TUN mode won't turn on or has no effect

TUN mode takes over all traffic at the network layer through a virtual adapter, covering terminals and games that system proxies cannot reach. If it fails to enable:

1. Run as administrator: Creating a virtual adapter on Windows requires admin rights. Right-click the Clash for Windows icon, choose "Run as administrator", then enable TUN.
2. Install the service mode: Click the install button next to Service Mode on the General page—TUN becomes far more reliable once installed.
3. Check the virtual adapter: Look for the Clash virtual adapter (TUN/TAP) in Device Manager; re-enable it if security software disabled it.
4. Verify DNS settings: TUN mode works best with Fake-IP DNS—see the Fake-IP DNS guide.
5. Pick one of TUN or system proxy: With TUN on, the system proxy can be turned off. They usually don't conflict, but keep only one while troubleshooting so the traffic path is clear.

If specific apps still connect directly after enabling TUN, check whether the app binds its own network stack (some VMs and containers do)—that traffic needs separate handling.