diff --git a/build.gradle.kts b/build.gradle.kts
index 179c26c..165e8ee 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -10,8 +10,8 @@ buildscript {
         this["gMinSdkVersion"] = 24
         this["gTargetSdkVersion"] = 29
 
-        this["gVersionCode"] = 10205
-        this["gVersionName"] = "1.2.5"
+        this["gVersionCode"] = 10206
+        this["gVersionName"] = "1.2.6"
 
         this["gKotlinVersion"] = kotlinVersion
         this["gKotlinCoroutineVersion"] = "1.3.5"
diff --git a/service/src/main/java/com/github/kr328/clash/service/TunService.kt b/service/src/main/java/com/github/kr328/clash/service/TunService.kt
index 9c7e4b7..881e19f 100644
--- a/service/src/main/java/com/github/kr328/clash/service/TunService.kt
+++ b/service/src/main/java/com/github/kr328/clash/service/TunService.kt
@@ -146,5 +146,11 @@ class TunService : VpnService(), CoroutineScope by MainScope() {
                     (settings.get(ServiceSettings.ACCESS_CONTROL_PACKAGES) - packageName).toList()
                 } else emptyList()
             }
+
+        override fun onCreateTunFailure() {
+            reason = "Start VPN is rejected by the system"
+
+            stopSelf()
+        }
     }
 }
\ No newline at end of file
diff --git a/service/src/main/java/com/github/kr328/clash/service/clash/module/TunModule.kt b/service/src/main/java/com/github/kr328/clash/service/clash/module/TunModule.kt
index 17efce7..0c9003c 100644
--- a/service/src/main/java/com/github/kr328/clash/service/clash/module/TunModule.kt
+++ b/service/src/main/java/com/github/kr328/clash/service/clash/module/TunModule.kt
@@ -22,6 +22,8 @@ class TunModule(private val service: VpnService) : Module() {
         val dnsHijacking: Boolean
         val allowApplications: List<String>
         val disallowApplication: List<String>
+
+        fun onCreateTunFailure()
     }
 
     var configure: Configure? = null
@@ -62,7 +64,8 @@ class TunModule(private val service: VpnService) : Module() {
                 builder.setMetered(false)
             }
 
-            val fd = builder.establish() ?: throw NullPointerException("Unable to create vpn")
+            val fd = builder.establish()
+                ?: return@withContext c.onCreateTunFailure()
 
             if (c.dnsHijacking) {
                 Clash.startTunDevice(