The system proxy politely asks programs to use a proxy; TUN mode takes the traffic at the network layer. It creates a virtual network adapter that owns the default route, so all TCP/UDP traffic enters the Clash core - including CLI tools, games and clients that ignore proxy settings.

Enabling it

  1. Install Service Mode: Settings → Service Mode → Manage (administrator rights required). A green dot indicates success. TUN needs adapter-creation privileges, which the service provides.
  2. Turn on TUN: back on the General page, flip TUN Mode.
  3. A network adapter named Clash appears, and the Connections page starts showing traffic from all kinds of processes.
Sponsored Where does the subscription link come from? Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click. Get high-speed nodes

TUN vs system proxy

System proxyTUN mode
CoveragePrograms honoring proxy settingsNearly everything
PrivilegesNoneService Mode required
DNSLeft to each programHandled by Clash (fake-ip)
Typical useEveryday browsingCLI, games, UWP, full capture

They can run together without conflict; running TUN alone is also fine.

Configuration details (advanced)

TUN relies on the tun and dns sections. If your subscription lacks them, inject via Mixin:

mixin:
  tun:
    enable: true
    stack: gvisor
    dns-hijack:
      - 198.18.0.2:53
  dns:
    enable: true
    enhanced-mode: fake-ip
    nameserver:
      - 1.1.1.1
      - 8.8.8.8
  • stack: gvisor is the userspace stack with the best compatibility; system is faster but more environment-sensitive - fall back to gvisor when in doubt.
  • With fake-ip, Clash answers DNS with reserved-range addresses (198.18.0.0/16) and maps them back to domains at connect time - lower resolution latency and no DNS leaks. Details in Custom DNS.
Won't start? The full checklist for TUN start failures and no-network-after-enable is in TUN Mode Issues.