Clash Verge Rev TUN Mode Setup on Windows: How to Enable

What TUN Mode Does in Clash Verge Rev

Clash Verge Rev can send traffic through two different desktop paths: the Windows system proxy and a virtual network interface created by TUN mode. The system proxy changes the HTTP and SOCKS proxy settings that Windows exposes to applications. TUN mode works at a lower level. It creates a virtual network adapter, captures IP traffic from the operating system, and passes that traffic to the mihomo kernel for DNS handling, rule matching, and forwarding.

That distinction explains why TUN mode is useful. Browsers usually respect the Windows proxy setting, but many launchers, command-line tools, game clients, update services, and background applications do not. Some applications use their own socket implementation, connect directly to an IP address, or ignore the operating system proxy entirely. With TUN enabled, those connections can enter Clash even when the application has no proxy settings of its own.

TUN is not a separate proxy protocol and it does not automatically make every connection successful. The mihomo kernel still needs valid proxy nodes, a working configuration, appropriate DNS settings, and rules that select the intended outbound. TUN only changes how traffic enters the kernel. The final path is still determined by the active mode, rule providers, proxy groups, and the availability of the selected node.

System proxy mode changes Windows proxy configuration and is usually enough for browsers and ordinary HTTP applications.
TUN mode captures traffic through a virtual interface and is better suited to applications that ignore system proxy settings.
Rule mode decides whether matching traffic uses DIRECT, a proxy group, or another outbound.
Global mode sends most captured traffic to the selected proxy group, which is useful for testing but less selective for everyday use.

TUN mode is system-wide capture, not a second subscription

Enabling TUN does not provide a node, change your subscription, or replace routing rules. Import a usable profile first, select a proxy group, and then use TUN to bring applications that bypass the Windows proxy into the same routing path.

Windows Checks Before You Enable TUN

Most TUN failures happen before the switch is turned on. Clash Verge Rev needs permission to create and manage a virtual network interface and to install or start the supporting service used by the mihomo core. If the client is running without the required elevation, the TUN control may appear to switch on and then immediately turn off, or the interface may never appear in Windows.

Install a current Clash Verge Rev build from the site download center and launch it once after installation. Avoid running several Clash-family clients at the same time because they may compete for ports, system proxy settings, or virtual adapters.
Import a valid profile or subscription and wait until the proxy groups and nodes appear. A TUN interface can be active even when the configuration has no usable outbound, so confirm the profile itself works first.
Open the profile's proxy group and select a node or an automatic group that can reach the destinations you want to test. Do not leave a group on an unavailable node and assume that TUN is broken.
Close other VPN, transparent proxy, packet-capture, or network-filtering software temporarily. These tools can install their own drivers, alter routes, or reserve DNS and proxy ports.
Accept the Windows UAC prompt when Clash Verge Rev asks for elevated permission. If the prompt was denied earlier, exit the client completely and start it again with Run as administrator for the first TUN setup.

Windows Security or third-party endpoint protection may also block the helper process or virtual adapter. A warning does not necessarily mean the configuration is invalid, but it should not be dismissed blindly. Check that the application came from a trusted source, then allow the client or its service when Windows asks whether it can communicate on the network. Public-network restrictions are especially relevant on laptops that change between home, office, and public Wi-Fi.

Check	Why it matters	Typical symptom when it is missing
Administrator permission	Allows the client to create the TUN adapter and manage routes	TUN switches off or reports a service error
Working profile and proxy group	Provides an actual outbound for captured traffic	The interface is active but connections time out
No competing VPN or TUN tool	Prevents route and driver conflicts	Unstable connectivity, duplicate adapters, or unreachable LAN devices
Firewall permission	Allows the core and helper service to communicate	Nodes appear connected but applications cannot establish sessions

How to Turn On TUN Mode in Clash Verge Rev

The exact label can vary slightly between Clash Verge Rev releases and operating-system language settings, but the control is normally located in the application's settings area rather than inside the profile editor. The following sequence is the safest way to enable it on Windows.

Open Clash Verge Rev and confirm that the intended profile is loaded. If several profiles are listed, activate the one containing your current nodes and rules.
Go to Settings and locate the section named System Settings, Network, or a similar settings category.
Find the TUN Mode switch. Some versions place it beside options such as System Proxy, Service Mode, or Auto Run.
Turn on TUN mode and approve the administrator or UAC request. Wait several seconds for the mihomo service and virtual adapter to initialize.
Return to the dashboard and confirm that the TUN status remains enabled. If there is a separate system-proxy switch, leave it enabled only if you want ordinary Windows proxy-aware applications to use that path as well.
Open the proxy or connections view and generate a test connection. A visible connection entry confirms that traffic has reached the mihomo kernel, although it does not by itself prove that every application is being captured.

On some installations, the TUN switch is unavailable until Service Mode is installed or started. Service Mode and TUN mode are related but not identical: Service Mode supplies a privileged background component, while TUN mode activates traffic capture through the virtual interface. Install the service from the relevant settings control, restart Clash Verge Rev if requested, and then enable TUN again.

If the switch turns off immediately, read the client log before changing configuration files. Look for messages mentioning permission denied, adapter creation, route setup, service startup, or an address conflict. Repeatedly clicking the switch without checking the log can leave a partially installed service or several stale adapters, making the next diagnosis harder.

Do not enable every network feature at once

For the first test, change only one setting at a time. Enable the privileged service if required, then TUN, then verify traffic. Adding a manual Windows proxy, another VPN, custom routes, and experimental DNS options simultaneously makes it difficult to identify which component caused the failure.

DNS, Routes, and Configuration Details

TUN mode captures more than browser requests, but DNS still deserves separate attention. A domain can be resolved by Windows before an application opens its connection, or it can be resolved by the mihomo DNS module after traffic reaches Clash. If DNS resolution stays outside the intended path, domain-based rules may behave inconsistently and DNS requests may be visible to the local network.

When the client exposes advanced TUN options, auto-route normally allows mihomo to add the routes needed for traffic takeover. auto-detect-interface helps the kernel choose the active physical interface, which is useful on systems with Wi-Fi, Ethernet, virtual machines, and multiple VPN adapters. dns-hijack can redirect common DNS requests such as port 53 traffic to the Clash DNS listener. The exact controls shown by Clash Verge Rev depend on the bundled mihomo version and the profile's capabilities.

A conceptual mihomo configuration may look like this:

tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true
  dns-hijack:
    - any:53

dns:
  enable: true
  enhanced-mode: fake-ip
  nameserver:
    - https://example.invalid/dns-query
  fake-ip-range: 198.18.0.1/16

The endpoint above is deliberately a documentation placeholder and is not a usable resolver. In a real profile, use resolver entries supplied by the configuration author or ones you have independently verified. Do not copy a DNS block into a profile simply because TUN is enabled. An incompatible DNS section can cause startup errors, slow resolution, or failures for local services.

With fake-ip, Clash returns synthetic addresses from a reserved range such as 198.18.0.0/16 for many domain lookups, then maps those addresses back to domain names internally. Seeing a 198.18.x.x result in a diagnostic command is not automatically a leak. It can be evidence that the request is being handled by the mihomo DNS module. Local domains, excluded domains, and applications that require real addresses may need entries in fake-ip-filter or a different DNS strategy.

Keep local-network destinations direct when necessary, especially printers, NAS devices, and router administration pages.
Be careful with IP-CIDR rules and the no-resolve option; an IP rule that triggers DNS resolution unexpectedly can change the observed path.
Place specific domain and LAN rules before broad rules, and keep the final MATCH rule at the bottom.
Use rule mode for normal operation and global mode only as a controlled diagnostic comparison.

How to Verify That Applications Use the Tunnel

A green TUN indicator is only the beginning. Verify both the network path and the application you actually care about. Testing a browser alone does not prove that a game launcher, terminal, or desktop application follows the same route.

Open the Clash Verge Rev connections or logs view and clear old entries if the interface provides that option.
Start one test application, then open a fresh page or perform one recognizable action. Keep other network-heavy applications closed so the new connection is easy to identify.
Look for the application's process name, destination domain or IP, selected rule, and outbound proxy group. The entry should show the policy you expect, not an accidental DIRECT match.
Compare an external IP result with TUN disabled and enabled. The proxied result should correspond to the selected proxy exit rather than the local network's public address.
Test a command-line program separately. For example, run curl https://example.com in PowerShell and watch for a corresponding connection in the Clash log. A browser result cannot substitute for this check.
Test a DNS lookup with nslookup example.com and compare it with the mihomo DNS log. The exact display depends on the active enhanced mode, so interpret the result together with the connection log rather than relying on one address.

Observation	Likely interpretation	Next action
The application appears in Clash connections with a proxy outbound	TUN capture and rule matching are working for that process	Continue testing the application's other services
The application connects successfully but every entry is DIRECT	TUN works, but the active rules intentionally select direct access	Review rule order, process rules, and the final MATCH rule
The browser is proxied but the command-line tool is absent	The command may be using a separate resolver, IPv6 path, or excluded route	Check TUN routes, IPv6 behavior, firewall software, and the command's own settings
TUN is enabled but no new connection appears	The adapter or privileged service may not be active	Restart the service, check Windows adapters, and inspect the log
Connections appear and then time out	Capture works, but the node, DNS path, or remote destination is failing	Try another node and test DNS independently

For a stronger test, disable the Windows system proxy while leaving TUN enabled, then repeat the application test. If the application still appears in Clash and follows the expected outbound, TUN is capturing it independently of the HTTP proxy setting. Re-enable the system proxy afterward if other applications need it. This comparison also reveals clients that rely only on Windows proxy settings and do not need TUN.

Fixes for Common TUN Problems on Windows

The TUN switch turns off immediately

Start by launching Clash Verge Rev with administrator permission and confirm that its privileged service is installed and running. Then inspect Windows network adapters for an old or duplicated virtual adapter left by an earlier client. Do not delete adapters at random: identify the one associated with the Clash installation, exit all proxy clients, and remove only stale components through the client or Windows network settings. A security product may also be blocking the driver or helper process, so review its recent events.

TUN is on, but there is no internet access

Switch temporarily to a known-working node or proxy group and check whether the issue affects all destinations. If every destination fails, verify that the active profile has a valid final rule and that the selected outbound is not unavailable. If only domain names fail while direct IP addresses work, focus on DNS, fake-IP filtering, and DNS hijack settings. If only one application fails, inspect its process-specific rules, certificate pinning behavior, IPv6 preference, or local firewall policy.

LAN devices stop working

TUN routing can capture local addresses as well as internet traffic. Add or preserve direct rules for the private ranges used by your network, such as 192.168.0.0/16, 172.16.0.0/12, and 10.0.0.0/8, when your configuration requires them. The correct ranges depend on the LAN design, and broad exclusions should not be used without understanding their effect. Test the router, printer, and local file server separately after changing the rules.

IPv6 behaves differently from IPv4

A configuration may proxy IPv4 traffic while an application prefers IPv6, creating a path that does not match expectations. Check whether the profile and TUN implementation support the IPv6 behavior you need. If your network does not provide a reliable IPv6 proxy path, use the client or profile's documented IPv6 controls rather than adding random routes. Re-test with both an IPv4 and an IPv6 destination after every change.

A reliable verification standard

Consider the setup complete only when the TUN status stays enabled, the intended application appears in the Clash connection log, the selected rule and outbound are correct, DNS behaves as expected, and local devices still work. A single successful browser page is not enough to validate a system-wide configuration.

Once the checks pass, keep the configuration simple. Use TUN when applications need system-wide capture, use system proxy for software that already supports it, and avoid stacking multiple traffic interception tools. When a future client update changes the TUN controls, repeat the same sequence: confirm permission, confirm the adapter, confirm the route, and verify a real application in the mihomo log.

Continue With Clash Verge Rev

Download the Windows client from the download center, then follow the quick-start workflow to import a profile, choose a proxy group, and verify the first connection before enabling advanced capture features.

Open Download Center Read the Quick Start Guide