diff --git a/frontend/src/lib/xray/outbound-form-adapter.ts b/frontend/src/lib/xray/outbound-form-adapter.ts
index 310532fb..254880e0 100644
--- a/frontend/src/lib/xray/outbound-form-adapter.ts
+++ b/frontend/src/lib/xray/outbound-form-adapter.ts
@@ -266,6 +266,7 @@ function freedomFromWire(raw: Raw): FreedomOutboundFormSettings {
       return (allowed.includes(s) ? s : '') as FreedomOutboundFormSettings['domainStrategy'];
     })(),
     redirect: asString(raw.redirect),
+    userLevel: asNumber(raw.userLevel, 0),
     proxyProtocol: ((): FreedomOutboundFormSettings['proxyProtocol'] => {
       const n = asNumber(raw.proxyProtocol, 0);
       return (n === 1 || n === 2) ? n : 0;
@@ -506,11 +507,15 @@ function freedomToWire(s: FreedomOutboundFormSettings) {
   // Legacy semantics: emit fragment only when the user actually populated
   // at least one of the four sub-fields. Defaults like packets='1-3' alone
   // are not enough — the modal's Fragment Switch sets all four together.
-  const fragmentEntries = Object.entries(s.fragment).filter(([, v]) => v !== '' && v != null);
-  const fragmentEnabled = !!s.fragment.length || !!s.fragment.interval || !!s.fragment.maxSplit;
+  // getFieldsValue(true) may omit `fragment` when the switch is off, so the
+  // fallback keeps Object.entries from throwing on undefined (issue #4686).
+  const fragment: Partial<FreedomOutboundFormSettings['fragment']> = s.fragment ?? {};
+  const fragmentEntries = Object.entries(fragment).filter(([, v]) => v !== '' && v != null);
+  const fragmentEnabled = !!fragment.length || !!fragment.interval || !!fragment.maxSplit;
   return {
     domainStrategy: s.domainStrategy || undefined,
     redirect: s.redirect || undefined,
+    userLevel: s.userLevel || undefined,
     proxyProtocol: s.proxyProtocol || undefined,
     fragment: fragmentEnabled ? Object.fromEntries(fragmentEntries) : undefined,
     noises: s.noises.length > 0 ? s.noises : undefined,
diff --git a/frontend/src/pages/xray/outbounds/protocols/freedom.tsx b/frontend/src/pages/xray/outbounds/protocols/freedom.tsx
index 818cbffe..30816202 100644
--- a/frontend/src/pages/xray/outbounds/protocols/freedom.tsx
+++ b/frontend/src/pages/xray/outbounds/protocols/freedom.tsx
@@ -1,5 +1,5 @@
 import { useTranslation } from 'react-i18next';
-import { Button, Form, Input, Select, Switch, type FormInstance } from 'antd';
+import { Button, Form, Input, InputNumber, Select, Switch, type FormInstance } from 'antd';
 import { DeleteOutlined, PlusOutlined } from '@ant-design/icons';
 
 import { OutboundDomainStrategies } from '@/schemas/primitives';
@@ -20,6 +20,9 @@ export default function FreedomFields({ form }: { form: FormInstance<OutboundFor
       <Form.Item label={t('pages.xray.outboundForm.redirect')} name={['settings', 'redirect']}>
         <Input />
       </Form.Item>
+      <Form.Item label={t('pages.xray.tun.userLevel')} name={['settings', 'userLevel']}>
+        <InputNumber min={0} style={{ width: '100%' }} />
+      </Form.Item>
       <Form.Item label={t('pages.xray.outboundForm.proxyProtocol')} name={['settings', 'proxyProtocol']}>
         <Select
           options={[
diff --git a/frontend/src/schemas/forms/outbound-form.ts b/frontend/src/schemas/forms/outbound-form.ts
index 0c6733dc..14e94dd9 100644
--- a/frontend/src/schemas/forms/outbound-form.ts
+++ b/frontend/src/schemas/forms/outbound-form.ts
@@ -166,6 +166,7 @@ export type FreedomFinalRuleForm = z.infer<typeof FreedomFinalRuleFormSchema>;
 export const FreedomOutboundFormSettingsSchema = z.object({
   domainStrategy: z.union([OutboundDomainStrategySchema, z.literal('')]).default(''),
   redirect: z.string().default(''),
+  userLevel: z.number().int().min(0).default(0),
   proxyProtocol: z.number().int().min(0).max(2).default(0),
   fragment: FreedomFragmentSchema.default({
     packets: '1-3',
diff --git a/frontend/src/schemas/protocols/outbound/freedom.ts b/frontend/src/schemas/protocols/outbound/freedom.ts
index ff7d997d..026b0ea6 100644
--- a/frontend/src/schemas/protocols/outbound/freedom.ts
+++ b/frontend/src/schemas/protocols/outbound/freedom.ts
@@ -26,7 +26,7 @@ export const FreedomFragmentSchema = z.object({
 export type FreedomFragment = z.infer<typeof FreedomFragmentSchema>;
 
 export const FreedomNoiseTypeSchema = z.enum(['rand', 'str', 'base64', 'hex']);
-export const FreedomNoiseApplyToSchema = z.enum(['ip', 'host', 'all']);
+export const FreedomNoiseApplyToSchema = z.enum(['ip', 'ipv4', 'ipv6']);
 
 export const FreedomNoiseSchema = z.object({
   type: FreedomNoiseTypeSchema.default('rand'),
@@ -52,6 +52,7 @@ export type FreedomFinalRule = z.infer<typeof FreedomFinalRuleSchema>;
 export const FreedomOutboundSettingsSchema = z.object({
   domainStrategy: OutboundDomainStrategySchema.optional(),
   redirect: z.string().optional(),
+  userLevel: z.number().int().min(0).optional(),
   proxyProtocol: z.number().optional(),
   fragment: FreedomFragmentSchema.optional(),
   noises: z.array(FreedomNoiseSchema).optional(),
diff --git a/frontend/src/test/outbound-form-adapter.test.ts b/frontend/src/test/outbound-form-adapter.test.ts
index e674d513..738ddfdc 100644
--- a/frontend/src/test/outbound-form-adapter.test.ts
+++ b/frontend/src/test/outbound-form-adapter.test.ts
@@ -235,18 +235,43 @@ describe('outbound-form-adapter: round-trip', () => {
       settings: {
         domainStrategy: 'UseIPv4',
         redirect: '1.1.1.1',
+        userLevel: 3,
         proxyProtocol: 2,
         fragment: { packets: 'tlshello', length: '100-200' },
+        noises: [{ type: 'rand', packet: '10-20', delay: '10-16', applyTo: 'ipv4' }],
       },
     }));
     expect(filled.settings).toMatchObject({
       domainStrategy: 'UseIPv4',
       redirect: '1.1.1.1',
+      userLevel: 3,
       proxyProtocol: 2,
       fragment: { packets: 'tlshello', length: '100-200' },
+      noises: [{ type: 'rand', packet: '10-20', delay: '10-16', applyTo: 'ipv4' }],
     });
   });
 
+  it('freedom tolerates settings without a fragment object (issue #4686)', () => {
+    const values = {
+      protocol: 'freedom',
+      tag: 'direct',
+      settings: {
+        domainStrategy: '',
+        redirect: '',
+        proxyProtocol: 0,
+        noises: [],
+        finalRules: [
+          { action: 'block', network: '', port: '', ip: ['geoip:private'], blockDelay: '' },
+        ],
+      },
+    } as unknown as Parameters<typeof formValuesToWirePayload>[0];
+
+    expect(() => formValuesToWirePayload(values)).not.toThrow();
+    const back = formValuesToWirePayload(values);
+    expect((back.settings as { fragment?: unknown }).fragment).toBeUndefined();
+    expect((back.settings as { finalRules?: unknown[] }).finalRules).toHaveLength(1);
+  });
+
   it('freedom omits proxyProtocol when disabled (0)', () => {
     const round = formValuesToWirePayload(rawOutboundToFormValues({
       protocol: 'freedom',