_SUFFIX=''
+		set $cfgname.config.MODE_HTTP='1'
+		set $cfgname.config.MODE_HTTP_KEEPALIVE='0'
+		set $cfgname.config.HTTP_PORTS='80'
+		set $cfgname.config.NFQWS_OPT_DESYNC_HTTP=''
+		set $cfgname.config.NFQWS_OPT_DESYNC_HTTP_SUFFIX=''
+		set $cfgname.config.NFQWS_OPT_DESYNC_HTTP6=''
+		set $cfgname.config.NFQWS_OPT_DESYNC_HTTP6_SUFFIX=''
+		set $cfgname.config.MODE_HTTPS='1'
+		set $cfgname.config.HTTPS_PORTS='443'
+		set $cfgname.config.NFQWS_OPT_DESYNC_HTTPS=''
+		set $cfgname.config.NFQWS_OPT_DESYNC_HTTPS_SUFFIX=''
+		set $cfgname.config.NFQWS_OPT_DESYNC_HTTPS6=''
+		set $cfgname.config.NFQWS_OPT_DESYNC_HTTPS6_SUFFIX=''
+		set $cfgname.config.MODE_QUIC='1'
+		set $cfgname.config.QUIC_PORTS='443'
+		set $cfgname.config.NFQWS_OPT_DESYNC_QUIC='--dpi-desync=fake,split2 --dpi-desync-repeats=15 --dpi-desync-fake-quic=/opt/zapret/files/fake/quic_initial_www_google_com.bin --new --dpi-desync=fake --dpi-desync-repeats=15'
+		set $cfgname.config.NFQWS_OPT_DESYNC_QUIC_SUFFIX=''
+		set $cfgname.config.NFQWS_OPT_DESYNC_QUIC6=''
+		set $cfgname.config.NFQWS_OPT_DESYNC_QUIC6_SUFFIX=''
+		commit $cfgname
+	EOF
+	return 0
+}
+
+function create_default_config
+{
+	local cfgname=${1:-$ZAPRET_CFG_NAME}
+	local cfgfile=/etc/config/$cfgname
+	rm -f $cfgfile
+	touch $cfgfile
+	uci set $cfgname.config=main
+	set_default_values $cfgname
+	return 0
+}
+
+function merge_config_with_def_values
+{
+	local cfgname=${1:-$ZAPRET_CFG_NAME}
+	local force=$2
+	local cfgfile=/etc/config/$cfgname
+	local NEWCFGNAME="zapret-default"
+	local NEWCFGFILE="/etc/config/$NEWCFGNAME"
+
+	create_default_config "$NEWCFGNAME"
+	[ ! -f "$NEWCFGFILE" ] && return 1 
+
+	uci -m -f $cfgfile import "$NEWCFGNAME"
+	uci commit "$NEWCFGNAME"
+	uci -m -f "$NEWCFGFILE" import $cfgname
+	uci commit $cfgname
+	rm -f "$NEWCFGFILE"	
+	return 0
+}
+
+
+if [ "$SCRIPT_SOURCED" != "1" ]; then
+	while getopts "fms" SCRIPT_OPT; do
+		case $SCRIPT_OPT in
+			f) CFG_OPT_FORCE=1;;
+			m) CFG_OPT_MERGE=1;;
+			s) CFG_OPT_SYNC_CFG=1;;
+		esac
+	done
+
+	if [ ! -f "$ZAPRET_CFG_FILE" ]; then
+		CFG_OPT_FORCE=1
+	fi
+
+	if [ "$CFG_OPT_FORCE" = "1" ]; then
+		create_default_config
+		[ "$CFG_OPT_SYNC_CFG" = "1" ] && /opt/zapret/sync_config.sh
+		return 0
+	fi
+fi
+
+
+CFG_OPT_MERGE=1
+merge_config_with_def_values
+
+if [ ! -f "$ZAPRET_CONFIG" ]; then
+	# create main config
+	/opt/zapret/sync_config.sh
+fi
+
+return 0
diff --git a/zapret/zapret.config b/zapret/zapret.config
deleted file mode 100644
index 64395a2..0000000
--- a/zapret/zapret.config
+++ /dev/null
@@ -1,32 +0,0 @@
-config main 'config'
-	option autostart '0'
-	option FWTYPE 'nftables'
-	option MODE 'nfqws'
-	option FLOWOFFLOAD 'none'
-	option INIT_APPLY_FW '1'
-	option DISABLE_IPV4 '0'
-	option DISABLE_IPV6 '1'
-	option MODE_FILTER 'hostlist'
-	option DESYNC_MARK '0x40000000'
-	option DESYNC_MARK_POSTNAT '0x20000000'
-	option NFQWS_OPT_DESYNC '--dpi-desync=fake,split2 --dpi-desync-ttl=7 --dpi-desync-ttl6=0 --dpi-desync-repeats=20 --dpi-desync-fooling=md5sig,badseq --dpi-desync-fake-tls=/opt/zapret/files/fake/tls_clienthello_www_google_com.bin'
-	option NFQWS_OPT_DESYNC_SUFFIX ''
-	option MODE_HTTP '1'
-	option MODE_HTTP_KEEPALIVE '0'
-	option HTTP_PORTS '80'
-	option NFQWS_OPT_DESYNC_HTTP ''
-	option NFQWS_OPT_DESYNC_HTTP_SUFFIX ''
-	option NFQWS_OPT_DESYNC_HTTP6 ''
-	option NFQWS_OPT_DESYNC_HTTP6_SUFFIX ''
-	option MODE_HTTPS '1'
-	option HTTPS_PORTS '443'
-	option NFQWS_OPT_DESYNC_HTTPS ''
-	option NFQWS_OPT_DESYNC_HTTPS_SUFFIX ''
-	option NFQWS_OPT_DESYNC_HTTPS6 ''
-	option NFQWS_OPT_DESYNC_HTTPS6_SUFFIX ''
-	option MODE_QUIC '1'
-	option QUIC_PORTS '443'
-	option NFQWS_OPT_DESYNC_QUIC '--dpi-desync=fake,split2 --dpi-desync-repeats=15 --dpi-desync-fake-quic=/opt/zapret/files/fake/quic_initial_www_google_com.bin --new --dpi-desync=fake --dpi-desync-repeats=15'
-	option NFQWS_OPT_DESYNC_QUIC_SUFFIX ''
-	option NFQWS_OPT_DESYNC_QUIC6 ''
-	option NFQWS_OPT_DESYNC_QUIC6_SUFFIX ''