diff --git a/adapter/inbound/listen.go b/adapter/inbound/listen.go
new file mode 100644
index 00000000..d481a56e
--- /dev/null
+++ b/adapter/inbound/listen.go
@@ -0,0 +1,26 @@
+package inbound
+
+import (
+	"context"
+	"net"
+
+	"github.com/database64128/tfo-go/v2"
+)
+
+var (
+	lc = tfo.ListenConfig{
+		DisableTFO: true,
+	}
+)
+
+func SetTfo(open bool) {
+	lc.DisableTFO = !open
+}
+
+func ListenContext(ctx context.Context, network, address string) (net.Listener, error) {
+	return lc.Listen(ctx, network, address)
+}
+
+func Listen(network, address string) (net.Listener, error) {
+	return ListenContext(context.Background(), network, address)
+}
diff --git a/hub/executor/executor.go b/hub/executor/executor.go
index fad07136..4c77aaba 100644
--- a/hub/executor/executor.go
+++ b/hub/executor/executor.go
@@ -2,14 +2,13 @@ package executor
 
 import (
 	"fmt"
-	"github.com/Dreamacro/clash/component/tls"
-	"github.com/Dreamacro/clash/listener/inner"
 	"net/netip"
 	"os"
 	"runtime"
 	"sync"
 
 	"github.com/Dreamacro/clash/adapter"
+	"github.com/Dreamacro/clash/adapter/inbound"
 	"github.com/Dreamacro/clash/adapter/outboundgroup"
 	"github.com/Dreamacro/clash/component/auth"
 	"github.com/Dreamacro/clash/component/dialer"
@@ -19,6 +18,7 @@ import (
 	"github.com/Dreamacro/clash/component/profile/cachefile"
 	"github.com/Dreamacro/clash/component/resolver"
 	SNI "github.com/Dreamacro/clash/component/sniffer"
+	"github.com/Dreamacro/clash/component/tls"
 	"github.com/Dreamacro/clash/component/trie"
 	"github.com/Dreamacro/clash/config"
 	C "github.com/Dreamacro/clash/constant"
@@ -26,6 +26,7 @@ import (
 	"github.com/Dreamacro/clash/dns"
 	P "github.com/Dreamacro/clash/listener"
 	authStore "github.com/Dreamacro/clash/listener/auth"
+	"github.com/Dreamacro/clash/listener/inner"
 	"github.com/Dreamacro/clash/listener/tproxy"
 	"github.com/Dreamacro/clash/log"
 	"github.com/Dreamacro/clash/tunnel"
@@ -335,7 +336,7 @@ func updateGeneral(general *config.General, force bool) {
 	bindAddress := general.BindAddress
 	P.SetBindAddress(bindAddress)
 
-	P.SetInboundTfo(general.InboundTfo)
+	inbound.SetTfo(general.InboundTfo)
 
 	tcpIn := tunnel.TCPIn()
 	udpIn := tunnel.UDPIn()
diff --git a/hub/route/server.go b/hub/route/server.go
index 62a8c95a..2d533496 100644
--- a/hub/route/server.go
+++ b/hub/route/server.go
@@ -3,11 +3,11 @@ package route
 import (
 	"bytes"
 	"encoding/json"
-	"net"
 	"net/http"
 	"strings"
 	"time"
 
+	"github.com/Dreamacro/clash/adapter/inbound"
 	C "github.com/Dreamacro/clash/constant"
 	"github.com/Dreamacro/clash/log"
 	"github.com/Dreamacro/clash/tunnel/statistic"
@@ -85,7 +85,7 @@ func Start(addr string, secret string) {
 		})
 	}
 
-	l, err := net.Listen("tcp", addr)
+	l, err := inbound.Listen("tcp", addr)
 	if err != nil {
 		log.Errorln("External controller listen error: %s", err)
 		return
diff --git a/listener/http/server.go b/listener/http/server.go
index f507fac7..cf7948dd 100644
--- a/listener/http/server.go
+++ b/listener/http/server.go
@@ -1,10 +1,9 @@
 package http
 
 import (
-	"context"
-	"github.com/database64128/tfo-go/v2"
 	"net"
 
+	"github.com/Dreamacro/clash/adapter/inbound"
 	"github.com/Dreamacro/clash/common/cache"
 	C "github.com/Dreamacro/clash/constant"
 )
@@ -31,15 +30,12 @@ func (l *Listener) Close() error {
 	return l.listener.Close()
 }
 
-func New(addr string, inboundTfo bool, in chan<- C.ConnContext) (*Listener, error) {
-	return NewWithAuthenticate(addr, in, true, inboundTfo)
+func New(addr string, in chan<- C.ConnContext) (*Listener, error) {
+	return NewWithAuthenticate(addr, in, true)
 }
 
-func NewWithAuthenticate(addr string, in chan<- C.ConnContext, authenticate bool, inboundTfo bool) (*Listener, error) {
-	lc := tfo.ListenConfig{
-		DisableTFO: !inboundTfo,
-	}
-	l, err := lc.Listen(context.Background(), "tcp", addr)
+func NewWithAuthenticate(addr string, in chan<- C.ConnContext, authenticate bool) (*Listener, error) {
+	l, err := inbound.Listen("tcp", addr)
 
 	if err != nil {
 		return nil, err
diff --git a/listener/listener.go b/listener/listener.go
index ff7eb9d1..dfae99dc 100644
--- a/listener/listener.go
+++ b/listener/listener.go
@@ -14,7 +14,6 @@ import (
 	C "github.com/Dreamacro/clash/constant"
 	"github.com/Dreamacro/clash/listener/autoredir"
 	"github.com/Dreamacro/clash/listener/http"
-	"github.com/Dreamacro/clash/listener/inner"
 	"github.com/Dreamacro/clash/listener/mixed"
 	"github.com/Dreamacro/clash/listener/redir"
 	"github.com/Dreamacro/clash/listener/sing_shadowsocks"
@@ -29,7 +28,6 @@ import (
 var (
 	allowLan    = false
 	bindAddress = "*"
-	inboundTfo  = false
 
 	socksListener       *socks.Listener
 	socksUDPListener    *socks.UDPListener
@@ -103,14 +101,6 @@ func SetBindAddress(host string) {
 	bindAddress = host
 }
 
-func SetInboundTfo(itfo bool) {
-	inboundTfo = itfo
-}
-
-func NewInner(tcpIn chan<- C.ConnContext) {
-	inner.New(tcpIn)
-}
-
 func ReCreateHTTP(port int, tcpIn chan<- C.ConnContext) {
 	httpMux.Lock()
 	defer httpMux.Unlock()
@@ -136,7 +126,7 @@ func ReCreateHTTP(port int, tcpIn chan<- C.ConnContext) {
 		return
 	}
 
-	httpListener, err = http.New(addr, inboundTfo, tcpIn)
+	httpListener, err = http.New(addr, tcpIn)
 	if err != nil {
 		log.Errorln("Start HTTP server error: %s", err.Error())
 		return
@@ -187,7 +177,7 @@ func ReCreateSocks(port int, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.P
 		return
 	}
 
-	tcpListener, err := socks.New(addr, inboundTfo, tcpIn)
+	tcpListener, err := socks.New(addr, tcpIn)
 	if err != nil {
 		return
 	}
@@ -280,7 +270,7 @@ func ReCreateShadowSocks(shadowSocksConfig string, tcpIn chan<- C.ConnContext, u
 		return
 	}
 
-	listener, err := sing_shadowsocks.New(shadowSocksConfig, inboundTfo, tcpIn, udpIn)
+	listener, err := sing_shadowsocks.New(shadowSocksConfig, tcpIn, udpIn)
 	if err != nil {
 		return
 	}
@@ -320,7 +310,7 @@ func ReCreateVmess(vmessConfig string, tcpIn chan<- C.ConnContext, udpIn chan<-
 		return
 	}
 
-	listener, err := sing_vmess.New(vmessConfig, inboundTfo, tcpIn, udpIn)
+	listener, err := sing_vmess.New(vmessConfig, tcpIn, udpIn)
 	if err != nil {
 		return
 	}
@@ -487,7 +477,7 @@ func ReCreateMixed(port int, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.P
 		return
 	}
 
-	mixedListener, err = mixed.New(addr, inboundTfo, tcpIn)
+	mixedListener, err = mixed.New(addr, tcpIn)
 	if err != nil {
 		return
 	}
diff --git a/listener/mixed/mixed.go b/listener/mixed/mixed.go
index 0fcaa80f..0ee50ba4 100644
--- a/listener/mixed/mixed.go
+++ b/listener/mixed/mixed.go
@@ -1,8 +1,7 @@
 package mixed
 
 import (
-	"context"
-	"github.com/database64128/tfo-go/v2"
+	"github.com/Dreamacro/clash/adapter/inbound"
 	"net"
 
 	"github.com/Dreamacro/clash/common/cache"
@@ -38,11 +37,8 @@ func (l *Listener) Close() error {
 	return l.listener.Close()
 }
 
-func New(addr string, inboundTfo bool, in chan<- C.ConnContext) (*Listener, error) {
-	lc := tfo.ListenConfig{
-		DisableTFO: !inboundTfo,
-	}
-	l, err := lc.Listen(context.Background(), "tcp", addr)
+func New(addr string, in chan<- C.ConnContext) (*Listener, error) {
+	l, err := inbound.Listen("tcp", addr)
 	if err != nil {
 		return nil, err
 	}
diff --git a/listener/shadowsocks/tcp.go b/listener/shadowsocks/tcp.go
index 37d29e61..c37892bb 100644
--- a/listener/shadowsocks/tcp.go
+++ b/listener/shadowsocks/tcp.go
@@ -1,8 +1,6 @@
 package shadowsocks
 
 import (
-	"context"
-	"github.com/database64128/tfo-go/v2"
 	"net"
 	"strings"
 
@@ -23,7 +21,7 @@ type Listener struct {
 
 var _listener *Listener
 
-func New(config string, inboundTfo bool, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.PacketAdapter) (*Listener, error) {
+func New(config string, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.PacketAdapter) (*Listener, error) {
 	addr, cipher, password, err := ParseSSURL(config)
 	if err != nil {
 		return nil, err
@@ -48,10 +46,7 @@ func New(config string, inboundTfo bool, tcpIn chan<- C.ConnContext, udpIn chan<
 		sl.udpListeners = append(sl.udpListeners, ul)
 
 		//TCP
-		lc := tfo.ListenConfig{
-			DisableTFO: !inboundTfo,
-		}
-		l, err := lc.Listen(context.Background(), "tcp", addr)
+		l, err := inbound.Listen("tcp", addr)
 		if err != nil {
 			return nil, err
 		}
diff --git a/listener/sing_shadowsocks/server.go b/listener/sing_shadowsocks/server.go
index bd500625..b7073e5d 100644
--- a/listener/sing_shadowsocks/server.go
+++ b/listener/sing_shadowsocks/server.go
@@ -3,7 +3,6 @@ package sing_shadowsocks
 import (
 	"context"
 	"fmt"
-	"github.com/database64128/tfo-go/v2"
 	"net"
 	"strings"
 
@@ -33,7 +32,7 @@ type Listener struct {
 
 var _listener *Listener
 
-func New(config string, inboundTfo bool, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.PacketAdapter) (C.AdvanceListener, error) {
+func New(config string, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.PacketAdapter) (C.AdvanceListener, error) {
 	addr, cipher, password, err := embedSS.ParseSSURL(config)
 	if err != nil {
 		return nil, err
@@ -57,7 +56,7 @@ func New(config string, inboundTfo bool, tcpIn chan<- C.ConnContext, udpIn chan<
 		sl.service, err = shadowaead_2022.NewServiceWithPassword(cipher, password, udpTimeout, h)
 	default:
 		err = fmt.Errorf("shadowsocks: unsupported method: %s", cipher)
-		return embedSS.New(config, inboundTfo, tcpIn, udpIn)
+		return embedSS.New(config, tcpIn, udpIn)
 	}
 	if err != nil {
 		return nil, err
@@ -101,10 +100,7 @@ func New(config string, inboundTfo bool, tcpIn chan<- C.ConnContext, udpIn chan<
 		}()
 
 		//TCP
-		lc := tfo.ListenConfig{
-			DisableTFO: !inboundTfo,
-		}
-		l, err := lc.Listen(context.Background(), "tcp", addr)
+		l, err := inbound.Listen("tcp", addr)
 		if err != nil {
 			return nil, err
 		}
diff --git a/listener/sing_vmess/server.go b/listener/sing_vmess/server.go
index f859d848..c02a2c79 100644
--- a/listener/sing_vmess/server.go
+++ b/listener/sing_vmess/server.go
@@ -2,7 +2,6 @@ package sing_vmess
 
 import (
 	"context"
-	"github.com/database64128/tfo-go/v2"
 	"net"
 	"net/url"
 	"strings"
@@ -25,7 +24,7 @@ type Listener struct {
 
 var _listener *Listener
 
-func New(config string, inboundTfo bool, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.PacketAdapter) (*Listener, error) {
+func New(config string, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.PacketAdapter) (*Listener, error) {
 	addr, username, password, err := parseVmessURL(config)
 	if err != nil {
 		return nil, err
@@ -55,10 +54,7 @@ func New(config string, inboundTfo bool, tcpIn chan<- C.ConnContext, udpIn chan<
 		addr := addr
 
 		//TCP
-		lc := tfo.ListenConfig{
-			DisableTFO: !inboundTfo,
-		}
-		l, err := lc.Listen(context.Background(), "tcp", addr)
+		l, err := inbound.Listen("tcp", addr)
 		if err != nil {
 			return nil, err
 		}
diff --git a/listener/socks/tcp.go b/listener/socks/tcp.go
index 13a33d1b..8961c393 100644
--- a/listener/socks/tcp.go
+++ b/listener/socks/tcp.go
@@ -1,8 +1,6 @@
 package socks
 
 import (
-	"context"
-	"github.com/database64128/tfo-go/v2"
 	"io"
 	"net"
 
@@ -36,11 +34,8 @@ func (l *Listener) Close() error {
 	return l.listener.Close()
 }
 
-func New(addr string, inboundTfo bool, in chan<- C.ConnContext) (*Listener, error) {
-	lc := tfo.ListenConfig{
-		DisableTFO: !inboundTfo,
-	}
-	l, err := lc.Listen(context.Background(), "tcp", addr)
+func New(addr string, in chan<- C.ConnContext) (*Listener, error) {
+	l, err := inbound.Listen("tcp", addr)
 	if err != nil {
 		return nil, err
 	}
diff --git a/listener/tunnel/tcp.go b/listener/tunnel/tcp.go
index d51ec47a..3c591230 100644
--- a/listener/tunnel/tcp.go
+++ b/listener/tunnel/tcp.go
@@ -32,7 +32,7 @@ func New(config string, in chan<- C.ConnContext) (*Listener, error) {
 				log.Errorln("invalid target address %q", target)
 				return
 			}
-			l, err := net.Listen("tcp", addr)
+			l, err := inbound.Listen("tcp", addr)
 			if err != nil {
 				return
 			}