diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18d04dd5..d14cfee1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,15 +25,80 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 ### Added
 
+- Etc timezones to the timezone list ([#6568]).
+- The schema version of the configuration file to the output of running
+  `AdGuardHome` (or `AdGuardHome.exe`) with `-v --version` command-line options
+  ([#6545]).
 - Ability to disable plain-DNS serving via UI if an encrypted protocol is
   already used ([#1660]).
 
+### Changed
+
+- The bootstrapped upstream addresses now updated according to the TTL of the
+  bootstrap DNS response ([#6321]).
+- Logging level of timeout errors is now `error` instead of `debug` ([#6574]).
+- The field `"upstream_mode"` in `POST /control/dns_config` and
+  `GET /control/dns_info` HTTP APIs now accepts `load_balance` value.  Check
+  `openapi/CHANGELOG.md` for more details.
+
+#### Configuration changes
+
+In this release, the schema version has changed from 27 to 28.
+
+- The new property `clients.persistent.*.uid`, which is unique identifier of the
+  persistent client.
+- The properties `dns.all_servers` and `dns.fastest_addr` were removed, their
+  values migrated to newly added field `dns.upstream_mode` that describes the
+  logic through which upstreams will be used.  See also a [Wiki
+  page][wiki-config].
+
+  ```yaml
+  # BEFORE:
+  'dns':
+      # …
+      'all_servers': true
+      'fastest_addr': true
+
+  # AFTER:
+  'dns':
+      # …
+      'upstream_mode': 'parallel'
+  ```
+
+  To rollback this change, remove the new field `upstream_mode`, set back
+  `dns.all_servers` and `dns.fastest_addr` properties in `dns` section, and
+  change the `schema_version` back to `27`.
+
 ### Fixed
 
+- Panic on using `--no-etc-hosts` flag ([#6644]).
+- Schedule display in the client settings after creating or updating.
+- Zero value in `querylog.size_memory` disables logging ([#6570]).
+- Non-anonymized IP addresses on the dashboard ([#6584]).
+- Maximum cache TTL requirement when editing minimum cache TTL in the Web UI
+  ([#6409]).
+- Load balancing algorithm stuck on a single server ([#6480]).
+- Statistics for 7 days displayed as 168 hours on the dashboard.
+- Pre-filling the Edit static lease window with data ([#6534]).
+- Names defined in the `/etc/hosts` for a single address family wrongly
+  considered undefined for another family ([#6541]).
 - Omitted CNAME records in safe search results, which can cause YouTube to not
   work on iOS ([#6352]).
 
+[#6321]: https://github.com/AdguardTeam/AdGuardHome/issues/6321
 [#6352]: https://github.com/AdguardTeam/AdGuardHome/issues/6352
+[#6409]: https://github.com/AdguardTeam/AdGuardHome/issues/6409
+[#6480]: https://github.com/AdguardTeam/AdGuardHome/issues/6480
+[#6534]: https://github.com/AdguardTeam/AdGuardHome/issues/6534
+[#6541]: https://github.com/AdguardTeam/AdGuardHome/issues/6541
+[#6545]: https://github.com/AdguardTeam/AdGuardHome/issues/6545
+[#6568]: https://github.com/AdguardTeam/AdGuardHome/issues/6568
+[#6570]: https://github.com/AdguardTeam/AdGuardHome/issues/6570
+[#6574]: https://github.com/AdguardTeam/AdGuardHome/issues/6574
+[#6584]: https://github.com/AdguardTeam/AdGuardHome/issues/6584
+[#6644]: https://github.com/AdguardTeam/AdGuardHome/issues/6644
+
+[wiki-config]: https://github.com/AdguardTeam/AdGuardHome/wiki/Configuration
 
 <!--
 NOTE: Add new changes ABOVE THIS COMMENT.
diff --git a/README.md b/README.md
index 1a6937f1..3e2b4f2b 100644
--- a/README.md
+++ b/README.md
@@ -276,6 +276,15 @@ Open your terminal and execute these commands:
 git clone https://github.com/AdguardTeam/AdGuardHome
 cd AdGuardHome
 make
+```
+
+  #### <a href="#building-node" id="building-node" name="building-node">Building with Node.js 17 and later</a>
+
+In order to build AdGuard Home with Node.js 17 and later, specify
+`--openssl-legacy-provider` option.
+
+```sh
+export NODE_OPTIONS=--openssl-legacy-provider
 ```
 
 **NOTE:**  The non-standard `-j` flag is currently not supported, so building
@@ -409,6 +418,7 @@ There are three options how you can install an unstable version:
     ```sh
     curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -c edge
     ```
+
 [wiki-platf]: https://github.com/AdguardTeam/AdGuardHome/wiki/Platforms
 
 
@@ -463,10 +473,6 @@ bug or implementing the feature.
     [@kongfl888](https://github.com/kongfl888) (originally by
     [@rufengsuixing](https://github.com/rufengsuixing)).
 
- *  [Prometheus exporter for AdGuard
-    Home](https://github.com/ebrianne/adguard-exporter) by
-    [@ebrianne](https://github.com/ebrianne).
-
  *  [Terminal-based, real-time traffic monitoring and statistics for your AdGuard Home
     instance](https://github.com/Lissy93/AdGuardian-Term) by
     [@Lissy93](https://github.com/Lissy93)
@@ -485,7 +491,8 @@ bug or implementing the feature.
  *  [Node.js library](https://github.com/Andrea055/AdguardHomeAPI) by
     [@Andrea055](https://github.com/Andrea055/).
 
-
+ *  [Browser Extension](https://github.com/satheshshiva/Adguard-Home-Browser-Ext) by
+    [@satheshshiva](https://github.com/satheshshiva/).
 
 ## <a href="#acknowledgments" id="acknowledgments" name="acknowledgments">Acknowledgments</a>
 
diff --git a/client/package-lock.json b/client/package-lock.json
index a06f0c18..0c7da114 100644
--- a/client/package-lock.json
+++ b/client/package-lock.json
@@ -11,6 +11,7 @@
                 "@nivo/line": "^0.64.0",
                 "axios": "^0.19.2",
                 "classnames": "^2.2.6",
+                "countries-and-timezones": "^3.6.0",
                 "date-fns": "^1.29.0",
                 "i18next": "^19.6.2",
                 "i18next-browser-languagedetector": "^4.2.0",
@@ -37,7 +38,6 @@
                 "redux-actions": "^2.6.5",
                 "redux-form": "^8.3.5",
                 "redux-thunk": "^2.3.0",
-                "timezones-list": "^3.0.2",
                 "url-polyfill": "^1.1.9"
             },
             "devDependencies": {
@@ -5596,6 +5596,15 @@
                 "node": ">=8"
             }
         },
+        "node_modules/countries-and-timezones": {
+            "version": "3.6.0",
+            "resolved": "https://registry.npmjs.org/countries-and-timezones/-/countries-and-timezones-3.6.0.tgz",
+            "integrity": "sha512-8/nHBCs1eKeQ1jnsZVGdqrLYxS8nPcfJn8PnmxdJXWRLZdXsGFR8gnVhRjatGDBjqmPm7H+FtYpBYTPWd0Eiqg==",
+            "engines": {
+                "node": ">=8.x",
+                "npm": ">=5.x"
+            }
+        },
         "node_modules/create-ecdh": {
             "version": "4.0.3",
             "resolved": "https://registry.npmjs.org/create-ecdh/-/create-ecdh-4.0.3.tgz",
@@ -18881,11 +18890,6 @@
                 "node": ">=0.6.0"
             }
         },
-        "node_modules/timezones-list": {
-            "version": "3.0.2",
-            "resolved": "https://registry.npmjs.org/timezones-list/-/timezones-list-3.0.2.tgz",
-            "integrity": "sha512-I698hm6Jp/xxkwyTSOr39pZkYKETL8LDJeSIhjxXBfPUAHM5oZNuQ4o9UK3PSkDBOkjATecSOBb3pR1IkIBUsg=="
-        },
         "node_modules/tiny-invariant": {
             "version": "1.1.0",
             "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.1.0.tgz",
@@ -25268,6 +25272,11 @@
                 "yaml": "^1.7.2"
             }
         },
+        "countries-and-timezones": {
+            "version": "3.6.0",
+            "resolved": "https://registry.npmjs.org/countries-and-timezones/-/countries-and-timezones-3.6.0.tgz",
+            "integrity": "sha512-8/nHBCs1eKeQ1jnsZVGdqrLYxS8nPcfJn8PnmxdJXWRLZdXsGFR8gnVhRjatGDBjqmPm7H+FtYpBYTPWd0Eiqg=="
+        },
         "create-ecdh": {
             "version": "4.0.3",
             "resolved": "https://registry.npmjs.org/create-ecdh/-/create-ecdh-4.0.3.tgz",
@@ -35674,11 +35683,6 @@
                 "setimmediate": "^1.0.4"
             }
         },
-        "timezones-list": {
-            "version": "3.0.2",
-            "resolved": "https://registry.npmjs.org/timezones-list/-/timezones-list-3.0.2.tgz",
-            "integrity": "sha512-I698hm6Jp/xxkwyTSOr39pZkYKETL8LDJeSIhjxXBfPUAHM5oZNuQ4o9UK3PSkDBOkjATecSOBb3pR1IkIBUsg=="
-        },
         "tiny-invariant": {
             "version": "1.1.0",
             "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.1.0.tgz",
diff --git a/client/package.json b/client/package.json
index 23c1eea6..64b3f03b 100644
--- a/client/package.json
+++ b/client/package.json
@@ -16,6 +16,7 @@
         "@nivo/line": "^0.64.0",
         "axios": "^0.19.2",
         "classnames": "^2.2.6",
+        "countries-and-timezones": "^3.6.0",
         "date-fns": "^1.29.0",
         "i18next": "^19.6.2",
         "i18next-browser-languagedetector": "^4.2.0",
@@ -42,7 +43,6 @@
         "redux-actions": "^2.6.5",
         "redux-form": "^8.3.5",
         "redux-thunk": "^2.3.0",
-        "timezones-list": "^3.0.2",
         "url-polyfill": "^1.1.9"
     },
     "devDependencies": {
diff --git a/client/src/components/Filters/Examples.js b/client/src/components/Filters/Examples.js
index 6dcc01c7..602c17da 100644
--- a/client/src/components/Filters/Examples.js
+++ b/client/src/components/Filters/Examples.js
@@ -36,7 +36,7 @@ const Examples = () => (
             <Trans
                 components={[
                     <a
-                        href="https://github.com/AdguardTeam/AdGuardHome/wiki/Hosts-Blocklists"
+                        href="https://link.adtidy.org/forward.html?action=dns_kb_filtering_syntax&from=ui&app=home"
                         target="_blank"
                         rel="noopener noreferrer"
                         key="0"
diff --git a/client/src/components/Filters/Services/ScheduleForm/Timezone.js b/client/src/components/Filters/Services/ScheduleForm/Timezone.js
index 71d017d6..421267b6 100644
--- a/client/src/components/Filters/Services/ScheduleForm/Timezone.js
+++ b/client/src/components/Filters/Services/ScheduleForm/Timezone.js
@@ -1,5 +1,5 @@
 import React from 'react';
-import timezones from 'timezones-list';
+import ct from 'countries-and-timezones';
 import { useTranslation } from 'react-i18next';
 import PropTypes from 'prop-types';
 
@@ -15,6 +15,8 @@ export const Timezone = ({
         setTimezone(event.target.value);
     };
 
+    const timezones = ct.getAllTimezones();
+
     return (
         <div className="schedule__timezone">
             <label className="form__label form__label--with-desc mb-2">
@@ -30,9 +32,9 @@ export const Timezone = ({
                     {t('schedule_timezone')}
                 </option>
                 {/* TODO: get timezones from backend method when the method is ready */}
-                {timezones.map((zone) => (
-                    <option key={zone.name} value={zone.tzCode}>
-                        {zone.label}
+                {Object.keys(timezones).map((zone) => (
+                    <option key={zone} value={zone}>
+                        {zone} (GMT{timezones[zone].utcOffsetStr})
                     </option>
                 ))}
             </select>
diff --git a/client/src/components/Filters/Services/ScheduleForm/index.js b/client/src/components/Filters/Services/ScheduleForm/index.js
index f7bf605b..e2de3c41 100644
--- a/client/src/components/Filters/Services/ScheduleForm/index.js
+++ b/client/src/components/Filters/Services/ScheduleForm/index.js
@@ -1,4 +1,4 @@
-import React, { useState, useMemo } from 'react';
+import React, { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import PropTypes from 'prop-types';
 import cn from 'classnames';
@@ -21,10 +21,7 @@ export const ScheduleForm = ({
     const onModalOpen = () => setModalOpen(true);
     const onModalClose = () => setModalOpen(false);
 
-    const filteredScheduleKeys = useMemo(() => (
-        schedule ? Object.keys(schedule).filter((v) => v !== 'time_zone') : []
-    ), [schedule]);
-
+    const filteredScheduleKeys = schedule ? Object.keys(schedule).filter((v) => v !== 'time_zone') : [];
     const scheduleMap = new Map();
     filteredScheduleKeys.forEach((day) => scheduleMap.set(day, schedule[day]));
 
diff --git a/client/src/components/Settings/Clients/Form.js b/client/src/components/Settings/Clients/Form.js
index ba4ec4b3..2df5b655 100644
--- a/client/src/components/Settings/Clients/Form.js
+++ b/client/src/components/Settings/Clients/Form.js
@@ -162,7 +162,7 @@ let Form = (props) => {
     const [activeTabLabel, setActiveTabLabel] = useState('settings');
 
     const handleScheduleSubmit = (values) => {
-        change('blocked_services_schedule', values);
+        change('blocked_services_schedule', { ...values });
     };
 
     const tabs = {
@@ -371,7 +371,7 @@ let Form = (props) => {
                         </div>
                         <div className="form__desc mt-0 mb-2">
                             <Trans components={[
-                                <a target="_blank" rel="noopener noreferrer" href="https://github.com/AdguardTeam/AdGuardHome/wiki/Hosts-Blocklists#ctag"
+                                <a target="_blank" rel="noopener noreferrer" href="https://link.adtidy.org/forward.html?action=dns_kb_filtering_syntax_ctag&from=ui&app=home"
                                    key="0">link</a>,
                             ]}>
                                 tags_desc
diff --git a/client/src/components/Settings/Dhcp/Leases.js b/client/src/components/Settings/Dhcp/Leases.js
index 9b245dbe..3b267b3b 100644
--- a/client/src/components/Settings/Dhcp/Leases.js
+++ b/client/src/components/Settings/Dhcp/Leases.js
@@ -3,7 +3,7 @@ import { connect } from 'react-redux';
 import PropTypes from 'prop-types';
 import ReactTable from 'react-table';
 import { Trans, withTranslation } from 'react-i18next';
-import { LEASES_TABLE_DEFAULT_PAGE_SIZE } from '../../../helpers/constants';
+import { LEASES_TABLE_DEFAULT_PAGE_SIZE, MODAL_TYPE } from '../../../helpers/constants';
 import { sortIp } from '../../../helpers/helpers';
 import { toggleLeaseModal } from '../../../actions';
 
@@ -18,7 +18,10 @@ class Leases extends Component {
 
     convertToStatic = (data) => () => {
         const { dispatch } = this.props;
-        dispatch(toggleLeaseModal(data));
+        dispatch(toggleLeaseModal({
+            type: MODAL_TYPE.ADD_LEASE,
+            config: data,
+        }));
     }
 
     makeStatic = ({ row }) => {
diff --git a/client/src/components/Settings/Dns/Cache/Form.js b/client/src/components/Settings/Dns/Cache/Form.js
index 0f51e117..c772019f 100644
--- a/client/src/components/Settings/Dns/Cache/Form.js
+++ b/client/src/components/Settings/Dns/Cache/Form.js
@@ -41,7 +41,7 @@ const Form = ({
         cache_ttl_max, cache_ttl_min,
     } = useSelector((state) => state.form[FORM_NAME.CACHE].values, shallowEqual);
 
-    const minExceedsMax = cache_ttl_min > cache_ttl_max;
+    const minExceedsMax = cache_ttl_min > 0 && cache_ttl_max > 0 && cache_ttl_min > cache_ttl_max;
 
     const handleClearCache = () => {
         if (window.confirm(t('confirm_dns_cache_clear'))) {
diff --git a/client/src/helpers/constants.js b/client/src/helpers/constants.js
index 0b345f4d..66454939 100644
--- a/client/src/helpers/constants.js
+++ b/client/src/helpers/constants.js
@@ -181,6 +181,7 @@ export const MODAL_TYPE = {
     ADD_REWRITE: 'ADD_REWRITE',
     EDIT_REWRITE: 'EDIT_REWRITE',
     EDIT_LEASE: 'EDIT_LEASE',
+    ADD_LEASE: 'ADD_LEASE',
 };
 
 export const CLIENT_ID = {
@@ -435,7 +436,7 @@ export const SCHEME_TO_PROTOCOL_MAP = {
 export const DNS_REQUEST_OPTIONS = {
     PARALLEL: 'parallel',
     FASTEST_ADDR: 'fastest_addr',
-    LOAD_BALANCING: '',
+    LOAD_BALANCING: 'load_balance',
 };
 
 export const DHCP_FORM_NAMES = {
diff --git a/client/src/helpers/filters/filters.js b/client/src/helpers/filters/filters.js
index a1bf0555..b7e4a06a 100644
--- a/client/src/helpers/filters/filters.js
+++ b/client/src/helpers/filters/filters.js
@@ -142,11 +142,11 @@ export default {
             "homepage": "https://github.com/AdguardTeam/AdGuardSDNSFilter",
             "source": "https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt"
         },
-        "adway_default_blocklist": {
-            "name": "AdAway Default Blocklist",
+        "awavenue_ads_rule": {
+            "name": "AWAvenue Ads Rule",
             "categoryId": "general",
-            "homepage": "https://github.com/AdAway/adaway.github.io/",
-            "source": "https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt"
+            "homepage": "https://awavenue.top/",
+            "source": "https://adguardteam.github.io/HostlistsRegistry/assets/filter_53.txt"
         },
         "curben_phishing_filter": {
             "name": "Phishing URL Blocklist (PhishTank and OpenPhish)",
@@ -190,6 +190,12 @@ export default {
             "homepage": "https://github.com/hagezi/dns-blocklists#piracy",
             "source": "https://adguardteam.github.io/HostlistsRegistry/assets/filter_46.txt"
         },
+        "hagezi_dyndns_blocklist": {
+            "name": "HaGeZi's DynDNS Blocklist",
+            "categoryId": "security",
+            "homepage": "https://github.com/hagezi/dns-blocklists",
+            "source": "https://adguardteam.github.io/HostlistsRegistry/assets/filter_54.txt"
+        },
         "hagezi_encrypted_dns_vpn_tor_proxy_bypass": {
             "name": "HaGeZi's Encrypted DNS/VPN/TOR/Proxy Bypass",
             "categoryId": "security",
diff --git a/client/src/helpers/trackers/trackers.json b/client/src/helpers/trackers/trackers.json
index b5016dfb..247e5ce8 100644
--- a/client/src/helpers/trackers/trackers.json
+++ b/client/src/helpers/trackers/trackers.json
@@ -1,5 +1,5 @@
 {
-    "timeUpdated": "2023-12-01T15:24:07.522Z",
+    "timeUpdated": "2024-01-22T00:10:10.554Z",
     "categories": {
         "0": "audio_video_player",
         "1": "comments",
@@ -10758,9 +10758,10 @@
         },
         "localytics": {
             "name": "Localytics",
-            "categoryId": 6,
-            "url": "http://www.localytics.com/",
-            "companyId": "localytics"
+            "categoryId": 101,
+            "url": "https://uplandsoftware.com/localytics/",
+            "companyId": "upland",
+            "source": "AdGuard"
         },
         "lockerdome": {
             "name": "LockerDome",
@@ -15613,10 +15614,11 @@
             "companyId": "sharecompany"
         },
         "sharepoint": {
-            "name": "Microsoft SharePoint",
-            "categoryId": 2,
-            "url": "https://products.office.com/en-us/sharepoint/sharepoint-online-collaboration-software",
-            "companyId": "microsoft"
+            "name": "SharePoint",
+            "categoryId": 8,
+            "url": "https://www.microsoft.com/microsoft-365/sharepoint/collaboration",
+            "companyId": "microsoft",
+            "source": "AdGuard"
         },
         "sharethis": {
             "name": "ShareThis",
@@ -22958,6 +22960,7 @@
         "loadercdn.com": "loadercdn.com",
         "loadsource.org": "loadsource.org",
         "web.localytics.com": "localytics",
+        "localytics.com": "localytics",
         "cdn2.lockerdome.com": "lockerdome",
         "addtoany.com": "lockerz_share",
         "pixel.loganmedia.mobi": "logan_media",
@@ -23254,6 +23257,7 @@
         "k-msedge.net": "msedge",
         "l-msedge.net": "msedge",
         "s-msedge.net": "msedge",
+        "spo-msedge.net": "msedge",
         "t-msedge.net": "msedge",
         "wac-msedge.net": "msedge",
         "msn.com": "msn",
@@ -23521,8 +23525,10 @@
         "outbrain.com": "outbrain",
         "outbrainimg.com": "outbrain",
         "live.com": "outlook",
+        "cloud.microsoft": "outlook",
         "hotmail.com": "outlook",
         "outlook.com": "outlook",
+        "svc.ms": "outlook",
         "overheat.it": "overheat.it",
         "oewabox.at": "owa",
         "owneriq.net": "owneriq",
@@ -23790,6 +23796,7 @@
         "rcsmediagroup.it": "rcs.it",
         "d335luupugsy2.cloudfront.net": "rd_station",
         "rea-group.com": "rea_group",
+        "reagroupdata.com.au": "rea_group",
         "reastatic.net": "rea_group",
         "d12ulf131zb0yj.cloudfront.net": "reachforce",
         "reachforce.com": "reachforce",
@@ -24109,6 +24116,8 @@
         "quintrics.nl": "sharecompany",
         "sharecompany.nl": "sharecompany",
         "sharepointonline.com": "sharepoint",
+        "onmicrosoft.com": "sharepoint",
+        "sharepoint.com": "sharepoint",
         "sharethis.com": "sharethis",
         "shareth.ru": "sharethrough",
         "sharethrough.com": "sharethrough",
diff --git a/client/src/reducers/dhcp.js b/client/src/reducers/dhcp.js
index 877451a5..47768b50 100644
--- a/client/src/reducers/dhcp.js
+++ b/client/src/reducers/dhcp.js
@@ -128,7 +128,8 @@ const dhcp = handleActions(
             const newState = {
                 ...state,
                 isModalOpen: !state.isModalOpen,
-                leaseModalConfig: payload,
+                modalType: payload?.type || '',
+                leaseModalConfig: payload?.config,
             };
             return newState;
         },
diff --git a/client/src/reducers/dnsConfig.js b/client/src/reducers/dnsConfig.js
index d877b6c4..93f64bd7 100644
--- a/client/src/reducers/dnsConfig.js
+++ b/client/src/reducers/dnsConfig.js
@@ -1,7 +1,7 @@
 import { handleActions } from 'redux-actions';
 
 import * as actions from '../actions/dnsConfig';
-import { ALL_INTERFACES_IP, BLOCKING_MODES } from '../helpers/constants';
+import { ALL_INTERFACES_IP, BLOCKING_MODES, DNS_REQUEST_OPTIONS } from '../helpers/constants';
 
 const DEFAULT_BLOCKING_IPV4 = ALL_INTERFACES_IP;
 const DEFAULT_BLOCKING_IPV6 = '::';
@@ -15,6 +15,7 @@ const dnsConfig = handleActions(
                 blocking_ipv4,
                 blocking_ipv6,
                 upstream_dns,
+                upstream_mode,
                 fallback_dns,
                 bootstrap_dns,
                 local_ptr_upstreams,
@@ -33,6 +34,7 @@ const dnsConfig = handleActions(
                 local_ptr_upstreams: (local_ptr_upstreams && local_ptr_upstreams.join('\n')) || '',
                 ratelimit_whitelist: (ratelimit_whitelist && ratelimit_whitelist.join('\n')) || '',
                 processingGetConfig: false,
+                upstream_mode: upstream_mode === '' ? DNS_REQUEST_OPTIONS.LOAD_BALANCING : upstream_mode,
             };
         },
 
diff --git a/go.mod b/go.mod
index a7978511..4f8d48e4 100644
--- a/go.mod
+++ b/go.mod
@@ -3,12 +3,13 @@ module github.com/AdguardTeam/AdGuardHome
 go 1.20
 
 require (
-	github.com/AdguardTeam/dnsproxy v0.60.2-0.20240111154045-f9e73722f6d8
-	github.com/AdguardTeam/golibs v0.18.0
+	github.com/AdguardTeam/dnsproxy v0.64.0
+	github.com/AdguardTeam/golibs v0.19.0
 	github.com/AdguardTeam/urlfilter v0.17.3
 	github.com/NYTimes/gziphandler v1.1.1
 	github.com/ameshkov/dnscrypt/v2 v2.2.7
 	github.com/bluele/gcache v0.0.2
+	github.com/c2h5oh/datasize v0.0.0-20231215233829-aa82cc1e6500
 	github.com/digineo/go-ipset/v2 v2.2.1
 	github.com/dimfeld/httptreemux/v5 v5.5.0
 	github.com/fsnotify/fsnotify v1.7.0
@@ -16,7 +17,7 @@ require (
 	github.com/google/go-cmp v0.6.0
 	github.com/google/gopacket v1.1.19
 	github.com/google/renameio/v2 v2.0.0
-	github.com/google/uuid v1.4.0
+	github.com/google/uuid v1.5.0
 	github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2
 	github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86
 	github.com/kardianos/service v1.2.2
@@ -26,15 +27,15 @@ require (
 	// TODO(a.garipov): This package is deprecated; find a new one or use our
 	// own code for that.  Perhaps, use gopacket.
 	github.com/mdlayher/raw v0.1.0
-	github.com/miekg/dns v1.1.57
+	github.com/miekg/dns v1.1.58
 	github.com/quic-go/quic-go v0.40.0
 	github.com/stretchr/testify v1.8.4
 	github.com/ti-mo/netfilter v0.5.1
 	go.etcd.io/bbolt v1.3.8
-	golang.org/x/crypto v0.16.0
-	golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb
-	golang.org/x/net v0.19.0
-	golang.org/x/sys v0.15.0
+	golang.org/x/crypto v0.18.0
+	golang.org/x/exp v0.0.0-20240119083558-1b970713d09a
+	golang.org/x/net v0.20.0
+	golang.org/x/sys v0.16.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gopkg.in/yaml.v3 v3.0.1
 	howett.net/plist v1.0.1
@@ -47,20 +48,21 @@ require (
 	github.com/beefsack/go-rate v0.0.0-20220214233405-116f4ca011a0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
-	github.com/google/pprof v0.0.0-20231205033806-a5a03c77bf08 // indirect
+	github.com/google/pprof v0.0.0-20240117000934-35fc243c5815 // indirect
 	// TODO(a.garipov): Upgrade to v0.5.0 once we switch to Go 1.21+.
-	github.com/mdlayher/socket v0.4.1 // indirect
-	github.com/onsi/ginkgo/v2 v2.13.2 // indirect
+	github.com/mdlayher/socket v0.5.0 // indirect
+	github.com/onsi/ginkgo/v2 v2.15.0 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
-	github.com/pierrec/lz4/v4 v4.1.19 // indirect
+	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/quic-go/qpack v0.4.0 // indirect
 	github.com/quic-go/qtls-go1-20 v0.4.1 // indirect
-	github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63 // indirect
-	go.uber.org/mock v0.3.0 // indirect
+	github.com/u-root/uio v0.0.0-20240118234441-a3c409a6018e // indirect
+	go.uber.org/mock v0.4.0 // indirect
 	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/sync v0.5.0 // indirect
+	golang.org/x/sync v0.6.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/tools v0.16.0 // indirect
+	golang.org/x/tools v0.17.0 // indirect
+	gonum.org/v1/gonum v0.14.0 // indirect
 )
diff --git a/go.sum b/go.sum
index b68660b7..b7b46d20 100644
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,7 @@
-github.com/AdguardTeam/dnsproxy v0.60.2-0.20240111154045-f9e73722f6d8 h1:KuObu+oJf2UNxrdEB5NLUgaA8psetrXZMpxCA/znHsE=
-github.com/AdguardTeam/dnsproxy v0.60.2-0.20240111154045-f9e73722f6d8/go.mod h1:B7FvvTFQZBfey1cJXQo732EyCLX6xj4JqrciCawATzg=
-github.com/AdguardTeam/golibs v0.18.0 h1:ckS2YK7t2Ub6UkXl0fnreVaM15Zb07Hh1gmFqttjpWg=
-github.com/AdguardTeam/golibs v0.18.0/go.mod h1:DKhCIXHcUYtBhU8ibTLKh1paUL96n5zhQBlx763sj+U=
+github.com/AdguardTeam/dnsproxy v0.64.0 h1:AwUrUwUZHr+d2xTlkW+FK+7HdsYFCoLM6ytt1R1O3xs=
+github.com/AdguardTeam/dnsproxy v0.64.0/go.mod h1:dRRAFOjrq4QYM92jGs4lt4BoY0Dm3EY3HkaleoM2Feo=
+github.com/AdguardTeam/golibs v0.19.0 h1:y/x+Xn3pDg1ZfQ+QEZapPJqaeVYUIMp/EODMtVhn7PM=
+github.com/AdguardTeam/golibs v0.19.0/go.mod h1:3WunclLLfrVAq7fYQRhd6f168FHOEMssnipVXCxDL/w=
 github.com/AdguardTeam/urlfilter v0.17.3 h1:fg/ObbnO0Cv6aw0tW6N/ETDMhhNvmcUUOZ7HlmKC3rw=
 github.com/AdguardTeam/urlfilter v0.17.3/go.mod h1:Jru7jFfeH2CoDf150uDs+rRYcZBzHHBz05r9REyDKyE=
 github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
@@ -18,6 +18,8 @@ github.com/beefsack/go-rate v0.0.0-20220214233405-116f4ca011a0 h1:0b2vaepXIfMsG+
 github.com/beefsack/go-rate v0.0.0-20220214233405-116f4ca011a0/go.mod h1:6YNgTHLutezwnBvyneBbwvB8C82y3dcoOj5EQJIdGXA=
 github.com/bluele/gcache v0.0.2 h1:WcbfdXICg7G/DGBh1PFfcirkWOQV+v077yF1pSy3DGw=
 github.com/bluele/gcache v0.0.2/go.mod h1:m15KV+ECjptwSPxKhOhQoAFQVtUFjTVkc3H8o0t/fp0=
+github.com/c2h5oh/datasize v0.0.0-20231215233829-aa82cc1e6500 h1:6lhrsTEnloDPXyeZBvSYvQf8u86jbKehZPVDDlkgDl4=
+github.com/c2h5oh/datasize v0.0.0-20231215233829-aa82cc1e6500/go.mod h1:S/7n9copUssQ56c7aAgHqftWO4LTf4xY6CGWt8Bc+3M=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -41,13 +43,13 @@ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
-github.com/google/pprof v0.0.0-20231205033806-a5a03c77bf08 h1:PxlBVtIFHR/mtWk2i0gTEdCz+jBnqiuHNSki0epDbVs=
-github.com/google/pprof v0.0.0-20231205033806-a5a03c77bf08/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
+github.com/google/pprof v0.0.0-20240117000934-35fc243c5815 h1:WzfWbQz/Ze8v6l++GGbGNFZnUShVpP/0xffCPLL+ax8=
+github.com/google/pprof v0.0.0-20240117000934-35fc243c5815/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
 github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
 github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4=
-github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.5.0 h1:1p67kYwdtXjb0gL0BPiP1Av9wiZPo5A8z2cWkTZ+eyU=
+github.com/google/uuid v1.5.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714 h1:/jC7qQFrv8CrSJVmaolDVOxTfS9kc36uB6H40kdbQq8=
 github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2 h1:9K06NfxkBh25x56yVhWWlKFE8YpicaSfHwoV8SFbueA=
 github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2/go.mod h1:3A9PQ1cunSDF/1rbTq99Ts4pVnycWg+vlPkfeD2NLFI=
@@ -71,19 +73,19 @@ github.com/mdlayher/packet v1.1.2/go.mod h1:GEu1+n9sG5VtiRE4SydOmX5GTwyyYlteZiFU
 github.com/mdlayher/raw v0.1.0 h1:K4PFMVy+AFsp0Zdlrts7yNhxc/uXoPVHi9RzRvtZF2Y=
 github.com/mdlayher/raw v0.1.0/go.mod h1:yXnxvs6c0XoF/aK52/H5PjsVHmWBCFfZUfoh/Y5s9Sg=
 github.com/mdlayher/socket v0.2.1/go.mod h1:QLlNPkFR88mRUNQIzRBMfXxwKal8H7u1h3bL1CV+f0E=
-github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
-github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
-github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
-github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
+github.com/mdlayher/socket v0.5.0 h1:ilICZmJcQz70vrWVes1MFera4jGiWNocSkykwwoy3XI=
+github.com/mdlayher/socket v0.5.0/go.mod h1:WkcBFfvyG8QENs5+hfQPl1X6Jpd2yeLIYgrGFmJiJxI=
+github.com/miekg/dns v1.1.58 h1:ca2Hdkz+cDg/7eNF6V56jjzuZ4aCAE+DbVkILdQWG/4=
+github.com/miekg/dns v1.1.58/go.mod h1:Ypv+3b/KadlvW9vJfXOTf300O4UqaHFzFCuHz+rPkBY=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
-github.com/onsi/ginkgo/v2 v2.13.2 h1:Bi2gGVkfn6gQcjNjZJVO8Gf0FHzMPf2phUei9tejVMs=
-github.com/onsi/ginkgo/v2 v2.13.2/go.mod h1:XStQ8QcGwLyF4HdfcZB8SFOS/MWCgDuXMSBe6zrvLgM=
-github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
+github.com/onsi/ginkgo/v2 v2.15.0 h1:79HwNRBAZHOEwrczrgSOPy+eFTTlIGELKy5as+ClttY=
+github.com/onsi/ginkgo/v2 v2.15.0/go.mod h1:HlxMHtYF57y6Dpf+mc5529KKmSq9h2FpCF+/ZkwUxKM=
+github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/pierrec/lz4/v4 v4.1.14/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
-github.com/pierrec/lz4/v4 v4.1.19 h1:tYLzDnjDXh9qIxSTKHwXwOYmm9d887Y7Y1ZkyXYHAN4=
-github.com/pierrec/lz4/v4 v4.1.19/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
+github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -109,19 +111,19 @@ github.com/ti-mo/netfilter v0.5.1 h1:cqamEd1c1zmpfpqvInLOro0Znq/RAfw2QL5wL2rAR/8
 github.com/ti-mo/netfilter v0.5.1/go.mod h1:h9UPQ3ZrTZGBitay+LETMxZvNgWGK/efTUcqES2YiLw=
 github.com/tklauser/go-sysconf v0.3.11 h1:89WgdJhk5SNwJfu+GKyYveZ4IaJ7xAkecBo+KdJV0CM=
 github.com/tklauser/numcpus v0.6.0 h1:kebhY2Qt+3U6RNK7UqpYNA+tJ23IBEGKkB7JQBfDYms=
-github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63 h1:YcojQL98T/OO+rybuzn2+5KrD5dBwXIvYBvQ2cD3Avg=
-github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63/go.mod h1:eLL9Nub3yfAho7qB0MzZizFhTU2QkLeoVsWdHtDW264=
+github.com/u-root/uio v0.0.0-20240118234441-a3c409a6018e h1:BA9O3BmlTmpjbvajAwzWx4Wo2TRVdpPXZEeemGQcajw=
+github.com/u-root/uio v0.0.0-20240118234441-a3c409a6018e/go.mod h1:eLL9Nub3yfAho7qB0MzZizFhTU2QkLeoVsWdHtDW264=
 github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=
 go.etcd.io/bbolt v1.3.8 h1:xs88BrvEv273UsB79e0hcVrlUWmS0a8upikMFhSyAtA=
 go.etcd.io/bbolt v1.3.8/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
-go.uber.org/mock v0.3.0 h1:3mUxI1No2/60yUYax92Pt8eNOEecx2D3lcXZh2NEZJo=
-go.uber.org/mock v0.3.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
+go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
+go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
-golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb h1:c0vyKkb6yr3KR7jEfJaOSv4lG7xPkbN6r52aJz1d8a8=
-golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
+golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
+golang.org/x/exp v0.0.0-20240119083558-1b970713d09a h1:Q8/wZp0KX97QFTc2ywcOE0YRjZPVIx+MXInMzdvQqcA=
+golang.org/x/exp v0.0.0-20240119083558-1b970713d09a/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
@@ -132,12 +134,12 @@ golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
+golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190322080309-f49334f85ddc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -149,8 +151,8 @@ golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220622161953-175b2fd9d664/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.4.1-0.20230131160137-e7d7f63158de/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -158,10 +160,12 @@ golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.16.0 h1:GO788SKMRunPIBCXiQyo2AaexLstOrVhuAL5YwsckQM=
-golang.org/x/tools v0.16.0/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
+golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
+golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.14.0 h1:2NiG67LD1tEH0D7kM+ps2V+fXmsAnpUeec7n8tcr4S0=
+gonum.org/v1/gonum v0.14.0/go.mod h1:AoWeoz0becf9QMWtE8iWXNXc27fK4fNeHNf/oMejGfU=
 google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
diff --git a/internal/aghalg/ringbuffer.go b/internal/aghalg/ringbuffer.go
index b97bcc67..3faa8cb5 100644
--- a/internal/aghalg/ringbuffer.go
+++ b/internal/aghalg/ringbuffer.go
@@ -1,23 +1,15 @@
 package aghalg
 
-import (
-	"github.com/AdguardTeam/golibs/errors"
-)
-
 // RingBuffer is the implementation of ring buffer data structure.
 type RingBuffer[T any] struct {
 	buf  []T
-	cur  int
+	cur  uint
 	full bool
 }
 
 // NewRingBuffer initializes the new instance of ring buffer.  size must be
 // greater or equal to zero.
-func NewRingBuffer[T any](size int) (rb *RingBuffer[T]) {
-	if size < 0 {
-		panic(errors.Error("ring buffer: size must be greater or equal to zero"))
-	}
-
+func NewRingBuffer[T any](size uint) (rb *RingBuffer[T]) {
 	return &RingBuffer[T]{
 		buf: make([]T, size),
 	}
@@ -30,7 +22,7 @@ func (rb *RingBuffer[T]) Append(e T) {
 	}
 
 	rb.buf[rb.cur] = e
-	rb.cur = (rb.cur + 1) % cap(rb.buf)
+	rb.cur = (rb.cur + 1) % uint(cap(rb.buf))
 	if rb.cur == 0 {
 		rb.full = true
 	}
@@ -87,12 +79,12 @@ func (rb *RingBuffer[T]) splitCur() (before, after []T) {
 }
 
 // Len returns a length of the buffer.
-func (rb *RingBuffer[T]) Len() (l int) {
+func (rb *RingBuffer[T]) Len() (l uint) {
 	if !rb.full {
 		return rb.cur
 	}
 
-	return cap(rb.buf)
+	return uint(cap(rb.buf))
 }
 
 // Clear clears the buffer.
diff --git a/internal/aghalg/ringbuffer_test.go b/internal/aghalg/ringbuffer_test.go
index 43fbb46b..0209d27f 100644
--- a/internal/aghalg/ringbuffer_test.go
+++ b/internal/aghalg/ringbuffer_test.go
@@ -9,13 +9,13 @@ import (
 )
 
 // elements is a helper function that returns n elements of the buffer.
-func elements(b *aghalg.RingBuffer[int], n int, reverse bool) (es []int) {
+func elements(b *aghalg.RingBuffer[int], n uint, reverse bool) (es []int) {
 	fn := b.Range
 	if reverse {
 		fn = b.ReverseRange
 	}
 
-	i := 0
+	var i uint
 	fn(func(e int) (cont bool) {
 		if i >= n {
 			return false
@@ -42,19 +42,14 @@ func TestNewRingBuffer(t *testing.T) {
 		assert.Zero(t, b.Len())
 	})
 
-	t.Run("negative_size", func(t *testing.T) {
-		assert.PanicsWithError(t, "ring buffer: size must be greater or equal to zero", func() {
-			aghalg.NewRingBuffer[int](-5)
-		})
-	})
-
 	t.Run("zero", func(t *testing.T) {
 		b := aghalg.NewRingBuffer[int](0)
 		for i := 0; i < 10; i++ {
 			b.Append(i)
-			assert.Equal(t, 0, b.Len())
-			assert.Empty(t, elements(b, b.Len(), false))
-			assert.Empty(t, elements(b, b.Len(), true))
+			bufLen := b.Len()
+			assert.EqualValues(t, 0, bufLen)
+			assert.Empty(t, elements(b, bufLen, false))
+			assert.Empty(t, elements(b, bufLen, true))
 		}
 	})
 
@@ -62,9 +57,10 @@ func TestNewRingBuffer(t *testing.T) {
 		b := aghalg.NewRingBuffer[int](1)
 		for i := 0; i < 10; i++ {
 			b.Append(i)
-			assert.Equal(t, 1, b.Len())
-			assert.Equal(t, []int{i}, elements(b, b.Len(), false))
-			assert.Equal(t, []int{i}, elements(b, b.Len(), true))
+			bufLen := b.Len()
+			assert.EqualValues(t, 1, bufLen)
+			assert.Equal(t, []int{i}, elements(b, bufLen, false))
+			assert.Equal(t, []int{i}, elements(b, bufLen, true))
 		}
 	})
 }
@@ -78,7 +74,7 @@ func TestRingBuffer_Range(t *testing.T) {
 		name   string
 		want   []int
 		count  int
-		length int
+		length uint
 	}{{
 		name:   "three",
 		count:  3,
@@ -163,11 +159,11 @@ func TestRingBuffer_Range_increment(t *testing.T) {
 	for i, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			b.Append(i)
-
-			assert.Equal(t, tc.want, elements(b, b.Len(), false))
+			bufLen := b.Len()
+			assert.Equal(t, tc.want, elements(b, bufLen, false))
 
 			slices.Reverse(tc.want)
-			assert.Equal(t, tc.want, elements(b, b.Len(), true))
+			assert.Equal(t, tc.want, elements(b, bufLen, true))
 		})
 	}
 }
diff --git a/internal/client/addrproc.go b/internal/client/addrproc.go
index 2b8046f6..76ff1367 100644
--- a/internal/client/addrproc.go
+++ b/internal/client/addrproc.go
@@ -262,8 +262,7 @@ func (p *DefaultAddrProc) processRDNS(ip netip.Addr) (host string) {
 // shouldResolve returns false if ip is a loopback address, or ip is private and
 // resolving of private addresses is disabled.
 func (p *DefaultAddrProc) shouldResolve(ip netip.Addr) (ok bool) {
-	return !ip.IsLoopback() &&
-		(p.usePrivateRDNS || !p.privateSubnets.Contains(ip.AsSlice()))
+	return !ip.IsLoopback() && (p.usePrivateRDNS || !p.privateSubnets.Contains(ip))
 }
 
 // processWHOIS looks up the information about clients' IP addresses in the
diff --git a/internal/configmigrate/configmigrate.go b/internal/configmigrate/configmigrate.go
new file mode 100644
index 00000000..6e8845e0
--- /dev/null
+++ b/internal/configmigrate/configmigrate.go
@@ -0,0 +1,5 @@
+// Package configmigrate provides a way to upgrade the YAML configuration file.
+package configmigrate
+
+// LastSchemaVersion is the most recent schema version.
+const LastSchemaVersion uint = 28
diff --git a/internal/confmigrate/migrations_internal_test.go b/internal/configmigrate/migrations_internal_test.go
similarity index 95%
rename from internal/confmigrate/migrations_internal_test.go
rename to internal/configmigrate/migrations_internal_test.go
index 513646e8..5349102f 100644
--- a/internal/confmigrate/migrations_internal_test.go
+++ b/internal/configmigrate/migrations_internal_test.go
@@ -1,9 +1,10 @@
-package confmigrate
+package configmigrate
 
 import (
 	"testing"
 	"time"
 
+	"github.com/AdguardTeam/AdGuardHome/internal/dnsforward"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
 	"github.com/AdguardTeam/golibs/testutil"
 	"github.com/AdguardTeam/golibs/timeutil"
@@ -1646,3 +1647,84 @@ func TestUpgradeSchema26to27(t *testing.T) {
 		})
 	}
 }
+
+func TestUpgradeSchema27to28(t *testing.T) {
+	const newSchemaVer = 28
+
+	testCases := []struct {
+		in   yobj
+		want yobj
+		name string
+	}{{
+		name: "empty",
+		in:   yobj{},
+		want: yobj{
+			"schema_version": newSchemaVer,
+		},
+	}, {
+		name: "load_balance",
+		in: yobj{
+			"dns": yobj{
+				"all_servers":  false,
+				"fastest_addr": false,
+			},
+		},
+		want: yobj{
+			"dns": yobj{
+				"upstream_mode": dnsforward.UpstreamModeLoadBalance,
+			},
+			"schema_version": newSchemaVer,
+		},
+	}, {
+		name: "parallel",
+		in: yobj{
+			"dns": yobj{
+				"all_servers":  true,
+				"fastest_addr": false,
+			},
+		},
+		want: yobj{
+			"dns": yobj{
+				"upstream_mode": dnsforward.UpstreamModeParallel,
+			},
+			"schema_version": newSchemaVer,
+		},
+	}, {
+		name: "parallel_fastest",
+		in: yobj{
+			"dns": yobj{
+				"all_servers":  true,
+				"fastest_addr": true,
+			},
+		},
+		want: yobj{
+			"dns": yobj{
+				"upstream_mode": dnsforward.UpstreamModeParallel,
+			},
+			"schema_version": newSchemaVer,
+		},
+	}, {
+		name: "load_balance",
+		in: yobj{
+			"dns": yobj{
+				"all_servers":  false,
+				"fastest_addr": true,
+			},
+		},
+		want: yobj{
+			"dns": yobj{
+				"upstream_mode": dnsforward.UpstreamModeFastestAddr,
+			},
+			"schema_version": newSchemaVer,
+		},
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := migrateTo28(tc.in)
+			require.NoError(t, err)
+
+			assert.Equal(t, tc.want, tc.in)
+		})
+	}
+}
diff --git a/internal/confmigrate/migrator.go b/internal/configmigrate/migrator.go
similarity index 95%
rename from internal/confmigrate/migrator.go
rename to internal/configmigrate/migrator.go
index 636db690..ebdf6ba7 100644
--- a/internal/confmigrate/migrator.go
+++ b/internal/configmigrate/migrator.go
@@ -1,5 +1,4 @@
-// Package confmigrate provides a way to upgrade the YAML configuration file.
-package confmigrate
+package configmigrate
 
 import (
 	"bytes"
@@ -9,9 +8,6 @@ import (
 	yaml "gopkg.in/yaml.v3"
 )
 
-// LastSchemaVersion is the most recent schema version.
-const LastSchemaVersion uint = 27
-
 // Config is a the configuration for initializing a [Migrator].
 type Config struct {
 	// WorkingDir is an absolute path to the working directory of AdGuardHome.
@@ -123,6 +119,7 @@ func (m *Migrator) upgradeConfigSchema(current, target uint, diskConf yobj) (err
 		24: migrateTo25,
 		25: migrateTo26,
 		26: migrateTo27,
+		27: migrateTo28,
 	}
 
 	for i, migrate := range upgrades[current:target] {
diff --git a/internal/confmigrate/migrator_test.go b/internal/configmigrate/migrator_test.go
similarity index 97%
rename from internal/confmigrate/migrator_test.go
rename to internal/configmigrate/migrator_test.go
index de3aa401..442713a4 100644
--- a/internal/confmigrate/migrator_test.go
+++ b/internal/configmigrate/migrator_test.go
@@ -1,4 +1,4 @@
-package confmigrate_test
+package configmigrate_test
 
 import (
 	"io/fs"
@@ -6,7 +6,7 @@ import (
 	"path"
 	"testing"
 
-	"github.com/AdguardTeam/AdGuardHome/internal/confmigrate"
+	"github.com/AdguardTeam/AdGuardHome/internal/configmigrate"
 	"github.com/AdguardTeam/golibs/testutil"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/bcrypt"
@@ -200,7 +200,7 @@ func TestMigrateConfig_Migrate(t *testing.T) {
 			wantBody, err := fs.ReadFile(testdata, path.Join(t.Name(), outputFileName))
 			require.NoError(t, err)
 
-			migrator := confmigrate.New(&confmigrate.Config{
+			migrator := configmigrate.New(&configmigrate.Config{
 				WorkingDir: t.Name(),
 			})
 			newBody, upgraded, err := migrator.Migrate(body, tc.targetVersion)
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v1/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v1/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v1/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v1/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v1/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v1/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v1/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v1/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v10/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v10/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v10/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v10/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v10/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v10/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v10/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v10/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v11/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v11/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v11/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v11/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v11/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v11/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v11/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v11/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v12/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v12/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v12/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v12/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v12/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v12/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v12/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v12/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v13/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v13/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v13/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v13/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v13/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v13/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v13/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v13/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v14/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v14/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v14/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v14/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v14/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v14/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v14/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v14/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v15/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v15/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v15/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v15/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v15/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v15/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v15/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v15/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v16/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v16/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v16/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v16/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v16/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v16/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v16/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v16/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v17/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v17/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v17/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v17/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v17/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v17/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v17/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v17/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v18/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v18/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v18/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v18/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v18/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v18/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v18/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v18/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v19/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v19/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v19/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v19/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v19/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v19/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v19/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v19/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v2/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v2/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v2/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v2/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v2/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v2/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v2/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v2/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v20/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v20/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v20/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v20/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v20/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v20/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v20/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v20/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v21/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v21/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v21/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v21/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v21/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v21/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v21/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v21/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v22/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v22/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v22/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v22/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v22/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v22/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v22/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v22/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v23/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v23/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v23/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v23/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v23/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v23/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v23/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v23/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v24/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v24/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v24/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v24/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v24/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v24/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v24/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v24/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v25/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v25/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v25/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v25/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v25/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v25/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v25/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v25/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v26/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v26/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v26/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v26/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v26/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v26/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v26/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v26/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v27/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v27/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v27/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v27/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v27/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v27/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v27/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v27/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v3/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v3/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v3/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v3/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v3/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v3/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v3/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v3/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v4/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v4/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v4/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v4/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v4/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v4/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v4/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v4/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v5/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v5/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v5/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v5/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v5/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v5/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v5/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v5/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v6/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v6/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v6/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v6/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v6/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v6/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v6/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v6/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v7/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v7/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v7/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v7/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v7/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v7/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v7/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v7/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v8/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v8/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v8/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v8/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v8/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v8/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v8/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v8/output.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v9/input.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v9/input.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v9/input.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v9/input.yml
diff --git a/internal/confmigrate/testdata/TestMigrateConfig_Migrate/v9/output.yml b/internal/configmigrate/testdata/TestMigrateConfig_Migrate/v9/output.yml
similarity index 100%
rename from internal/confmigrate/testdata/TestMigrateConfig_Migrate/v9/output.yml
rename to internal/configmigrate/testdata/TestMigrateConfig_Migrate/v9/output.yml
diff --git a/internal/confmigrate/v1.go b/internal/configmigrate/v1.go
similarity index 97%
rename from internal/confmigrate/v1.go
rename to internal/configmigrate/v1.go
index 780c0273..550ac9c8 100644
--- a/internal/confmigrate/v1.go
+++ b/internal/configmigrate/v1.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 import (
 	"os"
diff --git a/internal/confmigrate/v10.go b/internal/configmigrate/v10.go
similarity index 99%
rename from internal/confmigrate/v10.go
rename to internal/configmigrate/v10.go
index 0cf10c2f..f987b6b5 100644
--- a/internal/confmigrate/v10.go
+++ b/internal/configmigrate/v10.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 import (
 	"fmt"
diff --git a/internal/confmigrate/v11.go b/internal/configmigrate/v11.go
similarity index 96%
rename from internal/confmigrate/v11.go
rename to internal/configmigrate/v11.go
index d93fbcd8..c2ba1516 100644
--- a/internal/confmigrate/v11.go
+++ b/internal/configmigrate/v11.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo11 performs the following changes:
 //
diff --git a/internal/confmigrate/v12.go b/internal/configmigrate/v12.go
similarity index 97%
rename from internal/confmigrate/v12.go
rename to internal/configmigrate/v12.go
index 6703561a..40afca80 100644
--- a/internal/confmigrate/v12.go
+++ b/internal/configmigrate/v12.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 import (
 	"time"
diff --git a/internal/confmigrate/v13.go b/internal/configmigrate/v13.go
similarity index 96%
rename from internal/confmigrate/v13.go
rename to internal/configmigrate/v13.go
index a69592bf..3a4034d1 100644
--- a/internal/confmigrate/v13.go
+++ b/internal/configmigrate/v13.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo13 performs the following changes:
 //
diff --git a/internal/confmigrate/v14.go b/internal/configmigrate/v14.go
similarity index 98%
rename from internal/confmigrate/v14.go
rename to internal/configmigrate/v14.go
index d259a2a6..49e54ca3 100644
--- a/internal/confmigrate/v14.go
+++ b/internal/configmigrate/v14.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo14 performs the following changes:
 //
diff --git a/internal/confmigrate/v15.go b/internal/configmigrate/v15.go
similarity index 98%
rename from internal/confmigrate/v15.go
rename to internal/configmigrate/v15.go
index 904ef110..85f6d14b 100644
--- a/internal/confmigrate/v15.go
+++ b/internal/configmigrate/v15.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo15 performs the following changes:
 //
diff --git a/internal/confmigrate/v16.go b/internal/configmigrate/v16.go
similarity index 98%
rename from internal/confmigrate/v16.go
rename to internal/configmigrate/v16.go
index b174d4cb..d9ed1ca2 100644
--- a/internal/confmigrate/v16.go
+++ b/internal/configmigrate/v16.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo16 performs the following changes:
 //
diff --git a/internal/confmigrate/v17.go b/internal/configmigrate/v17.go
similarity index 96%
rename from internal/confmigrate/v17.go
rename to internal/configmigrate/v17.go
index a3a04460..5672d14c 100644
--- a/internal/confmigrate/v17.go
+++ b/internal/configmigrate/v17.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo17 performs the following changes:
 //
diff --git a/internal/confmigrate/v18.go b/internal/configmigrate/v18.go
similarity index 97%
rename from internal/confmigrate/v18.go
rename to internal/configmigrate/v18.go
index 28c55723..7fc5c639 100644
--- a/internal/confmigrate/v18.go
+++ b/internal/configmigrate/v18.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo18 performs the following changes:
 //
diff --git a/internal/confmigrate/v19.go b/internal/configmigrate/v19.go
similarity index 98%
rename from internal/confmigrate/v19.go
rename to internal/configmigrate/v19.go
index 6fbb6d4f..229be5dc 100644
--- a/internal/confmigrate/v19.go
+++ b/internal/configmigrate/v19.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 import "github.com/AdguardTeam/golibs/log"
 
diff --git a/internal/confmigrate/v2.go b/internal/configmigrate/v2.go
similarity index 97%
rename from internal/confmigrate/v2.go
rename to internal/configmigrate/v2.go
index 1faff87f..d4652d10 100644
--- a/internal/confmigrate/v2.go
+++ b/internal/configmigrate/v2.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 import (
 	"os"
diff --git a/internal/confmigrate/v20.go b/internal/configmigrate/v20.go
similarity index 96%
rename from internal/confmigrate/v20.go
rename to internal/configmigrate/v20.go
index e86c36c7..d207ac0b 100644
--- a/internal/confmigrate/v20.go
+++ b/internal/configmigrate/v20.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 import (
 	"time"
diff --git a/internal/confmigrate/v21.go b/internal/configmigrate/v21.go
similarity index 97%
rename from internal/confmigrate/v21.go
rename to internal/configmigrate/v21.go
index afda11bf..362f2ff1 100644
--- a/internal/confmigrate/v21.go
+++ b/internal/configmigrate/v21.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo21 performs the following changes:
 //
diff --git a/internal/confmigrate/v22.go b/internal/configmigrate/v22.go
similarity index 98%
rename from internal/confmigrate/v22.go
rename to internal/configmigrate/v22.go
index 4d5de732..6a0b24c0 100644
--- a/internal/confmigrate/v22.go
+++ b/internal/configmigrate/v22.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 import (
 	"fmt"
diff --git a/internal/confmigrate/v23.go b/internal/configmigrate/v23.go
similarity index 98%
rename from internal/confmigrate/v23.go
rename to internal/configmigrate/v23.go
index 6cbcbcf5..5cda964d 100644
--- a/internal/confmigrate/v23.go
+++ b/internal/configmigrate/v23.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 import (
 	"fmt"
diff --git a/internal/confmigrate/v24.go b/internal/configmigrate/v24.go
similarity index 98%
rename from internal/confmigrate/v24.go
rename to internal/configmigrate/v24.go
index e8df5718..f9d781e5 100644
--- a/internal/confmigrate/v24.go
+++ b/internal/configmigrate/v24.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo24 performs the following changes:
 //
diff --git a/internal/confmigrate/v25.go b/internal/configmigrate/v25.go
similarity index 96%
rename from internal/confmigrate/v25.go
rename to internal/configmigrate/v25.go
index e574610e..a07dec70 100644
--- a/internal/confmigrate/v25.go
+++ b/internal/configmigrate/v25.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo25 performs the following changes:
 //
diff --git a/internal/confmigrate/v26.go b/internal/configmigrate/v26.go
similarity index 99%
rename from internal/confmigrate/v26.go
rename to internal/configmigrate/v26.go
index 5ead91df..a19b9038 100644
--- a/internal/confmigrate/v26.go
+++ b/internal/configmigrate/v26.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo26 performs the following changes:
 //
diff --git a/internal/confmigrate/v27.go b/internal/configmigrate/v27.go
similarity index 98%
rename from internal/confmigrate/v27.go
rename to internal/configmigrate/v27.go
index ddba8671..0beba4db 100644
--- a/internal/confmigrate/v27.go
+++ b/internal/configmigrate/v27.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo27 performs the following changes:
 //
diff --git a/internal/configmigrate/v28.go b/internal/configmigrate/v28.go
new file mode 100644
index 00000000..c32f9f3f
--- /dev/null
+++ b/internal/configmigrate/v28.go
@@ -0,0 +1,47 @@
+package configmigrate
+
+import (
+	"github.com/AdguardTeam/AdGuardHome/internal/dnsforward"
+)
+
+// migrateTo28 performs the following changes:
+//
+//	# BEFORE:
+//	'dns':
+//	  'all_servers': true
+//	  'fastest_addr': true
+//	  # …
+//	# …
+//
+//	# AFTER:
+//	'dns':
+//	  'upstream_mode': 'parallel'
+//	  # …
+//	# …
+func migrateTo28(diskConf yobj) (err error) {
+	diskConf["schema_version"] = 28
+
+	dns, ok, err := fieldVal[yobj](diskConf, "dns")
+	if !ok {
+		return err
+	}
+
+	allServers, _, _ := fieldVal[bool](dns, "all_servers")
+	fastestAddr, _, _ := fieldVal[bool](dns, "fastest_addr")
+
+	var upstreamModeType dnsforward.UpstreamMode
+	if allServers {
+		upstreamModeType = dnsforward.UpstreamModeParallel
+	} else if fastestAddr {
+		upstreamModeType = dnsforward.UpstreamModeFastestAddr
+	} else {
+		upstreamModeType = dnsforward.UpstreamModeLoadBalance
+	}
+
+	dns["upstream_mode"] = upstreamModeType
+
+	delete(dns, "all_servers")
+	delete(dns, "fastest_addr")
+
+	return nil
+}
diff --git a/internal/confmigrate/v3.go b/internal/configmigrate/v3.go
similarity index 96%
rename from internal/confmigrate/v3.go
rename to internal/configmigrate/v3.go
index 8220c5df..a62dd87d 100644
--- a/internal/confmigrate/v3.go
+++ b/internal/configmigrate/v3.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo3 performs the following changes:
 //
diff --git a/internal/confmigrate/v4.go b/internal/configmigrate/v4.go
similarity index 95%
rename from internal/confmigrate/v4.go
rename to internal/configmigrate/v4.go
index 467cc05c..c4d40fb7 100644
--- a/internal/confmigrate/v4.go
+++ b/internal/configmigrate/v4.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo4 performs the following changes:
 //
diff --git a/internal/confmigrate/v5.go b/internal/configmigrate/v5.go
similarity index 97%
rename from internal/confmigrate/v5.go
rename to internal/configmigrate/v5.go
index 7bdd4d00..e167a8e0 100644
--- a/internal/confmigrate/v5.go
+++ b/internal/configmigrate/v5.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 import (
 	"fmt"
diff --git a/internal/confmigrate/v6.go b/internal/configmigrate/v6.go
similarity index 97%
rename from internal/confmigrate/v6.go
rename to internal/configmigrate/v6.go
index aa741ba9..733785a0 100644
--- a/internal/confmigrate/v6.go
+++ b/internal/configmigrate/v6.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 import "fmt"
 
diff --git a/internal/confmigrate/v7.go b/internal/configmigrate/v7.go
similarity index 98%
rename from internal/confmigrate/v7.go
rename to internal/configmigrate/v7.go
index 1db348bd..61ee1e26 100644
--- a/internal/confmigrate/v7.go
+++ b/internal/configmigrate/v7.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo7 performs the following changes:
 //
diff --git a/internal/confmigrate/v8.go b/internal/configmigrate/v8.go
similarity index 96%
rename from internal/confmigrate/v8.go
rename to internal/configmigrate/v8.go
index f8075dfb..e6283f64 100644
--- a/internal/confmigrate/v8.go
+++ b/internal/configmigrate/v8.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo8 performs the following changes:
 //
diff --git a/internal/confmigrate/v9.go b/internal/configmigrate/v9.go
similarity index 95%
rename from internal/confmigrate/v9.go
rename to internal/configmigrate/v9.go
index b8fc9a72..b0583f70 100644
--- a/internal/confmigrate/v9.go
+++ b/internal/configmigrate/v9.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 // migrateTo9 performs the following changes:
 //
diff --git a/internal/confmigrate/yaml.go b/internal/configmigrate/yaml.go
similarity index 98%
rename from internal/confmigrate/yaml.go
rename to internal/configmigrate/yaml.go
index 778cd1fd..c2e2ff08 100644
--- a/internal/confmigrate/yaml.go
+++ b/internal/configmigrate/yaml.go
@@ -1,4 +1,4 @@
-package confmigrate
+package configmigrate
 
 import (
 	"fmt"
diff --git a/internal/dnsforward/config.go b/internal/dnsforward/config.go
index ec20096b..2a11773d 100644
--- a/internal/dnsforward/config.go
+++ b/internal/dnsforward/config.go
@@ -89,12 +89,8 @@ type Config struct {
 	// servers are not responding.
 	FallbackDNS []string `yaml:"fallback_dns"`
 
-	// AllServers, if true, parallel queries to all configured upstream servers
-	// are enabled.
-	AllServers bool `yaml:"all_servers"`
-
-	// FastestAddr, if true, use Fastest Address algorithm.
-	FastestAddr bool `yaml:"fastest_addr"`
+	// UpstreamMode determines the logic through which upstreams will be used.
+	UpstreamMode UpstreamMode `yaml:"upstream_mode"`
 
 	// FastestTimeout replaces the default timeout for dialing IP addresses
 	// when FastestAddr is true.
@@ -114,11 +110,10 @@ type Config struct {
 	// BlockedHosts is the list of hosts that should be blocked.
 	BlockedHosts []string `yaml:"blocked_hosts"`
 
-	// TrustedProxies is the list of IP addresses and CIDR networks to detect
-	// proxy servers addresses the DoH requests from which should be handled.
-	// The value of nil or an empty slice for this field makes Proxy not trust
-	// any address.
-	TrustedProxies []string `yaml:"trusted_proxies"`
+	// TrustedProxies is the list of CIDR networks with proxy servers addresses
+	// from which the DoH requests should be handled.  The value of nil or an
+	// empty slice for this field makes Proxy not trust any address.
+	TrustedProxies []netutil.Prefix `yaml:"trusted_proxies"`
 
 	// DNS cache settings
 
@@ -154,7 +149,7 @@ type Config struct {
 
 	// MaxGoroutines is the max number of parallel goroutines for processing
 	// incoming requests.
-	MaxGoroutines uint32 `yaml:"max_goroutines"`
+	MaxGoroutines uint `yaml:"max_goroutines"`
 
 	// HandleDDR, if true, handle DDR requests
 	HandleDDR bool `yaml:"handle_ddr"`
@@ -294,9 +289,21 @@ type ServerConfig struct {
 	ServePlainDNS bool
 }
 
+// UpstreamMode is a enumeration of upstream mode representations.  See
+// [proxy.UpstreamModeType].
+type UpstreamMode string
+
+const (
+	UpstreamModeLoadBalance UpstreamMode = "load_balance"
+	UpstreamModeParallel    UpstreamMode = "parallel"
+	UpstreamModeFastestAddr UpstreamMode = "fastest_addr"
+)
+
 // newProxyConfig creates and validates configuration for the main proxy.
 func (s *Server) newProxyConfig() (conf *proxy.Config, err error) {
 	srvConf := s.conf
+	trustedPrefixes := netutil.UnembedPrefixes(srvConf.TrustedProxies)
+
 	conf = &proxy.Config{
 		HTTP3:                  srvConf.ServeHTTP3,
 		Ratelimit:              int(srvConf.Ratelimit),
@@ -304,7 +311,7 @@ func (s *Server) newProxyConfig() (conf *proxy.Config, err error) {
 		RatelimitSubnetLenIPv6: srvConf.RatelimitSubnetLenIPv6,
 		RatelimitWhitelist:     srvConf.RatelimitWhitelist,
 		RefuseAny:              srvConf.RefuseAny,
-		TrustedProxies:         srvConf.TrustedProxies,
+		TrustedProxies:         netutil.SliceSubnetSet(trustedPrefixes),
 		CacheMinTTL:            srvConf.CacheMinTTL,
 		CacheMaxTTL:            srvConf.CacheMaxTTL,
 		CacheOptimistic:        srvConf.CacheOptimistic,
@@ -313,7 +320,7 @@ func (s *Server) newProxyConfig() (conf *proxy.Config, err error) {
 		RequestHandler:         s.handleDNSRequest,
 		HTTPSServerName:        aghhttp.UserAgent(),
 		EnableEDNSClientSubnet: srvConf.EDNSClientSubnet.Enabled,
-		MaxGoroutines:          int(srvConf.MaxGoroutines),
+		MaxGoroutines:          srvConf.MaxGoroutines,
 		UseDNS64:               srvConf.UseDNS64,
 		DNS64Prefs:             srvConf.DNS64Prefixes,
 	}
@@ -323,18 +330,11 @@ func (s *Server) newProxyConfig() (conf *proxy.Config, err error) {
 		conf.EDNSAddr = net.IP(srvConf.EDNSClientSubnet.CustomIP.AsSlice())
 	}
 
-	if srvConf.CacheSize != 0 {
-		conf.CacheEnabled = true
-		conf.CacheSizeBytes = int(srvConf.CacheSize)
+	err = setProxyUpstreamMode(conf, srvConf.UpstreamMode, srvConf.FastestTimeout.Duration)
+	if err != nil {
+		return nil, fmt.Errorf("upstream mode: %w", err)
 	}
 
-	setProxyUpstreamMode(
-		conf,
-		srvConf.AllServers,
-		srvConf.FastestAddr,
-		srvConf.FastestTimeout.Duration,
-	)
-
 	conf.BogusNXDomain, err = parseBogusNXDOMAIN(srvConf.BogusNXDomain)
 	if err != nil {
 		return nil, fmt.Errorf("bogus_nxdomain: %w", err)
@@ -361,6 +361,37 @@ func (s *Server) newProxyConfig() (conf *proxy.Config, err error) {
 		return nil, errors.Error("no default upstream servers configured")
 	}
 
+	conf, err = prepareCacheConfig(conf,
+		srvConf.CacheSize,
+		srvConf.CacheMinTTL,
+		srvConf.CacheMaxTTL,
+	)
+	if err != nil {
+		// Don't wrap the error since it's informative enough as is.
+		return nil, err
+	}
+
+	return conf, nil
+}
+
+// prepareCacheConfig prepares the cache configuration and returns an error if
+// there is one.
+func prepareCacheConfig(
+	conf *proxy.Config,
+	size uint32,
+	minTTL uint32,
+	maxTTL uint32,
+) (prepared *proxy.Config, err error) {
+	if size != 0 {
+		conf.CacheEnabled = true
+		conf.CacheSizeBytes = int(size)
+	}
+
+	err = validateCacheTTL(minTTL, maxTTL)
+	if err != nil {
+		return nil, fmt.Errorf("validating cache ttl: %w", err)
+	}
+
 	return conf, nil
 }
 
@@ -739,3 +770,19 @@ func (s *Server) enableProtectionAfterPause() {
 
 	log.Info("dns: protection is restarted after pause")
 }
+
+// validateCacheTTL returns an error if the configuration of the cache TTL
+// invalid.
+//
+// TODO(s.chzhen):  Move to dnsproxy.
+func validateCacheTTL(minTTL, maxTTL uint32) (err error) {
+	if minTTL == 0 && maxTTL == 0 {
+		return nil
+	}
+
+	if maxTTL > 0 && minTTL > maxTTL {
+		return errors.Error("cache_ttl_min must be less than or equal to cache_ttl_max")
+	}
+
+	return nil
+}
diff --git a/internal/dnsforward/dns64_test.go b/internal/dnsforward/dns64_test.go
index 55c08db7..ad89098c 100644
--- a/internal/dnsforward/dns64_test.go
+++ b/internal/dnsforward/dns64_test.go
@@ -290,6 +290,7 @@ func TestServer_HandleDNSRequest_dns64(t *testing.T) {
 			TCPListenAddrs: []*net.TCPAddr{{}},
 			UseDNS64:       true,
 			Config: Config{
+				UpstreamMode:     UpstreamModeLoadBalance,
 				EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 			},
 			ServePlainDNS: true,
diff --git a/internal/dnsforward/dnsforward.go b/internal/dnsforward/dnsforward.go
index cdd2c240..2da21391 100644
--- a/internal/dnsforward/dnsforward.go
+++ b/internal/dnsforward/dnsforward.go
@@ -81,6 +81,7 @@ type DHCP interface {
 	Enabled() (ok bool)
 }
 
+// SystemResolvers is an interface for accessing the OS-provided resolvers.
 type SystemResolvers interface {
 	// Addrs returns the list of system resolvers' addresses.
 	Addrs() (addrs []netip.AddrPort)
@@ -310,7 +311,7 @@ func (s *Server) WriteDiskConfig(c *Config) {
 	c.AllowedClients = stringutil.CloneSlice(sc.AllowedClients)
 	c.DisallowedClients = stringutil.CloneSlice(sc.DisallowedClients)
 	c.BlockedHosts = stringutil.CloneSlice(sc.BlockedHosts)
-	c.TrustedProxies = stringutil.CloneSlice(sc.TrustedProxies)
+	c.TrustedProxies = slices.Clone(sc.TrustedProxies)
 	c.UpstreamDNS = stringutil.CloneSlice(sc.UpstreamDNS)
 }
 
@@ -389,7 +390,7 @@ func (s *Server) Exchange(ip netip.Addr) (host string, ttl time.Duration, err er
 
 	var resolver *proxy.Proxy
 	var errMsg string
-	if s.privateNets.Contains(ip.AsSlice()) {
+	if s.privateNets.Contains(ip) {
 		if !s.conf.UsePrivateRDNS {
 			return "", 0, nil
 		}
@@ -469,13 +470,15 @@ func (s *Server) startLocked() error {
 	return err
 }
 
-// setupLocalResolvers initializes the resolvers for local addresses.  It
-// assumes s.serverLock is locked or the Server not running.
-func (s *Server) setupLocalResolvers(boot upstream.Resolver) (err error) {
+// prepareLocalResolvers initializes the local upstreams configuration using
+// boot as bootstrap.  It assumes that s.serverLock is locked or s not running.
+func (s *Server) prepareLocalResolvers(
+	boot upstream.Resolver,
+) (uc *proxy.UpstreamConfig, err error) {
 	set, err := s.conf.ourAddrsSet()
 	if err != nil {
 		// Don't wrap the error because it's informative enough as is.
-		return err
+		return nil, err
 	}
 
 	resolvers := s.conf.LocalPTRResolvers
@@ -492,29 +495,46 @@ func (s *Server) setupLocalResolvers(boot upstream.Resolver) (err error) {
 
 	log.Debug("dnsforward: upstreams to resolve ptr for local addresses: %v", resolvers)
 
-	uc, err := s.prepareUpstreamConfig(resolvers, nil, &upstream.Options{
+	uc, err = s.prepareUpstreamConfig(resolvers, nil, &upstream.Options{
 		Bootstrap: boot,
 		Timeout:   defaultLocalTimeout,
 		// TODO(e.burkov): Should we verify server's certificates?
 		PreferIPv6: s.conf.BootstrapPreferIPv6,
 	})
 	if err != nil {
-		return fmt.Errorf("preparing private upstreams: %w", err)
+		return nil, fmt.Errorf("preparing private upstreams: %w", err)
 	}
 
 	if confNeedsFiltering {
 		err = filterOutAddrs(uc, set)
 		if err != nil {
-			return fmt.Errorf("filtering private upstreams: %w", err)
+			return nil, fmt.Errorf("filtering private upstreams: %w", err)
 		}
 	}
 
+	return uc, nil
+}
+
+// setupLocalResolvers initializes and sets the resolvers for local addresses.
+// It assumes s.serverLock is locked or s not running.
+func (s *Server) setupLocalResolvers(boot upstream.Resolver) (err error) {
+	uc, err := s.prepareLocalResolvers(boot)
+	if err != nil {
+		// Don't wrap the error because it's informative enough as is.
+		return err
+	}
+
 	s.localResolvers = &proxy.Proxy{
 		Config: proxy.Config{
 			UpstreamConfig: uc,
 		},
 	}
 
+	err = s.localResolvers.Init()
+	if err != nil {
+		return fmt.Errorf("initializing proxy: %w", err)
+	}
+
 	// TODO(e.burkov):  Should we also consider the DNS64 usage?
 	if s.conf.UsePrivateRDNS &&
 		// Only set the upstream config if there are any upstreams.  It's safe
@@ -700,15 +720,13 @@ func (s *Server) prepareInternalProxy() (err error) {
 		CacheEnabled:   true,
 		CacheSizeBytes: 4096,
 		UpstreamConfig: srvConf.UpstreamConfig,
-		MaxGoroutines:  int(s.conf.MaxGoroutines),
+		MaxGoroutines:  s.conf.MaxGoroutines,
 	}
 
-	setProxyUpstreamMode(
-		conf,
-		srvConf.AllServers,
-		srvConf.FastestAddr,
-		srvConf.FastestTimeout.Duration,
-	)
+	err = setProxyUpstreamMode(conf, srvConf.UpstreamMode, srvConf.FastestTimeout.Duration)
+	if err != nil {
+		return fmt.Errorf("invalid upstream mode: %w", err)
+	}
 
 	// TODO(a.garipov): Make a proper constructor for proxy.Proxy.
 	p := &proxy.Proxy{
diff --git a/internal/dnsforward/dnsforward_test.go b/internal/dnsforward/dnsforward_test.go
index bdd3308d..ece14ba3 100644
--- a/internal/dnsforward/dnsforward_test.go
+++ b/internal/dnsforward/dnsforward_test.go
@@ -177,6 +177,7 @@ func createTestTLS(t *testing.T, tlsConf TLSConfig) (s *Server, certPem []byte)
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
+			UpstreamMode:     UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 		},
 		ServePlainDNS: true,
@@ -305,6 +306,7 @@ func TestServer(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
+			UpstreamMode:     UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 		},
 		ServePlainDNS: true,
@@ -344,6 +346,7 @@ func TestServer_timeout(t *testing.T) {
 		srvConf := &ServerConfig{
 			UpstreamTimeout: testTimeout,
 			Config: Config{
+				UpstreamMode:     UpstreamModeLoadBalance,
 				EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 			},
 			ServePlainDNS: true,
@@ -362,6 +365,7 @@ func TestServer_timeout(t *testing.T) {
 		s, err := NewServer(DNSCreateParams{DNSFilter: createTestDNSFilter(t)})
 		require.NoError(t, err)
 
+		s.conf.Config.UpstreamMode = UpstreamModeLoadBalance
 		s.conf.Config.EDNSClientSubnet = &EDNSClientSubnet{
 			Enabled: false,
 		}
@@ -379,6 +383,7 @@ func TestServer_Prepare_fallbacks(t *testing.T) {
 				"#tls://1.1.1.1",
 				"8.8.8.8",
 			},
+			UpstreamMode:     UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 		},
 		ServePlainDNS: true,
@@ -401,6 +406,7 @@ func TestServerWithProtectionDisabled(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
+			UpstreamMode:     UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 		},
 		ServePlainDNS: true,
@@ -478,7 +484,8 @@ func TestServerRace(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
-			UpstreamDNS: []string{"8.8.8.8:53", "8.8.4.4:53"},
+			UpstreamMode: UpstreamModeLoadBalance,
+			UpstreamDNS:  []string{"8.8.8.8:53", "8.8.4.4:53"},
 		},
 		ConfigModified: func() {},
 		ServePlainDNS:  true,
@@ -531,6 +538,7 @@ func TestSafeSearch(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
@@ -614,6 +622,7 @@ func TestInvalidRequest(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
@@ -643,6 +652,7 @@ func TestBlockedRequest(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
@@ -678,7 +688,8 @@ func TestServerCustomClientUpstream(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
-			CacheSize: defaultCacheSize,
+			CacheSize:    defaultCacheSize,
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
@@ -756,6 +767,7 @@ func TestBlockCNAMEProtectionEnabled(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
@@ -789,6 +801,7 @@ func TestBlockCNAME(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
@@ -864,6 +877,7 @@ func TestClientRulesForCNAMEMatching(t *testing.T) {
 			FilterHandler: func(_ netip.Addr, _ string, settings *filtering.Settings) {
 				settings.FilteringEnabled = false
 			},
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
@@ -909,6 +923,7 @@ func TestNullBlockedRequest(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
@@ -974,7 +989,8 @@ func TestBlockedCustomIP(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
-			UpstreamDNS: []string{"8.8.8.8:53", "8.8.4.4:53"},
+			UpstreamDNS:  []string{"8.8.8.8:53", "8.8.4.4:53"},
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
@@ -1027,6 +1043,7 @@ func TestBlockedByHosts(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
@@ -1078,6 +1095,7 @@ func TestBlockedBySafeBrowsing(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
@@ -1136,7 +1154,8 @@ func TestRewrite(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
-			UpstreamDNS: []string{"8.8.8.8:53"},
+			UpstreamDNS:  []string{"8.8.8.8:53"},
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
@@ -1265,6 +1284,7 @@ func TestPTRResponseFromDHCPLeases(t *testing.T) {
 	s.conf.TCPListenAddrs = []*net.TCPAddr{{}}
 	s.conf.UpstreamDNS = []string{"127.0.0.1:53"}
 	s.conf.Config.EDNSClientSubnet = &EDNSClientSubnet{Enabled: false}
+	s.conf.Config.UpstreamMode = UpstreamModeLoadBalance
 
 	err = s.Prepare(&s.conf)
 	require.NoError(t, err)
@@ -1347,6 +1367,7 @@ func TestPTRResponseFromHosts(t *testing.T) {
 	s.conf.TCPListenAddrs = []*net.TCPAddr{{}}
 	s.conf.UpstreamDNS = []string{"127.0.0.1:53"}
 	s.conf.Config.EDNSClientSubnet = &EDNSClientSubnet{Enabled: false}
+	s.conf.Config.UpstreamMode = UpstreamModeLoadBalance
 
 	err = s.Prepare(&s.conf)
 	require.NoError(t, err)
@@ -1526,9 +1547,9 @@ func TestServer_Exchange(t *testing.T) {
 			},
 		},
 	}
-
 	srv.conf.UsePrivateRDNS = true
 	srv.privateNets = netutil.SubnetSetFunc(netutil.IsLocallyServed)
+	require.NoError(t, srv.internalProxy.Init())
 
 	testCases := []struct {
 		req         netip.Addr
@@ -1604,6 +1625,7 @@ func TestServer_Exchange(t *testing.T) {
 		srv.localResolvers = &proxy.Proxy{
 			Config: pcfg,
 		}
+		require.NoError(t, srv.localResolvers.Init())
 
 		t.Run(tc.name, func(t *testing.T) {
 			host, ttl, eerr := srv.Exchange(tc.req)
diff --git a/internal/dnsforward/dnsrewrite_test.go b/internal/dnsforward/dnsrewrite_test.go
index 1022388f..5204c2f2 100644
--- a/internal/dnsforward/dnsrewrite_test.go
+++ b/internal/dnsforward/dnsrewrite_test.go
@@ -38,6 +38,7 @@ func TestServer_FilterDNSRewrite(t *testing.T) {
 		BlockingMode: filtering.BlockingModeDefault,
 	}, ServerConfig{
 		Config: Config{
+			UpstreamMode:     UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 		},
 		ServePlainDNS: true,
diff --git a/internal/dnsforward/filter_test.go b/internal/dnsforward/filter_test.go
index 6559b308..9e172a32 100644
--- a/internal/dnsforward/filter_test.go
+++ b/internal/dnsforward/filter_test.go
@@ -31,6 +31,7 @@ func TestHandleDNSRequest_handleDNSRequest(t *testing.T) {
 		UDPListenAddrs: []*net.UDPAddr{{}},
 		TCPListenAddrs: []*net.TCPAddr{{}},
 		Config: Config{
+			UpstreamMode: UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{
 				Enabled: false,
 			},
diff --git a/internal/dnsforward/http.go b/internal/dnsforward/http.go
index 96128b78..c3795b63 100644
--- a/internal/dnsforward/http.go
+++ b/internal/dnsforward/http.go
@@ -71,7 +71,7 @@ type jsonDNSConfig struct {
 	DisableIPv6 *bool `json:"disable_ipv6"`
 
 	// UpstreamMode defines the way DNS requests are constructed.
-	UpstreamMode *string `json:"upstream_mode"`
+	UpstreamMode *jsonUpstreamMode `json:"upstream_mode"`
 
 	// BlockedResponseTTL is the TTL for blocked responses.
 	BlockedResponseTTL *uint32 `json:"blocked_response_ttl"`
@@ -115,6 +115,21 @@ type jsonDNSConfig struct {
 	DefaultLocalPTRUpstreams []string `json:"default_local_ptr_upstreams,omitempty"`
 }
 
+// jsonUpstreamMode is a enumeration of upstream modes.
+type jsonUpstreamMode string
+
+const (
+	// jsonUpstreamModeEmpty is the default value on frontend, it is used as
+	// jsonUpstreamModeLoadBalance mode.
+	//
+	// Deprecated: Use jsonUpstreamModeLoadBalance instead.
+	jsonUpstreamModeEmpty jsonUpstreamMode = ""
+
+	jsonUpstreamModeLoadBalance jsonUpstreamMode = "load_balance"
+	jsonUpstreamModeParallel    jsonUpstreamMode = "parallel"
+	jsonUpstreamModeFastestAddr jsonUpstreamMode = "fastest_addr"
+)
+
 func (s *Server) getDNSConfig() (c *jsonDNSConfig) {
 	protectionEnabled, protectionDisabledUntil := s.UpdatedProtectionStatus()
 
@@ -146,11 +161,16 @@ func (s *Server) getDNSConfig() (c *jsonDNSConfig) {
 	usePrivateRDNS := s.conf.UsePrivateRDNS
 	localPTRUpstreams := stringutil.CloneSliceOrEmpty(s.conf.LocalPTRResolvers)
 
-	var upstreamMode string
-	if s.conf.FastestAddr {
-		upstreamMode = "fastest_addr"
-	} else if s.conf.AllServers {
-		upstreamMode = "parallel"
+	var upstreamMode jsonUpstreamMode
+	switch s.conf.UpstreamMode {
+	case UpstreamModeLoadBalance:
+		// TODO(d.kolyshev): Support jsonUpstreamModeLoadBalance on frontend instead
+		// of jsonUpstreamModeEmpty.
+		upstreamMode = jsonUpstreamModeEmpty
+	case UpstreamModeParallel:
+		upstreamMode = jsonUpstreamModeParallel
+	case UpstreamModeFastestAddr:
+		upstreamMode = jsonUpstreamModeFastestAddr
 	}
 
 	defPTRUps, err := s.defaultLocalPTRUpstreams()
@@ -223,18 +243,22 @@ func (req *jsonDNSConfig) checkBlockingMode() (err error) {
 	return validateBlockingMode(*req.BlockingMode, req.BlockingIPv4, req.BlockingIPv6)
 }
 
-// checkUpstreamsMode returns an error if the upstream mode is invalid.
-func (req *jsonDNSConfig) checkUpstreamsMode() (err error) {
+// checkUpstreamMode returns an error if the upstream mode is invalid.
+func (req *jsonDNSConfig) checkUpstreamMode() (err error) {
 	if req.UpstreamMode == nil {
 		return nil
 	}
 
-	mode := *req.UpstreamMode
-	if ok := slices.Contains([]string{"", "fastest_addr", "parallel"}, mode); !ok {
-		return fmt.Errorf("upstream_mode: incorrect value %q", mode)
+	switch um := *req.UpstreamMode; um {
+	case
+		jsonUpstreamModeEmpty,
+		jsonUpstreamModeLoadBalance,
+		jsonUpstreamModeParallel,
+		jsonUpstreamModeFastestAddr:
+		return nil
+	default:
+		return fmt.Errorf("upstream_mode: incorrect value %q", um)
 	}
-
-	return nil
 }
 
 // checkBootstrap returns an error if any bootstrap address is invalid.
@@ -244,17 +268,22 @@ func (req *jsonDNSConfig) checkBootstrap() (err error) {
 	}
 
 	var b string
-	defer func() { err = errors.Annotate(err, "checking bootstrap %s: invalid address: %w", b) }()
+	defer func() { err = errors.Annotate(err, "checking bootstrap %s: %w", b) }()
 
 	for _, b = range *req.Bootstraps {
 		if b == "" {
 			return errors.Error("empty")
 		}
 
-		if _, err = upstream.NewUpstreamResolver(b, nil); err != nil {
+		var resolver *upstream.UpstreamResolver
+		if resolver, err = upstream.NewUpstreamResolver(b, nil); err != nil {
 			// Don't wrap the error because it's informative enough as is.
 			return err
 		}
+
+		if err = resolver.Close(); err != nil {
+			return fmt.Errorf("closing %s: %w", b, err)
+		}
 	}
 
 	return nil
@@ -298,7 +327,7 @@ func (req *jsonDNSConfig) validate(privateNets netutil.SubnetSet) (err error) {
 		return err
 	}
 
-	err = req.checkUpstreamsMode()
+	err = req.checkUpstreamMode()
 	if err != nil {
 		// Don't wrap the error since it's informative enough as is.
 		return err
@@ -355,15 +384,12 @@ func (req *jsonDNSConfig) checkCacheTTL() (err error) {
 	if req.CacheMinTTL != nil {
 		minTTL = *req.CacheMinTTL
 	}
+
 	if req.CacheMaxTTL != nil {
 		maxTTL = *req.CacheMaxTTL
 	}
 
-	if minTTL <= maxTTL {
-		return nil
-	}
-
-	return errors.Error("cache_ttl_min must be less or equal than cache_ttl_max")
+	return validateCacheTTL(minTTL, maxTTL)
 }
 
 // checkRatelimitSubnetMaskLen returns an error if the length of the subnet mask
@@ -447,8 +473,9 @@ func (s *Server) setConfig(dc *jsonDNSConfig) (shouldRestart bool) {
 	}
 
 	if dc.UpstreamMode != nil {
-		s.conf.AllServers = *dc.UpstreamMode == "parallel"
-		s.conf.FastestAddr = *dc.UpstreamMode == "fastest_addr"
+		s.conf.UpstreamMode = mustParseUpstreamMode(*dc.UpstreamMode)
+	} else {
+		s.conf.UpstreamMode = UpstreamModeLoadBalance
 	}
 
 	if dc.EDNSCSUseCustom != nil && *dc.EDNSCSUseCustom {
@@ -461,6 +488,22 @@ func (s *Server) setConfig(dc *jsonDNSConfig) (shouldRestart bool) {
 	return s.setConfigRestartable(dc)
 }
 
+// mustParseUpstreamMode returns an upstream mode parsed from jsonUpstreamMode.
+// Panics in case of invalid value.
+func mustParseUpstreamMode(mode jsonUpstreamMode) (um UpstreamMode) {
+	switch mode {
+	case jsonUpstreamModeEmpty, jsonUpstreamModeLoadBalance:
+		return UpstreamModeLoadBalance
+	case jsonUpstreamModeParallel:
+		return UpstreamModeParallel
+	case jsonUpstreamModeFastestAddr:
+		return UpstreamModeFastestAddr
+	default:
+		// Should never happen, since the value should be validated.
+		panic(fmt.Errorf("unexpected upstream mode: %q", mode))
+	}
+}
+
 // setIfNotNil sets the value pointed at by currentPtr to the value pointed at
 // by newPtr if newPtr is not nil.  currentPtr must not be nil.
 func setIfNotNil[T any](currentPtr, newPtr *T) (hasSet bool) {
diff --git a/internal/dnsforward/http_test.go b/internal/dnsforward/http_test.go
index efe62d57..b642eb2c 100644
--- a/internal/dnsforward/http_test.go
+++ b/internal/dnsforward/http_test.go
@@ -77,6 +77,7 @@ func TestDNSForwardHTTP_handleGetConfig(t *testing.T) {
 			FallbackDNS:            []string{"9.9.9.10"},
 			RatelimitSubnetLenIPv4: 24,
 			RatelimitSubnetLenIPv6: 56,
+			UpstreamMode:           UpstreamModeLoadBalance,
 			EDNSClientSubnet:       &EDNSClientSubnet{Enabled: false},
 		},
 		ConfigModified: func() {},
@@ -103,7 +104,7 @@ func TestDNSForwardHTTP_handleGetConfig(t *testing.T) {
 	}, {
 		conf: func() ServerConfig {
 			conf := defaultConf
-			conf.FastestAddr = true
+			conf.UpstreamMode = UpstreamModeFastestAddr
 
 			return conf
 		},
@@ -111,7 +112,7 @@ func TestDNSForwardHTTP_handleGetConfig(t *testing.T) {
 	}, {
 		conf: func() ServerConfig {
 			conf := defaultConf
-			conf.AllServers = true
+			conf.UpstreamMode = UpstreamModeParallel
 
 			return conf
 		},
@@ -157,6 +158,7 @@ func TestDNSForwardHTTP_handleSetConfig(t *testing.T) {
 			UpstreamDNS:            []string{"8.8.8.8:53", "8.8.4.4:53"},
 			RatelimitSubnetLenIPv4: 24,
 			RatelimitSubnetLenIPv6: 56,
+			UpstreamMode:           UpstreamModeLoadBalance,
 			EDNSClientSubnet:       &EDNSClientSubnet{Enabled: false},
 		},
 		ConfigModified: func() {},
@@ -226,11 +228,11 @@ func TestDNSForwardHTTP_handleSetConfig(t *testing.T) {
 			`bad top-level domain name label "!!!": bad top-level domain name label rune '!'`,
 	}, {
 		name: "bootstraps_bad",
-		wantSet: `validating dns config: checking bootstrap a: invalid address: not a bootstrap: ` +
-			`ParseAddr("a"): unable to parse IP`,
+		wantSet: `validating dns config: checking bootstrap a: not a bootstrap: ParseAddr("a"): ` +
+			`unable to parse IP`,
 	}, {
 		name:    "cache_bad_ttl",
-		wantSet: `validating dns config: cache_ttl_min must be less or equal than cache_ttl_max`,
+		wantSet: `validating dns config: cache_ttl_min must be less than or equal to cache_ttl_max`,
 	}, {
 		name:    "upstream_mode_bad",
 		wantSet: `validating dns config: upstream_mode: incorrect value "somethingelse"`,
@@ -432,6 +434,7 @@ func TestServer_HandleTestUpstreamDNS(t *testing.T) {
 		TCPListenAddrs:  []*net.TCPAddr{{}},
 		UpstreamTimeout: upsTimeout,
 		Config: Config{
+			UpstreamMode:     UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 		},
 		ServePlainDNS: true,
diff --git a/internal/dnsforward/process.go b/internal/dnsforward/process.go
index c9aea322..8cfe923a 100644
--- a/internal/dnsforward/process.go
+++ b/internal/dnsforward/process.go
@@ -36,11 +36,8 @@ type dnsContext struct {
 
 	// unreversedReqIP stores an IP address obtained from a PTR request if it
 	// was parsed successfully and belongs to one of the locally served IP
-	// ranges.  It is also filled with unmapped version of the address if it's
-	// within DNS64 prefixes.
-	//
-	// TODO(e.burkov):  Use netip.Addr when we switch to netip more fully.
-	unreversedReqIP net.IP
+	// ranges.
+	unreversedReqIP netip.Addr
 
 	// err is the error returned from a processing function.
 	err error
@@ -350,7 +347,7 @@ func (s *Server) processDetermineLocal(dctx *dnsContext) (rc resultCode) {
 
 	rc = resultCodeSuccess
 
-	dctx.isLocalClient = s.privateNets.Contains(dctx.proxyCtx.Addr.Addr().AsSlice())
+	dctx.isLocalClient = s.privateNets.Contains(dctx.proxyCtx.Addr.Addr())
 
 	return rc
 }
@@ -491,14 +488,7 @@ func extractARPASubnet(domain string) (pref netip.Prefix, err error) {
 		}
 	}
 
-	var subnet *net.IPNet
-	subnet, err = netutil.SubnetFromReversedAddr(domain[idx:])
-	if err != nil {
-		// Don't wrap the error since it's informative enough as is.
-		return netip.Prefix{}, err
-	}
-
-	return netutil.IPNetToPrefixNoMapped(subnet)
+	return netutil.PrefixFromReversedAddr(domain[idx:])
 }
 
 // processRestrictLocal responds with NXDOMAIN to PTR requests for IP addresses
@@ -532,8 +522,7 @@ func (s *Server) processRestrictLocal(dctx *dnsContext) (rc resultCode) {
 	// assume that all the DHCP leases we give are locally served or at least
 	// shouldn't be accessible externally.
 	subnetAddr := subnet.Addr()
-	addrData := subnetAddr.AsSlice()
-	if !s.privateNets.Contains(addrData) {
+	if !s.privateNets.Contains(subnetAddr) {
 		return resultCodeSuccess
 	}
 
@@ -548,7 +537,7 @@ func (s *Server) processRestrictLocal(dctx *dnsContext) (rc resultCode) {
 	}
 
 	// Do not perform unreversing ever again.
-	dctx.unreversedReqIP = addrData
+	dctx.unreversedReqIP = subnetAddr
 
 	// There is no need to filter request from external addresses since this
 	// code is only executed when the request is for locally served ARPA
@@ -573,16 +562,8 @@ func (s *Server) processDHCPAddrs(dctx *dnsContext) (rc resultCode) {
 		return resultCodeSuccess
 	}
 
-	ip := dctx.unreversedReqIP
-	if ip == nil {
-		return resultCodeSuccess
-	}
-
-	// TODO(a.garipov):  Remove once we switch to [netip.Addr] more fully.
-	ipAddr, err := netutil.IPToAddrNoMapped(ip)
-	if err != nil {
-		log.Debug("dnsforward: bad reverse ip %v from dhcp: %s", ip, err)
-
+	ipAddr := dctx.unreversedReqIP
+	if ipAddr == (netip.Addr{}) {
 		return resultCodeSuccess
 	}
 
@@ -591,7 +572,7 @@ func (s *Server) processDHCPAddrs(dctx *dnsContext) (rc resultCode) {
 		return resultCodeSuccess
 	}
 
-	log.Debug("dnsforward: dhcp client %s is %q", ip, host)
+	log.Debug("dnsforward: dhcp client %s is %q", ipAddr, host)
 
 	req := pctx.Req
 	resp := s.makeResponse(req)
@@ -624,7 +605,7 @@ func (s *Server) processLocalPTR(dctx *dnsContext) (rc resultCode) {
 	}
 
 	ip := dctx.unreversedReqIP
-	if ip == nil {
+	if ip == (netip.Addr{}) {
 		return resultCodeSuccess
 	}
 
@@ -639,8 +620,7 @@ func (s *Server) processLocalPTR(dctx *dnsContext) (rc resultCode) {
 			// Generate the server failure if the private upstream configuration
 			// is empty.
 			//
-			// TODO(e.burkov):  Get rid of this crutch once the local resolvers
-			// logic is moved to the dnsproxy completely.
+			// This is a crutch, see TODO at [Server.localResolvers].
 			if errors.Is(err, upstream.ErrNoUpstreams) {
 				pctx.Res = s.genServerFailure(pctx.Req)
 
diff --git a/internal/dnsforward/process_internal_test.go b/internal/dnsforward/process_internal_test.go
index 18b04b3f..2c919d7d 100644
--- a/internal/dnsforward/process_internal_test.go
+++ b/internal/dnsforward/process_internal_test.go
@@ -79,6 +79,7 @@ func TestServer_ProcessInitial(t *testing.T) {
 			c := ServerConfig{
 				Config: Config{
 					AAAADisabled:     tc.aaaaDisabled,
+					UpstreamMode:     UpstreamModeLoadBalance,
 					EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 				},
 				ServePlainDNS: true,
@@ -179,6 +180,7 @@ func TestServer_ProcessFilteringAfterResponse(t *testing.T) {
 			c := ServerConfig{
 				Config: Config{
 					AAAADisabled:     tc.aaaaDisabled,
+					UpstreamMode:     UpstreamModeLoadBalance,
 					EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 				},
 				ServePlainDNS: true,
@@ -694,6 +696,7 @@ func TestServer_ProcessRestrictLocal(t *testing.T) {
 		// TODO(s.chzhen):  Add tests where EDNSClientSubnet.Enabled is true.
 		// Improve Config declaration for tests.
 		Config: Config{
+			UpstreamMode:     UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 		},
 		ServePlainDNS: true,
@@ -770,6 +773,7 @@ func TestServer_ProcessLocalPTR_usingResolvers(t *testing.T) {
 			UDPListenAddrs: []*net.UDPAddr{{}},
 			TCPListenAddrs: []*net.TCPAddr{{}},
 			Config: Config{
+				UpstreamMode:     UpstreamModeLoadBalance,
 				EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 			},
 			ServePlainDNS: true,
@@ -791,7 +795,7 @@ func TestServer_ProcessLocalPTR_usingResolvers(t *testing.T) {
 		}
 		dnsCtx = &dnsContext{
 			proxyCtx:        proxyCtx,
-			unreversedReqIP: net.IP{192, 168, 1, 1},
+			unreversedReqIP: netip.MustParseAddr("192.168.1.1"),
 		}
 		s.conf.UsePrivateRDNS = use
 	}
diff --git a/internal/dnsforward/stats.go b/internal/dnsforward/stats.go
index f67e5ad8..6a6b9853 100644
--- a/internal/dnsforward/stats.go
+++ b/internal/dnsforward/stats.go
@@ -25,10 +25,10 @@ func (s *Server) processQueryLogsAndStats(dctx *dnsContext) (rc resultCode) {
 
 	ip := pctx.Addr.Addr().AsSlice()
 	s.anonymizer.Load()(ip)
+	ipStr := net.IP(ip).String()
 
-	log.Debug("dnsforward: client ip for stats and querylog: %s", ip)
+	log.Debug("dnsforward: client ip for stats and querylog: %s", ipStr)
 
-	ipStr := pctx.Addr.Addr().String()
 	ids := []string{ipStr, dctx.clientID}
 	qt, cl := q.Qtype, q.Qclass
 
diff --git a/internal/dnsforward/svcbmsg_test.go b/internal/dnsforward/svcbmsg_test.go
index 58275ef4..2c2b7b0b 100644
--- a/internal/dnsforward/svcbmsg_test.go
+++ b/internal/dnsforward/svcbmsg_test.go
@@ -17,6 +17,7 @@ func TestGenAnswerHTTPS_andSVCB(t *testing.T) {
 		BlockingMode: filtering.BlockingModeDefault,
 	}, ServerConfig{
 		Config: Config{
+			UpstreamMode:     UpstreamModeLoadBalance,
 			EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
 		},
 		ServePlainDNS: true,
diff --git a/internal/dnsforward/upstreams.go b/internal/dnsforward/upstreams.go
index dda14de2..b28b5f90 100644
--- a/internal/dnsforward/upstreams.go
+++ b/internal/dnsforward/upstreams.go
@@ -112,18 +112,22 @@ func UpstreamHTTPVersions(http3 bool) (v []upstream.HTTPVersion) {
 // based on provided parameters.
 func setProxyUpstreamMode(
 	conf *proxy.Config,
-	allServers bool,
-	fastestAddr bool,
+	upstreamMode UpstreamMode,
 	fastestTimeout time.Duration,
-) {
-	if allServers {
+) (err error) {
+	switch upstreamMode {
+	case UpstreamModeParallel:
 		conf.UpstreamMode = proxy.UModeParallel
-	} else if fastestAddr {
+	case UpstreamModeFastestAddr:
 		conf.UpstreamMode = proxy.UModeFastestAddr
 		conf.FastestPingTimeout = fastestTimeout
-	} else {
+	case UpstreamModeLoadBalance:
 		conf.UpstreamMode = proxy.UModeLoadBalance
+	default:
+		return fmt.Errorf("unexpected value %q", upstreamMode)
 	}
+
+	return nil
 }
 
 // createBootstrap returns a bootstrap resolver based on the configuration of s.
@@ -152,7 +156,7 @@ func (s *Server) createBootstrap(
 
 	var parallel upstream.ParallelResolver
 	for _, b := range boots {
-		parallel = append(parallel, b)
+		parallel = append(parallel, upstream.NewCachingResolver(b))
 	}
 
 	if s.etcHosts != nil {
@@ -198,7 +202,7 @@ func ValidateUpstreamsPrivate(upstreams []string, privateNets netutil.SubnetSet)
 			continue
 		}
 
-		if !privateNets.Contains(subnet.Addr().AsSlice()) {
+		if !privateNets.Contains(subnet.Addr()) {
 			errs = append(
 				errs,
 				fmt.Errorf("arpa domain %q should point to a locally-served network", domain),
diff --git a/internal/filtering/dnsrewrite_test.go b/internal/filtering/dnsrewrite_test.go
index 2793697c..06cd921b 100644
--- a/internal/filtering/dnsrewrite_test.go
+++ b/internal/filtering/dnsrewrite_test.go
@@ -1,17 +1,11 @@
 package filtering
 
 import (
-	"fmt"
 	"net/netip"
 	"path"
 	"testing"
-	"testing/fstest"
 
-	"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
-	"github.com/AdguardTeam/AdGuardHome/internal/aghtest"
 	"github.com/AdguardTeam/golibs/netutil"
-	"github.com/AdguardTeam/golibs/testutil"
-	"github.com/AdguardTeam/urlfilter/rules"
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -215,167 +209,3 @@ func TestDNSFilter_CheckHostRules_dnsrewrite(t *testing.T) {
 		assert.Equal(t, "new-ptr-with-dot.", ptr)
 	})
 }
-
-func TestDNSFilter_CheckHost_hostsContainer(t *testing.T) {
-	addrv4 := netip.MustParseAddr("1.2.3.4")
-	addrv6 := netip.MustParseAddr("::1")
-	addrMapped := netip.MustParseAddr("::ffff:1.2.3.4")
-	addrv4Dup := netip.MustParseAddr("4.3.2.1")
-
-	data := fmt.Sprintf(
-		""+
-			"%[1]s v4.host.example\n"+
-			"%[2]s v6.host.example\n"+
-			"%[3]s mapped.host.example\n"+
-			"%[4]s v4.host.with-dup\n"+
-			"%[4]s v4.host.with-dup\n",
-		addrv4,
-		addrv6,
-		addrMapped,
-		addrv4Dup,
-	)
-
-	files := fstest.MapFS{
-		"hosts": &fstest.MapFile{
-			Data: []byte(data),
-		},
-	}
-	watcher := &aghtest.FSWatcher{
-		OnEvents: func() (e <-chan struct{}) { return nil },
-		OnAdd:    func(name string) (err error) { return nil },
-		OnClose:  func() (err error) { return nil },
-	}
-	hc, err := aghnet.NewHostsContainer(files, watcher, "hosts")
-	require.NoError(t, err)
-	testutil.CleanupAndRequireSuccess(t, hc.Close)
-
-	f, _ := newForTest(t, &Config{EtcHosts: hc}, nil)
-	setts := &Settings{
-		FilteringEnabled: true,
-	}
-
-	testCases := []struct {
-		name      string
-		host      string
-		wantRules []*ResultRule
-		wantResps []rules.RRValue
-		dtyp      uint16
-	}{{
-		name: "v4",
-		host: "v4.host.example",
-		dtyp: dns.TypeA,
-		wantRules: []*ResultRule{{
-			Text:         "1.2.3.4 v4.host.example",
-			FilterListID: SysHostsListID,
-		}},
-		wantResps: []rules.RRValue{addrv4},
-	}, {
-		name: "v6",
-		host: "v6.host.example",
-		dtyp: dns.TypeAAAA,
-		wantRules: []*ResultRule{{
-			Text:         "::1 v6.host.example",
-			FilterListID: SysHostsListID,
-		}},
-		wantResps: []rules.RRValue{addrv6},
-	}, {
-		name: "mapped",
-		host: "mapped.host.example",
-		dtyp: dns.TypeAAAA,
-		wantRules: []*ResultRule{{
-			Text:         "::ffff:1.2.3.4 mapped.host.example",
-			FilterListID: SysHostsListID,
-		}},
-		wantResps: []rules.RRValue{addrMapped},
-	}, {
-		name: "ptr",
-		host: "4.3.2.1.in-addr.arpa",
-		dtyp: dns.TypePTR,
-		wantRules: []*ResultRule{{
-			Text:         "1.2.3.4 v4.host.example",
-			FilterListID: SysHostsListID,
-		}},
-		wantResps: []rules.RRValue{"v4.host.example"},
-	}, {
-		name: "ptr-mapped",
-		host: "4.0.3.0.2.0.1.0.f.f.f.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa",
-		dtyp: dns.TypePTR,
-		wantRules: []*ResultRule{{
-			Text:         "::ffff:1.2.3.4 mapped.host.example",
-			FilterListID: SysHostsListID,
-		}},
-		wantResps: []rules.RRValue{"mapped.host.example"},
-	}, {
-		name:      "not_found_v4",
-		host:      "non.existent.example",
-		dtyp:      dns.TypeA,
-		wantRules: nil,
-		wantResps: nil,
-	}, {
-		name:      "not_found_v6",
-		host:      "non.existent.example",
-		dtyp:      dns.TypeAAAA,
-		wantRules: nil,
-		wantResps: nil,
-	}, {
-		name:      "not_found_ptr",
-		host:      "4.3.2.2.in-addr.arpa",
-		dtyp:      dns.TypePTR,
-		wantRules: nil,
-		wantResps: nil,
-	}, {
-		name:      "v4_mismatch",
-		host:      "v4.host.example",
-		dtyp:      dns.TypeAAAA,
-		wantRules: nil,
-		wantResps: nil,
-	}, {
-		name:      "v6_mismatch",
-		host:      "v6.host.example",
-		dtyp:      dns.TypeA,
-		wantRules: nil,
-		wantResps: nil,
-	}, {
-		name:      "wrong_ptr",
-		host:      "4.3.2.1.ip6.arpa",
-		dtyp:      dns.TypePTR,
-		wantRules: nil,
-		wantResps: nil,
-	}, {
-		name:      "unsupported_type",
-		host:      "v4.host.example",
-		dtyp:      dns.TypeCNAME,
-		wantRules: nil,
-		wantResps: nil,
-	}, {
-		name: "v4_dup",
-		host: "v4.host.with-dup",
-		dtyp: dns.TypeA,
-		wantRules: []*ResultRule{{
-			Text:         "4.3.2.1 v4.host.with-dup",
-			FilterListID: SysHostsListID,
-		}},
-		wantResps: []rules.RRValue{addrv4Dup},
-	}}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			var res Result
-			res, err = f.CheckHost(tc.host, tc.dtyp, setts)
-			require.NoError(t, err)
-
-			if len(tc.wantRules) == 0 {
-				assert.Empty(t, res.Rules)
-				assert.Nil(t, res.DNSRewriteResult)
-
-				return
-			}
-
-			require.NotNil(t, res.DNSRewriteResult)
-			require.Contains(t, res.DNSRewriteResult.Response, tc.dtyp)
-
-			assert.Equal(t, tc.wantResps, res.DNSRewriteResult.Response[tc.dtyp])
-			assert.Equal(t, tc.wantRules, res.Rules)
-		})
-	}
-}
diff --git a/internal/filtering/filtering.go b/internal/filtering/filtering.go
index d54b0d35..2d382530 100644
--- a/internal/filtering/filtering.go
+++ b/internal/filtering/filtering.go
@@ -23,7 +23,6 @@ import (
 	"github.com/AdguardTeam/golibs/hostsfile"
 	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/golibs/mathutil"
-	"github.com/AdguardTeam/golibs/netutil"
 	"github.com/AdguardTeam/golibs/stringutil"
 	"github.com/AdguardTeam/golibs/syncutil"
 	"github.com/AdguardTeam/urlfilter"
@@ -618,84 +617,6 @@ func (d *DNSFilter) CheckHost(
 	return Result{}, nil
 }
 
-// matchSysHosts tries to match the host against the operating system's hosts
-// database.  err is always nil.
-func (d *DNSFilter) matchSysHosts(
-	host string,
-	qtype uint16,
-	setts *Settings,
-) (res Result, err error) {
-	// TODO(e.burkov):  Where else is this checked?
-	if !setts.FilteringEnabled || d.conf.EtcHosts == nil {
-		return Result{}, nil
-	}
-
-	vals, rs := hostsRewrites(qtype, host, d.conf.EtcHosts)
-	if len(vals) > 0 {
-		res.DNSRewriteResult = &DNSRewriteResult{
-			Response: DNSRewriteResultResponse{
-				qtype: vals,
-			},
-			RCode: dns.RcodeSuccess,
-		}
-		res.Rules = rs
-		res.Reason = RewrittenAutoHosts
-	}
-
-	return res, nil
-}
-
-// hostsRewrites returns values and rules matched by qt and host within hs.
-func hostsRewrites(
-	qtype uint16,
-	host string,
-	hs hostsfile.Storage,
-) (vals []rules.RRValue, rs []*ResultRule) {
-	var isValidProto func(netip.Addr) (ok bool)
-	switch qtype {
-	case dns.TypeA:
-		isValidProto = netip.Addr.Is4
-	case dns.TypeAAAA:
-		isValidProto = netip.Addr.Is6
-	case dns.TypePTR:
-		// TODO(e.burkov):  Add some [netip]-aware alternative to [netutil].
-		ip, err := netutil.IPFromReversedAddr(host)
-		if err != nil {
-			log.Debug("filtering: failed to parse PTR record %q: %s", host, err)
-
-			return nil, nil
-		}
-
-		addr, _ := netip.AddrFromSlice(ip)
-
-		for _, name := range hs.ByAddr(addr) {
-			vals = append(vals, name)
-			rs = append(rs, &ResultRule{
-				Text:         fmt.Sprintf("%s %s", addr, name),
-				FilterListID: SysHostsListID,
-			})
-		}
-
-		return vals, rs
-	default:
-		log.Debug("filtering: unsupported qtype %d", qtype)
-
-		return nil, nil
-	}
-
-	for _, addr := range hs.ByName(host) {
-		if isValidProto(addr) {
-			vals = append(vals, addr)
-			rs = append(rs, &ResultRule{
-				Text:         fmt.Sprintf("%s %s", addr, host),
-				FilterListID: SysHostsListID,
-			})
-		}
-	}
-
-	return vals, rs
-}
-
 // processRewrites performs filtering based on the legacy rewrite records.
 //
 // Firstly, it finds CNAME rewrites for host.  If the CNAME is the same as host,
diff --git a/internal/filtering/hosts.go b/internal/filtering/hosts.go
new file mode 100644
index 00000000..79cb69ac
--- /dev/null
+++ b/internal/filtering/hosts.go
@@ -0,0 +1,92 @@
+package filtering
+
+import (
+	"fmt"
+	"net/netip"
+
+	"github.com/AdguardTeam/golibs/hostsfile"
+	"github.com/AdguardTeam/golibs/log"
+	"github.com/AdguardTeam/golibs/netutil"
+	"github.com/AdguardTeam/urlfilter/rules"
+	"github.com/miekg/dns"
+)
+
+// matchSysHosts tries to match the host against the operating system's hosts
+// database.  err is always nil.
+func (d *DNSFilter) matchSysHosts(
+	host string,
+	qtype uint16,
+	setts *Settings,
+) (res Result, err error) {
+	// TODO(e.burkov):  Where else is this checked?
+	if !setts.FilteringEnabled || d.conf.EtcHosts == nil {
+		return Result{}, nil
+	}
+
+	vals, rs, matched := hostsRewrites(qtype, host, d.conf.EtcHosts)
+	if !matched {
+		return Result{}, nil
+	}
+
+	return Result{
+		DNSRewriteResult: &DNSRewriteResult{
+			Response: DNSRewriteResultResponse{
+				qtype: vals,
+			},
+			RCode: dns.RcodeSuccess,
+		},
+		Rules:  rs,
+		Reason: RewrittenAutoHosts,
+	}, nil
+}
+
+// hostsRewrites returns values and rules matched by qt and host within hs.
+func hostsRewrites(
+	qtype uint16,
+	host string,
+	hs hostsfile.Storage,
+) (vals []rules.RRValue, rls []*ResultRule, matched bool) {
+	var isValidProto func(netip.Addr) (ok bool)
+	switch qtype {
+	case dns.TypeA:
+		isValidProto = netip.Addr.Is4
+	case dns.TypeAAAA:
+		isValidProto = netip.Addr.Is6
+	case dns.TypePTR:
+		addr, err := netutil.IPFromReversedAddr(host)
+		if err != nil {
+			log.Debug("filtering: failed to parse PTR record %q: %s", host, err)
+
+			return nil, nil, false
+		}
+
+		names := hs.ByAddr(addr)
+
+		for _, name := range names {
+			vals = append(vals, name)
+			rls = append(rls, &ResultRule{
+				Text:         fmt.Sprintf("%s %s", addr, name),
+				FilterListID: SysHostsListID,
+			})
+		}
+
+		return vals, rls, len(names) > 0
+	default:
+		log.Debug("filtering: unsupported qtype %d", qtype)
+
+		return nil, nil, false
+	}
+
+	addrs := hs.ByName(host)
+	for _, addr := range addrs {
+		if isValidProto(addr) {
+			vals = append(vals, addr)
+		}
+		rls = append(rls, &ResultRule{
+			Text:         fmt.Sprintf("%s %s", addr, host),
+			FilterListID: SysHostsListID,
+		})
+	}
+
+	return vals, rls, len(addrs) > 0
+}
diff --git a/internal/filtering/hosts_test.go b/internal/filtering/hosts_test.go
new file mode 100644
index 00000000..baa6675c
--- /dev/null
+++ b/internal/filtering/hosts_test.go
@@ -0,0 +1,191 @@
+package filtering
+
+import (
+	"fmt"
+	"net/netip"
+	"testing"
+	"testing/fstest"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
+	"github.com/AdguardTeam/AdGuardHome/internal/aghtest"
+	"github.com/AdguardTeam/golibs/testutil"
+	"github.com/AdguardTeam/urlfilter/rules"
+	"github.com/miekg/dns"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDNSFilter_CheckHost_hostsContainer(t *testing.T) {
+	addrv4 := netip.MustParseAddr("1.2.3.4")
+	addrv6 := netip.MustParseAddr("::1")
+	addrMapped := netip.MustParseAddr("::ffff:1.2.3.4")
+	addrv4Dup := netip.MustParseAddr("4.3.2.1")
+
+	data := fmt.Sprintf(
+		""+
+			"%[1]s v4.host.example\n"+
+			"%[2]s v6.host.example\n"+
+			"%[3]s mapped.host.example\n"+
+			"%[4]s v4.host.with-dup\n"+
+			"%[4]s v4.host.with-dup\n",
+		addrv4,
+		addrv6,
+		addrMapped,
+		addrv4Dup,
+	)
+
+	files := fstest.MapFS{
+		"hosts": &fstest.MapFile{
+			Data: []byte(data),
+		},
+	}
+	watcher := &aghtest.FSWatcher{
+		OnEvents: func() (e <-chan struct{}) { return nil },
+		OnAdd:    func(name string) (err error) { return nil },
+		OnClose:  func() (err error) { return nil },
+	}
+	hc, err := aghnet.NewHostsContainer(files, watcher, "hosts")
+	require.NoError(t, err)
+	testutil.CleanupAndRequireSuccess(t, hc.Close)
+
+	conf := &Config{
+		EtcHosts: hc,
+	}
+	f, err := New(conf, nil)
+	require.NoError(t, err)
+
+	setts := &Settings{
+		FilteringEnabled: true,
+	}
+
+	testCases := []struct {
+		name      string
+		host      string
+		wantRules []*ResultRule
+		wantResps []rules.RRValue
+		dtyp      uint16
+	}{{
+		name: "v4",
+		host: "v4.host.example",
+		dtyp: dns.TypeA,
+		wantRules: []*ResultRule{{
+			Text:         "1.2.3.4 v4.host.example",
+			FilterListID: SysHostsListID,
+		}},
+		wantResps: []rules.RRValue{addrv4},
+	}, {
+		name: "v6",
+		host: "v6.host.example",
+		dtyp: dns.TypeAAAA,
+		wantRules: []*ResultRule{{
+			Text:         "::1 v6.host.example",
+			FilterListID: SysHostsListID,
+		}},
+		wantResps: []rules.RRValue{addrv6},
+	}, {
+		name: "mapped",
+		host: "mapped.host.example",
+		dtyp: dns.TypeAAAA,
+		wantRules: []*ResultRule{{
+			Text:         "::ffff:1.2.3.4 mapped.host.example",
+			FilterListID: SysHostsListID,
+		}},
+		wantResps: []rules.RRValue{addrMapped},
+	}, {
+		name: "ptr",
+		host: "4.3.2.1.in-addr.arpa",
+		dtyp: dns.TypePTR,
+		wantRules: []*ResultRule{{
+			Text:         "1.2.3.4 v4.host.example",
+			FilterListID: SysHostsListID,
+		}},
+		wantResps: []rules.RRValue{"v4.host.example"},
+	}, {
+		name: "ptr-mapped",
+		host: "4.0.3.0.2.0.1.0.f.f.f.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa",
+		dtyp: dns.TypePTR,
+		wantRules: []*ResultRule{{
+			Text:         "::ffff:1.2.3.4 mapped.host.example",
+			FilterListID: SysHostsListID,
+		}},
+		wantResps: []rules.RRValue{"mapped.host.example"},
+	}, {
+		name:      "not_found_v4",
+		host:      "non.existent.example",
+		dtyp:      dns.TypeA,
+		wantRules: nil,
+		wantResps: nil,
+	}, {
+		name:      "not_found_v6",
+		host:      "non.existent.example",
+		dtyp:      dns.TypeAAAA,
+		wantRules: nil,
+		wantResps: nil,
+	}, {
+		name:      "not_found_ptr",
+		host:      "4.3.2.2.in-addr.arpa",
+		dtyp:      dns.TypePTR,
+		wantRules: nil,
+		wantResps: nil,
+	}, {
+		name: "v4_mismatch",
+		host: "v4.host.example",
+		dtyp: dns.TypeAAAA,
+		wantRules: []*ResultRule{{
+			Text:         fmt.Sprintf("%s v4.host.example", addrv4),
+			FilterListID: SysHostsListID,
+		}},
+		wantResps: nil,
+	}, {
+		name: "v6_mismatch",
+		host: "v6.host.example",
+		dtyp: dns.TypeA,
+		wantRules: []*ResultRule{{
+			Text:         fmt.Sprintf("%s v6.host.example", addrv6),
+			FilterListID: SysHostsListID,
+		}},
+		wantResps: nil,
+	}, {
+		name:      "wrong_ptr",
+		host:      "4.3.2.1.ip6.arpa",
+		dtyp:      dns.TypePTR,
+		wantRules: nil,
+		wantResps: nil,
+	}, {
+		name:      "unsupported_type",
+		host:      "v4.host.example",
+		dtyp:      dns.TypeCNAME,
+		wantRules: nil,
+		wantResps: nil,
+	}, {
+		name: "v4_dup",
+		host: "v4.host.with-dup",
+		dtyp: dns.TypeA,
+		wantRules: []*ResultRule{{
+			Text:         "4.3.2.1 v4.host.with-dup",
+			FilterListID: SysHostsListID,
+		}},
+		wantResps: []rules.RRValue{addrv4Dup},
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var res Result
+			res, err = f.CheckHost(tc.host, tc.dtyp, setts)
+			require.NoError(t, err)
+
+			if len(tc.wantRules) == 0 {
+				assert.Empty(t, res.Rules)
+				assert.Nil(t, res.DNSRewriteResult)
+
+				return
+			}
+
+			require.NotNil(t, res.DNSRewriteResult)
+			require.Contains(t, res.DNSRewriteResult.Response, tc.dtyp)
+
+			assert.Equal(t, tc.wantResps, res.DNSRewriteResult.Response[tc.dtyp])
+			assert.Equal(t, tc.wantRules, res.Rules)
+		})
+	}
+}
diff --git a/internal/filtering/http.go b/internal/filtering/http.go
index ca6b8cf9..362ef0e4 100644
--- a/internal/filtering/http.go
+++ b/internal/filtering/http.go
@@ -24,23 +24,25 @@ func validateFilterURL(urlStr string) (err error) {
 
 	if filepath.IsAbs(urlStr) {
 		_, err = os.Stat(urlStr)
-		if err != nil {
-			// Don't wrap the error since it's informative enough as is.
-			return err
-		}
 
-		return nil
+		// Don't wrap the error since it's informative enough as is.
+		return err
 	}
 
 	u, err := url.ParseRequestURI(urlStr)
 	if err != nil {
 		// Don't wrap the error since it's informative enough as is.
 		return err
-	} else if s := u.Scheme; s != aghhttp.SchemeHTTP && s != aghhttp.SchemeHTTPS {
+	}
+
+	if s := u.Scheme; s != aghhttp.SchemeHTTP && s != aghhttp.SchemeHTTPS {
 		return &url.Error{
 			Op:  "Check scheme",
 			URL: urlStr,
-			Err: fmt.Errorf("only %v allowed", []string{aghhttp.SchemeHTTP, aghhttp.SchemeHTTPS}),
+			Err: fmt.Errorf("only %v allowed", []string{
+				aghhttp.SchemeHTTP,
+				aghhttp.SchemeHTTPS,
+			}),
 		}
 	}
 
diff --git a/internal/filtering/rulelist/filter.go b/internal/filtering/rulelist/filter.go
new file mode 100644
index 00000000..278eef5c
--- /dev/null
+++ b/internal/filtering/rulelist/filter.go
@@ -0,0 +1,338 @@
+package rulelist
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/aghrenameio"
+	"github.com/AdguardTeam/golibs/errors"
+	"github.com/AdguardTeam/golibs/ioutil"
+	"github.com/AdguardTeam/golibs/log"
+	"github.com/AdguardTeam/urlfilter/filterlist"
+	"github.com/c2h5oh/datasize"
+)
+
+// Filter contains information about a single rule-list filter.
+//
+// TODO(a.garipov): Use.
+type Filter struct {
+	// url is the URL of this rule list.  Supported schemes are:
+	//   - http
+	//   - https
+	//   - file
+	url *url.URL
+
+	// ruleList is the last successfully compiled [filterlist.RuleList].
+	ruleList filterlist.RuleList
+
+	// updated is the time of the last successful update.
+	updated time.Time
+
+	// name is the human-readable name of this rule-list filter.
+	name string
+
+	// uid is the unique ID of this rule-list filter.
+	uid UID
+
+	// urlFilterID is used for working with package urlfilter.
+	urlFilterID URLFilterID
+
+	// rulesCount contains the number of rules in this rule-list filter.
+	rulesCount int
+
+	// checksum is a CRC32 hash used to quickly check if the rules within a list
+	// file have changed.
+	checksum uint32
+
+	// enabled, if true, means that this rule-list filter is used for filtering.
+	//
+	// TODO(a.garipov): Take into account.
+	enabled bool
+}
+
+// FilterConfig contains the configuration for a [Filter].
+type FilterConfig struct {
+	// URL is the URL of this rule-list filter.  Supported schemes are:
+	//   - http
+	//   - https
+	//   - file
+	URL *url.URL
+
+	// Name is the human-readable name of this rule-list filter.  If not set, it
+	// is either taken from the rule-list data or generated synthetically from
+	// the UID.
+	Name string
+
+	// UID is the unique ID of this rule-list filter.
+	UID UID
+
+	// URLFilterID is used for working with package urlfilter.
+	URLFilterID URLFilterID
+
+	// Enabled, if true, means that this rule-list filter is used for filtering.
+	Enabled bool
+}
+
+// NewFilter creates a new rule-list filter.  The filter is not refreshed, so a
+// refresh should be performed before use.
+func NewFilter(c *FilterConfig) (f *Filter, err error) {
+	if c.URL == nil {
+		return nil, errors.Error("no url")
+	}
+
+	switch s := c.URL.Scheme; s {
+	case "http", "https", "file":
+		// Go on.
+	default:
+		return nil, fmt.Errorf("bad url scheme: %q", s)
+	}
+
+	return &Filter{
+		url:         c.URL,
+		name:        c.Name,
+		uid:         c.UID,
+		urlFilterID: c.URLFilterID,
+		enabled:     c.Enabled,
+	}, nil
+}
+
+// Refresh updates the data in the rule-list filter.  parseBuf is the initial
+// buffer used to parse information from the data.  cli and maxSize are only
+// used when f is a URL-based list.
+func (f *Filter) Refresh(
+	ctx context.Context,
+	parseBuf []byte,
+	cli *http.Client,
+	cacheDir string,
+	maxSize datasize.ByteSize,
+) (parseRes *ParseResult, err error) {
+	cachePath := filepath.Join(cacheDir, f.uid.String()+".txt")
+
+	switch s := f.url.Scheme; s {
+	case "http", "https":
+		parseRes, err = f.setFromHTTP(ctx, parseBuf, cli, cachePath, maxSize.Bytes())
+	case "file":
+		parseRes, err = f.setFromFile(parseBuf, f.url.Path, cachePath)
+	default:
+		// Since the URL has been prevalidated in New, consider this a
+		// programmer error.
+		panic(fmt.Errorf("bad url scheme: %q", s))
+	}
+	if err != nil {
+		// Don't wrap the error, because it's informative enough as is.
+		return nil, err
+	}
+
+	if f.checksum != parseRes.Checksum {
+		f.checksum = parseRes.Checksum
+		f.rulesCount = parseRes.RulesCount
+		f.setName(parseRes.Title)
+		f.updated = time.Now()
+	}
+
+	return parseRes, nil
+}
+
+// setFromHTTP sets the rule-list filter's data from its URL.  It also caches
+// the data into a file.
+func (f *Filter) setFromHTTP(
+	ctx context.Context,
+	parseBuf []byte,
+	cli *http.Client,
+	cachePath string,
+	maxSize uint64,
+) (parseRes *ParseResult, err error) {
+	defer func() { err = errors.Annotate(err, "setting from http: %w") }()
+
+	text, parseRes, err := f.readFromHTTP(ctx, parseBuf, cli, cachePath, maxSize)
+	if err != nil {
+		// Don't wrap the error, because it's informative enough as is.
+		return nil, err
+	}
+
+	// TODO(a.garipov): Add filterlist.BytesRuleList.
+	f.ruleList = &filterlist.StringRuleList{
+		ID:             f.urlFilterID,
+		RulesText:      text,
+		IgnoreCosmetic: true,
+	}
+
+	return parseRes, nil
+}
+
+// readFromHTTP reads the data from the rule-list filter's URL into the cache
+// file as well as returns it as a string.  The data is filtered through a
+// parser and so is free from comments, unnecessary whitespace, etc.
+func (f *Filter) readFromHTTP(
+	ctx context.Context,
+	parseBuf []byte,
+	cli *http.Client,
+	cachePath string,
+	maxSize uint64,
+) (text string, parseRes *ParseResult, err error) {
+	urlStr := f.url.String()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, urlStr, nil)
+	if err != nil {
+		return "", nil, fmt.Errorf("making request for http url %q: %w", urlStr, err)
+	}
+
+	resp, err := cli.Do(req)
+	if err != nil {
+		return "", nil, fmt.Errorf("requesting from http url: %w", err)
+	}
+	defer func() { err = errors.WithDeferred(err, resp.Body.Close()) }()
+
+	// TODO(a.garipov): Use [agdhttp.CheckStatus] when it's moved to golibs.
+	if resp.StatusCode != http.StatusOK {
+		return "", nil, fmt.Errorf("got status code %d, want %d", resp.StatusCode, http.StatusOK)
+	}
+
+	fltFile, err := aghrenameio.NewPendingFile(cachePath, 0o644)
+	if err != nil {
+		return "", nil, fmt.Errorf("creating temp file: %w", err)
+	}
+	defer func() { err = aghrenameio.WithDeferredCleanup(err, fltFile) }()
+
+	buf := &bytes.Buffer{}
+	mw := io.MultiWriter(buf, fltFile)
+
+	parser := NewParser()
+	httpBody := ioutil.LimitReader(resp.Body, maxSize)
+	parseRes, err = parser.Parse(mw, httpBody, parseBuf)
+	if err != nil {
+		return "", nil, fmt.Errorf("parsing response from http url %q: %w", urlStr, err)
+	}
+
+	return buf.String(), parseRes, nil
+}
+
+// setName sets the title using either the already-present name, the given title
+// from the rule-list data, or a synthetic name.
+func (f *Filter) setName(title string) {
+	if f.name != "" {
+		return
+	}
+
+	if title != "" {
+		f.name = title
+
+		return
+	}
+
+	f.name = fmt.Sprintf("List %s", f.uid)
+}
+
+// setFromFile sets the rule-list filter's data from a file path.  It also
+// caches the data into a file.
+//
+// TODO(a.garipov): Retest on Windows once rule-list updater is committed.  See
+// if calling Close is necessary here.
+func (f *Filter) setFromFile(
+	parseBuf []byte,
+	filePath string,
+	cachePath string,
+) (parseRes *ParseResult, err error) {
+	defer func() { err = errors.Annotate(err, "setting from file: %w") }()
+
+	parseRes, err = parseIntoCache(parseBuf, filePath, cachePath)
+	if err != nil {
+		// Don't wrap the error, because it's informative enough as is.
+		return nil, err
+	}
+
+	err = f.Close()
+	if err != nil {
+		return nil, fmt.Errorf("closing old rule list: %w", err)
+	}
+
+	rl, err := filterlist.NewFileRuleList(f.urlFilterID, cachePath, true)
+	if err != nil {
+		return nil, fmt.Errorf("opening new rule list: %w", err)
+	}
+
+	f.ruleList = rl
+
+	return parseRes, nil
+}
+
+// parseIntoCache copies the relevant the data from filePath into cachePath
+// while also parsing it.
+func parseIntoCache(
+	parseBuf []byte,
+	filePath string,
+	cachePath string,
+) (parseRes *ParseResult, err error) {
+	tmpFile, err := aghrenameio.NewPendingFile(cachePath, 0o644)
+	if err != nil {
+		return nil, fmt.Errorf("creating temp file: %w", err)
+	}
+	defer func() { err = aghrenameio.WithDeferredCleanup(err, tmpFile) }()
+
+	// #nosec G304 -- Assume that cachePath is always cacheDir joined with a
+	// uid using [filepath.Join].
+	f, err := os.Open(filePath)
+	if err != nil {
+		return nil, fmt.Errorf("opening src file: %w", err)
+	}
+	defer func() { err = errors.WithDeferred(err, f.Close()) }()
+
+	parser := NewParser()
+	parseRes, err = parser.Parse(tmpFile, f, parseBuf)
+	if err != nil {
+		return nil, fmt.Errorf("copying src file: %w", err)
+	}
+
+	return parseRes, nil
+}
+
+// Close closes the underlying rule list.
+func (f *Filter) Close() (err error) {
+	if f.ruleList == nil {
+		return nil
+	}
+
+	return f.ruleList.Close()
+}
+
+// filterUpdate represents a single ongoing rule-list filter update.
+//
+//lint:ignore U1000 TODO(a.garipov): Use.
+type filterUpdate struct {
+	httpCli  *http.Client
+	cacheDir string
+	name     string
+	parseBuf []byte
+	maxSize  datasize.ByteSize
+}
+
+// process runs an update of a single rule-list.
+func (u *filterUpdate) process(ctx context.Context, f *Filter) (err error) {
+	prevChecksum := f.checksum
+	parseRes, err := f.Refresh(ctx, u.parseBuf, u.httpCli, u.cacheDir, u.maxSize)
+	if err != nil {
+		return fmt.Errorf("updating %s: %w", f.uid, err)
+	}
+
+	if prevChecksum == parseRes.Checksum {
+		log.Info("filtering: filter %q: filter %q: no change", u.name, f.uid)
+
+		return nil
+	}
+
+	log.Info(
+		"filtering: updated filter %q: filter %q: %d bytes, %d rules",
+		u.name,
+		f.uid,
+		parseRes.BytesWritten,
+		parseRes.RulesCount,
+	)
+
+	return nil
+}
diff --git a/internal/filtering/rulelist/filter_test.go b/internal/filtering/rulelist/filter_test.go
new file mode 100644
index 00000000..93cd6e9c
--- /dev/null
+++ b/internal/filtering/rulelist/filter_test.go
@@ -0,0 +1,107 @@
+package rulelist_test
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/filtering/rulelist"
+	"github.com/AdguardTeam/golibs/testutil"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFilter_Refresh(t *testing.T) {
+	cacheDir := t.TempDir()
+	uid := rulelist.MustNewUID()
+
+	initialFile := filepath.Join(cacheDir, "initial.txt")
+	initialData := []byte(
+		testRuleTextTitle +
+			testRuleTextBlocked,
+	)
+	writeErr := os.WriteFile(initialFile, initialData, 0o644)
+	require.NoError(t, writeErr)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		pt := testutil.PanicT{}
+
+		_, err := io.WriteString(w, testRuleTextTitle+testRuleTextBlocked)
+		require.NoError(pt, err)
+	}))
+
+	srvURL, urlErr := url.Parse(srv.URL)
+	require.NoError(t, urlErr)
+
+	testCases := []struct {
+		url           *url.URL
+		name          string
+		wantNewErrMsg string
+	}{{
+		url:           nil,
+		name:          "nil_url",
+		wantNewErrMsg: "no url",
+	}, {
+		url: &url.URL{
+			Scheme: "ftp",
+		},
+		name:          "bad_scheme",
+		wantNewErrMsg: `bad url scheme: "ftp"`,
+	}, {
+		name: "file",
+		url: &url.URL{
+			Scheme: "file",
+			Path:   initialFile,
+		},
+		wantNewErrMsg: "",
+	}, {
+		name:          "http",
+		url:           srvURL,
+		wantNewErrMsg: "",
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			f, err := rulelist.NewFilter(&rulelist.FilterConfig{
+				URL:         tc.url,
+				Name:        tc.name,
+				UID:         uid,
+				URLFilterID: testURLFilterID,
+				Enabled:     true,
+			})
+			if tc.wantNewErrMsg != "" {
+				assert.EqualError(t, err, tc.wantNewErrMsg)
+
+				return
+			}
+
+			testutil.CleanupAndRequireSuccess(t, f.Close)
+
+			require.NotNil(t, f)
+
+			ctx, cancel := context.WithTimeout(context.Background(), testTimeout)
+			t.Cleanup(cancel)
+
+			buf := make([]byte, rulelist.DefaultRuleBufSize)
+			cli := &http.Client{
+				Timeout: testTimeout,
+			}
+
+			res, err := f.Refresh(ctx, buf, cli, cacheDir, rulelist.DefaultMaxRuleListSize)
+			require.NoError(t, err)
+
+			assert.Equal(t, testTitle, res.Title)
+			assert.Equal(t, len(testRuleTextBlocked), res.BytesWritten)
+			assert.Equal(t, 1, res.RulesCount)
+
+			// Check that the cached file exists.
+			_, err = os.Stat(filepath.Join(cacheDir, uid.String()+".txt"))
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/internal/filtering/rulelist/parser_test.go b/internal/filtering/rulelist/parser_test.go
index 5554458d..45a8e465 100644
--- a/internal/filtering/rulelist/parser_test.go
+++ b/internal/filtering/rulelist/parser_test.go
@@ -69,12 +69,12 @@ func TestParser_Parse(t *testing.T) {
 		wantWritten:  len(testRuleTextBlocked) + len(testRuleTextHTML),
 	}, {
 		name: "title",
-		in: "! Title:  Test Title \n" +
+		in: testRuleTextTitle +
 			"! Title: Bad, Ignored Title\n" +
 			testRuleTextBlocked,
 		wantDst:      testRuleTextBlocked,
 		wantErrMsg:   "",
-		wantTitle:    "Test Title",
+		wantTitle:    testTitle,
 		wantRulesNum: 1,
 		wantWritten:  len(testRuleTextBlocked),
 	}, {
@@ -87,14 +87,14 @@ func TestParser_Parse(t *testing.T) {
 		wantWritten:  len(testRuleTextCosmetic),
 	}, {
 		name: "bad_char",
-		in: "! Title:  Test Title \n" +
+		in: testRuleTextTitle +
 			testRuleTextBlocked +
 			">>>\x7F<<<",
 		wantDst: testRuleTextBlocked,
 		wantErrMsg: "line 3: " +
 			"character 4: " +
 			"likely binary character '\\x7f'",
-		wantTitle:    "Test Title",
+		wantTitle:    testTitle,
 		wantRulesNum: 1,
 		wantWritten:  len(testRuleTextBlocked),
 	}, {
diff --git a/internal/filtering/rulelist/rulelist.go b/internal/filtering/rulelist/rulelist.go
index 464650a1..e0fd61b4 100644
--- a/internal/filtering/rulelist/rulelist.go
+++ b/internal/filtering/rulelist/rulelist.go
@@ -1,9 +1,55 @@
 // Package rulelist contains the implementation of the standard rule-list
 // filter that wraps an urlfilter filtering-engine.
 //
-// TODO(a.garipov): Expand.
+// TODO(a.garipov): Add a new update worker.
 package rulelist
 
+import (
+	"fmt"
+
+	"github.com/c2h5oh/datasize"
+	"github.com/google/uuid"
+)
+
 // DefaultRuleBufSize is the default length of a buffer used to read a line with
 // a filtering rule, in bytes.
+//
+// TODO(a.garipov): Consider using [datasize.ByteSize].  It is currently only
+// used as an int.
 const DefaultRuleBufSize = 1024
+
+// DefaultMaxRuleListSize is the default maximum filtering-rule list size.
+const DefaultMaxRuleListSize = 64 * datasize.MB
+
+// URLFilterID is a semantic type-alias for IDs used for working with package
+// urlfilter.
+type URLFilterID = int
+
+// UID is the type for the unique IDs of filtering-rule lists.
+type UID uuid.UUID
+
+// NewUID returns a new filtering-rule list UID.  Any error returned is an error
+// from the cryptographic randomness reader.
+func NewUID() (uid UID, err error) {
+	uuidv7, err := uuid.NewV7()
+
+	return UID(uuidv7), err
+}
+
+// MustNewUID is a wrapper around [NewUID] that panics if there is an error.
+func MustNewUID() (uid UID) {
+	uid, err := NewUID()
+	if err != nil {
+		panic(fmt.Errorf("unexpected uuidv7 error: %w", err))
+	}
+
+	return uid
+}
+
+// type check
+var _ fmt.Stringer = UID{}
+
+// String implements the [fmt.Stringer] interface for UID.
+func (id UID) String() (s string) {
+	return uuid.UUID(id).String()
+}
diff --git a/internal/filtering/rulelist/rulelist_test.go b/internal/filtering/rulelist/rulelist_test.go
index aec6f33b..dc79d503 100644
--- a/internal/filtering/rulelist/rulelist_test.go
+++ b/internal/filtering/rulelist/rulelist_test.go
@@ -1,16 +1,34 @@
 package rulelist_test
 
-import "time"
+import (
+	"testing"
+	"time"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/filtering/rulelist"
+	"github.com/AdguardTeam/golibs/testutil"
+)
+
+func TestMain(m *testing.M) {
+	testutil.DiscardLogOutput(m)
+}
 
 // testTimeout is the common timeout for tests.
 const testTimeout = 1 * time.Second
 
-// Common texts for tests.
+// testURLFilterID is the common [rulelist.URLFilterID] for tests.
+const testURLFilterID rulelist.URLFilterID = 1
+
+// testTitle is the common title for tests.
+const testTitle = "Test Title"
+
+// Common rule texts for tests.
 const (
 	testRuleTextBadTab      = "||bad-tab-and-comment.example^\t# A comment.\n"
 	testRuleTextBlocked     = "||blocked.example^\n"
+	testRuleTextBlocked2    = "||blocked-2.example^\n"
 	testRuleTextEtcHostsTab = "0.0.0.0 tab..example^\t# A comment.\n"
 	testRuleTextHTML        = "<!DOCTYPE html>\n"
+	testRuleTextTitle       = "! Title:  " + testTitle + " \n"
 
 	// testRuleTextCosmetic is a cosmetic rule with a zero-width non-joiner.
 	//
diff --git a/internal/filtering/servicelist.go b/internal/filtering/servicelist.go
index ec893ecf..2ee8bf4b 100644
--- a/internal/filtering/servicelist.go
+++ b/internal/filtering/servicelist.go
@@ -12,6 +12,15 @@ type blockedService struct {
 
 // blockedServices contains raw blocked service data.
 var blockedServices = []blockedService{{
+	ID:      "4chan",
+	Name:    "4chan",
+	IconSVG: []byte("<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"currentColor\" viewBox=\"0 0 50 50\"><path d=\"M33.25 2C31.311 2 29 3.724 29 11.928c0 4.614 1.237 8.92 1.29 9.101l.265.909.922-.215a32.132 32.132 0 0 0 5.472-1.907C39.37 18.711 45 15.614 45 10.75 45 8.098 43.789 5 40.375 5c-.996 0-1.807.356-2.387.736C36.868 4.038 35.13 2 33.25 2zM11.852 4C8.297 4 6 5.956 6 8.984c0 .975.355 1.752.746 2.325C5.044 12.389 3 14.129 3 16.25c0 1.428.97 4.75 9.943 4.75 5.104 0 8.958-1.248 9.12-1.3l.837-.276-.17-.865c-.042-.215-1.054-5.3-3.75-9.905C18.038 7.044 15.335 4 11.852 4zm8.22 24.057-.836.228c-.273.075-2.742.774-5.336 2.336-3.184 1.916-6.9 5.436-6.9 9.047C7 43.987 9.755 46 11.617 46a4.894 4.894 0 0 0 2.791-.877C15.383 46.262 17.144 48 19.316 48 22.957 48 23 41.027 23 40.957c0-6.061-2.477-11.86-2.582-12.103l-.346-.797zm16.67.943c-5.242 0-8.636 1.001-8.777 1.043l-.83.248.127.855c.02.138.518 3.416 1.88 6.627C31.395 43.078 34.483 46 37.845 46 42.704 46 44 43.161 44 41.484a4.94 4.94 0 0 0-.768-2.611C44.666 37.885 47 35.971 47 33.984 47 29.916 39.403 29 36.742 29z\"/></svg>"),
+	Rules: []string{
+		"||4cdn.org^",
+		"||4chan.org^",
+		"||4channel.org^",
+	},
+}, {
 	ID:      "500px",
 	Name:    "500px",
 	IconSVG: []byte("<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"currentColor\" viewBox=\"0 0 50 50\"><path d=\"M 5 14 L 2.5 26 L 6.800781 26 C 6.800781 26 7.699219 24.300781 10.199219 24.300781 C 12.699219 24.300781 14 26.199219 14 28.300781 C 14 30.402344 12.5 32.800781 10.199219 32.800781 C 7.898438 32.800781 6.5 30.398438 6.5 29 L 2 29 C 2 30.199219 3 36 10.199219 36 C 15.15625 36 17.417969 33.121094 18.015625 31.898438 C 19.386719 34.34375 21.992188 36 24.984375 36 C 27.253906 36 29.777344 34.808594 32.5 32.453125 C 35.222656 34.808594 37.746094 36 40.015625 36 C 44.417969 36 48 32.410156 48 28 C 48 23.589844 44.417969 20 40.015625 20 C 37.746094 20 35.222656 21.191406 32.5 23.546875 C 29.777344 21.191406 27.253906 20 24.984375 20 C 21.832031 20 19.105469 21.847656 17.8125 24.511719 C 17.113281 23.382813 15.414063 21 11.902344 21 C 8.101563 21 7.300781 22.597656 7.300781 22.597656 C 7.300781 22.597656 7.699219 21.300781 8.300781 18 L 17 18 L 17 14 Z M 24.984375 25 C 25.453125 25 26.800781 25.226563 29.230469 27.328125 L 30.011719 28 L 29.230469 28.671875 C 26.800781 30.773438 25.453125 31 24.984375 31 C 23.339844 31 22 29.652344 22 28 C 22 26.347656 23.339844 25 24.984375 25 Z M 40.015625 25 C 41.660156 25 43 26.347656 43 28 C 43 29.652344 41.660156 31 40.015625 31 C 39.546875 31 38.199219 30.773438 35.769531 28.671875 L 34.988281 28 L 35.769531 27.328125 C 38.199219 25.226563 39.546875 25 40.015625 25 Z\"/></svg>"),
@@ -583,6 +592,14 @@ var blockedServices = []blockedService{{
 		"||discordstatus.com^",
 		"||watchanimeattheoffice.com^",
 	},
+}, {
+	ID:      "discoveryplus",
+	Name:    "Discovery+",
+	IconSVG: []byte("<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"currentColor\" viewBox=\"166 -24 320 320\"><path d=\"M346.4.1h-98.2v71.5a101 101 0 0 0-81.7 98.9c0 58.6 48.2 101 101.2 101h78.7c78.5 0 138.5-59.9 138.5-135.7C485 62.2 424.9.1 346.4.1Zm0 263.5h-78.7a93.3 93.3 0 0 1-11.5-185.7V8.1h90.2c68.5 0 130.5 52.9 130.5 127.7.1 77.2-61.9 127.8-130.5 127.8Z\"/><path d=\"M345.8 22h-77.3v56c45.5 0 92 37.7 92 93.2S315.3 251 315.3 251h30.5c61.5 0 117.7-45.1 117.7-114.4C463.5 66.1 403.1 22 345.8 22Z\"/><path d=\"M347.5 170a80 80 0 0 1-80 80 80 80 0 0 1-80-80 80 80 0 0 1 80-80 80 80 0 0 1 80 80z\"/></svg>"),
+	Rules: []string{
+		"||disco-api.com^",
+		"||discoveryplus.com^",
+	},
 }, {
 	ID:      "disneyplus",
 	Name:    "Disney+",
@@ -1449,6 +1466,16 @@ var blockedServices = []blockedService{{
 		"||flickrpro.com^",
 		"||staticflickr.com^",
 	},
+}, {
+	ID:      "globoplay",
+	Name:    "Globoplay",
+	IconSVG: []byte("<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"currentColor\" viewBox=\"30 -5 90 90\"><path d=\"M36.45 18.035a8.498 8.498 0 0 0-6.298 7.33 8.23 8.23 0 0 0 3.298 8.27 8.685 8.685 0 0 0 4.952 1.635 5.696 5.696 0 0 0 4.497-1.714c.06 2.704-1.139 4.685-4.319 4.784a10.012 10.012 0 0 1-5.556-1.535c-.901-.535-1.337-.376-1.793.535-.257.505-.505 1.04-.782 1.555-.397.723-.258 1.178.465 1.773a11.886 11.886 0 0 0 7.23 2.218c8.063 0 9.559-5.962 9.559-10.707V19.67c.02-1.753.079-1.654-2.457-1.654a3.16 3.16 0 0 0-1.584.238c-.327.258-.387.753-.387 1.535a6.601 6.601 0 0 0-6.825-1.753m2.469 13.153c-2.486-.02-4.319-1.654-4.319-4.556a4.15 4.15 0 0 1 4.338-4.467 4.19 4.19 0 0 1 4.16 4.507h-.02a4.16 4.16 0 0 1-4.144 4.516h-.015m76.025 14.606c-.644 1.872-1.337 3.705-1.981 5.557-.476 1.347-1.05 2.843-1.555 4.319 0 0-2.645-6.795-3.863-9.905a1.11 1.11 0 0 0-1.229-.852h-2.753c-1.436 0-1.496.079-.911 1.416 2.07 4.755 6.606 15.095 6.606 15.095-.387.923-.851 1.81-1.386 2.655a2.042 2.042 0 0 1-2.477.99c-1.674-.396-1.674-.376-2.486 1.199a8.951 8.951 0 0 0-.336.594c-.288.505-.466 1.178.138 1.496a5.717 5.717 0 0 0 3.387 1.137h.071c.088-.001.178-.004.266-.008 3.19 0 5.131-2.892 5.943-4.873 1.288-3.23 2.952-7.191 4.259-10.44 1.06-2.665 2.16-5.3 3.15-7.924.436-1.08.238-1.397-.931-1.397-.862 0-1.714.06-2.555 0a1.168 1.168 0 0 0-1.357.941M76.237 12.072V34.1c-.016.288.046.575.178.832.337.515 3.675.554 3.962 0 .238-.308.119-1.397.238-1.298a7.696 7.696 0 0 0 11.153-.892c2.703-2.931 2.684-8.775.237-11.746a8.19 8.19 0 0 0-6.517-3.25 6.754 6.754 0 0 0-4.507 1.813c-.02-.08-.06-5.28-.079-7.408 0-.882-.267-1.298-1.258-1.298-.733.06-1.317.02-2.17 0h-.065c-.806 0-1.172.36-1.172 1.219m8.486 19.155a4.25 4.25 0 0 1-3.92-4.555c.06-2.734 1.872-4.487 4.24-4.487a4.22 4.22 0 0 1 4.24 4.546 4.249 4.249 0 0 1-4.237 4.508 4.33 4.33 0 0 1-.323-.012m-23.521 15.39c0-1.297.079-1.693-1.278-1.693h-1.872c-.773-.11-1.05.267-1.05.99v22.098c0 .713.218 1.07.99 1.07h1.773c1.714 0 1.714 0 1.714-1.655v-6.933c.475.297.723.495 1.05.674a6.815 6.815 0 0 0 7.101.386 9.033 9.033 0 0 0 4.576-10.281c-.853-3.919-4.351-6.738-7.994-6.737-1.726 0-3.485.633-5.01 2.081m4.445 11.341a4.328 4.328 0 0 1-4.249-4.596 4.22 4.22 0 0 1 4.447-4.467c2.684.1 4.081 1.952 4.081 4.507a4.23 4.23 0 0 1-4.215 4.557h-.064M87.29 45.776a9.231 9.231 0 0 0-.753 14.738 7.084 7.084 0 0 0 5.2 1.832 6.24 6.24 0 0 0 4.557-2.06c0 1.734.317 1.734 1.892 1.734h1.377c.901.079 1.258-.377 1.258-1.209V46.033c0-.762-.278-1.258-1.16-1.159h-1.574c-1.753-.02-1.535 0-1.753 1.595l-.773-.495a6.925 6.925 0 0 0-4.269-1.47c-1.399 0-2.8.423-4.001 1.272m.564 7.626v-.04a4.279 4.279 0 0 1 4.16-4.487l.154.005a4.348 4.348 0 0 1 4.145 4.542 4.279 4.279 0 0 1-4.26 4.596l-.105.001c-2.372 0-4.094-1.972-4.094-4.617m-31.291-26.91a8.855 8.855 0 0 0 9.053 9.217 8.855 8.855 0 0 0 8.647-9.058c.001-.067.002-.133.001-.2a8.736 8.736 0 0 0-8.787-8.684h-.071a8.846 8.846 0 0 0-8.843 8.726m8.63 4.806a4.487 4.487 0 0 1-4.143-4.807c.002-.069.004-.138.01-.207a4.299 4.299 0 0 1 8.579.564v.06a4.358 4.358 0 0 1-4.32 4.397 4.08 4.08 0 0 1-.125-.008m30.527-4.665a8.816 8.816 0 1 0 17.63.258 8.816 8.816 0 0 0-8.686-8.945 8.817 8.817 0 0 0-8.944 8.686m4.478.377a4.378 4.378 0 0 1 4.17-4.863 4.259 4.259 0 0 1 4.437 4.487v.02a4.338 4.338 0 0 1-4.16 4.655h-.021a4.428 4.428 0 0 1-4.426-4.299M77.93 37.762c-1.228.02-1.397.198-1.397 1.436v21.514c0 .89.307 1.346 1.298 1.287.722-.04 1.446-.04 2.169 0 .822.04 1.139-.297 1.139-1.149V49.895c0-3.644-.02-7.31 0-10.974 0-.822-.297-1.159-1.139-1.159h-2.07ZM50.846 10.505c-.669.004-.913.505-.913 1.408v11.252c-.02 1.09-.02 2.199 0 3.21v7.923c-.02 1.317.812 1.694 1.713 1.317.456-.168 1.07-.485 1.377-.623 1.506-.674 1.446-1.21 1.446-2.427.06-6.25.06-13.045.06-19.126 0-1.595-.496-1.753-2.407-2.586-.528-.233-.942-.346-1.26-.348h-.016Z\"/></svg>"),
+	Rules: []string{
+		"||globoplay.com.br^",
+		"||globoplay.com^",
+		"||globoplay.globo.com^",
+		"|||cloud-jarvis.globo.com^",
+	},
 }, {
 	ID:      "gog",
 	Name:    "GOG",
@@ -1475,6 +1502,7 @@ var blockedServices = []blockedService{{
 		"||hbomax.com^",
 		"||hbomaxcdn.com^",
 		"||hbonow.com^",
+		"||max.com^",
 		"||maxgo.com^",
 	},
 }, {
@@ -2140,6 +2168,16 @@ var blockedServices = []blockedService{{
 		"||rockstargames.com^",
 		"||rsg.sc^",
 	},
+}, {
+	ID:      "samsung_tv_plus",
+	Name:    "Samsung TV Plus",
+	IconSVG: []byte("<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"currentColor\" viewBox=\"121 -91 672 672\"><path d=\"m710.504 89.711.004 38.892c0 .073.021.14.021.214V352.97c0 21.351-17.05 38.526-38.326 38.835l-.05.052h-.473c-.015 0-.028.004-.042.004h-96.769v31.034a24.11 24.11 0 0 1-24.162 24.163H368.046a24.11 24.11 0 0 1-24.162-24.163v-31.034H208.832v35.86c0 34.394 27.687 62.083 62.081 62.083h457.22c34.395 0 62.085-27.69 62.085-62.083V151.795c0-34.394-27.69-62.084-62.084-62.084zM185.028 0c-34.394 0-62.084 27.69-62.084 62.084V329.78c0 34.393 27.69 62.081 62.083 62.081h23.804V128.817c0-21.546 17.346-38.89 38.892-38.89h38.6l.176-.216h424.005V62.084C710.504 27.69 682.814 0 648.421 0Z\"/></svg>"),
+	Rules: []string{
+		"||internetat.tv^",
+		"||samsung.wurl.tv^",
+		"||samsungcloud.tv^",
+		"||samsungtvplus.com^",
+	},
 }, {
 	ID:      "shein",
 	Name:    "Shein",
@@ -2328,7 +2366,6 @@ var blockedServices = []blockedService{{
 	Name:    "TikTok",
 	IconSVG: []byte("<svg xmlns=\"http://www.w3.org/2000/svg\" fill=\"currentColor\" viewBox=\"0 0 50 50\"><path d=\"M41 4H9C6.243 4 4 6.243 4 9v32c0 2.757 2.243 5 5 5h32c2.757 0 5-2.243 5-5V9c0-2.757-2.243-5-5-5zm-3.994 18.323a7.482 7.482 0 0 1-.69.035 7.492 7.492 0 0 1-6.269-3.388v11.537a8.527 8.527 0 1 1-8.527-8.527c.178 0 .352.016.527.027v4.202c-.175-.021-.347-.053-.527-.053a4.351 4.351 0 1 0 0 8.704c2.404 0 4.527-1.894 4.527-4.298l.042-19.594h4.016a7.488 7.488 0 0 0 6.901 6.685v4.67z\" /></svg>"),
 	Rules: []string{
-		"|p16-tiktokcdn-com.akamaized.net^",
 		"||amemv.com^",
 		"||bdurl.com^",
 		"||bytecdn.cn^",
@@ -2348,6 +2385,7 @@ var blockedServices = []blockedService{{
 		"||muscdn.com^",
 		"||musical.ly^",
 		"||p16-tiktok-*.ibyteimg.com^",
+		"||p16-tiktokcdn-com.akamaized.net^",
 		"||pstatp.com^",
 		"||snssdk.com^",
 		"||tiktok.com^",
@@ -2356,6 +2394,7 @@ var blockedServices = []blockedService{{
 		"||tiktokv.com^",
 		"||ttlivecdn.com.c.bytefcdn-oversea.com^",
 		"||ttlivecdn.com^",
+		"||v*.tiktokcdn-eu.com^",
 	},
 }, {
 	ID:      "tinder",
diff --git a/internal/home/client.go b/internal/home/client.go
index 28edccf5..64e9b677 100644
--- a/internal/home/client.go
+++ b/internal/home/client.go
@@ -1,17 +1,53 @@
 package home
 
 import (
+	"encoding"
 	"fmt"
+	"net"
+	"net/netip"
+	"strings"
 	"time"
 
+	"github.com/AdguardTeam/AdGuardHome/internal/dnsforward"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering/safesearch"
 	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/AdguardTeam/golibs/errors"
+	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/golibs/stringutil"
+	"github.com/google/uuid"
+	"golang.org/x/exp/slices"
 )
 
-// Client contains information about persistent clients.
-type Client struct {
+// UID is the type for the unique IDs of persistent clients.
+type UID uuid.UUID
+
+// NewUID returns a new persistent client UID.  Any error returned is an error
+// from the cryptographic randomness reader.
+func NewUID() (uid UID, err error) {
+	uuidv7, err := uuid.NewV7()
+
+	return UID(uuidv7), err
+}
+
+// type check
+var _ encoding.TextMarshaler = UID{}
+
+// MarshalText implements the [encoding.TextMarshaler] for UID.
+func (uid UID) MarshalText() ([]byte, error) {
+	return uuid.UUID(uid).MarshalText()
+}
+
+// type check
+var _ encoding.TextUnmarshaler = (*UID)(nil)
+
+// UnmarshalText implements the [encoding.TextUnmarshaler] interface for UID.
+func (uid *UID) UnmarshalText(data []byte) error {
+	return (*uuid.UUID)(uid).UnmarshalText(data)
+}
+
+// persistentClient contains information about persistent clients.
+type persistentClient struct {
 	// upstreamConfig is the custom upstream configuration for this client.  If
 	// it's nil, it has not been initialized yet.  If it's non-nil and empty,
 	// there are no valid upstreams.  If it's non-nil and non-empty, these
@@ -27,10 +63,18 @@ type Client struct {
 
 	Name string
 
-	IDs       []string
 	Tags      []string
 	Upstreams []string
 
+	IPs []netip.Addr
+	// TODO(s.chzhen):  Use netutil.Prefix.
+	Subnets   []netip.Prefix
+	MACs      []net.HardwareAddr
+	ClientIDs []string
+
+	// UID is the unique identifier of the persistent client.
+	UID UID
+
 	UpstreamsCacheSize    uint32
 	UpstreamsCacheEnabled bool
 
@@ -43,21 +87,153 @@ type Client struct {
 	IgnoreStatistics      bool
 }
 
-// ShallowClone returns a deep copy of the client, except upstreamConfig,
+// setTags sets the tags if they are known, otherwise logs an unknown tag.
+func (c *persistentClient) setTags(tags []string, known *stringutil.Set) {
+	for _, t := range tags {
+		if !known.Has(t) {
+			log.Info("skipping unknown tag %q", t)
+
+			continue
+		}
+
+		c.Tags = append(c.Tags, t)
+	}
+
+	slices.Sort(c.Tags)
+}
+
+// setIDs parses a list of strings into typed fields and returns an error if
+// there is one.
+func (c *persistentClient) setIDs(ids []string) (err error) {
+	for _, id := range ids {
+		err = c.setID(id)
+		if err != nil {
+			return err
+		}
+	}
+
+	slices.SortFunc(c.IPs, netip.Addr.Compare)
+
+	// TODO(s.chzhen):  Use netip.PrefixCompare in Go 1.23.
+	slices.SortFunc(c.Subnets, subnetCompare)
+	slices.SortFunc(c.MACs, slices.Compare[net.HardwareAddr])
+	slices.Sort(c.ClientIDs)
+
+	return nil
+}
+
+// subnetCompare is a comparison function for the two subnets.  It returns -1 if
+// x sorts before y, 1 if x sorts after y, and 0 if their relative sorting
+// position is the same.
+func subnetCompare(x, y netip.Prefix) (cmp int) {
+	if x == y {
+		return 0
+	}
+
+	xAddr, xBits := x.Addr(), x.Bits()
+	yAddr, yBits := y.Addr(), y.Bits()
+	if xBits == yBits {
+		return xAddr.Compare(yAddr)
+	}
+
+	if xBits > yBits {
+		return -1
+	} else {
+		return 1
+	}
+}
+
+// setID parses id into typed field if there is no error.
+func (c *persistentClient) setID(id string) (err error) {
+	if id == "" {
+		return errors.Error("clientid is empty")
+	}
+
+	var ip netip.Addr
+	if ip, err = netip.ParseAddr(id); err == nil {
+		c.IPs = append(c.IPs, ip)
+
+		return nil
+	}
+
+	var subnet netip.Prefix
+	if subnet, err = netip.ParsePrefix(id); err == nil {
+		c.Subnets = append(c.Subnets, subnet)
+
+		return nil
+	}
+
+	var mac net.HardwareAddr
+	if mac, err = net.ParseMAC(id); err == nil {
+		c.MACs = append(c.MACs, mac)
+
+		return nil
+	}
+
+	err = dnsforward.ValidateClientID(id)
+	if err != nil {
+		// Don't wrap the error, because it's informative enough as is.
+		return err
+	}
+
+	c.ClientIDs = append(c.ClientIDs, strings.ToLower(id))
+
+	return nil
+}
+
+// ids returns a list of client ids containing at least one element.
+func (c *persistentClient) ids() (ids []string) {
+	ids = make([]string, 0, c.idsLen())
+
+	for _, ip := range c.IPs {
+		ids = append(ids, ip.String())
+	}
+
+	for _, subnet := range c.Subnets {
+		ids = append(ids, subnet.String())
+	}
+
+	for _, mac := range c.MACs {
+		ids = append(ids, mac.String())
+	}
+
+	return append(ids, c.ClientIDs...)
+}
+
+// idsLen returns a length of client ids.
+func (c *persistentClient) idsLen() (n int) {
+	return len(c.IPs) + len(c.Subnets) + len(c.MACs) + len(c.ClientIDs)
+}
+
+// equalIDs returns true if the ids of the current and previous clients are the
+// same.
+func (c *persistentClient) equalIDs(prev *persistentClient) (equal bool) {
+	return slices.Equal(c.IPs, prev.IPs) &&
+		slices.Equal(c.Subnets, prev.Subnets) &&
+		slices.EqualFunc(c.MACs, prev.MACs, slices.Equal[net.HardwareAddr]) &&
+		slices.Equal(c.ClientIDs, prev.ClientIDs)
+}
+
+// shallowClone returns a deep copy of the client, except upstreamConfig,
 // safeSearchConf, SafeSearch fields, because it's difficult to copy them.
-func (c *Client) ShallowClone() (sh *Client) {
-	clone := *c
+func (c *persistentClient) shallowClone() (clone *persistentClient) {
+	clone = &persistentClient{}
+	*clone = *c
 
 	clone.BlockedServices = c.BlockedServices.Clone()
-	clone.IDs = stringutil.CloneSlice(c.IDs)
-	clone.Tags = stringutil.CloneSlice(c.Tags)
-	clone.Upstreams = stringutil.CloneSlice(c.Upstreams)
+	clone.Tags = slices.Clone(c.Tags)
+	clone.Upstreams = slices.Clone(c.Upstreams)
 
-	return &clone
+	clone.IPs = slices.Clone(c.IPs)
+	clone.Subnets = slices.Clone(c.Subnets)
+	clone.MACs = slices.Clone(c.MACs)
+	clone.ClientIDs = slices.Clone(c.ClientIDs)
+
+	return clone
 }
 
 // closeUpstreams closes the client-specific upstream config of c if any.
-func (c *Client) closeUpstreams() (err error) {
+func (c *persistentClient) closeUpstreams() (err error) {
 	if c.upstreamConfig != nil {
 		if err = c.upstreamConfig.Close(); err != nil {
 			return fmt.Errorf("closing upstreams of client %q: %w", c.Name, err)
@@ -68,7 +244,7 @@ func (c *Client) closeUpstreams() (err error) {
 }
 
 // setSafeSearch initializes and sets the safe search filter for this client.
-func (c *Client) setSafeSearch(
+func (c *persistentClient) setSafeSearch(
 	conf filtering.SafeSearchConfig,
 	cacheSize uint,
 	cacheTTL time.Duration,
diff --git a/internal/home/client_internal_test.go b/internal/home/client_internal_test.go
new file mode 100644
index 00000000..c360cb19
--- /dev/null
+++ b/internal/home/client_internal_test.go
@@ -0,0 +1,124 @@
+package home
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPersistentClient_EqualIDs(t *testing.T) {
+	const (
+		ip  = "0.0.0.0"
+		ip1 = "1.1.1.1"
+		ip2 = "2.2.2.2"
+
+		cidr  = "0.0.0.0/0"
+		cidr1 = "1.1.1.1/11"
+		cidr2 = "2.2.2.2/22"
+
+		mac  = "00-00-00-00-00-00"
+		mac1 = "11-11-11-11-11-11"
+		mac2 = "22-22-22-22-22-22"
+
+		cli  = "client0"
+		cli1 = "client1"
+		cli2 = "client2"
+	)
+
+	testCases := []struct {
+		name    string
+		ids     []string
+		prevIDs []string
+		want    assert.BoolAssertionFunc
+	}{{
+		name:    "single_ip",
+		ids:     []string{ip1},
+		prevIDs: []string{ip1},
+		want:    assert.True,
+	}, {
+		name:    "single_ip_not_equal",
+		ids:     []string{ip1},
+		prevIDs: []string{ip2},
+		want:    assert.False,
+	}, {
+		name:    "ips_not_equal",
+		ids:     []string{ip1, ip2},
+		prevIDs: []string{ip1, ip},
+		want:    assert.False,
+	}, {
+		name:    "ips_mixed_equal",
+		ids:     []string{ip1, ip2},
+		prevIDs: []string{ip2, ip1},
+		want:    assert.True,
+	}, {
+		name:    "single_subnet",
+		ids:     []string{cidr1},
+		prevIDs: []string{cidr1},
+		want:    assert.True,
+	}, {
+		name:    "subnets_not_equal",
+		ids:     []string{ip1, ip2, cidr1, cidr2},
+		prevIDs: []string{ip1, ip2, cidr1, cidr},
+		want:    assert.False,
+	}, {
+		name:    "subnets_mixed_equal",
+		ids:     []string{ip1, ip2, cidr1, cidr2},
+		prevIDs: []string{cidr2, cidr1, ip2, ip1},
+		want:    assert.True,
+	}, {
+		name:    "single_mac",
+		ids:     []string{mac1},
+		prevIDs: []string{mac1},
+		want:    assert.True,
+	}, {
+		name:    "single_mac_not_equal",
+		ids:     []string{mac1},
+		prevIDs: []string{mac2},
+		want:    assert.False,
+	}, {
+		name:    "macs_not_equal",
+		ids:     []string{ip1, ip2, cidr1, cidr2, mac1, mac2},
+		prevIDs: []string{ip1, ip2, cidr1, cidr2, mac1, mac},
+		want:    assert.False,
+	}, {
+		name:    "macs_mixed_equal",
+		ids:     []string{ip1, ip2, cidr1, cidr2, mac1, mac2},
+		prevIDs: []string{mac2, mac1, cidr2, cidr1, ip2, ip1},
+		want:    assert.True,
+	}, {
+		name:    "single_client_id",
+		ids:     []string{cli1},
+		prevIDs: []string{cli1},
+		want:    assert.True,
+	}, {
+		name:    "single_client_id_not_equal",
+		ids:     []string{cli1},
+		prevIDs: []string{cli2},
+		want:    assert.False,
+	}, {
+		name:    "client_ids_not_equal",
+		ids:     []string{ip1, ip2, cidr1, cidr2, mac1, mac2, cli1, cli2},
+		prevIDs: []string{ip1, ip2, cidr1, cidr2, mac1, mac2, cli1, cli},
+		want:    assert.False,
+	}, {
+		name:    "client_ids_mixed_equal",
+		ids:     []string{ip1, ip2, cidr1, cidr2, mac1, mac2, cli1, cli2},
+		prevIDs: []string{cli2, cli1, mac2, mac1, cidr2, cidr1, ip2, ip1},
+		want:    assert.True,
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			c := &persistentClient{}
+			err := c.setIDs(tc.ids)
+			require.NoError(t, err)
+
+			prev := &persistentClient{}
+			err = prev.setIDs(tc.prevIDs)
+			require.NoError(t, err)
+
+			tc.want(t, c.equalIDs(prev))
+		})
+	}
+}
diff --git a/internal/home/clients.go b/internal/home/clients.go
index d3fe6985..63b9472f 100644
--- a/internal/home/clients.go
+++ b/internal/home/clients.go
@@ -1,7 +1,6 @@
 package home
 
 import (
-	"bytes"
 	"fmt"
 	"net"
 	"net/netip"
@@ -48,8 +47,8 @@ type DHCP interface {
 type clientsContainer struct {
 	// TODO(a.garipov): Perhaps use a number of separate indices for different
 	// types (string, netip.Addr, and so on).
-	list    map[string]*Client // name -> client
-	idIndex map[string]*Client // ID -> client
+	list    map[string]*persistentClient // name -> client
+	idIndex map[string]*persistentClient // ID -> client
 
 	// ipToRC maps IP addresses to runtime client information.
 	ipToRC map[netip.Addr]*client.Runtime
@@ -103,8 +102,8 @@ func (clients *clientsContainer) Init(
 		log.Fatal("clients.list != nil")
 	}
 
-	clients.list = map[string]*Client{}
-	clients.idIndex = map[string]*Client{}
+	clients.list = map[string]*persistentClient{}
+	clients.idIndex = map[string]*persistentClient{}
 	clients.ipToRC = map[netip.Addr]*client.Runtime{}
 
 	clients.allTags = stringutil.NewSet(clientTags...)
@@ -189,6 +188,9 @@ type clientObject struct {
 	Tags      []string `yaml:"tags"`
 	Upstreams []string `yaml:"upstreams"`
 
+	// UID is the unique identifier of the persistent client.
+	UID UID `yaml:"uid"`
+
 	// UpstreamsCacheSize is the DNS cache size (in bytes).
 	//
 	// TODO(d.kolyshev): Use [datasize.Bytesize].
@@ -207,66 +209,83 @@ type clientObject struct {
 	IgnoreStatistics bool `yaml:"ignore_statistics"`
 }
 
+// toPersistent returns an initialized persistent client if there are no errors.
+func (o *clientObject) toPersistent(
+	filteringConf *filtering.Config,
+	allTags *stringutil.Set,
+) (cli *persistentClient, err error) {
+	cli = &persistentClient{
+		Name: o.Name,
+
+		Upstreams: o.Upstreams,
+
+		UID: o.UID,
+
+		UseOwnSettings:        !o.UseGlobalSettings,
+		FilteringEnabled:      o.FilteringEnabled,
+		ParentalEnabled:       o.ParentalEnabled,
+		safeSearchConf:        o.SafeSearchConf,
+		SafeBrowsingEnabled:   o.SafeBrowsingEnabled,
+		UseOwnBlockedServices: !o.UseGlobalBlockedServices,
+		IgnoreQueryLog:        o.IgnoreQueryLog,
+		IgnoreStatistics:      o.IgnoreStatistics,
+		UpstreamsCacheEnabled: o.UpstreamsCacheEnabled,
+		UpstreamsCacheSize:    o.UpstreamsCacheSize,
+	}
+
+	err = cli.setIDs(o.IDs)
+	if err != nil {
+		return nil, fmt.Errorf("parsing ids: %w", err)
+	}
+
+	if (cli.UID == UID{}) {
+		cli.UID, err = NewUID()
+		if err != nil {
+			return nil, fmt.Errorf("generating uid: %w", err)
+		}
+	}
+
+	if o.SafeSearchConf.Enabled {
+		o.SafeSearchConf.CustomResolver = safeSearchResolver{}
+
+		err = cli.setSafeSearch(
+			o.SafeSearchConf,
+			filteringConf.SafeSearchCacheSize,
+			time.Minute*time.Duration(filteringConf.CacheTime),
+		)
+		if err != nil {
+			return nil, fmt.Errorf("init safesearch %q: %w", cli.Name, err)
+		}
+	}
+
+	err = o.BlockedServices.Validate()
+	if err != nil {
+		return nil, fmt.Errorf("init blocked services %q: %w", cli.Name, err)
+	}
+
+	cli.BlockedServices = o.BlockedServices.Clone()
+
+	cli.setTags(o.Tags, allTags)
+
+	return cli, nil
+}
+
 // addFromConfig initializes the clients container with objects from the
 // configuration file.
 func (clients *clientsContainer) addFromConfig(
 	objects []*clientObject,
 	filteringConf *filtering.Config,
 ) (err error) {
-	for _, o := range objects {
-		cli := &Client{
-			Name: o.Name,
-
-			IDs:       o.IDs,
-			Upstreams: o.Upstreams,
-
-			UseOwnSettings:        !o.UseGlobalSettings,
-			FilteringEnabled:      o.FilteringEnabled,
-			ParentalEnabled:       o.ParentalEnabled,
-			safeSearchConf:        o.SafeSearchConf,
-			SafeBrowsingEnabled:   o.SafeBrowsingEnabled,
-			UseOwnBlockedServices: !o.UseGlobalBlockedServices,
-			IgnoreQueryLog:        o.IgnoreQueryLog,
-			IgnoreStatistics:      o.IgnoreStatistics,
-			UpstreamsCacheEnabled: o.UpstreamsCacheEnabled,
-			UpstreamsCacheSize:    o.UpstreamsCacheSize,
-		}
-
-		if o.SafeSearchConf.Enabled {
-			o.SafeSearchConf.CustomResolver = safeSearchResolver{}
-
-			err = cli.setSafeSearch(
-				o.SafeSearchConf,
-				filteringConf.SafeSearchCacheSize,
-				time.Minute*time.Duration(filteringConf.CacheTime),
-			)
-			if err != nil {
-				log.Error("clients: init client safesearch %q: %s", cli.Name, err)
-
-				continue
-			}
-		}
-
-		err = o.BlockedServices.Validate()
+	for i, o := range objects {
+		var cli *persistentClient
+		cli, err = o.toPersistent(filteringConf, clients.allTags)
 		if err != nil {
-			return fmt.Errorf("clients: init client blocked services %q: %w", cli.Name, err)
+			return fmt.Errorf("clients: init persistent client at index %d: %w", i, err)
 		}
 
-		cli.BlockedServices = o.BlockedServices.Clone()
-
-		for _, t := range o.Tags {
-			if clients.allTags.Has(t) {
-				cli.Tags = append(cli.Tags, t)
-			} else {
-				log.Info("clients: skipping unknown tag %q", t)
-			}
-		}
-
-		slices.Sort(cli.Tags)
-
-		_, err = clients.Add(cli)
+		_, err = clients.add(cli)
 		if err != nil {
-			log.Error("clients: adding clients %s: %s", cli.Name, err)
+			log.Error("clients: adding client at index %d %s: %s", i, cli.Name, err)
 		}
 	}
 
@@ -286,10 +305,12 @@ func (clients *clientsContainer) forConfig() (objs []*clientObject) {
 
 			BlockedServices: cli.BlockedServices.Clone(),
 
-			IDs:       stringutil.CloneSlice(cli.IDs),
+			IDs:       cli.ids(),
 			Tags:      stringutil.CloneSlice(cli.Tags),
 			Upstreams: stringutil.CloneSlice(cli.Upstreams),
 
+			UID: cli.UID,
+
 			UseGlobalSettings:        !cli.UseOwnSettings,
 			FilteringEnabled:         cli.FilteringEnabled,
 			ParentalEnabled:          cli.ParentalEnabled,
@@ -352,10 +373,10 @@ func (clients *clientsContainer) clientSource(ip netip.Addr) (src client.Source)
 	return src
 }
 
-// findMultiple is a wrapper around Find to make it a valid client finder for
-// the query log.  c is never nil; if no information about the client is found,
-// it returns an artificial client record by only setting the blocking-related
-// fields.  err is always nil.
+// findMultiple is a wrapper around [clientsContainer.find] to make it a valid
+// client finder for the query log.  c is never nil; if no information about the
+// client is found, it returns an artificial client record by only setting the
+// blocking-related fields.  err is always nil.
 func (clients *clientsContainer) findMultiple(ids []string) (c *querylog.Client, err error) {
 	var artClient *querylog.Client
 	var art bool
@@ -389,7 +410,7 @@ func (clients *clientsContainer) clientOrArtificial(
 		}
 	}()
 
-	cli, ok := clients.Find(id)
+	cli, ok := clients.find(id)
 	if ok {
 		return &querylog.Client{
 			Name:           cli.Name,
@@ -413,8 +434,8 @@ func (clients *clientsContainer) clientOrArtificial(
 	}, true
 }
 
-// Find returns a shallow copy of the client if there is one found.
-func (clients *clientsContainer) Find(id string) (c *Client, ok bool) {
+// find returns a shallow copy of the client if there is one found.
+func (clients *clientsContainer) find(id string) (c *persistentClient, ok bool) {
 	clients.lock.Lock()
 	defer clients.lock.Unlock()
 
@@ -423,12 +444,12 @@ func (clients *clientsContainer) Find(id string) (c *Client, ok bool) {
 		return nil, false
 	}
 
-	return c.ShallowClone(), true
+	return c.shallowClone(), true
 }
 
-// shouldCountClient is a wrapper around Find to make it a valid client
-// information finder for the statistics.  If no information about the client
-// is found, it returns true.
+// shouldCountClient is a wrapper around [clientsContainer.find] to make it a
+// valid client information finder for the statistics.  If no information about
+// the client is found, it returns true.
 func (clients *clientsContainer) shouldCountClient(ids []string) (y bool) {
 	clients.lock.Lock()
 	defer clients.lock.Unlock()
@@ -496,7 +517,7 @@ func (clients *clientsContainer) UpstreamConfigByID(
 
 // findLocked searches for a client by its ID.  clients.lock is expected to be
 // locked.
-func (clients *clientsContainer) findLocked(id string) (c *Client, ok bool) {
+func (clients *clientsContainer) findLocked(id string) (c *persistentClient, ok bool) {
 	c, ok = clients.idIndex[id]
 	if ok {
 		return c, true
@@ -508,13 +529,7 @@ func (clients *clientsContainer) findLocked(id string) (c *Client, ok bool) {
 	}
 
 	for _, c = range clients.list {
-		for _, id := range c.IDs {
-			var subnet netip.Prefix
-			subnet, err = netip.ParsePrefix(id)
-			if err != nil {
-				continue
-			}
-
+		for _, subnet := range c.Subnets {
 			if subnet.Contains(ip) {
 				return c, true
 			}
@@ -527,22 +542,16 @@ func (clients *clientsContainer) findLocked(id string) (c *Client, ok bool) {
 
 // findDHCP searches for a client by its MAC, if the DHCP server is active and
 // there is such client.  clients.lock is expected to be locked.
-func (clients *clientsContainer) findDHCP(ip netip.Addr) (c *Client, ok bool) {
+func (clients *clientsContainer) findDHCP(ip netip.Addr) (c *persistentClient, ok bool) {
 	foundMAC := clients.dhcp.MACByIP(ip)
 	if foundMAC == nil {
 		return nil, false
 	}
 
 	for _, c = range clients.list {
-		for _, id := range c.IDs {
-			mac, err := net.ParseMAC(id)
-			if err != nil {
-				continue
-			}
-
-			if bytes.Equal(mac, foundMAC) {
-				return c, true
-			}
+		_, found := slices.BinarySearchFunc(c.MACs, foundMAC, slices.Compare[net.HardwareAddr])
+		if found {
+			return c, true
 		}
 	}
 
@@ -582,35 +591,26 @@ func (clients *clientsContainer) findRuntimeClient(ip netip.Addr) (rc *client.Ru
 	return rc, ok
 }
 
-// check validates the client.
-func (clients *clientsContainer) check(c *Client) (err error) {
+// check validates the client.  It also sorts the client tags.
+func (clients *clientsContainer) check(c *persistentClient) (err error) {
 	switch {
 	case c == nil:
 		return errors.Error("client is nil")
 	case c.Name == "":
 		return errors.Error("invalid name")
-	case len(c.IDs) == 0:
+	case c.idsLen() == 0:
 		return errors.Error("id required")
 	default:
 		// Go on.
 	}
 
-	for i, id := range c.IDs {
-		var norm string
-		norm, err = normalizeClientIdentifier(id)
-		if err != nil {
-			return fmt.Errorf("client at index %d: %w", i, err)
-		}
-
-		c.IDs[i] = norm
-	}
-
 	for _, t := range c.Tags {
 		if !clients.allTags.Has(t) {
 			return fmt.Errorf("invalid tag: %q", t)
 		}
 	}
 
+	// TODO(s.chzhen):  Move to the constructor.
 	slices.Sort(c.Tags)
 
 	_, err = proxy.ParseUpstreamsConfig(c.Upstreams, &upstream.Options{})
@@ -621,38 +621,9 @@ func (clients *clientsContainer) check(c *Client) (err error) {
 	return nil
 }
 
-// normalizeClientIdentifier returns a normalized version of idStr.  If idStr
-// cannot be normalized, it returns an error.
-func normalizeClientIdentifier(idStr string) (norm string, err error) {
-	if idStr == "" {
-		return "", errors.Error("clientid is empty")
-	}
-
-	var ip netip.Addr
-	if ip, err = netip.ParseAddr(idStr); err == nil {
-		return ip.String(), nil
-	}
-
-	var subnet netip.Prefix
-	if subnet, err = netip.ParsePrefix(idStr); err == nil {
-		return subnet.String(), nil
-	}
-
-	var mac net.HardwareAddr
-	if mac, err = net.ParseMAC(idStr); err == nil {
-		return mac.String(), nil
-	}
-
-	if err = dnsforward.ValidateClientID(idStr); err == nil {
-		return strings.ToLower(idStr), nil
-	}
-
-	return "", fmt.Errorf("bad client identifier %q", idStr)
-}
-
-// Add adds a new client object.  ok is false if such client already exists or
+// add adds a new client object.  ok is false if such client already exists or
 // if an error occurred.
-func (clients *clientsContainer) Add(c *Client) (ok bool, err error) {
+func (clients *clientsContainer) add(c *persistentClient) (ok bool, err error) {
 	err = clients.check(c)
 	if err != nil {
 		return false, err
@@ -668,50 +639,52 @@ func (clients *clientsContainer) Add(c *Client) (ok bool, err error) {
 	}
 
 	// check ID index
-	for _, id := range c.IDs {
-		var c2 *Client
+	ids := c.ids()
+	for _, id := range ids {
+		var c2 *persistentClient
 		c2, ok = clients.idIndex[id]
 		if ok {
 			return false, fmt.Errorf("another client uses the same ID (%q): %q", id, c2.Name)
 		}
 	}
 
-	clients.add(c)
+	clients.addLocked(c)
 
-	log.Debug("clients: added %q: ID:%q [%d]", c.Name, c.IDs, len(clients.list))
+	log.Debug("clients: added %q: ID:%q [%d]", c.Name, ids, len(clients.list))
 
 	return true, nil
 }
 
-// add c to the indexes. clients.lock is expected to be locked.
-func (clients *clientsContainer) add(c *Client) {
+// addLocked c to the indexes.  clients.lock is expected to be locked.
+func (clients *clientsContainer) addLocked(c *persistentClient) {
 	// update Name index
 	clients.list[c.Name] = c
 
 	// update ID index
-	for _, id := range c.IDs {
+	for _, id := range c.ids() {
 		clients.idIndex[id] = c
 	}
 }
 
-// Del removes a client.  ok is false if there is no such client.
-func (clients *clientsContainer) Del(name string) (ok bool) {
+// remove removes a client.  ok is false if there is no such client.
+func (clients *clientsContainer) remove(name string) (ok bool) {
 	clients.lock.Lock()
 	defer clients.lock.Unlock()
 
-	var c *Client
+	var c *persistentClient
 	c, ok = clients.list[name]
 	if !ok {
 		return false
 	}
 
-	clients.del(c)
+	clients.removeLocked(c)
 
 	return true
 }
 
-// del removes c from the indexes. clients.lock is expected to be locked.
-func (clients *clientsContainer) del(c *Client) {
+// removeLocked removes c from the indexes.  clients.lock is expected to be
+// locked.
+func (clients *clientsContainer) removeLocked(c *persistentClient) {
 	if err := c.closeUpstreams(); err != nil {
 		log.Error("client container: removing client %s: %s", c.Name, err)
 	}
@@ -720,13 +693,13 @@ func (clients *clientsContainer) del(c *Client) {
 	delete(clients.list, c.Name)
 
 	// Update the ID index.
-	for _, id := range c.IDs {
+	for _, id := range c.ids() {
 		delete(clients.idIndex, id)
 	}
 }
 
-// Update updates a client by its name.
-func (clients *clientsContainer) Update(prev, c *Client) (err error) {
+// update updates a client by its name.
+func (clients *clientsContainer) update(prev, c *persistentClient) (err error) {
 	err = clients.check(c)
 	if err != nil {
 		// Don't wrap the error since it's informative enough as is.
@@ -744,18 +717,23 @@ func (clients *clientsContainer) Update(prev, c *Client) (err error) {
 		}
 	}
 
+	if c.equalIDs(prev) {
+		clients.removeLocked(prev)
+		clients.addLocked(c)
+
+		return nil
+	}
+
 	// Check the ID index.
-	if !slices.Equal(prev.IDs, c.IDs) {
-		for _, id := range c.IDs {
-			existing, ok := clients.idIndex[id]
-			if ok && existing != prev {
-				return fmt.Errorf("id %q is used by client with name %q", id, existing.Name)
-			}
+	for _, id := range c.ids() {
+		existing, ok := clients.idIndex[id]
+		if ok && existing != prev {
+			return fmt.Errorf("id %q is used by client with name %q", id, existing.Name)
 		}
 	}
 
-	clients.del(prev)
-	clients.add(c)
+	clients.removeLocked(prev)
+	clients.addLocked(c)
 
 	return nil
 }
@@ -928,7 +906,7 @@ func (clients *clientsContainer) addFromSystemARP() {
 // the persistent clients.
 func (clients *clientsContainer) close() (err error) {
 	persistent := maps.Values(clients.list)
-	slices.SortFunc(persistent, func(a, b *Client) (res int) {
+	slices.SortFunc(persistent, func(a, b *persistentClient) (res int) {
 		return strings.Compare(a.Name, b.Name)
 	})
 
diff --git a/internal/home/clients_internal_test.go b/internal/home/clients_internal_test.go
index 93a84b0b..07332ecf 100644
--- a/internal/home/clients_internal_test.go
+++ b/internal/home/clients_internal_test.go
@@ -62,44 +62,46 @@ func TestClients(t *testing.T) {
 
 			cli1IP = netip.MustParseAddr(cli1)
 			cli2IP = netip.MustParseAddr(cli2)
+
+			cliIPv6 = netip.MustParseAddr("1:2:3::4")
 		)
 
-		c := &Client{
-			IDs:  []string{cli1, "1:2:3::4", "aa:aa:aa:aa:aa:aa"},
+		c := &persistentClient{
 			Name: "client1",
+			IPs:  []netip.Addr{cli1IP, cliIPv6},
 		}
 
-		ok, err := clients.Add(c)
+		ok, err := clients.add(c)
 		require.NoError(t, err)
 
 		assert.True(t, ok)
 
-		c = &Client{
-			IDs:  []string{cli2},
+		c = &persistentClient{
 			Name: "client2",
+			IPs:  []netip.Addr{cli2IP},
 		}
 
-		ok, err = clients.Add(c)
+		ok, err = clients.add(c)
 		require.NoError(t, err)
 
 		assert.True(t, ok)
 
-		c, ok = clients.Find(cli1)
+		c, ok = clients.find(cli1)
 		require.True(t, ok)
 
 		assert.Equal(t, "client1", c.Name)
 
-		c, ok = clients.Find("1:2:3::4")
+		c, ok = clients.find("1:2:3::4")
 		require.True(t, ok)
 
 		assert.Equal(t, "client1", c.Name)
 
-		c, ok = clients.Find(cli2)
+		c, ok = clients.find(cli2)
 		require.True(t, ok)
 
 		assert.Equal(t, "client2", c.Name)
 
-		_, ok = clients.Find(cliNone)
+		_, ok = clients.find(cliNone)
 		assert.False(t, ok)
 
 		assert.Equal(t, clients.clientSource(cli1IP), client.SourcePersistent)
@@ -107,17 +109,16 @@ func TestClients(t *testing.T) {
 	})
 
 	t.Run("add_fail_name", func(t *testing.T) {
-		ok, err := clients.Add(&Client{
-			IDs:  []string{"1.2.3.5"},
+		ok, err := clients.add(&persistentClient{
 			Name: "client1",
+			IPs:  []netip.Addr{netip.MustParseAddr("1.2.3.5")},
 		})
 		require.NoError(t, err)
 		assert.False(t, ok)
 	})
 
 	t.Run("add_fail_ip", func(t *testing.T) {
-		ok, err := clients.Add(&Client{
-			IDs:  []string{"2.2.2.2"},
+		ok, err := clients.add(&persistentClient{
 			Name: "client3",
 		})
 		require.Error(t, err)
@@ -125,8 +126,7 @@ func TestClients(t *testing.T) {
 	})
 
 	t.Run("update_fail_ip", func(t *testing.T) {
-		err := clients.Update(&Client{Name: "client1"}, &Client{
-			IDs:  []string{"2.2.2.2"},
+		err := clients.update(&persistentClient{Name: "client1"}, &persistentClient{
 			Name: "client1",
 		})
 		assert.Error(t, err)
@@ -143,13 +143,13 @@ func TestClients(t *testing.T) {
 		prev, ok := clients.list["client1"]
 		require.True(t, ok)
 
-		err := clients.Update(prev, &Client{
-			IDs:  []string{cliNew},
+		err := clients.update(prev, &persistentClient{
 			Name: "client1",
+			IPs:  []netip.Addr{cliNewIP},
 		})
 		require.NoError(t, err)
 
-		_, ok = clients.Find(cliOld)
+		_, ok = clients.find(cliOld)
 		assert.False(t, ok)
 
 		assert.Equal(t, clients.clientSource(cliNewIP), client.SourcePersistent)
@@ -157,14 +157,14 @@ func TestClients(t *testing.T) {
 		prev, ok = clients.list["client1"]
 		require.True(t, ok)
 
-		err = clients.Update(prev, &Client{
-			IDs:            []string{cliNew},
+		err = clients.update(prev, &persistentClient{
 			Name:           "client1-renamed",
+			IPs:            []netip.Addr{cliNewIP},
 			UseOwnSettings: true,
 		})
 		require.NoError(t, err)
 
-		c, ok := clients.Find(cliNew)
+		c, ok := clients.find(cliNew)
 		require.True(t, ok)
 
 		assert.Equal(t, "client1-renamed", c.Name)
@@ -175,21 +175,21 @@ func TestClients(t *testing.T) {
 
 		assert.Nil(t, nilCli)
 
-		require.Len(t, c.IDs, 1)
+		require.Len(t, c.ids(), 1)
 
-		assert.Equal(t, cliNew, c.IDs[0])
+		assert.Equal(t, cliNewIP, c.IPs[0])
 	})
 
 	t.Run("del_success", func(t *testing.T) {
-		ok := clients.Del("client1-renamed")
+		ok := clients.remove("client1-renamed")
 		require.True(t, ok)
 
-		_, ok = clients.Find("1.1.1.2")
+		_, ok = clients.find("1.1.1.2")
 		assert.False(t, ok)
 	})
 
 	t.Run("del_fail", func(t *testing.T) {
-		ok := clients.Del("client3")
+		ok := clients.remove("client3")
 		assert.False(t, ok)
 	})
 
@@ -258,9 +258,9 @@ func TestClientsWHOIS(t *testing.T) {
 	t.Run("can't_set_manually-added", func(t *testing.T) {
 		ip := netip.MustParseAddr("1.1.1.2")
 
-		ok, err := clients.Add(&Client{
-			IDs:  []string{"1.1.1.2"},
+		ok, err := clients.add(&persistentClient{
 			Name: "client1",
+			IPs:  []netip.Addr{netip.MustParseAddr("1.1.1.2")},
 		})
 		require.NoError(t, err)
 		assert.True(t, ok)
@@ -269,7 +269,7 @@ func TestClientsWHOIS(t *testing.T) {
 		rc := clients.ipToRC[ip]
 		require.Nil(t, rc)
 
-		assert.True(t, clients.Del("client1"))
+		assert.True(t, clients.remove("client1"))
 	})
 }
 
@@ -280,9 +280,11 @@ func TestClientsAddExisting(t *testing.T) {
 		ip := netip.MustParseAddr("1.1.1.1")
 
 		// Add a client.
-		ok, err := clients.Add(&Client{
-			IDs:  []string{ip.String(), "1:2:3::4", "aa:aa:aa:aa:aa:aa", "2.2.2.0/24"},
-			Name: "client1",
+		ok, err := clients.add(&persistentClient{
+			Name:    "client1",
+			IPs:     []netip.Addr{ip, netip.MustParseAddr("1:2:3::4")},
+			Subnets: []netip.Prefix{netip.MustParsePrefix("2.2.2.0/24")},
+			MACs:    []net.HardwareAddr{{0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA}},
 		})
 		require.NoError(t, err)
 		assert.True(t, ok)
@@ -328,17 +330,17 @@ func TestClientsAddExisting(t *testing.T) {
 		require.NoError(t, err)
 
 		// Add a new client with the same IP as for a client with MAC.
-		ok, err := clients.Add(&Client{
-			IDs:  []string{ip.String()},
+		ok, err := clients.add(&persistentClient{
 			Name: "client2",
+			IPs:  []netip.Addr{ip},
 		})
 		require.NoError(t, err)
 		assert.True(t, ok)
 
 		// Add a new client with the IP from the first client's IP range.
-		ok, err = clients.Add(&Client{
-			IDs:  []string{"2.2.2.2"},
+		ok, err = clients.add(&persistentClient{
 			Name: "client3",
+			IPs:  []netip.Addr{netip.MustParseAddr("2.2.2.2")},
 		})
 		require.NoError(t, err)
 		assert.True(t, ok)
@@ -349,9 +351,9 @@ func TestClientsCustomUpstream(t *testing.T) {
 	clients := newClientsContainer(t)
 
 	// Add client with upstreams.
-	ok, err := clients.Add(&Client{
-		IDs:  []string{"1.1.1.1", "1:2:3::4", "aa:aa:aa:aa:aa:aa"},
+	ok, err := clients.add(&persistentClient{
 		Name: "client1",
+		IPs:  []netip.Addr{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("1:2:3::4")},
 		Upstreams: []string{
 			"1.1.1.1",
 			"[/example.org/]8.8.8.8",
diff --git a/internal/home/clientshttp.go b/internal/home/clientshttp.go
index 20d6080f..3f2918ca 100644
--- a/internal/home/clientshttp.go
+++ b/internal/home/clientshttp.go
@@ -61,6 +61,7 @@ type clientJSON struct {
 	UpstreamsCacheEnabled aghalg.NullBool `json:"upstreams_cache_enabled"`
 }
 
+// runtimeClientJSON is a JSON representation of the [client.Runtime].
 type runtimeClientJSON struct {
 	WHOIS *whois.Info `json:"whois_info"`
 
@@ -69,6 +70,8 @@ type runtimeClientJSON struct {
 	Source client.Source `json:"source"`
 }
 
+// clientListJSON contains lists of persistent clients, runtime clients and also
+// supported tags.
 type clientListJSON struct {
 	Clients        []*clientJSON       `json:"clients"`
 	RuntimeClients []runtimeClientJSON `json:"auto_clients"`
@@ -126,32 +129,36 @@ func (clients *clientsContainer) handleGetClients(w http.ResponseWriter, r *http
 	aghhttp.WriteJSONResponseOK(w, r, data)
 }
 
-// jsonToClient converts JSON object to Client object.
-func (clients *clientsContainer) jsonToClient(cj clientJSON, prev *Client) (c *Client, err error) {
-	safeSearchConf := copySafeSearch(cj.SafeSearchConf, cj.SafeSearchEnabled)
+// initPrev initializes the persistent client with the default or previous
+// client properties.
+func initPrev(cj clientJSON, prev *persistentClient) (c *persistentClient, err error) {
+	var (
+		uid              UID
+		ignoreQueryLog   bool
+		ignoreStatistics bool
+		upsCacheEnabled  bool
+		upsCacheSize     uint32
+	)
+
+	if prev != nil {
+		uid = prev.UID
+		ignoreQueryLog = prev.IgnoreQueryLog
+		ignoreStatistics = prev.IgnoreStatistics
+		upsCacheEnabled = prev.UpstreamsCacheEnabled
+		upsCacheSize = prev.UpstreamsCacheSize
+	}
 
-	var ignoreQueryLog bool
 	if cj.IgnoreQueryLog != aghalg.NBNull {
 		ignoreQueryLog = cj.IgnoreQueryLog == aghalg.NBTrue
-	} else if prev != nil {
-		ignoreQueryLog = prev.IgnoreQueryLog
 	}
 
-	var ignoreStatistics bool
 	if cj.IgnoreStatistics != aghalg.NBNull {
 		ignoreStatistics = cj.IgnoreStatistics == aghalg.NBTrue
-	} else if prev != nil {
-		ignoreStatistics = prev.IgnoreStatistics
 	}
 
-	var upsCacheEnabled bool
-	var upsCacheSize uint32
 	if cj.UpstreamsCacheEnabled != aghalg.NBNull {
 		upsCacheEnabled = cj.UpstreamsCacheEnabled == aghalg.NBTrue
 		upsCacheSize = cj.UpstreamsCacheSize
-	} else if prev != nil {
-		upsCacheEnabled = prev.UpstreamsCacheEnabled
-		upsCacheSize = prev.UpstreamsCacheSize
 	}
 
 	svcs, err := copyBlockedServices(cj.Schedule, cj.BlockedServices, prev)
@@ -159,31 +166,54 @@ func (clients *clientsContainer) jsonToClient(cj clientJSON, prev *Client) (c *C
 		return nil, fmt.Errorf("invalid blocked services: %w", err)
 	}
 
-	c = &Client{
-		safeSearchConf: safeSearchConf,
+	if (uid == UID{}) {
+		uid, err = NewUID()
+		if err != nil {
+			return nil, fmt.Errorf("generating uid: %w", err)
+		}
+	}
 
-		Name: cj.Name,
-
-		BlockedServices: svcs,
-
-		IDs:       cj.IDs,
-		Tags:      cj.Tags,
-		Upstreams: cj.Upstreams,
-
-		UseOwnSettings:        !cj.UseGlobalSettings,
-		FilteringEnabled:      cj.FilteringEnabled,
-		ParentalEnabled:       cj.ParentalEnabled,
-		SafeBrowsingEnabled:   cj.SafeBrowsingEnabled,
-		UseOwnBlockedServices: !cj.UseGlobalBlockedServices,
+	return &persistentClient{
+		BlockedServices:       svcs,
+		UID:                   uid,
 		IgnoreQueryLog:        ignoreQueryLog,
 		IgnoreStatistics:      ignoreStatistics,
 		UpstreamsCacheEnabled: upsCacheEnabled,
 		UpstreamsCacheSize:    upsCacheSize,
+	}, nil
+}
+
+// jsonToClient converts JSON object to persistent client object if there are no
+// errors.
+func (clients *clientsContainer) jsonToClient(
+	cj clientJSON,
+	prev *persistentClient,
+) (c *persistentClient, err error) {
+	c, err = initPrev(cj, prev)
+	if err != nil {
+		// Don't wrap the error since it's informative enough as is.
+		return nil, err
 	}
 
-	if safeSearchConf.Enabled {
+	err = c.setIDs(cj.IDs)
+	if err != nil {
+		// Don't wrap the error since it's informative enough as is.
+		return nil, err
+	}
+
+	c.safeSearchConf = copySafeSearch(cj.SafeSearchConf, cj.SafeSearchEnabled)
+	c.Name = cj.Name
+	c.Tags = cj.Tags
+	c.Upstreams = cj.Upstreams
+	c.UseOwnSettings = !cj.UseGlobalSettings
+	c.FilteringEnabled = cj.FilteringEnabled
+	c.ParentalEnabled = cj.ParentalEnabled
+	c.SafeBrowsingEnabled = cj.SafeBrowsingEnabled
+	c.UseOwnBlockedServices = !cj.UseGlobalBlockedServices
+
+	if c.safeSearchConf.Enabled {
 		err = c.setSafeSearch(
-			safeSearchConf,
+			c.safeSearchConf,
 			clients.safeSearchCacheSize,
 			clients.safeSearchCacheTTL,
 		)
@@ -228,7 +258,7 @@ func copySafeSearch(
 func copyBlockedServices(
 	sch *schedule.Weekly,
 	svcStrs []string,
-	prev *Client,
+	prev *persistentClient,
 ) (svcs *filtering.BlockedServices, err error) {
 	var weekly *schedule.Weekly
 	if sch != nil {
@@ -252,8 +282,8 @@ func copyBlockedServices(
 	return svcs, nil
 }
 
-// clientToJSON converts Client object to JSON.
-func clientToJSON(c *Client) (cj *clientJSON) {
+// clientToJSON converts persistent client object to JSON object.
+func clientToJSON(c *persistentClient) (cj *clientJSON) {
 	// TODO(d.kolyshev): Remove after cleaning the deprecated
 	// [clientJSON.SafeSearchEnabled] field.
 	cloneVal := c.safeSearchConf
@@ -261,7 +291,7 @@ func clientToJSON(c *Client) (cj *clientJSON) {
 
 	return &clientJSON{
 		Name:                c.Name,
-		IDs:                 c.IDs,
+		IDs:                 c.ids(),
 		Tags:                c.Tags,
 		UseGlobalSettings:   !c.UseOwnSettings,
 		FilteringEnabled:    c.FilteringEnabled,
@@ -302,7 +332,7 @@ func (clients *clientsContainer) handleAddClient(w http.ResponseWriter, r *http.
 		return
 	}
 
-	ok, err := clients.Add(c)
+	ok, err := clients.add(c)
 	if err != nil {
 		aghhttp.Error(r, w, http.StatusBadRequest, "%s", err)
 
@@ -334,7 +364,7 @@ func (clients *clientsContainer) handleDelClient(w http.ResponseWriter, r *http.
 		return
 	}
 
-	if !clients.Del(cj.Name) {
+	if !clients.remove(cj.Name) {
 		aghhttp.Error(r, w, http.StatusBadRequest, "Client not found")
 
 		return
@@ -343,6 +373,7 @@ func (clients *clientsContainer) handleDelClient(w http.ResponseWriter, r *http.
 	onConfigModified()
 }
 
+// updateJSON contains the name and data of the updated persistent client.
 type updateJSON struct {
 	Name string     `json:"name"`
 	Data clientJSON `json:"data"`
@@ -366,7 +397,7 @@ func (clients *clientsContainer) handleUpdateClient(w http.ResponseWriter, r *ht
 		return
 	}
 
-	var prev *Client
+	var prev *persistentClient
 	var ok bool
 
 	func() {
@@ -378,6 +409,8 @@ func (clients *clientsContainer) handleUpdateClient(w http.ResponseWriter, r *ht
 
 	if !ok {
 		aghhttp.Error(r, w, http.StatusBadRequest, "client not found")
+
+		return
 	}
 
 	c, err := clients.jsonToClient(dj.Data, prev)
@@ -387,7 +420,7 @@ func (clients *clientsContainer) handleUpdateClient(w http.ResponseWriter, r *ht
 		return
 	}
 
-	err = clients.Update(prev, c)
+	err = clients.update(prev, c)
 	if err != nil {
 		aghhttp.Error(r, w, http.StatusBadRequest, "%s", err)
 
@@ -408,7 +441,7 @@ func (clients *clientsContainer) handleFindClient(w http.ResponseWriter, r *http
 		}
 
 		ip, _ := netip.ParseAddr(idStr)
-		c, ok := clients.Find(idStr)
+		c, ok := clients.find(idStr)
 		var cj *clientJSON
 		if !ok {
 			cj = clients.findRuntime(ip, idStr)
diff --git a/internal/home/config.go b/internal/home/config.go
index e78bf8e9..fac08df0 100644
--- a/internal/home/config.go
+++ b/internal/home/config.go
@@ -10,7 +10,7 @@ import (
 
 	"github.com/AdguardTeam/AdGuardHome/internal/aghalg"
 	"github.com/AdguardTeam/AdGuardHome/internal/aghtls"
-	"github.com/AdguardTeam/AdGuardHome/internal/confmigrate"
+	"github.com/AdguardTeam/AdGuardHome/internal/configmigrate"
 	"github.com/AdguardTeam/AdGuardHome/internal/dhcpd"
 	"github.com/AdguardTeam/AdGuardHome/internal/dnsforward"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
@@ -20,6 +20,7 @@ import (
 	"github.com/AdguardTeam/dnsproxy/fastip"
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/log"
+	"github.com/AdguardTeam/golibs/netutil"
 	"github.com/AdguardTeam/golibs/timeutil"
 	"github.com/google/renameio/v2/maybe"
 	yaml "gopkg.in/yaml.v3"
@@ -149,7 +150,7 @@ type configuration struct {
 	sync.RWMutex `yaml:"-"`
 
 	// SchemaVersion is the version of the configuration schema.  See
-	// [confmigrate.LastSchemaVersion].
+	// [configmigrate.LastSchemaVersion].
 	SchemaVersion uint `yaml:"schema_version"`
 }
 
@@ -200,7 +201,7 @@ type dnsConfig struct {
 
 	// PrivateNets is the set of IP networks for which the private reverse DNS
 	// resolver should be used.
-	PrivateNets []string `yaml:"private_networks"`
+	PrivateNets []netutil.Prefix `yaml:"private_networks"`
 
 	// UsePrivateRDNS defines if the PTR requests for unknown addresses from
 	// locally-served networks should be resolved via private PTR resolvers.
@@ -267,7 +268,7 @@ type queryLogConfig struct {
 
 	// MemSize is the number of entries kept in memory before they are flushed
 	// to disk.
-	MemSize int `yaml:"size_memory"`
+	MemSize uint `yaml:"size_memory"`
 
 	// Enabled defines if the query log is enabled.
 	Enabled bool `yaml:"enabled"`
@@ -315,14 +316,18 @@ var config = &configuration{
 			RatelimitSubnetLenIPv4: 24,
 			RatelimitSubnetLenIPv6: 56,
 			RefuseAny:              true,
-			AllServers:             false,
+			UpstreamMode:           dnsforward.UpstreamModeLoadBalance,
 			HandleDDR:              true,
 			FastestTimeout: timeutil.Duration{
 				Duration: fastip.DefaultPingWaitTimeout,
 			},
 
-			TrustedProxies: []string{"127.0.0.0/8", "::1/128"},
-			CacheSize:      4 * 1024 * 1024,
+			TrustedProxies: []netutil.Prefix{{
+				Prefix: netip.MustParsePrefix("127.0.0.0/8"),
+			}, {
+				Prefix: netip.MustParsePrefix("::1/128"),
+			}},
+			CacheSize: 4 * 1024 * 1024,
 
 			EDNSClientSubnet: &dnsforward.EDNSClientSubnet{
 				CustomIP:  netip.Addr{},
@@ -434,7 +439,7 @@ var config = &configuration{
 		MaxAge:     3,
 	},
 	OSConfig:      &osConfig{},
-	SchemaVersion: confmigrate.LastSchemaVersion,
+	SchemaVersion: configmigrate.LastSchemaVersion,
 	Theme:         ThemeAuto,
 }
 
@@ -479,14 +484,14 @@ func parseConfig() (err error) {
 		return err
 	}
 
-	migrator := confmigrate.New(&confmigrate.Config{
+	migrator := configmigrate.New(&configmigrate.Config{
 		WorkingDir: Context.workDir,
 	})
 
 	var upgraded bool
 	config.fileData, upgraded, err = migrator.Migrate(
 		config.fileData,
-		confmigrate.LastSchemaVersion,
+		configmigrate.LastSchemaVersion,
 	)
 	if err != nil {
 		// Don't wrap the error, because it's informative enough as is.
diff --git a/internal/home/dns.go b/internal/home/dns.go
index 59d3fa62..5d601694 100644
--- a/internal/home/dns.go
+++ b/internal/home/dns.go
@@ -127,16 +127,11 @@ func initDNSServer(
 	httpReg aghhttp.RegisterFunc,
 	tlsConf *tlsConfigSettings,
 ) (err error) {
-	privateNets, err := parseSubnetSet(config.DNS.PrivateNets)
-	if err != nil {
-		return fmt.Errorf("preparing set of private subnets: %w", err)
-	}
-
 	Context.dnsServer, err = dnsforward.NewServer(dnsforward.DNSCreateParams{
 		DNSFilter:   filters,
 		Stats:       sts,
 		QueryLog:    qlog,
-		PrivateNets: privateNets,
+		PrivateNets: parseSubnetSet(config.DNS.PrivateNets),
 		Anonymizer:  anonymizer,
 		DHCPServer:  dhcpSrv,
 		EtcHosts:    Context.etcHosts,
@@ -169,26 +164,15 @@ func initDNSServer(
 // parseSubnetSet parses a slice of subnets.  If the slice is empty, it returns
 // a subnet set that matches all locally served networks, see
 // [netutil.IsLocallyServed].
-func parseSubnetSet(nets []string) (s netutil.SubnetSet, err error) {
+func parseSubnetSet(nets []netutil.Prefix) (s netutil.SubnetSet) {
 	switch len(nets) {
 	case 0:
 		// Use an optimized function-based matcher.
-		return netutil.SubnetSetFunc(netutil.IsLocallyServed), nil
+		return netutil.SubnetSetFunc(netutil.IsLocallyServed)
 	case 1:
-		s, err = netutil.ParseSubnet(nets[0])
-		if err != nil {
-			return nil, err
-		}
-
-		return s, nil
+		return nets[0].Prefix
 	default:
-		var nets []*net.IPNet
-		nets, err = netutil.ParseSubnets(config.DNS.PrivateNets...)
-		if err != nil {
-			return nil, err
-		}
-
-		return netutil.SliceSubnetSet(nets), nil
+		return netutil.SliceSubnetSet(netutil.UnembedPrefixes(nets))
 	}
 }
 
@@ -411,9 +395,9 @@ func applyAdditionalFiltering(clientIP netip.Addr, clientID string, setts *filte
 
 	setts.ClientIP = clientIP
 
-	c, ok := Context.clients.Find(clientID)
+	c, ok := Context.clients.find(clientID)
 	if !ok {
-		c, ok = Context.clients.Find(clientIP.String())
+		c, ok = Context.clients.find(clientIP.String())
 		if !ok {
 			log.Debug("%s: no clients with ip %s and clientid %q", pref, clientIP, clientID)
 
diff --git a/internal/home/dns_internal_test.go b/internal/home/dns_internal_test.go
index 22fa06fe..820b22a6 100644
--- a/internal/home/dns_internal_test.go
+++ b/internal/home/dns_internal_test.go
@@ -22,7 +22,7 @@ func TestApplyAdditionalFiltering(t *testing.T) {
 	}, nil)
 	require.NoError(t, err)
 
-	Context.clients.idIndex = map[string]*Client{
+	Context.clients.idIndex = map[string]*persistentClient{
 		"default": {
 			UseOwnSettings:      false,
 			safeSearchConf:      filtering.SafeSearchConfig{Enabled: false},
@@ -108,7 +108,7 @@ func TestApplyAdditionalFiltering_blockedServices(t *testing.T) {
 	}, nil)
 	require.NoError(t, err)
 
-	Context.clients.idIndex = map[string]*Client{
+	Context.clients.idIndex = map[string]*persistentClient{
 		"default": {
 			UseOwnBlockedServices: false,
 		},
diff --git a/internal/home/home.go b/internal/home/home.go
index f0a037c0..701e4820 100644
--- a/internal/home/home.go
+++ b/internal/home/home.go
@@ -360,6 +360,11 @@ func setupDNSFilteringConf(conf *filtering.Config) (err error) {
 	)
 
 	conf.EtcHosts = Context.etcHosts
+	// TODO(s.chzhen):  Use empty interface.
+	if Context.etcHosts == nil {
+		conf.EtcHosts = nil
+	}
+
 	conf.ConfigModified = onConfigModified
 	conf.HTTPRegister = httpRegister
 	conf.DataDir = Context.getDataDir()
diff --git a/internal/home/options.go b/internal/home/options.go
index 1bbf2752..d32aaa1c 100644
--- a/internal/home/options.go
+++ b/internal/home/options.go
@@ -7,6 +7,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/AdguardTeam/AdGuardHome/internal/configmigrate"
 	"github.com/AdguardTeam/AdGuardHome/internal/version"
 	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/golibs/stringutil"
@@ -308,7 +309,7 @@ var cmdLineOpts = []cmdLineOpt{{
 	effect: func(o options, exec string) (effect, error) {
 		return func() error {
 			if o.verbose {
-				fmt.Println(version.Verbose())
+				fmt.Print(version.Verbose(configmigrate.LastSchemaVersion))
 			} else {
 				fmt.Println(version.Full())
 			}
diff --git a/internal/next/cmd/opt.go b/internal/next/cmd/opt.go
index fdbea2a0..5959af76 100644
--- a/internal/next/cmd/opt.go
+++ b/internal/next/cmd/opt.go
@@ -10,6 +10,7 @@ import (
 	"os"
 	"strings"
 
+	"github.com/AdguardTeam/AdGuardHome/internal/configmigrate"
 	"github.com/AdguardTeam/AdGuardHome/internal/next/configmgr"
 	"github.com/AdguardTeam/AdGuardHome/internal/version"
 	"github.com/AdguardTeam/golibs/log"
@@ -382,7 +383,7 @@ func processOptions(
 
 	if opts.version {
 		if opts.verbose {
-			fmt.Println(version.Verbose())
+			fmt.Print(version.Verbose(configmigrate.LastSchemaVersion))
 		} else {
 			fmt.Printf("AdGuard Home %s\n", version.Version())
 		}
diff --git a/internal/next/dnssvc/dnssvc.go b/internal/next/dnssvc/dnssvc.go
index e0056dcb..68c2e7e7 100644
--- a/internal/next/dnssvc/dnssvc.go
+++ b/internal/next/dnssvc/dnssvc.go
@@ -110,7 +110,7 @@ func addressesToUpstreams(
 	// TODO(e.burkov):  Add system hosts resolver here.
 	var bootstrap upstream.ParallelResolver
 	for _, r := range boots {
-		bootstrap = append(bootstrap, r)
+		bootstrap = append(bootstrap, upstream.NewCachingResolver(r))
 	}
 
 	upstreams = make([]upstream.Upstream, len(upsStrs))
diff --git a/internal/querylog/qlog.go b/internal/querylog/qlog.go
index ae058541..73ac7e6a 100644
--- a/internal/querylog/qlog.go
+++ b/internal/querylog/qlog.go
@@ -196,7 +196,7 @@ func newLogEntry(params *AddParams) (entry *logEntry) {
 // Add implements the [QueryLog] interface for *queryLog.
 func (l *queryLog) Add(params *AddParams) {
 	var isEnabled, fileIsEnabled bool
-	var memSize int
+	var memSize uint
 	func() {
 		l.confMu.RLock()
 		defer l.confMu.RUnlock()
@@ -205,7 +205,7 @@ func (l *queryLog) Add(params *AddParams) {
 		memSize = l.conf.MemSize
 	}()
 
-	if !isEnabled || memSize == 0 {
+	if !isEnabled {
 		return
 	}
 
@@ -230,6 +230,7 @@ func (l *queryLog) Add(params *AddParams) {
 	if !l.flushPending && fileIsEnabled && l.buffer.Len() >= memSize {
 		l.flushPending = true
 
+		// TODO(s.chzhen):  Fix occasional rewrite of entires.
 		go func() {
 			flushErr := l.flushLogBuffer()
 			if flushErr != nil {
diff --git a/internal/querylog/querylog.go b/internal/querylog/querylog.go
index b9292c7d..189f1f57 100644
--- a/internal/querylog/querylog.go
+++ b/internal/querylog/querylog.go
@@ -63,7 +63,7 @@ type Config struct {
 
 	// MemSize is the number of entries kept in a memory buffer before they are
 	// flushed to disk.
-	MemSize int
+	MemSize uint
 
 	// Enabled tells if the query log is enabled.
 	Enabled bool
@@ -143,14 +143,17 @@ func newQueryLog(conf Config) (l *queryLog, err error) {
 		}
 	}
 
-	if conf.MemSize < 0 {
-		return nil, errors.Error("memory size must be greater or equal to zero")
+	memSize := conf.MemSize
+	if memSize == 0 {
+		// If query log is enabled, we still need to write entries to a file.
+		// And all writing goes through a buffer.
+		memSize = 1
 	}
 
 	l = &queryLog{
 		findClient: findClient,
 
-		buffer: aghalg.NewRingBuffer[*logEntry](conf.MemSize),
+		buffer: aghalg.NewRingBuffer[*logEntry](memSize),
 
 		conf:    &Config{},
 		confMu:  &sync.RWMutex{},
diff --git a/internal/querylog/search.go b/internal/querylog/search.go
index b4fd3ffe..1a992e20 100644
--- a/internal/querylog/search.go
+++ b/internal/querylog/search.go
@@ -47,7 +47,14 @@ func (l *queryLog) client(clientID, ip string, cache clientCache) (c *Client, er
 // searchMemory looks up log records which are currently in the in-memory
 // buffer.  It optionally uses the client cache, if provided.  It also returns
 // the total amount of records in the buffer at the moment of searching.
+// l.confMu is expected to be locked.
 func (l *queryLog) searchMemory(params *searchParams, cache clientCache) (entries []*logEntry, total int) {
+	// We use this configuration check because a buffer can contain a single log
+	// record.  See [newQueryLog].
+	if l.conf.MemSize == 0 {
+		return nil, 0
+	}
+
 	l.bufferLock.Lock()
 	defer l.bufferLock.Unlock()
 
@@ -73,11 +80,12 @@ func (l *queryLog) searchMemory(params *searchParams, cache clientCache) (entrie
 		return true
 	})
 
-	return entries, l.buffer.Len()
+	return entries, int(l.buffer.Len())
 }
 
-// search - searches log entries in the query log using specified parameters
-// returns the list of entries found + time of the oldest entry
+// search searches log entries in memory buffer and log file using specified
+// parameters and returns the list of entries found and the time of the oldest
+// entry.  l.confMu is expected to be locked.
 func (l *queryLog) search(params *searchParams) (entries []*logEntry, oldest time.Time) {
 	start := time.Now()
 
diff --git a/internal/stats/unit.go b/internal/stats/unit.go
index 84c6770b..478d9f66 100644
--- a/internal/stats/unit.go
+++ b/internal/stats/unit.go
@@ -484,7 +484,7 @@ func (s *StatsCtx) fillCollectedStats(data *StatsResp, units []*unitDB, curID ui
 	data.TimeUnits = timeUnitsHours
 
 	daysCount := size / 24
-	if daysCount > 7 {
+	if daysCount >= 7 {
 		size = daysCount
 		data.TimeUnits = timeUnitsDays
 	}
@@ -510,6 +510,10 @@ func (s *StatsCtx) fillCollectedStats(data *StatsResp, units []*unitDB, curID ui
 
 // fillCollectedStatsDaily fills data with collected daily statistics.  units
 // must contain data for the count of days.
+//
+// TODO(s.chzhen):  Improve collection of statistics for frontend.  Dashboard
+// cards should contain statistics for the whole interval without rounding to
+// days.
 func (s *StatsCtx) fillCollectedStatsDaily(
 	data *StatsResp,
 	units []*unitDB,
diff --git a/internal/version/version.go b/internal/version/version.go
index b553d6f8..e14e08dd 100644
--- a/internal/version/version.go
+++ b/internal/version/version.go
@@ -96,23 +96,25 @@ func fmtModule(m *debug.Module) (formatted string) {
 
 // Constants defining the headers of build information message.
 const (
-	vFmtAGHHdr    = "AdGuard Home"
-	vFmtVerHdr    = "Version: "
-	vFmtChanHdr   = "Channel: "
-	vFmtGoHdr     = "Go version: "
-	vFmtTimeHdr   = "Commit time: "
-	vFmtRaceHdr   = "Race: "
-	vFmtGOOSHdr   = "GOOS: " + runtime.GOOS
-	vFmtGOARCHHdr = "GOARCH: " + runtime.GOARCH
-	vFmtGOARMHdr  = "GOARM: "
-	vFmtGOMIPSHdr = "GOMIPS: "
-	vFmtDepsHdr   = "Dependencies:"
+	vFmtAGHHdr       = "AdGuard Home"
+	vFmtVerHdr       = "Version: "
+	vFmtSchemaVerHdr = "Schema version: "
+	vFmtChanHdr      = "Channel: "
+	vFmtGoHdr        = "Go version: "
+	vFmtTimeHdr      = "Commit time: "
+	vFmtRaceHdr      = "Race: "
+	vFmtGOOSHdr      = "GOOS: " + runtime.GOOS
+	vFmtGOARCHHdr    = "GOARCH: " + runtime.GOARCH
+	vFmtGOARMHdr     = "GOARM: "
+	vFmtGOMIPSHdr    = "GOMIPS: "
+	vFmtDepsHdr      = "Dependencies:"
 )
 
 // Verbose returns formatted build information.  Output example:
 //
 //	AdGuard Home
 //	Version: v0.105.3
+//	Schema version: 27
 //	Channel: development
 //	Go version: go1.15.3
 //	Build time: 2021-03-30T16:26:08Z+0300
@@ -125,34 +127,31 @@ const (
 //	        ...
 //
 // TODO(e.burkov): Make it write into passed io.Writer.
-func Verbose() (v string) {
+func Verbose(schemaVersion uint) (v string) {
 	b := &strings.Builder{}
 
 	const nl = "\n"
-	stringutil.WriteToBuilder(
-		b,
-		vFmtAGHHdr,
-		nl,
-		vFmtVerHdr,
-		version,
-		nl,
-		vFmtChanHdr,
-		channel,
-		nl,
-		vFmtGoHdr,
-		runtime.Version(),
-	)
+	stringutil.WriteToBuilder(b, vFmtAGHHdr, nl)
+	stringutil.WriteToBuilder(b, vFmtVerHdr, version, nl)
+
+	schemaVerStr := strconv.FormatUint(uint64(schemaVersion), 10)
+	stringutil.WriteToBuilder(b, vFmtSchemaVerHdr, schemaVerStr, nl)
+
+	stringutil.WriteToBuilder(b, vFmtChanHdr, channel, nl)
+	stringutil.WriteToBuilder(b, vFmtGoHdr, runtime.Version(), nl)
 
 	writeCommitTime(b)
 
-	stringutil.WriteToBuilder(b, nl, vFmtGOOSHdr, nl, vFmtGOARCHHdr)
+	stringutil.WriteToBuilder(b, vFmtGOOSHdr, nl)
+	stringutil.WriteToBuilder(b, vFmtGOARCHHdr, nl)
+
 	if goarm != "" {
-		stringutil.WriteToBuilder(b, nl, vFmtGOARMHdr, "v", goarm)
+		stringutil.WriteToBuilder(b, vFmtGOARMHdr, "v", goarm, nl)
 	} else if gomips != "" {
-		stringutil.WriteToBuilder(b, nl, vFmtGOMIPSHdr, gomips)
+		stringutil.WriteToBuilder(b, vFmtGOMIPSHdr, gomips, nl)
 	}
 
-	stringutil.WriteToBuilder(b, nl, vFmtRaceHdr, strconv.FormatBool(isRace))
+	stringutil.WriteToBuilder(b, vFmtRaceHdr, strconv.FormatBool(isRace), nl)
 
 	info, ok := debug.ReadBuildInfo()
 	if !ok {
@@ -163,10 +162,10 @@ func Verbose() (v string) {
 		return b.String()
 	}
 
-	stringutil.WriteToBuilder(b, nl, vFmtDepsHdr)
+	stringutil.WriteToBuilder(b, vFmtDepsHdr, nl)
 	for _, dep := range info.Deps {
 		if depStr := fmtModule(dep); depStr != "" {
-			stringutil.WriteToBuilder(b, "\n\t", depStr)
+			stringutil.WriteToBuilder(b, "\t", depStr, nl)
 		}
 	}
 
@@ -180,8 +179,8 @@ func writeCommitTime(b *strings.Builder) {
 
 	commitTimeUnix, err := strconv.ParseInt(committime, 10, 64)
 	if err != nil {
-		stringutil.WriteToBuilder(b, "\n", vFmtTimeHdr, fmt.Sprintf("parse error: %s", err))
+		stringutil.WriteToBuilder(b, vFmtTimeHdr, fmt.Sprintf("parse error: %s", err), "\n")
 	} else {
-		stringutil.WriteToBuilder(b, "\n", vFmtTimeHdr, time.Unix(commitTimeUnix, 0).String())
+		stringutil.WriteToBuilder(b, vFmtTimeHdr, time.Unix(commitTimeUnix, 0).String(), "\n")
 	}
 }
diff --git a/internal/whois/whois.go b/internal/whois/whois.go
index b2d20a80..37f1dec8 100644
--- a/internal/whois/whois.go
+++ b/internal/whois/whois.go
@@ -268,7 +268,7 @@ var _ Interface = (*Default)(nil)
 // Process makes WHOIS request and returns WHOIS information or nil.  changed
 // indicates that Info was updated since last request.
 func (w *Default) Process(ctx context.Context, ip netip.Addr) (wi *Info, changed bool) {
-	if netutil.IsSpecialPurposeAddr(ip) {
+	if netutil.IsSpecialPurpose(ip) {
 		return nil, false
 	}
 
diff --git a/openapi/CHANGELOG.md b/openapi/CHANGELOG.md
index b71ee56c..de87f6fa 100644
--- a/openapi/CHANGELOG.md
+++ b/openapi/CHANGELOG.md
@@ -4,6 +4,20 @@
 
 ## v0.108.0: API changes
 
+## v0.107.44: API changes
+
+### The field `"upstream_mode"` in `DNSConfig`
+
+* The field `"upstream_mode"` in `POST /control/dns_config` and
+  `GET /control/dns_info` now accepts `load_balance` value. Note that, the usage
+  of an empty string or field absence is considered to as deprecated and is not
+  recommended. Use `load_balance` instead.
+
+### Type correction in `Client`
+
+* Field `upstreams_cache_size` of object `Client` now correctly has type
+  `integer` instead of the previous incorrect type `boolean`.
+
 ## v0.107.42: API changes
 
 ### The new field `"serve_plain_dns"` in `TlsConfig`
@@ -152,7 +166,7 @@ has the following format:
 * The new field `"top_upstreams_responses"` in `GET /control/stats` method
   shows the total number of responses from each upstream.
 
-* The new field `"top_upstrems_avg_time"` in `GET /control/stats` method shows
+* The new field `"top_upstreams_avg_time"` in `GET /control/stats` method shows
   the average processing time in seconds of requests from each upstream.
 
 ## v0.107.30: API changes
diff --git a/openapi/openapi.yaml b/openapi/openapi.yaml
index 5ab3fa52..300311c1 100644
--- a/openapi/openapi.yaml
+++ b/openapi/openapi.yaml
@@ -1524,10 +1524,15 @@
         'cache_optimistic':
           'type': 'boolean'
         'upstream_mode':
+          'type': 'string'
           'enum':
-          - ''
-          - 'parallel'
-          - 'fastest_addr'
+          - const: ''
+            deprecated: true
+            description: Use `load_balance` instead.
+          - const: 'fastest_addr'
+          - const: 'load_balance'
+          - const: 'parallel'
+          'description': Upstream modes enumeration.
         'use_private_ptr_resolvers':
           'type': 'boolean'
         'resolve_clients':
@@ -2709,7 +2714,7 @@
             changed.
 
             This behaviour can be changed in the future versions.
-          'type': 'boolean'
+          'type': 'integer'
     'ClientAuto':
       'type': 'object'
       'description': 'Auto-Client information'
diff --git a/scripts/make/go-lint.sh b/scripts/make/go-lint.sh
index e52b0dfc..ce8718dc 100644
--- a/scripts/make/go-lint.sh
+++ b/scripts/make/go-lint.sh
@@ -211,7 +211,7 @@ run_linter gocognit --over='10'\
 	./internal/aghtest/\
 	./internal/arpdb/\
 	./internal/client/\
-	./internal/confmigrate/\
+	./internal/configmigrate/\
 	./internal/dhcpsvc\
 	./internal/dnsforward/\
 	./internal/filtering/hashprefix/\
@@ -250,7 +250,7 @@ run_linter fieldalignment \
 	./internal/aghtls/\
 	./internal/arpdb/\
 	./internal/client/\
-	./internal/confmigrate/\
+	./internal/configmigrate/\
 	./internal/dhcpsvc/\
 	./internal/filtering/hashprefix/\
 	./internal/filtering/rewrite/\
@@ -280,7 +280,7 @@ run_linter gosec --quiet\
 	./internal/aghtest/\
 	./internal/arpdb/\
 	./internal/client/\
-	./internal/confmigrate/\
+	./internal/configmigrate/\
 	./internal/dhcpd/\
 	./internal/dhcpsvc/\
 	./internal/dnsforward/\