diff --git a/app/proxyman/inbound/always.go b/app/proxyman/inbound/always.go
index a1cb7b7c..697e2c16 100644
--- a/app/proxyman/inbound/always.go
+++ b/app/proxyman/inbound/always.go
@@ -186,6 +186,7 @@ func (h *AlwaysOnInboundHandler) Close() error {
 		errs = append(errs, worker.Close())
 	}
 	errs = append(errs, h.mux.Close())
+	errs = append(errs, common.Close(h.proxy))
 	if err := errors.Combine(errs...); err != nil {
 		return errors.New("failed to close all resources").Base(err)
 	}
diff --git a/proxy/tun/handler.go b/proxy/tun/handler.go
index 31fc43c6..8a7fb253 100644
--- a/proxy/tun/handler.go
+++ b/proxy/tun/handler.go
@@ -23,6 +23,7 @@ type Handler struct {
 	ctx             context.Context
 	config          *Config
 	stack           Stack
+	tun             Tun
 	policyManager   policy.Manager
 	dispatcher      routing.Dispatcher
 	tag             string
@@ -95,6 +96,7 @@ func (t *Handler) Init(ctx context.Context, pm policy.Manager, dispatcher routin
 	}
 
 	t.stack = tunStack
+	t.tun = tunInterface
 
 	errors.LogInfo(t.ctx, tunName, " up")
 	return nil
@@ -144,6 +146,11 @@ func (t *Handler) HandleConnection(conn net.Conn, destination net.Destination) {
 	}
 }
 
+// Close implements common.Closable.
+func (t *Handler) Close() error {
+	return errors.Combine(t.stack.Close(), t.tun.Close())
+}
+
 // Network implements proxy.Inbound
 // and exists only to comply to proxy interface, declaring it doesn't listen on any network,
 // making the process not open any port for this inbound (input will be network interface)