diff --git a/client/NetdClient.cpp b/client/NetdClient.cpp
index 68f1f31..fce362e 100644
--- a/client/NetdClient.cpp
+++ b/client/NetdClient.cpp
@@ -62,7 +62,7 @@
         }
     }
     if (FwmarkClient::shouldSetFwmark(family)) {
-        FwmarkCommand command = {FwmarkCommand::ON_ACCEPT, 0};
+        FwmarkCommand command = {FwmarkCommand::ON_ACCEPT, 0, 0};
         if (int error = FwmarkClient().send(&command, sizeof(command), acceptedSocket)) {
             return closeFdAndSetErrno(acceptedSocket, error);
         }
@@ -72,7 +72,7 @@
 
 int netdClientConnect(int sockfd, const sockaddr* addr, socklen_t addrlen) {
     if (sockfd >= 0 && addr && FwmarkClient::shouldSetFwmark(addr->sa_family)) {
-        FwmarkCommand command = {FwmarkCommand::ON_CONNECT, 0};
+        FwmarkCommand command = {FwmarkCommand::ON_CONNECT, 0, 0};
         if (int error = FwmarkClient().send(&command, sizeof(command), sockfd)) {
             errno = -error;
             return -1;
@@ -182,7 +182,7 @@
     if (socketFd < 0) {
         return -EBADF;
     }
-    FwmarkCommand command = {FwmarkCommand::SELECT_NETWORK, netId};
+    FwmarkCommand command = {FwmarkCommand::SELECT_NETWORK, netId, 0};
     return FwmarkClient().send(&command, sizeof(command), socketFd);
 }
 
@@ -198,6 +198,14 @@
     if (socketFd < 0) {
         return -EBADF;
     }
-    FwmarkCommand command = {FwmarkCommand::PROTECT_FROM_VPN, 0};
+    FwmarkCommand command = {FwmarkCommand::PROTECT_FROM_VPN, 0, 0};
+    return FwmarkClient().send(&command, sizeof(command), socketFd);
+}
+
+extern "C" int setNetworkForUser(uid_t uid, int socketFd) {
+    if (socketFd < 0) {
+        return -EBADF;
+    }
+    FwmarkCommand command = {FwmarkCommand::SELECT_FOR_USER, 0, uid};
     return FwmarkClient().send(&command, sizeof(command), socketFd);
 }
diff --git a/include/FwmarkCommand.h b/include/FwmarkCommand.h
index 9ec93e2..57464b4 100644
--- a/include/FwmarkCommand.h
+++ b/include/FwmarkCommand.h
@@ -17,6 +17,8 @@
 #ifndef NETD_INCLUDE_FWMARK_COMMAND_H
 #define NETD_INCLUDE_FWMARK_COMMAND_H
 
+#include <sys/types.h>
+
 // Commands sent from clients to the fwmark server to mark sockets (i.e., set their SO_MARK).
 struct FwmarkCommand {
     enum {
@@ -24,8 +26,10 @@
         ON_CONNECT,
         SELECT_NETWORK,
         PROTECT_FROM_VPN,
+        SELECT_FOR_USER,
     } cmdId;
     unsigned netId;  // used only in the SELECT_NETWORK command; ignored otherwise.
+    uid_t uid;  // used only in the SELECT_FOR_USER command; ignored otherwise.
 };
 
 #endif  // NETD_INCLUDE_FWMARK_COMMAND_H
diff --git a/include/NetdClient.h b/include/NetdClient.h
index 742902f..71529a3 100644
--- a/include/NetdClient.h
+++ b/include/NetdClient.h
@@ -19,6 +19,7 @@
 
 #include <stdbool.h>
 #include <sys/cdefs.h>
+#include <sys/types.h>
 
 __BEGIN_DECLS
 
@@ -34,6 +35,8 @@
 
 int protectFromVpn(int socketFd);
 
+int setNetworkForUser(uid_t uid, int socketFd);
+
 __END_DECLS
 
 #endif  // NETD_INCLUDE_NETD_CLIENT_H
diff --git a/server/FwmarkServer.cpp b/server/FwmarkServer.cpp
index 3a540bd..39a8d74 100644
--- a/server/FwmarkServer.cpp
+++ b/server/FwmarkServer.cpp
@@ -134,6 +134,15 @@
             break;
         }
 
+        case FwmarkCommand::SELECT_FOR_USER: {
+            if ((permission & PERMISSION_SYSTEM) != PERMISSION_SYSTEM) {
+                return -EPERM;
+            }
+            fwmark.netId = mNetworkController->getNetworkForUser(command.uid, NETID_UNSET, false);
+            fwmark.protectedFromVpn = true;
+            break;
+        }
+
         default: {
             // unknown command
             return -EPROTO;