diff --git a/Cargo.lock b/Cargo.lock
index 750c9dd..b368d8b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -491,17 +491,6 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
-[[package]]
-name = "auto-launch"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f012b8cc0c850f34117ec8252a44418f2e34a2cf501de89e29b241ae5f79471"
-dependencies = [
- "dirs 4.0.0",
- "thiserror 1.0.63",
- "winreg 0.10.1",
-]
-
 [[package]]
 name = "auto_impl"
 version = "1.2.1"
@@ -2256,7 +2245,6 @@ dependencies = [
  "serde_json",
  "tauri",
  "tauri-build",
- "tauri-plugin-autostart",
  "tauri-plugin-clipboard-manager",
  "tauri-plugin-os",
  "tauri-plugin-positioner",
@@ -7703,13 +7691,14 @@ dependencies = [
 [[package]]
 name = "service-manager"
 version = "0.8.0"
-source = "git+https://github.com/chipsenkbeil/service-manager-rs.git?branch=main#0294d3b9769c8ef7db8b4e831fb1c4f14b7d473b"
+source = "git+https://github.com/EasyTier/service-manager-rs.git?branch=main#5eb28f7a686858eea4f4933534ed989d3b71dc2a"
 dependencies = [
  "cfg-if",
  "dirs 4.0.0",
  "encoding-utils",
  "encoding_rs",
  "plist",
+ "sys-info",
  "which 4.4.2",
  "xml-rs",
 ]
@@ -8319,6 +8308,16 @@ dependencies = [
  "syn 2.0.87",
 ]
 
+[[package]]
+name = "sys-info"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b3a0d0aba8bf96a0e1ddfdc352fc53b3df7f39318c71854910c3c4b024ae52c"
+dependencies = [
+ "cc",
+ "libc",
+]
+
 [[package]]
 name = "sys-locale"
 version = "0.3.1"
@@ -8584,20 +8583,6 @@ dependencies = [
  "walkdir",
 ]
 
-[[package]]
-name = "tauri-plugin-autostart"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "062cdcd483d5e3148c9a64dabf8c574e239e2aa1193cf208d95cf89a676f87a5"
-dependencies = [
- "auto-launch",
- "serde",
- "serde_json",
- "tauri",
- "tauri-plugin",
- "thiserror 2.0.11",
-]
-
 [[package]]
 name = "tauri-plugin-clipboard-manager"
 version = "2.3.0"
@@ -10891,15 +10876,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "winreg"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80d0f4e272c85def139476380b12f9ac60926689dd2e01d4923222f40580869d"
-dependencies = [
- "winapi",
-]
-
 [[package]]
 name = "winreg"
 version = "0.50.0"
diff --git a/easytier-contrib/easytier-ohrs/Cargo.lock b/easytier-contrib/easytier-ohrs/Cargo.lock
index 462f5f4..7182f8c 100644
--- a/easytier-contrib/easytier-ohrs/Cargo.lock
+++ b/easytier-contrib/easytier-ohrs/Cargo.lock
@@ -3882,13 +3882,14 @@ dependencies = [
 [[package]]
 name = "service-manager"
 version = "0.8.0"
-source = "git+https://github.com/chipsenkbeil/service-manager-rs.git?branch=main#0294d3b9769c8ef7db8b4e831fb1c4f14b7d473b"
+source = "git+https://github.com/EasyTier/service-manager-rs.git?branch=main#5eb28f7a686858eea4f4933534ed989d3b71dc2a"
 dependencies = [
  "cfg-if",
  "dirs",
  "encoding-utils",
  "encoding_rs",
  "plist",
+ "sys-info",
  "which 4.4.2",
  "xml-rs",
 ]
@@ -4071,6 +4072,16 @@ dependencies = [
  "syn 2.0.106",
 ]
 
+[[package]]
+name = "sys-info"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b3a0d0aba8bf96a0e1ddfdc352fc53b3df7f39318c71854910c3c4b024ae52c"
+dependencies = [
+ "cc",
+ "libc",
+]
+
 [[package]]
 name = "sys-locale"
 version = "0.3.2"
diff --git a/easytier-gui/src-tauri/Cargo.toml b/easytier-gui/src-tauri/Cargo.toml
index 65d458c..4e731bb 100644
--- a/easytier-gui/src-tauri/Cargo.toml
+++ b/easytier-gui/src-tauri/Cargo.toml
@@ -50,7 +50,7 @@ tauri-plugin-clipboard-manager = "2.3.0"
 tauri-plugin-positioner = { version = "2.3.0", features = ["tray-icon"] }
 tauri-plugin-vpnservice = { path = "../../tauri-plugin-vpnservice" }
 tauri-plugin-os = "2.3.0"
-tauri-plugin-autostart = "2.5.0"
+
 uuid = "1.17.0"
 async-trait = "0.1.89"
 
diff --git a/easytier-gui/src-tauri/capabilities/migrated.json b/easytier-gui/src-tauri/capabilities/migrated.json
index 7a29e5c..5c499eb 100644
--- a/easytier-gui/src-tauri/capabilities/migrated.json
+++ b/easytier-gui/src-tauri/capabilities/migrated.json
@@ -45,10 +45,6 @@
     "os:allow-arch",
     "os:allow-hostname",
     "os:allow-platform",
-    "os:allow-locale",
-    "autostart:default",
-    "autostart:allow-disable",
-    "autostart:allow-enable",
-    "autostart:allow-is-enabled"
+    "os:allow-locale"
   ]
 }
\ No newline at end of file
diff --git a/easytier-gui/src-tauri/src/lib.rs b/easytier-gui/src-tauri/src/lib.rs
index 6570c61..420596c 100644
--- a/easytier-gui/src-tauri/src/lib.rs
+++ b/easytier-gui/src-tauri/src/lib.rs
@@ -3,6 +3,7 @@
 
 mod elevate;
 
+use anyhow::Context;
 use easytier::proto::api::manage::{
     CollectNetworkInfoResponse, ValidateConfigResponse, WebClientService,
     WebClientServiceClientFactory,
@@ -17,10 +18,11 @@ use easytier::{
     launcher::NetworkConfig,
     rpc_service::ApiRpcServer,
     tunnel::ring::RingTunnelListener,
-    utils::{self, NewFilterSender},
+    utils::{self},
 };
 use std::ops::Deref;
 use std::sync::Arc;
+use tokio::sync::{RwLock, RwLockReadGuard};
 use uuid::Uuid;
 
 use tauri::{AppHandle, Emitter, Manager as _};
@@ -28,19 +30,27 @@ use tauri::{AppHandle, Emitter, Manager as _};
 #[cfg(not(target_os = "android"))]
 use tauri::tray::{MouseButton, MouseButtonState, TrayIconBuilder, TrayIconEvent};
 
-pub const AUTOSTART_ARG: &str = "--autostart";
-
-static INSTANCE_MANAGER: once_cell::sync::Lazy<Arc<NetworkInstanceManager>> =
-    once_cell::sync::Lazy::new(|| Arc::new(NetworkInstanceManager::new()));
-
-static mut LOGGER_LEVEL_SENDER: once_cell::sync::Lazy<Option<NewFilterSender>> =
-    once_cell::sync::Lazy::new(Default::default);
+static INSTANCE_MANAGER: once_cell::sync::Lazy<RwLock<Option<Arc<NetworkInstanceManager>>>> =
+    once_cell::sync::Lazy::new(|| RwLock::new(None));
 
 static RPC_RING_UUID: once_cell::sync::Lazy<uuid::Uuid> =
     once_cell::sync::Lazy::new(uuid::Uuid::new_v4);
 
-static CLIENT_MANAGER: once_cell::sync::OnceCell<manager::GUIClientManager> =
-    once_cell::sync::OnceCell::new();
+static CLIENT_MANAGER: once_cell::sync::Lazy<RwLock<Option<manager::GUIClientManager>>> =
+    once_cell::sync::Lazy::new(|| RwLock::new(None));
+
+static RING_RPC_SERVER: once_cell::sync::Lazy<RwLock<Option<ApiRpcServer<RingTunnelListener>>>> =
+    once_cell::sync::Lazy::new(|| RwLock::new(None));
+
+macro_rules! get_client_manager {
+    () => {{
+        let guard = CLIENT_MANAGER
+            .try_read()
+            .map_err(|_| "Failed to acquire read lock for client manager")?;
+        RwLockReadGuard::try_map(guard, |cm| cm.as_ref())
+            .map_err(|_| "RPC connection not initialized".to_string())
+    }};
+}
 
 #[tauri::command]
 fn easytier_version() -> Result<String, String> {
@@ -88,19 +98,17 @@ async fn run_network_instance(
     app.emit("pre_run_network_instance", cfg.instance_id())
         .map_err(|e| e.to_string())?;
 
+    let client_manager = get_client_manager!()?;
+
     #[cfg(target_os = "android")]
     if cfg.no_tun() == false {
-        CLIENT_MANAGER
-            .get()
-            .unwrap()
+        client_manager
             .disable_instances_with_tun(&app)
             .await
             .map_err(|e| e.to_string())?;
     }
 
-    CLIENT_MANAGER
-        .get()
-        .unwrap()
+    client_manager
         .handle_run_network_instance(app.clone(), cfg, save)
         .await
         .map_err(|e| e.to_string())?;
@@ -118,31 +126,32 @@ async fn collect_network_info(
     let instance_id = instance_id
         .parse()
         .map_err(|e: uuid::Error| e.to_string())?;
-    CLIENT_MANAGER
-        .get()
-        .unwrap()
+    get_client_manager!()?
         .handle_collect_network_info(app, Some(vec![instance_id]))
         .await
         .map_err(|e| e.to_string())
 }
 
 #[tauri::command]
-fn set_logging_level(level: String) -> Result<(), String> {
-    #[allow(static_mut_refs)]
-    let sender = unsafe { LOGGER_LEVEL_SENDER.as_ref().unwrap() };
-    sender.send(level).map_err(|e| e.to_string())?;
+async fn set_logging_level(level: String) -> Result<(), String> {
+    println!("Setting logging level to: {}", level);
+    get_client_manager!()?
+        .set_logging_level(level.clone())
+        .await
+        .map_err(|e| e.to_string())?;
     Ok(())
 }
 
 #[tauri::command]
-fn set_tun_fd(fd: i32) -> Result<(), String> {
-    if let Some(uuid) = CLIENT_MANAGER
-        .get()
-        .unwrap()
+async fn set_tun_fd(fd: i32) -> Result<(), String> {
+    let Some(instance_manager) = INSTANCE_MANAGER.read().await.clone() else {
+        return Err("set_tun_fd is not supported in remote mode".to_string());
+    };
+    if let Some(uuid) = get_client_manager!()?
         .get_enabled_instances_with_tun_ids()
         .next()
     {
-        INSTANCE_MANAGER
+        instance_manager
             .set_tun_fd(&uuid, fd)
             .map_err(|e| e.to_string())?;
     }
@@ -153,9 +162,7 @@ fn set_tun_fd(fd: i32) -> Result<(), String> {
 async fn list_network_instance_ids(
     app: AppHandle,
 ) -> Result<ListNetworkInstanceIdsJsonResp, String> {
-    CLIENT_MANAGER
-        .get()
-        .unwrap()
+    get_client_manager!()?
         .handle_list_network_instance_ids(app)
         .await
         .map_err(|e| e.to_string())
@@ -166,16 +173,12 @@ async fn remove_network_instance(app: AppHandle, instance_id: String) -> Result<
     let instance_id = instance_id
         .parse()
         .map_err(|e: uuid::Error| e.to_string())?;
-    CLIENT_MANAGER
-        .get()
-        .unwrap()
+    let client_manager = get_client_manager!()?;
+    client_manager
         .handle_remove_network_instances(app.clone(), vec![instance_id])
         .await
         .map_err(|e| e.to_string())?;
-    CLIENT_MANAGER
-        .get()
-        .unwrap()
-        .notify_vpn_stop_if_no_tun(&app)?;
+    client_manager.notify_vpn_stop_if_no_tun(&app)?;
     Ok(())
 }
 
@@ -188,17 +191,13 @@ async fn update_network_config_state(
     let instance_id = instance_id
         .parse()
         .map_err(|e: uuid::Error| e.to_string())?;
-    CLIENT_MANAGER
-        .get()
-        .unwrap()
+    let client_manager = get_client_manager!()?;
+    client_manager
         .handle_update_network_state(app.clone(), instance_id, disabled)
         .await
         .map_err(|e| e.to_string())?;
     if disabled {
-        CLIENT_MANAGER
-            .get()
-            .unwrap()
-            .notify_vpn_stop_if_no_tun(&app)?;
+        client_manager.notify_vpn_stop_if_no_tun(&app)?;
     }
     Ok(())
 }
@@ -209,9 +208,7 @@ async fn save_network_config(app: AppHandle, cfg: NetworkConfig) -> Result<(), S
         .instance_id()
         .parse()
         .map_err(|e: uuid::Error| e.to_string())?;
-    CLIENT_MANAGER
-        .get()
-        .unwrap()
+    get_client_manager!()?
         .handle_save_network_config(app, instance_id, cfg)
         .await
         .map_err(|e| e.to_string())
@@ -222,9 +219,7 @@ async fn validate_config(
     app: AppHandle,
     config: NetworkConfig,
 ) -> Result<ValidateConfigResponse, String> {
-    CLIENT_MANAGER
-        .get()
-        .unwrap()
+    get_client_manager!()?
         .handle_validate_config(app, config)
         .await
         .map_err(|e| e.to_string())
@@ -232,9 +227,7 @@ async fn validate_config(
 
 #[tauri::command]
 async fn get_config(app: AppHandle, instance_id: String) -> Result<NetworkConfig, String> {
-    let cfg = CLIENT_MANAGER
-        .get()
-        .unwrap()
+    let cfg = get_client_manager!()?
         .storage
         .get_network_config(app, &instance_id)
         .await
@@ -249,10 +242,7 @@ async fn load_configs(
     configs: Vec<NetworkConfig>,
     enabled_networks: Vec<String>,
 ) -> Result<(), String> {
-    CLIENT_MANAGER
-        .get()
-        .unwrap()
-        .storage
+    get_client_manager!()?
         .load_configs(app, configs, enabled_networks)
         .await
         .map_err(|e| e.to_string())?;
@@ -264,14 +254,143 @@ async fn get_network_metas(
     app: AppHandle,
     instance_ids: Vec<uuid::Uuid>,
 ) -> Result<GetNetworkMetasResponse, String> {
-    CLIENT_MANAGER
-        .get()
-        .unwrap()
+    get_client_manager!()?
         .handle_get_network_metas(app, instance_ids)
         .await
         .map_err(|e| e.to_string())
 }
 
+#[cfg(target_os = "android")]
+#[tauri::command]
+fn init_service() -> Result<(), String> {
+    Ok(())
+}
+
+#[cfg(not(target_os = "android"))]
+#[tauri::command]
+fn init_service(opts: Option<service::ServiceOptions>) -> Result<(), String> {
+    match opts {
+        Some(args) => {
+            let path = std::path::Path::new(&args.config_dir);
+            if !path.exists() {
+                std::fs::create_dir_all(&args.config_dir).map_err(|e| e.to_string())?;
+            } else if !path.is_dir() {
+                return Err("config_dir exists but is not a directory".to_string());
+            }
+            let path = std::path::Path::new(&args.file_log_dir);
+            if !path.exists() {
+                std::fs::create_dir_all(&args.file_log_dir).map_err(|e| e.to_string())?;
+            } else if !path.is_dir() {
+                return Err("file_log_dir exists but is not a directory".to_string());
+            }
+
+            service::install(args).map_err(|e| format!("{:#}", e))?;
+        }
+        None => {
+            service::uninstall().map_err(|e| format!("{:#}", e))?;
+        }
+    }
+    Ok(())
+}
+
+#[tauri::command]
+fn set_service_status(_enable: bool) -> Result<(), String> {
+    #[cfg(not(target_os = "android"))]
+    {
+        service::set_status(_enable).map_err(|e| format!("{:#}", e))?;
+    }
+    Ok(())
+}
+
+#[tauri::command]
+fn get_service_status() -> Result<&'static str, String> {
+    #[cfg(not(target_os = "android"))]
+    {
+        use easytier::service_manager::ServiceStatus;
+        let status = service::status().map_err(|e| format!("{:#}", e))?;
+        match status {
+            ServiceStatus::NotInstalled => Ok("NotInstalled"),
+            ServiceStatus::Stopped(_) => Ok("Stopped"),
+            ServiceStatus::Running => Ok("Running"),
+        }
+    }
+    #[cfg(target_os = "android")]
+    {
+        Ok("NotInstalled")
+    }
+}
+
+#[tauri::command]
+async fn init_rpc_connection(_app: AppHandle, url: Option<String>) -> Result<(), String> {
+    let mut client_manager_guard =
+        tokio::time::timeout(std::time::Duration::from_secs(5), CLIENT_MANAGER.write())
+            .await
+            .map_err(|_| "Failed to acquire write lock for client manager")?;
+    let mut instance_manager_guard = INSTANCE_MANAGER
+        .try_write()
+        .map_err(|_| "Failed to acquire write lock for instance manager")?;
+    let mut ring_rpc_server_guard = RING_RPC_SERVER
+        .try_write()
+        .map_err(|_| "Failed to acquire write lock for ring rpc server")?;
+
+    let normal_mode = url.is_none();
+    if normal_mode {
+        let instance_manager = if let Some(im) = instance_manager_guard.take() {
+            im
+        } else {
+            Arc::new(NetworkInstanceManager::new())
+        };
+        let rpc_server = if let Some(rpc_server) = ring_rpc_server_guard.take() {
+            rpc_server
+        } else {
+            ApiRpcServer::from_tunnel(
+                RingTunnelListener::new(
+                    format!("ring://{}", RPC_RING_UUID.deref()).parse().unwrap(),
+                ),
+                instance_manager.clone(),
+            )
+            .with_rx_timeout(None)
+            .serve()
+            .await
+            .map_err(|e| e.to_string())?
+        };
+
+        *instance_manager_guard = Some(instance_manager);
+        *ring_rpc_server_guard = Some(rpc_server);
+    } else {
+        *ring_rpc_server_guard = None;
+    }
+
+    let mut client_manager = tokio::time::timeout(
+        std::time::Duration::from_millis(1000),
+        manager::GUIClientManager::new(url),
+    )
+    .await
+    .map_err(|_| "connect remote rpc timed out".to_string())?
+    .with_context(|| "Failed to connect remote rpc")
+    .map_err(|e| format!("{:#}", e))?;
+    if let Some(old_manager) = client_manager_guard.take() {
+        client_manager.storage = old_manager.storage;
+    }
+    *client_manager_guard = Some(client_manager);
+
+    if !normal_mode {
+        if let Some(instance_manager) = instance_manager_guard.take() {
+            instance_manager
+                .retain_network_instance(vec![])
+                .map_err(|e| e.to_string())?;
+            drop(instance_manager);
+        }
+    }
+
+    Ok(())
+}
+
+#[tauri::command]
+async fn is_client_running() -> Result<bool, String> {
+    Ok(get_client_manager!()?.rpc_manager.is_running())
+}
+
 #[cfg(not(target_os = "android"))]
 fn toggle_window_visibility<R: tauri::Runtime>(app: &tauri::AppHandle<R>) {
     if let Some(window) = app.get_webview_window("main") {
@@ -289,19 +408,23 @@ fn toggle_window_visibility<R: tauri::Runtime>(app: &tauri::AppHandle<R>) {
     }
 }
 
+fn get_exe_path() -> String {
+    if let Ok(appimage_path) = std::env::var("APPIMAGE") {
+        if !appimage_path.is_empty() {
+            return appimage_path;
+        }
+    }
+    std::env::current_exe()
+        .map(|p| p.to_string_lossy().to_string())
+        .unwrap_or_default()
+}
+
 #[cfg(not(target_os = "android"))]
 fn check_sudo() -> bool {
     let is_elevated = elevate::Command::is_elevated();
     if !is_elevated {
-        let exe_path = std::env::var("APPIMAGE")
-            .ok()
-            .or_else(|| std::env::args().next())
-            .unwrap_or_default();
-        let args: Vec<String> = std::env::args().collect();
-        let mut stdcmd = std::process::Command::new(&exe_path);
-        if args.contains(&AUTOSTART_ARG.to_owned()) {
-            stdcmd.arg(AUTOSTART_ARG);
-        }
+        let exe_path = get_exe_path();
+        let stdcmd = std::process::Command::new(&exe_path);
         elevate::Command::new(stdcmd)
             .output()
             .expect("Failed to run elevated command");
@@ -313,10 +436,15 @@ mod manager {
     use super::*;
     use async_trait::async_trait;
     use dashmap::{DashMap, DashSet};
+    use easytier::common::global_ctx::GlobalCtx;
+    use easytier::common::stun::MockStunInfoCollector;
     use easytier::launcher::NetworkConfig;
-    use easytier::proto::api::manage::RunNetworkInstanceRequest;
+    use easytier::proto::api::logger::{LoggerRpc, LoggerRpcClientFactory, SetLoggerConfigRequest};
+    use easytier::proto::api::manage::{ListNetworkInstanceRequest, RunNetworkInstanceRequest};
+    use easytier::proto::common::NatType;
     use easytier::proto::rpc_impl::bidirect::BidirectRpcManager;
     use easytier::proto::rpc_types::controller::BaseController;
+    use easytier::rpc_service::logger::LoggerRpcService;
     use easytier::rpc_service::remote_client::PersistentConfig;
     use easytier::tunnel::ring::RingTunnelConnector;
     use easytier::tunnel::TunnelConnector;
@@ -344,54 +472,6 @@ mod manager {
             }
         }
 
-        pub(super) async fn load_configs(
-            &self,
-            app: AppHandle,
-            configs: Vec<NetworkConfig>,
-            enabled_networks: Vec<String>,
-        ) -> anyhow::Result<()> {
-            self.network_configs.clear();
-            for cfg in configs {
-                let instance_id = cfg.instance_id();
-                self.network_configs.insert(
-                    instance_id.parse()?,
-                    GUIConfig(instance_id.to_string(), cfg),
-                );
-            }
-
-            self.enabled_networks.clear();
-            INSTANCE_MANAGER.iter().for_each(|v| {
-                self.enabled_networks.insert(*v.key());
-            });
-            for id in enabled_networks {
-                if let Ok(uuid) = id.parse() {
-                    if !self.enabled_networks.contains(&uuid) {
-                        let config = self
-                            .network_configs
-                            .get(&uuid)
-                            .map(|i| i.value().1.clone())
-                            .ok_or_else(|| anyhow::anyhow!("Config not found"))?;
-                        CLIENT_MANAGER
-                            .get()
-                            .unwrap()
-                            .get_rpc_client(app.clone())
-                            .ok_or_else(|| anyhow::anyhow!("RPC client not found"))?
-                            .run_network_instance(
-                                BaseController::default(),
-                                RunNetworkInstanceRequest {
-                                    inst_id: None,
-                                    config: Some(config),
-                                    overwrite: false,
-                                },
-                            )
-                            .await?;
-                        self.enabled_networks.insert(uuid);
-                    }
-                }
-            }
-            Ok(())
-        }
-
         fn save_configs(&self, app: &AppHandle) -> anyhow::Result<()> {
             let configs: Result<Vec<String>, _> = self
                 .network_configs
@@ -507,14 +587,32 @@ mod manager {
 
     pub(super) struct GUIClientManager {
         pub(super) storage: GUIStorage,
-        rpc_manager: BidirectRpcManager,
+        pub(super) rpc_manager: BidirectRpcManager,
     }
     impl GUIClientManager {
-        pub async fn new() -> Result<Self, anyhow::Error> {
-            let mut connector = RingTunnelConnector::new(
-                format!("ring://{}", RPC_RING_UUID.deref()).parse().unwrap(),
-            );
-            let tunnel = connector.connect().await?;
+        pub async fn new(rpc_url: Option<String>) -> Result<Self, anyhow::Error> {
+            let global_ctx = Arc::new(GlobalCtx::new(TomlConfigLoader::default()));
+            global_ctx.replace_stun_info_collector(Box::new(MockStunInfoCollector {
+                udp_nat_type: NatType::Unknown,
+            }));
+            let mut flags = global_ctx.get_flags();
+            flags.bind_device = false;
+            global_ctx.set_flags(flags);
+            let tunnel = if let Some(url) = rpc_url {
+                let mut connector = easytier::connector::create_connector_by_url(
+                    &url,
+                    &global_ctx,
+                    easytier::tunnel::IpVersion::Both,
+                )
+                .await?;
+                connector.connect().await?
+            } else {
+                let mut connector = RingTunnelConnector::new(
+                    format!("ring://{}", RPC_RING_UUID.deref()).parse().unwrap(),
+                );
+                connector.connect().await?
+            };
+
             let rpc_manager = BidirectRpcManager::new();
             rpc_manager.run_with_tunnel(tunnel);
 
@@ -554,6 +652,84 @@ mod manager {
             }
             Ok(())
         }
+
+        fn get_logger_rpc_client(
+            &self,
+        ) -> Option<Box<dyn LoggerRpc<Controller = BaseController> + Send>> {
+            Some(
+                self.rpc_manager
+                    .rpc_client()
+                    .scoped_client::<LoggerRpcClientFactory<BaseController>>(1, 1, "".to_string()),
+            )
+        }
+
+        pub(super) async fn set_logging_level(&self, level: String) -> Result<(), anyhow::Error> {
+            let logger_rpc = self
+                .get_logger_rpc_client()
+                .ok_or_else(|| anyhow::anyhow!("Logger RPC client not available"))?;
+            logger_rpc
+                .set_logger_config(
+                    BaseController::default(),
+                    SetLoggerConfigRequest {
+                        level: LoggerRpcService::string_to_log_level(&level).into(),
+                    },
+                )
+                .await?;
+            Ok(())
+        }
+
+        pub(super) async fn load_configs(
+            &self,
+            app: AppHandle,
+            configs: Vec<NetworkConfig>,
+            enabled_networks: Vec<String>,
+        ) -> anyhow::Result<()> {
+            self.storage.network_configs.clear();
+            for cfg in configs {
+                let instance_id = cfg.instance_id();
+                self.storage.network_configs.insert(
+                    instance_id.parse()?,
+                    GUIConfig(instance_id.to_string(), cfg),
+                );
+            }
+
+            self.storage.enabled_networks.clear();
+            let client = self
+                .get_rpc_client(app.clone())
+                .ok_or_else(|| anyhow::anyhow!("RPC client not found"))?;
+            let running_instances = client
+                .list_network_instance(BaseController::default(), ListNetworkInstanceRequest {})
+                .await?;
+            for id in running_instances.inst_ids {
+                self.storage.enabled_networks.insert(id.into());
+            }
+            for id in enabled_networks {
+                if let Ok(uuid) = id.parse() {
+                    if !self.storage.enabled_networks.contains(&uuid) {
+                        let config = self
+                            .storage
+                            .network_configs
+                            .get(&uuid)
+                            .map(|i| i.value().1.clone());
+                        if config.is_none() {
+                            continue;
+                        }
+                        client
+                            .run_network_instance(
+                                BaseController::default(),
+                                RunNetworkInstanceRequest {
+                                    inst_id: None,
+                                    config,
+                                    overwrite: false,
+                                },
+                            )
+                            .await?;
+                        self.storage.enabled_networks.insert(uuid);
+                    }
+                }
+            }
+            Ok(())
+        }
     }
     impl RemoteClientManager<AppHandle, GUIConfig, anyhow::Error> for GUIClientManager {
         fn get_rpc_client(
@@ -577,8 +753,78 @@ mod manager {
     }
 }
 
+#[cfg(not(target_os = "android"))]
+mod service {
+    use anyhow::Context;
+
+    #[derive(Clone, serde::Serialize, serde::Deserialize)]
+    pub struct ServiceOptions {
+        pub(super) config_dir: String,
+        pub(super) rpc_portal: String,
+        pub(super) file_log_level: String,
+        pub(super) file_log_dir: String,
+    }
+    impl ServiceOptions {
+        fn to_args_vec(&self) -> Vec<std::ffi::OsString> {
+            vec![
+                "--config-dir".into(),
+                self.config_dir.clone().into(),
+                "--rpc-portal".into(),
+                self.rpc_portal.clone().into(),
+                "--file-log-level".into(),
+                self.file_log_level.clone().into(),
+                "--file-log-dir".into(),
+                self.file_log_dir.clone().into(),
+                "--daemon".into(),
+            ]
+        }
+    }
+
+    pub fn install(opts: ServiceOptions) -> anyhow::Result<()> {
+        let service = easytier::service_manager::Service::new(env!("CARGO_PKG_NAME").to_string())?;
+        let options = easytier::service_manager::ServiceInstallOptions {
+            program: super::get_exe_path().into(),
+            args: opts.to_args_vec(),
+            work_directory: std::env::current_dir()?,
+            disable_autostart: false,
+            description: Some("EasyTier Gui Service".to_string()),
+            display_name: Some("EasyTier Gui Service".to_string()),
+            disable_restart_on_failure: false,
+        };
+        service
+            .install(&options)
+            .with_context(|| "Failed to install service")?;
+        Ok(())
+    }
+
+    pub fn uninstall() -> anyhow::Result<()> {
+        let service = easytier::service_manager::Service::new(env!("CARGO_PKG_NAME").to_string())?;
+        service.uninstall()?;
+        Ok(())
+    }
+
+    pub fn set_status(enable: bool) -> anyhow::Result<()> {
+        use easytier::service_manager::*;
+        let service = Service::new(env!("CARGO_PKG_NAME").to_string())?;
+        let status = service.status()?;
+        if enable && status != ServiceStatus::Running {
+            service.start().with_context(|| "Failed to start service")?;
+        } else if !enable && status == ServiceStatus::Running {
+            service.stop().with_context(|| "Failed to stop service")?;
+        } else if status == ServiceStatus::NotInstalled {
+            return Err(anyhow::anyhow!("Service not installed"));
+        }
+        Ok(())
+    }
+
+    pub fn status() -> anyhow::Result<easytier::service_manager::ServiceStatus> {
+        let service = easytier::service_manager::Service::new(env!("CARGO_PKG_NAME").to_string())?;
+        service.status()
+    }
+}
+
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
-pub fn run() {
+pub fn run_gui() -> std::process::ExitCode {
     #[cfg(not(target_os = "android"))]
     if !check_sudo() {
         use std::process;
@@ -587,35 +833,8 @@ pub fn run() {
 
     utils::setup_panic_handler();
 
-    let _rpc_server_handle = tauri::async_runtime::spawn(async move {
-        let rpc_server = ApiRpcServer::from_tunnel(
-            RingTunnelListener::new(format!("ring://{}", RPC_RING_UUID.deref()).parse().unwrap()),
-            INSTANCE_MANAGER.clone(),
-        )
-        .serve()
-        .await
-        .expect("Failed to start RPC server");
-
-        let _ = CLIENT_MANAGER.set(
-            manager::GUIClientManager::new()
-                .await
-                .expect("Failed to create GUI client manager"),
-        );
-
-        rpc_server
-    });
-
     let mut builder = tauri::Builder::default();
 
-    #[cfg(not(target_os = "android"))]
-    {
-        use tauri_plugin_autostart::MacosLauncher;
-        builder = builder.plugin(tauri_plugin_autostart::init(
-            MacosLauncher::LaunchAgent,
-            Some(vec![AUTOSTART_ARG]),
-        ));
-    }
-
     #[cfg(not(any(target_os = "android", target_os = "ios")))]
     {
         builder = builder.plugin(tauri_plugin_single_instance::init(|app, _args, _cwd| {
@@ -651,13 +870,9 @@ pub fn run() {
                 })
                 .build()
                 .map_err(|e| e.to_string())?;
-            let Ok(Some(logger_reinit)) = utils::init_logger(&config, true) else {
+            let Ok(_) = utils::init_logger(&config, true) else {
                 return Ok(());
             };
-            #[allow(static_mut_refs)]
-            unsafe {
-                LOGGER_LEVEL_SENDER.replace(logger_reinit)
-            };
 
             // for tray icon, menu need to be built in js
             #[cfg(not(target_os = "android"))]
@@ -699,6 +914,11 @@ pub fn run() {
             get_config,
             load_configs,
             get_network_metas,
+            init_service,
+            set_service_status,
+            get_service_status,
+            init_rpc_connection,
+            is_client_running,
         ])
         .on_window_event(|_win, event| match event {
             #[cfg(not(target_os = "android"))]
@@ -724,4 +944,14 @@ pub fn run() {
             _ => {}
         });
     }
+
+    std::process::ExitCode::SUCCESS
+}
+
+pub fn run_cli() -> std::process::ExitCode {
+    tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap()
+        .block_on(async { easytier::core::main().await })
 }
diff --git a/easytier-gui/src-tauri/src/main.rs b/easytier-gui/src-tauri/src/main.rs
index c672c6a..05049eb 100644
--- a/easytier-gui/src-tauri/src/main.rs
+++ b/easytier-gui/src-tauri/src/main.rs
@@ -1,5 +1,9 @@
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
 
-fn main() {
-    app_lib::run();
+fn main() -> std::process::ExitCode {
+    if std::env::args().count() > 1 {
+        app_lib::run_cli()
+    } else {
+        app_lib::run_gui()
+    }
 }
diff --git a/easytier-gui/src/auto-imports.d.ts b/easytier-gui/src/auto-imports.d.ts
index 21da4e5..4f34ad8 100644
--- a/easytier-gui/src/auto-imports.d.ts
+++ b/easytier-gui/src/auto-imports.d.ts
@@ -28,15 +28,20 @@ declare global {
   const getCurrentScope: typeof import('vue')['getCurrentScope']
   const getEasytierVersion: typeof import('./composables/backend')['getEasytierVersion']
   const getNetworkMetas: typeof import('./composables/backend')['getNetworkMetas']
+  const getServiceStatus: typeof import('./composables/backend')['getServiceStatus']
   const h: typeof import('vue')['h']
   const initMobileVpnService: typeof import('./composables/mobile_vpn')['initMobileVpnService']
+  const initRpcConnection: typeof import('./composables/backend')['initRpcConnection']
+  const initService: typeof import('./composables/backend')['initService']
   const inject: typeof import('vue')['inject']
+  const isClientRunning: typeof import('./composables/backend')['isClientRunning']
   const isProxy: typeof import('vue')['isProxy']
   const isReactive: typeof import('vue')['isReactive']
   const isReadonly: typeof import('vue')['isReadonly']
   const isRef: typeof import('vue')['isRef']
   const listNetworkInstanceIds: typeof import('./composables/backend')['listNetworkInstanceIds']
   const listenGlobalEvents: typeof import('./composables/event')['listenGlobalEvents']
+  const loadMode: typeof import('./composables/mode')['loadMode']
   const mapActions: typeof import('pinia')['mapActions']
   const mapGetters: typeof import('pinia')['mapGetters']
   const mapState: typeof import('pinia')['mapState']
@@ -69,11 +74,13 @@ declare global {
   const ref: typeof import('vue')['ref']
   const resolveComponent: typeof import('vue')['resolveComponent']
   const runNetworkInstance: typeof import('./composables/backend')['runNetworkInstance']
+  const saveMode: typeof import('./composables/mode')['saveMode']
   const saveNetworkConfig: typeof import('./composables/backend')['saveNetworkConfig']
   const sendConfigs: typeof import('./composables/backend')['sendConfigs']
   const setActivePinia: typeof import('pinia')['setActivePinia']
   const setLoggingLevel: typeof import('./composables/backend')['setLoggingLevel']
   const setMapStoreSuffix: typeof import('pinia')['setMapStoreSuffix']
+  const setServiceStatus: typeof import('./composables/backend')['setServiceStatus']
   const setTrayMenu: typeof import('./composables/tray')['setTrayMenu']
   const setTrayRunState: typeof import('./composables/tray')['setTrayRunState']
   const setTrayTooltip: typeof import('./composables/tray')['setTrayTooltip']
@@ -141,15 +148,20 @@ declare module 'vue' {
     readonly getCurrentScope: UnwrapRef<typeof import('vue')['getCurrentScope']>
     readonly getEasytierVersion: UnwrapRef<typeof import('./composables/backend')['getEasytierVersion']>
     readonly getNetworkMetas: UnwrapRef<typeof import('./composables/backend')['getNetworkMetas']>
+    readonly getServiceStatus: UnwrapRef<typeof import('./composables/backend')['getServiceStatus']>
     readonly h: UnwrapRef<typeof import('vue')['h']>
     readonly initMobileVpnService: UnwrapRef<typeof import('./composables/mobile_vpn')['initMobileVpnService']>
+    readonly initRpcConnection: UnwrapRef<typeof import('./composables/backend')['initRpcConnection']>
+    readonly initService: UnwrapRef<typeof import('./composables/backend')['initService']>
     readonly inject: UnwrapRef<typeof import('vue')['inject']>
+    readonly isClientRunning: UnwrapRef<typeof import('./composables/backend')['isClientRunning']>
     readonly isProxy: UnwrapRef<typeof import('vue')['isProxy']>
     readonly isReactive: UnwrapRef<typeof import('vue')['isReactive']>
     readonly isReadonly: UnwrapRef<typeof import('vue')['isReadonly']>
     readonly isRef: UnwrapRef<typeof import('vue')['isRef']>
     readonly listNetworkInstanceIds: UnwrapRef<typeof import('./composables/backend')['listNetworkInstanceIds']>
     readonly listenGlobalEvents: UnwrapRef<typeof import('./composables/event')['listenGlobalEvents']>
+    readonly loadMode: UnwrapRef<typeof import('./composables/mode')['loadMode']>
     readonly mapActions: UnwrapRef<typeof import('pinia')['mapActions']>
     readonly mapGetters: UnwrapRef<typeof import('pinia')['mapGetters']>
     readonly mapState: UnwrapRef<typeof import('pinia')['mapState']>
@@ -182,11 +194,13 @@ declare module 'vue' {
     readonly ref: UnwrapRef<typeof import('vue')['ref']>
     readonly resolveComponent: UnwrapRef<typeof import('vue')['resolveComponent']>
     readonly runNetworkInstance: UnwrapRef<typeof import('./composables/backend')['runNetworkInstance']>
+    readonly saveMode: UnwrapRef<typeof import('./composables/mode')['saveMode']>
     readonly saveNetworkConfig: UnwrapRef<typeof import('./composables/backend')['saveNetworkConfig']>
     readonly sendConfigs: UnwrapRef<typeof import('./composables/backend')['sendConfigs']>
     readonly setActivePinia: UnwrapRef<typeof import('pinia')['setActivePinia']>
     readonly setLoggingLevel: UnwrapRef<typeof import('./composables/backend')['setLoggingLevel']>
     readonly setMapStoreSuffix: UnwrapRef<typeof import('pinia')['setMapStoreSuffix']>
+    readonly setServiceStatus: UnwrapRef<typeof import('./composables/backend')['setServiceStatus']>
     readonly setTrayMenu: UnwrapRef<typeof import('./composables/tray')['setTrayMenu']>
     readonly setTrayRunState: UnwrapRef<typeof import('./composables/tray')['setTrayRunState']>
     readonly setTrayTooltip: UnwrapRef<typeof import('./composables/tray')['setTrayTooltip']>
diff --git a/easytier-gui/src/components/ModeSwitcher.vue b/easytier-gui/src/components/ModeSwitcher.vue
new file mode 100644
index 0000000..67f7326
--- /dev/null
+++ b/easytier-gui/src/components/ModeSwitcher.vue
@@ -0,0 +1,155 @@
+<script setup lang="ts">
+import { computed, watch, onMounted, ref } from 'vue';
+import type { Mode, ServiceMode, RemoteMode } from '~/composables/mode';
+import { appConfigDir, appLogDir } from '@tauri-apps/api/path';
+import { join } from '@tauri-apps/api/path';
+import { getServiceStatus, type ServiceStatus } from '~/composables/backend';
+
+const { t } = useI18n()
+
+const model = defineModel<Mode>({ required: true })
+const emit = defineEmits(['uninstall-service', 'stop-service'])
+
+const defaultConfigDir = ref('')
+const defaultLogDir = ref('')
+const serviceStatus = ref<ServiceStatus>('NotInstalled')
+const isServiceStatusLoaded = ref(false)
+
+onMounted(async () => {
+  defaultConfigDir.value = await join(await appConfigDir(), 'config.d')
+  defaultLogDir.value = await appLogDir()
+})
+
+const modeOptions = computed(() => [
+  { label: t('mode.normal'), value: 'normal' },
+  { label: t('mode.service'), value: 'service' },
+  { label: t('mode.remote'), value: 'remote' },
+]);
+
+const serviceMode = computed({
+  get: () => model.value.mode === 'service' ? model.value as ServiceMode : undefined,
+  set: (value) => {
+    if (value) {
+      model.value = value
+    }
+  }
+})
+
+const remoteMode = computed({
+  get: () => model.value.mode === 'remote' ? model.value as RemoteMode : undefined,
+  set: (value) => {
+    if (value) {
+      model.value = value
+    }
+  }
+})
+
+const statusColorClass = computed(() => {
+  switch (serviceStatus.value) {
+    case 'Running':
+      return 'text-green-600'
+    case 'Stopped':
+      return 'text-orange-600'
+    case 'NotInstalled':
+      return 'text-gray-600'
+    default:
+      return 'text-gray-600'
+  }
+})
+
+watch(() => model.value.mode, async (newMode, oldMode) => {
+  if (newMode === oldMode)
+    return
+
+  if (newMode === 'service' && !isServiceStatusLoaded.value) {
+    serviceStatus.value = await getServiceStatus()
+    isServiceStatusLoaded.value = true
+  }
+
+  const oldModelValue = { ...model.value }
+
+  if (newMode === 'normal') {
+    model.value = {
+      ...oldModelValue,
+      mode: 'normal',
+    }
+  }
+  else if (newMode === 'service') {
+    model.value = {
+      ...oldModelValue,
+      mode: 'service',
+      config_dir: serviceMode.value?.config_dir || defaultConfigDir.value,
+      rpc_portal: serviceMode.value?.rpc_portal || '127.0.0.1:15999',
+      file_log_level: serviceMode.value?.file_log_level || 'off',
+      file_log_dir: serviceMode.value?.file_log_dir || defaultLogDir.value,
+    }
+  }
+  else if (newMode === 'remote') {
+    model.value = {
+      ...oldModelValue,
+      mode: 'remote',
+      remote_rpc_address: remoteMode.value?.remote_rpc_address || 'tcp://127.0.0.1:15999',
+    }
+  }
+}, { immediate: true })
+
+</script>
+
+<template>
+  <div class="flex flex-col gap-4">
+    <div>
+      <SelectButton id="mode-select" v-model="model.mode" :options="modeOptions" option-label="label"
+        option-value="value" fluid />
+    </div>
+
+    <!-- Mode descriptions -->
+    <div v-if="model.mode === 'normal'" class="text-sm text-gray-500">
+      {{ t('mode.normal_description') }}
+    </div>
+    <div v-else-if="model.mode === 'service'" class="text-sm text-gray-500">
+      {{ t('mode.service_description') }}
+    </div>
+    <div v-else-if="model.mode === 'remote'" class="text-sm text-gray-500">
+      {{ t('mode.remote_description') }}
+    </div>
+
+    <div v-if="serviceMode" class="flex flex-col gap-2">
+      <div class="flex items-center gap-2">
+        <label for="config-dir">{{ t('mode.config_dir') }}</label>
+        <InputText id="config-dir" v-model="serviceMode.config_dir" class="flex-1" />
+      </div>
+      <div class="flex items-center gap-2">
+        <label for="rpc-portal">{{ t('mode.rpc_portal') }}</label>
+        <InputText id="rpc-portal" v-model="serviceMode.rpc_portal" class="flex-1" />
+      </div>
+      <div class="flex items-center gap-2">
+        <label for="log-level">{{ t('mode.log_level') }}</label>
+        <Select id="log-level" v-model="serviceMode.file_log_level"
+          :options="['off', 'warn', 'info', 'debug', 'trace']" />
+      </div>
+      <div class="flex items-center gap-2">
+        <label for="log-dir">{{ t('mode.log_dir') }}</label>
+        <InputText id="log-dir" v-model="serviceMode.file_log_dir" class="flex-1" />
+      </div>
+      <div class="flex items-center gap-2 justify-between">
+        <div class="flex items-center gap-2">
+          <label>{{ t('mode.service_status') }}</label>
+          <span :class="statusColorClass">{{ t(`mode.service_status_${serviceStatus.toLowerCase()}`) }}</span>
+        </div>
+        <div class="flex items-center gap-2">
+          <Button :label="t('mode.stop_service')" icon="pi pi-stop-circle" v-if="serviceStatus === 'Running'"
+            @click="emit('stop-service')" severity="warn" text />
+          <Button :label="t('mode.uninstall_service')" icon="pi pi-trash" v-if="serviceStatus !== 'NotInstalled'"
+            @click="emit('uninstall-service')" severity="danger" text />
+        </div>
+      </div>
+    </div>
+
+    <div v-if="remoteMode" class="flex flex-col gap-2">
+      <div class="flex items-center gap-2">
+        <label for="remote-addr">{{ t('mode.remote_rpc_address') }}</label>
+        <InputText id="remote-addr" v-model="remoteMode.remote_rpc_address" class="flex-1" />
+      </div>
+    </div>
+  </div>
+</template>
diff --git a/easytier-gui/src/composables/backend.ts b/easytier-gui/src/composables/backend.ts
index 5491ace..c79a90e 100644
--- a/easytier-gui/src/composables/backend.ts
+++ b/easytier-gui/src/composables/backend.ts
@@ -1,11 +1,19 @@
 import { invoke } from '@tauri-apps/api/core'
 import { Api, type NetworkTypes } from 'easytier-frontend-lib'
 import { GetNetworkMetasResponse } from 'node_modules/easytier-frontend-lib/dist/modules/api'
-import { getAutoLaunchStatusAsync } from '~/modules/auto_launch'
+
 
 type NetworkConfig = NetworkTypes.NetworkConfig
 type ValidateConfigResponse = Api.ValidateConfigResponse
 type ListNetworkInstanceIdResponse = Api.ListNetworkInstanceIdResponse
+interface ServiceOptions {
+  config_dir: string
+  rpc_portal: string
+  file_log_level: string
+  file_log_dir: string
+}
+
+export type ServiceStatus = "Running" | "Stopped" | "NotInstalled"
 
 export async function parseNetworkConfig(cfg: NetworkConfig) {
   return invoke<string>('parse_network_config', { cfg })
@@ -61,10 +69,29 @@ export async function getConfig(instanceId: string) {
 
 export async function sendConfigs() {
   let networkList: NetworkConfig[] = JSON.parse(localStorage.getItem('networkList') || '[]');
-  let autoStartInstIds = getAutoLaunchStatusAsync() ? JSON.parse(localStorage.getItem('autoStartInstIds') || '[]') : []
-  return await invoke('load_configs', { configs: networkList, enabledNetworks: autoStartInstIds })
+  return await invoke('load_configs', { configs: networkList, enabledNetworks: [] })
 }
 
 export async function getNetworkMetas(instanceIds: string[]) {
   return await invoke<GetNetworkMetasResponse>('get_network_metas', { instanceIds })
 }
+
+export async function initService(opts?: ServiceOptions) {
+  return await invoke('init_service', { opts })
+}
+
+export async function setServiceStatus(enable: boolean) {
+  return await invoke('set_service_status', { enable })
+}
+
+export async function getServiceStatus() {
+  return await invoke<ServiceStatus>('get_service_status')
+}
+
+export async function initRpcConnection(url?: string) {
+  return await invoke('init_rpc_connection', { url })
+}
+
+export async function isClientRunning() {
+  return await invoke<boolean>('is_client_running')
+}
diff --git a/easytier-gui/src/composables/event.ts b/easytier-gui/src/composables/event.ts
index 4c9c261..9cf0ca4 100644
--- a/easytier-gui/src/composables/event.ts
+++ b/easytier-gui/src/composables/event.ts
@@ -4,7 +4,6 @@ import { NetworkTypes } from "easytier-frontend-lib"
 
 const EVENTS = Object.freeze({
     SAVE_CONFIGS: 'save_configs',
-    SAVE_ENABLED_NETWORKS: 'save_enabled_networks',
     PRE_RUN_NETWORK_INSTANCE: 'pre_run_network_instance',
     POST_RUN_NETWORK_INSTANCE: 'post_run_network_instance',
     VPN_SERVICE_STOP: 'vpn_service_stop',
@@ -15,11 +14,6 @@ function onSaveConfigs(event: Event<NetworkTypes.NetworkConfig[]>) {
     localStorage.setItem('networkList', JSON.stringify(event.payload));
 }
 
-function onSaveEnabledNetworks(event: Event<string[]>) {
-    console.log(`Received event '${EVENTS.SAVE_ENABLED_NETWORKS}': ${event.payload}`);
-    localStorage.setItem('autoStartInstIds', JSON.stringify(event.payload));
-}
-
 async function onPreRunNetworkInstance(event: Event<string>) {
     if (type() === 'android') {
         await prepareVpnService(event.payload);
@@ -39,7 +33,6 @@ async function onVpnServiceStop(event: Event<string>) {
 export async function listenGlobalEvents() {
     const unlisteners = [
         await listen(EVENTS.SAVE_CONFIGS, onSaveConfigs),
-        await listen(EVENTS.SAVE_ENABLED_NETWORKS, onSaveEnabledNetworks),
         await listen(EVENTS.PRE_RUN_NETWORK_INSTANCE, onPreRunNetworkInstance),
         await listen(EVENTS.POST_RUN_NETWORK_INSTANCE, onPostRunNetworkInstance),
         await listen(EVENTS.VPN_SERVICE_STOP, onVpnServiceStop),
diff --git a/easytier-gui/src/composables/mode.ts b/easytier-gui/src/composables/mode.ts
new file mode 100644
index 0000000..52e50c4
--- /dev/null
+++ b/easytier-gui/src/composables/mode.ts
@@ -0,0 +1,36 @@
+interface NormalMode {
+    mode: 'normal'
+}
+
+export interface ServiceMode {
+    mode: 'service'
+    config_dir: string
+    rpc_portal: string
+    file_log_level: 'off' | 'warn' | 'info' | 'debug' | 'trace'
+    file_log_dir: string
+}
+
+export interface RemoteMode {
+    mode: 'remote'
+    remote_rpc_address: string
+}
+
+export function saveMode(mode: Mode) {
+    localStorage.setItem('app_mode', JSON.stringify(mode))
+}
+
+import { type } from '@tauri-apps/plugin-os';
+
+export function loadMode(): Mode {
+    if (type() === 'android') {
+        return { mode: 'normal' };
+    }
+    const modeStr = localStorage.getItem('app_mode')
+    if (modeStr) {
+        return JSON.parse(modeStr) as Mode
+    } else {
+        return { mode: 'normal' }
+    }
+}
+
+export type Mode = NormalMode | ServiceMode | RemoteMode
diff --git a/easytier-gui/src/main.ts b/easytier-gui/src/main.ts
index 325f726..4481a6a 100644
--- a/easytier-gui/src/main.ts
+++ b/easytier-gui/src/main.ts
@@ -9,7 +9,7 @@ import App from '~/App.vue';
 import 'easytier-frontend-lib/style.css';
 import { ConfirmationService, DialogService, ToastService } from 'primevue';
 import '~/styles.css';
-import { getAutoLaunchStatusAsync, loadAutoLaunchStatusAsync } from './modules/auto_launch';
+
 
 if (import.meta.env.PROD) {
   document.addEventListener('keydown', (event) => {
@@ -29,7 +29,6 @@ if (import.meta.env.PROD) {
 
 async function main() {
   await I18nUtils.loadLanguageAsync(localStorage.getItem('lang') || 'en')
-  await loadAutoLaunchStatusAsync(getAutoLaunchStatusAsync())
 
   const app = createApp(App)
 
diff --git a/easytier-gui/src/modules/auto_launch.ts b/easytier-gui/src/modules/auto_launch.ts
deleted file mode 100644
index 81ae0a9..0000000
--- a/easytier-gui/src/modules/auto_launch.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import { disable, enable, isEnabled } from '@tauri-apps/plugin-autostart'
-
-export async function loadAutoLaunchStatusAsync(target_enable: boolean): Promise<boolean> {
-  try {
-    if (target_enable) {
-      await enable()
-    }
-    else {
-      // 消除没有配置自启动时进行关闭操作报错
-      try {
-        await disable()
-      }
-      catch { }
-    }
-    localStorage.setItem('auto_launch', JSON.stringify(await isEnabled()))
-    return isEnabled()
-  }
-  catch (e) {
-    console.error(e)
-    return false
-  }
-}
-
-export function getAutoLaunchStatusAsync(): boolean {
-  return localStorage.getItem('auto_launch') === 'true'
-}
diff --git a/easytier-gui/src/pages/index.vue b/easytier-gui/src/pages/index.vue
index 3bf8f13..742e11d 100644
--- a/easytier-gui/src/pages/index.vue
+++ b/easytier-gui/src/pages/index.vue
@@ -9,16 +9,193 @@ import { I18nUtils, RemoteManagement } from "easytier-frontend-lib"
 import type { MenuItem } from 'primevue/menuitem'
 import { useTray } from '~/composables/tray'
 import { GUIRemoteClient } from '~/modules/api'
-import { getAutoLaunchStatusAsync as getAutoLaunchStatus, loadAutoLaunchStatusAsync } from '~/modules/auto_launch'
+
 import { getDockVisibilityStatus, loadDockVisibilityAsync } from '~/modules/dock_visibility'
+import { useToast, useConfirm } from 'primevue'
+import { loadMode, saveMode, type Mode } from '~/composables/mode'
+import ModeSwitcher from '~/components/ModeSwitcher.vue'
+import { getServiceStatus, type ServiceStatus } from '~/composables/backend'
 
 const { t, locale } = useI18n()
+const confirm = useConfirm()
 const aboutVisible = ref(false)
+const modeDialogVisible = ref(false)
+const currentMode = ref<Mode>({ mode: 'normal' })
+const editingMode = ref<Mode>({ mode: 'normal' })
+const isModeSaving = ref(false)
+const serviceStatus = ref<ServiceStatus>('NotInstalled')
+
+async function openModeDialog() {
+  editingMode.value = JSON.parse(JSON.stringify(loadMode()))
+  if (editingMode.value.mode === 'service') {
+    serviceStatus.value = await getServiceStatus()
+  }
+  modeDialogVisible.value = true
+}
+
+async function onModeSave() {
+  if (isModeSaving.value) {
+    return;
+  }
+  isModeSaving.value = true
+  try {
+    await initWithMode(editingMode.value);
+    modeDialogVisible.value = false
+  }
+  catch (e: any) {
+    toast.add({ severity: 'error', summary: t('error'), detail: e, life: 10000 })
+    console.error("Error switching mode", e, currentMode.value, editingMode.value)
+    await initWithMode(currentMode.value);
+  }
+  finally {
+    isModeSaving.value = false
+  }
+}
+
+async function onUninstallService() {
+  confirm.require({
+    message: t('mode.uninstall_service_confirm'),
+    header: t('mode.uninstall_service'),
+    icon: 'pi pi-exclamation-triangle',
+    rejectProps: {
+      label: t('web.common.cancel'),
+      severity: 'secondary',
+      outlined: true
+    },
+    acceptProps: {
+      label: t('mode.uninstall_service'),
+      severity: 'danger'
+    },
+    accept: async () => {
+      isModeSaving.value = true
+      try {
+        await initWithMode({ ...currentMode.value, mode: 'normal' });
+        await initService(undefined)
+        toast.add({ severity: 'success', summary: t('web.common.success'), detail: t('mode.uninstall_service_success'), life: 3000 })
+        modeDialogVisible.value = false
+      } catch (e: any) {
+        toast.add({ severity: 'error', summary: t('error'), detail: e, life: 10000 })
+        console.error("Error uninstalling service", e)
+      } finally {
+        isModeSaving.value = false
+      }
+    },
+  });
+}
+
+async function onStopService() {
+  isModeSaving.value = true
+  try {
+    await setServiceStatus(false)
+    toast.add({ severity: 'success', summary: t('web.common.success'), detail: t('mode.stop_service_success'), life: 3000 })
+    modeDialogVisible.value = false
+  }
+  catch (e: any) {
+    toast.add({ severity: 'error', summary: t('error'), detail: e, life: 10000 })
+    console.error("Error stopping service", e)
+  }
+  finally {
+    isModeSaving.value = false
+  }
+}
+
+async function initWithMode(mode: Mode) {
+  if (currentMode.value.mode === 'service' && mode.mode !== 'service') {
+    let serviceStatus = await getServiceStatus()
+    if (serviceStatus === "Running") {
+      await setServiceStatus(false)
+      serviceStatus = await getServiceStatus()
+    }
+    if (serviceStatus === "Stopped") {
+      await initService(undefined)
+    }
+  }
+
+  let url: string | undefined = undefined
+  let retrys = 1
+  switch (mode.mode) {
+    case 'remote':
+      if (!mode.remote_rpc_address) {
+        toast.add({ severity: 'error', summary: t('error'), detail: t('mode.remote_rpc_address_empty'), life: 10000 })
+        return initWithMode({ ...mode, mode: 'normal' });
+      }
+      url = mode.remote_rpc_address
+      break;
+    case 'service':
+      if (!mode.config_dir || !mode.file_log_dir || !mode.file_log_level || !mode.rpc_portal) {
+        toast.add({ severity: 'error', summary: t('error'), detail: t('mode.service_config_empty'), life: 10000 })
+        return initWithMode({ ...mode, mode: 'normal' });
+      }
+      let serviceStatus = await getServiceStatus()
+      if (serviceStatus === "NotInstalled" || JSON.stringify(mode) !== JSON.stringify(currentMode.value)) {
+        await initService({
+          config_dir: mode.config_dir,
+          file_log_dir: mode.file_log_dir,
+          file_log_level: mode.file_log_level,
+          rpc_portal: mode.rpc_portal,
+        })
+        serviceStatus = await getServiceStatus()
+      }
+      if (serviceStatus === "Stopped") {
+        await setServiceStatus(true)
+      }
+      url = "tcp://" + mode.rpc_portal.replace("0.0.0.0", "127.0.0.1")
+      retrys = 5
+      break;
+  }
+  for (let i = 0; i < retrys; i++) {
+    try {
+      await connectRpcClient(url)
+      break;
+    } catch (e) {
+      if (i === retrys - 1) {
+        throw e;
+      }
+      console.error("Error connecting rpc client, retrying...", e)
+      await new Promise(resolve => setTimeout(resolve, 1000))
+    }
+  }
+  currentMode.value = mode
+  saveMode(mode)
+  clientRunning.value = await isClientRunning()
+}
+
+onMounted(() => {
+  currentMode.value = loadMode()
+  initWithMode(currentMode.value);
+});
 
 useTray(true)
+let toast = useToast();
 
 const remoteClient = computed(() => new GUIRemoteClient());
 const instanceId = ref<string | undefined>(undefined);
+const clientRunning = ref(false);
+
+watch(clientRunning, async (newVal, oldVal) => {
+  if (!newVal && oldVal) {
+    await reconnectClient()
+  }
+})
+
+onMounted(async () => {
+  clientRunning.value = await isClientRunning().catch(() => false)
+  const timer = setInterval(async () => {
+    try {
+      clientRunning.value = await isClientRunning()
+    } catch (e) {
+      clientRunning.value = false
+      console.error("Error checking client running status", e)
+    }
+  }, 1000)
+  return () => {
+    clearInterval(timer)
+  }
+})
+async function reconnectClient() {
+  editingMode.value = JSON.parse(JSON.stringify(loadMode()));
+  await onModeSave()
+}
 
 onMounted(async () => {
   window.setTimeout(async () => {
@@ -81,11 +258,10 @@ const setting_menu_items: Ref<MenuItem[]> = ref([
     },
   },
   {
-    label: () => getAutoLaunchStatus() ? t('disable_auto_launch') : t('enable_auto_launch'),
-    icon: 'pi pi-desktop',
-    command: async () => {
-      await loadAutoLaunchStatusAsync(!getAutoLaunchStatus())
-    },
+    label: () => `${t('mode.switch_mode')}: ${t('mode.' + currentMode.value.mode)}`,
+    icon: 'pi pi-sync',
+    command: openModeDialog,
+    visible: () => type() !== 'android',
   },
   {
     label: () => getDockVisibilityStatus() ? t('hide_dock_icon') : t('show_dock_icon'),
@@ -117,6 +293,12 @@ const setting_menu_items: Ref<MenuItem[]> = ref([
   },
 ])
 
+async function connectRpcClient(url?: string) {
+  await initRpcConnection(url)
+  await sendConfigs()
+  console.log("easytier rpc connection established")
+}
+
 onMounted(async () => {
   if (type() === 'android') {
     try {
@@ -127,7 +309,6 @@ onMounted(async () => {
     }
   }
   const unlisten = await listenGlobalEvents()
-  await sendConfigs()
   return () => {
     unlisten()
   }
@@ -140,9 +321,24 @@ onMounted(async () => {
     <Dialog v-model:visible="aboutVisible" modal :header="t('about.title')" :style="{ width: '70%' }">
       <About />
     </Dialog>
+    <Dialog v-model:visible="modeDialogVisible" modal :header="t('mode.switch_mode')" :style="{ width: '50vw' }">
+      <ModeSwitcher v-model="editingMode" @uninstall-service="onUninstallService" @stop-service="onStopService" />
+      <template #footer>
+        <Button :label="t('web.common.cancel')" icon="pi pi-times" @click="modeDialogVisible = false" text />
+        <Button :label="t('web.common.save')" icon="pi pi-save" @click="onModeSave" autofocus :loading="isModeSaving" />
+      </template>
+    </Dialog>
     <Menu ref="log_menu" :model="log_menu_items_popup" :popup="true" />
 
-    <RemoteManagement class="flex-1 overflow-y-auto" :api="remoteClient" v-bind:instance-id="instanceId" />
+    <RemoteManagement v-if="clientRunning" class="flex-1 overflow-y-auto" :api="remoteClient"
+      :pause-auto-refresh="isModeSaving" v-bind:instance-id="instanceId" />
+    <div v-else class="empty-state flex-1 flex flex-col items-center py-12">
+      <i class="pi pi-server text-5xl text-secondary mb-4 opacity-50"></i>
+      <div class="text-xl text-center font-medium mb-3">{{ t('client.not_running') }}
+      </div>
+      <Button @click="reconnectClient" :loading="isModeSaving" :label="t('client.retry')" icon="pi pi-replay"
+        iconPos="left" />
+    </div>
 
     <Menubar :model="setting_menu_items" breakpoint="560px">
       <template #item="{ item, props }">
diff --git a/easytier-web/frontend-lib/src/components/RemoteManagement.vue b/easytier-web/frontend-lib/src/components/RemoteManagement.vue
index a6ad4e2..1fbfcca 100644
--- a/easytier-web/frontend-lib/src/components/RemoteManagement.vue
+++ b/easytier-web/frontend-lib/src/components/RemoteManagement.vue
@@ -12,6 +12,7 @@ const { t } = useI18n()
 const props = defineProps<{
     api: Api.RemoteClient;
     newConfigGenerator?: () => NetworkTypes.NetworkConfig;
+    pauseAutoRefresh?: boolean;
 }>();
 
 const instanceId = defineModel('instanceId', {
@@ -407,6 +408,9 @@ const actionMenu: Ref<MenuItem[]> = ref([
 ]);
 
 let periodFunc = new Utils.PeriodicTask(async () => {
+    if (props.pauseAutoRefresh) {
+        return;
+    }
     try {
         await Promise.all([loadNetworkInstanceIds(), loadCurrentNetworkInfo()]);
     } catch (e) {
diff --git a/easytier-web/frontend-lib/src/locales/cn.yaml b/easytier-web/frontend-lib/src/locales/cn.yaml
index 7905d42..dd8e460 100644
--- a/easytier-web/frontend-lib/src/locales/cn.yaml
+++ b/easytier-web/frontend-lib/src/locales/cn.yaml
@@ -340,3 +340,33 @@ web:
     language: 语言
     theme: 主题
     logout: 退出登录
+
+mode:
+  title: 模式
+  switch_mode: 切换模式
+  config_dir: 配置目录
+  rpc_portal: RPC端口
+  log_level: 日志级别
+  log_dir: 日志目录
+  remote_rpc_address: 远程RPC地址
+  normal: 普通模式
+  service: 服务模式
+  remote: 远程模式
+  normal_description: 直接运行EasyTier，适合本地使用
+  service_description: 作为系统服务运行，支持开机自启和后台运行。退出GUI后服务仍在后台运行。
+  remote_description: 连接到远程RPC服务，管理和控制远程节点
+  service_status: 服务状态
+  service_status_running: 运行中
+  service_status_stopped: 已停止
+  service_status_notinstalled: 未安装
+  uninstall_service: 卸载服务
+  stop_service: 停止服务
+  uninstall_service_confirm: 确定要卸载服务吗？
+  uninstall_service_success: 服务卸载成功，已切换回普通模式
+  stop_service_success: 服务停止成功
+  remote_rpc_address_empty: 远程RPC地址不能为空
+  service_config_empty: 服务配置不能为空
+
+client:
+  not_running: 无法连接至远程客户端
+  retry: 重试
diff --git a/easytier-web/frontend-lib/src/locales/en.yaml b/easytier-web/frontend-lib/src/locales/en.yaml
index 462ef2c..49587b0 100644
--- a/easytier-web/frontend-lib/src/locales/en.yaml
+++ b/easytier-web/frontend-lib/src/locales/en.yaml
@@ -340,3 +340,33 @@ web:
     language: Language
     theme: Theme
     logout: Logout
+
+mode:
+  title: Mode
+  switch_mode: Switch Mode
+  config_dir: Config Dir
+  rpc_portal: RPC Portal
+  log_level: Log Level
+  log_dir: Log Dir
+  remote_rpc_address: Remote RPC Address
+  normal: Normal
+  service: Service
+  remote: Remote
+  normal_description: Run EasyTier directly, suitable for local use.
+  service_description: Run as a system service, supporting auto-startup and background operation. The service continues to run in the background after exiting the GUI.
+  remote_description: Connect to a remote RPC service to manage and control remote nodes.
+  service_status: Service Status
+  service_status_running: Running
+  service_status_stopped: Stopped
+  service_status_notinstalled: Not Installed
+  uninstall_service: Uninstall Service
+  stop_service: Stop Service
+  uninstall_service_confirm: Are you sure you want to uninstall the service?
+  uninstall_service_success: Service uninstalled successfully, switched back to normal mode
+  stop_service_success: Service stopped successfully
+  remote_rpc_address_empty: Remote RPC Address cannot be empty
+  service_config_empty: Service Config cannot be empty
+
+client:
+  not_running: Unable to connect to remote client.
+  retry: Retry
diff --git a/easytier/Cargo.toml b/easytier/Cargo.toml
index 635bf93..1c2a842 100644
--- a/easytier/Cargo.toml
+++ b/easytier/Cargo.toml
@@ -189,7 +189,7 @@ sys-locale = "0.3"
 ringbuf = "0.4.5"
 async-ringbuf = "0.3.1"
 
-service-manager = { git = "https://github.com/chipsenkbeil/service-manager-rs.git", branch = "main" }
+service-manager = { git = "https://github.com/EasyTier/service-manager-rs.git", branch = "main" }
 
 zstd = { version = "0.13" }
 
diff --git a/easytier/src/core.rs b/easytier/src/core.rs
new file mode 100644
index 0000000..da13bac
--- /dev/null
+++ b/easytier/src/core.rs
@@ -0,0 +1,1412 @@
+#![allow(dead_code)]
+
+use std::{
+    net::{IpAddr, SocketAddr},
+    path::PathBuf,
+    process::ExitCode,
+    sync::{atomic::AtomicBool, Arc},
+};
+
+use crate::{
+    common::{
+        config::{
+            get_avaliable_encrypt_methods, load_config_from_file, ConfigFileControl, ConfigLoader,
+            ConsoleLoggerConfig, FileLoggerConfig, LoggingConfigLoader, NetworkIdentity,
+            PeerConfig, PortForwardConfig, TomlConfigLoader, VpnPortalConfig,
+        },
+        constants::EASYTIER_VERSION,
+    },
+    defer,
+    instance_manager::NetworkInstanceManager,
+    launcher::add_proxy_network_to_config,
+    proto::common::CompressionAlgoPb,
+    rpc_service::ApiRpcServer,
+    tunnel::PROTO_PORT_OFFSET,
+    utils::{init_logger, setup_panic_handler},
+    web_client,
+};
+use anyhow::Context;
+use cidr::IpCidr;
+use clap::{CommandFactory, Parser};
+use clap_complete::Shell;
+use rust_i18n::t;
+use tokio::io::AsyncReadExt;
+
+#[cfg(feature = "jemalloc-prof")]
+use jemalloc_ctl::{epoch, stats, Access as _, AsName as _};
+
+#[cfg(target_os = "windows")]
+windows_service::define_windows_service!(ffi_service_main, win_service_main);
+
+fn set_prof_active(_active: bool) {
+    #[cfg(feature = "jemalloc-prof")]
+    {
+        const PROF_ACTIVE: &[u8] = b"prof.active\0";
+        let name = PROF_ACTIVE.name();
+        name.write(_active).expect("Should succeed to set prof");
+    }
+}
+
+fn get_dump_profile_path(cur_allocated: usize, suffix: &str) -> String {
+    format!(
+        "profile-{}-{}.{}",
+        cur_allocated,
+        chrono::Local::now().format("%Y-%m-%d-%H-%M-%S"),
+        suffix
+    )
+}
+
+fn dump_profile(_cur_allocated: usize) {
+    #[cfg(feature = "jemalloc-prof")]
+    {
+        const PROF_DUMP: &[u8] = b"prof.dump\0";
+        static mut PROF_DUMP_FILE_NAME: [u8; 128] = [0; 128];
+        let file_name_str = get_dump_profile_path(_cur_allocated, "out");
+        // copy file name to PROF_DUMP
+        let file_name = file_name_str.as_bytes();
+        let len = file_name.len();
+        if len > 127 {
+            panic!("file name too long");
+        }
+        unsafe {
+            PROF_DUMP_FILE_NAME[..len].copy_from_slice(file_name);
+            // set the last byte to 0
+            PROF_DUMP_FILE_NAME[len] = 0;
+
+            let name = PROF_DUMP.name();
+            name.write(&PROF_DUMP_FILE_NAME[..len + 1])
+                .expect("Should succeed to dump profile");
+            println!("dump profile to: {}", file_name_str);
+        }
+    }
+}
+
+#[derive(Parser, Debug)]
+#[command(name = "easytier-core", author, version = EASYTIER_VERSION , about, long_about = None)]
+struct Cli {
+    #[arg(
+        short = 'w',
+        long,
+        env = "ET_CONFIG_SERVER",
+        help = t!("core_clap.config_server").to_string()
+    )]
+    config_server: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_MACHINE_ID",
+        help = t!("core_clap.machine_id").to_string()
+    )]
+    machine_id: Option<String>,
+
+    #[arg(
+        short,
+        long,
+        env = "ET_CONFIG_FILE",
+        value_delimiter = ',',
+        help = t!("core_clap.config_file").to_string(),
+        num_args = 1..,
+    )]
+    config_file: Option<Vec<PathBuf>>,
+
+    #[arg(
+        long,
+        env = "ET_CONFIG_DIR",
+        help = t!("core_clap.config_dir").to_string()
+    )]
+    config_dir: Option<PathBuf>,
+
+    #[command(flatten)]
+    network_options: NetworkOptions,
+
+    #[command(flatten)]
+    logging_options: LoggingOptions,
+
+    #[command(flatten)]
+    rpc_portal_options: RpcPortalOptions,
+
+    #[clap(long, help = t!("core_clap.generate_completions").to_string())]
+    gen_autocomplete: Option<Shell>,
+
+    #[clap(long, help = t!("core_clap.check_config").to_string())]
+    check_config: bool,
+
+    #[clap(long, help = t!("core_clap.daemon").to_string())]
+    daemon: bool,
+}
+
+#[derive(Parser, Debug, Default, PartialEq, Eq)]
+struct NetworkOptions {
+    #[arg(
+        long,
+        env = "ET_NETWORK_NAME",
+        help = t!("core_clap.network_name").to_string(),
+    )]
+    network_name: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_NETWORK_SECRET",
+        help = t!("core_clap.network_secret").to_string(),
+    )]
+    network_secret: Option<String>,
+
+    #[arg(
+        short,
+        long,
+        env = "ET_IPV4",
+        help = t!("core_clap.ipv4").to_string()
+    )]
+    ipv4: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_IPV6",
+        help = t!("core_clap.ipv6").to_string()
+    )]
+    ipv6: Option<String>,
+
+    #[arg(
+        short,
+        long,
+        env = "ET_DHCP",
+        help = t!("core_clap.dhcp").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    dhcp: Option<bool>,
+
+    #[arg(
+        short,
+        long,
+        env = "ET_PEERS",
+        value_delimiter = ',',
+        help = t!("core_clap.peers").to_string(),
+        num_args = 0..
+    )]
+    peers: Vec<String>,
+
+    #[arg(
+        short,
+        long,
+        env = "ET_EXTERNAL_NODE",
+        help = t!("core_clap.external_node").to_string()
+    )]
+    external_node: Option<String>,
+
+    #[arg(
+        short = 'n',
+        long,
+        env = "ET_PROXY_NETWORKS",
+        value_delimiter = ',',
+        help = t!("core_clap.proxy_networks").to_string()
+    )]
+    proxy_networks: Vec<String>,
+
+    #[arg(
+        short,
+        long,
+        env = "ET_LISTENERS",
+        value_delimiter = ',',
+        help = t!("core_clap.listeners").to_string(),
+        num_args = 0..
+    )]
+    listeners: Vec<String>,
+
+    #[arg(
+        long,
+        env = "ET_MAPPED_LISTENERS",
+        value_delimiter = ',',
+        help = t!("core_clap.mapped_listeners").to_string(),
+        num_args = 0..
+    )]
+    mapped_listeners: Vec<String>,
+
+    #[arg(
+        long,
+        env = "ET_NO_LISTENER",
+        help = t!("core_clap.no_listener").to_string(),
+        default_value = "false",
+    )]
+    no_listener: bool,
+
+    #[arg(
+        long,
+        env = "ET_HOSTNAME",
+        help = t!("core_clap.hostname").to_string()
+    )]
+    hostname: Option<String>,
+
+    #[arg(
+        short = 'm',
+        long,
+        env = "ET_INSTANCE_NAME",
+        help = t!("core_clap.instance_name").to_string(),
+    )]
+    instance_name: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_VPN_PORTAL",
+        help = t!("core_clap.vpn_portal").to_string()
+    )]
+    vpn_portal: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_DEFAULT_PROTOCOL",
+        help = t!("core_clap.default_protocol").to_string()
+    )]
+    default_protocol: Option<String>,
+
+    #[arg(
+        short = 'u',
+        long,
+        env = "ET_DISABLE_ENCRYPTION",
+        help = t!("core_clap.disable_encryption").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    disable_encryption: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_ENCRYPTION_ALGORITHM",
+        help = t!("core_clap.encryption_algorithm").to_string(),
+        value_parser = get_avaliable_encrypt_methods()
+    )]
+    encryption_algorithm: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_MULTI_THREAD",
+        help = t!("core_clap.multi_thread").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    multi_thread: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_MULTI_THREAD_COUNT",
+        help = t!("core_clap.multi_thread_count").to_string(),
+    )]
+    multi_thread_count: Option<u32>,
+
+    #[arg(
+        long,
+        env = "ET_DISABLE_IPV6",
+        help = t!("core_clap.disable_ipv6").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    disable_ipv6: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_DEV_NAME",
+        help = t!("core_clap.dev_name").to_string()
+    )]
+    dev_name: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_MTU",
+        help = t!("core_clap.mtu").to_string()
+    )]
+    mtu: Option<u16>,
+
+    #[arg(
+        long,
+        env = "ET_LATENCY_FIRST",
+        help = t!("core_clap.latency_first").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    latency_first: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_EXIT_NODES",
+        value_delimiter = ',',
+        help = t!("core_clap.exit_nodes").to_string(),
+        num_args = 0..
+    )]
+    exit_nodes: Vec<IpAddr>,
+
+    #[arg(
+        long,
+        env = "ET_ENABLE_EXIT_NODE",
+        help = t!("core_clap.enable_exit_node").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    enable_exit_node: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_PROXY_FORWARD_BY_SYSTEM",
+        help = t!("core_clap.proxy_forward_by_system").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    proxy_forward_by_system: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_NO_TUN",
+        help = t!("core_clap.no_tun").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    no_tun: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_USE_SMOLTCP",
+        help = t!("core_clap.use_smoltcp").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    use_smoltcp: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_MANUAL_ROUTES",
+        value_delimiter = ',',
+        help = t!("core_clap.manual_routes").to_string(),
+        num_args = 0..
+    )]
+    manual_routes: Option<Vec<String>>,
+
+    // if not in relay_network_whitelist:
+    // for foreign virtual network, will refuse the incoming connection
+    // for local virtual network, will refuse to relay tun packets
+    #[arg(
+        long,
+        env = "ET_RELAY_NETWORK_WHITELIST",
+        value_delimiter = ',',
+        help = t!("core_clap.relay_network_whitelist").to_string(),
+        num_args = 0..
+    )]
+    relay_network_whitelist: Option<Vec<String>>,
+
+    #[arg(
+        long,
+        env = "ET_P2P_ONLY",
+        help = t!("core_clap.p2p_only").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    p2p_only: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_DISABLE_P2P",
+        help = t!("core_clap.disable_p2p").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    disable_p2p: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_DISABLE_UDP_HOLE_PUNCHING",
+        help = t!("core_clap.disable_udp_hole_punching").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    disable_udp_hole_punching: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_DISABLE_SYM_HOLE_PUNCHING",
+        help = t!("core_clap.disable_sym_hole_punching").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    disable_sym_hole_punching: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_RELAY_ALL_PEER_RPC",
+        help = t!("core_clap.relay_all_peer_rpc").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    relay_all_peer_rpc: Option<bool>,
+
+    #[cfg(feature = "socks5")]
+    #[arg(
+        long,
+        env = "ET_SOCKS5",
+        help = t!("core_clap.socks5").to_string()
+    )]
+    socks5: Option<u16>,
+
+    #[arg(
+        long,
+        env = "ET_COMPRESSION",
+        help = t!("core_clap.compression").to_string(),
+    )]
+    compression: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_BIND_DEVICE",
+        help = t!("core_clap.bind_device").to_string()
+    )]
+    bind_device: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_ENABLE_KCP_PROXY",
+        help = t!("core_clap.enable_kcp_proxy").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    enable_kcp_proxy: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_DISABLE_KCP_INPUT",
+        help = t!("core_clap.disable_kcp_input").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    disable_kcp_input: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_ENABLE_QUIC_PROXY",
+        help = t!("core_clap.enable_quic_proxy").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    enable_quic_proxy: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_DISABLE_QUIC_INPUT",
+        help = t!("core_clap.disable_quic_input").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    disable_quic_input: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_QUIC_LISTEN_PORT",
+        help = t!("core_clap.quic_listen_port").to_string(),
+        num_args = 0..=1,
+    )]
+    quic_listen_port: Option<u16>,
+
+    #[arg(
+        long,
+        env = "ET_PORT_FORWARD",
+        value_delimiter = ',',
+        help = t!("core_clap.port_forward").to_string(),
+        num_args = 1..
+    )]
+    port_forward: Vec<url::Url>,
+
+    #[arg(
+        long,
+        env = "ET_ACCEPT_DNS",
+        help = t!("core_clap.accept_dns").to_string(),
+    )]
+    accept_dns: Option<bool>,
+
+    #[arg(
+        long = "tld-dns-zone",
+        env = "ET_TLD_DNS_ZONE",
+        help = t!("core_clap.tld_dns_zone").to_string())]
+    tld_dns_zone: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_PRIVATE_MODE",
+        help = t!("core_clap.private_mode").to_string(),
+    )]
+    private_mode: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_FOREIGN_RELAY_BPS_LIMIT",
+        help = t!("core_clap.foreign_relay_bps_limit").to_string(),
+    )]
+    foreign_relay_bps_limit: Option<u64>,
+
+    #[arg(
+        long,
+        value_delimiter = ',',
+        help = t!("core_clap.tcp_whitelist").to_string(),
+        num_args = 0..
+    )]
+    tcp_whitelist: Vec<String>,
+
+    #[arg(
+        long,
+        value_delimiter = ',',
+        help = t!("core_clap.udp_whitelist").to_string(),
+        num_args = 0..
+    )]
+    udp_whitelist: Vec<String>,
+
+    #[arg(
+        long,
+        env = "ET_DISABLE_RELAY_KCP",
+        help = t!("core_clap.disable_relay_kcp").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    disable_relay_kcp: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_ENABLE_RELAY_FOREIGN_NETWORK_KCP",
+        help = t!("core_clap.enable_relay_foreign_network_kcp").to_string(),
+        num_args = 0..=1,
+        default_missing_value = "true"
+    )]
+    enable_relay_foreign_network_kcp: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_STUN_SERVERS",
+        value_delimiter = ',',
+        help = t!("core_clap.stun_servers").to_string(),
+        num_args = 0..
+    )]
+    stun_servers: Option<Vec<String>>,
+
+    #[arg(
+        long,
+        env = "ET_STUN_SERVERS_V6",
+        value_delimiter = ',',
+        help = t!("core_clap.stun_servers_v6").to_string(),
+        num_args = 0..
+    )]
+    stun_servers_v6: Option<Vec<String>>,
+}
+
+#[derive(Parser, Debug)]
+struct LoggingOptions {
+    #[arg(
+        long,
+        env = "ET_CONSOLE_LOG_LEVEL",
+        help = t!("core_clap.console_log_level").to_string()
+    )]
+    console_log_level: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_FILE_LOG_LEVEL",
+        help = t!("core_clap.file_log_level").to_string()
+    )]
+    file_log_level: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_FILE_LOG_DIR",
+        help = t!("core_clap.file_log_dir").to_string()
+    )]
+    file_log_dir: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_FILE_LOG_SIZE",
+        help = t!("core_clap.file_log_size_mb").to_string()
+    )]
+    file_log_size: Option<u64>,
+
+    #[arg(
+        long,
+        env = "ET_FILE_LOG_COUNT",
+        help = t!("core_clap.file_log_count").to_string()
+    )]
+    file_log_count: Option<usize>,
+}
+
+#[derive(Parser, Debug)]
+struct RpcPortalOptions {
+    #[arg(
+        short,
+        long,
+        env = "ET_RPC_PORTAL",
+        help = t!("core_clap.rpc_portal").to_string(),
+    )]
+    rpc_portal: Option<String>,
+
+    #[arg(
+        long,
+        env = "ET_RPC_PORTAL_WHITELIST",
+        value_delimiter = ',',
+        help = t!("core_clap.rpc_portal_whitelist").to_string(),
+    )]
+    rpc_portal_whitelist: Option<Vec<IpCidr>>,
+}
+
+impl Cli {
+    fn parse_listeners(no_listener: bool, listeners: Vec<String>) -> anyhow::Result<Vec<String>> {
+        if no_listener || listeners.is_empty() {
+            return Ok(vec![]);
+        }
+
+        let origin_listeners = listeners;
+        let mut listeners: Vec<String> = Vec::new();
+        if origin_listeners.len() == 1 {
+            if let Ok(port) = origin_listeners[0].parse::<u16>() {
+                for (proto, offset) in PROTO_PORT_OFFSET {
+                    listeners.push(format!("{}://0.0.0.0:{}", proto, port + *offset));
+                }
+                return Ok(listeners);
+            }
+        }
+
+        for l in &origin_listeners {
+            let proto_port: Vec<&str> = l.split(':').collect();
+            if proto_port.len() > 2 {
+                if let Ok(url) = l.parse::<url::Url>() {
+                    listeners.push(url.to_string());
+                } else {
+                    panic!("failed to parse listener: {}", l);
+                }
+            } else {
+                let Some((proto, offset)) = PROTO_PORT_OFFSET
+                    .iter()
+                    .find(|(proto, _)| *proto == proto_port[0])
+                else {
+                    return Err(anyhow::anyhow!("unknown protocol: {}", proto_port[0]));
+                };
+
+                let port = if proto_port.len() == 2 {
+                    proto_port[1].parse::<u16>().unwrap()
+                } else {
+                    11010 + offset
+                };
+
+                listeners.push(format!("{}://0.0.0.0:{}", proto, port));
+            }
+        }
+
+        Ok(listeners)
+    }
+}
+
+impl NetworkOptions {
+    fn can_merge(&self, cfg: &TomlConfigLoader, config_file_count: usize) -> bool {
+        if (*self) == NetworkOptions::default() {
+            return false;
+        }
+        if config_file_count == 1 {
+            return true;
+        }
+        let Some(network_name) = &self.network_name else {
+            return false;
+        };
+        if cfg.get_network_identity().network_name == *network_name {
+            return true;
+        }
+        false
+    }
+
+    fn merge_into(&self, cfg: &mut TomlConfigLoader) -> anyhow::Result<()> {
+        if self.hostname.is_some() {
+            cfg.set_hostname(self.hostname.clone());
+        }
+
+        let old_ns = cfg.get_network_identity();
+        let network_name = self.network_name.clone().unwrap_or(old_ns.network_name);
+        let network_secret = self
+            .network_secret
+            .clone()
+            .unwrap_or(old_ns.network_secret.unwrap_or_default());
+        cfg.set_network_identity(NetworkIdentity::new(network_name, network_secret));
+
+        if let Some(dhcp) = self.dhcp {
+            cfg.set_dhcp(dhcp);
+        }
+
+        if let Some(ipv4) = &self.ipv4 {
+            cfg.set_ipv4(Some(ipv4.parse().with_context(|| {
+                format!("failed to parse ipv4 address: {}", ipv4)
+            })?))
+        }
+
+        if let Some(ipv6) = &self.ipv6 {
+            cfg.set_ipv6(Some(ipv6.parse().with_context(|| {
+                format!("failed to parse ipv6 address: {}", ipv6)
+            })?))
+        }
+
+        if !self.peers.is_empty() {
+            let mut peers = cfg.get_peers();
+            peers.reserve(peers.len() + self.peers.len());
+            for p in &self.peers {
+                peers.push(PeerConfig {
+                    uri: p
+                        .parse()
+                        .with_context(|| format!("failed to parse peer uri: {}", p))?,
+                });
+            }
+            cfg.set_peers(peers);
+        }
+
+        if self.no_listener || !self.listeners.is_empty() {
+            cfg.set_listeners(
+                Cli::parse_listeners(self.no_listener, self.listeners.clone())?
+                    .into_iter()
+                    .map(|s| s.parse().unwrap())
+                    .collect(),
+            );
+        } else if cfg.get_listeners().is_none() {
+            cfg.set_listeners(
+                Cli::parse_listeners(false, vec!["11010".to_string()])?
+                    .into_iter()
+                    .map(|s| s.parse().unwrap())
+                    .collect(),
+            );
+        }
+
+        if !self.mapped_listeners.is_empty() {
+            let mut errs = Vec::new();
+            cfg.set_mapped_listeners(Some(
+                self.mapped_listeners
+                    .iter()
+                    .map(|s| {
+                        s.parse()
+                            .with_context(|| format!("mapped listener is not a valid url: {}", s))
+                            .unwrap()
+                    })
+                    .map(|s: url::Url| {
+                        if s.port().is_none() {
+                            errs.push(anyhow::anyhow!("mapped listener port is missing: {}", s));
+                        }
+                        s
+                    })
+                    .collect::<Vec<_>>(),
+            ));
+            if !errs.is_empty() {
+                return Err(anyhow::anyhow!(
+                    "{}",
+                    errs.iter()
+                        .map(|x| format!("{}", x))
+                        .collect::<Vec<_>>()
+                        .join("\n")
+                ));
+            }
+        }
+
+        for n in self.proxy_networks.iter() {
+            add_proxy_network_to_config(n, cfg)?;
+        }
+
+        if let Some(external_nodes) = self.external_node.as_ref() {
+            let mut old_peers = cfg.get_peers();
+            old_peers.push(PeerConfig {
+                uri: external_nodes.parse().with_context(|| {
+                    format!("failed to parse external node uri: {}", external_nodes)
+                })?,
+            });
+            cfg.set_peers(old_peers);
+        }
+
+        if let Some(inst_name) = &self.instance_name {
+            cfg.set_inst_name(inst_name.clone());
+        }
+
+        if let Some(vpn_portal) = self.vpn_portal.as_ref() {
+            let url: url::Url = vpn_portal
+                .parse()
+                .with_context(|| format!("failed to parse vpn portal url: {}", vpn_portal))?;
+            let host = url
+                .host_str()
+                .ok_or_else(|| anyhow::anyhow!("vpn portal url missing host"))?;
+            let port = url
+                .port()
+                .ok_or_else(|| anyhow::anyhow!("vpn portal url missing port"))?;
+            let client_cidr = url.path()[1..].parse().with_context(|| {
+                format!("failed to parse vpn portal client cidr: {}", url.path())
+            })?;
+            let wireguard_listen: SocketAddr = format!("{}:{}", host, port).parse().unwrap();
+            cfg.set_vpn_portal_config(VpnPortalConfig {
+                wireguard_listen,
+                client_cidr,
+            });
+        }
+
+        if let Some(manual_routes) = self.manual_routes.as_ref() {
+            let mut routes = Vec::<cidr::Ipv4Cidr>::with_capacity(manual_routes.len());
+            for r in manual_routes {
+                routes.push(
+                    r.parse()
+                        .with_context(|| format!("failed to parse route: {}", r))?,
+                );
+            }
+            cfg.set_routes(Some(routes));
+        }
+
+        #[cfg(feature = "socks5")]
+        if let Some(socks5_proxy) = self.socks5 {
+            cfg.set_socks5_portal(Some(
+                format!("socks5://0.0.0.0:{}", socks5_proxy)
+                    .parse()
+                    .unwrap(),
+            ));
+        }
+
+        #[cfg(feature = "socks5")]
+        for port_forward in self.port_forward.iter() {
+            let example_str = ", example: udp://0.0.0.0:12345/10.126.126.1:12345";
+
+            let bind_addr = format!(
+                "{}:{}",
+                port_forward.host_str().expect("local bind host is missing"),
+                port_forward.port().expect("local bind port is missing")
+            )
+            .parse()
+            .unwrap_or_else(|_| panic!("failed to parse local bind addr {}", example_str));
+
+            let dst_addr = port_forward
+                .path_segments()
+                .unwrap_or_else(|| panic!("remote destination addr is missing {}", example_str))
+                .next()
+                .unwrap_or_else(|| panic!("remote destination addr is missing {}", example_str))
+                .to_string()
+                .parse()
+                .unwrap_or_else(|_| {
+                    panic!("failed to parse remote destination addr {}", example_str)
+                });
+
+            let port_forward_item = PortForwardConfig {
+                bind_addr,
+                dst_addr,
+                proto: port_forward.scheme().to_string(),
+            };
+
+            let mut old = cfg.get_port_forwards();
+            old.push(port_forward_item);
+            cfg.set_port_forwards(old);
+        }
+
+        let mut f = cfg.get_flags();
+        if let Some(default_protocol) = &self.default_protocol {
+            f.default_protocol = default_protocol.clone()
+        };
+        if let Some(v) = self.disable_encryption {
+            f.enable_encryption = !v;
+        }
+        if let Some(algorithm) = &self.encryption_algorithm {
+            f.encryption_algorithm = algorithm.clone();
+        }
+        if let Some(v) = self.disable_ipv6 {
+            f.enable_ipv6 = !v;
+        }
+        f.latency_first = self.latency_first.unwrap_or(f.latency_first);
+        if let Some(dev_name) = &self.dev_name {
+            f.dev_name = dev_name.clone()
+        }
+        if let Some(mtu) = self.mtu {
+            f.mtu = mtu as u32;
+        }
+        f.enable_exit_node = self.enable_exit_node.unwrap_or(f.enable_exit_node);
+        f.proxy_forward_by_system = self
+            .proxy_forward_by_system
+            .unwrap_or(f.proxy_forward_by_system);
+        f.no_tun = self.no_tun.unwrap_or(f.no_tun) || cfg!(not(feature = "tun"));
+        f.use_smoltcp = self.use_smoltcp.unwrap_or(f.use_smoltcp);
+        if let Some(wl) = self.relay_network_whitelist.as_ref() {
+            f.relay_network_whitelist = wl.join(" ");
+        }
+        f.disable_p2p = self.disable_p2p.unwrap_or(f.disable_p2p);
+        f.p2p_only = self.p2p_only.unwrap_or(f.p2p_only);
+        f.disable_udp_hole_punching = self
+            .disable_udp_hole_punching
+            .unwrap_or(f.disable_udp_hole_punching);
+        f.relay_all_peer_rpc = self.relay_all_peer_rpc.unwrap_or(f.relay_all_peer_rpc);
+        f.multi_thread = self.multi_thread.unwrap_or(f.multi_thread);
+        if let Some(compression) = &self.compression {
+            f.data_compress_algo = match compression.as_str() {
+                "none" => CompressionAlgoPb::None,
+                "zstd" => CompressionAlgoPb::Zstd,
+                _ => panic!(
+                    "unknown compression algorithm: {}, supported: none, zstd",
+                    compression
+                ),
+            }
+            .into();
+        }
+        f.bind_device = self.bind_device.unwrap_or(f.bind_device);
+        f.enable_kcp_proxy = self.enable_kcp_proxy.unwrap_or(f.enable_kcp_proxy);
+        f.disable_kcp_input = self.disable_kcp_input.unwrap_or(f.disable_kcp_input);
+        f.enable_quic_proxy = self.enable_quic_proxy.unwrap_or(f.enable_quic_proxy);
+        f.disable_quic_input = self.disable_quic_input.unwrap_or(f.disable_quic_input);
+        if let Some(quic_listen_port) = self.quic_listen_port {
+            f.quic_listen_port = quic_listen_port as u32;
+        }
+        f.accept_dns = self.accept_dns.unwrap_or(f.accept_dns);
+        f.private_mode = self.private_mode.unwrap_or(f.private_mode);
+        f.foreign_relay_bps_limit = self
+            .foreign_relay_bps_limit
+            .unwrap_or(f.foreign_relay_bps_limit);
+        f.multi_thread_count = self.multi_thread_count.unwrap_or(f.multi_thread_count);
+        f.disable_relay_kcp = self.disable_relay_kcp.unwrap_or(f.disable_relay_kcp);
+        f.enable_relay_foreign_network_kcp = self
+            .enable_relay_foreign_network_kcp
+            .unwrap_or(f.enable_relay_foreign_network_kcp);
+        f.disable_sym_hole_punching = self.disable_sym_hole_punching.unwrap_or(false);
+        // Configure tld_dns_zone: use provided value if set
+        if let Some(tld_dns_zone) = &self.tld_dns_zone {
+            f.tld_dns_zone = tld_dns_zone.clone();
+        }
+        cfg.set_flags(f);
+
+        if !self.exit_nodes.is_empty() {
+            cfg.set_exit_nodes(self.exit_nodes.clone());
+        }
+
+        let mut old_tcp_whitelist = cfg.get_tcp_whitelist();
+        old_tcp_whitelist.extend(self.tcp_whitelist.clone());
+        cfg.set_tcp_whitelist(old_tcp_whitelist);
+
+        let mut old_udp_whitelist = cfg.get_udp_whitelist();
+        old_udp_whitelist.extend(self.udp_whitelist.clone());
+        cfg.set_udp_whitelist(old_udp_whitelist);
+
+        if let Some(stun_servers) = &self.stun_servers {
+            let mut old_stun_servers = cfg.get_stun_servers().unwrap_or_default();
+            old_stun_servers.extend(stun_servers.iter().cloned());
+            cfg.set_stun_servers(Some(old_stun_servers));
+        }
+
+        if let Some(stun_servers_v6) = &self.stun_servers_v6 {
+            let mut old_stun_servers_v6 = cfg.get_stun_servers_v6().unwrap_or_default();
+            old_stun_servers_v6.extend(stun_servers_v6.iter().cloned());
+            cfg.set_stun_servers_v6(Some(old_stun_servers_v6));
+        }
+        Ok(())
+    }
+}
+
+impl LoggingConfigLoader for &LoggingOptions {
+    fn get_console_logger_config(&self) -> ConsoleLoggerConfig {
+        ConsoleLoggerConfig {
+            level: self.console_log_level.clone(),
+        }
+    }
+
+    fn get_file_logger_config(&self) -> FileLoggerConfig {
+        FileLoggerConfig {
+            level: self.file_log_level.clone(),
+            dir: self.file_log_dir.clone(),
+            file: None,
+            size_mb: self.file_log_size,
+            count: self.file_log_count,
+        }
+    }
+}
+
+#[cfg(target_os = "windows")]
+fn win_service_set_work_dir(service_name: &std::ffi::OsString) -> anyhow::Result<()> {
+    use crate::common::constants::WIN_SERVICE_WORK_DIR_REG_KEY;
+    use winreg::enums::*;
+    use winreg::RegKey;
+
+    let hklm = RegKey::predef(HKEY_LOCAL_MACHINE);
+    let key = hklm.open_subkey_with_flags(WIN_SERVICE_WORK_DIR_REG_KEY, KEY_READ)?;
+    let dir_pat_str = key.get_value::<std::ffi::OsString, _>(service_name)?;
+    let dir_path = std::fs::canonicalize(dir_pat_str)?;
+
+    std::env::set_current_dir(dir_path)?;
+
+    Ok(())
+}
+
+#[cfg(target_os = "windows")]
+fn win_service_event_loop(
+    stop_notify: std::sync::Arc<tokio::sync::Notify>,
+    cli: Cli,
+    status_handle: windows_service::service_control_handler::ServiceStatusHandle,
+) {
+    use std::time::Duration;
+    use tokio::runtime::Runtime;
+    use windows_service::service::*;
+
+    let normal_status = ServiceStatus {
+        service_type: ServiceType::OWN_PROCESS,
+        current_state: ServiceState::Running,
+        controls_accepted: ServiceControlAccept::STOP,
+        exit_code: ServiceExitCode::Win32(0),
+        checkpoint: 0,
+        wait_hint: Duration::default(),
+        process_id: None,
+    };
+    let error_status = ServiceStatus {
+        service_type: ServiceType::OWN_PROCESS,
+        current_state: ServiceState::Stopped,
+        controls_accepted: ServiceControlAccept::empty(),
+        exit_code: ServiceExitCode::ServiceSpecific(1u32),
+        checkpoint: 0,
+        wait_hint: Duration::default(),
+        process_id: None,
+    };
+
+    std::thread::spawn(move || {
+        let rt = Runtime::new().unwrap();
+        rt.block_on(async move {
+            tokio::select! {
+                res = run_main(cli) => {
+                    match res {
+                        Ok(_) => {
+                            status_handle.set_service_status(normal_status).unwrap();
+                            std::process::exit(0);
+                        }
+                        Err(e) => {
+                            status_handle.set_service_status(error_status).unwrap();
+                            eprintln!("error: {}", e);
+                        }
+                    }
+                },
+                _ = stop_notify.notified() => {
+                    _ = status_handle.set_service_status(normal_status);
+                    std::process::exit(0);
+                }
+            }
+        });
+    });
+}
+
+fn parse_cli() -> Cli {
+    let mut cli = Cli::parse();
+    // for --stun-servers="", we want vec![], but clap will give vec![""], hack for that
+    if let Some(stun_servers) = &mut cli.network_options.stun_servers {
+        stun_servers.retain(|s| !s.trim().is_empty());
+    }
+    if let Some(stun_servers_v6) = &mut cli.network_options.stun_servers_v6 {
+        stun_servers_v6.retain(|s| !s.trim().is_empty());
+    }
+    cli
+}
+
+#[cfg(target_os = "windows")]
+fn win_service_main(arg: Vec<std::ffi::OsString>) {
+    use std::sync::Arc;
+    use std::time::Duration;
+    use tokio::sync::Notify;
+    use windows_service::service::*;
+    use windows_service::service_control_handler::*;
+
+    _ = win_service_set_work_dir(&arg[0]);
+
+    let cli = parse_cli();
+
+    let stop_notify_send = Arc::new(Notify::new());
+    let stop_notify_recv = Arc::clone(&stop_notify_send);
+    let event_handler = move |control_event| -> ServiceControlHandlerResult {
+        match control_event {
+            ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
+            ServiceControl::Stop => {
+                stop_notify_send.notify_one();
+                ServiceControlHandlerResult::NoError
+            }
+            _ => ServiceControlHandlerResult::NotImplemented,
+        }
+    };
+    let status_handle = register(String::new(), event_handler).expect("register service fail");
+    let next_status = ServiceStatus {
+        service_type: ServiceType::OWN_PROCESS,
+        current_state: ServiceState::Running,
+        controls_accepted: ServiceControlAccept::STOP,
+        exit_code: ServiceExitCode::Win32(0),
+        checkpoint: 0,
+        wait_hint: Duration::default(),
+        process_id: None,
+    };
+    status_handle
+        .set_service_status(next_status)
+        .expect("set service status fail");
+
+    win_service_event_loop(stop_notify_recv, cli, status_handle);
+}
+
+async fn run_main(cli: Cli) -> anyhow::Result<()> {
+    defer!(dump_profile(0););
+    init_logger(&cli.logging_options, true)?;
+
+    let manager = Arc::new(NetworkInstanceManager::new().with_config_path(cli.config_dir.clone()));
+
+    let _rpc_server = ApiRpcServer::new(
+        cli.rpc_portal_options.rpc_portal,
+        cli.rpc_portal_options.rpc_portal_whitelist,
+        manager.clone(),
+    )?
+    .serve()
+    .await?;
+
+    let _web_client = if let Some(config_server_url_s) = cli.config_server.as_ref() {
+        let wc = web_client::run_web_client(
+            config_server_url_s,
+            cli.machine_id.clone(),
+            cli.network_options.hostname.clone(),
+            manager.clone(),
+        )
+        .await
+        .inspect(|_| {
+            println!(
+                "Web client started successfully...\nserver: {}",
+                config_server_url_s,
+            );
+
+            println!("Official config website: https://easytier.cn/web");
+        })?;
+
+        Some(wc)
+    } else {
+        None
+    };
+
+    let _daemon_guard = if cli.daemon {
+        Some(manager.register_daemon())
+    } else {
+        None
+    };
+
+    let mut config_files = if let Some(v) = cli.config_file {
+        v.clone()
+    } else {
+        vec![]
+    };
+    if let Some(config_dir) = cli.config_dir.as_ref() {
+        if !config_dir.is_dir() {
+            anyhow::bail!("config_dir {} is not a directory", config_dir.display());
+        }
+
+        for entry in std::fs::read_dir(config_dir)? {
+            let entry = entry?;
+            let path = entry.path();
+            if !path.is_file() {
+                continue;
+            }
+            let Some(ext) = path.extension() else {
+                continue;
+            };
+            if ext != "toml" {
+                continue;
+            }
+            config_files.push(path);
+        }
+    }
+    let config_file_count = config_files.len();
+    let mut crate_cli_network = {
+        if cli.daemon {
+            false
+        } else if config_file_count == 0 && cli.config_server.is_none() {
+            true
+        } else {
+            cli.network_options.network_name.is_some()
+        }
+    };
+    for config_file in config_files {
+        let (mut cfg, mut control) =
+            load_config_from_file(&config_file, cli.config_dir.as_ref()).await?;
+
+        if cli.network_options.can_merge(&cfg, config_file_count) {
+            cli.network_options
+                .merge_into(&mut cfg)
+                .with_context(|| format!("failed to merge config from cli: {:?}", config_file))?;
+            crate_cli_network = false;
+            control.set_read_only(true);
+            control.set_no_delete(true);
+        }
+
+        println!(
+            "Starting easytier from config file {:?}({:?}) with config:",
+            config_file, control.permission
+        );
+        println!("############### TOML ###############\n");
+        println!("{}", cfg.dump());
+        println!("-----------------------------------");
+        manager.run_network_instance(cfg, true, control)?;
+    }
+
+    if crate_cli_network {
+        let mut cfg = TomlConfigLoader::default();
+        cli.network_options
+            .merge_into(&mut cfg)
+            .with_context(|| "failed to create config from cli".to_string())?;
+        println!("Starting easytier from cli with config:");
+        println!("############### TOML ###############\n");
+        println!("{}", cfg.dump());
+        println!("-----------------------------------");
+        manager.run_network_instance(cfg, true, ConfigFileControl::STATIC_CONFIG)?;
+    }
+
+    #[cfg(unix)]
+    let mut sigterm = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())?;
+    #[cfg(unix)]
+    let sigterm = sigterm.recv();
+    #[cfg(not(unix))]
+    let sigterm = std::future::pending::<()>();
+
+    tokio::select! {
+        _ = manager.wait() => {
+            let infos = manager.collect_network_infos().await?;
+            let errs = infos
+                .into_values()
+                .filter_map(|info| info.error_msg)
+                .collect::<Vec<_>>();
+            if !errs.is_empty() {
+                return Err(anyhow::anyhow!("some instances stopped with errors"));
+            }
+        }
+        _ = tokio::signal::ctrl_c() => {
+            println!("ctrl-c received, exiting...");
+        }
+
+        _ = sigterm, if cfg!(unix) => {
+            println!("terminate signal received, exiting...");
+        }
+    }
+    Ok(())
+}
+
+fn memory_monitor(_force_dump: Arc<AtomicBool>) {
+    #[cfg(feature = "jemalloc-prof")]
+    {
+        let mut last_peak_size = 0;
+        let e = epoch::mib().unwrap();
+        let allocated_stats = stats::allocated::mib().unwrap();
+
+        loop {
+            e.advance().unwrap();
+            let new_heap_size = allocated_stats.read().unwrap();
+
+            println!(
+                "heap size: {} bytes, time: {}",
+                new_heap_size,
+                chrono::Local::now().format("%Y-%m-%d %H:%M:%S")
+            );
+
+            // dump every 75MB
+            if (last_peak_size > 0
+                && new_heap_size > last_peak_size
+                && new_heap_size - last_peak_size > 10 * 1024 * 1024)
+                || _force_dump.load(std::sync::atomic::Ordering::Relaxed)
+            {
+                println!(
+                    "heap size increased: {} bytes, time: {}",
+                    new_heap_size - last_peak_size,
+                    chrono::Local::now().format("%Y-%m-%d %H:%M:%S")
+                );
+                dump_profile(new_heap_size);
+                last_peak_size = new_heap_size;
+                if _force_dump.load(std::sync::atomic::Ordering::Relaxed) {
+                    // also dump whole jemalloc stats
+                    use jemalloc_ctl::stats_print::stats_print;
+                    let tmp_file = get_dump_profile_path(new_heap_size, "stats");
+                    let mut file = std::fs::File::create(tmp_file).unwrap();
+                    let _ = stats_print(&mut file, Default::default());
+                    _force_dump.store(false, std::sync::atomic::Ordering::Relaxed);
+                }
+            }
+
+            if last_peak_size == 0 {
+                last_peak_size = new_heap_size;
+            }
+
+            std::thread::sleep(std::time::Duration::from_secs(5));
+        }
+    }
+}
+
+pub async fn main() -> ExitCode {
+    let locale = sys_locale::get_locale().unwrap_or_else(|| String::from("en-US"));
+    rust_i18n::set_locale(&locale);
+    setup_panic_handler();
+
+    #[cfg(target_os = "windows")]
+    match windows_service::service_dispatcher::start(String::new(), ffi_service_main) {
+        Ok(_) => std::thread::park(),
+        Err(e) => {
+            let should_panic = if let windows_service::Error::Winapi(ref io_error) = e {
+                io_error.raw_os_error() != Some(0x427) // ERROR_FAILED_SERVICE_CONTROLLER_CONNECT
+            } else {
+                true
+            };
+
+            if should_panic {
+                panic!("SCM start an error: {}", e);
+            }
+        }
+    };
+
+    set_prof_active(true);
+    // register a signal handler to set force dump when signal usr1 is received
+    let force_dump = Arc::new(AtomicBool::new(false));
+    #[cfg(all(feature = "jemalloc-prof", not(target_os = "windows")))]
+    {
+        let force_dump_clone = force_dump.clone();
+        let mut sigusr1 =
+            tokio::signal::unix::signal(tokio::signal::unix::SignalKind::user_defined1()).unwrap();
+        tokio::task::spawn(async move {
+            while sigusr1.recv().await.is_some() {
+                force_dump_clone.store(true, std::sync::atomic::Ordering::Relaxed);
+            }
+        });
+    }
+    let _monitor = std::thread::spawn(move || memory_monitor(force_dump));
+
+    let cli = parse_cli();
+
+    if let Some(shell) = cli.gen_autocomplete {
+        let mut cmd = Cli::command();
+        crate::print_completions(shell, &mut cmd, "easytier-core");
+        return ExitCode::SUCCESS;
+    }
+
+    // Verify configurations
+    if cli.check_config {
+        if let Err(e) = validate_config(&cli).await {
+            eprintln!("Config validation failed: {:?}", e);
+            return ExitCode::FAILURE;
+        } else {
+            return ExitCode::SUCCESS;
+        }
+    }
+
+    let mut ret_code = 0;
+
+    if let Err(e) = run_main(cli).await {
+        eprintln!("error: {:?}", e);
+        ret_code = 1;
+    }
+
+    println!("Stopping easytier...");
+    set_prof_active(false);
+
+    ExitCode::from(ret_code)
+}
+
+async fn validate_config(cli: &Cli) -> anyhow::Result<()> {
+    // Check if a config file is provided
+    let config_files = cli
+        .config_file
+        .as_ref()
+        .ok_or_else(|| anyhow::anyhow!("--config-file is required when using --check-config"))?;
+
+    for config_file in config_files {
+        if config_file == &PathBuf::from("-") {
+            let mut stdin = String::new();
+            _ = tokio::io::stdin().read_to_string(&mut stdin).await?;
+            TomlConfigLoader::new_from_str(stdin.as_str())
+                .with_context(|| "config source: stdin")?;
+        } else {
+            TomlConfigLoader::new(config_file)
+                .with_context(|| format!("config source: {:?}", config_file))?;
+        };
+    }
+
+    Ok(())
+}
diff --git a/easytier/src/easytier-cli.rs b/easytier/src/easytier-cli.rs
index d7db7aa..937375f 100644
--- a/easytier/src/easytier-cli.rs
+++ b/easytier/src/easytier-cli.rs
@@ -1,6 +1,5 @@
 use std::{
     ffi::OsString,
-    fmt::Write,
     net::{IpAddr, SocketAddr},
     path::PathBuf,
     str::FromStr,
@@ -17,6 +16,8 @@ use humansize::format_size;
 use rust_i18n::t;
 use service_manager::*;
 use tabled::settings::Style;
+
+use easytier::service_manager::{Service, ServiceInstallOptions};
 use tokio::time::timeout;
 
 use easytier::{
@@ -1376,274 +1377,6 @@ impl CommandHandler<'_> {
     }
 }
 
-#[derive(Debug)]
-pub struct ServiceInstallOptions {
-    pub program: PathBuf,
-    pub args: Vec<OsString>,
-    pub work_directory: PathBuf,
-    pub disable_autostart: bool,
-    pub description: Option<String>,
-    pub display_name: Option<String>,
-    pub disable_restart_on_failure: bool,
-}
-pub struct Service {
-    lable: ServiceLabel,
-    kind: ServiceManagerKind,
-    service_manager: Box<dyn ServiceManager>,
-}
-
-impl Service {
-    pub fn new(name: String) -> Result<Self, Error> {
-        #[cfg(target_os = "windows")]
-        let service_manager = Box::new(crate::win_service_manager::WinServiceManager::new()?);
-
-        #[cfg(not(target_os = "windows"))]
-        let service_manager = <dyn ServiceManager>::native()?;
-        let kind = ServiceManagerKind::native()?;
-
-        println!("service manager kind: {:?}", kind);
-
-        Ok(Self {
-            lable: name.parse()?,
-            kind,
-            service_manager,
-        })
-    }
-
-    pub fn install(&self, options: &ServiceInstallOptions) -> Result<(), Error> {
-        let ctx = ServiceInstallCtx {
-            label: self.lable.clone(),
-            program: options.program.clone(),
-            args: options.args.clone(),
-            contents: self.make_install_content_option(options),
-            autostart: !options.disable_autostart,
-            username: None,
-            working_directory: Some(options.work_directory.clone()),
-            environment: None,
-            disable_restart_on_failure: options.disable_restart_on_failure,
-        };
-        if self.status()? != ServiceStatus::NotInstalled {
-            return Err(anyhow::anyhow!(
-                "Service is already installed! Service Name: {}",
-                self.lable
-            ));
-        }
-
-        self.service_manager
-            .install(ctx.clone())
-            .map_err(|e| anyhow::anyhow!("failed to install service: {:?}", e))?;
-
-        println!(
-            "Service installed successfully! Service Name: {}",
-            self.lable
-        );
-
-        Ok(())
-    }
-
-    pub fn uninstall(&self) -> Result<(), Error> {
-        let ctx = ServiceUninstallCtx {
-            label: self.lable.clone(),
-        };
-        let status = self.status()?;
-
-        if status == ServiceStatus::NotInstalled {
-            return Err(anyhow::anyhow!("Service is not installed"));
-        }
-
-        if status == ServiceStatus::Running {
-            self.service_manager.stop(ServiceStopCtx {
-                label: self.lable.clone(),
-            })?;
-        }
-
-        self.service_manager
-            .uninstall(ctx)
-            .map_err(|e| anyhow::anyhow!("failed to uninstall service: {}", e))
-    }
-
-    pub fn status(&self) -> Result<ServiceStatus, Error> {
-        let ctx = ServiceStatusCtx {
-            label: self.lable.clone(),
-        };
-        let status = self.service_manager.status(ctx)?;
-
-        Ok(status)
-    }
-
-    pub fn start(&self) -> Result<(), Error> {
-        let ctx = ServiceStartCtx {
-            label: self.lable.clone(),
-        };
-        let status = self.status()?;
-
-        match status {
-            ServiceStatus::Running => Err(anyhow::anyhow!("Service is already running")),
-            ServiceStatus::Stopped(_) => {
-                self.service_manager
-                    .start(ctx)
-                    .map_err(|e| anyhow::anyhow!("failed to start service: {}", e))?;
-                Ok(())
-            }
-            ServiceStatus::NotInstalled => Err(anyhow::anyhow!("Service is not installed")),
-        }
-    }
-
-    pub fn stop(&self) -> Result<(), Error> {
-        let ctx = ServiceStopCtx {
-            label: self.lable.clone(),
-        };
-        let status = self.status()?;
-
-        match status {
-            ServiceStatus::Running => {
-                self.service_manager
-                    .stop(ctx)
-                    .map_err(|e| anyhow::anyhow!("failed to stop service: {}", e))?;
-                Ok(())
-            }
-            ServiceStatus::Stopped(_) => Err(anyhow::anyhow!("Service is already stopped")),
-            ServiceStatus::NotInstalled => Err(anyhow::anyhow!("Service is not installed")),
-        }
-    }
-
-    fn make_install_content_option(&self, options: &ServiceInstallOptions) -> Option<String> {
-        match self.kind {
-            ServiceManagerKind::Systemd => Some(self.make_systemd_unit(options).unwrap()),
-            ServiceManagerKind::Rcd => Some(self.make_rcd_script(options).unwrap()),
-            ServiceManagerKind::OpenRc => Some(self.make_open_rc_script(options).unwrap()),
-            ServiceManagerKind::Launchd => None, // 使用 service-manager-rs 的默认 plist 生成
-            _ => {
-                #[cfg(target_os = "windows")]
-                {
-                    let win_options = win_service_manager::WinServiceInstallOptions {
-                        description: options.description.clone(),
-                        display_name: options.display_name.clone(),
-                        dependencies: Some(vec!["rpcss".to_string(), "dnscache".to_string()]),
-                    };
-
-                    Some(serde_json::to_string(&win_options).unwrap())
-                }
-
-                #[cfg(not(target_os = "windows"))]
-                None
-            }
-        }
-    }
-
-    fn make_systemd_unit(
-        &self,
-        options: &ServiceInstallOptions,
-    ) -> Result<String, std::fmt::Error> {
-        let args = options
-            .args
-            .iter()
-            .map(|a| a.to_string_lossy())
-            .collect::<Vec<_>>()
-            .join(" ");
-        let target_app = options.program.display().to_string();
-        let work_dir = options.work_directory.display().to_string();
-        let mut unit_content = String::new();
-
-        writeln!(unit_content, "[Unit]")?;
-        writeln!(unit_content, "After=network.target syslog.target")?;
-        if let Some(ref d) = options.description {
-            writeln!(unit_content, "Description={d}")?;
-        }
-        writeln!(unit_content, "StartLimitIntervalSec=0")?;
-        writeln!(unit_content)?;
-        writeln!(unit_content, "[Service]")?;
-        writeln!(unit_content, "Type=simple")?;
-        writeln!(unit_content, "WorkingDirectory={work_dir}")?;
-        writeln!(unit_content, "ExecStart={target_app} {args}")?;
-        writeln!(unit_content, "Restart=always")?;
-        writeln!(unit_content, "RestartSec=1")?;
-        writeln!(unit_content, "LimitNOFILE=infinity")?;
-        writeln!(unit_content)?;
-        writeln!(unit_content, "[Install]")?;
-        writeln!(unit_content, "WantedBy=multi-user.target")?;
-
-        std::result::Result::Ok(unit_content)
-    }
-
-    fn make_rcd_script(&self, options: &ServiceInstallOptions) -> Result<String, std::fmt::Error> {
-        let name = self.lable.to_qualified_name();
-        let args = options
-            .args
-            .iter()
-            .map(|a| a.to_string_lossy())
-            .collect::<Vec<_>>()
-            .join(" ");
-        let target_app = options.program.display().to_string();
-        let work_dir = options.work_directory.display().to_string();
-        let mut script = String::new();
-
-        writeln!(script, "#!/bin/sh")?;
-        writeln!(script, "#")?;
-        writeln!(script, "# PROVIDE: {name}")?;
-        writeln!(script, "# REQUIRE: LOGIN FILESYSTEMS NETWORKING ")?;
-        writeln!(script, "# KEYWORD: shutdown")?;
-        writeln!(script)?;
-        writeln!(script, ". /etc/rc.subr")?;
-        writeln!(script)?;
-        writeln!(script, "name=\"{name}\"")?;
-        if let Some(ref d) = options.description {
-            writeln!(script, "desc=\"{d}\"")?;
-        }
-        writeln!(script, "rcvar=\"{name}_enable\"")?;
-        writeln!(script)?;
-        writeln!(script, "load_rc_config ${{name}}")?;
-        writeln!(script)?;
-        writeln!(script, ": ${{{name}_options=\"{args}\"}}")?;
-        writeln!(script)?;
-        writeln!(script, "{name}_chdir=\"{work_dir}\"")?;
-        writeln!(script, "pidfile=\"/var/run/${{name}}.pid\"")?;
-        writeln!(script, "procname=\"{target_app}\"")?;
-        writeln!(script, "command=\"/usr/sbin/daemon\"")?;
-        writeln!(
-            script,
-            "command_args=\"-c -S -T ${{name}} -p ${{pidfile}} ${{procname}} ${{{name}_options}}\""
-        )?;
-        writeln!(script)?;
-        writeln!(script, "run_rc_command \"$1\"")?;
-
-        std::result::Result::Ok(script)
-    }
-
-    fn make_open_rc_script(
-        &self,
-        options: &ServiceInstallOptions,
-    ) -> Result<String, std::fmt::Error> {
-        let args = options
-            .args
-            .iter()
-            .map(|a| a.to_string_lossy())
-            .collect::<Vec<_>>()
-            .join(" ");
-        let target_app = options.program.display().to_string();
-        let work_dir = options.work_directory.display().to_string();
-        let mut script = String::new();
-
-        writeln!(script, "#!/sbin/openrc-run")?;
-        writeln!(script)?;
-        if let Some(ref d) = options.description {
-            writeln!(script, "description=\"{d}\"")?;
-        }
-        writeln!(script, "command=\"{target_app}\"")?;
-        writeln!(script, "command_args=\"{args}\"")?;
-        writeln!(script, "pidfile=\"/run/${{RC_SVCNAME}}.pid\"")?;
-        writeln!(script, "command_background=\"yes\"")?;
-        writeln!(script, "directory=\"{work_dir}\"")?;
-        writeln!(script)?;
-        writeln!(script, "depend() {{")?;
-        writeln!(script, "    need net")?;
-        writeln!(script, "    use looger")?;
-        writeln!(script, "}}")?;
-
-        std::result::Result::Ok(script)
-    }
-}
-
 fn print_output<T>(items: &[T], format: &OutputFormat) -> Result<(), Error>
 where
     T: tabled::Tabled + serde::Serialize,
@@ -2225,180 +1958,3 @@ async fn main() -> Result<(), Error> {
 
     Ok(())
 }
-
-#[cfg(target_os = "windows")]
-mod win_service_manager {
-    use std::{ffi::OsStr, ffi::OsString, io, path::PathBuf};
-    use windows_service::{
-        service::{
-            ServiceAccess, ServiceDependency, ServiceErrorControl, ServiceInfo, ServiceStartType,
-            ServiceType,
-        },
-        service_manager::{ServiceManager, ServiceManagerAccess},
-    };
-
-    use service_manager::{
-        ServiceInstallCtx, ServiceLevel, ServiceStartCtx, ServiceStatus, ServiceStatusCtx,
-        ServiceStopCtx, ServiceUninstallCtx,
-    };
-
-    use winreg::{enums::*, RegKey};
-
-    use easytier::common::constants::WIN_SERVICE_WORK_DIR_REG_KEY;
-
-    use serde::{Deserialize, Serialize};
-
-    #[derive(Serialize, Deserialize)]
-    pub struct WinServiceInstallOptions {
-        pub dependencies: Option<Vec<String>>,
-        pub description: Option<String>,
-        pub display_name: Option<String>,
-    }
-
-    pub struct WinServiceManager {
-        service_manager: ServiceManager,
-    }
-
-    impl WinServiceManager {
-        pub fn new() -> Result<Self, crate::Error> {
-            let service_manager =
-                ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::ALL_ACCESS)?;
-            Ok(Self { service_manager })
-        }
-    }
-    impl service_manager::ServiceManager for WinServiceManager {
-        fn available(&self) -> io::Result<bool> {
-            Ok(true)
-        }
-
-        fn install(&self, ctx: ServiceInstallCtx) -> io::Result<()> {
-            let start_type_ = if ctx.autostart {
-                ServiceStartType::AutoStart
-            } else {
-                ServiceStartType::OnDemand
-            };
-            let srv_name = OsString::from(ctx.label.to_qualified_name());
-            let mut dis_name = srv_name.clone();
-            let mut description: Option<OsString> = None;
-            let mut dependencies = Vec::<ServiceDependency>::new();
-
-            if let Some(s) = ctx.contents.as_ref() {
-                let options: WinServiceInstallOptions = serde_json::from_str(s.as_str()).unwrap();
-                if let Some(d) = options.dependencies {
-                    dependencies = d
-                        .iter()
-                        .map(|dep| ServiceDependency::Service(OsString::from(dep.clone())))
-                        .collect::<Vec<_>>();
-                }
-                if let Some(d) = options.description {
-                    description = Some(OsString::from(d));
-                }
-                if let Some(d) = options.display_name {
-                    dis_name = OsString::from(d);
-                }
-            }
-
-            let service_info = ServiceInfo {
-                name: srv_name,
-                display_name: dis_name,
-                service_type: ServiceType::OWN_PROCESS,
-                start_type: start_type_,
-                error_control: ServiceErrorControl::Normal,
-                executable_path: ctx.program,
-                launch_arguments: ctx.args,
-                dependencies: dependencies.clone(),
-                account_name: None,
-                account_password: None,
-            };
-
-            let service = self
-                .service_manager
-                .create_service(&service_info, ServiceAccess::ALL_ACCESS)
-                .map_err(io::Error::other)?;
-
-            if let Some(s) = description {
-                service
-                    .set_description(s.clone())
-                    .map_err(io::Error::other)?;
-            }
-
-            if let Some(work_dir) = ctx.working_directory {
-                set_service_work_directory(&ctx.label.to_qualified_name(), work_dir)?;
-            }
-
-            Ok(())
-        }
-
-        fn uninstall(&self, ctx: ServiceUninstallCtx) -> io::Result<()> {
-            let service = self
-                .service_manager
-                .open_service(ctx.label.to_qualified_name(), ServiceAccess::ALL_ACCESS)
-                .map_err(io::Error::other)?;
-
-            service.delete().map_err(io::Error::other)
-        }
-
-        fn start(&self, ctx: ServiceStartCtx) -> io::Result<()> {
-            let service = self
-                .service_manager
-                .open_service(ctx.label.to_qualified_name(), ServiceAccess::ALL_ACCESS)
-                .map_err(io::Error::other)?;
-
-            service.start(&[] as &[&OsStr]).map_err(io::Error::other)
-        }
-
-        fn stop(&self, ctx: ServiceStopCtx) -> io::Result<()> {
-            let service = self
-                .service_manager
-                .open_service(ctx.label.to_qualified_name(), ServiceAccess::ALL_ACCESS)
-                .map_err(io::Error::other)?;
-
-            _ = service.stop().map_err(io::Error::other)?;
-
-            Ok(())
-        }
-
-        fn level(&self) -> ServiceLevel {
-            ServiceLevel::System
-        }
-
-        fn set_level(&mut self, level: ServiceLevel) -> io::Result<()> {
-            match level {
-                ServiceLevel::System => Ok(()),
-                _ => Err(io::Error::other("Unsupported service level")),
-            }
-        }
-
-        fn status(&self, ctx: ServiceStatusCtx) -> io::Result<ServiceStatus> {
-            let service = match self
-                .service_manager
-                .open_service(ctx.label.to_qualified_name(), ServiceAccess::QUERY_STATUS)
-            {
-                Ok(s) => s,
-                Err(e) => {
-                    if let windows_service::Error::Winapi(ref win_err) = e {
-                        if win_err.raw_os_error() == Some(0x424) {
-                            return Ok(ServiceStatus::NotInstalled);
-                        }
-                    }
-                    return Err(io::Error::other(e));
-                }
-            };
-
-            let status = service.query_status().map_err(io::Error::other)?;
-
-            match status.current_state {
-                windows_service::service::ServiceState::Stopped => Ok(ServiceStatus::Stopped(None)),
-                _ => Ok(ServiceStatus::Running),
-            }
-        }
-    }
-
-    fn set_service_work_directory(service_name: &str, work_directory: PathBuf) -> io::Result<()> {
-        let (reg_key, _) =
-            RegKey::predef(HKEY_LOCAL_MACHINE).create_subkey(WIN_SERVICE_WORK_DIR_REG_KEY)?;
-        reg_key
-            .set_value::<OsString, _>(service_name, &work_directory.as_os_str().to_os_string())?;
-        Ok(())
-    }
-}
diff --git a/easytier/src/easytier-core.rs b/easytier/src/easytier-core.rs
index 4b8114d..656b138 100644
--- a/easytier/src/easytier-core.rs
+++ b/easytier/src/easytier-core.rs
@@ -1,41 +1,4 @@
-#![allow(dead_code)]
-
-#[macro_use]
-extern crate rust_i18n;
-
-use std::{
-    net::{IpAddr, SocketAddr},
-    path::PathBuf,
-    process::ExitCode,
-    sync::{atomic::AtomicBool, Arc},
-};
-
-use anyhow::Context;
-use cidr::IpCidr;
-use clap::{CommandFactory, Parser};
-use clap_complete::Shell;
-use easytier::{
-    common::{
-        config::{
-            get_avaliable_encrypt_methods, load_config_from_file, ConfigFileControl, ConfigLoader,
-            ConsoleLoggerConfig, FileLoggerConfig, LoggingConfigLoader, NetworkIdentity,
-            PeerConfig, PortForwardConfig, TomlConfigLoader, VpnPortalConfig,
-        },
-        constants::EASYTIER_VERSION,
-    },
-    defer,
-    instance_manager::NetworkInstanceManager,
-    launcher::add_proxy_network_to_config,
-    proto::common::CompressionAlgoPb,
-    rpc_service::ApiRpcServer,
-    tunnel::PROTO_PORT_OFFSET,
-    utils::{init_logger, setup_panic_handler},
-    web_client,
-};
-use tokio::io::AsyncReadExt;
-
-#[cfg(target_os = "windows")]
-windows_service::define_windows_service!(ffi_service_main, win_service_main);
+use easytier::core;
 
 #[cfg(all(feature = "mimalloc", not(feature = "jemalloc")))]
 use mimalloc::MiMalloc;
@@ -44,9 +7,6 @@ use mimalloc::MiMalloc;
 #[global_allocator]
 static GLOBAL_MIMALLOC: MiMalloc = MiMalloc;
 
-#[cfg(feature = "jemalloc-prof")]
-use jemalloc_ctl::{epoch, stats, Access as _, AsName as _};
-
 #[cfg(feature = "jemalloc")]
 #[global_allocator]
 static ALLOC: jemallocator::Jemalloc = jemallocator::Jemalloc;
@@ -61,1351 +21,9 @@ pub static malloc_conf: &[u8] = b"prof:true,prof_active:true,lg_prof_sample:19,r
 #[export_name = "malloc_conf"]
 pub static malloc_conf: &[u8] = b"retain:false\0";
 
-fn set_prof_active(_active: bool) {
-    #[cfg(feature = "jemalloc-prof")]
-    {
-        const PROF_ACTIVE: &[u8] = b"prof.active\0";
-        let name = PROF_ACTIVE.name();
-        name.write(_active).expect("Should succeed to set prof");
-    }
-}
-
-fn get_dump_profile_path(cur_allocated: usize, suffix: &str) -> String {
-    format!(
-        "profile-{}-{}.{}",
-        cur_allocated,
-        chrono::Local::now().format("%Y-%m-%d-%H-%M-%S"),
-        suffix
-    )
-}
-
-fn dump_profile(_cur_allocated: usize) {
-    #[cfg(feature = "jemalloc-prof")]
-    {
-        const PROF_DUMP: &[u8] = b"prof.dump\0";
-        static mut PROF_DUMP_FILE_NAME: [u8; 128] = [0; 128];
-        let file_name_str = get_dump_profile_path(_cur_allocated, "out");
-        // copy file name to PROF_DUMP
-        let file_name = file_name_str.as_bytes();
-        let len = file_name.len();
-        if len > 127 {
-            panic!("file name too long");
-        }
-        unsafe {
-            PROF_DUMP_FILE_NAME[..len].copy_from_slice(file_name);
-            // set the last byte to 0
-            PROF_DUMP_FILE_NAME[len] = 0;
-
-            let name = PROF_DUMP.name();
-            name.write(&PROF_DUMP_FILE_NAME[..len + 1])
-                .expect("Should succeed to dump profile");
-            println!("dump profile to: {}", file_name_str);
-        }
-    }
-}
-
-#[derive(Parser, Debug)]
-#[command(name = "easytier-core", author, version = EASYTIER_VERSION , about, long_about = None)]
-struct Cli {
-    #[arg(
-        short = 'w',
-        long,
-        env = "ET_CONFIG_SERVER",
-        help = t!("core_clap.config_server").to_string()
-    )]
-    config_server: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_MACHINE_ID",
-        help = t!("core_clap.machine_id").to_string()
-    )]
-    machine_id: Option<String>,
-
-    #[arg(
-        short,
-        long,
-        env = "ET_CONFIG_FILE",
-        value_delimiter = ',',
-        help = t!("core_clap.config_file").to_string(),
-        num_args = 1..,
-    )]
-    config_file: Option<Vec<PathBuf>>,
-
-    #[arg(
-        long,
-        env = "ET_CONFIG_DIR",
-        help = t!("core_clap.config_dir").to_string()
-    )]
-    config_dir: Option<PathBuf>,
-
-    #[command(flatten)]
-    network_options: NetworkOptions,
-
-    #[command(flatten)]
-    logging_options: LoggingOptions,
-
-    #[command(flatten)]
-    rpc_portal_options: RpcPortalOptions,
-
-    #[clap(long, help = t!("core_clap.generate_completions").to_string())]
-    gen_autocomplete: Option<Shell>,
-
-    #[clap(long, help = t!("core_clap.check_config").to_string())]
-    check_config: bool,
-}
-
-#[derive(Parser, Debug, Default, PartialEq, Eq)]
-struct NetworkOptions {
-    #[arg(
-        long,
-        env = "ET_NETWORK_NAME",
-        help = t!("core_clap.network_name").to_string(),
-    )]
-    network_name: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_NETWORK_SECRET",
-        help = t!("core_clap.network_secret").to_string(),
-    )]
-    network_secret: Option<String>,
-
-    #[arg(
-        short,
-        long,
-        env = "ET_IPV4",
-        help = t!("core_clap.ipv4").to_string()
-    )]
-    ipv4: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_IPV6",
-        help = t!("core_clap.ipv6").to_string()
-    )]
-    ipv6: Option<String>,
-
-    #[arg(
-        short,
-        long,
-        env = "ET_DHCP",
-        help = t!("core_clap.dhcp").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    dhcp: Option<bool>,
-
-    #[arg(
-        short,
-        long,
-        env = "ET_PEERS",
-        value_delimiter = ',',
-        help = t!("core_clap.peers").to_string(),
-        num_args = 0..
-    )]
-    peers: Vec<String>,
-
-    #[arg(
-        short,
-        long,
-        env = "ET_EXTERNAL_NODE",
-        help = t!("core_clap.external_node").to_string()
-    )]
-    external_node: Option<String>,
-
-    #[arg(
-        short = 'n',
-        long,
-        env = "ET_PROXY_NETWORKS",
-        value_delimiter = ',',
-        help = t!("core_clap.proxy_networks").to_string()
-    )]
-    proxy_networks: Vec<String>,
-
-    #[arg(
-        short,
-        long,
-        env = "ET_LISTENERS",
-        value_delimiter = ',',
-        help = t!("core_clap.listeners").to_string(),
-        num_args = 0..
-    )]
-    listeners: Vec<String>,
-
-    #[arg(
-        long,
-        env = "ET_MAPPED_LISTENERS",
-        value_delimiter = ',',
-        help = t!("core_clap.mapped_listeners").to_string(),
-        num_args = 0..
-    )]
-    mapped_listeners: Vec<String>,
-
-    #[arg(
-        long,
-        env = "ET_NO_LISTENER",
-        help = t!("core_clap.no_listener").to_string(),
-        default_value = "false",
-    )]
-    no_listener: bool,
-
-    #[arg(
-        long,
-        env = "ET_HOSTNAME",
-        help = t!("core_clap.hostname").to_string()
-    )]
-    hostname: Option<String>,
-
-    #[arg(
-        short = 'm',
-        long,
-        env = "ET_INSTANCE_NAME",
-        help = t!("core_clap.instance_name").to_string(),
-    )]
-    instance_name: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_VPN_PORTAL",
-        help = t!("core_clap.vpn_portal").to_string()
-    )]
-    vpn_portal: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_DEFAULT_PROTOCOL",
-        help = t!("core_clap.default_protocol").to_string()
-    )]
-    default_protocol: Option<String>,
-
-    #[arg(
-        short = 'u',
-        long,
-        env = "ET_DISABLE_ENCRYPTION",
-        help = t!("core_clap.disable_encryption").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    disable_encryption: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_ENCRYPTION_ALGORITHM",
-        help = t!("core_clap.encryption_algorithm").to_string(),
-        value_parser = get_avaliable_encrypt_methods()
-    )]
-    encryption_algorithm: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_MULTI_THREAD",
-        help = t!("core_clap.multi_thread").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    multi_thread: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_MULTI_THREAD_COUNT",
-        help = t!("core_clap.multi_thread_count").to_string(),
-    )]
-    multi_thread_count: Option<u32>,
-
-    #[arg(
-        long,
-        env = "ET_DISABLE_IPV6",
-        help = t!("core_clap.disable_ipv6").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    disable_ipv6: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_DEV_NAME",
-        help = t!("core_clap.dev_name").to_string()
-    )]
-    dev_name: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_MTU",
-        help = t!("core_clap.mtu").to_string()
-    )]
-    mtu: Option<u16>,
-
-    #[arg(
-        long,
-        env = "ET_LATENCY_FIRST",
-        help = t!("core_clap.latency_first").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    latency_first: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_EXIT_NODES",
-        value_delimiter = ',',
-        help = t!("core_clap.exit_nodes").to_string(),
-        num_args = 0..
-    )]
-    exit_nodes: Vec<IpAddr>,
-
-    #[arg(
-        long,
-        env = "ET_ENABLE_EXIT_NODE",
-        help = t!("core_clap.enable_exit_node").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    enable_exit_node: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_PROXY_FORWARD_BY_SYSTEM",
-        help = t!("core_clap.proxy_forward_by_system").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    proxy_forward_by_system: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_NO_TUN",
-        help = t!("core_clap.no_tun").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    no_tun: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_USE_SMOLTCP",
-        help = t!("core_clap.use_smoltcp").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    use_smoltcp: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_MANUAL_ROUTES",
-        value_delimiter = ',',
-        help = t!("core_clap.manual_routes").to_string(),
-        num_args = 0..
-    )]
-    manual_routes: Option<Vec<String>>,
-
-    // if not in relay_network_whitelist:
-    // for foreign virtual network, will refuse the incoming connection
-    // for local virtual network, will refuse to relay tun packets
-    #[arg(
-        long,
-        env = "ET_RELAY_NETWORK_WHITELIST",
-        value_delimiter = ',',
-        help = t!("core_clap.relay_network_whitelist").to_string(),
-        num_args = 0..
-    )]
-    relay_network_whitelist: Option<Vec<String>>,
-
-    #[arg(
-        long,
-        env = "ET_DISABLE_P2P",
-        help = t!("core_clap.disable_p2p").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    disable_p2p: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_P2P_ONLY",
-        help = t!("core_clap.p2p_only").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    p2p_only: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_DISABLE_UDP_HOLE_PUNCHING",
-        help = t!("core_clap.disable_udp_hole_punching").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    disable_udp_hole_punching: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_DISABLE_SYM_HOLE_PUNCHING",
-        help = t!("core_clap.disable_sym_hole_punching").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    disable_sym_hole_punching: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_RELAY_ALL_PEER_RPC",
-        help = t!("core_clap.relay_all_peer_rpc").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    relay_all_peer_rpc: Option<bool>,
-
-    #[cfg(feature = "socks5")]
-    #[arg(
-        long,
-        env = "ET_SOCKS5",
-        help = t!("core_clap.socks5").to_string()
-    )]
-    socks5: Option<u16>,
-
-    #[arg(
-        long,
-        env = "ET_COMPRESSION",
-        help = t!("core_clap.compression").to_string(),
-    )]
-    compression: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_BIND_DEVICE",
-        help = t!("core_clap.bind_device").to_string()
-    )]
-    bind_device: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_ENABLE_KCP_PROXY",
-        help = t!("core_clap.enable_kcp_proxy").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    enable_kcp_proxy: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_DISABLE_KCP_INPUT",
-        help = t!("core_clap.disable_kcp_input").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    disable_kcp_input: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_ENABLE_QUIC_PROXY",
-        help = t!("core_clap.enable_quic_proxy").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    enable_quic_proxy: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_DISABLE_QUIC_INPUT",
-        help = t!("core_clap.disable_quic_input").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    disable_quic_input: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_QUIC_LISTEN_PORT",
-        help = t!("core_clap.quic_listen_port").to_string(),
-        num_args = 0..=1,
-    )]
-    quic_listen_port: Option<u16>,
-
-    #[arg(
-        long,
-        env = "ET_PORT_FORWARD",
-        value_delimiter = ',',
-        help = t!("core_clap.port_forward").to_string(),
-        num_args = 1..
-    )]
-    port_forward: Vec<url::Url>,
-
-    #[arg(
-        long,
-        env = "ET_ACCEPT_DNS",
-        help = t!("core_clap.accept_dns").to_string(),
-    )]
-    accept_dns: Option<bool>,
-
-    #[arg(
-        long = "tld-dns-zone",
-        env = "ET_TLD_DNS_ZONE",
-        help = t!("core_clap.tld_dns_zone").to_string())]
-    tld_dns_zone: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_PRIVATE_MODE",
-        help = t!("core_clap.private_mode").to_string(),
-    )]
-    private_mode: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_FOREIGN_RELAY_BPS_LIMIT",
-        help = t!("core_clap.foreign_relay_bps_limit").to_string(),
-    )]
-    foreign_relay_bps_limit: Option<u64>,
-
-    #[arg(
-        long,
-        value_delimiter = ',',
-        help = t!("core_clap.tcp_whitelist").to_string(),
-        num_args = 0..
-    )]
-    tcp_whitelist: Vec<String>,
-
-    #[arg(
-        long,
-        value_delimiter = ',',
-        help = t!("core_clap.udp_whitelist").to_string(),
-        num_args = 0..
-    )]
-    udp_whitelist: Vec<String>,
-
-    #[arg(
-        long,
-        env = "ET_DISABLE_RELAY_KCP",
-        help = t!("core_clap.disable_relay_kcp").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    disable_relay_kcp: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_ENABLE_RELAY_FOREIGN_NETWORK_KCP",
-        help = t!("core_clap.enable_relay_foreign_network_kcp").to_string(),
-        num_args = 0..=1,
-        default_missing_value = "true"
-    )]
-    enable_relay_foreign_network_kcp: Option<bool>,
-
-    #[arg(
-        long,
-        env = "ET_STUN_SERVERS",
-        value_delimiter = ',',
-        help = t!("core_clap.stun_servers").to_string(),
-        num_args = 0..
-    )]
-    stun_servers: Option<Vec<String>>,
-
-    #[arg(
-        long,
-        env = "ET_STUN_SERVERS_V6",
-        value_delimiter = ',',
-        help = t!("core_clap.stun_servers_v6").to_string(),
-        num_args = 0..
-    )]
-    stun_servers_v6: Option<Vec<String>>,
-}
-
-#[derive(Parser, Debug)]
-struct LoggingOptions {
-    #[arg(
-        long,
-        env = "ET_CONSOLE_LOG_LEVEL",
-        help = t!("core_clap.console_log_level").to_string()
-    )]
-    console_log_level: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_FILE_LOG_LEVEL",
-        help = t!("core_clap.file_log_level").to_string()
-    )]
-    file_log_level: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_FILE_LOG_DIR",
-        help = t!("core_clap.file_log_dir").to_string()
-    )]
-    file_log_dir: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_FILE_LOG_SIZE",
-        help = t!("core_clap.file_log_size_mb").to_string()
-    )]
-    file_log_size: Option<u64>,
-
-    #[arg(
-        long,
-        env = "ET_FILE_LOG_COUNT",
-        help = t!("core_clap.file_log_count").to_string()
-    )]
-    file_log_count: Option<usize>,
-}
-
-#[derive(Parser, Debug)]
-struct RpcPortalOptions {
-    #[arg(
-        short,
-        long,
-        env = "ET_RPC_PORTAL",
-        help = t!("core_clap.rpc_portal").to_string(),
-    )]
-    rpc_portal: Option<String>,
-
-    #[arg(
-        long,
-        env = "ET_RPC_PORTAL_WHITELIST",
-        value_delimiter = ',',
-        help = t!("core_clap.rpc_portal_whitelist").to_string(),
-    )]
-    rpc_portal_whitelist: Option<Vec<IpCidr>>,
-}
-
 rust_i18n::i18n!("locales", fallback = "en");
 
-impl Cli {
-    fn parse_listeners(no_listener: bool, listeners: Vec<String>) -> anyhow::Result<Vec<String>> {
-        if no_listener || listeners.is_empty() {
-            return Ok(vec![]);
-        }
-
-        let origin_listeners = listeners;
-        let mut listeners: Vec<String> = Vec::new();
-        if origin_listeners.len() == 1 {
-            if let Ok(port) = origin_listeners[0].parse::<u16>() {
-                for (proto, offset) in PROTO_PORT_OFFSET {
-                    listeners.push(format!("{}://0.0.0.0:{}", proto, port + *offset));
-                }
-                return Ok(listeners);
-            }
-        }
-
-        for l in &origin_listeners {
-            let proto_port: Vec<&str> = l.split(':').collect();
-            if proto_port.len() > 2 {
-                if let Ok(url) = l.parse::<url::Url>() {
-                    listeners.push(url.to_string());
-                } else {
-                    panic!("failed to parse listener: {}", l);
-                }
-            } else {
-                let Some((proto, offset)) = PROTO_PORT_OFFSET
-                    .iter()
-                    .find(|(proto, _)| *proto == proto_port[0])
-                else {
-                    return Err(anyhow::anyhow!("unknown protocol: {}", proto_port[0]));
-                };
-
-                let port = if proto_port.len() == 2 {
-                    proto_port[1].parse::<u16>().unwrap()
-                } else {
-                    11010 + offset
-                };
-
-                listeners.push(format!("{}://0.0.0.0:{}", proto, port));
-            }
-        }
-
-        Ok(listeners)
-    }
-}
-
-impl NetworkOptions {
-    fn can_merge(&self, cfg: &TomlConfigLoader, config_file_count: usize) -> bool {
-        if (*self) == NetworkOptions::default() {
-            return false;
-        }
-        if config_file_count == 1 {
-            return true;
-        }
-        let Some(network_name) = &self.network_name else {
-            return false;
-        };
-        if cfg.get_network_identity().network_name == *network_name {
-            return true;
-        }
-        false
-    }
-
-    fn merge_into(&self, cfg: &mut TomlConfigLoader) -> anyhow::Result<()> {
-        if self.hostname.is_some() {
-            cfg.set_hostname(self.hostname.clone());
-        }
-
-        let old_ns = cfg.get_network_identity();
-        let network_name = self.network_name.clone().unwrap_or(old_ns.network_name);
-        let network_secret = self
-            .network_secret
-            .clone()
-            .unwrap_or(old_ns.network_secret.unwrap_or_default());
-        cfg.set_network_identity(NetworkIdentity::new(network_name, network_secret));
-
-        if let Some(dhcp) = self.dhcp {
-            cfg.set_dhcp(dhcp);
-        }
-
-        if let Some(ipv4) = &self.ipv4 {
-            cfg.set_ipv4(Some(ipv4.parse().with_context(|| {
-                format!("failed to parse ipv4 address: {}", ipv4)
-            })?))
-        }
-
-        if let Some(ipv6) = &self.ipv6 {
-            cfg.set_ipv6(Some(ipv6.parse().with_context(|| {
-                format!("failed to parse ipv6 address: {}", ipv6)
-            })?))
-        }
-
-        if !self.peers.is_empty() {
-            let mut peers = cfg.get_peers();
-            peers.reserve(peers.len() + self.peers.len());
-            for p in &self.peers {
-                peers.push(PeerConfig {
-                    uri: p
-                        .parse()
-                        .with_context(|| format!("failed to parse peer uri: {}", p))?,
-                });
-            }
-            cfg.set_peers(peers);
-        }
-
-        if self.no_listener || !self.listeners.is_empty() {
-            cfg.set_listeners(
-                Cli::parse_listeners(self.no_listener, self.listeners.clone())?
-                    .into_iter()
-                    .map(|s| s.parse().unwrap())
-                    .collect(),
-            );
-        } else if cfg.get_listeners().is_none() {
-            cfg.set_listeners(
-                Cli::parse_listeners(false, vec!["11010".to_string()])?
-                    .into_iter()
-                    .map(|s| s.parse().unwrap())
-                    .collect(),
-            );
-        }
-
-        if !self.mapped_listeners.is_empty() {
-            let mut errs = Vec::new();
-            cfg.set_mapped_listeners(Some(
-                self.mapped_listeners
-                    .iter()
-                    .map(|s| {
-                        s.parse()
-                            .with_context(|| format!("mapped listener is not a valid url: {}", s))
-                            .unwrap()
-                    })
-                    .map(|s: url::Url| {
-                        if s.port().is_none() {
-                            errs.push(anyhow::anyhow!("mapped listener port is missing: {}", s));
-                        }
-                        s
-                    })
-                    .collect::<Vec<_>>(),
-            ));
-            if !errs.is_empty() {
-                return Err(anyhow::anyhow!(
-                    "{}",
-                    errs.iter()
-                        .map(|x| format!("{}", x))
-                        .collect::<Vec<_>>()
-                        .join("\n")
-                ));
-            }
-        }
-
-        for n in self.proxy_networks.iter() {
-            add_proxy_network_to_config(n, cfg)?;
-        }
-
-        if let Some(external_nodes) = self.external_node.as_ref() {
-            let mut old_peers = cfg.get_peers();
-            old_peers.push(PeerConfig {
-                uri: external_nodes.parse().with_context(|| {
-                    format!("failed to parse external node uri: {}", external_nodes)
-                })?,
-            });
-            cfg.set_peers(old_peers);
-        }
-
-        if let Some(inst_name) = &self.instance_name {
-            cfg.set_inst_name(inst_name.clone());
-        }
-
-        if let Some(vpn_portal) = self.vpn_portal.as_ref() {
-            let url: url::Url = vpn_portal
-                .parse()
-                .with_context(|| format!("failed to parse vpn portal url: {}", vpn_portal))?;
-            let host = url
-                .host_str()
-                .ok_or_else(|| anyhow::anyhow!("vpn portal url missing host"))?;
-            let port = url
-                .port()
-                .ok_or_else(|| anyhow::anyhow!("vpn portal url missing port"))?;
-            let client_cidr = url.path()[1..].parse().with_context(|| {
-                format!("failed to parse vpn portal client cidr: {}", url.path())
-            })?;
-            let wireguard_listen: SocketAddr = format!("{}:{}", host, port).parse().unwrap();
-            cfg.set_vpn_portal_config(VpnPortalConfig {
-                wireguard_listen,
-                client_cidr,
-            });
-        }
-
-        if let Some(manual_routes) = self.manual_routes.as_ref() {
-            let mut routes = Vec::<cidr::Ipv4Cidr>::with_capacity(manual_routes.len());
-            for r in manual_routes {
-                routes.push(
-                    r.parse()
-                        .with_context(|| format!("failed to parse route: {}", r))?,
-                );
-            }
-            cfg.set_routes(Some(routes));
-        }
-
-        #[cfg(feature = "socks5")]
-        if let Some(socks5_proxy) = self.socks5 {
-            cfg.set_socks5_portal(Some(
-                format!("socks5://0.0.0.0:{}", socks5_proxy)
-                    .parse()
-                    .unwrap(),
-            ));
-        }
-
-        #[cfg(feature = "socks5")]
-        for port_forward in self.port_forward.iter() {
-            let example_str = ", example: udp://0.0.0.0:12345/10.126.126.1:12345";
-
-            let bind_addr = format!(
-                "{}:{}",
-                port_forward.host_str().expect("local bind host is missing"),
-                port_forward.port().expect("local bind port is missing")
-            )
-            .parse()
-            .unwrap_or_else(|_| panic!("failed to parse local bind addr {}", example_str));
-
-            let dst_addr = port_forward
-                .path_segments()
-                .unwrap_or_else(|| panic!("remote destination addr is missing {}", example_str))
-                .next()
-                .unwrap_or_else(|| panic!("remote destination addr is missing {}", example_str))
-                .to_string()
-                .parse()
-                .unwrap_or_else(|_| {
-                    panic!("failed to parse remote destination addr {}", example_str)
-                });
-
-            let port_forward_item = PortForwardConfig {
-                bind_addr,
-                dst_addr,
-                proto: port_forward.scheme().to_string(),
-            };
-
-            let mut old = cfg.get_port_forwards();
-            old.push(port_forward_item);
-            cfg.set_port_forwards(old);
-        }
-
-        let mut f = cfg.get_flags();
-        if let Some(default_protocol) = &self.default_protocol {
-            f.default_protocol = default_protocol.clone()
-        };
-        if let Some(v) = self.disable_encryption {
-            f.enable_encryption = !v;
-        }
-        if let Some(algorithm) = &self.encryption_algorithm {
-            f.encryption_algorithm = algorithm.clone();
-        }
-        if let Some(v) = self.disable_ipv6 {
-            f.enable_ipv6 = !v;
-        }
-        f.latency_first = self.latency_first.unwrap_or(f.latency_first);
-        if let Some(dev_name) = &self.dev_name {
-            f.dev_name = dev_name.clone()
-        }
-        if let Some(mtu) = self.mtu {
-            f.mtu = mtu as u32;
-        }
-        f.enable_exit_node = self.enable_exit_node.unwrap_or(f.enable_exit_node);
-        f.proxy_forward_by_system = self
-            .proxy_forward_by_system
-            .unwrap_or(f.proxy_forward_by_system);
-        f.no_tun = self.no_tun.unwrap_or(f.no_tun) || cfg!(not(feature = "tun"));
-        f.use_smoltcp = self.use_smoltcp.unwrap_or(f.use_smoltcp);
-        if let Some(wl) = self.relay_network_whitelist.as_ref() {
-            f.relay_network_whitelist = wl.join(" ");
-        }
-        f.disable_p2p = self.disable_p2p.unwrap_or(f.disable_p2p);
-        f.p2p_only = self.p2p_only.unwrap_or(f.p2p_only);
-        f.disable_udp_hole_punching = self
-            .disable_udp_hole_punching
-            .unwrap_or(f.disable_udp_hole_punching);
-        f.relay_all_peer_rpc = self.relay_all_peer_rpc.unwrap_or(f.relay_all_peer_rpc);
-        f.multi_thread = self.multi_thread.unwrap_or(f.multi_thread);
-        if let Some(compression) = &self.compression {
-            f.data_compress_algo = match compression.as_str() {
-                "none" => CompressionAlgoPb::None,
-                "zstd" => CompressionAlgoPb::Zstd,
-                _ => panic!(
-                    "unknown compression algorithm: {}, supported: none, zstd",
-                    compression
-                ),
-            }
-            .into();
-        }
-        f.bind_device = self.bind_device.unwrap_or(f.bind_device);
-        f.enable_kcp_proxy = self.enable_kcp_proxy.unwrap_or(f.enable_kcp_proxy);
-        f.disable_kcp_input = self.disable_kcp_input.unwrap_or(f.disable_kcp_input);
-        f.enable_quic_proxy = self.enable_quic_proxy.unwrap_or(f.enable_quic_proxy);
-        f.disable_quic_input = self.disable_quic_input.unwrap_or(f.disable_quic_input);
-        if let Some(quic_listen_port) = self.quic_listen_port {
-            f.quic_listen_port = quic_listen_port as u32;
-        }
-        f.accept_dns = self.accept_dns.unwrap_or(f.accept_dns);
-        f.private_mode = self.private_mode.unwrap_or(f.private_mode);
-        f.foreign_relay_bps_limit = self
-            .foreign_relay_bps_limit
-            .unwrap_or(f.foreign_relay_bps_limit);
-        f.multi_thread_count = self.multi_thread_count.unwrap_or(f.multi_thread_count);
-        f.disable_relay_kcp = self.disable_relay_kcp.unwrap_or(f.disable_relay_kcp);
-        f.enable_relay_foreign_network_kcp = self
-            .enable_relay_foreign_network_kcp
-            .unwrap_or(f.enable_relay_foreign_network_kcp);
-        f.disable_sym_hole_punching = self.disable_sym_hole_punching.unwrap_or(false);
-        // Configure tld_dns_zone: use provided value if set
-        if let Some(tld_dns_zone) = &self.tld_dns_zone {
-            f.tld_dns_zone = tld_dns_zone.clone();
-        }
-        cfg.set_flags(f);
-
-        if !self.exit_nodes.is_empty() {
-            cfg.set_exit_nodes(self.exit_nodes.clone());
-        }
-
-        let mut old_tcp_whitelist = cfg.get_tcp_whitelist();
-        old_tcp_whitelist.extend(self.tcp_whitelist.clone());
-        cfg.set_tcp_whitelist(old_tcp_whitelist);
-
-        let mut old_udp_whitelist = cfg.get_udp_whitelist();
-        old_udp_whitelist.extend(self.udp_whitelist.clone());
-        cfg.set_udp_whitelist(old_udp_whitelist);
-
-        if let Some(stun_servers) = &self.stun_servers {
-            let mut old_stun_servers = cfg.get_stun_servers().unwrap_or_default();
-            old_stun_servers.extend(stun_servers.iter().cloned());
-            cfg.set_stun_servers(Some(old_stun_servers));
-        }
-
-        if let Some(stun_servers_v6) = &self.stun_servers_v6 {
-            let mut old_stun_servers_v6 = cfg.get_stun_servers_v6().unwrap_or_default();
-            old_stun_servers_v6.extend(stun_servers_v6.iter().cloned());
-            cfg.set_stun_servers_v6(Some(old_stun_servers_v6));
-        }
-        Ok(())
-    }
-}
-
-impl LoggingConfigLoader for &LoggingOptions {
-    fn get_console_logger_config(&self) -> ConsoleLoggerConfig {
-        ConsoleLoggerConfig {
-            level: self.console_log_level.clone(),
-        }
-    }
-
-    fn get_file_logger_config(&self) -> FileLoggerConfig {
-        FileLoggerConfig {
-            level: self.file_log_level.clone(),
-            dir: self.file_log_dir.clone(),
-            file: None,
-            size_mb: self.file_log_size,
-            count: self.file_log_count,
-        }
-    }
-}
-
-#[cfg(target_os = "windows")]
-fn win_service_set_work_dir(service_name: &std::ffi::OsString) -> anyhow::Result<()> {
-    use easytier::common::constants::WIN_SERVICE_WORK_DIR_REG_KEY;
-    use winreg::enums::*;
-    use winreg::RegKey;
-
-    let hklm = RegKey::predef(HKEY_LOCAL_MACHINE);
-    let key = hklm.open_subkey_with_flags(WIN_SERVICE_WORK_DIR_REG_KEY, KEY_READ)?;
-    let dir_pat_str = key.get_value::<std::ffi::OsString, _>(service_name)?;
-    let dir_path = std::fs::canonicalize(dir_pat_str)?;
-
-    std::env::set_current_dir(dir_path)?;
-
-    Ok(())
-}
-
-#[cfg(target_os = "windows")]
-fn win_service_event_loop(
-    stop_notify: std::sync::Arc<tokio::sync::Notify>,
-    cli: Cli,
-    status_handle: windows_service::service_control_handler::ServiceStatusHandle,
-) {
-    use std::time::Duration;
-    use tokio::runtime::Runtime;
-    use windows_service::service::*;
-
-    let normal_status = ServiceStatus {
-        service_type: ServiceType::OWN_PROCESS,
-        current_state: ServiceState::Running,
-        controls_accepted: ServiceControlAccept::STOP,
-        exit_code: ServiceExitCode::Win32(0),
-        checkpoint: 0,
-        wait_hint: Duration::default(),
-        process_id: None,
-    };
-    let error_status = ServiceStatus {
-        service_type: ServiceType::OWN_PROCESS,
-        current_state: ServiceState::Stopped,
-        controls_accepted: ServiceControlAccept::empty(),
-        exit_code: ServiceExitCode::ServiceSpecific(1u32),
-        checkpoint: 0,
-        wait_hint: Duration::default(),
-        process_id: None,
-    };
-
-    std::thread::spawn(move || {
-        let rt = Runtime::new().unwrap();
-        rt.block_on(async move {
-            tokio::select! {
-                res = run_main(cli) => {
-                    match res {
-                        Ok(_) => {
-                            status_handle.set_service_status(normal_status).unwrap();
-                            std::process::exit(0);
-                        }
-                        Err(e) => {
-                            status_handle.set_service_status(error_status).unwrap();
-                            eprintln!("error: {}", e);
-                        }
-                    }
-                },
-                _ = stop_notify.notified() => {
-                    _ = status_handle.set_service_status(normal_status);
-                    std::process::exit(0);
-                }
-            }
-        });
-    });
-}
-
-fn parse_cli() -> Cli {
-    let mut cli = Cli::parse();
-    // for --stun-servers="", we want vec![], but clap will give vec![""], hack for that
-    if let Some(stun_servers) = &mut cli.network_options.stun_servers {
-        stun_servers.retain(|s| !s.trim().is_empty());
-    }
-    if let Some(stun_servers_v6) = &mut cli.network_options.stun_servers_v6 {
-        stun_servers_v6.retain(|s| !s.trim().is_empty());
-    }
-    cli
-}
-
-#[cfg(target_os = "windows")]
-fn win_service_main(arg: Vec<std::ffi::OsString>) {
-    use std::sync::Arc;
-    use std::time::Duration;
-    use tokio::sync::Notify;
-    use windows_service::service::*;
-    use windows_service::service_control_handler::*;
-
-    _ = win_service_set_work_dir(&arg[0]);
-
-    let cli = parse_cli();
-
-    let stop_notify_send = Arc::new(Notify::new());
-    let stop_notify_recv = Arc::clone(&stop_notify_send);
-    let event_handler = move |control_event| -> ServiceControlHandlerResult {
-        match control_event {
-            ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
-            ServiceControl::Stop => {
-                stop_notify_send.notify_one();
-                ServiceControlHandlerResult::NoError
-            }
-            _ => ServiceControlHandlerResult::NotImplemented,
-        }
-    };
-    let status_handle = register(String::new(), event_handler).expect("register service fail");
-    let next_status = ServiceStatus {
-        service_type: ServiceType::OWN_PROCESS,
-        current_state: ServiceState::Running,
-        controls_accepted: ServiceControlAccept::STOP,
-        exit_code: ServiceExitCode::Win32(0),
-        checkpoint: 0,
-        wait_hint: Duration::default(),
-        process_id: None,
-    };
-    status_handle
-        .set_service_status(next_status)
-        .expect("set service status fail");
-
-    win_service_event_loop(stop_notify_recv, cli, status_handle);
-}
-
-async fn run_main(cli: Cli) -> anyhow::Result<()> {
-    defer!(dump_profile(0););
-    init_logger(&cli.logging_options, true)?;
-
-    let manager = Arc::new(NetworkInstanceManager::new().with_config_path(cli.config_dir.clone()));
-
-    let _rpc_server = ApiRpcServer::new(
-        cli.rpc_portal_options.rpc_portal,
-        cli.rpc_portal_options.rpc_portal_whitelist,
-        manager.clone(),
-    )?
-    .serve()
-    .await?;
-
-    let _web_client = if let Some(config_server_url_s) = cli.config_server.as_ref() {
-        let wc = web_client::run_web_client(
-            config_server_url_s,
-            cli.machine_id.clone(),
-            cli.network_options.hostname.clone(),
-            manager.clone(),
-        )
-        .await
-        .inspect(|_| {
-            println!(
-                "Web client started successfully...\nserver: {}",
-                config_server_url_s,
-            );
-
-            println!("Official config website: https://easytier.cn/web");
-        })?;
-
-        Some(wc)
-    } else {
-        None
-    };
-
-    let mut config_files = if let Some(v) = cli.config_file {
-        v.clone()
-    } else {
-        vec![]
-    };
-    if let Some(config_dir) = cli.config_dir.as_ref() {
-        if !config_dir.is_dir() {
-            anyhow::bail!("config_dir {} is not a directory", config_dir.display());
-        }
-
-        for entry in std::fs::read_dir(config_dir)? {
-            let entry = entry?;
-            let path = entry.path();
-            if !path.is_file() {
-                continue;
-            }
-            let Some(ext) = path.extension() else {
-                continue;
-            };
-            if ext != "toml" {
-                continue;
-            }
-            config_files.push(path);
-        }
-    }
-    let config_file_count = config_files.len();
-    let mut crate_cli_network = (config_file_count == 0 && cli.config_server.is_none())
-        || cli.network_options.network_name.is_some();
-    for config_file in config_files {
-        let (mut cfg, mut control) =
-            load_config_from_file(&config_file, cli.config_dir.as_ref()).await?;
-
-        if cli.network_options.can_merge(&cfg, config_file_count) {
-            cli.network_options
-                .merge_into(&mut cfg)
-                .with_context(|| format!("failed to merge config from cli: {:?}", config_file))?;
-            crate_cli_network = false;
-            control.set_read_only(true);
-            control.set_no_delete(true);
-        }
-
-        println!(
-            "Starting easytier from config file {:?}({:?}) with config:",
-            config_file, control.permission
-        );
-        println!("############### TOML ###############\n");
-        println!("{}", cfg.dump());
-        println!("-----------------------------------");
-        manager.run_network_instance(cfg, true, control)?;
-    }
-
-    if crate_cli_network {
-        let mut cfg = TomlConfigLoader::default();
-        cli.network_options
-            .merge_into(&mut cfg)
-            .with_context(|| "failed to create config from cli".to_string())?;
-        println!("Starting easytier from cli with config:");
-        println!("############### TOML ###############\n");
-        println!("{}", cfg.dump());
-        println!("-----------------------------------");
-        manager.run_network_instance(cfg, true, ConfigFileControl::STATIC_CONFIG)?;
-    }
-
-    tokio::select! {
-        _ = manager.wait() => {
-            let infos = manager.collect_network_infos().await?;
-            let errs = infos
-                .into_values()
-                .filter_map(|info| info.error_msg)
-                .collect::<Vec<_>>();
-            if !errs.is_empty() {
-                return Err(anyhow::anyhow!("some instances stopped with errors"));
-            }
-        }
-        _ = tokio::signal::ctrl_c() => {
-            println!("ctrl-c received, exiting...");
-        }
-    }
-    Ok(())
-}
-
-fn memory_monitor(_force_dump: Arc<AtomicBool>) {
-    #[cfg(feature = "jemalloc-prof")]
-    {
-        let mut last_peak_size = 0;
-        let e = epoch::mib().unwrap();
-        let allocated_stats = stats::allocated::mib().unwrap();
-
-        loop {
-            e.advance().unwrap();
-            let new_heap_size = allocated_stats.read().unwrap();
-
-            println!(
-                "heap size: {} bytes, time: {}",
-                new_heap_size,
-                chrono::Local::now().format("%Y-%m-%d %H:%M:%S")
-            );
-
-            // dump every 75MB
-            if (last_peak_size > 0
-                && new_heap_size > last_peak_size
-                && new_heap_size - last_peak_size > 10 * 1024 * 1024)
-                || _force_dump.load(std::sync::atomic::Ordering::Relaxed)
-            {
-                println!(
-                    "heap size increased: {} bytes, time: {}",
-                    new_heap_size - last_peak_size,
-                    chrono::Local::now().format("%Y-%m-%d %H:%M:%S")
-                );
-                dump_profile(new_heap_size);
-                last_peak_size = new_heap_size;
-                if _force_dump.load(std::sync::atomic::Ordering::Relaxed) {
-                    // also dump whole jemalloc stats
-                    use jemalloc_ctl::stats_print::stats_print;
-                    let tmp_file = get_dump_profile_path(new_heap_size, "stats");
-                    let mut file = std::fs::File::create(tmp_file).unwrap();
-                    let _ = stats_print(&mut file, Default::default());
-                    _force_dump.store(false, std::sync::atomic::Ordering::Relaxed);
-                }
-            }
-
-            if last_peak_size == 0 {
-                last_peak_size = new_heap_size;
-            }
-
-            std::thread::sleep(std::time::Duration::from_secs(5));
-        }
-    }
-}
-
 #[tokio::main(flavor = "current_thread")]
-async fn main() -> ExitCode {
-    let locale = sys_locale::get_locale().unwrap_or_else(|| String::from("en-US"));
-    rust_i18n::set_locale(&locale);
-    setup_panic_handler();
-
-    #[cfg(target_os = "windows")]
-    match windows_service::service_dispatcher::start(String::new(), ffi_service_main) {
-        Ok(_) => std::thread::park(),
-        Err(e) => {
-            let should_panic = if let windows_service::Error::Winapi(ref io_error) = e {
-                io_error.raw_os_error() != Some(0x427) // ERROR_FAILED_SERVICE_CONTROLLER_CONNECT
-            } else {
-                true
-            };
-
-            if should_panic {
-                panic!("SCM start an error: {}", e);
-            }
-        }
-    };
-
-    set_prof_active(true);
-    // register a signal handler to set force dump when signal usr1 is received
-    let force_dump = Arc::new(AtomicBool::new(false));
-    #[cfg(all(feature = "jemalloc-prof", not(target_os = "windows")))]
-    {
-        let force_dump_clone = force_dump.clone();
-        let mut sigusr1 =
-            tokio::signal::unix::signal(tokio::signal::unix::SignalKind::user_defined1()).unwrap();
-        tokio::task::spawn(async move {
-            while sigusr1.recv().await.is_some() {
-                force_dump_clone.store(true, std::sync::atomic::Ordering::Relaxed);
-            }
-        });
-    }
-    let _monitor = std::thread::spawn(move || memory_monitor(force_dump));
-
-    let cli = parse_cli();
-
-    if let Some(shell) = cli.gen_autocomplete {
-        let mut cmd = Cli::command();
-        easytier::print_completions(shell, &mut cmd, "easytier-core");
-        return ExitCode::SUCCESS;
-    }
-
-    // Verify configurations
-    if cli.check_config {
-        if let Err(e) = validate_config(&cli).await {
-            eprintln!("Config validation failed: {:?}", e);
-            return ExitCode::FAILURE;
-        } else {
-            return ExitCode::SUCCESS;
-        }
-    }
-
-    let mut ret_code = 0;
-
-    if let Err(e) = run_main(cli).await {
-        eprintln!("error: {:?}", e);
-        ret_code = 1;
-    }
-
-    println!("Stopping easytier...");
-    set_prof_active(false);
-
-    ExitCode::from(ret_code)
-}
-
-async fn validate_config(cli: &Cli) -> anyhow::Result<()> {
-    // Check if a config file is provided
-    let config_files = cli
-        .config_file
-        .as_ref()
-        .ok_or_else(|| anyhow::anyhow!("--config-file is required when using --check-config"))?;
-
-    for config_file in config_files {
-        if config_file == &PathBuf::from("-") {
-            let mut stdin = String::new();
-            _ = tokio::io::stdin().read_to_string(&mut stdin).await?;
-            TomlConfigLoader::new_from_str(stdin.as_str())
-                .with_context(|| "config source: stdin")?;
-        } else {
-            TomlConfigLoader::new(config_file)
-                .with_context(|| format!("config source: {:?}", config_file))?;
-        };
-    }
-
-    Ok(())
+async fn main() -> std::process::ExitCode {
+    core::main().await
 }
diff --git a/easytier/src/instance_manager.rs b/easytier/src/instance_manager.rs
index 1e3976e..059fecb 100644
--- a/easytier/src/instance_manager.rs
+++ b/easytier/src/instance_manager.rs
@@ -13,11 +13,11 @@ use crate::{
     rpc_service::InstanceRpcService,
 };
 
-pub(crate) struct WebClientGuard {
+pub(crate) struct DaemonGuard {
     guard: Option<Arc<()>>,
     stop_check_notifier: Arc<tokio::sync::Notify>,
 }
-impl Drop for WebClientGuard {
+impl Drop for DaemonGuard {
     fn drop(&mut self) {
         drop(self.guard.take());
         self.stop_check_notifier.notify_one();
@@ -30,7 +30,7 @@ pub struct NetworkInstanceManager {
     stop_check_notifier: Arc<tokio::sync::Notify>,
     instance_error_messages: Arc<DashMap<uuid::Uuid, String>>,
     config_dir: Option<PathBuf>,
-    web_client_counter: Arc<()>,
+    guard_counter: Arc<()>,
 }
 
 impl Default for NetworkInstanceManager {
@@ -47,7 +47,7 @@ impl NetworkInstanceManager {
             stop_check_notifier: Arc::new(tokio::sync::Notify::new()),
             instance_error_messages: Arc::new(DashMap::new()),
             config_dir: None,
-            web_client_counter: Arc::new(()),
+            guard_counter: Arc::new(()),
         }
     }
 
@@ -233,9 +233,9 @@ impl NetworkInstanceManager {
         self.config_dir.as_ref()
     }
 
-    pub(crate) fn register_web_client(&self) -> WebClientGuard {
-        WebClientGuard {
-            guard: Some(self.web_client_counter.clone()),
+    pub(crate) fn register_daemon(&self) -> DaemonGuard {
+        DaemonGuard {
+            guard: Some(self.guard_counter.clone()),
             stop_check_notifier: self.stop_check_notifier.clone(),
         }
     }
@@ -250,9 +250,9 @@ impl NetworkInstanceManager {
                 .instance_map
                 .iter()
                 .any(|item| item.value().is_easytier_running());
-            let web_client_running = Arc::strong_count(&self.web_client_counter) > 1;
+            let daemon_running = Arc::strong_count(&self.guard_counter) > 1;
 
-            if !local_instance_running && !web_client_running {
+            if !local_instance_running && !daemon_running {
                 break;
             }
 
diff --git a/easytier/src/lib.rs b/easytier/src/lib.rs
index 7d8d8e7..882f6c9 100644
--- a/easytier/src/lib.rs
+++ b/easytier/src/lib.rs
@@ -13,11 +13,13 @@ mod vpn_portal;
 
 pub mod common;
 pub mod connector;
+pub mod core;
 pub mod instance_manager;
 pub mod launcher;
 pub mod peers;
 pub mod proto;
 pub mod rpc_service;
+pub mod service_manager;
 pub mod tunnel;
 pub mod utils;
 pub mod web_client;
diff --git a/easytier/src/proto/rpc_impl/standalone.rs b/easytier/src/proto/rpc_impl/standalone.rs
index 32200ab..a392f55 100644
--- a/easytier/src/proto/rpc_impl/standalone.rs
+++ b/easytier/src/proto/rpc_impl/standalone.rs
@@ -39,6 +39,7 @@ pub struct StandAloneServer<L> {
     inflight_server: Arc<AtomicU32>,
     tasks: JoinSet<()>,
     hook: Option<Arc<dyn RpcServerHook>>,
+    rx_timeout: Option<Duration>,
 }
 
 impl<L: TunnelListener + 'static> StandAloneServer<L> {
@@ -50,9 +51,14 @@ impl<L: TunnelListener + 'static> StandAloneServer<L> {
             tasks: JoinSet::new(),
 
             hook: None,
+            rx_timeout: Some(Duration::from_secs(60)),
         }
     }
 
+    pub fn set_rx_timeout(&mut self, timeout: Option<Duration>) {
+        self.rx_timeout = timeout;
+    }
+
     pub fn set_hook(&mut self, hook: Arc<dyn RpcServerHook>) {
         self.hook = Some(hook);
     }
@@ -66,6 +72,7 @@ impl<L: TunnelListener + 'static> StandAloneServer<L> {
         inflight: Arc<AtomicU32>,
         registry: Arc<ServiceRegistry>,
         hook: Arc<dyn RpcServerHook>,
+        rx_timeout: Option<Duration>,
     ) -> Result<(), Error> {
         let tasks = Arc::new(Mutex::new(JoinSet::new()));
         join_joinset_background(tasks.clone(), "standalone serve_loop".to_string());
@@ -87,8 +94,7 @@ impl<L: TunnelListener + 'static> StandAloneServer<L> {
 
             inflight_server.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
             tasks.lock().unwrap().spawn(async move {
-                let server =
-                    BidirectRpcManager::new().set_rx_timeout(Some(Duration::from_secs(60)));
+                let server = BidirectRpcManager::new().set_rx_timeout(rx_timeout);
                 server.rpc_server().registry().replace_registry(&registry);
                 server.run_with_tunnel(tunnel);
                 server.wait().await;
@@ -101,6 +107,7 @@ impl<L: TunnelListener + 'static> StandAloneServer<L> {
     pub async fn serve(&mut self) -> Result<(), Error> {
         let mut listener = self.listener.take().unwrap();
         let hook = self.hook.take().unwrap_or_else(|| Arc::new(DefaultHook));
+        let rx_timeout = self.rx_timeout;
 
         listener
             .listen()
@@ -118,6 +125,7 @@ impl<L: TunnelListener + 'static> StandAloneServer<L> {
                     inflight_server.clone(),
                     registry.clone(),
                     hook.clone(),
+                    rx_timeout,
                 )
                 .await;
                 if let Err(e) = ret {
diff --git a/easytier/src/rpc_service/api.rs b/easytier/src/rpc_service/api.rs
index 84d9041..f49ce92 100644
--- a/easytier/src/rpc_service/api.rs
+++ b/easytier/src/rpc_service/api.rs
@@ -70,6 +70,11 @@ impl<T: TunnelListener + 'static> ApiRpcServer<T> {
         self.rpc_server.serve().await?;
         Ok(self)
     }
+
+    pub fn with_rx_timeout(mut self, timeout: Option<std::time::Duration>) -> Self {
+        self.rpc_server.set_rx_timeout(timeout);
+        self
+    }
 }
 
 impl<T: TunnelListener + 'static> Drop for ApiRpcServer<T> {
diff --git a/easytier/src/rpc_service/logger.rs b/easytier/src/rpc_service/logger.rs
index d718863..197abc9 100644
--- a/easytier/src/rpc_service/logger.rs
+++ b/easytier/src/rpc_service/logger.rs
@@ -26,7 +26,7 @@ impl LoggerRpcService {
         }
     }
 
-    fn string_to_log_level(level_str: &str) -> LogLevel {
+    pub fn string_to_log_level(level_str: &str) -> LogLevel {
         match level_str.to_lowercase().as_str() {
             "off" | "disabled" => LogLevel::Disabled,
             "error" => LogLevel::Error,
diff --git a/easytier/src/service_manager/mod.rs b/easytier/src/service_manager/mod.rs
new file mode 100644
index 0000000..6f35f5f
--- /dev/null
+++ b/easytier/src/service_manager/mod.rs
@@ -0,0 +1,541 @@
+use std::ffi::OsString;
+use std::fmt::Write;
+use std::path::PathBuf;
+
+use service_manager::ServiceManager as _;
+
+#[derive(Debug)]
+pub struct ServiceInstallOptions {
+    pub program: PathBuf,
+    pub args: Vec<OsString>,
+    pub work_directory: PathBuf,
+    pub disable_autostart: bool,
+    pub description: Option<String>,
+    pub display_name: Option<String>,
+    pub disable_restart_on_failure: bool,
+}
+
+pub type ServiceStatus = service_manager::ServiceStatus;
+
+trait ServiceManager: service_manager::ServiceManager {
+    fn update(&self, ctx: service_manager::ServiceInstallCtx) -> std::io::Result<()>;
+}
+impl ServiceManager for service_manager::TypedServiceManager {
+    fn update(&self, ctx: service_manager::ServiceInstallCtx) -> std::io::Result<()> {
+        let status = self.status(service_manager::ServiceStatusCtx {
+            label: ctx.label.clone(),
+        })?;
+        if status == ServiceStatus::Running {
+            self.stop(service_manager::ServiceStopCtx {
+                label: ctx.label.clone(),
+            })?;
+        }
+        if status != ServiceStatus::NotInstalled {
+            self.uninstall(service_manager::ServiceUninstallCtx {
+                label: ctx.label.clone(),
+            })?;
+        }
+        self.install(ctx)
+    }
+}
+
+pub struct Service {
+    label: service_manager::ServiceLabel,
+    kind: service_manager::ServiceManagerKind,
+    service_manager: Box<dyn ServiceManager>,
+}
+
+impl Service {
+    pub fn new(name: String) -> Result<Self, anyhow::Error> {
+        #[cfg(target_os = "windows")]
+        let service_manager = Box::new(self::win_service_manager::WinServiceManager::new()?);
+        #[cfg(target_os = "macos")]
+        let service_manager: Box<dyn ServiceManager> =
+            Box::new(service_manager::TypedServiceManager::Launchd(
+                service_manager::LaunchdServiceManager::system().with_config(
+                    service_manager::LaunchdConfig {
+                        install: service_manager::LaunchdInstallConfig {
+                            keep_alive: service_manager::KeepAlive::conditions()
+                                .crashed(true)
+                                .successful_exit(false),
+                        },
+                    },
+                ),
+            ));
+
+        #[cfg(not(any(target_os = "windows", target_os = "macos")))]
+        let service_manager: Box<dyn ServiceManager> =
+            Box::new(service_manager::TypedServiceManager::native()?);
+
+        let kind = service_manager::ServiceManagerKind::native()?;
+
+        println!("service manager kind: {:?}", kind);
+
+        Ok(Self {
+            label: name.parse()?,
+            kind,
+            service_manager,
+        })
+    }
+
+    pub fn install(&self, options: &ServiceInstallOptions) -> Result<(), anyhow::Error> {
+        let ctx = service_manager::ServiceInstallCtx {
+            label: self.label.clone(),
+            program: options.program.clone(),
+            args: options.args.clone(),
+            contents: self.make_install_content_option(options),
+            autostart: !options.disable_autostart,
+            username: None,
+            working_directory: Some(options.work_directory.clone()),
+            environment: None,
+            disable_restart_on_failure: options.disable_restart_on_failure,
+        };
+
+        if self.status()? != service_manager::ServiceStatus::NotInstalled {
+            self.service_manager
+                .update(ctx)
+                .map_err(|e| anyhow::anyhow!("failed to update service: {:?}", e))?;
+            println!("Service updated successfully! Service Name: {}", self.label);
+            return Ok(());
+        }
+
+        self.service_manager
+            .install(ctx.clone())
+            .map_err(|e| anyhow::anyhow!("failed to install service: {:?}", e))?;
+
+        println!(
+            "Service installed successfully! Service Name: {}",
+            self.label
+        );
+
+        Ok(())
+    }
+
+    pub fn uninstall(&self) -> Result<(), anyhow::Error> {
+        let ctx = service_manager::ServiceUninstallCtx {
+            label: self.label.clone(),
+        };
+        let status = self.status()?;
+
+        if status == service_manager::ServiceStatus::NotInstalled {
+            return Err(anyhow::anyhow!("Service is not installed"))?;
+        }
+
+        if status == service_manager::ServiceStatus::Running {
+            self.service_manager.stop(service_manager::ServiceStopCtx {
+                label: self.label.clone(),
+            })?;
+        }
+
+        self.service_manager
+            .uninstall(ctx)
+            .map_err(|e| anyhow::anyhow!("failed to uninstall service: {}", e))
+    }
+
+    pub fn status(&self) -> Result<service_manager::ServiceStatus, anyhow::Error> {
+        let ctx = service_manager::ServiceStatusCtx {
+            label: self.label.clone(),
+        };
+        let status = self.service_manager.status(ctx)?;
+
+        Ok(status)
+    }
+
+    pub fn start(&self) -> Result<(), anyhow::Error> {
+        let ctx = service_manager::ServiceStartCtx {
+            label: self.label.clone(),
+        };
+        let status = self.status()?;
+
+        match status {
+            service_manager::ServiceStatus::Running => {
+                Err(anyhow::anyhow!("Service is already running"))?
+            }
+            service_manager::ServiceStatus::Stopped(_) => {
+                self.service_manager
+                    .start(ctx)
+                    .map_err(|e| anyhow::anyhow!("failed to start service: {}", e))?;
+                Ok(())
+            }
+            service_manager::ServiceStatus::NotInstalled => {
+                Err(anyhow::anyhow!("Service is not installed"))?
+            }
+        }
+    }
+
+    pub fn stop(&self) -> Result<(), anyhow::Error> {
+        let ctx = service_manager::ServiceStopCtx {
+            label: self.label.clone(),
+        };
+        let status = self.status()?;
+
+        match status {
+            service_manager::ServiceStatus::Running => {
+                self.service_manager
+                    .stop(ctx)
+                    .map_err(|e| anyhow::anyhow!("failed to stop service: {}", e))?;
+                Ok(())
+            }
+            service_manager::ServiceStatus::Stopped(_) => {
+                Err(anyhow::anyhow!("Service is already stopped"))?
+            }
+            service_manager::ServiceStatus::NotInstalled => {
+                Err(anyhow::anyhow!("Service is not installed"))?
+            }
+        }
+    }
+
+    fn make_install_content_option(&self, options: &ServiceInstallOptions) -> Option<String> {
+        match self.kind {
+            service_manager::ServiceManagerKind::Systemd => {
+                Some(self.make_systemd_unit(options).unwrap())
+            }
+            service_manager::ServiceManagerKind::Rcd => {
+                Some(self.make_rcd_script(options).unwrap())
+            }
+            service_manager::ServiceManagerKind::OpenRc => {
+                Some(self.make_open_rc_script(options).unwrap())
+            }
+            service_manager::ServiceManagerKind::Launchd => {
+                None // 使用 service-manager-rs 的默认 plist 生成
+            }
+            _ => {
+                #[cfg(target_os = "windows")]
+                {
+                    let win_options = self::win_service_manager::WinServiceInstallOptions {
+                        description: options.description.clone(),
+                        display_name: options.display_name.clone(),
+                        dependencies: Some(vec!["rpcss".to_string(), "dnscache".to_string()]),
+                    };
+
+                    Some(serde_json::to_string(&win_options).unwrap())
+                }
+
+                #[cfg(not(target_os = "windows"))]
+                None
+            }
+        }
+    }
+
+    fn make_systemd_unit(
+        &self,
+        options: &ServiceInstallOptions,
+    ) -> Result<String, std::fmt::Error> {
+        let args = options
+            .args
+            .iter()
+            .map(|a| a.to_string_lossy())
+            .collect::<Vec<_>>()
+            .join(" ");
+        let target_app = options.program.display().to_string();
+        let work_dir = options.work_directory.display().to_string();
+        let mut unit_content = String::new();
+
+        writeln!(unit_content, "[Unit]")?;
+        writeln!(unit_content, "After=network.target syslog.target")?;
+        if let Some(ref d) = options.description {
+            writeln!(unit_content, "Description={d}")?;
+        }
+        writeln!(unit_content, "StartLimitIntervalSec=0")?;
+        writeln!(unit_content)?;
+        writeln!(unit_content, "[Service]")?;
+        writeln!(unit_content, "Type=simple")?;
+        writeln!(unit_content, "WorkingDirectory={work_dir}")?;
+        writeln!(unit_content, "ExecStart={target_app} {args}")?;
+        writeln!(unit_content, "Restart=always")?;
+        writeln!(unit_content, "RestartSec=1")?;
+        writeln!(unit_content, "LimitNOFILE=infinity")?;
+        writeln!(unit_content)?;
+        writeln!(unit_content, "[Install]")?;
+        writeln!(unit_content, "WantedBy=multi-user.target")?;
+
+        std::result::Result::Ok(unit_content)
+    }
+
+    fn make_rcd_script(&self, options: &ServiceInstallOptions) -> Result<String, std::fmt::Error> {
+        let name = self.label.to_qualified_name();
+        let args = options
+            .args
+            .iter()
+            .map(|a| a.to_string_lossy())
+            .collect::<Vec<_>>()
+            .join(" ");
+        let target_app = options.program.display().to_string();
+        let work_dir = options.work_directory.display().to_string();
+        let mut script = String::new();
+
+        writeln!(script, "#!/bin/sh")?;
+        writeln!(script, "#")?;
+        writeln!(script, "# PROVIDE: {name}")?;
+        writeln!(script, "# REQUIRE: LOGIN FILESYSTEMS NETWORKING ")?;
+        writeln!(script, "# KEYWORD: shutdown")?;
+        writeln!(script)?;
+        writeln!(script, ". /etc/rc.subr")?;
+        writeln!(script)?;
+        writeln!(script, "name=\"{name}\"")?;
+        if let Some(ref d) = options.description {
+            writeln!(script, "desc=\"{d}\"")?;
+        }
+        writeln!(script, "rcvar=\"{name}_enable\"")?;
+        writeln!(script)?;
+        writeln!(script, "load_rc_config ${{name}}")?;
+        writeln!(script)?;
+        writeln!(script, ": ${{{name}_options=\"{args}\"}}")?;
+        writeln!(script)?;
+        writeln!(script, "{name}_chdir=\"{work_dir}\"")?;
+        writeln!(script, "pidfile=\"/var/run/${{name}}.pid\"")?;
+        writeln!(script, "procname=\"{target_app}\"")?;
+        writeln!(script, "command=\"/usr/sbin/daemon\"")?;
+        writeln!(
+            script,
+            "command_args=\"-c -S -T ${{name}} -p ${{pidfile}} ${{procname}} ${{{name}_options}}\""
+        )?;
+        writeln!(script)?;
+        writeln!(script, "run_rc_command \"$1\"")?;
+
+        std::result::Result::Ok(script)
+    }
+
+    fn make_open_rc_script(
+        &self,
+        options: &ServiceInstallOptions,
+    ) -> Result<String, std::fmt::Error> {
+        let args = options
+            .args
+            .iter()
+            .map(|a| a.to_string_lossy())
+            .collect::<Vec<_>>()
+            .join(" ");
+        let target_app = options.program.display().to_string();
+        let work_dir = options.work_directory.display().to_string();
+        let mut script = String::new();
+
+        writeln!(script, "#!/sbin/openrc-run")?;
+        writeln!(script)?;
+        if let Some(ref d) = options.description {
+            writeln!(script, "description=\"{d}\"")?;
+        }
+        writeln!(script, "command=\"{target_app}\"")?;
+        writeln!(script, "command_args=\"{args}\"")?;
+        writeln!(script, "pidfile=\"/run/${{RC_SVCNAME}}.pid\"")?;
+        writeln!(script, "command_background=\"yes\"")?;
+        writeln!(script, "directory=\"{work_dir}\"")?;
+        writeln!(script)?;
+        writeln!(script, "depend() {{")?;
+        writeln!(script, "    need net")?;
+        writeln!(script, "    use looger")?;
+        writeln!(script, "}}")?;
+
+        std::result::Result::Ok(script)
+    }
+}
+
+#[cfg(target_os = "windows")]
+mod win_service_manager {
+    use std::{ffi::OsStr, ffi::OsString, io, path::PathBuf};
+    use windows_service::{
+        service::{
+            ServiceAccess, ServiceDependency, ServiceErrorControl, ServiceInfo, ServiceStartType,
+            ServiceType,
+        },
+        service_manager::{ServiceManager, ServiceManagerAccess},
+    };
+
+    use service_manager::{
+        ServiceInstallCtx, ServiceLevel, ServiceStartCtx, ServiceStatus, ServiceStatusCtx,
+        ServiceStopCtx, ServiceUninstallCtx,
+    };
+
+    use winreg::{enums::*, RegKey};
+
+    use crate::common::constants::WIN_SERVICE_WORK_DIR_REG_KEY;
+
+    use serde::{Deserialize, Serialize};
+
+    #[derive(Serialize, Deserialize)]
+    pub struct WinServiceInstallOptions {
+        pub dependencies: Option<Vec<String>>,
+        pub description: Option<String>,
+        pub display_name: Option<String>,
+    }
+
+    pub struct WinServiceManager {
+        service_manager: ServiceManager,
+    }
+
+    fn generate_service_info(ctx: &ServiceInstallCtx) -> (ServiceInfo, Option<OsString>) {
+        let start_type = if ctx.autostart {
+            ServiceStartType::AutoStart
+        } else {
+            ServiceStartType::OnDemand
+        };
+        let srv_name = OsString::from(ctx.label.to_qualified_name());
+        let mut dis_name = srv_name.clone();
+        let mut description: Option<OsString> = None;
+        let mut dependencies = Vec::<ServiceDependency>::new();
+
+        if let Some(s) = ctx.contents.as_ref() {
+            let options: WinServiceInstallOptions = serde_json::from_str(s.as_str()).unwrap();
+            if let Some(d) = options.dependencies {
+                dependencies = d
+                    .iter()
+                    .map(|dep| ServiceDependency::Service(OsString::from(dep.clone())))
+                    .collect::<Vec<_>>();
+            }
+            if let Some(d) = options.description {
+                description = Some(OsString::from(d));
+            }
+            if let Some(d) = options.display_name {
+                dis_name = OsString::from(d);
+            }
+        }
+
+        let service_info = ServiceInfo {
+            name: srv_name,
+            display_name: dis_name,
+            service_type: ServiceType::OWN_PROCESS,
+            start_type,
+            error_control: ServiceErrorControl::Normal,
+            executable_path: ctx.program.clone(),
+            launch_arguments: ctx.args.clone(),
+            dependencies: dependencies.clone(),
+            account_name: None,
+            account_password: None,
+        };
+
+        (service_info, description)
+    }
+
+    impl WinServiceManager {
+        pub fn new() -> Result<Self, anyhow::Error> {
+            let service_manager =
+                ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::ALL_ACCESS)?;
+            Ok(Self { service_manager })
+        }
+    }
+    impl service_manager::ServiceManager for WinServiceManager {
+        fn available(&self) -> io::Result<bool> {
+            Ok(true)
+        }
+
+        fn install(&self, ctx: ServiceInstallCtx) -> io::Result<()> {
+            let (service_info, description) = generate_service_info(&ctx);
+
+            let service = self
+                .service_manager
+                .create_service(&service_info, ServiceAccess::ALL_ACCESS)
+                .map_err(io::Error::other)?;
+
+            if let Some(s) = description {
+                service
+                    .set_description(s.clone())
+                    .map_err(io::Error::other)?;
+            }
+
+            if let Some(work_dir) = ctx.working_directory {
+                set_service_work_directory(&ctx.label.to_qualified_name(), work_dir)?;
+            }
+
+            Ok(())
+        }
+
+        fn uninstall(&self, ctx: ServiceUninstallCtx) -> io::Result<()> {
+            let service = self
+                .service_manager
+                .open_service(ctx.label.to_qualified_name(), ServiceAccess::ALL_ACCESS)
+                .map_err(io::Error::other)?;
+
+            service.delete().map_err(io::Error::other)
+        }
+
+        fn start(&self, ctx: ServiceStartCtx) -> io::Result<()> {
+            let service = self
+                .service_manager
+                .open_service(ctx.label.to_qualified_name(), ServiceAccess::ALL_ACCESS)
+                .map_err(io::Error::other)?;
+
+            service.start(&[] as &[&OsStr]).map_err(io::Error::other)
+        }
+
+        fn stop(&self, ctx: ServiceStopCtx) -> io::Result<()> {
+            let service = self
+                .service_manager
+                .open_service(ctx.label.to_qualified_name(), ServiceAccess::ALL_ACCESS)
+                .map_err(io::Error::other)?;
+
+            _ = service.stop().map_err(io::Error::other)?;
+
+            Ok(())
+        }
+
+        fn level(&self) -> ServiceLevel {
+            ServiceLevel::System
+        }
+
+        fn set_level(&mut self, level: ServiceLevel) -> io::Result<()> {
+            match level {
+                ServiceLevel::System => Ok(()),
+                _ => Err(io::Error::other("Unsupported service level")),
+            }
+        }
+
+        fn status(&self, ctx: ServiceStatusCtx) -> io::Result<ServiceStatus> {
+            let service = match self
+                .service_manager
+                .open_service(ctx.label.to_qualified_name(), ServiceAccess::QUERY_STATUS)
+            {
+                Ok(s) => s,
+                Err(e) => {
+                    if let windows_service::Error::Winapi(ref win_err) = e {
+                        if win_err.raw_os_error() == Some(0x424) {
+                            return Ok(ServiceStatus::NotInstalled);
+                        }
+                    }
+                    return Err(io::Error::other(e));
+                }
+            };
+
+            let status = service.query_status().map_err(io::Error::other)?;
+
+            match status.current_state {
+                windows_service::service::ServiceState::Stopped => Ok(ServiceStatus::Stopped(None)),
+                _ => Ok(ServiceStatus::Running),
+            }
+        }
+    }
+
+    impl super::ServiceManager for WinServiceManager {
+        fn update(&self, ctx: service_manager::ServiceInstallCtx) -> io::Result<()> {
+            let (service_info, description) = generate_service_info(&ctx);
+
+            let service = self
+                .service_manager
+                .open_service(ctx.label.to_qualified_name(), ServiceAccess::ALL_ACCESS)
+                .map_err(io::Error::other)?;
+
+            service
+                .change_config(&service_info)
+                .map_err(io::Error::other)?;
+
+            if let Some(s) = description {
+                service
+                    .set_description(s.clone())
+                    .map_err(io::Error::other)?;
+            }
+
+            if let Some(work_dir) = ctx.working_directory {
+                set_service_work_directory(&ctx.label.to_qualified_name(), work_dir)?;
+            }
+
+            Ok(())
+        }
+    }
+
+    fn set_service_work_directory(service_name: &str, work_directory: PathBuf) -> io::Result<()> {
+        let (reg_key, _) =
+            RegKey::predef(HKEY_LOCAL_MACHINE).create_subkey(WIN_SERVICE_WORK_DIR_REG_KEY)?;
+        reg_key
+            .set_value::<OsString, _>(service_name, &work_directory.as_os_str().to_os_string())?;
+        Ok(())
+    }
+}
diff --git a/easytier/src/web_client/mod.rs b/easytier/src/web_client/mod.rs
index b5a5fb8..b73a165 100644
--- a/easytier/src/web_client/mod.rs
+++ b/easytier/src/web_client/mod.rs
@@ -6,7 +6,7 @@ use crate::{
         set_default_machine_id, stun::MockStunInfoCollector,
     },
     connector::create_connector_by_url,
-    instance_manager::{NetworkInstanceManager, WebClientGuard},
+    instance_manager::{DaemonGuard, NetworkInstanceManager},
     proto::common::NatType,
     tunnel::{IpVersion, TunnelConnector},
 };
@@ -19,7 +19,7 @@ pub mod session;
 pub struct WebClient {
     controller: Arc<controller::Controller>,
     tasks: ScopedTask<()>,
-    manager_guard: WebClientGuard,
+    manager_guard: DaemonGuard,
 }
 
 impl WebClient {
@@ -29,7 +29,7 @@ impl WebClient {
         hostname: H,
         manager: Arc<NetworkInstanceManager>,
     ) -> Self {
-        let manager_guard = manager.register_web_client();
+        let manager_guard = manager.register_daemon();
         let controller = Arc::new(controller::Controller::new(
             token.to_string(),
             hostname.to_string(),
diff --git a/flake.nix b/flake.nix
index e69d586..5964a37 100644
--- a/flake.nix
+++ b/flake.nix
@@ -32,6 +32,11 @@
         rustVersion = "1.89.0";
         makeRust =
           features:
+          let
+            rustTarget = pkgs.stdenv.hostPlatform.config;
+            muslTarget = pkgs.lib.replaceStrings [ "gnu" ] [ "musl" ] rustTarget;
+            muslTargets = if pkgs.stdenv.isLinux then [ muslTarget ] else [ ];
+          in
           pkgs.rust-bin.stable.${rustVersion}.default.override {
             extensions = [
               "rust-src"
@@ -39,7 +44,7 @@
             ]
             ++ (if builtins.elem "android" features then android.rust.extensions else [ ]);
 
-            targets = if builtins.elem "android" features then android.rust.targets else [ ];
+            targets = muslTargets ++ (if builtins.elem "android" features then android.rust.targets else []);
           };
 
         android = import ./android.nix {
@@ -76,6 +81,7 @@
               );
 
             buildInputs = with pkgs; ([
+              jemalloc
               zstd
               openssl
               libclang
@@ -90,6 +96,7 @@
             LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath (flattenPaths (buildInputs ++ nativeBuildInputs));
             ZSTD_SYS_USE_PKG_CONFIG = true;
             KCP_SYS_EXTRA_HEADER_PATH = "${pkgs.libclang.lib}/lib/clang/19/include:${pkgs.glibc.dev}/include";
+            JEMALLOC_OVERRIDE = "${pkgs.jemalloc}/lib/libjemalloc.so";
           }
           // (if hasFeature "android" then android.envVars else { }));
       in