TUN mode explained: how it works, how to enable it, when to use it

Programs the system proxy cannot reach (games, CLI tools, some clients) are all reachable by TUN mode. It creates a virtual network adapter so the OS routes all traffic to Clash — no app can bypass it.

Enabling it

1. Install Service Mode first: Settings → Service Mode → Manage → Install; the globe icon turns green when done. TUN needs system privileges to create the adapter, and Service Mode grants them by running the core as a service;
2. Back on General, toggle TUN Mode on;
3. Verify: in a terminal with no proxy variables set, run curl ip.gs — if it returns the node's IP, TUN has taken over.

Notes

• TUN and the system proxy can be on together without conflict — traffic covered by the system proxy will not enter TUN twice;
• Under TUN, DNS is hijacked by Clash. If you can reach IPs but not domains, see "Fixing TUN with no network";
• If you only need a browser proxied, the system proxy alone is fine — TUN adds a little CPU overhead.