diff --git a/app/tun_windows.go b/app/tun_windows.go
index a9d972cdc..63790a7fb 100644
--- a/app/tun_windows.go
+++ b/app/tun_windows.go
@@ -1,3 +1,5 @@
+//go:build windows
+
 package app
 
 import (
diff --git a/app/wg.go b/app/wg.go
index bf59eaff8..45cb31888 100644
--- a/app/wg.go
+++ b/app/wg.go
@@ -64,7 +64,7 @@ func establishWireguard(l *slog.Logger, conf *wiresocks.Configuration, tunDev wg
 	var request bytes.Buffer
 
 	request.WriteString(fmt.Sprintf("private_key=%s\n", conf.Interface.PrivateKey))
-	if fwmark != 0 {
+	if bind && fwmark != 0 {
 		request.WriteString(fmt.Sprintf("fwmark=%d\n", fwmark))
 	}