diff --git a/go/cmd/nekoray_core/core_ray.go b/go/cmd/nekoray_core/core_ray.go
index c417d2372..0d7b160cc 100644
--- a/go/cmd/nekoray_core/core_ray.go
+++ b/go/cmd/nekoray_core/core_ray.go
@@ -8,6 +8,7 @@ import (
 	"neko/pkg/neko_common"
 	"net"
 	"net/http"
+	"os"
 	"time"
 
 	"github.com/sirupsen/logrus"
@@ -18,7 +19,7 @@ import (
 
 var instance *libcore.V2RayInstance
 var getNekorayTunIndex = func() int { return 0 } // Windows only
-var underlyingNetDialer *net.Dialer              // Windows only
+var underlyingNetDialer *net.Dialer              // NKR_VPN_LEGACY_DNS only
 
 func setupCore() {
 	// TODO del
@@ -28,14 +29,16 @@ func setupCore() {
 	// localdns setup
 	resolver_def := &net.Resolver{PreferGo: false}
 	resolver_go := &net.Resolver{PreferGo: true}
-	if underlyingNetDialer != nil {
+	if underlyingNetDialer != nil && os.Getenv("NKR_VPN_LEGACY_DNS") == "1" {
+		resolver_def.Dial = underlyingNetDialer.DialContext
 		resolver_go.Dial = underlyingNetDialer.DialContext
+		logrus.Println("using NKR_VPN_LEGACY_DNS")
 	}
 	localdns.SetLookupFunc(func(network string, host string) (ips []net.IP, err error) {
 		// fix old sekai
 		defer func() {
 			if len(ips) == 0 {
-				logrus.Println("LookupIP error:", err)
+				logrus.Println("LookupIP error:", network, host, err)
 				err = dns.ErrEmptyResponse
 			}
 		}()
@@ -43,7 +46,7 @@ func setupCore() {
 		if getNekorayTunIndex() == 0 {
 			return resolver_def.LookupIP(context.Background(), network, host)
 		}
-		// VPN mode use Go resolver
+		// Windows VPN mode use Go resolver
 		return resolver_go.LookupIP(context.Background(), network, host)
 	})
 	//
diff --git a/go/cmd/nekoray_core/protect_fwmark_linux.go b/go/cmd/nekoray_core/protect_fwmark_linux.go
index 737033dd2..b335a53b5 100644
--- a/go/cmd/nekoray_core/protect_fwmark_linux.go
+++ b/go/cmd/nekoray_core/protect_fwmark_linux.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"libcore/protect"
 	"log"
+	"net"
 	"strings"
 	"syscall"
 
@@ -102,4 +103,12 @@ func is_fwmark_exist(number int) bool {
 
 func init() {
 	protect.FdProtector = &fwmarkProtector{}
+	underlyingNetDialer = &net.Dialer{
+		Control: func(network, address string, c syscall.RawConn) error {
+			c.Control(func(fd uintptr) {
+				protect.FdProtector.Protect(int32(fd))
+			})
+			return nil
+		},
+	}
 }
diff --git a/sys/ExternalProcess.cpp b/sys/ExternalProcess.cpp
index da6fc33eb..d8a6c7379 100644
--- a/sys/ExternalProcess.cpp
+++ b/sys/ExternalProcess.cpp
@@ -7,6 +7,7 @@
 namespace NekoRay::sys {
     ExternalProcess::ExternalProcess() : QProcess() {
         // qDebug() << "[Debug] ExternalProcess()" << this << running_ext;
+        this->env = QProcessEnvironment::systemEnvironment().toStringList();
     }
 
     ExternalProcess::~ExternalProcess() {
@@ -117,7 +118,6 @@ namespace NekoRay::sys {
 
     void CoreProcess::Start() {
         show_stderr = false;
-        env = QStringList();
         auto v2ray_asset_dir = FindCoreAsset("geoip.dat");
         if (!v2ray_asset_dir.isEmpty()) {
             v2ray_asset_dir = QFileInfo(v2ray_asset_dir).absolutePath();