Premium · Clash documentation

Feature: TUN Device

Before using Clash Premium TUN to capture TCP, UDP, and ICMP, check auto-route, auto-redir, system/gvisor, and DNS hijacking settings. Confirm the operating-system limitations before enabling it.

Read the articleBack to documentation home
  • auto-route
  • auto-redir
  • dns-hijack
  • gvisor
  • interface-name
Premium
On this page

Scope of this historical document

This document preserves historical instructions for original Clash / Clash Premium to help interpret older configurations. References to “Premium only”, unsupported features, or platform limits do not describe current Mihomo capabilities. Do not use them to overwrite your current client configuration or run permission-related commands.

For Mihomo, consult current Mihomo configuration documentation. For the graphical interface, installation, and permissions, follow the documentation for your specific client.

The Premium core supports TUN devices. As a network-layer device, it can handle TCP, UDP, and ICMP traffic. It has been extensively tested and used in production, and can even support competitive gaming.

One of the greatest advantages of Clash TUN is its built-in management of the operating system's routing table, routing rules, and nftable. Enable it with the tun.auto-route and tun.auto-redir options. This feature replaces the legacy redir-port configuration option (TCP), making configuration easier and more reliable.

TIP

tun.auto-route is available only on macOS, Windows, Linux, and Android, and accepts only IPv4 traffic. tun.auto-redir is available only on Linux (kernel netlink support is required).

The system/gvisor instructions below are for original Premium. For a current TUN failure, first identify the running core and client versions. Report interface, installation, or permission problems to the relevant client; use Mihomo issue tracker only for confirmed Mihomo core issues. If you are unsure which project is responsible, check clients and project sources. The original Clash new-issue page is no longer available. Remove subscription tokens, passwords, and other sensitive details from logs and configurations before reporting.

Technical limitations

  • On Android, the control device is located at /dev/tun rather than /dev/net/tun, so first create a symbolic link (for example, ln -sf /dev/tun /dev/net/tun).

  • DNS hijacking may fail when the system DNS uses a private IP address, because auto-route does not capture private-network traffic.

Linux, macOS, and Windows

Here is an example TUN configuration:

yaml
interface-name: en0 # 与 `tun.auto-detect-interface` 冲突

tun:
  enable: true
  stack: system # or gvisor
  # dns-hijack:
  #   - 8.8.8.8:53
  #   - tcp://8.8.8.8:53
  #   - any:53
  #   - tcp://any:53
  auto-route: true # manage `ip route` and `ip rules`
  auto-redir: true # manage nftable REDIRECT
  auto-detect-interface: true # 与 `interface-name` 冲突

Because this setup uses a TUN device and modifies system routing tables and nftable, Clash requires superuser privileges here.

shell
sudo ./clash

If your device already has other TUN devices, Clash TUN may not work; you will need to inspect the routing table and routing rules manually. In that case, fake-ip-filter may also help.

Windows

Visit WinTUN website and download the latest version. Then copy wintun.dll to the Clash home directory. Example configuration:

yaml
tun:
  enable: true
  stack: gvisor # or system
  dns-hijack:
    - 198.18.0.2:53 # 当 `fake-ip-range` 是 198.18.0.1/16, 应该劫持 198.18.0.2:53
  auto-route: true # 为 Windows 自动设置全局路由
  # 推荐使用 `interface-name`
  auto-detect-interface: true # 自动检测接口, 与 `interface-name` 冲突
Previous articleIntroduction to PremiumNext articleFeature: eBPF Redirect to TUN