diff --git a/hub/executor/executor.go b/hub/executor/executor.go
index ee7ad088..9a5c7c2b 100644
--- a/hub/executor/executor.go
+++ b/hub/executor/executor.go
@@ -315,6 +315,11 @@ func updateIPTables(cfg *config.Config) {
 		}
 	}()
 
+	if cfg.Tun.Enable {
+		err = fmt.Errorf("when tun is enabled, iptables cannot be set automatically")
+		return
+	}
+
 	var (
 		inboundInterface = "lo"
 		bypass           = iptables.Bypass