diff --git a/src/main/scala/com/github/shadowsocks/ShadowsocksNatService.scala b/src/main/scala/com/github/shadowsocks/ShadowsocksNatService.scala
index dd4cbe17..438d5f6b 100644
--- a/src/main/scala/com/github/shadowsocks/ShadowsocksNatService.scala
+++ b/src/main/scala/com/github/shadowsocks/ShadowsocksNatService.scala
@@ -151,8 +151,6 @@ class ShadowsocksNatService extends BaseService {
 
       if (profile.auth) cmd += "-A"
 
-      if (TcpFastOpen.sendEnabled) cmd += "--fast-open"
-
       if (BuildConfig.DEBUG) Log.d(TAG, cmd.mkString(" "))
 
       sstunnelProcess = new GuardedProcess(cmd).start()
diff --git a/src/main/scala/com/github/shadowsocks/ShadowsocksVpnService.scala b/src/main/scala/com/github/shadowsocks/ShadowsocksVpnService.scala
index a95dc06c..7a052de4 100644
--- a/src/main/scala/com/github/shadowsocks/ShadowsocksVpnService.scala
+++ b/src/main/scala/com/github/shadowsocks/ShadowsocksVpnService.scala
@@ -236,8 +236,6 @@ class ShadowsocksVpnService extends VpnService with BaseService {
 
     if (profile.auth) cmd += "-A"
 
-    if (TcpFastOpen.sendEnabled) cmd += "--fast-open"
-
     if (BuildConfig.DEBUG) Log.d(TAG, cmd.mkString(" "))
 
     sstunnelProcess = new GuardedProcess(cmd).start()
@@ -285,6 +283,8 @@ class ShadowsocksVpnService extends VpnService with BaseService {
       cmd += (getApplicationInfo.dataDir + "/acl.list")
     }
 
+    if (TcpFastOpen.sendEnabled) cmd += "--fast-open"
+
     if (BuildConfig.DEBUG) Log.d(TAG, cmd.mkString(" "))
 
     sslocalProcess = new GuardedProcess(cmd).start()
@@ -314,8 +314,6 @@ class ShadowsocksVpnService extends VpnService with BaseService {
 
     if (profile.auth) cmd += "-A"
 
-    if (TcpFastOpen.sendEnabled) cmd += "--fast-open"
-
     if (BuildConfig.DEBUG) Log.d(TAG, cmd.mkString(" "))
 
     sstunnelProcess = new GuardedProcess(cmd).start()