What TUN mode changes in Clash Verge Rev
TUN mode lets Clash Verge Rev route more Windows traffic through Mihomo than the ordinary system proxy can reach. A conventional system proxy works for applications that explicitly read Windows proxy settings, such as many browsers. Other programs—including some launchers, command-line tools, games, and background services—may open network connections directly and never consult that setting. When TUN is active, Mihomo creates a virtual network interface and uses Windows routing mechanisms to capture eligible traffic, then applies the rules and proxy groups in your current profile.
That broader reach is useful, but it does not mean every connection must go through a proxy. Your profile still decides whether a connection uses a proxy group, takes a DIRECT route, or is otherwise handled. TUN changes how traffic reaches Mihomo; it does not replace your rules, create a subscription, or guarantee that a particular application will work. If a destination is classified as DIRECT, TUN can capture the connection and still send it directly according to policy.
TUN also changes the networking layer beneath the desktop app. Windows may ask for administrator approval, a virtual adapter may appear in Network Connections, and DNS behavior can differ from ordinary system-proxy operation. These are expected consequences of a network-level feature, not proof that your profile has been damaged. The right approach is to enable one change at a time, note the current configuration, and verify what actually happens before changing unrelated settings.
This walkthrough covers the usual setup path in Clash Verge Rev on Windows, permission prompts, practical connection checks, and a troubleshooting sequence for startup errors or conflicts with another VPN. Labels and settings can vary slightly between releases, so follow the purpose of an option if its wording differs from the examples below. Use a trusted build and a profile you are authorized to use, and avoid running multiple tools that compete to manage the same routes.
Check the profile and Windows setup first
Before switching TUN on, establish a working baseline. Open Clash Verge Rev, select the profile you intend to use, and confirm that it has loaded successfully. If the client already reports a configuration error, fix that first: a virtual interface cannot repair invalid YAML, unavailable subscription data, or a proxy group with no usable node. If ordinary system-proxy mode currently works, record that fact and note which applications you tested. This gives you a reliable comparison if the new mode behaves differently.
Check whether another network tool is active. A second Clash-compatible client, a commercial VPN, a corporate endpoint agent, a game-network accelerator, or a DNS-filtering product may install its own adapter or alter routing. Some can coexist, but two tools that both redirect traffic may create loops, unexpected bypasses, or a connection that appears to be online while applications cannot reach anything. For a clean first test, disconnect other VPN or tunnel clients and leave security software enabled unless your organization’s administrator tells you otherwise.
Also consider the context in which you are using the computer. Managed work or school devices may restrict virtual adapters, driver installation, DNS changes, or administrator elevation. Do not try to bypass those controls. Ask the device administrator whether TUN is permitted and whether a sanctioned VPN or proxy must remain active. On a personal Windows computer, use an account with administrator access when Windows requests it, but do not grant privileges to an executable whose source you cannot verify.
- Confirm a usable profile: make sure the selected profile loads and at least one relevant proxy group has a working choice.
- Save a baseline: test one browser and one application that does not normally follow the system proxy, if you have a safe test case.
- Reduce overlapping tunnels: disconnect other VPNs or traffic-redirection tools temporarily for the initial test.
- Keep security controls intact: do not disable Windows Defender Firewall or your organization’s endpoint protection to make TUN start.
Finally, check that you are using a Clash Verge Rev release compatible with your Windows version and its bundled Mihomo core. A setting may be present in the interface while the underlying core fails to create or maintain the required tunnel. If an update recently changed the behavior, note the exact client and core versions before reinstalling anything. Version information is much more useful in a support request than a screenshot that only says “TUN is on.”
Enable TUN mode and approve the permission prompt
Open Clash Verge Rev and locate its settings or network configuration area. Find the TUN section, enable the TUN option, and save or apply the change if the interface requires it. Depending on the build, there may also be options for the virtual interface name, stack implementation, route handling, DNS hijacking, or automatic route configuration. Do not change every advanced option at once. Start with the client’s defaults unless you have a specific reason to alter them; defaults are usually the easiest state to diagnose.
Windows may display a User Account Control prompt when the client needs elevated permission to create or configure the virtual network interface. Read the prompt and verify that the application publisher and file are consistent with the trusted build you installed. Approve it only if you intended to enable TUN and trust the executable. If the prompt is declined, the setting may remain selected in the interface while the tunnel itself fails to start. Reopen the TUN panel and check the reported status rather than assuming that clicking the toggle completed the setup.
Some client builds install or use a virtual network component as part of this process. A new adapter can become visible in Windows network settings, but its name and display state depend on the build and operating system. Do not disable or uninstall an adapter just because it appears unfamiliar immediately after you enabled TUN. First verify that it belongs to the client and check the client’s logs for a matching startup message. If Windows reports that a driver cannot be installed or started, record the exact wording; it may indicate a permission restriction, an incompatible component, or a conflict with another network product.
After enabling the option, give the core a moment to initialize. Look for a clear running or connected state in the TUN panel and inspect the Mihomo logs for errors around interface creation, route setup, or DNS configuration. A visible toggle alone is not conclusive. If the client offers a restart or reload action, use its own control rather than repeatedly switching the option on and off. Repeated toggles can leave you unsure which configuration is active and make it harder to connect a log message to the change that caused it.
For an initial check, leave the profile’s routing mode and rule set unchanged. Open a site that you know is reachable through the selected proxy and check whether the connection appears in Clash Verge Rev’s Connections view. Then try one application that previously ignored the system proxy. When possible, choose an ordinary, non-sensitive test destination rather than starting with a work account, a payment flow, or an online game. A narrow test reduces the risk of misreading a policy issue as a tunnel failure.
Verify traffic routing without guessing
Use evidence from the application and the client together. If a test application loads but no corresponding connection appears in Clash Verge Rev, it may not be using the route you expected, or the connection may have been established before TUN started. Close and reopen the application, repeat the test, and check the Connections view again. For an app with persistent background services, a full application restart—or a Windows sign-out and sign-in if needed—can help ensure that its old sockets are not being reused.
When a connection does appear, inspect its destination, process, rule, and selected policy where available. A connection assigned to a proxy group confirms that the profile is routing it through that group; a connection marked DIRECT may be correct if your rules intentionally exclude local or trusted destinations. Do not force all traffic to a proxy just because one service failed. First identify the rule that matched and determine whether the behavior is expected. Changing to Global mode can be a temporary diagnostic comparison, but it is not a substitute for understanding the rule that should handle the application.
DNS deserves particular attention because TUN can interact with name resolution differently from system-proxy mode. If an application connects by hostname but fails while IP-based tests behave differently, inspect the active profile’s DNS settings and Mihomo logs. A DNS response that is stale, blocked, or inconsistent with the routing mode can make the tunnel appear broken even when the virtual interface is running. Avoid copying DNS addresses or advanced YAML snippets from unrelated profiles without understanding their effect; providers and network environments do not all use the same DNS design.
Test several types of traffic only after the first, simple check succeeds. A browser page mostly confirms that one web request can complete. A desktop updater, a command-line request, or a service that uses a different protocol can reveal that an application follows different networking behavior. UDP-dependent software may need separate attention because the profile, selected node, and network path must all support the required traffic. If web browsing works but voice, gaming, or real-time traffic does not, record that distinction instead of describing the entire tunnel as offline.
Use a short, repeatable test sequence and change only one variable at a time:
- Confirm that TUN reports itself as running and that the profile remains selected.
- Open a new browser session and check the matching entry in Connections.
- Restart one application that normally ignores the Windows system proxy, then repeat its test.
- Check the matched rule and policy group for each connection, including any unexpected
DIRECTresult. - Review recent logs for interface, route, DNS, or proxy errors at the time of the test.
Keep a note of the selected profile, mode, and test time. If a connection fails only on one Wi-Fi network, compare it with another permitted network before editing the profile. Captive portals, campus networks, hotel Wi-Fi, and corporate access controls can impose their own restrictions. TUN cannot make a blocked or unavailable upstream service reachable, and it should not be used to evade rules that apply to the network you are using.
Fix startup failures and VPN conflicts methodically
If TUN does not start, begin with the client’s exact error rather than changing unrelated Windows settings. A permission or access-denied message points toward elevation or device policy. A driver or adapter error points toward the tunnel component, a compatibility problem, or another tool managing a conflicting interface. A route-configuration error may indicate that another VPN changed network routes or that Windows rejected the requested configuration. Save the relevant log lines and note whether the failure began after a client update, a Windows update, or installation of another networking application.
Next, make a controlled conflict test. Disconnect other VPN and proxy applications using their normal controls, then restart Clash Verge Rev and try TUN again. Do not remove corporate security software or manually delete system routes to force the test. If TUN works only after a second VPN is disconnected, you have useful evidence of an overlap; you still need to decide which tool is permitted to own the connection. On a managed device, consult the administrator instead of choosing a workaround that could interrupt required security or access controls.
If the setting is enabled but traffic is still not routed as expected, verify the selected profile and routing mode before reinstalling the client. A profile can load successfully while its rules send a particular destination directly, and an application can keep using an old connection until restarted. Check the relevant connection in the logs, identify the matching rule, and temporarily compare with a known-good profile only if you are allowed to do so. Restore your original configuration after the test, especially if the alternative profile has different DNS, bypass, or access policies.
For DNS or partial-connectivity problems, change one DNS-related setting at a time and preserve a copy of the original profile. Confirm whether the failure affects all applications or only hostnames, and whether a fresh connection changes the result. If you use a custom YAML configuration, be cautious about editing generated subscription content directly: a later profile update may overwrite the change, and an invalid edit can prevent Mihomo from loading. Prefer the client’s supported override or profile-editing mechanism when available, and keep a known-good copy so you can revert promptly.
Finally, distinguish tunnel health from service health. A running TUN interface and visible Connections entries do not prove that the selected node is available, that an account is authorized, or that the destination service is responding. Compare with a second known-good destination, check the proxy group’s current selection, and inspect the relevant response or error. If only one service fails while other traffic is correctly routed, focus on that service’s endpoint, policy, or account rather than repeatedly reinstalling the network adapter.
Compared with a browser-only proxy toggle, TUN can cover more Windows applications without asking each one to support proxy settings; compared with some all-or-nothing VPN clients, Clash Verge Rev also lets your profile apply rules and proxy groups to individual destinations. That flexibility does require a little more care with permissions, DNS, and competing adapters, but the checks above make those parts observable rather than mysterious. If you want to set up the client and review the available builds for your device, you can start from the download page.