Clash Verge Rev TUN Mode Setup on Windows: A Simple Guide

What TUN Mode Does

If you use Clash Verge Rev on Windows, the ordinary system proxy setting is usually enough for browsers and applications that respect Windows proxy configuration. However, many desktop programs do not use that setting at all. Games, launchers, command-line tools, virtual machines, developer environments, and some Microsoft services may connect directly even while Clash appears to be running correctly.

TUN mode solves this limitation by creating a virtual network interface on Windows. Instead of waiting for every application to understand HTTP or SOCKS proxy settings, Clash Verge Rev captures traffic at the system network layer and sends it through the Mihomo core. This makes routing more consistent across applications, including software that has no proxy option in its settings.

This guide explains how to enable TUN mode safely, prepare the required permissions, choose a suitable routing mode, and verify that traffic is actually being handled by Clash. It also covers DNS behavior, administrator prompts, conflicts with other VPN software, and the most common failures on Windows 10 and Windows 11.

1Prepare Windows Before Enabling TUN

TUN mode is more powerful than the ordinary system proxy switch because it changes how Windows traffic is captured. Before turning it on, spend a few minutes checking the client version, the active profile, permissions, and possible network conflicts. This preparation prevents most “TUN does nothing” problems.

Confirm the Client and Profile

Open Clash Verge Rev and make sure a valid profile is selected under the profile or configuration page. The profile must contain working proxies, proxy groups, and rules. TUN mode can capture traffic even when the profile is incomplete, but captured requests may fail if the configuration has no usable outbound proxy or has invalid DNS settings.

Update Clash Verge Rev from a trusted source when possible. The exact wording and location of TUN controls can vary between releases, but the underlying requirements remain similar: a compatible Mihomo core, a virtual network interface, and permission to install or control that interface.

Check Permissions and Conflicts

• Administrator permission: Creating or modifying a virtual network adapter normally requires elevated Windows permission. Allow the UAC prompt when Clash Verge Rev requests it.
• Other VPN clients: Exit WireGuard, OpenVPN, Wintun-based VPNs, and other traffic-capture tools temporarily. Two programs attempting to control the same tunnel can produce loops, missing routes, or complete loss of internet access.
• Security software: Some endpoint security products block virtual adapters or driver installation. If TUN repeatedly fails, check the security product’s event log rather than disabling protection permanently.
• Network type: Corporate, university, and hotel networks may restrict driver installation or unusual DNS traffic. Test on a normal home connection if possible.

2Enable TUN Mode in Clash Verge Rev

Once the profile is active, open the settings area of Clash Verge Rev and locate the TUN or Service Mode controls. In some builds, TUN is presented as a switch inside the general settings page. In others, you may first need to install a service or grant administrator access before the switch becomes available.

The most important option for a first installation is usually Auto Route. It allows Mihomo to add the necessary routes automatically. Without it, the TUN interface may appear in Windows while applications continue to use the normal network adapter. This is one of the main reasons users believe TUN mode is enabled when no traffic is actually being captured.

After enabling TUN, open the Windows network adapter list and look for a newly created virtual adapter. The name depends on the core and release, so do not worry if it is not literally called “Clash TUN.” The adapter may appear only while the service is running. Do not manually change its IPv4 address unless the Clash documentation for your specific version instructs you to do so.

Choose a Suitable Stack

Mihomo-based clients may expose a stack choice such as system, gvisor, or mixed. The system stack often provides the best compatibility because it uses the Windows networking implementation more directly. The gVisor stack can be useful in particular environments, but it may behave differently with high-throughput applications, UDP traffic, or unusual protocols. Start with the default or system option, then change it only when a specific application requires troubleshooting.

3Configure Routing and DNS Correctly

Turning on TUN only determines how traffic enters Clash. The profile’s mode, rules, DNS behavior, and proxy groups still decide where that traffic goes. For most Windows users, Rule mode is the best starting point because it provides a balance between usability and control. Global mode is useful for testing, while Direct mode is useful for confirming whether Clash itself is the cause of a connection problem.

Start with Rule Mode

Use Rule mode for normal operation and confirm that the selected proxy group has a working node. Your rules should contain sensible handling for local networks, private addresses, and important services. A typical structure may look like this:

The exact names of your proxy groups will depend on the subscription. Replace Proxy with the group name used by your profile if necessary. The private-network rules help preserve access to routers, network printers, NAS devices, and other local resources. If you want all traffic to use a selected node during testing, temporarily switch to Global mode rather than rewriting the entire ruleset.

Use Fake-IP DNS with Awareness

TUN mode and DNS handling are closely connected. If Windows or an application resolves a domain outside Clash, the connection may use the wrong address or reveal local DNS behavior. A common Mihomo configuration uses fake-ip mode so Clash can associate domain requests with captured connections.

This is an example rather than a universal drop-in configuration. Some company domains, antivirus products, games, and local devices do not work well with fake IP addresses. In that case, add appropriate entries to fake-ip-filter or use the DNS options supplied by your subscription. Do not copy a DNS block blindly if your existing profile already contains provider-specific settings.

4Verify That TUN Is Really Working

A visible TUN switch is not proof that every application is using the tunnel. Verification should happen at several levels: the Clash dashboard, Windows routes, DNS behavior, and an application that normally ignores system proxy settings.

Check the Clash Dashboard

Open the connections or traffic page in Clash Verge Rev and start a few test applications. Visit a website in a browser, run a command-line request, or open a launcher that previously ignored the system proxy. New connections should appear in the dashboard with a rule result such as Proxy or DIRECT. If only browser connections appear while the desktop application remains absent, TUN may not have captured the application, or the application may be using a special kernel-level networking method.

Compare Public IP Results

With a proxy rule selected, check your public IP address in a browser and then test from another application. The results should match the route you selected. Switch temporarily to DIRECT and repeat the test. A clear difference confirms that traffic is moving through the expected path. Do not rely on a single website, because cached results, browser DNS caching, or an IPv6 connection can make the comparison misleading.

Use Windows Command-Line Checks

Open PowerShell and inspect the route table:

Look for the virtual adapter and confirm that it is present and enabled. The precise route entries vary by version and configuration, so the goal is not to match a fixed table line by line. Instead, confirm that Windows has an active virtual interface and that enabling or disabling TUN changes the relevant network state.

You can also test a domain with:

These commands are useful for detecting basic failures, but they do not prove that every protocol is routed correctly. Some applications use their own DNS resolver, QUIC, embedded proxies, or certificate pinning. Use the Clash connection log together with the application’s behavior for a more reliable diagnosis.

5Troubleshoot Common Windows Problems

Most TUN failures are caused by permissions, route conflicts, DNS incompatibility, or an application that requires special handling. Work through the following checks in order instead of changing many settings at once.

TUN Switch Turns Off Immediately

This usually indicates that the service could not start, the virtual adapter could not be created, or Windows denied permission. Close Clash Verge Rev, reopen it with administrator permission, and try again. If another VPN is active, exit it first. Check Windows Security notifications and the application log for blocked drivers or services. Reinstalling the client should be a last resort after confirming that the installer matches your Windows architecture.

Internet Stops After Enabling TUN

First disable TUN to restore connectivity. Then check whether another VPN, proxy utility, or security product is already controlling the default route. Re-enable TUN with Global mode and a known working node. If Global mode works but Rule mode fails, inspect the final rule and proxy group. If neither works, turn off Strict Route, return the stack to its default value, and test with IPv6 disabled.

Local Devices Cannot Be Reached

Printers, routers, NAS devices, and local development servers usually need DIRECT routing. Add private IP ranges and local domains to your rules. Also confirm that Windows Firewall allows local network discovery on the correct network profile. A TUN configuration should not automatically force every private address through a remote proxy.

Only Some Applications Work

An application may use a hard-coded DNS server, a custom VPN driver, UDP-only transport, or a protected process that does not cooperate with user-space capture. Check whether the application appears in the Clash connections list. If it does, inspect the rule and protocol. If it does not, test the application with its own proxy settings, update the client, and review whether the program is excluded by its security policy. Some games and anti-cheat systems intentionally reject traffic interception; do not attempt to bypass those protections by modifying protected files.

DNS Errors or Certificate Warnings Appear

Flush stale DNS information after changing modes:

Restart the affected application and test again. Make sure the system clock is correct, because an incorrect clock can create certificate failures that look like proxy errors. If only internal company domains fail, ask the network administrator for the required DNS suffixes or resolvers instead of routing sensitive corporate traffic through an unknown external service.

A Reliable Daily Configuration

For everyday Windows use, keep the setup simple. Use Rule mode, maintain a clearly named proxy group, and keep private network ranges on DIRECT. Enable TUN only when you need applications that ignore system proxy settings to follow Clash. If your browser already works through the normal system proxy, there is no advantage in forcing every connection through TUN all the time.

Review the connection log after installing a major Windows update or changing VPN software. Network drivers and route priorities can change after updates, and a previously working virtual adapter may need to be restarted. Keep a backup of your profile before editing YAML, especially when modifying DNS, rules, or fake-IP exclusions.

• Use a trusted and current Clash Verge Rev build.
• Confirm the active profile has a working node and proxy group.
• Grant administrator permission when Windows requests it.
• Enable Auto Route and verify the virtual adapter.
• Use Rule mode for normal operation and Global mode only for testing.
• Keep private networks and local devices on DIRECT.
• Verify traffic in the Clash dashboard instead of relying only on the switch state.
• Disable competing VPN or tunnel software while diagnosing problems.

With these checks in place, TUN mode becomes a practical way to give Windows-wide applications consistent Clash routing without manually configuring every program. It is not a replacement for a sound profile: permissions, DNS, rules, and node quality still determine the final result. Start with the smallest working configuration, verify each layer, and only then add advanced options such as Strict Route, custom fake-IP filters, or specialized DNS policies.