Clash Tutorials

TUN Mode (Full Transparent Proxy)

TUN mode is one of Clash's most powerful features. It creates a virtual network interface to capture all system traffic (not just HTTP/SOCKS proxy traffic), achieving true "full transparent proxying." With TUN mode enabled, all applications — including games, command-line tools, and apps that don't support proxy settings — have their traffic routed through Clash.

TUN Mode vs. System Proxy

Normal "System Proxy" mode only proxies applications that respect HTTP/SOCKS proxy settings (mainly browsers). TUN mode captures all traffic, including:

• Applications that don't support proxy settings
• Command-line tools (curl, git, ssh, etc.)
• Game clients
• Electron apps (some bypass system proxy)
• Docker container traffic (requires additional config)

Enabling TUN Mode

Enabling TUN mode in Clash Verge Rev is straightforward:

1. Ensure Service Mode is installed — TUN mode requires creating a virtual network interface, which typically needs admin/root privileges. Clash Verge Rev handles this through its service mode. Check the main interface for "Service Mode: Running."
2. Enable TUN mode — Click "Settings" on the left → find "TUN Mode" → toggle it on. If service mode is properly installed, TUN activates immediately.
3. Disable System Proxy — After enabling TUN, turn off "System Proxy" to avoid a double-proxy loop.
4. Verify TUN mode — Open a browser and visit ip.sb or whoer.net to check if your IP shows as the proxy IP. Then try pinging a domain to confirm DNS is also resolved through Clash.

TUN Mode Configuration Example

In your Clash config file, TUN mode settings look like this:

tun:
  enable: true
  stack: system          # Options: system / gvisor / mixed
  dns-hijack:
    - any:53               # Hijack all DNS queries
  auto-route: true        # Auto-configure routing table
  auto-detect-interface: true  # Auto-detect outbound interface

For a complete walkthrough of TUN mode setup including stack selection and DNS hijacking configuration, read our TUN mode global proxy guide.

DNS Configuration & Anti-Pollution

DNS pollution is one of the primary censorship techniques. Attackers return false IP addresses during DNS resolution, preventing you from accessing target websites or redirecting you to wrong servers. Clash's DNS module effectively prevents DNS pollution, ensuring accurate domain resolution.

How DNS Pollution Works

When you query a blocked domain using standard DNS (UDP port 53), the censorship system responds with a fake IP address faster than the legitimate DNS server. Your device receives this fake IP and tries to connect to the wrong server, naturally failing to reach the target. This is DNS pollution.

Clash's DNS Anti-Pollution Approach

Clash prevents DNS pollution through these mechanisms:

• DNS-over-HTTPS (DoH) — Encrypts DNS queries via HTTPS, preventing man-in-the-middle tampering
• DNS-over-TLS (DoT) — Encrypts DNS queries via TLS
• Nameserver & Fallback Separation — Uses domestic DNS for domestic domains (fast) and encrypted DNS for foreign domains (pollution-proof)
• Fallback Filtering — If domestic and overseas DNS return different results, prioritize the overseas DNS result (pollution-proof)

DNS Configuration Example

dns:
  enable: true
  listen: 0.0.0.0:1053
  ipv6: false
  enhanced-mode: fake-ip        # Fake-IP mode (recommended)
  fake-ip-range: 198.18.0.1/16  # Fake-IP address pool
  fake-ip-filter:               # Domains that skip fake-IP
    - '*.lan'
    - '*.local'
    - 'localhost.ptqy.gitv.tv'
  default-nameserver:            # DNS for resolving DoH domains themselves
    - 223.5.5.5
    - 119.29.29.29
  nameserver:                    # Domestic DNS
    - https://doh.pub/dns-query
    - https://dns.alidns.com/dns-query
  fallback:                      # Overseas DNS (anti-pollution)
    - https://dns.cloudflare.com/dns-query
    - https://dns.google/dns-query
    - tls://8.8.4.4:853
  fallback-filter:               # Conditions for using fallback
    geoip: true
    geoip-code: CN
    ipcidr:
      - 240.0.0.0/4

Fake-IP Mode Explained

Fake-IP is Clash's recommended DNS mode. When an app requests DNS resolution, Clash immediately returns a fake IP (from the fake-ip-range) without performing a real DNS query, while recording the domain-to-fake-IP mapping. When the app actually initiates a connection, Clash intercepts it, matches rules based on the domain, then resolves the real IP using the correct DNS. Benefits include:

• Eliminates DNS resolution delay (instant fake IP return)
• Prevents DNS pollution (real resolution happens at the proxy layer)
• Reduces DNS queries (only resolves when actually connecting)

For an in-depth explanation of DNS anti-pollution mechanisms and a complete configuration guide, read our DNS anti-pollution configuration guide.

Proxy Group Policies Explained

Proxy Groups are a core concept in Clash configuration. They define the egress strategy for traffic. With properly configured proxy groups, you can achieve flexible traffic scheduling and node switching.

Common Proxy Group Types

select (Manual Selection) — The most common type. Users can manually choose a node from the group. Ideal for a "Node Select" group.

proxy-groups:
  - name: "Proxy"
    type: select
    proxies:
      - "Hong Kong"
      - "Japan"
      - "United States"
      - DIRECT

url-test (Auto Select) — Automatically tests latency for all nodes in the group and selects the one with the lowest latency. Perfect for automatic optimal node selection.

  - name: "Auto Select"
    type: url-test
    proxies:
      - "Hong Kong"
      - "Japan"
      - "United States"
    url: 'http://www.gstatic.com/generate_204'
    interval: 300           # Test every 300 seconds
    tolerance: 50            # Only switch if latency differs by 50ms+

fallback (Failover) — Tests nodes in order and selects the first available one. If the primary node goes down, it automatically switches to the next.

  - name: "Failover"
    type: fallback
    proxies:
      - "Hong Kong"
      - "Japan"
      - "United States"
    url: 'http://www.gstatic.com/generate_204'
    interval: 300

load-balance (Load Balancing) — Distributes traffic across multiple nodes to increase total bandwidth. Supports per-connection or per-session distribution.

Rule Provider — Online Rule Sets

Rule Providers allow you to load rule sets from remote URLs instead of writing all rules in your local config file. This keeps your rules up-to-date without bloating your local configuration.

Configuration Example

rule-providers:
  reject:                    # Ad blocking rules
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/reject.txt"
    path: ./ruleset/reject.yaml
    interval: 86400

  proxy:                     # Proxy domain rules
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/proxy.txt"
    path: ./ruleset/proxy.yaml
    interval: 86400

  direct:                    # Direct connection rules
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/direct.txt"
    path: ./ruleset/direct.yaml
    interval: 86400

  cncidr:                    # China IP ranges
    type: http
    behavior: ipcidr
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/cncidr.txt"
    path: ./ruleset/cncidr.yaml
    interval: 86400

rules:
  - RULE-SET,reject,REJECT
  - RULE-SET,proxy,Proxy
  - RULE-SET,direct,DIRECT
  - RULE-SET,cncidr,DIRECT
  - GEOIP,CN,DIRECT,no-resolve
  - MATCH,Proxy

External Controller & Web Dashboard

Clash provides a RESTful API (external controller) that lets you remotely manage and monitor Clash through a web dashboard. The most popular web dashboards are Yacd and MetaCubeXD.

Configuring the External Controller

external-controller: 127.0.0.1:9090
secret: "your-secret-here"      # Optional: set an access password

Using the Web Dashboard

After configuration, access the web dashboard:

• Yacd: Visit http://yacd.haishan.me, enter API address http://127.0.0.1:9090
• MetaCubeXD: Visit http://d.haishan.me, enter the same API address

In the web dashboard you can: view real-time connections and traffic, switch proxy nodes, view logs, manage rules, and inspect DNS query history. Clash Verge Rev has a built-in Dashboard, so you usually don't need to open a separate web dashboard.

Can't Access the Internet After Installation

This is the most common issue for new users. Possible causes and solutions:

Checklist

1. Verify System Proxy is enabled — Check "System Proxy" on the Clash dashboard. If using TUN mode, you don't need System Proxy enabled.
2. Verify subscription is imported and active — In the Profiles page, check that a config file is selected (highlighted). Without an active config, Clash can't proxy any traffic.
3. Verify the node works — In the Proxies page, select a node and test latency. If all nodes time out, your subscription may have expired or the provider's servers may be down.
4. Check proxy mode — Ensure you're using "Rule" mode or "Global" mode. "Direct" mode bypasses all proxies.
5. Close other proxy software — Running multiple proxy tools simultaneously (VPNs, other Clash instances) can cause conflicts. Close other proxy software.
6. Check system proxy settings — Windows: Settings → Network & Internet → Proxy. Confirm system proxy is correctly set to 127.0.0.1:7890 (Clash's default port). If settings are abnormal, clear them manually and re-enable Clash system proxy.

Subscription Import Fails

If nothing happens or you get an error when clicking import, try these steps:

1. Check the URL is complete — Ensure you copied the full subscription URL without missing characters. Pay special attention to special characters like = and &.
2. Check network connectivity — If the subscription server is blocked, you may need to enable proxy first before importing. Temporarily use "Global" mode or manually configure a node first.
3. Try subscription conversion — Some providers' formats aren't Clash-compatible. Use a subscription conversion tool to convert before importing. See Chapter 3's conversion section.
4. Import via local file — If online import always fails, open the subscription URL directly in your browser (which may be able to access it), save the content as a .yaml file, then import the local file in Clash.

TUN Mode Not Working

If traffic isn't going through the proxy after enabling TUN mode, possible causes include:

• Service mode not properly installed — Check if the main interface shows "Service Mode: Running." If not, click to install or repair service mode.
• Conflict with system proxy — Having both TUN mode and system proxy enabled can cause double-proxying. Enable only TUN mode and disable system proxy.
• Firewall/security software blocking — Some security software blocks virtual network interface creation. Try temporarily disabling security software and re-enabling TUN.
• DNS not properly captured — Check that dns-hijack includes any:53 to ensure all DNS queries are captured by Clash.
• Stack mode incompatibility — Try switching TUN's stack mode (system → gvisor → mixed). Different systems have varying compatibility with specific stacks.

DNS Leak Detection

A DNS leak means your real DNS queries bypass Clash, exposing the domains you're actually visiting. How to check:

1. Visit a DNS leak test site — Open browserleaks.com/dns or dnsleaktest.com and run a full test. If the DNS server IPs shown are your proxy server's IPs, you have no leak.
2. Confirm Fake-IP mode — Fake-IP mode inherently prevents DNS leaks since the application layer never makes real DNS queries. Check that enhanced-mode is set to fake-ip in your config.
3. Check for IPv6 leaks — If you haven't configured IPv6 proxying, disable IPv6 DNS resolution entirely. Set ipv6: false in your config.

Node Connection Failures

If a selected node won't connect (latency test times out or shows errors), troubleshoot these:

• Node is offline — Contact your provider to confirm node status. Try switching to a different node.
• Protocol incompatibility — Ensure your client uses the Mihomo (Clash Meta) core. Original Clash doesn't support newer protocols like Vless and Reality.
• Port blocked — In some network environments, specific ports may be blocked. Try a node using port 443.
• Local firewall — Check if your local firewall is allowing the Clash process and port.
• Incorrect system time — TLS handshakes depend on accurate system time. If your clock is significantly off, connections may fail. Sync your system time.