Understanding TUN Mode: Why System Proxy Isn't Enough

When you first install Clash Verge Rev on macOS, you likely rely on the "System Proxy" toggle. While this works for most web browsers like Safari or Chrome, it often fails to capture traffic from other applications. This is because many macOS apps—such as Spotify, Discord, terminal-based tools like curl or git, and various gaming platforms—do not automatically respect the system's HTTP/HTTPS proxy settings. This is where TUN Mode becomes essential.

TUN mode creates a virtual network interface (a "tunnel") at the kernel level. Instead of waiting for apps to "opt-in" to the proxy settings, TUN mode intercepts all network packets at the IP layer. This ensures that every single bit of data leaving your Mac is processed by the Mihomo core within Clash Verge Rev. In 2026, as more apps use proprietary protocols or bypass standard system hooks, TUN mode has transitioned from a "power user feature" to a mandatory requirement for a seamless proxy experience on macOS.

Note: Enabling TUN mode requires administrative privileges because it modifies network routing tables and creates a virtual network adapter.

Prerequisites for macOS Users

Before we dive into the activation steps, ensure your environment meets the following criteria to avoid common installation errors:

  • Clash Verge Rev Version: Ensure you are running the latest stable release (v1.6.0 or higher is recommended for 2026).
  • Mihomo Core: TUN mode features are best supported by the Mihomo (formerly Clash Meta) core. Check Settings > Kernel to confirm you are using Mihomo.
  • Administrative Access: You must have the password for your Mac's admin account.
  • Conflicting Software: Disable other VPNs or firewall software (like Little Snitch or LuLu) temporarily if you encounter "Interface Collision" errors.

Step 1: Installing the Service Mode

For Clash Verge Rev to manage a virtual network interface, it must run a "Service" with root privileges. This is a one-time setup step that allows the app to toggle TUN mode without asking for your password every time.

  1. Launch Clash Verge Rev and navigate to the Settings tab on the left sidebar.
  2. Locate the Service Mode section. You will see a status indicator; if it says "Not Installed," click the Install button.
  3. A macOS system prompt will appear asking for your administrator password. Enter it and click OK.
  4. Once installed, the status should change to Active (represented by a green icon or text).

If the installation fails, try restarting the application as an administrator or check if your disk permissions are restricted by MDM (Mobile Device Management) profiles.

Step 2: Mihomo Core Configuration for TUN

While the app handles most settings, ensuring the config.yaml or the internal settings are optimized for TUN mode will prevent DNS leaks. In Clash Verge Rev, this is mostly handled via the Settings > TUN Settings menu.

Key parameters to verify in the TUN Settings panel:

  • Stack: Use gvisor or system. In 2026, gvisor is preferred for its stability and user-space efficiency.
  • DNS Hijack: Ensure this is enabled (usually any:53) so that all DNS queries are intercepted.
  • Auto Route: This must be toggled ON so that the app automatically updates the system routing table.
  • Auto Detect Interface: Toggle this ON to allow Clash to identify your active Wi-Fi or Ethernet connection.
# Example of what happens in the background (Mihomo config)
tun:
  enable: true
  stack: gvisor
  dns-hijack:
    - any:53
  auto-route: true
  auto-detect-interface: true

Step 3: Activating TUN Mode

With the Service Mode active and settings verified, you can now flip the switch. Unlike the System Proxy toggle, TUN mode might take a few seconds to initialize as it creates the utun interface.

  1. Go back to the Settings or the Main Dashboard.
  2. Find the TUN Mode toggle and switch it to ON.
  3. Open your macOS System Settings > Network. You should see a new interface (often named "Clash" or a generic "utun" device) appearing in the list.
  4. Verify traffic: Open the Connections tab in Clash Verge Rev and try using an app like Spotify. You should see active connections appearing with their specific process names.
Warning: Do not enable "System Proxy" and "TUN Mode" simultaneously unless you have a specific reason to do so. While they can coexist, it occasionally leads to "double-proxying" which increases latency and CPU usage.

Preventing DNS Leaks in TUN Mode

The biggest risk when using TUN mode is the "DNS Leak," where your Mac sends DNS queries to your ISP's servers instead of through the proxy. This can expose your browsing history and bypass region-locking. To prevent this in Clash Verge Rev:

  1. Navigate to Settings > DNS Settings.
  2. Enable Fake-IP mode. This ensures that the system receives a "fake" IP address for every domain, forcing the actual resolution to happen within the Clash core.
  3. Add reliable upstream DNS servers like https://1.1.1.1/dns-query or https://8.8.8.8/resolve.
  4. In the TUN settings, ensure Strict Route is enabled if you are on a public Wi-Fi network to prevent any packets from "leaking" outside the tunnel.

Common Troubleshooting for macOS

Even with the best tools, macOS's strict security can sometimes interfere with TUN mode. Here are the most common issues and their solutions:

Issue Possible Cause Solution
Service Mode Install Fail Permissions or existing service Run sudo rm -rf on old helper files or check System Settings > General > Login Items.
No Internet in TUN Mode DNS Conflict Switch DNS mode from Fake-IP to Real-IP or clear your DNS cache using sudo dscacheutil -flushcache.
High CPU Usage Stack choice Change the TUN Stack from system to gvisor in Settings.
App Bypasses TUN Bypass list settings Check the "Skip Proxy" or "Bypass" list in Clash Verge Rev settings to ensure the app isn't excluded.

Special Case: Terminal Proxying

Even with TUN mode, some CLI tools are stubborn. If your terminal still shows your local IP, you can use the following command to verify if the TUN interface is handling traffic:

# Check active network interfaces
ifconfig | grep utun

If you see a utunX interface with an IP address (usually 198.18.0.1 in Fake-IP mode), TUN mode is working correctly at the system level.

Why Clash Verge Rev is the Best Choice for macOS in 2026

Compared to legacy tools like ClashX or the original Clash for Windows, Clash Verge Rev offers a superior experience for macOS users. Its native integration with the Mihomo core allows for advanced features like RULE-SET support and optimized memory management for Apple Silicon (M1/M2/M3/M4) chips. Many commercial VPN apps offer a "one-click" experience, but they often lack the transparency and granular control that Clash provides. For developers and privacy-conscious users, the ability to see exactly which process is connecting to which IP is invaluable.

Furthermore, the open-source nature of Clash Verge Rev ensures that security vulnerabilities are patched quickly by the community. As macOS continues to lock down its kernel (making traditional KEXT-based VPNs obsolete), the user-space implementation of TUN mode in Clash Verge Rev remains the most future-proof method for system-wide proxying.

Get the installer

Download Clash for free and start browsing freely →