diff --git a/assets/translations/strings_en.i18n.json b/assets/translations/strings_en.i18n.json
index cf340c63..3f4e2d8a 100644
--- a/assets/translations/strings_en.i18n.json
+++ b/assets/translations/strings_en.i18n.json
@@ -214,7 +214,8 @@
             "serviceModes": {
                 "proxy": "Proxy Service Only",
                 "systemProxy": "Set System Proxy",
-                "tun": "VPN"
+                "tun": "VPN",
+                "tunService": "VPN Service"
             },
             "section": {
                 "route": "Route Options",
diff --git a/lib/features/config_option/data/config_option_repository.dart b/lib/features/config_option/data/config_option_repository.dart
index dc5f05cf..79519308 100644
--- a/lib/features/config_option/data/config_option_repository.dart
+++ b/lib/features/config_option/data/config_option_repository.dart
@@ -191,6 +191,7 @@ class SingBoxConfigOptionRepositoryImpl
           enableClashApi: persisted.enableClashApi,
           clashApiPort: persisted.clashApiPort,
           enableTun: persisted.serviceMode == ServiceMode.tun,
+          enableTunService: persisted.serviceMode == ServiceMode.tunService,
           setSystemProxy: persisted.serviceMode == ServiceMode.systemProxy,
           bypassLan: persisted.bypassLan,
           allowConnectionFromLan: persisted.allowConnectionFromLan,
diff --git a/lib/features/connection/data/connection_repository.dart b/lib/features/connection/data/connection_repository.dart
index 9e53b74c..9d3aeb5b 100644
--- a/lib/features/connection/data/connection_repository.dart
+++ b/lib/features/connection/data/connection_repository.dart
@@ -159,11 +159,11 @@ class ConnectionRepositoryImpl
         await $(
           TaskEither(() async {
             if (options.enableTun) {
-              // final hasPrivilege = await platformSource.checkPrivilege();
-              // if (!hasPrivilege) {
-              //   loggy.warning("missing privileges for tun mode");
-              //   return left(const MissingPrivilege());
-              // }
+              final hasPrivilege = await platformSource.checkPrivilege();
+              if (!hasPrivilege) {
+                loggy.warning("missing privileges for tun mode");
+                return left(const MissingPrivilege());
+              }
             }
             return right(unit);
           }),
@@ -192,11 +192,11 @@ class ConnectionRepositoryImpl
         await $(
           TaskEither(() async {
             if (options.enableTun) {
-              // final hasPrivilege = await platformSource.checkPrivilege();
-              // if (!hasPrivilege) {
-              //   loggy.warning("missing privileges for tun mode");
-              //   return left(const MissingPrivilege());
-              // }
+              final hasPrivilege = await platformSource.checkPrivilege();
+              if (!hasPrivilege) {
+                loggy.warning("missing privileges for tun mode");
+                return left(const MissingPrivilege());
+              }
             }
             return right(unit);
           }),
diff --git a/lib/singbox/model/singbox_config_enum.dart b/lib/singbox/model/singbox_config_enum.dart
index 30aaac78..cea3730f 100644
--- a/lib/singbox/model/singbox_config_enum.dart
+++ b/lib/singbox/model/singbox_config_enum.dart
@@ -6,7 +6,8 @@ import 'package:json_annotation/json_annotation.dart';
 enum ServiceMode {
   proxy("proxy"),
   systemProxy("system-proxy"),
-  tun("vpn");
+  tun("vpn"),
+  tunService("vpnService");
 
   const ServiceMode(this.key);
 
@@ -27,6 +28,8 @@ enum ServiceMode {
         systemProxy => t.settings.config.serviceModes.systemProxy,
         tun =>
           "${t.settings.config.serviceModes.tun}${PlatformUtils.isDesktop ? " (${t.settings.experimental})" : ""}",
+        tunService =>
+          "${t.settings.config.serviceModes.tunService}${PlatformUtils.isDesktop ? " (${t.settings.experimental})" : ""}",
       };
 }
 
diff --git a/lib/singbox/model/singbox_config_option.dart b/lib/singbox/model/singbox_config_option.dart
index 5cbf4614..1dd9dbd8 100644
--- a/lib/singbox/model/singbox_config_option.dart
+++ b/lib/singbox/model/singbox_config_option.dart
@@ -33,6 +33,7 @@ class SingboxConfigOption with _$SingboxConfigOption {
     required bool enableClashApi,
     required int clashApiPort,
     required bool enableTun,
+    required bool enableTunService,
     required bool setSystemProxy,
     required bool bypassLan,
     required bool allowConnectionFromLan,
diff --git a/linux/packaging/appimage/AppRun b/linux/packaging/appimage/AppRun
index 0133767f..51d29413 100644
--- a/linux/packaging/appimage/AppRun
+++ b/linux/packaging/appimage/AppRun
@@ -2,7 +2,7 @@
 
 cd "\$(dirname "\$0")"
 export LD_LIBRARY_PATH=usr/lib
-if [ $1 == "HiddifyService" ];then
+if [ "$1" == "HiddifyService" ];then
     exec ./$@
 else
     exec ./$appName $@