Skip to main content
Clash Verge Clash VergeDL-CLASH.COM
EN

Home / Blog / Features

What TUN mode is, and when you actually need it

Features Published 2026-07-083 min read1060 words
What TUN mode is, and when you actually need it

Clash Verge has a TUN mode switch on the home screen, and plenty of guides just say "turn it on". It is not better-when-on though. Understand what it does and you will know when to reach for it and when it only adds complications.

Start with what the system proxy cannot do

When you enable the system proxy, Clash Verge does something simple: it writes a line into the Windows registry (or macOS network preferences) saying "the HTTP proxy is at 127.0.0.1:7897".

The catch is that this is a suggestion, and programs are free to ignore it.

Which programs read the system proxyBrowsers — Chrome, Edge and Firefox follow it by defaultMost Electron desktop appsSome Windows Store appsCommand-line tools like curl, git and npm — need environment variables insteadGame clients — most open sockets directly and ignore it entirelyUDP traffic — the system proxy does not handle it at all
For programs that ignore it you get "the proxy is on but this app still cannot connect"

The usual offenders:

  • Games: Steam downloads, Battle.net, most UDP-based games
  • Command line: curl, git, pip, docker pull
  • Some desktop apps that ship their own networking stack
  • UDP traffic: the system proxy only handles HTTP/HTTPS/SOCKS, never UDP

TUN does something different

Instead of asking politely at the application layer, TUN creates a virtual network adapter and edits the routing table so all traffic is directed onto it.

Two levels of interceptionSystem proxyconfigured at thprograms comply voluntarilyonly covers HTTPSOCKSno special privilegesTUN modetakes over at thprograms cannot bypass itcovers both TCP and UDPneeds a virtual adapter and system service
TUN intercepts from below, so "this app does not support proxies" stops being a thing

As far as a program is concerned it is just using the network normally. In reality its packets go into the virtual adapter, get handed to the Mihomo core, and are routed by rule.

The data path under TUNAny programgames, CLI tools, anythingTUN adaptersystem routing points hereMihomo coredecides by rulesDirect or nodefinal exitThe core's own traffic is excluded to avoid a loop
Because it happens at the network layer, application support is irrelevant

When to turn it on

Turn on / leave offTurn on — gamingSteam downloads, Battle.net, UDP multiplayerTurn on — command-line toolswhen git clone, npm install or docker pull hangTurn on — one app refuses to routeafter the system proxy alone did nothingLeave off — just browsingthe system proxy is enough and simplerLeave off — managed work laptopvirtual adapters clash with endpoint security softwareLeave off — unstable connectiondisconnects feel worse under TUN

The rule of thumb: run with the system proxy only, and enable TUN when a specific program refuses to cooperate.

Four things to know before enabling it

1. It needs one administrator approval

TUN installs a virtual adapter driver (wintun on Windows) and a system service. The first time you enable it you get a UAC prompt — click Yes. It does not ask again afterwards.

There is a Service Mode entry in Clash Verge settings that handles this. If the TUN switch does nothing when clicked, check whether service mode installed successfully.

2. DNS gets taken over

Under TUN the core handles DNS queries, usually in fake-ip mode. Two side effects:

  • Internal services that rely on your local DNS may stop resolving; add them to fake-ip-filter
  • Pinging a domain returns something like 198.18.x.x — that is expected, not a fault

3. Games are not automatically faster

TUN lets game traffic take a node, but being routed is not the same as being faster. Games are extremely sensitive to latency and packet loss, and an extra hop is usually worse. For this to help, the underlying line has to be genuinely good — a dedicated IPLC/IEPL link, typically.

Also worth checking: some anti-cheat systems react to virtual adapters. Look up your specific game before enabling it.

4. Confirm routes are restored after turning it off

Switching TUN off normally makes the core undo its routing changes. If the process is force-killed, stale routes can remain, which looks like "I turned it off and now nothing works at all".

Recovery: run ipconfig /flushdns as administrator, then start Clash Verge again so it takes control and can shut down cleanly. Rebooting also works.

Can I run TUN and the system proxy together?

Yes, and many people do. They do not conflict:

  • Programs that honour the system proxy take that path
  • Programs that do not get caught by TUN at the network layer

That said, with TUN on, the system proxy is largely redundant. Some users turn the system proxy off and keep only TUN — the interface is tidier and behaviour is more uniform. The one thing to watch is that applications explicitly configured to "use system proxy" may behave differently.

Common questions

Q: LAN devices became unreachable after enabling TUN. Check that your rules include direct routes for private ranges. A sane config has:

- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
- IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
- IP-CIDR,172.16.0.0/12,DIRECT,no-resolve

Q: The TUN switch is greyed out. Service mode is not installed. Settings → Service Mode → Install, approve the prompt, then try again.

Q: Things got slower after enabling TUN. Under TUN all traffic passes through the core, which costs more CPU than the system proxy. Older machines notice. Also check the stack setting — mixed or gvisor are the compatible choices, system is faster but more demanding.

In short

TUN solves the "this program will not cooperate" problem, at the cost of higher privileges, more resources and more complicated DNS behaviour.

Use the system proxy first, add TUN when something is missing — that is the least painful order.

Further reading: system proxy vs TUN across six real scenarios and port settings explained.

← PreviousRule, Global and Direct — which proxy mode should you use? Next →System proxy or TUN? Six real situations, one answer each

Related reading