Clash TUN Mode Setup Guide: How Full-Traffic Takeover Works

What TUN Mode Is: Virtual Adapters and Layer-3 Takeover

TUN is a virtual network device provided by the operating system, operating at the network layer (Layer 3), where everything in and out is a standard IP packet. Once TUN mode is enabled, the client does three things in order:

1. It registers a virtual network adapter with the system. On Windows this usually shows up as an adapter named Mihomo or something with utun in it; on macOS and Linux, a new utun device appears.
2. It rewrites the routing table so the default route points to this adapter, meaning every IP packet leaving the machine lands in the kernel's hands first.
3. The kernel (mihomo) reads packets off the adapter, resolves the destination domain and port, decides whether to connect directly or route through a proxy node based on your rules, then sends the packet out via the real network adapter.

The key is the layer it operates on. A system proxy is an application-layer protocol — apps have to actively read and honor the system setting for it to work. TUN intercepts packets at the network layer, so apps have no idea a proxy even exists, which means whether they "honor" it is a non-issue. That's exactly why TUN can capture terminal commands, game traffic, and UWP apps that a system proxy can't touch.

The trade-off is permissions: creating a virtual adapter and rewriting the routing table both require administrator (Windows / macOS) or root (Linux) privileges, so it's normal for the system to prompt for authorization the first time you turn it on.

TUN Mode vs System Proxy

Two rules of thumb: for everyday browsing, a system proxy is enough and has the lowest overhead; turn on TUN when you need your terminal to route through the proxy, want to accelerate a game, or an app just refuses to read the system proxy setting. You can run both at once without conflict — once TUN takes over, the system proxy path mostly sits idle. That said, when troubleshooting, it's best to leave only one enabled, since having both active adds too many variables to pin down the issue.

Before You Start: Kernel, Permissions, and Config

At the config level, mihomo's TUN block looks like this. GUI clients usually just need a toggle switch — these fields get filled in automatically — but it helps to understand what each one does:

tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true
  dns-hijack:
    - any:53

• stack: the protocol stack implementation. system uses the OS's own stack and has the best compatibility; gvisor is a userspace stack that's more stable for UDP and gaming; mixed routes TCP through system and UDP through gvisor — the recommended default for daily use.
• auto-route: automatically rewrites the routing table to take over all traffic. Turn it off and the adapter gets created but no traffic actually flows through it — effectively the same as not enabling TUN at all.
• auto-detect-interface: automatically detects the real outbound network interface. Recommended to keep on for machines with multiple network adapters.
• dns-hijack: intercepts DNS queries sent to port 53 and hands them to the kernel's built-in DNS handling, preventing DNS leaks that would otherwise throw off rule matching.

It's best to pair DNS with fake-ip mode — this gives the cleanest rule splitting under TUN:

dns:
  enable: true
  enhanced-mode: fake-ip

Enabling TUN on Each Platform

Windows (Using Clash Verge Rev as an Example)

1. Open the settings page and install the "Service Mode" first. It's a small background helper — once installed, you won't need to launch the client as administrator every time to use TUN mode.
2. Go back to the settings page and flip on the "TUN Mode" switch.
3. When the firewall prompt appears, choose to allow it; a new virtual adapter will show up in your network connections list.
4. You can skip Service Mode, but then you'll need to right-click and "Run as administrator" every time you launch the client.

macOS

1. In Clash Verge Rev or ClashX Meta's settings, turn on TUN (some clients label this "Enhanced Mode").
2. The first time you enable it, you'll be asked for your login password to install a privileged helper tool — you only need to enter it once.
3. Run ifconfig in the terminal; if you see a new utun device listed, it's enabled successfully.

Linux

1. In GUI clients, just flip the TUN switch. If you're running mihomo from the command line instead, you'll need root, or grant the binary cap_net_admin capability.
2. If your desktop environment has multiple VPN tools installed, keep in mind only one can win control of the routing table at a time — disable the others first.

Android and iOS

1. Clash clients on Android (Clash for Android, FlClash, Clash Plus) run on the system's VpnService, which is essentially TUN under the hood — there's no separate toggle. Tap to connect, confirm the system's "Connection Request" prompt, and once the key icon appears in the status bar, all traffic is being taken over.
2. It's a good idea to add the client to your battery optimization whitelist so the system doesn't kill it in the background and cut your connection.
3. Same idea on iOS: the client takes over traffic through the system's Network Extension (Packet Tunnel) framework — just authorize the VPN configuration the first time you launch it.

Verifying TUN Is Actually Working

Three checks to confirm:

1. Check the network adapter. On Windows, run ipconfig and look for an adapter named Mihomo or containing utun; on macOS and Linux, use ifconfig or ip addr to look for a utun device.
2. Use a tool that ignores the system proxy to test your exit IP. Run this in the terminal:

curl ip.sb

curl doesn't read system proxy settings by default. Run it before enabling TUN and it returns your real local IP; run it again after enabling TUN and it returns the proxy node's exit IP instead — that's the clearest way to confirm the difference between "the system proxy is working" and "TUN is actually taking over."

1. Check the connections page. The client's Connections panel should show a connection entry from the process that ran curl, with the Rule Chain column showing which rule it matched.

If curl still returns your local IP, check first whether auto-route is enabled and whether some other VPN software has rewritten your routing table.

Common Issues and How to Avoid Them

One last note: TUN routes all system traffic through an extra layer of the protocol stack, which comes with a slight performance and battery cost. If you don't need system-wide takeover, turn off TUN and stick with the system proxy — it's lighter.