TUN Mode vs System Proxy: Which One Should You Actually Use?

Every Clash-family client offers two main ways to get your traffic into the core: the system proxy, a polite request that applications route through a local port, and TUN mode, a virtual network interface that takes everything by force. Choosing between TUN mode and the system proxy is the most common configuration decision after importing a subscription — and the short answer is: system proxy for everyday browsing, TUN when you need full coverage.

This article compares the two honestly — coverage, permissions, complexity and failure modes — so you can pick deliberately instead of toggling switches until something works.

The two modes at a glance

Coverage: voluntary vs enforced

The system proxy is a declaration, not a mechanism. Your client writes "use 127.0.0.1 on this port" into the OS network settings, and each application decides whether to respect it. Browsers and most mainstream apps do. Many command-line tools, some games, and any program with its own networking stack simply ignore it — their traffic bypasses the proxy entirely, and no client-side setting can change that.

TUN mode removes the choice. The client creates a virtual network adapter and installs routes so the operating system itself sends all IP traffic through it. Applications cannot opt out because they never get asked — by the time their packets exist, they are already on mihomo's interface. That is why TUN requires elevated privileges: on Windows, Clash Verge Rev installs a system service for it, and mobile systems express the same idea through the VPN permission. The TUN mode deep dive covers how to enable it on each platform.

Stability and performance in practice

Neither mode has a meaningful speed advantage for ordinary use — your bottleneck is the proxy server and your line, not the local plumbing. The difference is operational. The system proxy has fewer components, so when something breaks the cause list is short. TUN adds routing table changes and DNS interception; it works well once set up, but a misconfigured DNS section can take the whole machine offline rather than just the browser. The practical rule: TUN is not fragile, but it concentrates more failure modes in one place, and its problems look scarier than they are.

Which should you use?

• Daily browsing, streaming, web apps — system proxy. It covers everything you touch and is trivial to reason about.
• Games, terminal tools, or any app that ignores proxies — TUN mode is the reliable fix.
• You keep discovering apps that "leak" around the proxy — stop chasing them individually and switch to TUN.
• Something is broken and you are debugging — drop back to the system proxy first; fewer variables.

How the system proxy works under the hood — including the environment-variable trick for command-line tools — is covered in the system proxy explainer.

Running both, and switching cleanly

Leaving the system proxy on while TUN is active is usually harmless — traffic that follows the proxy setting still lands in the same core — but it muddies debugging, because you can no longer tell which path a connection took. When investigating any problem, keep exactly one mode active. When turning things off, disable the mode inside the client rather than killing the process, so it can restore system settings; a proxy setting left behind by a crashed client is a classic cause of "no internet with the client closed", explained in the common errors guide.

The bottom line

• System proxy: zero-privilege, transparent, covers cooperative apps — the right default.
• TUN mode: total coverage at the cost of privileges and a little complexity — the right tool when coverage is the point.
• One at a time while troubleshooting; the client's own toggles when switching.