Skip to content
XXD VPS Guide
中文
  1. How-to
  2. Apps
  3. Turn on TUN mode

Turn on TUN mode

5 minutesFor: Clash Verge Rev users on Windows or MacMain guide step 4: Install the apps

Why

Clash Verge’s “System Proxy” only takes over the browser’s web traffic (TCP). The browser’s WebRTC reports your IP over UDP, which doesn’t go through the system proxy — so test sites can see your real IP.

Tun Mode sends all traffic from every app through Clash first, then routes it by the rules: Chinese sites still go direct, WebRTC keeps working, and it exits via your server.

How

  1. On Profiles, “Update” the subscription once to get the latest rules.
  2. In Settings, turn on Tun Mode.
  3. When it says “TUN Mode Service Required”, click Install Service: “Yes” on Windows, login password on Mac. “Service Installed Successfully” means done.
  4. Windows only: click the gear next to Tun Mode, turn on Strict Route, leave everything else, and save.
  5. In the Clash settings, check IPv6 is on and DNS Overwrite is off.
  6. Fully quit the browser and reopen it (⌘Q on Mac; on Windows quit it from the tray too).

“System Proxy” can be on or off — it doesn’t matter.

Why IPv6 stays on

Clash Verge uses its own IPv6 switch to decide whether Tun Mode captures IPv6. With it off, IPv6 traffic bypasses Tun Mode and may expose your Chinese IPv6 address.

How to verify

  • Home shows “TUN Mode Enabled”;
  • At browserleaks.com/webrtc, “RTCPeerConnection” shows ✔ and “Public IP Address” is your server’s IP.
Example browserleaks WebRTC result
Two parts of browserleaks: RTCPeerConnection shows ✔, and Public IP Address is the server IP (replaced with an example here). Screenshot 2026-10; the interface may have changed since.

Don't disable WebRTC instead

Don’t install extensions like WebRTC Network Limiter or change the browser’s WebRTC settings. Test sites would then say “no IP detected” — which looks fixed but has actually broken web video and voice.

Stuck?

“TUN Mode automatically disabled due to service unavailable”?

In Settings, click Uninstall Service, then Install Service, then turn Tun Mode on again.

“Switched to normal mode (Sidecar); TUN requires administrator privileges”?

Click “View repair instructions” in the message and follow them. On Windows you can also right-click Clash Verge and “Run as administrator”.

The test site shows a Chinese IPv6 address?

First check the IPv6 switch is on. If it’s still a Chinese IPv6 address, turn IPv6 off in the system: on Windows, untick “Internet Protocol Version 6” in the network adapter’s properties; on Mac, set “Configure IPv6” to “Link-local only” under System Settings → Network → your network → Details → TCP/IP.

Some Chinese test sites still show a Chinese IP?

If that site uses a Chinese STUN server, Rule mode connects to it directly — expected behaviour. Confirm with browserleaks.com/webrtc; don’t disable WebRTC or switch to Global mode for this.

The full step-by-step troubleshooting (including test commands an AI assistant can run) is in the setup repository’s WebRTC leak fix guide (in Chinese).

This setup is for you and your family only. Follow local laws and each site's and AI tool's terms of use. Open source (MIT) — code and feedback on GitHub.