Clash Verge Rev is a widely used Windows GUI built around the Mihomo core (Clash Meta). It pairs a clean dashboard with powerful profile management, flexible proxy groups, and dependable TUN support for people who want routing that goes beyond a simple browser switch. If your goal is a straight path from install to working traffic, this guide explains download and first launch, subscription import, system proxy, and TUN mode in one continuous workflow, plus verification tips and realistic troubleshooting for Windows 10 and Windows 11.
What you should prepare before you start
A smooth setup depends on a few basics. First, confirm you are using a 64-bit Windows build and that you can install desktop software without corporate lockdown blocking drivers. Second, collect your subscription URL from your provider, and keep it private because it is effectively a key to your service plan. Third, decide whether you only need browser coverage or you also need coverage for games, terminals, and other apps that ignore the Windows HTTP proxy; that decision determines how strongly you should prioritize TUN mode in the steps below.
You should also plan for one elevated-permission moment. Tunnel software frequently needs permission to add or update a virtual adapter, so an administrator-capable account will reduce friction. If you are on a managed PC, ask your IT policy owner whether user-installed network filters are allowed before you proceed.
Step 1 — Download and install Clash Verge Rev
Start from a trusted distribution channel. On this site, open the Downloads page for Windows
and pick the latest stable installer that matches your hardware architecture. Most users should choose the standard
.exe setup; alternative packages exist for administrators who prefer .msi-style deployment.
Run the installer, accept the license if prompted, and complete the wizard.
During installation, Windows may show a SmartScreen prompt. That prompt is common for smaller developer-signed binaries. If you obtained the file from the official release you intended to use, you can continue carefully. After installation, keep the app updated, because core fixes and driver compatibility improvements ship frequently in this ecosystem.
Step 2 — First launch and how the interface maps to tasks
Open Clash Verge Rev from the Start menu or desktop shortcut. The interface is organized around tasks you will repeat often: picking nodes, managing profiles, and toggling global modes. The Home area is where you start and stop the overall experience, including quick toggles that matter for daily use. The Proxies view lists your proxy groups and upstream nodes, and it is where you manually choose a server when you do not want the default automatic behavior. The Profiles section is your control center for subscription imports and local configuration files. Finally, the Settings page holds global switches such as system proxy, TUN mode, language, and other advanced options that depend on the build you installed.
If you are new to Clash-family clients, treat profile as the word for your active ruleset: it defines nodes, groups, routing rules, DNS settings, and other behaviors. Your subscription download produces a profile entry you can activate. Once a profile is active, your node selections and mode switches apply on top of that foundation.
Step 3 — Import your subscription and activate the profile
Your provider should supply a URL that downloads a Clash-compatible configuration when opened. In Clash Verge Rev, open the Profiles page, then create a new entry using the import workflow. Paste the subscription URL, give the entry a memorable name, and start the import. Wait until the client finishes fetching and parsing the file; a stalled import is often a network issue, a blocked domain, or an expired link rather than a mysterious bug.
- Navigate to Profiles in the sidebar.
- Use New Profile or the import action, depending on the UI labels in your version.
- Paste the subscription URL, confirm, and wait until the list shows a successful update time.
- Select the profile so it becomes the active configuration.
- Open Proxies and confirm you see groups populated with nodes.
.yaml file instead of a URL, import the file directly. Some providers rotate
URLs; when that happens, update the profile entry rather than creating duplicates with confusing names.
If everything looks empty after import, copy the subscription URL into a browser address bar on the same PC. If the browser cannot download a usable file, the URL is likely invalid or your network cannot reach the provider domain. Fix the upstream issue first, because no client settings can compensate for a broken subscription source.
Step 4 — Enable system proxy for typical desktop applications
Start with System Proxy because it is the simplest compatibility story for many everyday programs. When system proxy is enabled, Windows advertises HTTP and HTTPS proxy endpoints to applications that honor the system configuration. Most mainstream browsers and many productivity apps follow that path, so you can get useful results quickly. Toggle system proxy from the area where your build exposes global switches, often near the Home view or within Settings, depending on version layout.
System proxy works best when your ruleset is sane and your selected node is healthy. If a page loads but feels wrong, check whether you picked a group that still points to a blocked node, and review the provider status page for outages. Keep in mind that system proxy does not magically capture every binary on your disk; that expectation sets up the next section.
Understand the split: system proxy versus TUN mode
The recurring confusion for newcomers is assuming that enabling a proxy equals proxying everything. On Windows, many programs do not read system proxy settings. Games, custom launchers, some electron apps, and plenty of command-line tools fall into this category. Those apps may use direct sockets, hard-coded DNS, or their own network stacks. That is normal, and it is why Clash-style tools offer TUN.
TUN mode introduces a virtual network interface so traffic can be steered at a lower layer, closer to how the operating system sees packets. In practical terms, TUN mode is the difference between “works in my browser” and “works for the stubborn program that never respected proxies.” The trade-off is higher privilege and more moving parts: a driver, routing interactions, and occasionally conflicts with other VPN or filter software.
DNS deserves a brief mention here. Even when transport is tunneled, some applications still resolve domain names through unexpected paths. If you observe leaks or odd region routing, review your profile DNS settings and any optional DNS features exposed in the client UI. Your provider documentation may recommend specific DNS modes for their backend.
Step 5 — Turn on TUN mode and handle the Wintun adapter
When you are ready for broader capture, open Settings and locate the TUN switch. Enable it and approve prompts related to adapter installation. On first run, Windows may ask for permission to install the Wintun driver used by many modern tunnel stacks. If the driver fails, restart the application elevated, then retry. Conflicts can occur if another VPN is actively managing routes; pause the other product temporarily while you test.
- Open Settings inside Clash Verge Rev.
- Enable TUN Mode using the toggle provided by your build.
- Approve driver installation prompts; avoid closing the installer mid-way.
- If the adapter does not appear, exit fully and relaunch the app using Run as administrator.
- Confirm in Windows network adapters that a virtual interface associated with the stack is present and enabled.
TUN mode changes how Windows routes packets for many programs. Expect a short connectivity blip while the adapter comes online. If you previously relied on manual proxy configuration in a specific app, consider resetting that app to defaults to avoid double-handling traffic.
Some users keep system proxy enabled alongside TUN in certain setups, while others rely on TUN alone. The correct choice depends on your ruleset, your habits, and whether any legacy app still needs explicit proxy configuration. If you are unsure, test with a simple rule and a known-good node before you tune advanced options.
Step 6 — Verify routing like a practitioner, not a guesser
Proof beats optimism. Open a browser and visit a reputable IP or DNS check page to see whether the egress matches the country you selected. Then open PowerShell and run a lightweight HTTPS request to confirm non-browser tools behave, for example:
curl -I https://www.cloudflare.comInside the client, inspect the connection or logging area if available, so you can see whether flows are classified as direct or relayed. If you expected a domain to match a particular rule but it did not, your profile may classify it under a different group than you assumed. That is configuration, not necessarily a broken tunnel.
Keep a quick mental model for failures: subscription problems look like empty groups or timeouts everywhere; driver problems often coincide with TUN toggling or OS updates; rule problems look like some sites right and some sites wrong in a patterned way. Separate those classes and you troubleshoot faster with less random clicking.
Keep subscriptions fresh without micromanaging imports
Providers change endpoints, rename nodes, and retire hardware. Set an auto update interval in the Profiles area if your build exposes it, because stale lists are one of the most common sources of “everything worked yesterday” issues. If your plan has data caps or rate limits, pick a sane refresh cadence rather than hammering the subscription URL every few minutes.
Troubleshooting scenarios that show up on real PCs
Every node times out right after import
Confirm the subscription URL downloads in a browser. Then verify local time is accurate, because TLS failures can look like generic timeouts. If you are on a restricted network, try another upstream Wi-Fi or a personal hotspot to rule out blocking.
The internet feels fine in the browser but not in a specific program
That pattern frequently means the program ignores system proxy. Enable TUN and retest. If it still fails, the application might use hard-coded endpoints, private DNS, or split tunnel logic that bypasses your rules in ways you must address inside the profile.
Connectivity drops immediately after enabling TUN
Revisit driver installation, relaunch as administrator, and look for competing VPNs or corporate filters. As a temporary isolation step, disable TUN, confirm baseline connectivity returns, then re-enable and change one variable at a time.
You suspect DNS leaks or odd regional routing
Review DNS directives in your active profile and any optional DNS settings in the client. Compare behavior against your provider’s recommended template, because a mismatched DNS strategy can look like a broken tunnel even when TCP relaying works.
Frequently asked questions
Do I need administrator rights to use TUN mode?
You typically need elevated permission at least once for driver installation. Later, running as administrator can still help when Windows updates interfere with the virtual adapter. Standard users may hit walls that disappear under an admin launch.
Should I keep system proxy enabled when TUN is on?
Some users enable both while debugging compatibility. Others standardize on TUN for simplicity. Test your must-have apps and pick the combination that produces the fewest surprises on your machine.
Why do security products distrust installers for tunnel apps?
Tunnel software changes routing tables and installs drivers, which resembles behavior also seen in malware categories. That overlap produces warnings. Reduce risk by downloading only from trusted release channels and verifying checksums when available.
How do I update my subscription when the provider rotates links?
Edit the existing profile entry with the new URL instead of stacking redundant profiles. Add an automatic refresh interval if you do not want to babysit manual updates during routine rotations.
If you walk through the steps above with a valid profile and a healthy node, you should have Clash Verge Rev working on Windows with both a conventional system proxy path and an optional TUN layer for the apps that refuse to play by older proxy conventions. When something breaks, narrow it to subscription health, adapter health, or rule logic, then fix the smallest causal layer first.
