The system proxy politely asks programs to use a proxy; TUN mode takes the traffic at the network layer. It creates a virtual network adapter that owns the default route, so all TCP/UDP traffic enters the Clash core - including CLI tools, games and clients that ignore proxy settings.
Enabling it
- Install Service Mode: Settings → Service Mode → Manage (administrator rights required). A green dot indicates success. TUN needs adapter-creation privileges, which the service provides.
- Turn on TUN: back on the General page, flip TUN Mode.
- A network adapter named Clash appears, and the Connections page starts showing traffic from all kinds of processes.
TUN vs system proxy
| System proxy | TUN mode | |
|---|---|---|
| Coverage | Programs honoring proxy settings | Nearly everything |
| Privileges | None | Service Mode required |
| DNS | Left to each program | Handled by Clash (fake-ip) |
| Typical use | Everyday browsing | CLI, games, UWP, full capture |
They can run together without conflict; running TUN alone is also fine.
Configuration details (advanced)
TUN relies on the tun and dns sections. If your subscription lacks them, inject via Mixin:
mixin:
tun:
enable: true
stack: gvisor
dns-hijack:
- 198.18.0.2:53
dns:
enable: true
enhanced-mode: fake-ip
nameserver:
- 1.1.1.1
- 8.8.8.8
stack: gvisoris the userspace stack with the best compatibility;systemis faster but more environment-sensitive - fall back to gvisor when in doubt.- With
fake-ip, Clash answers DNS with reserved-range addresses (198.18.0.0/16) and maps them back to domains at connect time - lower resolution latency and no DNS leaks. Details in Custom DNS.