You imported your subscription, picked a node, and turned on system proxy — yet some apps still connect directly, games lag on the wrong route, or a terminal tool ignores the proxy entirely. That is the moment most Clash Verge Rev users search for Clash Verge Rev TUN mode. TUN is not a replacement for subscriptions or node selection; it is the layer that lets the Mihomo core capture traffic from applications that never read Windows proxy settings.

This guide walks through complete TUN mode setup on Windows in 2026: what TUN does compared with system proxy, how to enable Clash Verge TUN with the correct permissions, recommended options for Windows full traffic proxy configuration, verification steps, and fixes for the errors users hit most often. We assume Clash Verge Rev is already installed and you have an active profile — if not, start with our subscription import guide first.

What TUN Mode Does in Clash Verge Rev

Clash Verge Rev offers two main ways to steer traffic through the Mihomo core on Windows:

  • System Proxy — Sets the Windows HTTP/SOCKS proxy registry keys. Browsers, many Electron apps, and tools that honor OS proxy settings route through Clash automatically. Lightweight and does not require administrator rights.
  • TUN Mode — Creates a virtual network adapter (usually named Meta) and intercepts IP packets before they leave the machine. Traffic from games, command-line utilities, Docker containers, and other apps that bypass system proxy still passes through Clash rules.

Think of system proxy as a polite suggestion to applications; TUN is a network-level capture net. When you need true system-wide routing — especially for UDP-based protocols, LAN discovery edge cases, or stubborn desktop software — TUN is the correct tool.

TUN does not change your subscription, nodes, or rule file. It only changes how packets reach the core. Your existing split-routing rules in Rule mode still apply: domestic sites can go DIRECT while foreign traffic uses your proxy group, even under TUN.

Before You Enable TUN

Skipping these checks causes most "TUN broke my network" reports. Confirm each item before toggling the switch:

  • Clash Verge Rev is running — The tray icon should be visible. Install or update from our download page if needed.
  • An active subscription profile — On Profiles, one card must be highlighted as in use. Import steps are covered in the Clash Verge Rev subscription tutorial.
  • A working node selected — Open Proxy, expand a strategy group, run latency tests, and pick a responsive server. TUN with no valid outbound node produces a full disconnect.
  • Administrator access on this PC — TUN adapter creation triggers a Windows UAC prompt. Standard user accounts without elevation cannot complete setup.
  • No conflicting VPN — Disconnect other VPN clients (WireGuard GUI, OpenVPN, corporate VPN, Hyper-V virtual switches with overlapping routes) before enabling TUN.

If you only need browser proxying, system proxy alone is simpler and avoids UAC. Enable TUN when specific apps still leak direct traffic — that is the usual trigger for TUN mode setup searches.

TUN Mode vs System Proxy — When to Use Each

Both modes can run together. Clash Verge Rev documentation and our tutorial · TUN section recommend keeping system proxy enabled even when TUN is on, because some Windows components still consult the registry proxy keys.

  • Use system proxy only — Daily browsing, IDE HTTP clients, apps that respect WinINET proxy settings. Lower privilege, fewer routing surprises.
  • Add TUN mode — Games (Steam, Battle.net), curl / git without proxy env vars, Discord voice UDP, Microsoft Store apps, or any software that ignores proxy configuration.
  • Global mode + TUN — Forces essentially all traffic through the selected proxy group. Useful for testing; Rule mode is preferred for split routing in daily use.

TUN adds a small CPU overhead for packet processing. On modern PCs the impact is negligible for typical use. Laptops on battery may notice slightly higher drain if TUN runs continuously — toggle it off when you only need browser access.

Step 1 — Enable TUN Mode in Clash Verge Rev

The core Clash Verge TUN toggle lives under Settings. Follow these steps in order:

1

Open Settings — Click Settings in the left sidebar of Clash Verge Rev.

2

Navigate to Clash Core — In the settings menu, select Clash Core (sometimes grouped under core or engine options depending on the build).

3

Toggle TUN Mode on — Find the TUN Mode switch and enable it. On first use, Windows displays a User Account Control dialog — click Yes to grant administrator permission.

4

Wait for the adapter — The Mihomo core creates the virtual adapter. Within a few seconds, Windows Network Connections should list an interface named Meta or similar.

5

Keep System Proxy enabled — Return to the main dashboard or tray menu and confirm System Proxy remains on alongside TUN for maximum compatibility.

If UAC was denied, TUN stays off silently or shows an error in the client log. Close Clash Verge Rev, right-click the shortcut, choose Run as administrator, and retry the toggle — some builds require elevated launch for persistent TUN support.

Step 2 — Configure TUN Options for Full Traffic Proxy

Default TUN settings work for most users. Power users tuning Windows full traffic proxy configuration should understand these options in Settings → Clash Core → TUN (exact labels may vary slightly by version):

  • Stack — Controls the packet capture backend. system uses the Windows native stack; gvisor uses a userspace network stack with broader compatibility on some builds. Start with the default; switch to gvisor only if you see crashes or adapter errors on system.
  • Auto Route — When enabled, Mihomo installs routes so traffic flows through the TUN adapter automatically. Leave this on for typical full-system capture. Disabling it is for advanced manual routing scenarios only.
  • Auto Detect Interface — Helps the core pick the correct outbound physical interface on multi-homed PCs (Wi-Fi plus Ethernet, or docked laptops). Enable on machines with several active adapters.
  • Strict Route — Prevents applications from bypassing TUN via alternative routes. Useful when you suspect leak behavior; may interfere with LAN printer or NAS access — test before leaving on permanently.
  • DNS Hijack — Redirects DNS queries to the core's DNS module so requests follow your Clash rules instead of leaking to ISP resolvers. Recommended when TUN is on and you rely on rule-based domain routing.

Editing raw YAML under Profiles is rarely necessary for basic TUN setup. The GUI toggles write equivalent tun: blocks into the running config. Avoid hand-editing unless you understand Mihomo's config schema.

Choose the Right Routing Mode

TUN captures packets; your profile's mode decides what happens next:

  • Rule (recommended) — Domain and IP rules from your subscription split traffic. Local and CN traffic may go DIRECT; blocked or foreign sites use your proxy group. Best balance for daily use.
  • Global — Every captured connection uses the selected proxy node. Simplest test for "is TUN working at all?" but routes domestic sites through the proxy too.
  • Direct — TUN is active but nothing is proxied. Rarely useful; mainly for debugging adapter creation.

Switch modes from the main dashboard toggle or tray menu. After changing mode, wait a few seconds for the core to reload before running verification tests.

Step 3 — Verify TUN Mode Is Working

Do not assume the toggle alone means traffic is routed. Run through this checklist after enabling TUN:

  • Virtual adapter visible — Open Settings → Network & Internet → Advanced network settings → More network adapter options (or run ncpa.cpl). Confirm a Meta adapter exists and is enabled.
  • Client status — Clash Verge Rev dashboard or tray icon shows both TUN Mode and System Proxy as active.
  • Latency test passes — On the Proxy page, at least one node returns low latency. A dead node under TUN blocks everything.
  • IP check via browser — Visit an IP lookup site. Under Global mode the result should match your proxy exit. Under Rule mode, foreign test sites should proxy while domestic sites may show your ISP address.
  • Non-proxy app test — Open Command Prompt and run curl https://ifconfig.me without setting HTTP_PROXY. If TUN works, the returned IP should differ from your raw ISP address (unless Rule mode sends that domain DIRECT).
  • Logs are clean — Settings → Logs should not show repeated TUN start failures or "access denied" adapter errors.

If the adapter appears but traffic does not route, switch to Global mode briefly, pick a confirmed working node, and retest. That isolates rule misconfiguration from TUN adapter problems.

Daily Use Tips With TUN Enabled

Once setup is complete, these habits keep TUN stable on Windows:

  • Start order — Launch Clash Verge Rev before the apps you want captured. Games started before TUN may need a restart to pick up new routes.
  • Tray quick toggle — Right-click the tray icon to disable TUN temporarily for LAN gaming or local server work without closing the client.
  • Profile updates — Refreshing your subscription does not disable TUN, but a bad YAML can prevent the core from reloading. Check logs after major profile changes.
  • Sleep and resume — Laptops waking from sleep occasionally lose TUN routes. Toggle TUN off and on, or restart the core from Settings if connectivity drops after resume.
  • Antivirus exclusions — Add Clash Verge Rev's install directory to Windows Defender or third-party AV exclusions if adapter creation is blocked silently.

Troubleshooting Common TUN Problems

UAC prompt dismissed or TUN toggle reverts off

Windows blocked adapter creation. Right-click Clash Verge Rev → Run as administrator, enable TUN again, and click Yes on UAC. If corporate policy disables virtual adapters, TUN may not be available on that machine.

TUN shows on but no Meta adapter appears

Restart the Mihomo core from Settings → Clash Core → restart button. Check Logs for driver or permission errors. Reinstall Clash Verge Rev from our download page if the wintun driver bundle is missing — the installer ships the required components.

Complete internet loss after enabling TUN

Usually means no working outbound node or a conflicting VPN route. Disable TUN, confirm direct internet works, select a healthy node, disable other VPN software, then re-enable TUN. Try switching TUN stack from system to gvisor if the disconnect persists on specific hardware.

Some apps work, others still bypass proxy

Enable Strict Route and DNS Hijack in TUN settings. Confirm the app is not using a hardcoded VPN or its own tunnel. Under Rule mode, the target domain may be set to DIRECT — check your profile rules or test under Global mode to compare.

Cannot access local NAS, printer, or LAN games

Strict Route or aggressive DNS Hijack sometimes blocks RFC1918 private ranges. Add LAN subnets to your profile's skip-proxy or direct rules, or temporarily disable TUN when accessing local devices. Our full tutorial covers custom rule snippets for LAN bypass.

DNS resolution fails under TUN

Enable DNS Hijack so queries hit the core's DNS module. Ensure your subscription defines valid dns servers — many airport configs include nameserver and fallback sections. Flush Windows DNS cache with ipconfig /flushdns after changes.

Conflict with WSL, Hyper-V, or Docker Desktop

Virtual switch drivers can clash with wintun. Pause Docker Desktop's VPN-like networking, or set Clash TUN stack to gvisor. Some users run Clash on the host and disable Docker's internal VPN when both must coexist.

Frequently Asked Questions

Where do I enable TUN mode in Clash Verge Rev?

Go to Settings → Clash Core → TUN Mode and toggle it on. Accept the Windows UAC prompt the first time. The virtual Meta adapter should appear in network settings within seconds.

Do I need TUN if system proxy already works?

Not for browsers and proxy-aware apps. Enable TUN when specific software ignores system proxy — common examples include games, terminal tools without proxy environment variables, and UDP-heavy voice chat.

Why does TUN require administrator rights?

Creating a virtual network adapter and modifying the system routing table are privileged operations on Windows. Without elevation, the wintun driver cannot install the adapter TUN mode depends on.

Should I use Global mode with TUN for full traffic proxy?

Global mode sends all captured traffic through your selected node — simplest for testing full proxy takeover. For daily use, Rule mode plus TUN gives split routing: domestic direct, foreign proxied. Both achieve system-level capture; the difference is routing logic.

Does TUN mode change my DNS?

Only if DNS Hijack is enabled in TUN settings, which redirects queries to Mihomo's DNS handler. Your subscription's DNS configuration then decides which resolver answers each domain. This prevents DNS leaks that would bypass Clash rules.

How do I turn off TUN mode safely?

Toggle TUN Mode off in Settings → Clash Core, or use the tray menu shortcut. The Meta adapter is removed and normal routing restores within seconds. System proxy can remain on if you still want browser-level routing.

Get Started with Clash Verge Rev TUN on Windows

One-click VPN apps promise "full device protection" but hide their routing stack, limit protocol choice, and disappear when app stores change policies. Clash Verge Rev with TUN mode delivers genuine system-level capture through the open-source Mihomo core — you see every node, every rule, and every log entry. Combined with subscription-based split routing, you get finer control than closed VPN clients without surrendering transparency.

Compared with legacy Windows proxy tools, Clash Verge Rev unifies subscription management, latency testing, Rule/Global/Direct modes, and TUN in one Tauri-based interface maintained on GitHub. TUN setup takes under two minutes once your profile is active: grant UAC, flip the toggle, verify the Meta adapter, and stubborn apps finally follow your proxy path.

Download the latest Windows build from our Clash client download page, import your subscription using the linked guide above, then enable TUN mode following the steps in this article. For broader configuration — custom rules, DNS tuning, and mode switching — continue with the official TUN tutorial section. From first toggle to verified full traffic proxy, most users finish in a single session.