TUN Mode Explained

Limits of a System Proxy

Both Windows and macOS offer a "system proxy" setting: you enter a proxy address and port in system preferences, and well-behaved apps like browsers and mail clients read that setting and route their requests through it. It's simple to set up and broadly compatible, which is why it's the most common way people run Clash.

But a system proxy has one fundamental limitation: it only works if an application chooses to cooperate. A system proxy setting is really just a suggestion — the OS has no way to force every program to honor it, and any app is free to call lower-level networking APIs and bypass it entirely. A few common scenarios where a system proxy simply doesn't help:

Game clients: Steam, Epic Games Store, and EA App typically manage their own networking and ignore the system proxy entirely. When you're playing a latency-sensitive multiplayer game, even with Clash running, game traffic still connects directly and gets none of the benefit.

UWP apps (Windows): Windows Store apps run in an AppContainer sandbox that blocks them from reading system proxy settings. The Xbox app, the Windows version of Spotify, and several built-in Microsoft tools fall into this category.

Command-line tools: Tools like git, npm, pip, and docker pull won't use the system proxy unless you've manually set the HTTP_PROXY environment variable. This is a particular pain for developers, who otherwise have to export proxy variables by hand in every terminal session.

iOS / Android apps: On mobile, the system proxy setting typically only affects HTTP/HTTPS traffic — UDP traffic (many games, video calls, and DNS queries) bypasses it completely.

What Is TUN Mode

TUN (short for "tunnel") is a virtual network device interface provided by the OS kernel, originally designed for VPN implementations. TUN mode has Clash create a virtual network adapter at the kernel level (usually named utun or Meta) and modifies the system routing table so that all network traffic on the device — not just traffic from apps that respect a system proxy — gets sent to that virtual adapter, where Clash then routes it according to your rules.

This means traffic is intercepted by Clash at the kernel level before it ever reaches an application's own networking stack. It doesn't matter whether the app respects the system proxy, what programming language it's written in, or what networking framework it uses — any traffic it generates has to pass through Clash's rule engine. This is what "true global proxying" means: nothing can slip past it.

How It Works

When you enable TUN mode, Clash does a few things behind the scenes:

Step 1: Create a virtual adapter. Clash registers a virtual network device with the OS kernel and assigns it a private IP range (such as 198.18.0.0/16). This adapter has no physical hardware behind it — Clash simulates its behavior entirely in user space.

Step 2: Rewrite the routing table. Clash adds two catch-all routes to the system routing table: all traffic destined for 0.0.0.0/1 and 128.0.0.0/1 (which together cover the entire IPv4 address space) gets sent to the virtual adapter. These routes take priority over the default gateway route, guaranteeing that all outbound traffic passes through Clash first.

Step 3: DNS interception (Fake-IP). TUN mode is usually paired with Fake-IP DNS. When an app makes a DNS query, Clash immediately hands back a "fake" internal IP (something like 198.18.x.x). The app connects using that fake IP, Clash intercepts the connection at the virtual adapter, resolves it back to the original domain, and then decides whether to proxy it or connect directly based on your rules. This whole process is invisible to the app, skips the latency of a real DNS lookup, and completely eliminates DNS leaks, since no query ever reaches your default DNS server.

Step 4: Traffic routing. Once Clash has intercepted a connection, it checks your rule set to decide what to do with it: direct-match traffic is forwarded straight to the real network adapter, proxy-match traffic is relayed through your chosen node, and anything matching a block rule is dropped.

Common Use Cases

Proxying games: This is the single biggest reason people turn on TUN mode. Steam downloads, in-game matchmaking, and voice chat (Discord) all rely on UDP, which a system proxy can't touch. With TUN mode enabled, UDP traffic gets captured too, which can meaningfully reduce latency and improve stability when playing on servers in another region.

Developer tools: No more manually exporting proxy environment variables. Commands like npm install, git clone, and docker pull automatically route through the proxy under TUN mode, which makes for a much smoother developer experience.

Streaming apps: Some streaming apps (a native Netflix app, for instance, as opposed to the browser version) bypass the system proxy entirely. TUN mode makes sure their traffic still goes through your proxy node.

iOS traffic management: On iOS, Clash Plus uses TUN/VPN mode by default, so every app's traffic — including UDP video calls — falls under the proxy's rules and can be managed and routed consistently.

Setup by Platform

Windows

Run Clash Plus as administrator (right-click → "Run as administrator," or confirm its permission level in Task Manager). Go to Settings → TUN Mode and flip on "Enable TUN Mode." The first time you enable it, the app will try to install a virtual adapter driver — click "Yes" when the UAC prompt appears. Once it's installed, you should see a virtual adapter named "Mihomo" or "WinTun" in Device Manager, confirming it worked.

macOS

Go to Settings → TUN Mode and flip the toggle on. The first time you do this, macOS will show a "System Extension Blocked" notification — go to System Settings → Privacy & Security, find the relevant extension under the Security section, and click "Allow." You'll need to enter your admin password and restart Clash Plus once. After that first setup, you won't need to re-authorize.

Android / iOS

Clash Plus on mobile already runs in TUN/VPN mode by default — tap "Connect" on the home screen, allow the VPN permission prompt, and you're already running in TUN mode with no extra setup required. On iOS, it's worth also enabling "On Demand" so the proxy doesn't drop when the screen locks.

Choosing a Stack Mode

TUN mode in Clash Plus (the Mihomo core) supports three network stack implementations, set via the stack field in the tun section of your config:

For most people, mixed is the best choice: TCP connections use the native OS stack for full performance, while UDP connections use gVisor for more reliable DNS handling and better UDP NAT traversal. If a specific UDP-based app misbehaves, try switching back to system to see if that resolves it.

Things to Watch For

Permissions: TUN mode needs administrator/root privileges because modifying the system routing table is a privileged operation. On Windows, forgetting to run Clash Plus as administrator is the most common reason TUN mode fails to start.

Running alongside a system proxy: You can leave your system proxy enabled while also using TUN mode. Apps that respect the system proxy will have their HTTP(S) traffic handled by it directly, while TUN mode catches everything else as a fallback. The two don't conflict — traffic handled by the system proxy technically loops back through the TUN adapter, but Clash handles that internally to avoid an infinite loop.

Performance overhead: Because TUN mode intercepts and processes every packet at the kernel level, it uses more CPU and memory than a plain system proxy. On lower-powered devices (older phones, a Raspberry Pi), this can be noticeable — for light everyday use, a system proxy is usually the better default.

Avoiding proxy loops: Traffic from Clash to your actual proxy server needs to bypass the TUN adapter itself, or you'll end up with an infinite loop. The Mihomo core automatically marks outbound proxy connections as direct traffic to prevent this, so you shouldn't need to intervene manually — but if a connection hangs, a routing loop is worth checking for.