diff --git a/adapter/provider/fetcher.go b/adapter/provider/fetcher.go
index 4a7be8b1..26029bc6 100644
--- a/adapter/provider/fetcher.go
+++ b/adapter/provider/fetcher.go
@@ -43,6 +43,14 @@ func (f *fetcher) Initial() (any, error) {
 		err     error
 		isLocal bool
 	)
+
+	defer func() {
+		// pull proxies automatically
+		if f.ticker != nil {
+			go f.pullLoop()
+		}
+	}()
+
 	if stat, fErr := os.Stat(f.vehicle.Path()); fErr == nil {
 		buf, err = os.ReadFile(f.vehicle.Path())
 		modTime := stat.ModTime()
@@ -84,11 +92,6 @@ func (f *fetcher) Initial() (any, error) {
 
 	f.hash = md5.Sum(buf)
 
-	// pull proxies automatically
-	if f.ticker != nil {
-		go f.pullLoop()
-	}
-
 	return proxies, nil
 }
 
diff --git a/adapter/provider/vehicle.go b/adapter/provider/vehicle.go
index 289ab3a0..ea987238 100644
--- a/adapter/provider/vehicle.go
+++ b/adapter/provider/vehicle.go
@@ -74,7 +74,7 @@ func (h *HTTPVehicle) Read() ([]byte, error) {
 		// from http.DefaultTransport
 		MaxIdleConns:          100,
 		IdleConnTimeout:       30 * time.Second,
-		TLSHandshakeTimeout:   10 * time.Second,
+		TLSHandshakeTimeout:   5 * time.Second,
 		ExpectContinueTimeout: 1 * time.Second,
 		DialContext: func(ctx context.Context, network, address string) (net.Conn, error) {
 			conn := inner.HandleTcp(address, uri.Hostname())
diff --git a/hub/executor/executor.go b/hub/executor/executor.go
index 8bf287f7..96dadc64 100644
--- a/hub/executor/executor.go
+++ b/hub/executor/executor.go
@@ -78,8 +78,8 @@ func ApplyConfig(cfg *config.Config, force bool) {
 	updateSniffer(cfg.Sniffer)
 	updateHosts(cfg.Hosts)
 	updateDNS(cfg.DNS)
-	loadProxyProvider(cfg.Providers)
-	loadRuleProvider(cfg.RuleProviders)
+
+	loadProviders(cfg)
 	updateGeneral(cfg.General, force)
 	updateIPTables(cfg)
 	updateTun(cfg.Tun, cfg.DNS)
@@ -89,6 +89,12 @@ func ApplyConfig(cfg *config.Config, force bool) {
 	log.SetLevel(cfg.General.LogLevel)
 }
 
+func loadProviders(cfg *config.Config) {
+	P.NewInner(tunnel.TCPIn())
+	loadProxyProvider(cfg.Providers)
+	loadRuleProvider(cfg.RuleProviders)
+}
+
 func GetGeneral() *config.General {
 	ports := P.GetPorts()
 	var authenticator []string
@@ -188,7 +194,7 @@ func loadProvider(pv provider.Provider) {
 		log.Infoln("Start initial provider %s", (pv).Name())
 	}
 
-	if err := (pv).Initial(); err != nil {
+	if err := pv.Initial(); err != nil {
 		switch pv.Type() {
 		case provider.Proxy:
 			{
diff --git a/listener/listener.go b/listener/listener.go
index 62019f68..8644d500 100644
--- a/listener/listener.go
+++ b/listener/listener.go
@@ -83,6 +83,10 @@ func SetBindAddress(host string) {
 	bindAddress = host
 }
 
+func NewInner(tcpIn chan<- C.ConnContext) {
+	inner.New(tcpIn)
+}
+
 func ReCreateHTTP(port int, tcpIn chan<- C.ConnContext) {
 	httpMux.Lock()
 	defer httpMux.Unlock()
@@ -127,7 +131,6 @@ func ReCreateSocks(port int, tcpIn chan<- C.ConnContext, udpIn chan<- *inbound.P
 			log.Errorln("Start SOCKS server error: %s", err.Error())
 		}
 	}()
-	inner.New(tcpIn)
 
 	addr := genAddr(bindAddress, port, allowLan)
 
diff --git a/rule/provider/fetcher.go b/rule/provider/fetcher.go
index c7ab9141..c56dfe29 100644
--- a/rule/provider/fetcher.go
+++ b/rule/provider/fetcher.go
@@ -44,6 +44,12 @@ func (f *fetcher) Initial() (interface{}, error) {
 		err      error
 	)
 
+	defer func() {
+		if f.ticker != nil {
+			go f.pullLoop()
+		}
+	}()
+
 	if stat, fErr := os.Stat(f.vehicle.Path()); fErr == nil {
 		buf, err = ioutil.ReadFile(f.vehicle.Path())
 		modTime := stat.ModTime()
@@ -83,9 +89,6 @@ func (f *fetcher) Initial() (interface{}, error) {
 	}
 
 	f.hash = md5.Sum(buf)
-	if f.ticker != nil {
-		go f.pullLoop()
-	}
 
 	return rules, nil
 }
diff --git a/rule/provider/provider.go b/rule/provider/provider.go
index 1169d4c4..f2a4547d 100644
--- a/rule/provider/provider.go
+++ b/rule/provider/provider.go
@@ -118,7 +118,8 @@ func NewRuleSetProvider(name string, behavior P.RuleType, interval time.Duration
 		rp,
 	}
 
-	runtime.SetFinalizer(wrapper, rp.fetcher.Destroy())
+	final := func(provider *RuleSetProvider) { rp.fetcher.Destroy() }
+	runtime.SetFinalizer(wrapper, final)
 	return wrapper
 }