diff --git a/main.c b/main.c
index 52e22ac..d452985 100644
--- a/main.c
+++ b/main.c
@@ -123,19 +123,13 @@
          plat_prefix ? plat_prefix : "(none)", v4_addr ? v4_addr : "(none)",
          v6_addr ? v6_addr : "(none)");
 
-  // run under a regular user but keep needed capabilities
-  drop_root_but_keep_caps();
-
   // open our raw sockets before dropping privs
   open_sockets(&tunnel, mark);
 
-  // keeps only admin capability
-  set_capability(1 << CAP_NET_ADMIN);
-
   configure_interface(uplink_interface, plat_prefix, v4_addr, v6_addr, &tunnel, mark);
 
-  // Drop all remaining capabilities.
-  set_capability(0);
+  // run under a regular user with no capabilities
+  drop_root_and_caps();
 
   // Loop until someone sends us a signal or brings down the tun interface.
   if (signal(SIGTERM, stop_loop) == SIG_ERR) {