What TUN mode is meant to solve
The project historically known as Mihomo Party is currently maintained as Clash Party, although older folders and screenshots may retain the previous name. TUN mode creates a virtual network interface and adds routes that send more system traffic into the Mihomo core. Its practical purpose is to capture applications that ignore the operating system's HTTP or SOCKS proxy setting, such as some launchers, command-line tools, and software with an independent network stack.
A system proxy merely tells participating applications to use a local proxy port. TUN capture happens lower in the network path. They are not “normal” and “faster” modes, and enabling both is not a prerequisite for good performance. If a browser already works through the system proxy, adding TUN increases the number of routes, DNS decisions, permissions, and virtual adapters that can fail.
Save a working baseline and remove conflicting variables
Refresh the subscription, select a fixed node that has passed a real browsing test, and record the current proxy mode. Temporarily exit other VPN clients, accelerators, or tools that create adapters or rewrite the default route. VirtualBox, Docker networking, and corporate security clients are not inherently incompatible, but simultaneous route changes make ownership difficult to establish.
- Export or retain the currently working configuration.
- Enable only the system proxy and confirm both a direct and a proxied destination.
- Disable the system proxy and verify that ordinary direct networking still works.
- Exit other tunnel software, then start Clash Party.
- Locate the virtual-adapter switch so that you have a clear rollback action.
TUN cannot reliably repair an underlying gateway, DNS, clock, or IPv6 problem. Restore the operating system's basic connection first. Otherwise, a pre-existing resolver failure will be misattributed to the virtual adapter.
Enable the virtual adapter in the client
Find the control labelled TUN or virtual adapter in the current Clash Party interface. Its location may change between releases, so use the visible label rather than an old screenshot as authority. The first activation can require privileged operations: Windows may request administrator approval and firewall access, macOS may request networking permission, and Linux needs permission to create a TUN interface and change routes.
After switching it on, wait for the core state to settle. Confirm that the interface exists, then visit one direct destination and one proxied destination. The connection log should identify the domain, matched rule, policy group, and final node. If the control immediately switches itself off, read the core log for a permission or startup error instead of repeatedly toggling it.
tun block only when you understand the client's override and merge order.Understand stacks, automatic routes, and DNS interception
Mihomo documents system, gvisor, and mixed as available TUN stacks, and recommends trying mixed when it causes no compatibility problem. auto-route installs routes into the virtual interface, auto-detect-interface chooses the outbound interface, and dns-hijack sends matched DNS requests to the internal resolver. Defaults and client presets may evolve, so do not treat an old screen as a permanent specification.
YAMLtun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: true
dns-hijack:
- any:53
Automatic outbound detection may choose poorly on a computer connected to Ethernet, Wi-Fi, and a hotspot at the same time. The official documentation also notes limits on automatically hijacking DNS sent to the local network on Windows and macOS. strict-route strengthens route enforcement, but the documented Windows behavior can disrupt software such as VirtualBox in some environments. Leave it out of the first test unless its protection is required.
Diagnose an outage in four layers
| Symptom | Check first | Controlled test |
|---|---|---|
| Switch will not stay enabled | Privileges and core startup | Read the core log and grant only required access |
| No domain opens | DNS and default route | Test an IP and name resolution separately |
| LAN devices disappear | Strict route and excluded networks | Disable strict route, then test a local address |
| Failure after changing networks | Outbound interface | Restart the core and identify the active adapter |
| Only UDP applications fail | Stack and node UDP support | Keep one node and change only the stack |
Change one variable at a time. Keep the node, rules, and DNS settings fixed, and disable only TUN. If networking immediately returns, continue inside the TUN layer. If it remains broken, the virtual adapter was not the sole cause. Next test raw IP reachability and DNS independently so that a resolver problem is not labelled a dead proxy.
On Linux, the first-party documentation advises checking outbound firewall permission for the TUN interface when an enabled firewall causes failure. On Windows, a firewall can also block the actual Mihomo core with the system or mixed stack. Add the narrow program or interface permission; permanently disabling the whole firewall is not a sound fix.
Operate and roll back safely
A blue switch is not proof of success. The target application must create a connection, the log must show the intended rule and node, and direct and local-network destinations must remain correct. Re-test after switching Wi-Fi, attaching a corporate VPN, resuming from sleep, or updating the client. For a long meeting or download, choose a fixed node to avoid a policy group's automatic change resetting an established session.
To recover, disable TUN first, exit the client, and confirm that the original default route and DNS have returned. Prefer a normal network reconnect or reboot to indiscriminately deleting routes whose purpose you do not know. Platform-specific option behavior is documented in the official Mihomo TUN reference; client names, releases, and issue history belong to the official Clash Party repository.
The durable rule is simple: keep the system proxy when it covers the application, and introduce TUN only when there is evidence that traffic bypasses that proxy. You get the needed coverage without turning every connectivity problem into a routing experiment.
Official sources and version scope
Version numbers, filenames, and interface labels can change. Confirm them in the linked project documentation before making changes.