diff --git a/app/app.go b/app/app.go
index b230f13..d3c5550 100644
--- a/app/app.go
+++ b/app/app.go
@@ -11,6 +11,7 @@ import (
 	"github.com/net-byte/vtun/tun"
 	"github.com/net-byte/vtun/udp"
 	"github.com/net-byte/vtun/ws"
+	"github.com/net-byte/water"
 )
 
 var _banner = `
@@ -28,6 +29,7 @@ var _srcUrl = "https://github.com/net-byte/vtun"
 type Vtun struct {
 	Config  *config.Config
 	Version string
+	Iface   *water.Interface
 }
 
 // InitConfig initializes the config
@@ -43,36 +45,37 @@ func (app *Vtun) InitConfig() {
 
 // StartApp starts the app
 func (app *Vtun) StartApp() {
+	app.Iface = tun.CreateTun(*app.Config)
 	switch app.Config.Protocol {
 	case "udp":
 		if app.Config.ServerMode {
-			udp.StartServer(*app.Config)
+			udp.StartServer(app.Iface, *app.Config)
 		} else {
-			udp.StartClient(*app.Config)
+			udp.StartClient(app.Iface, *app.Config)
 		}
 	case "ws", "wss":
 		if app.Config.ServerMode {
-			ws.StartServer(*app.Config)
+			ws.StartServer(app.Iface, *app.Config)
 		} else {
-			ws.StartClient(*app.Config)
+			ws.StartClient(app.Iface, *app.Config)
 		}
 	case "tls":
 		if app.Config.ServerMode {
-			tls.StartServer(*app.Config)
+			tls.StartServer(app.Iface, *app.Config)
 		} else {
-			tls.StartClient(*app.Config)
+			tls.StartClient(app.Iface, *app.Config)
 		}
 	case "grpc":
 		if app.Config.ServerMode {
-			grpc.StartServer(*app.Config)
+			grpc.StartServer(app.Iface, *app.Config)
 		} else {
-			grpc.StartClient(*app.Config)
+			grpc.StartClient(app.Iface, *app.Config)
 		}
 	default:
 		if app.Config.ServerMode {
-			udp.StartServer(*app.Config)
+			udp.StartServer(app.Iface, *app.Config)
 		} else {
-			udp.StartClient(*app.Config)
+			udp.StartClient(app.Iface, *app.Config)
 		}
 	}
 }
@@ -80,5 +83,6 @@ func (app *Vtun) StartApp() {
 // StopApp stops the app
 func (app *Vtun) StopApp() {
 	tun.ResetTun(*app.Config)
+	app.Iface.Close()
 	log.Println("vtun stopped")
 }
diff --git a/grpc/grpcclient.go b/grpc/grpcclient.go
index be086a6..1b849e3 100644
--- a/grpc/grpcclient.go
+++ b/grpc/grpcclient.go
@@ -15,14 +15,12 @@ import (
 	"github.com/net-byte/vtun/common/cipher"
 	"github.com/net-byte/vtun/common/config"
 	"github.com/net-byte/vtun/common/counter"
-	"github.com/net-byte/vtun/tun"
 	"github.com/net-byte/water"
 )
 
 // StartClient starts the grpc client
-func StartClient(config config.Config) {
+func StartClient(iface *water.Interface, config config.Config) {
 	log.Printf("vtun grpc client started on %v", config.LocalAddr)
-	iface := tun.CreateTun(config)
 	go tunToGrpc(config, iface)
 	tlsconfig := &tls.Config{
 		InsecureSkipVerify: config.TLSInsecureSkipVerify,
diff --git a/grpc/grpcserver.go b/grpc/grpcserver.go
index 0550685..835a11c 100644
--- a/grpc/grpcserver.go
+++ b/grpc/grpcserver.go
@@ -15,7 +15,6 @@ import (
 	"github.com/net-byte/vtun/common/config"
 	"github.com/net-byte/vtun/common/counter"
 	"github.com/net-byte/vtun/common/netutil"
-	"github.com/net-byte/vtun/tun"
 	"github.com/net-byte/water"
 )
 
@@ -33,9 +32,8 @@ func (s *StreamService) Tunnel(srv proto.GrpcServe_TunnelServer) error {
 }
 
 // StartServer starts the grpc server
-func StartServer(config config.Config) {
+func StartServer(iface *water.Interface, config config.Config) {
 	log.Printf("vtun grpc server started on %v", config.LocalAddr)
-	iface := tun.CreateTun(config)
 	ln, err := net.Listen("tcp", config.LocalAddr)
 	if err != nil {
 		log.Panic(err)
diff --git a/main.go b/main.go
index 8a0a92a..f6e105a 100644
--- a/main.go
+++ b/main.go
@@ -10,7 +10,7 @@ import (
 	"github.com/net-byte/vtun/common/config"
 )
 
-var _version = "v1.6.4"
+var _version = "v1.6.5"
 
 func main() {
 	config := config.Config{}
diff --git a/tls/tlsclient.go b/tls/tlsclient.go
index 6e42f59..8d27bd7 100644
--- a/tls/tlsclient.go
+++ b/tls/tlsclient.go
@@ -12,14 +12,12 @@ import (
 	"github.com/net-byte/vtun/common/cipher"
 	"github.com/net-byte/vtun/common/config"
 	"github.com/net-byte/vtun/common/counter"
-	"github.com/net-byte/vtun/tun"
 	"github.com/net-byte/water"
 )
 
 // StartClient starts the tls client
-func StartClient(config config.Config) {
+func StartClient(iface *water.Interface, config config.Config) {
 	log.Printf("vtun tls client started on %v", config.LocalAddr)
-	iface := tun.CreateTun(config)
 	go tunToTLS(config, iface)
 	tlsconfig := &tls.Config{
 		InsecureSkipVerify: config.TLSInsecureSkipVerify,
diff --git a/tls/tlsserver.go b/tls/tlsserver.go
index 8ccd488..b01d94f 100644
--- a/tls/tlsserver.go
+++ b/tls/tlsserver.go
@@ -13,14 +13,12 @@ import (
 	"github.com/net-byte/vtun/common/config"
 	"github.com/net-byte/vtun/common/counter"
 	"github.com/net-byte/vtun/common/netutil"
-	"github.com/net-byte/vtun/tun"
 	"github.com/net-byte/water"
 )
 
 // StartServer starts the tls server
-func StartServer(config config.Config) {
+func StartServer(iface *water.Interface, config config.Config) {
 	log.Printf("vtun tls server started on %v", config.LocalAddr)
-	iface := tun.CreateTun(config)
 	cert, err := tls.LoadX509KeyPair(config.TLSCertificateFilePath, config.TLSCertificateKeyFilePath)
 	if err != nil {
 		log.Panic(err)
diff --git a/udp/udpclient.go b/udp/udpclient.go
index 70b11a1..84d9156 100644
--- a/udp/udpclient.go
+++ b/udp/udpclient.go
@@ -8,14 +8,12 @@ import (
 	"github.com/net-byte/vtun/common/cipher"
 	"github.com/net-byte/vtun/common/config"
 	"github.com/net-byte/vtun/common/counter"
-	"github.com/net-byte/vtun/tun"
 	"github.com/net-byte/water"
 )
 
 // StartClient starts the udp client
-func StartClient(config config.Config) {
+func StartClient(iface *water.Interface, config config.Config) {
 	log.Printf("vtun udp client started on %v", config.LocalAddr)
-	iface := tun.CreateTun(config)
 	serverAddr, err := net.ResolveUDPAddr("udp", config.ServerAddr)
 	if err != nil {
 		log.Fatalln("failed to resolve server addr:", err)
diff --git a/udp/udpserver.go b/udp/udpserver.go
index af8ad5c..18c106b 100644
--- a/udp/udpserver.go
+++ b/udp/udpserver.go
@@ -10,15 +10,13 @@ import (
 	"github.com/net-byte/vtun/common/config"
 	"github.com/net-byte/vtun/common/counter"
 	"github.com/net-byte/vtun/common/netutil"
-	"github.com/net-byte/vtun/tun"
 	"github.com/net-byte/water"
 	"github.com/patrickmn/go-cache"
 )
 
 // StartServer starts the udp server
-func StartServer(config config.Config) {
+func StartServer(iface *water.Interface, config config.Config) {
 	log.Printf("vtun udp server started on %v", config.LocalAddr)
-	iface := tun.CreateTun(config)
 	localAddr, err := net.ResolveUDPAddr("udp", config.LocalAddr)
 	if err != nil {
 		log.Fatalln("failed to get udp socket:", err)
diff --git a/ws/wsclient.go b/ws/wsclient.go
index df44147..73bfde3 100644
--- a/ws/wsclient.go
+++ b/ws/wsclient.go
@@ -12,14 +12,12 @@ import (
 	"github.com/net-byte/vtun/common/config"
 	"github.com/net-byte/vtun/common/counter"
 	"github.com/net-byte/vtun/common/netutil"
-	"github.com/net-byte/vtun/tun"
 	"github.com/net-byte/water"
 )
 
 // StartClient starts the ws client
-func StartClient(config config.Config) {
+func StartClient(iface *water.Interface, config config.Config) {
 	log.Printf("vtun websocket client started on %v", config.LocalAddr)
-	iface := tun.CreateTun(config)
 	go tunToWs(config, iface)
 	for {
 		conn := netutil.ConnectServer(config)
diff --git a/ws/wsserver.go b/ws/wsserver.go
index df2a5f4..dc40583 100644
--- a/ws/wsserver.go
+++ b/ws/wsserver.go
@@ -19,13 +19,11 @@ import (
 	"github.com/net-byte/vtun/common/counter"
 	"github.com/net-byte/vtun/common/netutil"
 	"github.com/net-byte/vtun/register"
-	"github.com/net-byte/vtun/tun"
 	"github.com/net-byte/water"
 )
 
 // StartServer starts the ws server
-func StartServer(config config.Config) {
-	iface := tun.CreateTun(config)
+func StartServer(iface *water.Interface, config config.Config) {
 	// server -> client
 	go toClient(config, iface)
 	// client -> server