How to Enable TUN Mode in Clash Verge Rev on Windows

TUN mode in Clash Verge Rev gives Windows a virtual network interface that can capture traffic from applications that ignore the system proxy, including some games, command-line tools, launchers, and background services. It is useful when the browser works through Clash but another application still connects directly. This guide explains how to enable TUN mode, set up the required Windows service permissions, verify that traffic is being captured, and troubleshoot common startup and VPN conflicts.

What TUN Mode Does on Windows

In ordinary system-proxy mode, Clash Verge Rev sets a Windows proxy address that proxy-aware applications can use. A browser may follow that setting, while a game or terminal program may not. TUN mode takes a different route: Mihomo, the proxy core used by Clash Verge Rev, creates a virtual network adapter and captures traffic at the network layer. The captured connections are then matched against your Clash rules and sent to the selected proxy group or directly to the destination.

This distinction matters when diagnosing a setup. TUN mode does not automatically mean that every connection goes through a proxy. It means that more traffic can reach the Clash routing engine. Your rules still decide whether a connection is proxied, direct, or rejected, and an application may have its own proxy or VPN settings that take precedence.

• System proxy: Often sufficient for browsers and other applications that respect Windows proxy settings.
• TUN mode: Useful for applications that do not use the system proxy and for capturing more Windows network traffic.
• Both modes together: Usually unnecessary for basic use. If you enable both, test the result rather than assuming that one mode will improve the other.

TUN mode may require administrator privileges because Windows must create and configure a virtual adapter and install or start a privileged service. That is why a normal application restart may not be enough when the TUN switch appears to do nothing. Before changing settings, confirm that your Clash profile loads correctly, that a proxy node is available, and that you know how to return to ordinary system-proxy mode if another VPN or security product conflicts with the virtual adapter.

Prepare Windows and Clash Verge Rev

Update Clash Verge Rev to a build that includes the Mihomo core and TUN options. The exact wording and location of controls can vary slightly between releases, so treat the labels below as landmarks rather than assuming every build has an identical layout. If the TUN option is absent, check which core is selected and whether the application is using a compatible Mihomo version before editing a profile manually.

Next, select a valid profile and start the core. Confirm that a proxy group contains usable nodes and that the group has a selection. TUN can capture a connection correctly while the selected route still fails because a node is offline, a rule sends the destination to the wrong group, or the profile has a DNS or routing problem. A successful node latency test is helpful, but it does not prove that every destination is reachable.

1. Open Clash Verge Rev and select the profile you intend to use.
2. Start the core and confirm that the profile is not showing a parse error or failed state.
3. Choose an available proxy in the relevant proxy group, or verify that an automatic group has a working member.
4. Close or pause other VPN clients while setting up TUN, if practical. This makes the initial test less ambiguous.
5. Keep a note of how to disable TUN and restore the previous network state before proceeding.

Do not assume that a profile subscription will be modified permanently by a toggle in the application. In many setups, the UI manages the active TUN setting separately from the provider's remote profile. If you do need to edit YAML, make a local copy first and confirm whether your profile is managed or overwritten during updates. A subscription update can replace local edits, while a malformed manual change can prevent the core from starting.

Enable TUN Mode and Service Mode

In Clash Verge Rev, open the settings area and locate the TUN Mode control. Depending on the build, the option may appear in general settings, system settings, or a section related to the core. Turn on TUN mode. If the application reports that a service is required, or if the control cannot be enabled without elevated permissions, set up Service Mode as well. Service Mode lets the privileged component handle network operations that a regular desktop process cannot perform reliably.

Install the Privileged Service

Look for the Service Mode or service-install control in the settings interface. Use its install or enable action, then approve the Windows User Account Control prompt only if it is clearly associated with Clash Verge Rev. Some releases show a shield icon or an explicit service status beside the control. Wait for the status to indicate that the service is installed or running, then return to the TUN setting and enable it if it has not already turned on.

If there is no service control in the settings you are viewing, check the application's current documentation or release notes for that version rather than downloading an unrelated service installer. Do not run random administrator scripts to create a service. The application should manage the privileged component that matches its own build and core integration.

Start and Verify TUN

After enabling the service and TUN mode, restart the core if prompted. Wait until the core is running before launching the application you are testing. Some versions apply changes immediately; others require a core restart or a full application restart. If Windows displays a permission prompt, approve it only when you initiated the change and recognize the publisher or application.

Use a simple, repeatable test rather than changing several settings at once. Keep Clash Verge Rev open, confirm that the core is active, and launch an application that previously bypassed the system proxy. Observe the connection list or traffic panel, if available, and check whether the destination appears. Then inspect the matched rule and proxy group. Seeing a connection in Clash confirms interception more directly than merely seeing a changed public IP in a browser.

Check Routing and Traffic

Once TUN is enabled, verify both capture and routing. A successful TUN interface does not guarantee that a connection will use a proxy: a rule such as DIRECT, a private-network rule, or a catch-all rule can intentionally send it direct. Likewise, a connection may be captured but fail because the selected node is unavailable or the destination is blocked. Test a known destination and inspect the corresponding Clash connection entry to see the rule, the outbound group, and the final proxy where the interface provides those details.

You can also inspect Windows network interfaces from PowerShell. This is a diagnostic check, not a requirement to modify the interface manually. Interface names depend on the core and application version, so do not expect a specific name in every installation.

Get-NetAdapter | Format-Table -Auto Name, Status, InterfaceDescription

When TUN is active, you may see a virtual adapter or a related interface in the output. Its presence alone does not prove that traffic is being routed through Clash; check that the core is running and that the target connection appears in the application's connection view. If you need to inspect routes, use Windows' read-only route display and compare the output before and after enabling TUN:

route print -4

A route table can contain many entries, and Windows may retain routes belonging to other adapters. Do not delete routes just because they appear unfamiliar. First disable TUN through Clash Verge Rev, wait for the core to stop, and check whether the issue clears. If only one application fails, compare that application's behavior with a browser and a second test application. This helps distinguish a TUN startup problem from an application-specific proxy setting, firewall rule, or Clash routing rule.

• Connection is absent from Clash: Confirm TUN is enabled, the service is running, and the application is not using another VPN or a separate network adapter.
• Connection appears but goes direct: Inspect the matched rule and proxy group. Change the rule or group only if the direct route is not intended.
• Connection is proxied but fails: Test another node and check the core log for DNS, timeout, or handshake errors.
• Only domain-based access fails: Review DNS settings and domain rules. TUN capture does not by itself correct an unsuitable DNS configuration.

Fix Common TUN Problems

TUN will not turn on or immediately turns off. Check Service Mode status first. If the service is not installed or cannot start, close the core, reopen the service controls, and follow the application's supported installation or repair action. If Windows security software blocks the service, review its protection history and allow only the legitimate Clash Verge Rev component. Restart the application after a confirmed service change. Avoid repeatedly installing and removing the service without reading the error; permission, installation, and core-version problems require different fixes.

Windows asks for permission every time. A UAC prompt may appear when a privileged operation is requested, but repeated prompts can indicate that the service was not installed correctly or that the application is running in an unusual permission context. Do not solve this by permanently running every application as administrator. Check the service status and use the supported Service Mode option. Running the entire desktop client with elevated privileges can increase risk and is usually not the right first troubleshooting step.

Another VPN stops working, or the internet disappears. Two VPN or tunnel clients can compete to create routes, DNS settings, or virtual adapters. Disable the other VPN temporarily and restart the Clash core. If connectivity returns, use only one tunnel at a time where possible, or consult the other VPN's split-tunneling options. Corporate VPNs may enforce routing or security policies that cannot safely be overridden; follow your organization's guidance rather than changing system routes to bypass those controls.

The browser works, but one application still bypasses the proxy. Check whether the application has its own proxy configuration, uses a custom network stack, or is explicitly excluded by the active profile. Review the connection panel while generating a fresh request. If the request appears as direct, inspect the matched rule. If it does not appear at all, verify that TUN is active and that no competing VPN or per-application network control is involved. Some software may use protocols or connection methods that require additional profile-specific handling.

DNS behaves differently after enabling TUN. DNS resolution is part of the path, but TUN and DNS are separate settings. If connections are captured but domain names fail, check the core log and your profile's DNS configuration before changing Windows DNS manually. A mismatch between DNS behavior, routing rules, and applications can cause delays or inconsistent results. Change one DNS setting at a time and retest both a domain name and a known IP-based destination where appropriate.

Traffic stops after turning TUN off. Disable TUN from the application, stop or restart the core as requested, and allow Windows a short time to restore network state. If needed, disconnect and reconnect your normal network adapter or restart Windows. Do not remove the virtual adapter or service manually as a first step; the application may need them for a clean shutdown or later startup. If the issue persists, capture the core log and the exact Windows error before attempting repair.

For everyday use, leave TUN enabled only when you need its broader capture behavior. If system-proxy mode already covers your applications, keeping the simpler mode can reduce interactions with VPN software and network security tools. When TUN is necessary, a reliable routine is straightforward: start the core, confirm the service status, test one application, inspect its route, and then use your normal workload. With those checks in place, Clash Verge Rev can handle applications that would otherwise ignore the Windows system proxy without requiring you to guess whether traffic is actually being captured.