Common TUN issues include DNS bypassing Clash, bypassed or looping routes, LAN addresses being captured incorrectly, and inconsistent IPv6 handling. Add private subnets to the exclusion list or route them through DIRECT, disable other VPN software, and recreate TUN. For an IPv6 black hole, compare with IPv4 before changing settings.
Which component captures DNS requests, the default route, and LAN subnets?
After enabling TUN, test a public domain, the router address, and one LAN device separately. Use logs to verify whether DNS requests and traffic enter the intended interface.
- Does DNS hijack cover the system query address?
- Are auto-route and route-address configured according to the client documentation?
- Should LAN subnets bypass capture?
- Is IPv6 enabled without complete rules?
Exclude the LAN and recreate the TUN path
- Start with the connection list and DNS logs to confirm that requests enter the core(See DNS FAQ)
- Add LAN, router, and local-machine subnets to direct routing or the exclusion list
- Disable other VPN software and recreate the TUN interface
- For an IPv6 black hole, switch back to IPv4 first to verify
TUN route changes can affect LAN discovery, casting, and printing
DNS and routing must be troubleshot together(See TUN device guide)
TUN setting names differ across clients