What TUN Mode Does
TUN mode creates a virtual network interface that lets Clash Verge Rev handle traffic at the network level. This is different from the usual system proxy setting: a system proxy is used only by applications that know to follow Windows proxy settings, while TUN can capture traffic from many applications that ignore them. Games, command-line tools, launchers, and some desktop apps may therefore work through Clash when they would otherwise connect directly.
On Windows, TUN mode is provided by the Mihomo core and depends on Windows allowing the client to create and manage a virtual adapter and routes. Enabling the switch in the app is only one part of the setup. The core must be running, the adapter must be created successfully, and traffic must have a suitable route through your profile. If any of those pieces is missing, the switch may fail, or the app may appear connected while some traffic still bypasses the proxy.
This guide covers the practical checks and setup flow for Clash Verge Rev on Windows. Names and locations of controls can vary between releases, so use the TUN or service settings shown by your installed version rather than relying on an exact menu location. You also need a working profile and an available proxy group or node; TUN mode does not provide proxy servers by itself.
What You Will Achieve
Route eligible Windows application traffic through Clash Verge Rev, verify that the TUN adapter is active, and identify common permission, DNS, and VPN conflicts.
Important Distinction
TUN is a traffic-capture method, not a proxy mode or a new subscription. Your profile’s rules and selected proxy groups still decide whether captured traffic is sent through a proxy, connected directly, or rejected.
1Check Windows Permissions and Conflicts
Before changing settings, make sure Clash Verge Rev is installed correctly and can start its core. Use a current, trusted release that includes the Mihomo core, then open the application and confirm that your profile has loaded without a configuration error. If the profile is broken or no proxy group is available, TUN may capture traffic successfully but still have nowhere useful to send it.
Creating a virtual network adapter and changing routes require elevated Windows permissions. Depending on the version and installation, Clash Verge Rev may use an application service or ask Windows for administrator approval when you enable TUN. If a permission prompt appears, approve it only when you trust the installed application. If the app reports that a service is missing or cannot start, follow its own service-management prompt or repair the installation; repeatedly toggling TUN will not resolve a missing or blocked service.
- Close other network tools temporarily. Another VPN, proxy client, network filter, firewall utility, or virtual-machine network manager may install its own adapter or routes.
- Check that the profile is usable. Select a proxy group and confirm that the nodes or providers it depends on are available.
- Know how to undo the change. If connectivity fails, turn TUN off from Clash Verge Rev and restart the client. Avoid manually deleting Windows routes or adapters unless you know exactly which software created them.
- Use a manageable test environment. Save work that relies on remote access before changing network routing, especially on a work-managed computer.
Do Not Run Multiple TUN Clients at Once
Two VPN or TUN applications can compete to install routes, intercept DNS, or become the default gateway. Turn off the other client before testing Clash Verge Rev. On a managed work device, follow your organization’s network policy instead of bypassing its controls.
Prepare a Clean Test
For the first test, disconnect from any other VPN and close applications that install network adapters. Keep Windows Defender Firewall enabled; do not disable security software as a routine troubleshooting step. If your firewall or endpoint protection displays a specific block related to Clash Verge Rev or Mihomo, review the product’s alert and allow only the trusted component if that is permitted by your device policy.
It is also useful to note your normal network state before enabling TUN: whether ordinary websites load, whether your existing VPN is connected, and which proxy group is selected. This makes it easier to distinguish a TUN setup issue from an unavailable node or a general internet outage.
2Enable TUN Mode in Clash Verge Rev
Once the profile is ready and competing VPN clients are disconnected, enable TUN from the application’s settings. The exact navigation can change between releases, but the controls are generally grouped under settings for the core, network, or TUN. Look for the TUN switch and any separate option for starting or installing the required service. If Windows asks for administrator approval, accept the prompt only after confirming that it belongs to Clash Verge Rev.
- Open Clash Verge Rev and make sure the intended profile is active and has loaded successfully.
- Open the app’s settings and locate the TUN or network configuration. Turn on TUN mode.
- If the app offers a service installation or repair action, use that action and approve the Windows permission prompt when appropriate.
- Wait for the core to restart or for the virtual adapter to appear. Check the app’s status and logs for a successful TUN startup rather than assuming the switch alone means it is working.
- Select a working proxy group or node, then test with one application that normally ignores the Windows system proxy.
Some versions expose additional options such as the TUN stack, automatic route installation, DNS hijacking, or route exclusions. For a first setup, prefer the application’s defaults unless you have a clear reason to change them. These settings affect how traffic is captured and resolved; changing several at once makes failures harder to diagnose.
If your version provides a system and a gvisor stack choice, keep the default initially. The system stack can work well with the native Windows networking path, while gVisor uses a different userspace network implementation. Compatibility and performance depend on the device, core version, and workload, so compare alternatives only after confirming that the basic setup works.
Likewise, automatic routing and DNS interception are not interchangeable settings. Routing directs captured traffic through the TUN interface; DNS handling determines how name lookups are processed. Turning on DNS hijacking may help ensure that captured applications use the profile’s DNS configuration, but it can interact with other DNS tools and VPNs. Change it only when a test indicates a DNS issue, and record the original value so you can revert it.
Change One Setting at a Time
After changing a TUN option, apply or restart the core if the interface asks you to. Then repeat the same test. This keeps the cause of any new error clear and makes rollback straightforward.
If you manage the profile as YAML, avoid pasting a collection of TUN options copied from an unrelated guide. Mihomo options can vary by core version, and an invalid or duplicate configuration key can prevent the profile from loading. Use the configuration editor’s validation or the application log to identify syntax errors before restarting the core.
3Verify That Windows Traffic Uses TUN
After enabling TUN, check both the client and the traffic itself. First confirm that Clash Verge Rev reports the core as running and does not show an adapter, permission, or route error. Then open the connection or traffic view, if available, and look for requests from the application you are testing. A visible request confirms that the core is seeing traffic; the selected rule and policy group indicate whether it is being proxied or sent directly.
Choose a test application that does not reliably use Windows system proxy settings, such as a command-line tool or a desktop application known to connect directly. Make a fresh request after TUN is active rather than relying on a page or connection that was already open. If the client’s connection view shows the request, inspect its matched rule and outbound group. A DIRECT result can be correct for a rule-based profile, but it does not demonstrate that traffic went through a remote proxy.
For an additional check, compare your public IP address before and after selecting a proxy route using a trusted IP-check service. The result should reflect the selected route when the test request is actually proxied. Do not treat an unchanged address as automatic proof that TUN is broken: the profile may deliberately match the destination to DIRECT, the browser may use a separate secure DNS or VPN feature, or the service may report an address from a different connection.
- Core status: The Mihomo core is running and the app shows no TUN startup failure.
- Adapter and routing: Windows has a virtual adapter associated with the active client, and the client has not reported a route installation error.
- Connection visibility: A fresh request from the test application appears in the client’s traffic or connection list.
- Rule and outbound: The matched rule and policy group are appropriate for the destination you are testing.
- Repeatability: After restarting Clash Verge Rev, TUN starts again and the same application behaves as expected.
Test ordinary browser access as well as the application that motivated the setup. If the browser works but a specific app does not, the problem may be an app-specific route, a hard-coded DNS resolver, its own VPN or proxy setting, or a rule that sends its traffic directly. If no applications can connect, test whether the profile works with TUN disabled before investigating individual apps.
Some applications keep existing sockets open even after routing changes. Fully close and reopen the test application, or start a new request, before judging the result. For a more controlled comparison, test one application at a time and avoid changing the selected node, profile rules, and TUN options during the same test.
4Troubleshoot Startup and Connectivity Problems
If TUN does not start, use the app’s status and logs to narrow down the cause. A message about permission or service startup points to an elevation or service issue. A profile parsing error points to YAML or subscription configuration. A successful startup followed by failed connections is more likely to involve the selected proxy, routing rules, DNS, a firewall, or another network tool.
The TUN Switch Will Not Stay On
Check that the Mihomo core is available and the active profile loads without errors. If the app says a required service cannot be installed or started, use the provided service repair flow, restart Windows if the app requests it, and then try again. On a device where you do not have administrator rights, an administrator may need to complete the setup. Do not try to work around organizational restrictions by modifying system services or policies.
TUN Starts but Applications Have No Internet
First verify that the selected node or proxy group is reachable. Temporarily test a known working group, then inspect the connection list for the affected app. If the connection is marked REJECT, review the profile’s rules. If it is marked DIRECT, the rules may be behaving as configured rather than sending the traffic through a proxy. If there is no connection entry, confirm that the app is making a fresh request and that its traffic is not handled by another VPN, firewall, or application-level proxy.
To restore connectivity quickly, turn off TUN and check whether the original network works again. If it does, re-enable TUN with default options and no other VPN active. This rollback test helps separate a TUN routing problem from a general connection outage without requiring manual changes to Windows routes.
DNS or Some Domains Fail
When IP-based connections work but domain names do not, investigate DNS rather than changing every routing option. Check whether the profile’s DNS settings load correctly and whether another VPN, secure DNS application, browser setting, or network filter is overriding them. If DNS hijacking is available, test its default state and change it only as a controlled experiment. After each change, restart the core if required and retest the same domain.
VPN Conflicts, Slowdowns, or Intermittent Access
Disconnect other VPNs and proxy tools, including ones that remain active in the background. If TUN works when they are closed, the issue is likely overlapping adapters, DNS handling, or competing default routes. Keep only one traffic-capturing client active while diagnosing. On managed computers, consult the administrator rather than changing security software or endpoint protection settings.
If only some sites are slow, inspect the matched rule and proxy group before switching TUN stacks. The site may be routed through a distant or overloaded node, or the profile may use a route that is not suitable for that destination. If all traffic is slow, compare the connection with TUN off, confirm that the selected node is healthy, and then test one configuration change at a time. TUN adds a capture and routing layer; it cannot improve an overloaded proxy service or an unstable local connection.
Use Logs Before Editing Routes
Avoid deleting adapters, flushing system routes, or disabling the firewall as a first response. Those actions can disrupt other software and make the original fault harder to find. Save the relevant Clash Verge Rev log message and use the client’s supported repair or shutdown controls first.
When asking for help, include your Windows version, Clash Verge Rev version, core version, whether another VPN is installed, the exact startup or connection error, and whether the same profile works with TUN disabled. Remove subscription links, passwords, tokens, and private server addresses from screenshots or logs before sharing them.
5Use TUN Safely in Daily Work
Once the test passes, keep the setup simple. Leave stable default options in place, update the client and core through trusted sources, and check that the profile is current. After a client or core update, confirm that the core starts and repeat a short traffic test; network behavior can change when drivers, services, or configuration formats change.
Remember that TUN can capture traffic beyond browsers, including applications that may contain work, account, or device-management data. Your profile’s rules determine where that traffic goes. Review the selected policy groups and rules so you understand which destinations are proxied, direct, or blocked. If you need to exclude a work application or local network, use a supported profile rule or the application’s documented exclusion option rather than trying to manually manipulate Windows routes.
For routine shutdown, turn TUN off in Clash Verge Rev and wait for the client to stop the core or restore its routes. If the internet does not recover, restart the client first; if the problem persists, restart Windows and check that no other VPN has taken over the connection. Keep a note of any custom TUN or DNS settings so you can restore a known-good configuration after troubleshooting.
With permissions in place, a healthy profile, and competing network tools disconnected, TUN mode provides a practical way to route traffic from Windows apps that do not follow the system proxy. Verify the actual rule and outbound for each test rather than relying solely on the TUN switch, and change settings gradually when diagnosing an issue.