Clash TUN Mode Guide: Setting Up Global Transparent Proxy

What Is TUN Mode?

TUN mode creates a virtual network interface on your operating system. All network traffic from your device is routed through this virtual interface, where Clash intercepts and processes each connection. This gives you a truly transparent proxy that no application can bypass.

Unlike system proxy mode, which only affects applications that respect the operating system's proxy settings, TUN mode operates at the network layer (Layer 3). This means every TCP and UDP connection, regardless of the application or protocol, passes through Clash.

If you are new to Clash and have not yet set up a basic installation, we recommend starting with our Windows installation guide before diving into TUN mode.

System Proxy vs. TUN Mode

In practice, most web browsers and standard desktop applications work fine with system proxy mode. TUN mode is necessary when you need to proxy games, SSH connections, Docker containers, or any application that uses raw TCP/UDP sockets.

How TUN Mode Works Internally

When TUN mode is activated, the following sequence occurs:

1. The Clash core creates a virtual network adapter (the TUN device)
2. The system routing table is modified so that all traffic is directed through this virtual adapter
3. Clash intercepts each connection, examines it against the rule set, and either proxies it, sends it directly, or rejects it
4. For proxied connections, the traffic is forwarded to the remote proxy server using the configured protocol (Trojan, VLESS, Shadowsocks, etc.)
5. The response is routed back through the virtual adapter to the originating application

The dns-hijack setting is critical in this process. It ensures that DNS queries sent to any destination (typically port 53) are captured by Clash's internal DNS resolver. Without this, DNS queries could leak outside the proxy tunnel, revealing your true browsing targets.

Enabling TUN Mode in Different Clients

Clash Verge Rev (Windows/macOS/Linux)

Clash Verge Rev provides the most straightforward TUN mode setup. The GUI handles service installation and configuration automatically:

1. Open Clash Verge Rev
2. Navigate to Settings
3. Find the Clash Core Settings section
4. Enable TUN Mode
5. If prompted, allow the application to install the service helper (requires admin/root privileges)

For advanced configuration, you can add TUN settings to your profile override. See our rule configuration tutorial for how to use profile overrides effectively.

Clash Meta for Android

On Android, TUN mode requires the VPN permission. When you enable TUN in the app, Android will prompt you to authorize the VPN connection. Once authorized, all device traffic flows through Clash.

# Android TUN configuration (in the app settings)
tun:
  enable: true
  stack: system
  dns-hijack:
    - any:53
  auto-route: true

Android's battery optimization may kill the Clash process in the background. Disable battery optimization for the app to maintain a persistent TUN connection.

OpenWrt / Linux Router

For router-level deployment, TUN mode provides a transparent proxy for all devices on your network. This requires careful configuration to avoid routing loops:

# /etc/config/clash (OpenWrt example)
config tun
    option enable '1'
    option stack 'mixed'
    option auto_route '1'
    option auto_detect_interface '1'

# In the main config.yaml
tun:
  enable: true
  stack: mixed
  dns-hijack:
    - any:53
  auto-route: true
  auto-detect-interface: true
  route-exclude-address-set:
    - 192.168.0.0/16
    - 10.0.0.0/8

TUN Mode Configuration Reference

Here is a comprehensive TUN configuration with all available options:

tun:
  enable: true
  stack: mixed          # Options: system, gvisor, mixed
  dns-hijack:
    - any:53            # Hijack all DNS traffic on port 53
  auto-route: true      # Automatically add system routes
  auto-detect-interface: true  # Auto-detect network interface
  strict-route: true    # Enforce strict routing (prevent leaks)
  mtu: 9000             # Maximum Transmission Unit
  route-exclude-address-set:
    - 192.168.0.0/16
    - 172.16.0.0/12
    - 10.0.0.0/8
    - 127.0.0.0/8
  route-include-address-set: []  # Force-include specific ranges

Stack Selection

• system: Uses the OS native TCP/IP stack. Lowest latency but less control over connection handling.
• gvisor: Uses Google's gVisor userspace TCP stack. Better control and compatibility, slightly higher latency.
• mixed: Combines both stacks. Uses gVisor for TCP and system stack for UDP. This is the recommended default for most users.

Preventing DNS Leaks in TUN Mode

DNS leaks are the most common privacy issue in TUN mode setups. Even if all your traffic is routed through the proxy, DNS queries sent before the TUN interface is fully initialized can expose your browsing activity.

To prevent DNS leaks:

dns:
  enable: true
  listen: "0.0.0.0:1053"
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
    - "*.lan"
    - "*.local"
    - "dns.msftncsi.com"
    - "www.msftncsi.com"
    - "www.msftconnecttest.com"
  default-nameserver:
    - 223.5.5.5
    - 119.29.29.29
  nameserver:
    - "https://dns.alidns.com/dns-query"
    - "https://doh.pub/dns-query"
  proxy-server-nameserver:
    - "https://dns.google/dns-query"
    - "https://cloudflare-dns.com/dns-query"

Key points for DNS leak prevention:

• The dns-hijack: any:53 setting in TUN mode captures all DNS queries regardless of destination
• fake-ip mode prevents DNS leaks by returning synthetic IPs immediately, deferring real resolution to the proxy side
• proxy-server-nameserver is used exclusively to resolve proxy server addresses, and these queries go through the proxy
• Set strict-route: true in the TUN configuration to ensure no traffic bypasses the virtual interface

For a complete DNS configuration guide, see our DNS anti-pollution configuration article.

Troubleshooting Common Issues

TUN Mode Fails to Start

The most common cause is missing permissions. On Windows, Clash Verge Rev needs to run as administrator. On Linux/macOS, the core binary needs CAP_NET_ADMIN capability or root access.

# Linux: Grant network capabilities without root
sudo setcap cap_net_bind_service,cap_net_admin=+p /path/to/mihomo

Network Disappears After Enabling TUN

This usually indicates a routing conflict. Check for:

• Another VPN software running simultaneously (e.g., WireGuard, OpenVPN)
• Overlapping route tables from previous TUN sessions

Fix: Disable other VPN software, then restart the Clash service. On Linux, you can clear stale routes with ip route flush table main (use with caution).

Slow Performance in TUN Mode

Try switching the stack from mixed to system for lower latency. Also, increasing the MTU to 9000 can reduce fragmentation overhead:

tun:
  stack: system
  mtu: 9000

Specific Apps Not Being Proxied

Some applications use their own DNS resolver (like Firefox with DNS-over-HTTPS). Ensure dns-hijack is set to any:53 and that fake-ip mode is active. If an app hardcodes DNS servers, add those to the dns-hijack list:

tun:
  dns-hijack:
    - any:53
    - 8.8.8.8:53
    - 1.1.1.1:53

Performance Considerations

TUN mode introduces a small performance overhead compared to system proxy mode because every packet traverses the virtual network interface. The overhead depends on the stack type:

• system stack: 1-3% throughput reduction, negligible latency increase
• gvisor stack: 5-10% throughput reduction, 1-2ms latency increase
• mixed stack: Between the two, optimized for common use cases

For bandwidth-intensive tasks like video streaming or large downloads, the difference is typically imperceptible. For latency-sensitive applications like competitive gaming, the system stack is preferred.

If you are also optimizing your node connection stability, combining TUN mode with a well-configured rule set provides the best overall experience.