diff --git a/app/release/app-release.apk b/app/release/app-release.apk
index 884c4a2..4c4b973 100644
Binary files a/app/release/app-release.apk and b/app/release/app-release.apk differ
diff --git a/app/release/baselineProfiles/0/app-release.dm b/app/release/baselineProfiles/0/app-release.dm
index 58c9dc1..366611b 100644
Binary files a/app/release/baselineProfiles/0/app-release.dm and b/app/release/baselineProfiles/0/app-release.dm differ
diff --git a/app/release/baselineProfiles/1/app-release.dm b/app/release/baselineProfiles/1/app-release.dm
index f26fd47..9c739b5 100644
Binary files a/app/release/baselineProfiles/1/app-release.dm and b/app/release/baselineProfiles/1/app-release.dm differ
diff --git a/app/src/main/java/com/jihe/punchnet/PunchnetService.kt b/app/src/main/java/com/jihe/punchnet/PunchnetService.kt
index 9b9e430..34b0224 100644
--- a/app/src/main/java/com/jihe/punchnet/PunchnetService.kt
+++ b/app/src/main/java/com/jihe/punchnet/PunchnetService.kt
@@ -37,6 +37,7 @@ import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 import java.io.FileInputStream
 import java.io.FileOutputStream
+import java.util.concurrent.atomic.AtomicBoolean
 
 class PunchnetService : VpnService() , IfaceTun {
     private val TAG = "PunchnetService"
@@ -46,6 +47,9 @@ class PunchnetService : VpnService() , IfaceTun {
 
     private var vpnDescriptor: ParcelFileDescriptor? = null
 
+    private val serviceLock = Any()
+    private val isRunning = AtomicBoolean(false)
+
 
     var input: FileInputStream? = null
     var output: FileOutputStream? = null
@@ -125,56 +129,69 @@ class PunchnetService : VpnService() , IfaceTun {
     }
 
     private fun disconnect() {
-        Toast.makeText(this, "stop vpn called", Toast.LENGTH_LONG).show()
-        stopForeground(STOP_FOREGROUND_REMOVE)
-        input?.close()
-        output?.close()
-        vpnDescriptor?.close()
+        synchronized(serviceLock) {
+            if (!isRunning.get()) {
+                return
+            }
 
-        vpnDescriptor = null
+            Toast.makeText(this, "stop vpn called", Toast.LENGTH_LONG).show()
+            stopForeground(STOP_FOREGROUND_REMOVE)
+            input?.close()
+            output?.close()
+            vpnDescriptor?.close()
 
-        stopSelf()
+            vpnDescriptor = null
+            stopSelf()
+        }
     }
 
     private fun connect(startArg: PunchnetServiceArgument?) {
-        val iface = this
 
-        val server = "punchnet.aioe.tech"
+        synchronized(serviceLock) {
+            if (isRunning.get()) {
+                return
+            }
 
-        Log.d("DIR", "datadir = ${Environment.getDataDirectory().name}")
-        Log.d("DIR", "external storage = ${Environment.getExternalStorageDirectory().name}")
-        Log.d("DIR", "filesdir = ${this.filesDir.path}")
+            val iface = this
+            val server = "punchnet.aioe.tech"
 
-        arpTable.routeTable.clearRoute()
-        routes.clear()
-        for (route in startArg?.routes?.toList()?:listOf()) {
-            val r = RouteDetail(
-                mask = route.mask_ip,
-                gw = route.gateway,
-                maskedAddr = route.net_ip,
+            Log.d("DIR", "datadir = ${Environment.getDataDirectory().name}")
+            Log.d("DIR", "external storage = ${Environment.getExternalStorageDirectory().name}")
+            Log.d("DIR", "filesdir = ${this.filesDir.path}")
+
+            arpTable.routeTable.clearRoute()
+            routes.clear()
+            for (route in startArg?.routes?.toList()?:listOf()) {
+                val r = RouteDetail(
+                    mask = route.mask_ip,
+                    gw = route.gateway,
+                    maskedAddr = route.net_ip,
+                )
+                routes.add(route)
+                // val r = cidrToRouteDetail(route.targetNetCIDR, route.gateway)
+                arpTable.routeTable.addRoute(r)
+            }
+
+            val argument = Arguments(
+                baseDir = this.filesDir.path,
+                sn = "$server:1265",
+                tcp = "$server:18083",
+
+                nat_server1 = "$server:1265",
+                nat_server2 = "47.98.178.3:1265",
+                token = startArg?.token?:"",
+                name = "tau",
             )
-            routes.add(route)
-            // val r = cidrToRouteDetail(route.targetNetCIDR, route.gateway)
-            arpTable.routeTable.addRoute(r)
+
+            scope.launch {
+                run_sdlan(scope, iface, argument, startArg)
+            }
+
+            val notification = createNotification()
+            startForeground(1, notification)
+
+            isRunning.set(true)
         }
-
-        val argument = Arguments(
-            baseDir = this.filesDir.path,
-            sn = "$server:1265",
-            tcp = "$server:18083",
-
-            nat_server1 = "$server:1265",
-            nat_server2 = "47.98.178.3:1265",
-            token = startArg?.token?:"",
-            name = "tau",
-        )
-
-        scope.launch {
-            run_sdlan(scope, iface, argument, startArg)
-        }
-
-        val notification = createNotification()
-        startForeground(1, notification)
     }
 
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {