The system proxy politely asks programs to use a proxy; TUN mode takes the traffic at the network layer. It creates a virtual network adapter that owns the default route, so all TCP/UDP traffic enters the Clash core - including CLI tools, games and clients that ignore proxy settings.

Enabling it

  1. Install Service Mode: Settings → Service Mode → Manage (administrator rights required). A green dot indicates success. TUN needs adapter-creation privileges, which the service provides.
  2. Turn on TUN: back on the General page, flip TUN Mode.
  3. A network adapter named Clash appears, and the Connections page starts showing traffic from all kinds of processes.

TUN vs system proxy

System proxyTUN mode
CoveragePrograms honoring proxy settingsNearly everything
PrivilegesNoneService Mode required
DNSLeft to each programHandled by Clash (fake-ip)
Typical useEveryday browsingCLI, games, UWP, full capture

They can run together without conflict; running TUN alone is also fine.

Configuration details (advanced)

TUN relies on the tun and dns sections. If your subscription lacks them, inject via Mixin:

mixin:
  tun:
    enable: true
    stack: gvisor
    dns-hijack:
      - 198.18.0.2:53
  dns:
    enable: true
    enhanced-mode: fake-ip
    nameserver:
      - 1.1.1.1
      - 8.8.8.8
  • stack: gvisor is the userspace stack with the best compatibility; system is faster but more environment-sensitive - fall back to gvisor when in doubt.
  • With fake-ip, Clash answers DNS with reserved-range addresses (198.18.0.0/16) and maps them back to domains at connect time - lower resolution latency and no DNS leaks. Details in Custom DNS.
Won't start? The full checklist for TUN start failures and no-network-after-enable is in TUN Mode Issues.