System Proxy, TUN, and Routing Modes

Clash Nyanpasu has two ways to deliver device traffic to the selected core. A separate routing mode controls what the core does with traffic it receives.

Setting	Role
System Proxy OS proxy settings	Sets the operating system’s proxy. Only applications that honor those settings use it.
TUN Mode Virtual interface	Writes the TUN setting to the active core configuration so the core can create a virtual interface and route device traffic. It can cover applications that ignore the system proxy, subject to core support and network permissions.
Routing Mode Core policy	Selects how the core routes captured traffic. It does not turn System Proxy or TUN on.

flowchart LR
    App[Applications] -->|honors OS proxy| Proxy[System Proxy]
    App -->|device traffic capture| Tun[TUN Mode]
    Proxy --> Core[Selected core]
    Tun --> Core
    Core --> Mode{Routing mode}
    Mode -->|Rule| Rules[Profile rules]
    Mode -->|Global| Global[Global proxy choice]
    Mode -->|Direct| Direct[Direct outbound]
    Mode -->|Script, if supported| Script[Script policy]

Start with System Proxy for browsers and other applications that follow the operating system’s proxy settings. It is the simplest starting point and does not need TUN network privileges, but apps with their own proxy or network settings may bypass it.

Use TUN Mode when you need to capture traffic from applications that ignore the system proxy. Nyanpasu writes the TUN setting to the active core configuration; the selected core then creates a virtual interface and changes device-level routing. Both core support and sufficient network permissions matter. System Proxy and TUN are independent switches and can both be enabled; start with one when diagnosing which traffic is covered.

Both switches and the routing selector are in Settings → System Settings. The Current System Proxy section on that page shows the proxy settings reported by the operating system. It is a useful check of the OS setting, but does not prove that a particular app uses it.

These modes apply to traffic handled by the core, regardless of whether it arrived through System Proxy or TUN:

Mode	What it does
Rule	Applies the profile’s rules to choose an outbound, such as a proxy group or a direct connection. This is the usual starting mode.
Global	Sends handled traffic through the core’s global proxy choice. Select a usable proxy or proxy group in the profile.
Direct	Sends handled traffic directly, without using a proxy outbound.

With Clash Premium, the selector may also offer Script mode. Other cores may not provide this mode; see core compatibility.

Core-dependent TUN requires the selected core to support the configuration and TUN stack your setup uses. If the option is unavailable or the core rejects the configuration, check core compatibility.

1. Open Settings → System Settings and find System Service. Select Install, then Start if the service is stopped. The operating system asks for elevated authorization; see the platform tabs below.
2. After the service is installed, compatible, and running, turn on Service Mode. This lets the app manage the core through the service, which grants the core the privileges needed for features such as TUN.
3. Turn on TUN Mode under the Routing Mode section. Check the service status and any warning beside Service Mode before testing traffic.

• Windows
• macOS
• Linux

Installing or starting the service uses an elevated helper. If a service is installed but incompatible, follow the message in System Service to reinstall a compatible service version.

The service is designed to give the core the privileges needed for system-level features while keeping the desktop app at the user’s normal permission level. TUN Stack under Settings → Clash Settings offers System, gVisor, and Mixed where supported by the selected core. Mixed is not offered with Clash Premium. Do not assume every stack or optional TUN field works across all cores.

Manual changes to core-binary permissions are not part of the app’s TUN setup flow; use System Service and Service Mode instead.

• For System Proxy, inspect Current System Proxy and test an application that follows OS proxy settings.
• For TUN, confirm TUN Mode is on. If using Service Mode, verify that System Service is running and no fallback warning is shown. Then test an application that ignores the system proxy.
• If traffic reaches the core but takes the wrong route, check the profile rules and selected Routing Mode.

An enabled switch shows the requested setting; it does not prove that every application sends traffic through the core.

• Turn System Proxy off to disable the proxy setting Nyanpasu applied. When the app exits, it attempts to restore the system proxy state captured before it took control.
• Turn TUN Mode off to apply a core configuration with TUN disabled. Service Mode can stay enabled independently.
• Select Rule to return the core to profile-based routing after using Global, Direct, or Script mode.

See the installation guide for platform and package information, the core guide for core-specific behavior, and the FAQ for troubleshooting.