How to Set Up TUN Mode in Clash Verge Rev on Windows 11

What TUN Mode Does in Clash Verge Rev

Clash Verge Rev normally works through the Windows system proxy. When that option is enabled, applications that respect Windows proxy settings send their HTTP, HTTPS, or SOCKS traffic to Clash. This is convenient for browsers and many desktop tools, but it is not universal. Some games, command-line utilities, launchers, virtual machines, background services, and applications with their own network stack may ignore the system proxy completely.

TUN mode solves that limitation by creating a virtual network interface in Windows 11. Instead of waiting for every application to understand proxy settings, Clash can capture traffic at the network layer and pass it through the configured rules and proxy groups. This is why users search for “Clash Verge Rev TUN mode” when a browser works but a game, Git client, terminal, or other application still connects directly.

TUN mode is not exactly the same as a traditional full-device VPN. It is a transparent traffic-capture feature provided by the Clash core, and its behavior depends on the core version, routing mode, DNS configuration, and permissions granted to the client. TCP traffic is usually the easiest to verify. UDP support may depend on the selected core and the application, so a successful TUN setup does not guarantee that every UDP-based game or voice service will be proxied correctly.

What You Need Before Enabling TUN

Before changing Windows network settings, install a current Clash Verge Rev build that supports the Mihomo or compatible Clash Meta core. Older or unofficial packages may show a TUN switch but fail to create the adapter correctly. Download the Windows installer from the Windows download section, then install it under a normal user account unless your organization requires a managed installation.

You also need a subscription URL or a local YAML profile. Clash Verge Rev does not include proxy servers after installation. Import the profile in the Profiles page, update it, and activate the configuration. Confirm that proxy nodes appear and that at least one node passes a delay test. If the profile is invalid, TUN troubleshooting will be misleading because the virtual interface may be working while every connection is being rejected by the core.

Close other VPN clients and transparent proxy tools during the first setup. WireGuard, OpenVPN, game accelerators, corporate endpoint security, Hyper-V, WSL, VirtualBox, and VMware can all create virtual adapters or firewall rules. They are not automatically incompatible with TUN mode, but running several traffic interceptors at once makes it difficult to identify which component owns a connection.

Step 1: Authorize Service Mode

Clash Verge Rev needs elevated privileges to create and manage the TUN adapter. The exact wording can differ slightly between releases, but the relevant control is usually located in Settings, General, or a page named Service Mode. Open Clash Verge Rev and look for an option such as Install Service, Service Mode, or Manage Service.

1. Launch Clash Verge Rev and open its settings area.
2. Find the Service Mode section and choose Install or Enable.
3. Accept the Windows User Account Control prompt using an administrator account.
4. Wait until the interface reports that the service is installed or running.
5. Restart Clash Verge Rev if the client asks you to do so.

Service Mode is different from simply running the graphical interface as administrator. The service gives the Clash core a controlled way to request the permissions needed for adapter creation and traffic redirection. Running the entire application with elevated privileges may appear to fix a problem temporarily, but it is not the preferred long-term arrangement.

To inspect the result, open Windows Services by pressing Win + R, entering services.msc, and confirming that the Clash-related service exists. You do not need to change its startup type unless the client documentation specifically instructs you to do so. If the service disappears after every reboot, reinstall it from Clash Verge Rev and check whether endpoint security software is removing the service definition.

Step 2: Turn On TUN Mode in Windows 11

After Service Mode is authorized, open the Clash Verge Rev dashboard or settings page and locate TUN Mode. In some builds it appears under the general mode controls; in others it is inside a section called Service, Network, or Experimental. Enable the switch and wait several seconds. The client may briefly recreate network routes or display a Windows permission prompt.

1. Make sure the intended profile is active.
2. Set the operating mode to Rule unless you specifically need Global mode for testing.
3. Enable TUN Mode.
4. Enable the option that allows the client to automatically manage the TUN service or interface, if your build provides one.
5. Keep System Proxy enabled while testing, then decide later whether you still need it.
6. Choose a proxy group and node that you have already verified as reachable.

For many Mihomo-based configurations, TUN settings are represented in YAML with values similar to the following:

tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true

The graphical interface may write these options for you. Avoid adding duplicate tun: sections manually unless you understand which profile takes precedence. auto-route lets the core install routes for captured traffic, while auto-detect-interface helps it select the active Windows network interface. The mixed stack is commonly useful because it can handle both TCP and UDP paths more flexibly than a TCP-only setup, although the best choice depends on the core and your network.

Some profiles use a different stack name or expose fewer options. Do not copy a configuration from a different Clash fork without checking compatibility. An unknown field can cause the profile to fail validation, while a valid but unsuitable DNS section can make TUN appear broken even when the adapter itself is active.

Step 3: Verify That Applications Use the Tunnel

A TUN toggle that stays blue is not proof that traffic is being proxied. Verification should happen at three levels: the Windows adapter, the Clash connection log, and the application itself. Start with the adapter by opening Settings → Network & internet → Advanced network settings. Depending on the core, Windows may show a virtual adapter with a name related to Mihomo, Clash, or Wintun. The exact name is not universal, so focus on whether a new virtual interface appears after TUN is enabled.

Next, open the Clash Verge Rev connections or logs view. Visit a website from a browser, launch a program that previously ignored the system proxy, or run a command from PowerShell. You should see the destination hostname, the matched rule, the selected policy group, and the final outbound connection. A connection marked DIRECT is not necessarily an error: local domains may be intentionally excluded. For a test domain that should be proxied, confirm that the rule selects a proxy group rather than DIRECT or REJECT.

PowerShell can help you separate DNS problems from routing problems:

nslookup example.com
Test-NetConnection example.com -Port 443
curl.exe -I https://example.com

These commands are only diagnostic signals. A successful nslookup proves name resolution, not that the request used the proxy. The Clash connection log is the more useful source for confirming capture. If the application works only after System Proxy is enabled, it may still be using the regular proxy path rather than TUN. Temporarily disable System Proxy after the initial test and repeat the request from an application known to ignore Windows proxy settings.

Troubleshoot Common TUN Mode Problems

The TUN switch will not stay enabled

This usually points to missing elevation, a stopped Service Mode service, or a conflict with another virtual network component. Exit Clash Verge Rev completely, confirm the service exists in Windows Services, and reopen the client. If the issue continues, remove and reinstall the service from the client settings rather than installing multiple services with similar names. Temporarily pause third-party firewall or endpoint-control software only for a controlled test, and restore protection immediately afterward.

TUN starts but Windows loses internet access

First disable TUN and check whether ordinary connectivity returns. If it does, the problem is likely in route installation, DNS, or the active profile. Verify that the configuration contains a valid DNS section, that the selected proxy group has a working node, and that the default rule set does not send all traffic to a dead policy. Rebooting Windows can clear stale routes, but it should be a diagnostic step rather than the only solution.

IPv6 is another frequent source of confusing results. If your profile handles IPv4 but not IPv6, an application may obtain an IPv6 address and connect outside the path you are testing. For troubleshooting, use a profile with consistent IPv6 behavior or temporarily disable IPv6 only if your network administrator permits it. Do not permanently change adapter properties without understanding the effect on other services.

DNS, certificate, and login failures

When DNS is inconsistent, the Clash log may show a hostname while the application reports a timeout, certificate mismatch, or repeated login failure. Browsers can also enable their own DNS-over-HTTPS setting and bypass the resolver path you expect. During testing, use one DNS strategy: let Clash manage resolution, or deliberately configure the application and Windows to use the same documented resolver. Avoid stacking browser DoH, another VPN DNS service, and TUN DNS redirection until the basic route works.

Certificate errors should not be “fixed” by permanently disabling TLS verification. Check the Windows clock, captive portals, security inspection software, and the selected node first. If only one application fails, compare its certificate behavior with a browser and inspect whether it uses certificate pinning. Some applications reject transparent interception by design and may require a direct route or their own supported proxy setting.

Games and UDP applications still connect directly

Games often use UDP, custom launchers, anti-cheat drivers, or multiple helper processes. Confirm that the selected Clash core and TUN stack support the traffic type, then watch the log while the game is running. A launcher may be proxied while the game executable is not, so test every relevant process. Firewall rules can also block the virtual adapter even though browser traffic works. Create a narrow exception only when you understand the security implications, and avoid disabling the Windows firewall globally.

Recommended Settings for a Stable Windows 11 Setup

For most users, a sensible starting profile is Rule mode with TUN enabled, automatic route detection, a reliable DNS configuration, and a small number of clearly named proxy groups. Keep System Proxy enabled if you use browsers or applications that explicitly read Windows settings; disable it only when you have confirmed that TUN captures the traffic you need. Running both mechanisms is not automatically wrong, but it can make debugging confusing and may create unexpected behavior in applications that detect a system proxy.

• Update Clash Verge Rev and its core before diagnosing an issue that appeared after a Windows update.
• Update subscriptions periodically, but keep a known-good backup profile before accepting major provider changes.
• Use the Clash log to identify the matched rule instead of guessing from whether a page loads.
• Keep separate profiles for normal browsing, testing, and networks with captive portals.
• Restart the client after changing Service Mode, TUN stack, DNS, or route-related settings.
• Document changes to virtual adapters and firewall rules so they can be reversed cleanly.

Compared with simple system-proxy utilities, some competing desktop tools require per-application proxy rules, browser extensions, or manual configuration for every program that ignores Windows settings. They may also offer limited visibility into DNS, routes, and rule decisions, which makes failures difficult to diagnose. Clash Verge Rev brings TUN capture, rule-based routing, subscription management, connection logs, and selectable proxy groups into one interface, so the same Windows 11 setup can cover browsers and many proxy-unaware applications without repeating configuration work. If you want a more transparent and flexible way to manage these routes, Download Clash for Windows and try the workflow described above.