Understand what TUN mode changes
TUN mode allows Clash Verge Rev to create a virtual network interface on Windows and capture traffic at the IP layer. Instead of asking every application to use an HTTP or SOCKS proxy, Windows sends traffic to the virtual interface, and the mihomo core receives, evaluates, and forwards it according to the active configuration. This is why TUN mode can handle applications that ignore the Windows system proxy, including some games, command-line tools, launchers, development utilities, and software with its own network stack.
System proxy mode and TUN mode are not interchangeable. System proxy mode normally changes Windows proxy settings to an address such as 127.0.0.1:7890. Only applications that read those settings will use the proxy. TUN mode works below that application setting, but it also affects more traffic and requires additional permissions. A browser opening a website through system proxy mode does not prove that TUN is working; the two modes use different routing paths.
| Mode | Traffic coverage | Required permissions | Typical use |
|---|---|---|---|
| System proxy | Applications that respect Windows proxy settings | Usually no administrator service after installation | Browsers, office software, and ordinary desktop apps |
| TUN | Most IP traffic routed through the virtual interface | Administrator approval and a working service or helper | Games, terminals, launchers, and proxy-unaware applications |
| Existing VPN | Controlled by another VPN driver or network extension | Depends on the VPN product | Corporate access, privacy VPNs, or device-wide tunnels |
Prepare Windows and Clash Verge Rev
Before changing the setting, install a current Clash Verge Rev build that includes the mihomo core and supports Windows TUN operation. The exact labels can differ between releases, so look for the terms TUN, Service Mode, Core, or mihomo rather than relying on one fixed screen layout. If the application is an old portable build, move it to a stable local folder such as C:\Apps\Clash Verge Rev and avoid running it from a temporary extraction directory or a removable drive.
Sign in to a Windows administrator account, or make sure you can approve a User Account Control prompt. TUN itself does not mean that every subsequent action needs to be performed as administrator, but creating or controlling a system-level helper commonly does. If the UAC prompt is cancelled, hidden behind another window, or blocked by an organization policy, the client may still open normally while the TUN service remains unavailable.
Record the current ports and routing state
Open the active configuration in Clash Verge Rev and note the mixed port, controller port, mode, DNS settings, and current proxy group. A common mixed port is 7890, but the actual value may be different. Do not assume that every installation uses the same port, especially if another Clash client was installed previously. Also record whether the current mode is rule, global, or direct; TUN can be running correctly while a direct policy makes a particular website bypass the proxy.
mixed-port: 7890
allow-lan: false
mode: rule
log-level: info
external-controller: 127.0.0.1:9090In Windows, open Command Prompt and record the existing adapters and routes if you are troubleshooting a complex system:
ipconfig /all
route print
netstat -ano | findstr "7890 9090"These commands do not enable TUN. They provide a baseline for comparing the system before and after activation. In particular, ipconfig /all can reveal another VPN adapter, a disabled physical adapter, or a DNS server that is already unusual. The output may contain internal addresses, so remove private information before sharing screenshots or logs.
Check for software that commonly conflicts with TUN
- Other proxy clients: Quit Clash for Windows, another Clash Verge instance, sing-box GUI clients, and transparent proxy utilities before testing.
- VPN software: Disconnect commercial VPNs and corporate VPNs. Some install WFP filters that continue running even after the visible window is closed.
- Virtualization tools: Hyper-V, VMware, VirtualBox, WSL, Docker Desktop, and Android emulators can add virtual adapters and custom routes.
- Security software: Endpoint protection may block the helper executable, virtual adapter creation, or packet interception.
- Manual DNS tools: DNS filters and local resolvers listening on port
53can conflict with TUN DNS hijacking.
Install Service Mode and enable TUN
The most reliable Windows procedure is to install the client’s service component first, then enable TUN from the settings page. In Clash Verge Rev, open Settings and locate the section related to Service Mode. Choose the install or enable action, approve the Windows administrator prompt, and wait until the interface reports that the service is installed or running. The wording may be “Install Service,” “Install Service Mode,” or a similar label depending on the build.
Service Mode is not the proxy core itself. It is a privileged helper that allows the desktop client to perform operations requiring elevated Windows permissions, such as creating or controlling the TUN interface. If the service installation fails, repeatedly clicking the TUN switch will not solve the underlying problem. First inspect the error, check whether an older service remains installed, and restart Clash Verge Rev after the installation completes.
- Quit other proxy and VPN applications.
- Launch Clash Verge Rev and open Settings.
- Find Service Mode and select the install or enable option.
- Approve the UAC prompt with an administrator account.
- Wait for the status to change to installed, enabled, or running.
- Restart Clash Verge Rev if the client asks you to do so.
- Open the TUN section and enable TUN Mode.
- Turn on system proxy only if you specifically need applications that rely on Windows proxy settings.
When TUN is enabled through the graphical interface, the client normally writes or applies equivalent mihomo settings for the active profile. A typical configuration resembles the following, although the exact fields and defaults depend on the mihomo version bundled with the client:
tun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: true
dns-hijack:
- any:53enable: true turns on the TUN inbound. stack: mixed selects a traffic stack that can handle common IPv4 and IPv6 situations, while some users may prefer system or gvisor after testing compatibility. auto-route: true asks mihomo to install the routes needed to direct traffic into the virtual interface. auto-detect-interface: true helps the core choose the physical network interface used for outbound connections. DNS hijacking sends DNS queries to the configured mihomo DNS logic, but it should not be copied blindly into a configuration that already contains another DNS interception design.
Choose TUN options conservatively
Leave automatic route detection enabled for the first test unless your computer has several active network interfaces. If you use Ethernet, Wi-Fi, Hyper-V, and a corporate VPN simultaneously, automatic detection may select an unexpected interface. In that case, identify the real outbound adapter with ipconfig and adjust the client’s interface preference only when the logs show that auto-detection chose incorrectly.
IPv6 deserves a separate decision. If your proxy rules, DNS service, or upstream nodes do not support IPv6 consistently, IPv6 requests may fail or bypass the expected path. Do not disable IPv6 across Windows solely because one website behaves strangely. First compare IPv4 and IPv6 results, then decide whether to disable IPv6 handling in the profile, use a compatible TUN stack, or add an explicit policy for IPv6 traffic.
Verify that TUN is routing traffic
A green TUN switch is only the first check. Verification should cover the client status, Windows network interface, DNS behavior, and an application that normally ignores the system proxy. Start with the Clash Verge Rev dashboard or log view. The core should remain running without repeated messages about failed interface creation, route installation, DNS bind errors, or permission denial.
Next, open ncpa.cpl from the Windows Run dialog. A new virtual network adapter may appear with a name containing terms such as Clash, Mihomo, or Wintun. The exact name depends on the client and driver package. The presence of an adapter alone is not enough: it must be enabled, and the core log should show that the TUN inbound started successfully.
Use the following checks from Command Prompt or PowerShell:
ipconfig
route print
nslookup example.com
curl.exe -I https://example.comCompare the route table before and after enabling TUN. The details vary by Windows version and mihomo stack, but you should see route entries associated with the virtual adapter or a route arrangement that sends selected traffic through it. Do not expect every route to display the same gateway or interface metric on every computer. The important evidence is consistent traffic behavior, not a particular numeric value.
| Test | Expected result | If it fails |
|---|---|---|
| Core log | TUN inbound starts without permission or route errors | Check Service Mode, UAC, and conflicting drivers |
| Network adapters | A virtual TUN or Wintun adapter is enabled | Reinstall the service or inspect security software |
| Browser test | Traffic appears in the Clash connection log | Check mode, rules, and whether the browser uses a separate VPN |
| Command-line test | curl.exe works without proxy flags |
Check route selection, DNS, firewall, and IPv6 |
| DNS test | Names resolve and the result follows the selected DNS policy | Review DNS hijack, port 53 conflicts, and fake-IP settings |
For a stronger test, disable the Windows system proxy temporarily and run curl.exe without --proxy. If the request still appears in the Clash connection list and follows the expected policy, TUN is handling traffic independently of the normal application proxy setting. Test one browser tab, one command-line request, and one proxy-unaware application rather than opening many programs at once; a small test makes the connection log easier to interpret.
Troubleshoot common TUN startup failures
Service Mode will not install
If the service installation produces an access-denied message, restart the client and approve UAC explicitly. Check Windows Settings → System → For developers only if the client documentation specifically requires a development option; ordinary TUN use does not normally require Developer Mode. If an old Clash service is still registered, uninstall it through the old client first or remove it using the product’s documented cleanup procedure. Avoid deleting random services from the registry because an incorrect removal can affect unrelated network software.
Security software can also quarantine the helper immediately after installation. Review its protection history and create an exception only for a trusted, correctly obtained application. If the computer is managed by an organization, group policy may prevent service creation or virtual adapter installation. In that situation, a local administrator may still be unable to override the policy, and the practical solution is to ask the administrator rather than repeatedly reinstalling the client.
TUN starts and then stops
This pattern often indicates a driver conflict, an invalid route, or a core crash caused by the active configuration. Disable TUN, switch temporarily to a minimal known-good profile, and enable it again. Use a basic rule mode, one working proxy group, a standard mixed port, and conservative DNS settings. If the minimal profile works, restore custom rule providers, scripts, sniffer options, and DNS features one at a time.
Restart Windows after installing or removing a virtual adapter. Windows may retain a stale interface or route until the network stack is refreshed. Also check whether a laptop changes from Wi-Fi to Ethernet while TUN is active. Automatic interface detection usually handles this transition, but a manually selected adapter can become unavailable when the connection changes.
The adapter exists, but applications have no network access
First inspect the Clash connection log. If no request appears, the application may be excluded by a route, a bypass rule, or a separate VPN. If requests appear with DNS errors, review the DNS section before changing proxy nodes. A local service listening on port 53, a broken fake-IP range, or an unreachable upstream DNS server can make every domain appear offline even when the proxy connection itself is healthy.
If only selected destinations fail, inspect rules and policy groups. A rule such as GEOIP,CN,DIRECT, a domain suffix rule, or a final MATCH,DIRECT can intentionally send traffic directly. TUN does not force every connection through a proxy; it only makes the traffic visible to the core. The final route still depends on DNS resolution, rule order, and the selected policy.
System proxy and TUN appear to interfere
Running both modes is not automatically wrong, but it can make diagnosis confusing. TUN may capture the browser’s connection while the browser also sends requests to 127.0.0.1:7890, creating a loop or duplicate processing path in poorly matched configurations. For the initial test, choose one mode: disable system proxy and test TUN directly. After successful verification, enable system proxy only when a specific application needs it.
Finally, change one setting at a time and keep a short record of each test. Note the Clash Verge Rev version, mihomo core version, Windows build, active adapter, TUN stack, DNS mode, and the exact log error. “TUN does not work” is too broad to diagnose; “Service Mode is running, the adapter exists, DNS succeeds, but curl.exe follows the direct policy” points to a rule or policy problem. This method avoids unnecessary reinstalls and makes it easier to restore a stable configuration.