How to Enable TUN Mode in Clash Verge Rev on Windows

What TUN Mode Does in Clash Verge Rev

Clash Verge Rev’s TUN mode creates a virtual network interface on Windows and routes selected network traffic through the Clash core. This is different from the familiar System Proxy switch. A system proxy asks Windows applications to use a local HTTP or SOCKS proxy; applications that ignore those settings may connect directly. TUN mode works at the network-interface level, so it can capture more traffic from desktop apps, launchers, command-line tools, and games that do not offer their own proxy setting.

TUN does not automatically mean that every connection will use a proxy node. The active profile’s routing rules still decide whether a connection is sent to a proxy, goes directly to the internet, or is rejected. If a rule sends a destination to DIRECT, TUN can capture the traffic and the rule can still let it leave without a proxy. TUN changes how traffic reaches the Clash core; it does not replace the profile, proxy group, or rule configuration.

It is also useful to separate TUN mode from a full-device VPN. The virtual adapter can capture traffic that the Windows system proxy misses, but behavior depends on the client, the Mihomo core, the profile, DNS settings, and Windows networking. Some applications use their own encrypted DNS or network stack, and some connections may require additional routing or DNS configuration. Treat TUN as a broader traffic-capture method, not a guarantee that every app behaves identically.

Before You Enable TUN Mode

Start with a working Clash Verge Rev installation and an active profile. TUN cannot compensate for an expired subscription, an invalid configuration, or a proxy group with no usable nodes. First confirm that the profile loads without errors, select a node or group that is known to work, and test an ordinary browser connection with your existing proxy method. This gives you a reliable baseline: if browsing already fails before TUN is enabled, solve that problem first.

• Use a supported Windows version. A current 64-bit Windows 10 or Windows 11 installation is a sensible starting point. Keep Windows networking components and the client reasonably up to date.
• Use a trusted Clash Verge Rev build. Download the installer from a source you trust, and avoid replacing the Mihomo core with an unrelated or unofficial executable to troubleshoot TUN.
• Be prepared to approve elevated access. Creating or configuring a virtual network adapter requires system-level changes. Depending on the client version and installation, Windows may show a UAC prompt or the application may provide a service-installation control.
• Check for other network tools. VPN software, endpoint-security products, packet filters, virtual machines, and other proxy clients can install adapters or routing rules that conflict with TUN.
• Know how to turn it off. Before testing, locate the TUN switch and keep access to Clash Verge Rev’s logs. If connectivity stops, you should be able to disable TUN and return to your previous setup.

Administrator permission should be granted only to the client you intentionally installed. If Windows displays a publisher or file name that does not match the expected application, cancel the prompt and verify the installer. TUN changes affect the computer’s network path, so do not approve an unknown helper merely because a guide says that administrator access is required.

Also record your current state before changing anything. Note whether System Proxy is enabled, which profile is active, and whether another VPN is connected. This makes it easier to identify what changed if DNS or routing behaves differently after TUN starts. Avoid changing DNS, firewall rules, adapter metrics, and profile routing all at once; changing one variable at a time makes troubleshooting much more useful.

Enable TUN Mode in Clash Verge Rev

Clash Verge Rev’s labels and layout can vary between releases, and Windows may display permission prompts differently depending on how the application was installed. The usual workflow is to open the application’s settings, enable TUN mode, approve the required Windows operation, and confirm that the virtual adapter becomes active. If a control is named differently in your build, use the TUN or network section shown by that version rather than copying a menu path from an older screenshot.

1. Open Clash Verge Rev and load your profile. Confirm that the intended profile is selected and that the core starts without a configuration error. If the client provides a connection or log view, leave it available for the next checks.
2. Find the TUN setting. Open the application settings and look for a section labelled TUN, network, or core settings. Read any explanatory text shown beside the switch; some releases expose service or stack options in the same area.
3. Install or start the required service if prompted. Some Windows setups need a client service or elevated helper to create the virtual interface. Use only the control supplied by the trusted Clash Verge Rev installation. Approve the UAC request only after confirming that it belongs to the application you launched.
4. Turn on TUN mode. Enable the switch and give Windows a moment to create or activate the adapter. A brief pause while the network stack updates is normal. Do not repeatedly click the control while the application is still starting the core.
5. Check the resulting state. Return to the TUN settings and confirm that the mode remains enabled. If the application reports a startup error, note its exact wording before restarting or changing other settings.
6. Test with one application that previously bypassed System Proxy. Keep the test narrow at first. Use an application and destination you know should be reachable through the selected proxy, then inspect the Clash connection view to see whether a connection appears and which policy handles it.

On some versions, the TUN feature may depend on a service that is installed once and then started when needed. On others, enabling the setting may trigger the required Windows prompt directly. Do not assume that a missing prompt means the adapter is already working: verify the status in the client and in Windows. Likewise, seeing a virtual adapter in Windows is useful evidence, but it does not prove that the profile is routing the test application to a proxy.

It is not always necessary to keep System Proxy enabled alongside TUN. TUN is intended to capture traffic through the virtual interface, while System Proxy changes Windows proxy settings for applications that consult them. Start with the configuration recommended by your client version, test the target application, and avoid enabling both methods merely because one switch appears inactive. If you do use both, check that the application is not sending the same request through an unexpected or duplicated path.

Verify the Adapter, Routing, and DNS

After enabling TUN, verify the whole path rather than relying on one green status indicator. A useful test has three parts: the client reports that TUN is active, Windows has an available virtual adapter, and a real application connection appears in Clash’s connection list. If any one of these is missing, you have a more precise starting point than simply saying that “the proxy does not work.”

To inspect Windows adapters, open Settings → Network & internet → Advanced network settings, or open the classic Network Connections panel. The exact name of the adapter depends on the core and client version. Look for a newly present or active virtual interface associated with the client, but do not disable your Wi-Fi or Ethernet adapter to make the virtual one appear more prominent. Physical adapters normally remain enabled because they provide the underlying internet connection.

Next, generate traffic from the application that motivated you to use TUN. Open a connection view or log in Clash Verge Rev and look for the destination, selected rule, policy group, and final outbound. A connection marked DIRECT may indicate that the profile intentionally routes that destination directly; it does not necessarily mean that TUN failed to capture it. If no connection appears at all, check whether the app is using a different network path, whether TUN is actually running, and whether security software is blocking the virtual interface.

DNS deserves a separate check because it can make a working tunnel look broken. A browser might resolve a hostname using secure DNS, while another application uses Windows DNS. The profile’s DNS settings and the TUN implementation determine how name requests are handled. For a controlled test, use the same hostname in one application at a time and compare its behavior with the Clash logs. If requests by IP work but requests by hostname fail, investigate DNS before replacing proxy nodes or rewriting routing rules.

When testing an IP-address lookup, remember that a successful lookup alone does not prove that the requested application used a proxy. It only confirms that name resolution returned an answer. Combine DNS checks with the connection entry and its policy. Similarly, a page loading successfully does not prove that every application is routed through TUN; test the exact program that previously ignored the Windows system proxy.

Keep a simple record of the test: the application, destination, selected profile, observed policy, and whether the connection completed. This helps distinguish a capture problem from a rule problem. If the connection appears as DIRECT but should use a proxy, review rule order and the selected proxy group. If the connection appears with the expected proxy policy but fails, test another known-good node and check the core logs for a remote timeout or protocol error.

Fix Common TUN Startup Problems

The TUN switch turns off or reports an error

First read the client’s error message and core log. A service that is missing, stopped, or unable to obtain the required permission can prevent the interface from starting. Close and reopen Clash Verge Rev, approve a legitimate UAC prompt if one appears, and use the application’s own service control if your version provides one. Restarting Windows can clear a stale adapter state, but it should not be the first response to every error; capture the message before rebooting so you do not lose useful evidence.

If the service appears installed but will not start, check whether Windows Security, a third-party antivirus, or an organization-managed policy has blocked the client’s helper. Do not turn off security software wholesale. Review its alert history and, where appropriate, allow only the verified application component. On a work or school computer, administrator policy may prevent virtual adapters or network services; contact the device administrator rather than attempting to bypass those controls.

TUN starts, but the target app still has no connection

Check whether the test application generates a new connection after TUN is enabled, then look for that destination in the Clash connection list. If it appears, inspect its rule and outbound before changing adapter settings. A direct rule, an unavailable proxy group, or a profile that does not contain the expected node can all produce a result that looks like failed capture. Choose a working proxy group and test again before editing YAML.

If no entry appears, temporarily close and reopen the target application so it creates fresh connections. Some applications keep long-lived sockets or use their own VPN, proxy, or secure networking component. Also check whether another tunnel client is active. Do not remove unrelated virtual adapters as a trial-and-error fix; first identify which product created them and whether it is needed.

Windows loses internet access after TUN is enabled

Turn TUN off from Clash Verge Rev and check whether the normal connection returns. If it does, the issue is likely connected to TUN startup, DNS, route selection, or a conflict with another network tool rather than a general outage. Re-enable TUN only after confirming the active profile and a usable node. If connectivity does not return, check that the physical Wi-Fi or Ethernet adapter remains enabled, disconnect any conflicting VPN in the normal way, and restart the client before making system-level route changes.

Avoid manually deleting routes, resetting every adapter, or changing interface metrics unless you know what the change will do. Those actions can disrupt local network access and make the original cause harder to find. Prefer reversible steps: disable TUN, close conflicting clients, restart Clash Verge Rev, and test with a known-good profile. If the problem began immediately after a client or core update, record the version and include the relevant log excerpt when asking for support.

The app connects, but uses the wrong route

When the connection is visible in Clash, the first suspects should usually be the profile’s rules and proxy group, not the adapter. Confirm that the destination matches the rule you expect and that the selected group points to a working node. A broad direct rule earlier in the rule list can match before a more specific proxy rule. Change only the relevant rule or group, then repeat the same test and compare the connection entry.

If routing appears correct but hostnames fail, inspect the profile’s DNS configuration and the application’s own secure-DNS settings. Some apps can bypass ordinary system DNS behavior, so a test in a browser may not represent a command-line tool or game launcher. Avoid copying DNS values from an unrelated tutorial without checking what your core and profile support. Make a backup of any custom profile before editing it, and prefer the client’s supported settings over undocumented changes.

Use TUN Mode Reliably

Once the target application works, keep the setup as simple as possible. Leave the profile, TUN option, and rule mode that passed your test unchanged, and avoid adding several DNS overrides or adapter tweaks without a specific reason. If you update Clash Verge Rev or its core, repeat a short check: confirm TUN starts, test one previously bypassing application, and inspect its policy in the connection view. Updates can change interface details or core behavior, so a quick verification is more reliable than assuming an old result still applies.

For everyday use, know how to recover when a proxy node becomes unavailable. Switching to another healthy group member is often safer than changing Windows networking. If you need to disable TUN, use the client’s switch and wait for the interface state to settle; then confirm that ordinary connectivity returns. Do not leave an unneeded tunnel service running simply because it once fixed an application, and do not treat a TUN adapter as a replacement for a trusted network-security product.

Some lightweight proxy clients expose only a basic system-proxy toggle, which is convenient but can leave command-line tools or applications that ignore Windows proxy settings untouched. Clash Verge Rev gives you a rule-based core and TUN capture in one Windows interface, so you can route those connections through the same profile and inspect how each request is handled. If that broader control fits your setup, you can download Clash for Windows and try TUN mode with a profile and node you trust.