diff --git a/x-ui.service.arch b/x-ui.service.arch
index 59c1964c9..c36335d8f 100644
--- a/x-ui.service.arch
+++ b/x-ui.service.arch
@@ -50,6 +50,10 @@ ProtectSystem=full
 # alias for older systemd, needed so ProtectSystem=full keeps /etc/x-ui writable.
 ReadWritePaths=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
 ReadWriteDirectories=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
+# A kernel-TUN WireGuard outbound zeroes net.ipv{4,6}.conf.*.rp_filter as Xray starts
+# (#6796). Reopen only /proc/sys/net: kernel.* (core_pattern among them) stays read-only.
+# No ReadWriteDirectories alias needed: ProtectKernelTunables itself requires systemd 232.
+ReadWritePaths=-/proc/sys/net
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes
diff --git a/x-ui.service.debian b/x-ui.service.debian
index 074bda292..3a6085d7d 100644
--- a/x-ui.service.debian
+++ b/x-ui.service.debian
@@ -50,6 +50,10 @@ ProtectSystem=full
 # alias for older systemd, needed so ProtectSystem=full keeps /etc/x-ui writable.
 ReadWritePaths=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
 ReadWriteDirectories=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
+# A kernel-TUN WireGuard outbound zeroes net.ipv{4,6}.conf.*.rp_filter as Xray starts
+# (#6796). Reopen only /proc/sys/net: kernel.* (core_pattern among them) stays read-only.
+# No ReadWriteDirectories alias needed: ProtectKernelTunables itself requires systemd 232.
+ReadWritePaths=-/proc/sys/net
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes
diff --git a/x-ui.service.rhel b/x-ui.service.rhel
index ee2763331..18b115dcd 100644
--- a/x-ui.service.rhel
+++ b/x-ui.service.rhel
@@ -50,6 +50,10 @@ ProtectSystem=full
 # alias for older systemd, needed so ProtectSystem=full keeps /etc/x-ui writable.
 ReadWritePaths=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
 ReadWriteDirectories=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
+# A kernel-TUN WireGuard outbound zeroes net.ipv{4,6}.conf.*.rp_filter as Xray starts
+# (#6796). Reopen only /proc/sys/net: kernel.* (core_pattern among them) stays read-only.
+# No ReadWriteDirectories alias needed: ProtectKernelTunables itself requires systemd 232.
+ReadWritePaths=-/proc/sys/net
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes