diff --git a/httptunnel/server.go b/httptunnel/server.go
index af4196d1..58fe76c5 100644
--- a/httptunnel/server.go
+++ b/httptunnel/server.go
@@ -23,7 +23,8 @@ import (
 const RelayBufferSize = cipherstream.MaxCipherRelaySize
 
 type Server struct {
-	addr string
+	addr    string
+	timeout time.Duration
 
 	sync.Mutex
 	connMap     map[string][]net.Conn
@@ -44,6 +45,7 @@ func NewServer(addr string, timeout time.Duration, tlsConfig *tls.Config) *Serve
 
 	return &Server{
 		addr:        addr,
+		timeout:     timeout,
 		connMap:     make(map[string][]net.Conn, 256),
 		connCh:      make(chan net.Conn, 1),
 		closing:     make(chan struct{}, 1),
@@ -145,6 +147,7 @@ func (s *Server) pull(w http.ResponseWriter, r *http.Request) {
 	var n int
 	var p = &pullResp{}
 	for {
+		_ = conns[0].SetReadDeadline(time.Now().Add(s.timeout))
 		n, err = conns[0].Read(buf)
 		if n > 0 {
 			_ = faker.FakeData(p)
@@ -251,6 +254,10 @@ func (s *Server) pullClose(reqID string) {
 	s.Lock()
 	defer s.Unlock()
 
+	if conns, ok := s.connMap[reqID]; ok {
+		_ = conns[0].Close()
+	}
+
 	s.connMap[reqID] = nil
 	delete(s.connMap, reqID)
 }
diff --git a/remote.go b/remote.go
index c0817271..039c16f4 100644
--- a/remote.go
+++ b/remote.go
@@ -91,7 +91,7 @@ func (es *EasyServer) startTCPServer() {
 }
 
 func (es *EasyServer) startHTTPTunnelServer() {
-	server := httptunnel.NewServer(es.ListenHTTPTunnelAddr(), es.Timeout(), es.tlsConfig.Clone())
+	server := httptunnel.NewServer(es.ListenHTTPTunnelAddr(), es.MaxConnWaitTimeout(), es.tlsConfig.Clone())
 	es.mu.Lock()
 	es.httpTunnelServer = server
 	es.mu.Unlock()
diff --git a/util/netpipe/pipe.go b/util/netpipe/pipe.go
index da43574a..459ad2b5 100644
--- a/util/netpipe/pipe.go
+++ b/util/netpipe/pipe.go
@@ -138,7 +138,10 @@ func (p *pipe) Close() error {
 	p.closed = true
 	p.buf.CloseWithError(ErrPipeClosed)
 	p.cond.Broadcast()
-	bytespool.MustPut(p.back)
+	if len(p.back) > 0 {
+		bytespool.MustPut(p.back)
+		p.back = nil
+	}
 	return nil
 }