The Complete Guide to TUN Mode: How It Works, Setup, and Common Issues

"My system proxy is on, so why can't this app get online?" Plenty of people run into this after a while, and the answer usually points to the same feature: TUN mode. To understand what it does, you first need to understand why system proxy sometimes falls short.

Why System Proxy Isn't a Silver Bullet

"Auto-configure system proxy" works by having the client modify OS-level proxy settings, which most browsers and apps read automatically and route their traffic through the local proxy port accordingly. But this mechanism relies on one assumption: the app has to actively "respect" the system proxy setting. Command-line tools, some game clients, and certain messaging apps, for performance or compatibility reasons, often bypass the system proxy entirely and connect directly — that traffic simply can't be covered by the proxy, which shows up as "the proxy's on, but this app still isn't working." TUN mode takes a completely different approach: instead of relying on apps to "cooperate," it creates a virtual network adapter (a TUN device) in the OS's network stack and modifies the system routing table so that nearly all traffic passes through this virtual adapter before reaching the real one. The client intercepts raw packets on the virtual adapter, reads the destination address, decides whether to connect directly or route through the proxy based on your rules, then re-encapsulates and sends the packet out. Because this happens at the network layer, it doesn't rely on apps "choosing" to cooperate — UDP traffic, command-line tools, and games are all covered in the vast majority of cases, making it true global proxying.

When Do You Actually Need It?

Not everyone needs TUN mode running all the time, but a few situations basically require it: some package managers and tools like git or curl don't read the system proxy setting by default, so you need either TUN mode or manual proxy parameters; some games and launchers bypass the system proxy for anti-cheat or performance reasons; if your app relies heavily on UDP (like certain real-time communication or DNS over UDP), system proxy — which usually only handles TCP — often doesn't apply at all; and if you find several apps all bypassing your proxy, it's much simpler to just turn on TUN mode once rather than configuring exceptions for each one individually.

Enabling It Takes Four Steps, and Routing Rules Still Apply

The process isn't complicated: select "TUN Mode" from the system proxy menu (Windows requires running the client as administrator). The first time you enable it, the system may show a security prompt or ask to install a virtual adapter driver — just allow it. Once active, the tray icon shows TUN mode is on, and nearly all traffic now flows through the virtual adapter, but your routing rules still apply as normal — traffic you've set to connect directly still does, while everything else goes through the proxy, so "global proxy" doesn't mean all your traffic slows down.

Can't Connect After Enabling It? Here Are the Four Most Likely Causes

TUN mode involves creating a virtual adapter and modifying the system routing table — relatively low-level operations — so it's more prone to conflicts with other software that touches network settings the same way. The most common conflict is with traditional VPN clients: both try to take over the routing table, and running them together usually breaks one or the other, so avoid running them at the same time. Next, some security software is highly sensitive to virtual adapter creation and may flag or block it — you'll need to add the client to your allowlist. Another cause is an outdated virtual adapter driver — the WinTun driver commonly used on Windows can run into compatibility issues with newer system versions if it's out of date, and updating the driver or client usually resolves it. Finally, if internal network services stop working after enabling TUN mode, check whether your routing rules still correctly preserve a direct-connect rule for geoip:private, to avoid local network requests being routed incorrectly through the TUN adapter. A good general approach: disable TUN mode first to confirm the issue disappears, then work through the four causes above one by one. If you can't resolve it right away, switch back to system proxy and only enable TUN mode temporarily for the specific scenarios that need it, minimizing the chance of conflicts with other software.

Does It Use More Resources?

Since all traffic has to pass through an extra layer of packet parsing at the virtual adapter, TUN mode does add somewhat higher CPU usage compared to plain system proxy — but on modern hardware this overhead is usually negligible, and most people don't need to avoid it out of performance concerns. Only on low-performance devices, or in latency-sensitive scenarios, is it worth trying system proxy first and switching to TUN mode only when truly necessary.