Why System Proxy Is Not Enough for Git, npm, or Games

Most people first meet Clash through a simple mental model: turn on the client, flip system proxy, and suddenly Chrome respects 127.0.0.1:7890. That workflow is convenient because it piggybacks on operating-system APIs that tell WinHTTP, URLSession, and many GUI apps to send HTTP and HTTPS through a local forwarder. The limitation is equally simple: anything that does not consult the system proxy database will behave as if Clash does not exist.

Git over its native protocol speaks SSH to port 22 by default, uses long-lived TCP connections, and historically treated HTTP proxies as an explicit configuration concern rather than an ambient assumption. npm, pnpm, and Yarn speak TLS to registry hosts using Node networking stacks that may honor HTTP_PROXY variables, but only if you remembered to export them in every shell profile and CI job. Game clients frequently ship custom kernels, anti-cheat drivers, and UDP-heavy voice chat paths that never touch WinINet at all.

TUN mode changes the abstraction layer. Instead of asking each application to opt into a proxy voluntarily, Clash presents a virtual network interface and participates in the IP routing table so packets that would otherwise exit your physical NIC can be captured, classified, and forwarded according to the same YAML rules you already trust for browser traffic. The result is closer to a lightweight VPN slice: not every packet in the universe, but a well-defined subset governed by policy.

How TUN Mode Fits into the Network Stack

At a high level, Clash Meta (often referred to as Mihomo in downstream clients) attaches a userspace component to a TUN device. Applications still open sockets the way they always did; the operating system routes those packets based on prefixes you configure, often a default route that prefers the TUN interface for IPv4 or IPv6 destinations you want inspected. Clash reads payloads, maps flows to processes conceptually through metadata available at the proxy layer, matches your rule chain, then emits the traffic toward the correct outbound, whether that is a direct interface, a Shadowsocks hop, or a chained VMess link.

This design deliberately mirrors how enterprise VPN clients operate, which is why Windows will prompt for administrator approval when drivers install and why macOS may require reduced protection on Apple Silicon if you disable kernel extensions in favor of older stacks. You are not merely setting a string in the registry; you are asking the OS to trust Clash with packet steering.

Because TUN operates below HTTP, it catches protocols browsers rarely see: raw TLS to non-web ports, QUIC if your build and rules support it, arbitrary TCP games, and some UDP sessions. That power is why responsible configurations pair TUN with explicit DIRECT rules for LAN segments, local discovery, and finance portals you never want to leave your country by accident.

DNS Is Part of the TUN Story

Routing packets correctly is only half the battle; resolving hostnames happens before many apps even open TCP. If DNS leaks around Clash, you will observe bizarre split behaviors: the IP belongs to a domestic CDN while the TCP stream tries to exit through a foreign node, or vice versa. Modern Meta-class cores integrate fake-ip and enhanced DNS sections precisely because stale resolver answers undermine rule quality.

When you enable TUN, pay attention to three knobs together: the DNS section of your profile, the operating-system resolver list, and any per-app DNS cache embedded in browsers or Electron shells. A conservative approach for developers is to enable Clash DNS hijacking only for the subnets you intend to tunnel, then validate with a resolver test tool that does not itself short-circuit through cached answers.

If Git suddenly cannot resolve GitHub while TUN is active, resist the urge to disable everything at once. First confirm whether the failure is resolution or connectivity by running a narrow lookup against a public resolver from the same shell. Second, inspect whether your rules send GitHub domains to a policy group whose nodes are offline. Third, remember that corporate VPNs stacked on top of Clash can reorder interface metrics in ways that confuse split tunnels.

Git Over HTTPS and SSH Under TUN

For HTTPS remotes, TUN typically just works once the flow matches a rule that selects a working outbound. Git uses ordinary TLS; Clash sees a CONNECT-style path or encrypted SNI metadata depending on configuration, classifies the domain, and forwards accordingly. You may still keep explicit http.proxy entries in git config for clarity in CI, but they become optional rather than mandatory.

For SSH remotes, remember that traffic targets port 22 on a remote host, not port 443 on a corporate proxy appliance. System proxy mode rarely helped here unless you wrapped SSH with something like corkscrew. TUN shines because the SYN packets traverse the tunnel interface first. If your provider blocks outbound 22 entirely, no local mode will fix that; if the issue is regional routing, TUN plus the right outbound often restores reachability without patching every repository URL.

Large monorepos benefit in subtler ways. Fetching Git LFS objects, submodule updates, and shallow clones all reuse the same networking stack. When every invocation inherits consistent routing, your junior engineers stop asking why their laptop pulls fine in the browser but git fetch times out in Terminal.

npm, pnpm, Yarn, and Corporate Registries

Package managers are notorious for respecting environment variables in one terminal tab and ignoring them in another because launchd, systemd user units, or IDE-integrated terminals reset the environment. TUN sidesteps much of that drama by ensuring the actual SYN packets for registry.npmjs.org and mirrors traverse Clash regardless of whether HTTPS_PROXY was exported before Visual Studio Code spawned.

Still set sane defaults. Configure strict-ssl thoughtfully when you MITM yourself for debugging. If your company rewrites TLS with an internal root, trust stores must include that root in Node, not only in the browser. TUN cannot fix PKIX errors caused by incomplete certificate configuration; it only guarantees the packet reaches the resolver and remote host you intended under policy.

Monorepo tooling that spawns dozens of parallel downloads can stress keepalive tables on modest routers. If you notice intermittent ETIMEDOUT under load, consider lowering concurrency in npm or pointing heavy traffic at a datacenter outbound with higher file descriptor limits rather than blaming TUN itself.

Game Launchers, UDP, and Anti-Cheat Realities

Games are the poster child for TUN because matchmaking, voice chat, and telemetry mix TCP with UDP in ways web proxies never handled elegantly. When TUN is enabled and your rules mark the relevant ASNs or domain suffixes for proxying, the experience often improves immediately for titles that previously required a commercial gaming VPN.

Be honest about constraints. Kernel-level anti-cheat software sometimes validates network stack integrity and may refuse to launch if it detects virtual adapters it does not whitelist. Other titles pin latency-sensitive voice to interfaces with the lowest measured RTT; if Clash adds microseconds of userspace forwarding, competitive players may still prefer selective routing or split DNS only. Neither outcome means Clash failed; it means the game vendor drew a hard security or performance line.

For UDP-heavy flows, verify that your chosen outbound protocol actually supports UDP and that your provider does not throttle game ports. Shadowsocks2022 and VMess implementations vary; read the release notes for the exact core bundled in your GUI. If voice breaks while gameplay works, inspect whether only subsets of UDP ports are forwarded.

Enabling TUN on Windows and macOS Without Guesswork

On Windows, expect a UAC prompt the first time a Meta-based GUI installs its tunnel driver. After installation, reboot once if Device Manager shows a disabled adapter with a yellow warning badge. Re-open the client as administrator only when the documentation says so; running everything elevated all day widens the blast radius of unrelated malware.

On macOS, Enhanced Mode in ClashX-class clients is the user-facing name for a similar packet-capture story. Grant VPN permissions when System Settings asks, and remember that Little Snitch or LuLu rules layered above Clash can still block flows after Clash approves them. Ordering matters: security tools may see packets leaving the TUN interface before Clash re-injects them toward your airport node.

For a click-by-click Windows walkthrough that pairs screenshots with permission dialogs, read our Clash Verge Rev Windows setup guide after you finish this conceptual overview.

Stacking Rules: TUN plus Process Rules plus Fallbacks

Power users often combine TUN with PROCESS-NAME or UID style rules when the core exposes them, sending only heavy binaries through a high-bandwidth outbound while keeping email local. Others rely purely on domain lists imported as rule providers. Both approaches are valid if you document them for your household or team.

Avoid creating circular routes where traffic destined for the proxy server itself is accidentally captured by TUN and re-sent through the same outbound forever. Quality profiles include explicit DIRECT entries for the airport hostname and for link-local ranges. If latency spikes every thirty seconds, capture logs and search for loops before blaming CPU throttling.

Security and Trust Boundaries

TUN mode increases capability, which increases responsibility. You are granting a userspace daemon influence over default routes. Treat configuration files like code in a production repository: review changes, pin rule-provider URLs to maintainers you trust, and rotate remote profile tokens when staff leave. Combine TUN with OS firewall rules if you need defense in depth against lateral movement on a laptop that joins untrusted Wi-Fi.

Remember that Clash is open source; you can audit behavior upstream, but end users should still prefer installers distributed through verified download channels rather than random forum attachments that bundle unknown cores.

Troubleshooting Checklist When Something Still Bypasses TUN

Start with interface metrics. Windows may prefer Wi-Fi directly if the TUN adapter metric is higher than expected after waking from sleep. macOS may reorder services when docking. Renew DHCP or toggle airplane mode once to rebuild the table before you spend an hour editing YAML.

Next, read the live log while reproducing the issue. Clash tells you whether a flow matched REJECT, DIRECT, or a policy group. If the flow never appears, the packets are not traversing Clash at all, which points to hard-coded interfaces in the app, split tunneling in another VPN, or a browser experiment using QUIC on a path your rules do not classify yet.

Finally, test with the smallest reproducible command. A plain curl to an HTTPS endpoint with verbose output confirms TLS handshakes. A traceroute from the same host reveals whether ICMP is filtered separately. Document each step; future you will thank present you when a Windows update shuffles drivers again.

Bringing It Together

TUN mode is not magic; it is disciplined packet steering paired with the same rule language you already use for browser traffic. Developers gain predictable Git and npm behavior without sprinkling proxy environment variables across every toolchain. Gamers gain a fair shot at routing UDP flows through nodes that actually support them. Network administrators gain a single place to audit policy instead of chasing per-app toggles.

The cost is elevated trust: you must understand DNS, routes, and occasional anti-cheat friction. When those trade-offs make sense for your workload, Clash remains one of the most flexible ways to express split routing without buying a different appliance for every scenario. Compared with ad hoc per-tool proxy flags, a well-tested TUN profile feels like switching from duct tape to a labeled breaker panel.

If you are ready to install a maintained Meta-class client and enable TUN with sane defaults, start from our downloads hub so architecture, signatures, and update channels stay aligned with what this article assumes. → Download Clash for free and experience the difference between brittle per-app workarounds and a single routing plane you can reason about end to end.