TUN Mode Explained: How It Works and How to Enable It
On this page
TUN mode is how a proxy client stops asking applications for permission. Instead of publishing a proxy address and hoping programs read it, the client creates a virtual network adapter, tells the operating system to route traffic through it, and handles the packets that arrive. Applications never get a say, because by the time their data exists it is already on the client's interface.
That single idea explains both the appeal and the cost. TUN mode covers software that ignores proxy settings — games, command-line tools, background services — but it needs elevated privileges to create an interface and rewrite routes, and it takes DNS handling into its own hands.
Below: how TUN mode works, when you genuinely need it, what each platform requires, how to switch it on in Clash Verge Rev, and what to check when it goes wrong.
How TUN mode works
A TUN device is a virtual network interface: it looks like a network card to the operating system, but behind it sits a program instead of a cable. When TUN mode is on, the client creates such an interface and installs routes that make it the path outbound traffic takes. The kernel hands each matching IP packet to the core, which reassembles the connections, matches them against your routing rules, and forwards them through the selected server or straight out to the internet.
Because this happens at the network layer, coverage does not depend on application cooperation. It also makes DNS part of the client's job: the core intercepts lookups so domain-based rules can work at all, which is why TUN and DNS settings are so tightly linked. Most clients use a fake-ip scheme here — the core answers queries with placeholder addresses from a reserved range and resolves the real destination when the connection is made. Worth understanding before you troubleshoot, and covered in the DNS configuration guide.
When you actually need it
- Applications that ignore proxy settings. Games, launchers, peer-to-peer clients, anything with its own networking stack. If a program has no proxy option at all, TUN is the answer.
- Terminal work. One switch instead of exporting proxy variables in every shell and configuring each tool separately.
- Background services and system components, which were never designed to be configured by you in the first place.
- Protocols beyond HTTP. A system proxy handles HTTP and SOCKS; a TUN interface sees whatever the application sends.
For plain browsing it is unnecessary. The system proxy already covers browsers and mainstream apps, needs no privileges, and is far easier to debug.
What TUN requires on each platform
Creating a network interface is a privileged operation everywhere, so every platform asks for something:
- Windows — a background service, installed once from the client (usually labeled service mode). Without it the TUN switch either refuses to stay on or demands administrator elevation on every launch.
- macOS — administrator authorization the first time, so the client can install its privileged helper and adjust network settings.
- Linux — privileges to create the interface, granted through the client's helper or capabilities on the binary; the app walks you through it.
- Android — nothing beyond the VPN permission prompt shown on first connect.
Careful: a client that cannot obtain these privileges will show the toggle turning itself back off, sometimes without an obvious error. If TUN will not stay enabled, check the privilege step before anything else.
Enabling TUN in Clash Verge Rev
- Set the client up first, with a working subscription and a selected node — grab it from the download center and get the system proxy working before adding TUN to the picture.
- Open the settings page and install the service component when prompted, confirming the elevation dialog your system shows.
- Turn on the TUN Mode switch. The client creates the virtual adapter and adjusts routing.
- Optionally turn the system proxy off. Leaving it on is harmless, but keeping one mode active makes behavior easier to reason about.
- Verify with something the system proxy never covered — a command-line tool with no proxy configured, for instance.
Menu labels reflect the current 2.5.2 release and can move slightly between versions, so match the meaning rather than the wording.
Android: same mechanism, different name
On Android there is no TUN switch to find, because starting the tunnel is TUN mode. Clash Meta for Android and FlClash both use the system VPN service, which hands the app a virtual interface exactly like a desktop TUN device. That is why the permission dialog says VPN and why every app on the phone is covered without per-app configuration. One consequence is worth knowing: only a single app can hold the VPN interface at a time, so any other VPN client must be stopped first.
When TUN misbehaves
- No internet at all after enabling. Usually DNS. The core intercepts resolution in TUN mode, so a broken DNS section takes the whole machine offline rather than just the browser. Turn TUN off to confirm connectivity returns, then review that part of your configuration.
- Conflicts with other VPN software. Two tools competing for the default route rarely coexist gracefully — disconnect the other client first.
- The switch turns itself off. Privileges: reinstall the service component on Windows, re-authorize on macOS.
- A local resource became unreachable. LAN addresses may now take a different path; check your rules for the direct routes your network needs.
- Turning it off. Disable TUN inside the client rather than killing the process, so it can remove its routes cleanly. If a crash leaves things stale, restarting the client resets them.
Still unsure whether you need TUN at all? The practical trade-offs are compared side by side in TUN mode versus system proxy.