Mode Overview
TUN Mode
TUN mode creates a virtual network adapter and hands system-level traffic to Clash. It covers more apps than system proxy, including command-line tools and some games, but usually needs elevated permission and may conflict with other VPN, antivirus, or security tools.
- Routing behaviorCapture system traffic through a virtual adapter, then route by rules.
- Common namesTUN, Enhanced Mode, virtual adapter.
- Best forDesktop apps, games, command line, apps that ignore system proxy.
Use Cases
When to use it
Apps ignore system proxy
Some clients, CLI tools, and games do not read system proxy. TUN can capture them.
Whole-app routing
When you want all apps to follow Clash rules, TUN is more complete.
DNS and transparent proxy
TUN is useful when you need tighter DNS, Fake-IP, or transparent-proxy behavior.
Setup
Setup advice
- Confirm permissionsWindows and macOS may require services, network extensions, or administrator approval.
- Avoid VPN conflictsDo not run multiple VPN or TUN tools at the same time. Disable other proxy tools if problems appear.
- Test graduallyStart with the browser, then target apps, then inspect logs and DNS hits.
Best Practice
Usage notes
Best practice: First make sure system proxy works. Enable TUN only when apps ignore system proxy or whole-system capture is required.