TUN mode explained: how it works, how to enable it, when to use it
Programs the system proxy cannot reach (games, CLI tools, some clients) are all reachable by TUN mode. It creates a virtual network adapter so the OS routes all traffic to Clash — no app can bypass it.
Enabling it
- Install Service Mode first: Settings → Service Mode → Manage → Install; the globe icon turns green when done. TUN needs system privileges to create the adapter, and Service Mode grants them by running the core as a service;
- Back on General, toggle TUN Mode on;
- Verify: in a terminal with no proxy variables set, run
curl ip.gs— if it returns the node's IP, TUN has taken over.
Notes
- TUN and the system proxy can be on together without conflict — traffic covered by the system proxy will not enter TUN twice;
- Under TUN, DNS is hijacked by Clash. If you can reach IPs but not domains, see "Fixing TUN with no network";
- If you only need a browser proxied, the system proxy alone is fine — TUN adds a little CPU overhead.