Clash TUN on Windows 11 & macOS: Setup, System Proxy Differences, No-Internet Fixes

Why desktop users reach for TUN mode

Most Clash graphical clients can flip on “System Proxy” in one click. That path writes HTTP and SOCKS endpoints into the operating system so compliant programs pick them up automatically. The limitation is visibility: anything that does not honor those settings—many games, custom SDKs, older Win32 tools, or utilities that open raw sockets—will still try the default route and behave as if no proxy exists.

Clash TUN mode addresses that gap by sitting closer to the network stack. Instead of asking each app to cooperate, the core exposes a tunnel interface and uses policy routing (and on Windows, often a traffic filter) so eligible packets are steered into Clash before they leave the machine. In plain language, you are trading a little complexity for coverage: fewer “mystery direct” connections when your rules are correct.

That power comes with responsibility. Misconfigured DNS, incompatible VPN software, corporate endpoint agents, or an outdated Meta (mihomo) core can all produce the dreaded symptom where everything breaks the moment TUN toggles on. The sections below separate normal expectations from real misconfigurations so you can recover quickly.

TUN mode versus system proxy: what actually changes

Both modes can ultimately send traffic through the same upstream nodes, but they hook the OS at different layers. Understanding the distinction saves hours of toggling random switches.

Neither mode replaces thoughtful rules. If your MATCH line sends traffic to a dead group, both modes will feel broken. For ordering policy groups and Rule Providers, keep our YAML routing tutorial open while you test.

Prerequisites on Windows 11 and macOS

Before enabling TUN, align these basics. Skipping them is the fastest way to invent phantom bugs.

Run a maintained Meta (mihomo) core

TUN features evolve with the engine. Whether you use Clash Verge Rev, Clash for Windows derivatives, or a macOS fork, open the about screen and confirm the core string references Meta / mihomo. If you are still on an abandoned Premium-only build, upgrade before touching advanced modes.

Administrator rights and helpers

On Windows 11, installing or elevating the WFP network filter often requires running the client as administrator once, or approving a driver/helper installation prompt. On macOS, the first time you enable system extensions or packet tunneling, approve the security dialog under System Settings → Privacy & Security and reboot if macOS insists.

Remove overlapping VPNs (temporarily)

Commercial VPN clients and some enterprise agents install their own virtual adapters and routes. Two tunnel drivers fighting for the same default route is a common reason for “TUN on = no internet.” Pause the other VPN, test Clash, then reintroduce tooling only if you truly need both—and expect to tune exclusions.

Enable Clash TUN mode on Windows 11

Exact menu labels differ by fork, but the workflow is consistent: elevate permissions, turn on TUN, accept the filter driver, then verify the virtual adapter appears.

Clash Verge Rev (recommended path)

1. Install the latest build from our Windows download section and launch it.
2. Open Settings (or Preferences) and locate TUN Mode / Virtual Adapter. Toggle it on.
3. If Windows prompts for administrator approval or driver installation, allow it. Without the helper, TUN cannot attach to traffic.
4. Confirm the core log shows the tunnel interface coming up without bind errors. If you see “address already in use,” another process owns the TUN IP—change the stack port or stop the conflicting app.
5. In Network & internet → Advanced network settings, you should see a new virtual Ethernet adapter associated with the Clash meta stack. Status should read connected when the tunnel is active.

Clash for Windows–style clients

Legacy Clash for Windows exposes TUN behind Service Mode / TUN switches and may require installing a WinTun driver. If the toggle greys out, exit the app, re-run the installer as administrator, or manually allow the driver under Windows Security → Device security. After enabling, revisit the General page to ensure the Mixin or profile merge did not disable tun in YAML.

YAML sanity for Windows TUN

GUIs often write the tun section for you. When you inspect merged config, you typically expect enable: true plus a stable stack choice. A minimal illustration:

tun:
  enable: true
  stack: system # or mixed/gvisor depending on client support
  auto-route: true
  strict-route: false # set true only when you understand split routing impact
  dns-hijack:
    - any:53

Do not copy blindly: your client may rename fields or expose them only in the UI. Treat this as a reference when comparing against the effective running config in the log viewer.

Enable Clash TUN mode on macOS

macOS separates “proxy preferences” from kernel extensions and user-space tunnel helpers. TUN-capable Clash GUIs bundle a helper that macOS must trust.

Permissions and first launch

1. Install a current Meta-based GUI from our macOS download page and move it to /Applications.
2. Open the app; when macOS blocks a helper, go to System Settings → Privacy & Security and choose Allow. Some builds require lowering Gatekeeper once—prefer notarized releases when available.
3. In the Clash UI, enable TUN / Enhanced Mode (wording varies). Approve any VPN-configuration prompts so macOS can install routes.
4. Check System Settings → Network for a new interface (often utun). It should show active while Clash runs and disappear after quit.

Apple Silicon versus Intel

Always install the architecture-matched build. An Intel binary running under Rosetta can still work, but mismatched helper bundles are a frequent source of silent TUN failure. If the tunnel never appears, reinstall the correct DMG and clear quarantine flags: xattr -dr com.apple.quarantine /Applications/YourClash.app.

DNS on macOS with TUN

macOS applications may use VPN DNS, system resolvers, or their own DoH stacks. When TUN is on, align Clash DNS settings (dns section) with your rule mode—especially if you use fake-ip. A mismatch here looks like “some sites load, others hang forever.”

What the virtual network adapter is doing

Think of the virtual network adapter as a software-only NIC. Clash attaches IP addresses and routes to it so the kernel forwards certain packets inward for inspection. Unlike a simple SOCKS port listening on localhost, the adapter participates in the routing table, which is why a bad route or overlapping subnet can disrupt every application simultaneously.

On Windows you might see entries such as a Meta / WinTun interface with a private IPv4 range; on macOS you might notice a utun device with an internal address. Both are normal when the tunnel is up. What is not normal is duplicate default routes of equal metric pointing to different tunnels—that scenario produces intermittent “half the internet works” behavior.

No internet after enabling TUN: structured troubleshooting

When the entire machine loses connectivity, resist random checkbox roulette. Work top-down: tunnel interface, routes, DNS, then rules.

Step 1 — Confirm the tunnel interface is healthy

If the adapter never appears, the helper failed. Reinstall the client, approve drivers, and ensure no other VPN owns the same TUN name. On Windows, reboot after driver setup; on macOS, reboot after blocking/unblocking system extensions.

Step 2 — Check for routing loops and strict routing

auto-route manipulates the routing table. If you also run a second tunnel or manual static routes, you can loop traffic. Temporarily set strict-route to false if you recently enabled it, or disable the other VPN. Corporate Wi-Fi captive portals may also require local subnet exceptions—add PROCESS-NAME or IP-CIDR bypasses for the authentication domain if your policy allows.

Step 3 — DNS hijack versus local resolvers

With dns-hijack active, Clash expects to answer DNS. If the dns section is empty, upstream unreachable, or filtered by a firewall, every lookup stalls. Switch DNS mode to a minimal working configuration, then reintroduce advanced options. Remember that fake-ip requires matching rules; otherwise browsers may query addresses that never match your DOMAIN rules.

Step 4 — Validate upstream nodes

TUN magnifies outages. If your selected proxy group points to dead nodes, system proxy might have cached fewer connections, masking the issue. Run latency tests and try a different node before blaming TUN itself.

Some applications still go direct: realistic expectations

TUN improves coverage but is not a magical “capture everything” switch. Several classes of software can still bypass or partially bypass depending on permissions and stack choices.

• Hard-coded endpoints and pinned certificates — the traffic may still enter Clash, but TLS interception is not what Clash does; if the app refuses non-local trust stores, you will see errors rather than stealth proxying.
• Split tunneling features inside the app — some collaboration tools maintain their own “direct UDP” channels for voice or LAN discovery.
• Processes with firewall exemptions — third-party endpoint security can whitelist binaries beneath Clash’s filter.
• Browser DoH — DNS may skip the OS resolver, masking rule issues. Align browser secure DNS settings with your debugging session.

When a single app misbehaves, inspect Clash logs with process-level metadata if your client supports it, then add explicit PROCESS-NAME or DOMAIN-SUFFIX rules. Keep changes small and test after each addition so you can roll back quickly.

A practical workflow you can repeat

Stable desktop setups tend to follow the same rhythm. First, prove system proxy works with a simple rule set. Second, upgrade the Meta core. Third, enable TUN, confirm the adapter, and run a DNS-heavy site plus a non-browser tool (for example curl without special flags). Fourth, expand rules with policy groups as needed. Fifth, document the one or two toggles you truly need—strict route, DNS hijack, or bypass LAN—so future you can reset confidently.

If you distribute profiles across a team, avoid baking machine-specific paths. Instead, keep tun defaults conservative and let advanced users opt into stricter routing through a documented override file.

Closing thoughts

Clash TUN mode is the bridge between “proxy works in Chrome” and “this whole session follows my policy table.” The cost is deeper integration with Windows 11 and macOS networking: virtual adapters, DNS, and routes must agree. When they do, you gain transparent coverage without per-app SOCKS gymnastics. When they do not, the failure surface is wider than system proxy alone—which is exactly why a structured checklist beats superstition.

Compared with constantly patching individual applications, a maintained Meta-based client plus clear rules usually feels calmer day to day: fewer surprise direct connections, less tab switching, and a single place to read logs when something drifts. If your current bundle makes TUN feel fragile, trying a newer GUI from the same ecosystem often fixes driver mismatches without changing your subscription.

For more routing depth after TUN is stable, continue with the policy group guide and other articles in our tech column.