diff --git a/README.md b/README.md
index c9d5c0d8..fcbdd513 100644
--- a/README.md
+++ b/README.md
@@ -153,9 +153,7 @@ tproxy-port: 9898
 tun:
   enable: false
 ```
-Create user given name `clash`.
-
-Run Clash by user `clash` as a daemon.
+Run Clash as a daemon.
 
 Create the systemd configuration file at /etc/systemd/system/clash.service:
 ```shell
@@ -165,10 +163,7 @@ After=network.target
 
 [Service]
 Type=simple
-User=clash
-Group=clash
 CapabilityBoundingSet=cap_net_admin
-AmbientCapabilities=cap_net_admin
 Restart=always
 ExecStart=/usr/local/bin/clash -d /etc/clash
 
diff --git a/hub/executor/executor.go b/hub/executor/executor.go
index 7dd76644..f2fab98b 100644
--- a/hub/executor/executor.go
+++ b/hub/executor/executor.go
@@ -280,6 +280,10 @@ func updateIPTables(dns *config.DNS, general *config.General) {
 
 	tproxy.CleanUpTProxyLinuxIPTables()
 
+	if dialer.DefaultRoutingMark.Load() == 0 {
+		dialer.DefaultRoutingMark.Store(2158)
+	}
+
 	err = tproxy.SetTProxyLinuxIPTables(general.Interface, general.TProxyPort, dnsPort)
 
 	if err != nil {
diff --git a/listener/tproxy/tproxy_linux_iptables.go b/listener/tproxy/tproxy_linux_iptables.go
index 09650837..64e73c1f 100644
--- a/listener/tproxy/tproxy_linux_iptables.go
+++ b/listener/tproxy/tproxy_linux_iptables.go
@@ -4,10 +4,10 @@ import (
 	"errors"
 	"fmt"
 	"os/exec"
-	U "os/user"
 	"runtime"
 	"strings"
 
+	"github.com/Dreamacro/clash/component/dialer"
 	"github.com/Dreamacro/clash/log"
 )
 
@@ -20,7 +20,6 @@ var (
 const (
 	PROXY_FWMARK      = "0x2d0"
 	PROXY_ROUTE_TABLE = "0x2d0"
-	USERNAME          = "clash"
 )
 
 func SetTProxyLinuxIPTables(ifname string, tport int, dport int) error {
@@ -29,17 +28,10 @@ func SetTProxyLinuxIPTables(ifname string, tport int, dport int) error {
 		return fmt.Errorf("current operations system [%s] are not support iptables or command iptables does not exist", runtime.GOOS)
 	}
 
-	user, err := U.Lookup(USERNAME)
-	if err != nil {
-		return fmt.Errorf("the user \" %s\" does not exist, please create it", USERNAME)
-	}
-
 	if ifname == "" {
 		return errors.New("the 'interface-name' can not be empty")
 	}
 
-	ownerUid := user.Uid
-
 	interfaceName = ifname
 	tproxyPort = tport
 	dnsPort = dport
@@ -84,7 +76,7 @@ func SetTProxyLinuxIPTables(ifname string, tport int, dport int) error {
 	// set output
 	execCmd("iptables -t mangle -N clash_output")
 	execCmd("iptables -t mangle -F clash_output")
-	execCmd(fmt.Sprintf("iptables -t mangle -A clash_output -m owner --uid-owner %s -j RETURN", ownerUid))
+	execCmd(fmt.Sprintf("iptables -t mangle -A clash_output -m mark --mark %#x -j RETURN", dialer.DefaultRoutingMark.Load()))
 	execCmd("iptables -t mangle -A clash_output -p udp -m multiport --dports 53,123,137 -j ACCEPT")
 	execCmd("iptables -t mangle -A clash_output -p tcp --dport 53 -j ACCEPT")
 	execCmd("iptables -t mangle -A clash_output -m addrtype --dst-type LOCAL -j RETURN")
@@ -97,7 +89,7 @@ func SetTProxyLinuxIPTables(ifname string, tport int, dport int) error {
 	// set dns output
 	execCmd("iptables -t nat -N clash_dns_output")
 	execCmd("iptables -t nat -F clash_dns_output")
-	execCmd(fmt.Sprintf("iptables -t nat -A clash_dns_output -m owner --uid-owner %s -j RETURN", ownerUid))
+	execCmd(fmt.Sprintf("iptables -t nat -A clash_dns_output -m mark --mark %#x -j RETURN", dialer.DefaultRoutingMark.Load()))
 	execCmd("iptables -t nat -A clash_dns_output -s 172.17.0.0/16 -j RETURN")
 	execCmd(fmt.Sprintf("iptables -t nat -A clash_dns_output -p udp -j REDIRECT --to-ports %d", dnsPort))
 	execCmd(fmt.Sprintf("iptables -t nat -A clash_dns_output -p tcp -j REDIRECT --to-ports %d", dnsPort))
@@ -115,6 +107,10 @@ func CleanUpTProxyLinuxIPTables() {
 
 	log.Warnln("Clean up tproxy linux iptables")
 
+	if int(dialer.DefaultRoutingMark.Load()) == 2158 {
+		dialer.DefaultRoutingMark.Store(0)
+	}
+
 	if _, err := execCmd("iptables -t mangle -L clash_divert"); err != nil {
 		return
 	}