Prepare Clash Verge Rev and an Active Profile
TUN mode is useful when a Windows application ignores the system proxy or does not provide its own proxy settings. Instead of asking each application to connect to an HTTP or SOCKS proxy, Clash Verge Rev creates a virtual network interface and routes selected traffic through the mihomo core. The core then applies the active profile’s rules and proxy groups. TUN changes how traffic reaches the core; it does not provide proxy nodes, repair an expired subscription, or guarantee that every app will use a remote proxy.
If you still need the client, choose a Windows build from the Clash client download page. Import your provider’s subscription using the client’s Profiles or Configurations page, select the imported profile, and check that the core starts without configuration errors. Menu wording can differ between Clash Verge Rev releases, so use the equivalent profile and settings controls if the labels on your screen are not identical. The quick-start guide covers the basic client and subscription setup.
- Update the profile and confirm that it is selected as the active configuration, not simply present in the profile list.
- Open the Proxies page and choose a working node in the group used by your rules. Keep Rule mode for the initial test; switching to Global mode is not required to enable TUN.
- Check the core log for YAML parsing errors, unsupported fields, or failed proxy connections. Resolve those first so a routing test does not confuse a profile problem with a TUN problem.
- Save work that depends on another VPN, then disconnect that VPN for the first test. Two tools trying to control routes or virtual adapters can interfere with each other.
Enable TUN Mode and Its Windows Service
Install Service Mode First
On Windows 11, creating and managing a virtual network adapter generally requires elevated privileges. Clash Verge Rev provides a service mode to handle operations that the ordinary desktop process cannot perform by itself. Open the application’s Settings page and look for a Service Mode or Service section. If the service is not installed, use the client’s install control and approve the Windows User Account Control prompt only after confirming that the prompt is for the Clash Verge Rev service you intended to install.
Depending on the client release, the service control and TUN switch may appear in different parts of Settings. Install the service before troubleshooting the TUN toggle. If the installation control reports success, close and reopen Settings or restart the application once, then confirm that the service is shown as installed or available. Do not repeatedly click Install if Windows is still processing a prompt or the application is waiting for permission.
Turn on TUN and Restart the Core
Find the TUN Mode control in Clash Verge Rev’s settings and enable it. Some releases expose additional options, such as a network stack, automatic route configuration, or automatic interface detection. For a first test, leave optional values at their defaults unless the client or your network requires a specific choice. Apply the change and restart the core if the interface asks you to do so. A setting that is selected but not applied may not create an adapter or alter the routing table.
After enabling TUN, check both the application’s status and the core log. Look for a successful TUN initialization message, a created virtual interface, or a route setup confirmation. Exact log wording varies by mihomo version. A red error about administrator access, service communication, adapter creation, or route setup means the test is not yet valid; do not assume that the switch alone proves traffic is being captured.
| Item | What to check | Why it matters |
|---|---|---|
| Service Mode | The client reports the service installed and available | The service performs privileged operations needed for TUN setup |
| TUN switch | The setting is enabled and applied to the running core | A saved preference may not take effect until the core restarts |
| Core log | No adapter, permission, or route initialization error | A failed startup can leave the feature enabled in the interface but inactive |
| Profile | The intended configuration is active and has usable proxy groups | TUN transports traffic to the core; the profile determines how it is handled |
Test Routing Without Changing Several Settings
Start with one application that normally ignores the Windows system proxy, such as a desktop launcher or a command-line tool. Keep the active profile in Rule mode and use a rule or test destination that should match a known proxy group. Open the application, make one request, and inspect Clash Verge Rev’s Connections page. A successful TUN test should show the connection arriving at the core, its matched rule, and the selected proxy chain or direct action.
Test a destination whose expected route is clear. If the profile has a rule that sends a domain to a proxy group, use that domain rather than an internal company site or local printer. A connection marked DIRECT may indicate that the profile’s rule intentionally bypassed the proxy; it does not by itself show that TUN failed. Likewise, a connection visible in the log may still fail because the selected node cannot reach the destination.
- Test an app that bypasses system proxy: Confirm its request appears in Connections, then check the matched rule and proxy chain.
- Compare with a browser: If the browser works only when the system proxy is enabled but the other app does not appear in Connections, verify TUN startup and the other app’s network path.
- Check DNS separately: A domain lookup failure can occur even when the adapter is present. Review the profile’s DNS settings and core logs before changing DNS interception options.
- Check local resources: Test a trusted local address only after confirming that the profile and TUN settings are not intentionally routing local networks through a proxy.
You can inspect Windows network state without changing it. Open PowerShell and list adapters and routes while the client is running:
Get-NetAdapter | Format-Table Name, Status, InterfaceDescription
Get-NetRoute -AddressFamily IPv4 | Sort-Object RouteMetric | Select-Object -First 12Adapter names and descriptions depend on the client and core version, so do not expect a fixed name containing “Clash” or “mihomo.” Compare the output before and after enabling TUN, and use it as supporting evidence rather than editing routes by hand. If a test works in one app but not another, compare that app’s DNS behavior, use of UDP, permissions, and any built-in proxy or VPN settings.
Understand Routes, DNS, and Traffic Scope
TUN interception and the system proxy are related but distinct mechanisms. The system proxy tells applications that honor Windows proxy settings where to send supported requests. TUN works lower in the network path by routing IP traffic through a virtual adapter. It can therefore help with applications that do not read the system proxy, but applications may still behave differently depending on their networking method, protocol, privileges, or exclusion settings.
Many mihomo-based clients provide options for automatic routes, interface detection, DNS handling, and a network stack. The client may manage these values through its settings rather than requiring you to edit the subscription. Avoid copying a configuration snippet into a provider-managed profile just because an online example includes it: duplicate keys, unsupported options, or profile updates can cause errors or overwrite changes. If you need to inspect a configuration, check which settings are generated by the client and which belong to the active profile.
- Automatic route handling: This helps the core direct relevant Windows traffic to the TUN interface. Turning it off without a specific routing plan can leave applications using the ordinary network path.
- Interface detection: Choosing the correct physical network interface matters on devices with Wi-Fi, Ethernet, virtual machines, or multiple active adapters. Automatic detection is a sensible starting point for a typical laptop or desktop.
- DNS behavior: TUN does not make every DNS issue disappear. The profile’s DNS configuration, DNS hijacking options, and the application’s resolver behavior can affect whether a domain resolves and which rule is matched.
- Local and private networks: Rules or route exclusions may keep local addresses direct. This is often desirable for printers, routers, and office resources, but corporate policies and network layouts vary.
- UDP and app-specific traffic: UDP handling depends on the core, profile, node, and destination. A successful web page test over TCP does not prove that a game, voice app, or other UDP-based service will work.
Do not turn on LAN sharing simply to make TUN work on the same Windows computer. LAN sharing allows other devices to connect to a listening proxy endpoint; TUN concerns traffic routing on the machine where the client is running. Keep LAN exposure disabled unless you have a separate, deliberate need to share the proxy on a trusted network.
Troubleshoot Startup and Restore Normal Routing
Service or Adapter Errors
If TUN fails to start, first read the exact error in the client and core logs. Confirm that Service Mode is installed, that the service is available, and that any Windows permission prompt was completed. If the service was installed while the client was already open, restart the client and retry once. Avoid running several copies of Clash Verge Rev at the same time; two core processes can compete for ports, configuration files, or adapter resources.
If Windows shows no new virtual adapter, check Device Manager’s network adapters and the client’s startup log. A hidden or differently named adapter is possible, so compare descriptions and status rather than relying on a guessed device name. Security software may block a driver or service operation. Review its quarantine and protection history before changing security settings, and allow only the component you can verify belongs to the installed client. Do not download a driver from an unrelated site to fix a TUN startup error.
Conflicts, DNS, and No Internet
Temporarily disconnect another VPN and disable other software that creates a virtual network adapter, such as some firewalls or traffic filters. Test TUN again with the same profile and destination. If that resolves the issue, re-enable tools one at a time to identify a conflict. On managed work or school devices, administrator policy may restrict network services or route changes; do not try to bypass those controls.
If TUN starts but applications lose internet access, turn TUN off from the client and restart the core to restore the ordinary route, then verify that normal connectivity returns. Re-enable TUN only after checking the active node, profile rules, DNS settings, and logs. A stale route can sometimes remain after a forced shutdown; restarting Windows is a reasonable recovery step if the client can no longer restore its routing state. Do not delete routes or reset adapters manually unless you understand the effect on other VPNs, virtual machines, and corporate networking.
If only one application fails, check its own proxy settings, DNS cache, protocol support, and whether it uses a separate network service. If all applications fail, compare the core log with Windows adapter and route state, then test a known working profile and node. When reporting a problem, include the Clash Verge Rev version, Windows 11 build, core version, relevant error lines, and whether another VPN or security filter is installed. Redact subscription URLs, authentication tokens, node credentials, and private addresses from screenshots or logs before sharing them.
Once TUN is working, keep the profile in the mode that matches your rules, and avoid treating the system proxy indicator as the sole proof of routing. Check Connections when an application behaves unexpectedly. If you no longer need traffic interception, switch TUN off in Clash Verge Rev, apply the change, and confirm that the adapter and routes return to their expected state.