Premium · Clash documentation

Feature: TUN Device

Learn how Clash Premium TUN captures TCP, UDP, and ICMP, and verify auto-route, auto-redir, system/gvisor, DNS hijacking, and operating-system limitations.

Read the articleBack to documentation home
  • auto-route
  • auto-redir
  • dns-hijack
  • gvisor
  • interface-name
Premium

The Premium core supports TUN devices. As a network-layer device, it can handle TCP, UDP, and ICMP traffic. It has been extensively tested and used in production, and can even support competitive gaming.

One of the greatest advantages of Clash TUN is its built-in management of the operating system's routing table, routing rules, and nftable. Enable it with the tun.auto-route and tun.auto-redir options. This feature replaces the legacy redir-port configuration option (TCP), making configuration easier and more reliable.

TIP

tun.auto-route is available only on macOS, Windows, Linux, and Android, and accepts only IPv4 traffic. tun.auto-redir is available only on Linux (kernel netlink support is required).

Clash offers two TCP/IP stacks: system and gvisor. For the best performance, we recommend the system stack; use the gvisor stack only if you encounter compatibility problems, and if you do, please open an Issue immediately.

Technical limitations

  • On Android, the control device is located at /dev/tun rather than /dev/net/tun, so first create a symbolic link (for example, ln -sf /dev/tun /dev/net/tun).

  • DNS hijacking may fail when the system DNS uses a private IP address, because auto-route does not capture private-network traffic.

Linux, macOS, and Windows

Here is an example TUN configuration:

yaml
interface-name: en0 # 与 `tun.auto-detect-interface` 冲突

tun:
  enable: true
  stack: system # or gvisor
  # dns-hijack:
  #   - 8.8.8.8:53
  #   - tcp://8.8.8.8:53
  #   - any:53
  #   - tcp://any:53
  auto-route: true # manage `ip route` and `ip rules`
  auto-redir: true # manage nftable REDIRECT
  auto-detect-interface: true # 与 `interface-name` 冲突

Because this setup uses a TUN device and modifies system routing tables and nftable, Clash requires superuser privileges here.

shell
sudo ./clash

If your device already has other TUN devices, Clash TUN may not work; you will need to inspect the routing table and routing rules manually. In that case, fake-ip-filter may also help.

Windows

Visit WinTUN website and download the latest version. Then copy wintun.dll to the Clash home directory. Example configuration:

yaml
tun:
  enable: true
  stack: gvisor # or system
  dns-hijack:
    - 198.18.0.2:53 # 当 `fake-ip-range` 是 198.18.0.1/16, 应该劫持 198.18.0.2:53
  auto-route: true # 为 Windows 自动设置全局路由
  # 推荐使用 `interface-name`
  auto-detect-interface: true # 自动检测接口, 与 `interface-name` 冲突
Previous articleIntroduction to PremiumNext articleFeature: eBPF Redirect to TUN