diff --git a/protocol/vless/encryption/common.go b/protocol/vless/encryption/common.go
index 84e3818d..ad2592d0 100644
--- a/protocol/vless/encryption/common.go
+++ b/protocol/vless/encryption/common.go
@@ -164,6 +164,13 @@ func (c *CommonConn) IsEncryptionLayer() bool {
 	return true
 }
 
+func (c *CommonConn) Close() error {
+	if c == nil || c.Conn == nil {
+		return nil
+	}
+	return c.Conn.Close()
+}
+
 type AEAD struct {
 	cipher.AEAD
 	Nonce [12]byte
diff --git a/protocol/vless/outbound.go b/protocol/vless/outbound.go
index 391b0213..fca1995c 100644
--- a/protocol/vless/outbound.go
+++ b/protocol/vless/outbound.go
@@ -214,10 +214,13 @@ func (h *vlessDialer) DialContext(ctx context.Context, network string, destinati
 	}
 
 	if h.encryption != nil {
-		conn, err = h.encryption.Handshake(conn)
+		var encConn net.Conn
+		encConn, err = h.encryption.Handshake(conn)
 		if err != nil {
+			common.Close(conn)
 			return nil, E.Cause(err, "encryption handshake")
 		}
+		conn = encConn
 	}
 
 	var visionBaseConn net.Conn
@@ -299,11 +302,13 @@ func (h *vlessDialer) ListenPacket(ctx context.Context, destination M.Socksaddr)
 		return nil, err
 	}
 	if h.encryption != nil {
-		conn, err = h.encryption.Handshake(conn)
+		var encConn net.Conn
+		encConn, err = h.encryption.Handshake(conn)
 		if err != nil {
 			common.Close(conn)
 			return nil, E.Cause(err, "encryption handshake")
 		}
+		conn = encConn
 	}
 	if h.xudp {
 		return h.client.DialEarlyXUDPPacketConn(conn, destination)