Clash Mode Comparison

What TUN mode does on Windows

TUN mode lets Clash Verge Rev capture more Windows traffic than the system proxy setting alone. It creates a virtual network interface and routes selected traffic through the Mihomo core, where the active rules and proxy policies decide what happens next. This is useful for applications that do not follow Windows’ system proxy, including some command-line tools, games, launchers, and desktop apps.

TUN is a traffic-capture method, not a routing mode or a proxy server. It does not choose a node by itself, make a slow connection faster, or guarantee that every process will use a proxy. The core still needs a working configuration, an appropriate operating mode, valid rules, and a usable outbound. In Rule mode, for example, captured connections are evaluated against the configuration’s rules; a matching policy group may still be set to DIRECT.

Before changing settings, note the Clash Verge Rev version, Windows version, and active profile. Menu names can vary between releases, and a profile may supply DNS or routing options that affect TUN behavior. On Windows, press Win + R, enter winver, and record the version shown. Keep a copy of your current configuration or make sure the profile can be restored before troubleshooting.

• Use TUN when a specific application does not respect the system proxy, or when you need broader device-level traffic capture.
• Try the system proxy first if browser traffic is all you need to route; it involves fewer network-adapter changes.
• Do not enable TUN and another full-device VPN at the same time unless you understand how their adapters and routes interact.
• Keep the client and its Mihomo core current enough to support the TUN settings in your profile.

Check Windows and Clash Verge Rev first

Start with a working profile and confirm that ordinary proxy connections succeed before enabling TUN. If the selected node cannot connect, adding a virtual adapter will not repair the node or its credentials. In Clash Verge Rev, select the profile you intend to use, confirm that it has finished loading, and check that the core is running. If the client shows a configuration error, resolve that first rather than troubleshooting TUN and profile parsing at the same time.

Check the profile’s mode as well. Rule mode is a practical default for normal use, provided the rules and policy groups are configured as intended. Global mode can help compare routing behavior during a short test, but it does not fix traffic that never reaches the core. Direct mode routes captured traffic directly and is useful as a baseline when checking local connectivity. The mode affects routing after capture; it does not replace TUN or enable traffic capture on its own.

Close or disconnect other VPN clients for the first test, including work VPNs, if your organization permits it. Some endpoint-security products and network filters may remain active even after a VPN window is closed. If you manage a work device, check its policy before changing network settings; do not disable required security software just to force TUN to start.

Enable TUN mode in the client

Open Clash Verge Rev and go to its settings area. Find the section for the Mihomo core or network settings, then locate the TUN option. The exact label and location can change between releases; it may be displayed as “TUN Mode,” “TUN,” or a related toggle. If the option is not visible, check that you are using Clash Verge Rev rather than a different Clash client, and confirm that the installed core supports TUN.

1. Open Clash Verge Rev and confirm that the correct profile is selected and the core is running.
2. Open the application settings and find the TUN or Mihomo network settings. Read any description next to the toggle before changing related options.
3. Enable TUN. If the client asks to install, start, or repair a service, approve the Windows permission prompt only when it is clearly associated with Clash Verge Rev.
4. Wait for the interface or service to initialize. Check the client’s status and logs for a success message or a specific error before testing applications.
5. Open one application that previously ignored the system proxy and test a single site or connection. Keep other VPNs disconnected during this first test.

Some builds expose additional options such as a stack type, DNS hijacking, automatic route setup, or an interface name. Leave unfamiliar values at their defaults for the initial test. Changing several options at once makes failures harder to diagnose. If a setting is required by your network or profile, change only that setting, apply it, and test again.

Administrator elevation and a background service are not identical. Depending on the release and installation, the client may use a service to perform privileged network operations while the main interface runs under your regular account. If TUN fails, check whether the service is installed and running using the controls provided by the application. Avoid repeatedly starting the entire desktop app as administrator unless the client’s documentation specifically instructs you to do so; mixing elevated and standard launches can create confusing permission or data-directory behavior.

Verify traffic capture and routing

First verify that TUN started; then verify that traffic is actually reaching the intended outbound. These are separate checks. A virtual adapter appearing in Windows is evidence that an interface exists, not proof that a particular application is routed through a proxy. Likewise, a successful browser test may only show that the browser uses the system proxy if that setting remains enabled.

In Clash Verge Rev, check the connection or traffic view while opening the test application. Look for a new connection associated with that application, then inspect the matched rule and policy if the interface provides those details. The connection should show the expected outbound or policy group. If it shows DIRECT, TUN may be working correctly while the active rule or group sends that connection directly. Check the rule order and selected group before changing adapter settings.

You can also inspect Windows’ network adapters. Open PowerShell and run:

Get-NetAdapter |
  Sort-Object Status, Name |
  Format-Table Name, InterfaceDescription, Status, LinkSpeed -Auto

Look for an adapter associated with the client or its TUN implementation. Its displayed name can differ by version or installation, and its presence alone does not identify the route used by every connection. To inspect the active route table, run route print in Command Prompt or PowerShell. Do not delete routes or manually change interface metrics as a first-line fix; record the output and compare it with TUN off and on if you need to isolate a conflict.

• The adapter is present and the client records the test connection: Capture is likely working. Check the matched rule, policy group, and outbound if the observed destination is unexpected.
• The adapter is present but there is no test connection in the client: Confirm the test application really generated network traffic, then check TUN status, application exclusions, and core logs.
• The client records a connection but it fails: Check the selected node, DNS result, outbound protocol support, and the error shown in the connection or core log.
• Only browser traffic changes: The browser may be using the system proxy. Test a separate application known to ignore it, and compare its connection entry in the client.

For an additional route check, compare the public IP shown by the same test application or diagnostic tool with TUN off and on. Use a service you trust and avoid entering account credentials into unfamiliar test pages. A changed IP is useful evidence, but it is not a complete privacy or leak test: DNS behavior, excluded destinations, local-network routes, and applications with their own proxy settings can produce different results.

Fix common TUN problems without guessing

Permission or service errors

If the client reports that it cannot create the interface, check the exact error and service status first. Restart Clash Verge Rev once, approve a clearly identified Windows permission prompt, and use the application’s own service installation or repair control if one is available. If the service is missing or fails to start, save the application and core logs, note the client version, and check whether security software blocked the service or driver. Do not download a replacement driver from an unofficial mirror.

TUN starts, but some apps have no connection

Check whether the application is excluded from capture, whether its traffic uses a protocol or network path not handled by the current setup, and whether the active rules send it to an unsuitable policy. Test with one application and one destination at a time. For a name-resolution failure, compare the domain with a direct-IP test only as a diagnostic; an IP test can bypass DNS and does not prove that DNS is configured correctly. Review the profile’s DNS settings and the client’s TUN-related DNS options before editing the profile.

Internet access breaks when TUN is enabled

Turn TUN off from the client and confirm that normal connectivity returns. If it does, check for a second VPN, stale adapter state, conflicting route management, or a profile that directs required local or DNS traffic to an unavailable outbound. Re-enable TUN only after making one change at a time. Do not reset the Windows network stack or delete all virtual adapters before identifying which component created them; those actions can disrupt unrelated VPNs and work connections.

Another VPN or security product conflicts

Disconnect the other full-tunnel VPN and test again. If the two tools must coexist, consult the organization or product documentation for supported split-tunnel or interface-exclusion settings. There is no universal adapter priority that makes every VPN combination safe. A security product may also filter traffic below the application layer, so its logs can help distinguish a blocked connection from a Clash rule or node failure.

When reporting a persistent issue, include the Windows version, Clash Verge Rev version, core version if displayed, the exact error text, and whether the TUN adapter appeared. Redact subscription URLs, server addresses where sensitive, authentication tokens, and personal file paths before sharing logs or screenshots. These details are more useful than a vague report that “the VPN does not work,” and they help separate a permission problem from a routing or DNS problem.