diff --git a/hub/executor/executor.go b/hub/executor/executor.go
index e261ef9e..dd62c7f2 100644
--- a/hub/executor/executor.go
+++ b/hub/executor/executor.go
@@ -2,7 +2,7 @@ package executor
 
 import (
 	"fmt"
-
+	"github.com/Dreamacro/clash/listener/tun/ipstack/commons"
 	"net"
 	"os"
 	"runtime"
@@ -75,14 +75,14 @@ func ApplyConfig(cfg *config.Config, force bool) {
 	defer mux.Unlock()
 
 	updateUsers(cfg.Users)
-	updateHosts(cfg.Hosts)
 	updateProxies(cfg.Proxies, cfg.Providers)
 	updateRules(cfg.Rules, cfg.RuleProviders)
 	updateGeneral(cfg.General, force)
 	updateDNS(cfg.DNS, cfg.Tun)
 	updateTun(cfg.Tun)
-	updateIPTables(cfg.DNS, cfg.General, cfg.Tun)
+	autoUpdateIPTables(cfg.DNS, cfg.General, cfg.Tun)
 	updateExperimental(cfg)
+	updateHosts(cfg.Hosts)
 	loadProvider(cfg.RuleProviders, cfg.Providers)
 	updateProfile(cfg)
 
@@ -301,6 +301,13 @@ func patchSelectGroup(proxies map[string]C.Proxy) {
 	}
 }
 
+func autoUpdateIPTables(dns *config.DNS, general *config.General, tun *config.Tun) {
+	updateIPTables(dns, general, tun)
+	go commons.DefaultInterfaceChangeMonitor(func(_ string) {
+		updateIPTables(dns, general, tun)
+	})
+}
+
 func updateIPTables(dns *config.DNS, general *config.General, tun *config.Tun) {
 	tproxy.CleanUpTProxyLinuxIPTables()
 
@@ -340,7 +347,7 @@ func updateIPTables(dns *config.DNS, general *config.General, tun *config.Tun) {
 		dialer.DefaultRoutingMark.Store(2158)
 	}
 	if general.AutoIptables {
-		err = tproxy.SetTProxyLinuxIPTables(general.Interface, general.TProxyPort, dnsPort)
+		err = tproxy.SetTProxyLinuxIPTables(dialer.DefaultInterface.Load(), general.TProxyPort, dnsPort)
 	}
 }
 
diff --git a/listener/tun/ipstack/commons/router.go b/listener/tun/ipstack/commons/router.go
index 1cebfa98..86458948 100644
--- a/listener/tun/ipstack/commons/router.go
+++ b/listener/tun/ipstack/commons/router.go
@@ -24,7 +24,7 @@ func ipv4MaskString(bits int) string {
 	return fmt.Sprintf("%d.%d.%d.%d", m[0], m[1], m[2], m[3])
 }
 
-func defaultInterfaceChangeMonitor() {
+func DefaultInterfaceChangeMonitor(cb func(ifName string)) {
 	t := time.NewTicker(defaultInterfaceMonitorDuration)
 	defer t.Stop()
 
@@ -43,6 +43,9 @@ func defaultInterfaceChangeMonitor() {
 		}
 
 		dialer.DefaultInterface.Store(interfaceName)
+		if cb != nil {
+			cb(interfaceName)
+		}
 
 		log.Warnln("[TUN] default interface changed by monitor, %s => %s", old, interfaceName)
 	}
diff --git a/listener/tun/ipstack/commons/router_darwin.go b/listener/tun/ipstack/commons/router_darwin.go
index 4185a48a..77f0abaf 100644
--- a/listener/tun/ipstack/commons/router_darwin.go
+++ b/listener/tun/ipstack/commons/router_darwin.go
@@ -54,7 +54,7 @@ func configInterfaceRouting(interfaceName string, addr netip.Prefix) error {
 		}
 	}
 
-	go defaultInterfaceChangeMonitor()
+	go DefaultInterfaceChangeMonitor(nil)
 
 	return execRouterCmd("add", "-inet6", "2000::/3", interfaceName)
 }
diff --git a/listener/tun/ipstack/commons/router_linux.go b/listener/tun/ipstack/commons/router_linux.go
index 63479bae..be239989 100644
--- a/listener/tun/ipstack/commons/router_linux.go
+++ b/listener/tun/ipstack/commons/router_linux.go
@@ -42,7 +42,7 @@ func configInterfaceRouting(interfaceName string, addr netip.Prefix) error {
 		}
 	}
 
-	go defaultInterfaceChangeMonitor()
+	go DefaultInterfaceChangeMonitor(nil)
 
 	return nil
 }
diff --git a/listener/tun/ipstack/commons/router_windows.go b/listener/tun/ipstack/commons/router_windows.go
index 5ddcf709..8c761c66 100644
--- a/listener/tun/ipstack/commons/router_windows.go
+++ b/listener/tun/ipstack/commons/router_windows.go
@@ -203,7 +203,7 @@ startOver:
 
 	wintunInterfaceName = dev.Name()
 
-	go defaultInterfaceChangeMonitor()
+	go DefaultInterfaceChangeMonitor(nil)
 
 	return nil
 }