Skip to content

Theme

Theme color ·

中文
  1. How-to
  2. Apps
  3. Turn on TUN mode

Turn on TUN mode

5 minutesFor: Clash Verge Rev users on Windows or MacMain guide step 4: Install the apps

Why

Clash Verge’s “System Proxy” only takes over the browser’s web traffic (TCP). The browser’s WebRTC reports your IP over UDP, which doesn’t go through the system proxy — so test sites can see your real IP.

Tun Mode sends all traffic from every app through Clash first, then routes it by the rules: Chinese sites still go direct, WebRTC keeps working, and it exits via your server.

How

  1. On Profiles, “Update” the subscription once to get the latest rules.
  2. In Settings, turn on Tun Mode.
  3. When it says “TUN Mode Service Required”, click Install Service: “Yes” on Windows, login password on Mac. “Service Installed Successfully” means done.
  4. Windows only: click the gear next to Tun Mode, turn on Strict Route, leave everything else, and save.
  5. In the Clash settings, turn DNS Overwrite off; set IPv6 after the check below.
  6. Fully quit the browser and reopen it (⌘Q on Mac; on Windows quit it from the tray too).

“System Proxy” can be on or off — it doesn’t matter.

IPv6 on or off

First check whether the network you’re on has IPv6. Open Terminal (Mac) or PowerShell (Windows), paste this line and press Enter:

Check for IPv6 (Mac Terminal)
ifconfig | awk '/^[a-z]/{i=$1} $1=="inet6" && i!~/^(utun|lo|bridge|awdl|llw|gif|stf|anpi|ap)/ && $2!~/^(fe80|fd|fc|::1|2001:0:|2002:)/ {print i, $2}'
Result IPv6 switch Why
Lists addresses (starting with 2) On The network has IPv6. With the switch off, IPv6 traffic bypasses Tun Mode and may expose your Chinese IPv6 address
Prints nothing Off The network has no IPv6, so there’s no IPv6 traffic to leak. Leaving it on makes apps like WeChat try IPv6 addresses they can’t reach, without falling back to IPv4 — text sends, images don’t

This switch overrides the subscription

Clash Verge’s IPv6 switch overrides the subscription’s IPv6 setting, so set it by the check above. Afterwards, fully quit WeChat and QQ and reopen them. Check again when you change networks (home to office, or a phone hotspot).

How to verify

  • Home shows “TUN Mode Enabled”;
  • At browserleaks.com/webrtc, “RTCPeerConnection” shows ✔ and “Public IP Address” is your server’s IP.
Example browserleaks WebRTC result
Two parts of browserleaks: RTCPeerConnection shows ✔, and Public IP Address is the server IP (replaced with an example here). Screenshot 2026-10; the interface may have changed since.

Don't disable WebRTC instead

Don’t install extensions like WebRTC Network Limiter or change the browser’s WebRTC settings. Test sites would then say “no IP detected” — which looks fixed but has actually broken web video and voice.

Stuck?

“TUN Mode automatically disabled due to service unavailable”?

In Settings, click Uninstall Service, then Install Service, then turn Tun Mode on again.

“Switched to normal mode (Sidecar); TUN requires administrator privileges”?

Click “View repair instructions” in the message and follow them. On Windows you can also right-click Clash Verge and “Run as administrator”.

The test site shows a Chinese IPv6 address?

Seeing a Chinese IPv6 address means your network has IPv6, so the IPv6 switch should be on — check that first. If it’s still a Chinese IPv6 address, turn IPv6 off in the system: on Windows, untick “Internet Protocol Version 6” in the network adapter’s properties; on Mac, set “Configure IPv6” to “Link-local only” under System Settings → Network → your network → Details → TCP/IP.

With Tun Mode on, WeChat sends text but not images?

Try these in order. After each one, fully quit WeChat, reopen it and send an image:

  1. Redo the check in “IPv6 on or off” above. If the network has no IPv6 but the switch is on, turn it off. This is the most common cause.
  2. On Profiles, “Update” the subscription once.
  3. Click the gear next to Tun Mode, set Stack to Mixed, and save.
  4. Windows only: in the same window, turn off Strict Route and save.

Still failing? Open Connections on the left in Clash Verge, send an image, screenshot the WeChat connections, and send it to whoever set this up for you.

Some Chinese test sites still show a Chinese IP?

If that site uses a Chinese STUN server, Rule mode connects to it directly — expected behaviour. Confirm with browserleaks.com/webrtc; don’t disable WebRTC or switch to Global mode for this.

Want the same setup on Windows and Mac?

That’s fine — import the same subscription and use the same settings. But check each computer carefully:

  • both are in Rule mode, with Tun Mode on and the service installed;
  • Windows only has one extra step: Strict Route on;
  • DNS Overwrite is off on both;
  • set the IPv6 switch after checking the network that computer is on right now — the two may differ;
  • fully quit and reopen the browser on each, and test for leaks on each at ip.net.coffee/claude.

The full step-by-step troubleshooting (including test commands an AI assistant can run) is in the setup repository’s WebRTC leak fix guide (in Chinese).

This setup is for you and your family only. Follow local laws and each site's and AI tool's terms of use. Open source (MIT) — code and feedback on GitHub.