Clash TUN Mode Troubleshooting

TUN can capture more application traffic, but it also raises the troubleshooting cost. Confirm normal system proxy works before enabling TUN.

Reading tip

Identify the scenario first, then follow the checks in order. Jump to the linked download, subscription or configuration page when the issue becomes specific.

Before Turning It On

  • The subscription updates successfully and nodes can connect.
  • Rule or Global mode works through normal system proxy.
  • No other VPN, proxy driver or network filter is running at the same time.

Recovery Order When Internet Breaks

  1. Disable TUN immediately and confirm normal network access returns.
  2. Restart the client and test only system proxy.
  3. Check administrator permission, virtual adapter, DNS hijack and route table changes.
  4. Disable other VPN, firewall enhancement or network acceleration tools temporarily.
  5. Enable auto-route, auto-detect-interface and dns-hijack options one at a time.

Symptoms and Direction

SymptomLook AtNext Step
No internet after enablingRouting or DNSDisable TUN, then read logs
Browser works, app does notWhether the app follows system proxyUse TUN or app-level proxy settings
Only LAN breaksLAN bypass rulesAdd direct rules for private networks
Stops after restartPermission and autostartCheck login item and admin rights

Minimal Example

tun:
  enable: true
  stack: system
  auto-route: true
  auto-detect-interface: true
  dns-hijack:
    - any:53

Reference Sources