System proxy vs TUN
A system proxy only takes over web traffic from apps that respect system settings (mainly browsers); TUN mode takes over all traffic from every app, including UDP.
Think of it like this
A system proxy is a guide standing at the main door — only people who choose to follow get guided. TUN reroutes every exit of the building through the guide.
In this setup
This setup recommends turning on "Tun Mode" in Clash Verge: it stops the browser's WebRTC from exposing your real IP, and apps that ignore the system proxy still follow the rules. The first time, "Install Service" when prompted. Also keep the "IPv6" switch in Clash Verge's settings on — otherwise IPv6 traffic bypasses TUN.
Common misconceptions
- "With TUN on, Chinese sites take a detour too": no, routing rules still apply.
- "Only one of System Proxy and TUN can be on": both can be on without conflict; with TUN on, System Proxy can be either.
Try it: Turn on TUN mode
Related: WebRTC, Rule-based routing, TCP and UDP