TUN mode touches virtual adapters, routing tables and DNS hijacking - more moving parts than the system proxy. Find your scenario below.

Scenario 1: the TUN switch won't enable / flips back

  1. Service Mode missing: Settings → Service Mode → Manage → install; the dot must turn green. This is a hard prerequisite.
  2. Service installed but unhealthy: Uninstall, then Install again; if antivirus interferes, whitelist first and reinstall.
  3. start tun interface error in the logs: usually the wintun driver failed to load - reboot and retry; persistent failure suggests security software blocking driver loads.

Scenario 2: TUN enables, then the whole machine loses internet

Nine times out of ten, DNS wasn't taken over. TUN requires the built-in DNS with hijacking. Ensure via Mixin:

mixin:
  dns:
    enable: true
    enhanced-mode: fake-ip
    nameserver:
      - 1.1.1.1
  tun:
    enable: true
    stack: gvisor
    dns-hijack:
      - 198.18.0.2:53

Re-activate the profile and re-enable TUN. Still dead? Flip stack between gvisor and system - the two stacks tolerate different environments.

Scenario 3: mostly works, specific apps or sites broken

  • LAN devices unreachable: add private-range direct rules (most templates have them) - see IP Rules.
  • An app chokes on fake IPs: add its domains to fake-ip-filter - see the DNS guide.

Scenario 4: conflicts with other network software

VPN clients, VM adapters and game accelerators all edit the routing table; conflicts with TUN range from slowdown to blackout. The blunt but effective method: quit all such software, verify TUN alone, then add them back one at a time to find the culprit - then pick one or the other.

The quick reset

In order: TUN off → quit CFW → in Device Manager remove any leftover adapter named Clash → reboot → relaunch and re-enable TUN. Cures most "it worked yesterday" cases.

Tip: keep the system proxy off while debugging TUN so the two paths don't muddy each other's evidence.