diff --git a/core/src/main/java/com/github/shadowsocks/bg/BaseService.kt b/core/src/main/java/com/github/shadowsocks/bg/BaseService.kt
index f27f259d8c..09b823b1e8 100644
--- a/core/src/main/java/com/github/shadowsocks/bg/BaseService.kt
+++ b/core/src/main/java/com/github/shadowsocks/bg/BaseService.kt
@@ -335,7 +335,11 @@ object BaseService {
             val (profile, fallback) = expanded
             try {
                 data.proxy = ProxyInstance(profile)
-                data.udpFallback = if (fallback == null) null else ProxyInstance(fallback, profile.route)
+                data.udpFallback = if (fallback == null) null else ProxyInstance(fallback, when (profile.route) {
+                    // UDP relay sees IP endpoints, so hostname-only ACL routes would bypass the selected fallback.
+                    Acl.GFWLIST, Acl.CUSTOM_RULES -> Acl.ALL
+                    else -> profile.route
+                })
             } catch (e: IllegalArgumentException) {
                 data.notification = createNotification("")
                 stopRunner(false, e.message)