On this page
If the system proxy works but TUN fails, the problem is usually in the permission chain
This article addresses one specific macOS issue: with the same Profile and pinned node, webpages work through the system proxy, but enabling TUN immediately turns it off, reports abnormal service mode, or logs operation not permitted. This comparison shows that the subscription and node have at least basic availability.
TUN must create a virtual adapter, adjust routes, and take over DNS, so it requires more privileges than the system proxy. If the system proxy also fails or the proxies page has no nodes, troubleshoot the subscription, node, or core startup first instead of repeatedly installing the privileged service.
Choose a starting point from the symptom
| Symptom | Check first | Do not do yet |
|---|---|---|
| The TUN switch immediately falls back, and the log says operation not permitted | Runtime mode and service authorization | Change DNS or the subscription |
| Service mode shows inactive or installation failed | App location, version, and old service | Delete the entire configuration directory |
| TUN stays enabled, but every website times out | DNS, routing, or a conflict with another VPN | Enter the administrator password repeatedly |
| Neither the system proxy nor TUN can connect | Profile, node, and core logs | Attribute the issue only to macOS permissions |
- Clash Verge RevSave the setting and generate the runtime configuration
- Privileged serviceStarts Mihomo with controlled privileges
- TUN and routingCreates the virtual adapter and intercepts target traffic
- DNS and real connectionsCompletes resolution, rule matching, and egress
operation not permitted usually occurs between the privileged service and TUN. If TUN is enabled but webpages time out, continue checking DNS, rules, and egress.
Upgrade to an official release and launch it from Applications
Official Clash Verge Rev v2.5.2 release notes include a macOS fix for service installation or startup failing when the app is in App Translocation. Even with that scenario fixed, do not run the app indefinitely from a DMG, Downloads, or a temporary copy.
Quit Clash Verge Rev completely from the menu bar, drag Clash Verge.app into Applications, then open it from there. If the current release is older than v2.5.2, download the official installer matching Apple Silicon or Intel from the project Release first. Do not overwrite the app while the old process is running.
Change only the version and launch location
Record the current state
Record the client version, Mac chip, service-mode state, and first error in the log.
Disable TUN and quit the client
Confirm that system networking has recovered before quitting the menu-bar process, so the old service cannot change routes during installation.
Install the official release for the matching chip
For an M-series system choose Apple Silicon; for an Intel Mac choose Intel. Keep the existing Profile for comparison.
Reopen from Applications
Do not change DNS, overrides, or the node yet. Check only the service state and whether the original error disappears.
The first TUN error distinguishes a permission failure from lost connectivity
After restarting, enable TUN only once and find the first error from this action from the top of the log. A switch that falls back is not the same failure as webpage timeouts: the former often occurs before the adapter is created, while the latter suggests the adapter may exist and the problem has moved to DNS, routing, or upstream connectivity.
The official macOS FAQ says the client temporarily changes system DNS while TUN is enabled and should restore it when disabled. Record the original DNS before repair. If TUN is off but the setting is not restored, restore the original value in system network settings before continuing.
configure tun interface: operation not permitted
The core did not receive the authorization needed to create TUN; inspect service mode and remnants of an old service.
The service installation button errors before the log reaches core startup
Confirm that the app is in /Applications, then check whether security software or device-management policy blocks the privileged service.
TUN remains enabled and requests appear in Connections, but all of them timeout
The permission chain works; investigate DNS, rules, the node, or routing conflicts with another VPN.
The system proxy still works after TUN is disabled
Keep this state as the rollback baseline. Repair only the service; do not rebuild the subscription.
After upgrading across releases, reinstall the service in the official order
Official v2.4.5 release notes warned that macOS and Linux tightened service IPC permissions, so some existing installations must uninstall the old TUN service before installing the new one. If you upgraded across this release and retrying in the UI still fails, use the macOS tool from the release notes.
Before running it, confirm that the app is actually at /Applications/Clash Verge.app and that the client has exited. First check whether the tool exists. Stop if the path differs or the check fails; do not redirect the command to Downloads.
APP="/Applications/Clash Verge.app"
test -x "$APP/Contents/Resources/resources/clash-verge-service-uninstall"
test -x "$APP/Contents/Resources/resources/clash-verge-service-install"
sudo "$APP/Contents/Resources/resources/clash-verge-service-uninstall"
sudo "$APP/Contents/Resources/resources/clash-verge-service-install"Continue to the administrator password only if both test commands return successfully with no output. Then reopen the client, confirm that service mode is active, and test once with the original Profile. Do not download a same-named service file from a forum or manually remove unknown items from launchd directories.
Security policy on a company Mac must not be forcibly bypassed
The official macOS FAQ attributes some crashes and service-installation failures to security software blocking the service. On a personal computer, check background items related to Clash Verge Rev under System Settings → General → Login Items & Extensions. On a managed computer, ask the administrator whether the service is allowed.
If every login shows an osascript prompt requesting changes, first check whether the related background item is disabled. Do not permanently disable endpoint protection, remove device management, or recursively clear quarantine attributes from the entire app; those actions turn a permissions issue into a larger security risk.
A managed environment must confirm
- The client came from the project's official Release, and the file matches the chip architecture
- The app is installed in /Applications, not a temporary user directory
- The administrator explicitly allows installation and execution of the Clash Verge Rev service
- Security software has not quarantined the app, Mihomo core, or service tools
- No other VPN or TUN client is running and competing for routes
If the fix is incomplete, return to the system proxy for continued use
If the same permission error remains after reinstalling the service, stop authorizing repeatedly. Disable TUN, confirm that system DNS returns to the recorded pre-fix value, then complete one request with the system proxy and original node. This preserves basic connectivity and prevents a failed state from holding the route indefinitely.
If networking remains down after TUN is disabled, quit Clash Verge Rev, then disable the proxy or restore the original DNS in macOS network settings. Do not remove network services, reset the entire Mac network configuration, or clear the Profile; those data are not the same layer as service authorization.
Retain reproducible evidence before reporting
Export redacted logs
Keep several dozen lines before and after enabling TUN, and redact the subscription URL, node address, UUID, and password.
Record the environment
State the macOS version, Apple Silicon or Intel, client version, and installation path.
Record a minimal reproduction
Describe whether the system proxy works, TUN switch behavior, service-mode state, and first error.
Restore a usable mode
Use the system proxy until an official fix or administrator response; do not stack unknown scripts.
Five checks that prove TUN has actually recovered
A blue TUN switch proves only that the UI saved the state. Also compare with a request that does not depend on the system proxy, and confirm that routing and DNS recover normally after TUN is disabled.
Complete validation checklist
- Service mode shows active, and the log no longer contains operation not permitted
- With the system proxy disabled and only TUN enabled, browser and terminal requests both appear on the Connections page
- Connection records show the expected rule and egress instead of all DIRECT or continuous timeout
- After TUN is disabled, system DNS and ordinary direct connectivity recover without restarting the Mac
- The service remains available after one system login and does not repeatedly request abnormal authorization