diff --git a/vnt/src/channel/idle.rs b/vnt/src/channel/idle.rs
index ecb877f..c145819 100644
--- a/vnt/src/channel/idle.rs
+++ b/vnt/src/channel/idle.rs
@@ -39,7 +39,7 @@ impl Idle {
                 }
             }
         }
-        let sleep_time = self.read_idle - max;
+        let sleep_time = self.read_idle.checked_sub(max).unwrap_or_default();
         return IdleType::Sleep(sleep_time);
     }
 }
diff --git a/vnt/src/handle/handshaker.rs b/vnt/src/handle/handshaker.rs
index 9a1eb3d..9259072 100644
--- a/vnt/src/handle/handshaker.rs
+++ b/vnt/src/handle/handshaker.rs
@@ -30,7 +30,11 @@ impl Handshake {
         #[cfg(feature = "server_encrypt")] rsa_cipher: Arc<Mutex<Option<RsaCipher>>>,
     ) -> Self {
         Handshake {
-            time: Arc::new(AtomicCell::new(Instant::now() - Duration::from_secs(60))),
+            time: Arc::new(AtomicCell::new(
+                Instant::now()
+                    .checked_sub(Duration::from_secs(60))
+                    .unwrap_or(Instant::now()),
+            )),
             #[cfg(feature = "server_encrypt")]
             rsa_cipher,
         }
diff --git a/vnt/src/handle/recv_data/server.rs b/vnt/src/handle/recv_data/server.rs
index c28cb15..8452bec 100644
--- a/vnt/src/handle/recv_data/server.rs
+++ b/vnt/src/handle/recv_data/server.rs
@@ -80,7 +80,11 @@ impl<Call, Device> ServerPacketHandler<Call, Device> {
             nat_test,
             callback,
             #[cfg(feature = "server_encrypt")]
-            up_key_time: Arc::new(AtomicCell::new(Instant::now() - Duration::from_secs(60))),
+            up_key_time: Arc::new(AtomicCell::new(
+                Instant::now()
+                    .checked_sub(Duration::from_secs(60))
+                    .unwrap_or(Instant::now()),
+            )),
             external_route,
             handshake,
             #[cfg(feature = "integrated_tun")]
diff --git a/vnt/src/nat/mod.rs b/vnt/src/nat/mod.rs
index d35e1e8..6c3c4be 100644
--- a/vnt/src/nat/mod.rs
+++ b/vnt/src/nat/mod.rs
@@ -2,7 +2,6 @@ use anyhow::Context;
 use std::io;
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, ToSocketAddrs};
 use std::net::{SocketAddr, UdpSocket};
-use std::ops::Sub;
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
@@ -61,6 +60,7 @@ pub fn local_ipv6() -> Option<Ipv6Addr> {
     }
     None
 }
+
 pub const fn is_ipv4_global(ipv4: &Ipv4Addr) -> bool {
     !(ipv4.octets()[0] == 0 // "This network"
         || ipv4.is_private()
@@ -78,6 +78,7 @@ pub const fn is_ipv4_global(ipv4: &Ipv4Addr) -> bool {
         || ipv4.octets()[0] & 240 == 240 && !ipv4.is_broadcast()//ipv4.is_reserved()
         || ipv4.is_broadcast())
 }
+
 pub const fn is_ipv6_global(ipv6addr: &Ipv6Addr) -> bool {
     !(ipv6addr.is_unspecified()
         || ipv6addr.is_loopback()
@@ -169,11 +170,14 @@ impl NatTest {
         }
         #[cfg(feature = "upnp")]
         upnp.add_tcp_port(tcp_port);
+        let instant = Instant::now();
         NatTest {
             stun_server,
             info,
             time: Arc::new(AtomicCell::new(
-                Instant::now().sub(Duration::from_secs(100)),
+                instant
+                    .checked_sub(Duration::from_secs(100))
+                    .unwrap_or(instant),
             )),
             udp_ports,
             tcp_port,