diff --git a/src/internal/server/socks5/socks5.go b/src/internal/server/socks5/socks5.go
index 39cac9d..509edce 100644
--- a/src/internal/server/socks5/socks5.go
+++ b/src/internal/server/socks5/socks5.go
@@ -70,10 +70,9 @@ func (s *Server) Start() (err error) {
 
 // handleClient performs SOCKS5 negotiation and dispatches TCP/UDP handling.
 func (s *Server) HandleClient(client net.Conn) {
-	defer client.Close()
-
 	// Handshake (no auth)
 	if err := s.socks5Auth(client); err != nil {
+		_ = client.Close()
 		return
 	}
 
@@ -82,10 +81,12 @@ func (s *Server) HandleClient(client net.Conn) {
 		if cmd == socksCmdUDP {
 			// UDP Associate
 			s.handleUDPAssociate(client)
+			_ = client.Close()
 			return
 		}
 		logrus.Debugf("[%s][%s] ParseSocks5Request failed: %s",
 			client.RemoteAddr().String(), destAddrPort, err.Error())
+		_ = client.Close()
 		return
 	}
 
@@ -93,6 +94,7 @@ func (s *Server) HandleClient(client net.Conn) {
 	target, err := s.socks5Connect(client, destAddrPort)
 	if err != nil {
 		logrus.Debug("Connect failed: ", err)
+		_ = client.Close()
 		return
 	}
 	s.forwardTCP(client, target, destAddrPort)