How to Enable TUN Mode in Clash Verge Rev on Windows

What TUN mode changes in Clash Verge Rev

Clash Verge Rev can send traffic to its core through the Windows system proxy or through a TUN interface. The system proxy is a setting that applications may choose to follow; it works well for browsers and other software that honors Windows proxy settings, but command-line tools, games, launchers, and some apps may ignore it. TUN mode adds a virtual network interface and routes eligible traffic through the Clash core, so applications usually do not need to be configured one by one.

TUN is a traffic-capture method, not a promise that every connection will use a proxy node. Once traffic reaches the core, the active configuration’s rules and policy groups decide whether it goes through a proxy, connects directly, or is rejected. LAN exclusions, IPv6 handling, application behavior, Windows routes, and the capabilities of the selected node can all affect the result. A connection captured by TUN can still match a DIRECT rule.

Clash Verge Rev commonly runs the mihomo core, but the client interface and available controls can change between releases. Check the version shown in the About or application information area before following a menu path exactly. The instructions below describe the general Windows workflow; if a label differs, look for the TUN and service controls in the client’s settings rather than adding unrelated configuration fields.

• System proxy: Applications that read Windows proxy settings send supported requests to a local proxy listener.
• TUN: Windows routes eligible IP traffic through a virtual adapter, where the core can apply the configuration’s routing rules.
• Service mode: A privileged background component allows the client to perform operations that require elevated Windows permissions. It is not itself a proxy node or a subscription.

Prepare Windows and Clash Verge Rev

Before enabling TUN, confirm that Clash Verge Rev can start its core and use the current configuration. In the client, select the configuration you intend to use, choose a proxy group or node, and check that a basic browser test works with the system proxy enabled. If the core is stopped, the configuration fails validation, or the selected group has no usable outbound, TUN cannot make that underlying problem disappear.

Quit other proxy clients and VPN applications temporarily. Two network tools may each try to install a virtual adapter, change routes, capture DNS, or run a privileged service. Even when both appear to start, their route priorities or DNS handling can conflict. Also pause network-filtering software only when you understand its role and can restore it afterward; do not permanently disable Windows Firewall or antivirus protection just to get TUN working.

1. Record the Clash Verge Rev version, Windows version, active configuration, selected node or group, and whether the system proxy currently works.
2. Save a copy of any local configuration edits. Subscription updates can replace generated configuration, and an edit is not a reliable troubleshooting rollback unless it has been backed up.
3. Disconnect other VPNs and turn off TUN in other proxy clients. Close duplicate Clash Verge Rev processes if more than one copy is running.
4. Keep a way to restore normal connectivity: know how to turn off TUN and the system proxy, and avoid changing adapter, DNS, and route settings at the same time.

On a managed work or school computer, administrator policy may prevent installing a service or virtual network adapter. If the client reports an access-denied error, an organization’s endpoint security policy may be responsible. Do not try to bypass that policy; ask the administrator whether a local VPN-style network interface and privileged service are permitted.

Enable TUN mode and install its service

Open the TUN controls

Launch Clash Verge Rev and open its settings. Depending on the release, the control may be labeled TUN Mode, Service Mode, or be placed under a system or network settings section. Locate the TUN switch and any separate service installation or status control. Do not assume that turning on the system proxy also enables TUN: they are separate traffic-capture options.

If the client offers a service installation button, install or enable the service before switching TUN on. Windows may display a User Account Control prompt. Read the prompt and confirm that the requesting application is the Clash Verge Rev installation you opened. The service needs elevated permission because creating or configuring a virtual interface and adjusting routes can require administrator-level operations. A normal user account may run the interface while the service performs those privileged tasks.

Approve only a prompt that appears as part of the action you initiated in the client. If Windows asks for credentials, use the administrator credentials for that computer—not a subscription URL, proxy password, or website login. If the button reports success but TUN still cannot start, close the client and reopen it once, then check whether the service status is shown as installed or running. The exact service name and status presentation can differ across client versions.

Turn on TUN and review options

After the service is ready, enable TUN in Clash Verge Rev. If Windows asks again for permission, confirm the request only if it corresponds to the action you just took. Wait for the client to report that TUN is active before testing applications. Avoid enabling multiple capture mechanisms in other VPN clients at the same time.

Some releases expose options such as automatic route configuration, stack selection, DNS hijacking, IPv6 handling, or route exclusions. Start with the client’s defaults unless you have a specific reason to change them. These controls do not have identical behavior in every mihomo or Clash Verge Rev version. In particular, DNS hijacking concerns how DNS requests are handled; it does not replace the configuration’s proxy rules or guarantee that encrypted DNS used by every application is intercepted.

• Route exclusions: Check whether the configuration or client excludes local networks, specific addresses, or applications. An excluded destination may intentionally bypass TUN.
• IPv6: If only IPv4 traffic is being captured, an application may still attempt an IPv6 connection. Do not disable IPv6 across Windows as a first step; first check the client’s IPv6 and route behavior.
• Stack and DNS options: Change one option at a time and retest. If a change makes the connection worse, restore the previous value before trying another.

There is no single YAML fragment that must be pasted into every installation to enable TUN. Clash Verge Rev manages client-level controls, and supported configuration fields depend on the core and application version. If you do need to edit a configuration, use the client’s supported override or merge mechanism where available, retain a backup, and validate the result before relying on it. Avoid copying a full TUN block from an unrelated client or an older core.

Verify the virtual adapter and test traffic

Once the client reports TUN as active, confirm that Windows has a corresponding virtual network adapter. Open Settings → Network & internet → Advanced network settings on Windows 11, or open Control Panel → Network and Internet → Network Connections on versions where that view is available. The adapter name can vary; it may identify the client, mihomo, or a TUN-related component. Do not disable or remove an unfamiliar adapter while the client is using it.

Device Manager provides another view: open Device Manager → Network adapters and check for a virtual adapter associated with the active client. A listed adapter is useful evidence, but it does not by itself prove that traffic is being captured. Conversely, adapter labels can vary, so compare the list before and after enabling TUN rather than relying on one expected product name.

Test in a controlled sequence. Keep the same configuration and node, open one website that normally works directly, then test one service that requires the proxy. Next, try the application that previously ignored the system proxy. If the client has a connection or log view, look for the destination and the policy selected for that request. A DIRECT result may be expected under the active rules; it does not mean TUN failed to capture the connection.

For an additional Windows-side check, open Command Prompt and run ipconfig to inspect the active interfaces, or run route print to view routes. These commands are diagnostic, not repair commands. Do not delete routes or change interface metrics based on a guess. If you need to compare behavior, note the output with TUN off and on, then restore the client’s normal state after the comparison.

Also test local resources you rely on, such as a printer, NAS, or office server. Rules and exclusions may intentionally send private network destinations directly, while other configurations may route them differently. If a local resource becomes unreachable only with TUN enabled, investigate the destination’s route and the applicable rule before changing DNS or disabling the adapter.

Troubleshoot startup failures and VPN conflicts

If TUN does not start, use the exact error message and client logs to identify the failing layer. Do not reinstall the application as the first response: an installation error, a permission failure, an adapter conflict, and a routing conflict require different fixes. Turn TUN off before testing changes so that each test begins from a known state.

• Service installation fails or permission is denied: Check whether the client was allowed to request elevation and whether the Windows account has administrator rights. On a managed device, ask the administrator about service-installation restrictions. Restarting the client as administrator may help with a permission issue, but it cannot override organization policy or another software conflict.
• The service is installed but TUN remains unavailable: Restart Clash Verge Rev, check the service status in its settings, and review the client’s error log. If the service is missing or stopped, use the client’s own service controls to repair or reinstall it rather than manually creating a Windows service with an assumed name.
• The adapter does not appear: Confirm that TUN actually reached the active state, then check Device Manager for disabled devices or warnings. Security software may block driver or adapter installation. Use the client’s supported repair path and consult the relevant security policy rather than downloading a driver from an unknown source.
• TUN starts but the internet stops working: Turn TUN off and check whether the system proxy was left pointing to a local port after the client stopped. Restore ordinary connectivity, then test with one proxy client active. If the client log shows requests reaching the core, inspect the selected policy, node availability, and rule result before changing Windows routes.
• Only some applications fail: Check whether the application uses IPv6, encrypted DNS, UDP, or a network path excluded by the configuration. Test another application and inspect the core log. System proxy support and TUN support differ, and a node may not support the protocol the application is using.
• Other VPN software stops working: Disconnect that VPN and test Clash Verge Rev alone. VPN clients can compete over default routes, DNS, virtual adapters, or network filters. If both are required, check whether one supports a documented split-tunnel or coexistence setup; do not attempt to run both TUN interfaces simultaneously without verifying the route design.

A useful isolation test is to disable TUN, disconnect other VPNs, and confirm that the system proxy still works. Then reconnect only Clash Verge Rev’s TUN and repeat the same tests. If the system proxy works but TUN fails, focus on service permissions, adapter creation, route conflicts, or TUN-specific options. If both methods fail, investigate the configuration, node, local port, or basic network connection first.

When reporting a persistent problem, include the Clash Verge Rev version, Windows edition and build, core version if shown, the full error text, whether the service is installed, whether the adapter appears, and the relevant log lines around startup. Remove subscription URLs, credentials, private IP details, and other sensitive information before sharing logs. Once the test is complete, turn off any temporary diagnostic setting, reconnect only the VPNs you actually need, and verify that local network access and the Windows proxy state are as intended.