diff --git a/listener/listener.go b/listener/listener.go
index 880f56d4..ff7eb9d1 100644
--- a/listener/listener.go
+++ b/listener/listener.go
@@ -280,7 +280,7 @@ func ReCreateShadowSocks(shadowSocksConfig string, tcpIn chan<- C.ConnContext, u
 		return
 	}
 
-	listener, err := sing_shadowsocks.New(shadowSocksConfig, tcpIn, udpIn)
+	listener, err := sing_shadowsocks.New(shadowSocksConfig, inboundTfo, tcpIn, udpIn)
 	if err != nil {
 		return
 	}
@@ -320,7 +320,7 @@ func ReCreateVmess(vmessConfig string, tcpIn chan<- C.ConnContext, udpIn chan<-
 		return
 	}
 
-	listener, err := sing_vmess.New(vmessConfig, tcpIn, udpIn)
+	listener, err := sing_vmess.New(vmessConfig, inboundTfo, tcpIn, udpIn)
 	if err != nil {
 		return
 	}
diff --git a/listener/shadowsocks/tcp.go b/listener/shadowsocks/tcp.go
index b540a632..37d29e61 100644
--- a/listener/shadowsocks/tcp.go
+++ b/listener/shadowsocks/tcp.go
@@ -1,6 +1,8 @@
 package shadowsocks
 
 import (
+	"context"
+	"github.com/database64128/tfo-go/v2"
 	"net"
 	"strings"
 
@@ -21,7 +23,7 @@ type Listener struct {
 
 var _listener *Listener
 
-func New(config string, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.PacketAdapter) (*Listener, error) {
+func New(config string, inboundTfo bool, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.PacketAdapter) (*Listener, error) {
 	addr, cipher, password, err := ParseSSURL(config)
 	if err != nil {
 		return nil, err
@@ -46,7 +48,10 @@ func New(config string, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.Packet
 		sl.udpListeners = append(sl.udpListeners, ul)
 
 		//TCP
-		l, err := net.Listen("tcp", addr)
+		lc := tfo.ListenConfig{
+			DisableTFO: !inboundTfo,
+		}
+		l, err := lc.Listen(context.Background(), "tcp", addr)
 		if err != nil {
 			return nil, err
 		}
diff --git a/listener/sing_shadowsocks/server.go b/listener/sing_shadowsocks/server.go
index ba61ea36..bd500625 100644
--- a/listener/sing_shadowsocks/server.go
+++ b/listener/sing_shadowsocks/server.go
@@ -3,6 +3,7 @@ package sing_shadowsocks
 import (
 	"context"
 	"fmt"
+	"github.com/database64128/tfo-go/v2"
 	"net"
 	"strings"
 
@@ -32,7 +33,7 @@ type Listener struct {
 
 var _listener *Listener
 
-func New(config string, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.PacketAdapter) (C.AdvanceListener, error) {
+func New(config string, inboundTfo bool, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.PacketAdapter) (C.AdvanceListener, error) {
 	addr, cipher, password, err := embedSS.ParseSSURL(config)
 	if err != nil {
 		return nil, err
@@ -56,7 +57,7 @@ func New(config string, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.Packet
 		sl.service, err = shadowaead_2022.NewServiceWithPassword(cipher, password, udpTimeout, h)
 	default:
 		err = fmt.Errorf("shadowsocks: unsupported method: %s", cipher)
-		return embedSS.New(config, tcpIn, udpIn)
+		return embedSS.New(config, inboundTfo, tcpIn, udpIn)
 	}
 	if err != nil {
 		return nil, err
@@ -100,7 +101,10 @@ func New(config string, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.Packet
 		}()
 
 		//TCP
-		l, err := net.Listen("tcp", addr)
+		lc := tfo.ListenConfig{
+			DisableTFO: !inboundTfo,
+		}
+		l, err := lc.Listen(context.Background(), "tcp", addr)
 		if err != nil {
 			return nil, err
 		}
diff --git a/listener/sing_vmess/server.go b/listener/sing_vmess/server.go
index 26b12893..f859d848 100644
--- a/listener/sing_vmess/server.go
+++ b/listener/sing_vmess/server.go
@@ -2,6 +2,7 @@ package sing_vmess
 
 import (
 	"context"
+	"github.com/database64128/tfo-go/v2"
 	"net"
 	"net/url"
 	"strings"
@@ -24,7 +25,7 @@ type Listener struct {
 
 var _listener *Listener
 
-func New(config string, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.PacketAdapter) (*Listener, error) {
+func New(config string, inboundTfo bool, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.PacketAdapter) (*Listener, error) {
 	addr, username, password, err := parseVmessURL(config)
 	if err != nil {
 		return nil, err
@@ -54,7 +55,10 @@ func New(config string, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.Packet
 		addr := addr
 
 		//TCP
-		l, err := net.Listen("tcp", addr)
+		lc := tfo.ListenConfig{
+			DisableTFO: !inboundTfo,
+		}
+		l, err := lc.Listen(context.Background(), "tcp", addr)
 		if err != nil {
 			return nil, err
 		}