github.com/igoogolx/clash@v1.19.8/docs/premium/tun-device.md (about)

     1  ---
     2  sidebarTitle: "Feature: TUN Device"
     3  sidebarOrder: 2
     4  ---
     5  
     6  # TUN Device
     7  
     8  The Premium core has out-of-the-box support of TUN device. Being a Network layer device, it can be used to handle TCP, UDP, ICMP traffic. It has been extensively tested and used in production environments - you can even play competitive games with it.
     9  
    10  One of the biggest advantage of using Clash TUN is the built-in support of the *automagic* management of the route table, routing rules and nftable. You can enable it with the options `tun.auto-route` and `tun.auto-redir`. It's a drop-in replacement of the ancient configuration option `redir-port` (TCP) for the sake of easier configuration and better stability.
    11  
    12  ::: tip
    13  `tun.auto-route` is only available on macOS, Windows, Linux and Android, and only receives IPv4 traffic. `tun.auto-redir` is only available on Linux(needs netlink support in the kernel).
    14  :::
    15  
    16  There are two options of TCP/IP stack available: `system` or `gvisor`. In order to get the best performance available, we recommend that you always use `system` stack unless you have a specific reason or compatibility issue to use `gvisor`. If that's the case, do not hesitate to [submit an issue](https://github.com/Dreamacro/clash/issues/new/choose).
    17  
    18  ## Technical Limitations
    19  
    20  * For Android, the control device is at `/dev/tun` instead of `/dev/net/tun`, you will need to create a symbolic link first (i.e. `ln -sf /dev/tun /dev/net/tun`)
    21  
    22  * DNS hijacking might result in a failure, if the system DNS is at a private IP address (since `auto-route` does not capture private network traffic).
    23  
    24  ## Linux, macOS or Android
    25  
    26  This is an example configuration of the TUN feature:
    27  
    28  ```yaml
    29  interface-name: en0 # conflict with `tun.auto-detect-interface`
    30  
    31  tun:
    32    enable: true
    33    stack: system # or gvisor
    34    # dns-hijack:
    35    #   - 8.8.8.8:53
    36    #   - tcp://8.8.8.8:53
    37    #   - any:53
    38    #   - tcp://any:53
    39    auto-route: true # manage `ip route` and `ip rules`
    40    auto-redir: true # manage nftable REDIRECT
    41    auto-detect-interface: true # conflict with `interface-name`
    42  ```
    43  
    44  Be advised, since the use of TUN device and manipulation of system route/nft settings, Clash will need superuser privileges to run.
    45  
    46  ```shell
    47  sudo ./clash
    48  ```
    49  
    50  If your device already has some TUN device, Clash TUN might not work - you will have to check the route table and routing rules manually. In this case, `fake-ip-filter` may helpful as well.
    51  
    52  ## Windows
    53  
    54  You will need to visit the [WinTUN website](https://www.wintun.net) and download the latest release. After that, copy `wintun.dll` into Clash home directory. Example configuration:
    55  
    56  ```yaml
    57  tun:
    58    enable: true
    59    stack: gvisor # or system
    60    dns-hijack:
    61      - 198.18.0.2:53 # when `fake-ip-range` is 198.18.0.1/16, should hijack 198.18.0.2:53
    62    auto-route: true # auto set global route for Windows
    63    # It is recommended to use `interface-name`
    64    auto-detect-interface: true # auto detect interface, conflict with `interface-name`
    65  ```