How to Enable TUN Mode in Clash Verge Rev on Windows

Clash Verge Rev can route ordinary browser traffic through the system proxy, but that method does not cover every Windows application. Games, command-line tools, launchers, virtual machines, and apps with their own network stack may ignore Windows proxy settings completely. TUN mode solves this by creating a virtual network interface and allowing Clash to capture traffic at the system network layer. This guide explains how to enable TUN mode in Clash Verge Rev on Windows, grant the required permissions, choose sensible options, verify that traffic is actually being captured, and fix the most common startup and connectivity problems.

What TUN Mode Does on Windows

Windows normally sends traffic through the route table and network adapter selected by the operating system. When an application supports the system proxy, Clash can receive HTTP or SOCKS requests through the proxy address configured in Windows. This is convenient, but it depends on each application respecting those settings. Many programs do not. Some use a private proxy configuration, some connect directly through WinSock, and others communicate through UDP or custom protocols that a traditional HTTP proxy cannot handle correctly.

TUN mode works at a lower level. Clash Verge Rev creates a virtual network adapter, commonly backed by the Mihomo TUN implementation, and changes the routing behavior so that selected traffic is redirected into Clash. Clash can then inspect the destination, apply domain or IP rules, and send the connection directly or through a proxy group. From the application's perspective, it is still making a normal network request; the interception happens below the application layer.

This difference is important. Enabling TUN mode does not automatically mean that every connection will use a proxy. The final behavior is still controlled by your Clash configuration and rule mode. In Rule mode, matching rules decide whether traffic is proxied, sent directly, or rejected. In Global mode, most traffic is sent through the selected proxy group. In Direct mode, TUN may still capture traffic, but Clash will normally connect to destinations without using a proxy.

Prepare Windows and Clash Verge Rev

Before changing settings, close other proxy tools and check whether Windows is already using a VPN, transparent proxy, packet filter, or virtual network adapter. Running multiple traffic interception systems at the same time can produce loops, connection failures, or misleading test results. Common conflicts include another Clash client, Wintun-based VPN software, corporate security agents, traffic redirection utilities, and older proxy clients that install their own network service.

Use a recent Clash Verge Rev build that includes Mihomo core support and TUN-related options. The exact labels can differ slightly between releases, so do not rely only on the position of a switch. Look for terms such as TUN, Service Mode, Auto Route, Strict Route, and Stack. If a setting is missing, update the application or confirm that the selected core supports it.

It is also useful to establish a clean baseline before enabling TUN:

• Confirm that the selected profile loads without YAML errors.
• Check that at least one proxy node can connect successfully.
• Note whether ordinary browser traffic works through the system proxy.
• Record any existing DNS, VPN, or firewall software that could affect routing.
• Keep the profile backup available in case a new DNS or routing option needs to be reverted.

On Windows, TUN setup often requires elevated privileges because creating a virtual adapter and modifying routes are protected operations. An administrator account is helpful, but it does not always mean that the application is currently running with administrator rights. If the TUN switch appears to do nothing, close Clash Verge Rev, right-click its shortcut, select Run as administrator, and try again. Some versions instead use a separate service installation, described below.

Enable Service Mode and Required Permissions

Open Clash Verge Rev and select the settings area. Depending on the release, the relevant controls may be under Settings, System Settings, or a section named Service Mode. Service Mode allows the core or helper service to perform privileged operations without requiring the entire graphical interface to stay elevated all the time.

1. Exit any other Clash client or VPN-style traffic interception program.
2. Launch Clash Verge Rev with administrator privileges for the initial setup.
3. Open the Service Mode section and install or start the service if the interface provides an install button.
4. Approve the Windows User Account Control prompt.
5. Wait until the service status changes to running or installed successfully.
6. Restart Clash Verge Rev normally, then confirm that the service remains available.

If the service installation fails, open Windows Services and look for the Clash Verge Rev or Mihomo-related service entry. Do not delete unknown services simply because their names are unfamiliar; first verify that they belong to the application. A service that is installed but stopped should be started, while a service that repeatedly stops may indicate a permission conflict, a damaged installation, or a port and adapter conflict.

Configure TUN Options

After the permission layer is ready, open the TUN settings in Clash Verge Rev and enable the TUN switch. The following options are the ones that matter most on Windows.

• Auto Route: lets Clash add the routes needed to direct traffic through the virtual interface. It should normally be enabled for a desktop setup.
• Strict Route: applies stricter routing behavior and helps prevent traffic from bypassing the TUN interface. It can improve consistency, but may expose compatibility problems with local networks or unusual applications.
• Stack: controls the network stack used by the core. mixed is a practical starting point because it can handle TCP and UDP traffic with reasonable compatibility. Other choices may be useful for specialized environments.
• Auto Detect Interface: allows Clash to select the active physical network interface. This is useful for laptops that move between Wi-Fi and Ethernet.
• DNS Hijack: redirects DNS requests into Clash so that applications cannot easily bypass the configured DNS behavior. Enable it when you want consistent domain-based routing.
• IPv6: enable it only when your profile, proxy nodes, and local network are configured to handle IPv6 correctly. Otherwise, IPv6 can become an unexpected bypass path or cause slow fallback behavior.

A typical Mihomo-compatible TUN section may look like this:

tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true
  strict-route: false
  dns-hijack:
    - any:53

This example is a reference, not a universal profile fragment. Clash Verge Rev may write some values through its graphical interface, and the exact supported fields depend on the selected core version. Avoid adding options copied from a different Clash fork without checking compatibility. An unsupported field can prevent the profile from loading, while an incorrect DNS hijack value can make local services unreachable.

For most Windows users, start with mixed, auto-route: true, and automatic interface detection. Turn on strict routing only after the basic path works. If you use printers, network shares, enterprise intranet domains, or local development services, test those resources before deciding that stricter routing is appropriate.

Make DNS and Rules Work with TUN

TUN captures connections, but domain-based rules still depend on DNS information. If an application resolves a domain outside Clash, the core may see only an IP address. That can reduce the accuracy of DOMAIN, DOMAIN-SUFFIX, and related rules. It may also create DNS leaks or cause a domain to resolve to an address that is unreachable from the selected proxy node.

A modern Mihomo profile commonly uses fake-IP mode with DNS hijacking:

dns:
  enable: true
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  nameserver:
    - https://dns.cloudflare.com/dns-query
    - https://dns.google/dns-query
  fake-ip-filter:
    - "*.lan"
    - "localhost.ptlogin2.qq.com"

Do not copy this block blindly into a managed subscription profile. Some providers generate their own DNS section, and manually merging two competing sections can create duplicate keys or unexpected precedence. The practical goal is to ensure that DNS requests from TUN-captured applications are handled by the same Clash core that makes the routing decision.

Pay attention to private addresses and local domains. A broad proxy rule can accidentally send printer discovery, router administration, or company resources to a remote node. Keep private networks direct unless your environment specifically requires otherwise:

• 127.0.0.0/8 for local loopback services.
• 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 for common private IPv4 networks.
• localhost, *.local, and internal domains used by your own network.
• Local DNS servers and gateway addresses, if they must remain reachable directly.

Once DNS and rules are configured, select the intended mode in the main Clash interface. For a controlled test, Global mode makes it easier to confirm that a connection can use the selected proxy. After verification, return to Rule mode and review which rules should be direct, proxied, or rejected.

Verify That TUN Is Actually Routing Traffic

A green TUN switch alone is not proof that traffic is being captured. Use several tests because different applications exercise different protocols and DNS paths.

1. Open the Windows network adapter list and look for a Clash, Mihomo, or Wintun virtual adapter. The name varies by version, but it should appear while TUN is enabled.
2. In Clash Verge Rev, open the connections or traffic view. Start a new request from a browser, terminal, or test application and check whether a connection appears.
3. Visit a public IP display page and compare the result with TUN disabled and enabled. A proxied request should show the proxy exit address when the rule sends it through the proxy.
4. Test an application that normally ignores the Windows system proxy, such as a command-line tool or game launcher. If its connection appears in the Clash connection list, TUN capture is functioning.
5. Test a direct destination such as your router or a local development server. It should remain reachable if your rules and private-network handling are correct.

On Windows Terminal, a simple command can help confirm ordinary HTTPS behavior:

curl.exe -I https://example.com
nslookup example.com
ipconfig /all
route print

curl.exe may resolve to the Windows system executable rather than a separate Unix-compatible tool, so its result is useful for checking whether a normal process can connect. route print helps you inspect whether a virtual route has been added, while ipconfig /all shows active adapters and DNS servers. Do not judge success from nslookup alone: it may use DNS behavior that differs from the application and does not prove that the resulting connection is proxied.

Troubleshoot Common TUN Errors

TUN will not start

First restart Clash Verge Rev as administrator and check Service Mode. If the service is missing, reinstall or start it through the application's service controls. Then close competing VPN and proxy programs. If Windows reports that an adapter already exists, open Network Connections and inspect disabled or stale Clash and Wintun adapters. Remove an obsolete adapter only when you are certain it belongs to an old installation. A restart is often necessary after driver changes.

TUN is enabled but no traffic appears

Check that the active profile is running and that the core did not fall back to an error state. Confirm that auto-route is enabled and that Windows still has a usable physical interface. Temporarily switch to Global mode, open a new application, and watch the connection panel. If Global mode works but Rule mode does not, the issue is probably a rule or provider problem rather than TUN itself. Also check whether the application uses a separate VPN, QUIC path, or encrypted DNS mechanism that needs additional handling.

The internet stops working after enabling TUN

Disable TUN, restore connectivity, and then re-enable it with fewer variables. Start with automatic interface detection, the mixed stack, and DNS enabled. If the problem appears only with strict routing, turn strict routing off and test again. Check for a DNS loop, an incorrect fake-IP range, or a profile that points DNS to an unreachable server. Corporate security software may also block the virtual adapter, so review its network protection logs rather than repeatedly changing Clash options.

Local devices or intranet pages cannot be reached

Add or restore direct rules for private IP ranges and local domains. Make sure the router address is not being sent to a proxy group. If fake-IP mode interferes with a discovery protocol, add the required local domains to fake-ip-filter. Some printer and file-sharing protocols use broadcast or multicast traffic that ordinary domain rules cannot represent; in those cases, keep the local adapter and service direct, or use the application's own proxy exclusion settings.

Connections are slow or unstable

Compare mixed and system stack behavior if the interface offers both. Test with IPv6 disabled when your proxy path does not support IPv6 consistently. Review the selected proxy group's latency and packet loss instead of assuming the TUN layer is responsible. Finally, clear stale DNS data by restarting the Clash core or refreshing the relevant profile, then retest the same destination with one change at a time.

Use TUN Mode Safely Every Day

TUN mode is powerful because it can affect nearly every application on the computer. Keep a small rollback plan: know how to disable TUN, stop Service Mode, and restore normal Windows routing if a profile update breaks connectivity. Avoid enabling multiple VPN-style products at startup unless you understand their route priorities. When troubleshooting, change only one setting at a time and record the previous value.

For a stable daily setup, keep the core updated through a trusted Clash Verge Rev release, review subscription changes before applying them, and inspect rule providers when a previously working service suddenly changes behavior. Use Rule mode for normal operation, reserve Global mode for controlled testing, and maintain explicit direct rules for local resources. With those practices, TUN mode becomes a transparent extension of Clash rather than a source of mysterious network failures.

Once the virtual adapter, DNS handling, and routing rules have been verified, applications that ignore the Windows system proxy can use the same Clash policy as your browser. That is the main benefit of the setup: one consistent place to observe connections, select proxy nodes, and decide which traffic should remain direct.