diff --git a/service/src/main/java/com/github/kr328/clash/service/TunService.kt b/service/src/main/java/com/github/kr328/clash/service/TunService.kt
index 6e5987b..21ee4ec 100644
--- a/service/src/main/java/com/github/kr328/clash/service/TunService.kt
+++ b/service/src/main/java/com/github/kr328/clash/service/TunService.kt
@@ -139,7 +139,7 @@ class TunService : VpnService(), CoroutineScope by MainScope() {
             }
 
         override fun onCreateTunFailure() {
-            stopSelfForReason("Start VPN rejected by the system")
+            stopSelfForReason("Establish VPN rejected by system")
         }
 
         private fun generateTunNetwork(): ByteArray {
diff --git a/service/src/main/java/com/github/kr328/clash/service/clash/module/TunModule.kt b/service/src/main/java/com/github/kr328/clash/service/clash/module/TunModule.kt
index 2cc09f0..5b0d7c0 100644
--- a/service/src/main/java/com/github/kr328/clash/service/clash/module/TunModule.kt
+++ b/service/src/main/java/com/github/kr328/clash/service/clash/module/TunModule.kt
@@ -10,6 +10,7 @@ import com.github.kr328.clash.core.Clash
 import com.github.kr328.clash.service.util.parseCIDR
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
+import java.lang.NullPointerException
 
 class TunModule(private val service: VpnService) : Module() {
     interface Configure {
@@ -66,8 +67,12 @@ class TunModule(private val service: VpnService) : Module() {
                 builder.setMetered(false)
             }
 
-            val fd = builder.establish()
-                ?: return@withContext c.onCreateTunFailure()
+            val fd = try {
+                builder.establish() ?: throw NullPointerException()
+            }
+            catch (e: Exception) {
+                return@withContext c.onCreateTunFailure()
+            }
 
             if (c.dnsHijacking) {
                 Clash.startTunDevice(