How to Enable TUN Mode in v2rayN: Virtual Network Adapter Setup and Traffic Routing

System Proxy vs. TUN: Capturing Traffic Doesn’t Mean Proxying Everything

A system proxy is a proxy configuration provided by the operating system to apps. Browsers usually use it, but some command-line tools, games, and background services have their own network settings and may ignore it. TUN creates a layer 3 virtual network interface and uses routing to send eligible IP packets to the proxy core. Apps don’t need built-in support for HTTP or SOCKS proxies.

“All traffic” describes what TUN aims to capture; it doesn’t mean every packet will reach a proxy server. LAN exclusions, interface binding, IPv6 settings, and certain system traffic all affect coverage. Even traffic that enters TUN can be routed directly, proxied, or blocked by rules. Enabling TUN also doesn’t automatically change a “bypass LAN” routing setup into global proxying.

Before You Start: Record Current Settings and Verify Your Node

v2rayN provides the client interface; the core handles traffic forwarding. Using VMess or VLESS doesn’t by itself determine whether TUN is available. Your current client version must also include a compatible TUN backend and its required components. Some versions use sing-box for TUN. Don’t assume the “TUN” switch means all traffic is handled by a single Xray setting.

The steps below use common labels from recent Windows versions. Button locations and TUN options may vary between desktop releases. First, note your exact version under “Help” → “About,” then match the settings shown in your interface. If a field isn’t there, don’t copy an old screenshot or invent a core configuration.

1. Back up your settings. Back up the current configuration folder, or note your subscription groups, active node, routing mode, and DNS settings. Backups may contain subscription URLs and credentials, so store them securely.
2. Verify the connection first. Leave TUN off, select a working node, and open a real webpage using the system proxy. A normal latency reading isn’t enough—you need to confirm that an actual request succeeds.
3. Note the local port. Open “Settings” → “Parameter Settings” and check the local listening port and protocol. This guide uses 127.0.0.1:10808 as an example. Use the value from your current configuration.
4. Avoid competing traffic capture. Temporarily exit other VPNs, virtual adapter tools, and network accelerators. On a managed work device, check your organization’s requirements first. Don’t disable company network security services without authorization.
5. Check the installation folder. Use the complete installer or fully extracted folder; don’t copy only the launcher. Make sure your account can write to the configuration and log folders.

Enable TUN on Windows: Steps and Settings

For the first run, change only how traffic is captured. Keep the working node and routing setup. Don’t import a new subscription, switch protocols, change DNS, and enable TUN all at once—or it’ll be hard to identify what caused a failure.

1. Exit the client completely. Quit v2rayN from the system tray instead of just closing the main window. Confirm the old process has exited.
2. Run it as administrator. Right-click the v2rayN launcher, select “Run as administrator,” and approve the Windows prompt. If the app doesn’t get elevated privileges, fix that first. Don’t keep clicking the TUN switch.
3. Check the active node. Confirm the selected server and routing mode in the main window. A selected node doesn’t necessarily mean the connection has been verified.
4. Clear the system proxy. From the main window or tray menu, open “System Proxy” and select “Clear System Proxy.” For the first test, use only one traffic-capture method to make problems easier to isolate. Clearing the system proxy does not stop the core.
5. Enable TUN. Turn on “Enable TUN” in the main window. If prompted to elevate again or restart the core, follow the instructions. Then check the logs for permission, adapter creation, or configuration errors.
6. Start with the default TUN settings. To check advanced options, open the TUN section under “Settings” → “Parameter Settings.” In some versions, it’s called “TUN Mode Settings.” If a field isn’t available, keep the current version’s default rather than copying settings from another release.

If Windows Firewall prompts you on the first launch, check the program path and network scope. Don’t disable the entire firewall just to make the switch turn on, and don’t change the local listening address to 0.0.0.0. Widening the listening address won’t fix virtual adapter permissions and could let other devices on your network access the local proxy.

Check That TUN Works: Adapter, Routes, and Real Requests

A switch that’s on only confirms the interface state changed. To verify TUN, check that the virtual interface exists, that routes changed, and that the target request reached the core. Run the commands below in Windows PowerShell before and after enabling TUN, then compare the results. Interface names depend on the version and configuration, so they may not match screenshots in this guide.

Get-NetAdapter -IncludeHidden |
  Select-Object Name, InterfaceDescription, Status

route print -4
route print -6

curl.exe --noproxy "*" -I --connect-timeout 10 https://example.com/

• Adapter check: Compare the network adapters before and after enabling TUN. Look for a new or newly enabled virtual interface. An existing virtual adapter alone doesn’t prove traffic capture is working.
• Route check: Check whether the IPv4 routing table now includes routes through TUN. The implementation may use split default routes or another strategy; you don’t necessarily need to see a new 0.0.0.0/0 route.
• Request check: --noproxy "*" tells curl not to use an explicit proxy configuration, which helps test routing at the system level. It does not bypass TUN. An HTTP response means the request completed, but doesn’t by itself show whether it exited through a proxy.
• Routing check: Match the destination address and outbound tag in the core logs to confirm whether the test traffic went direct or through a proxy. If the current log level doesn’t show connections, raise it temporarily, then restore it when done. Remove sensitive details before sharing logs.

Also test one destination that should go direct and another that should use a proxy rule. A changed exit IP only confirms a change for that request; it doesn’t prove every app is covered. Test UDP with the app you actually need. A working webpage only confirms that HTTP request—it doesn’t verify UDP traffic used by games or voice apps.

DNS, IPv6, and LAN Access: What TUN Covers

TUN can receive packets without DNS necessarily working as expected. System caches, browser Secure DNS, client DNS rules, and core-level DNS capture can all take different paths. If IP addresses work but domain names don’t, check the logs for resolution errors, then review the client’s DNS settings. Don’t immediately replace every DNS server with the same public resolver.

• DNS capture: A common goal is to handle DNS queries over UDP or TCP port 53. Browsers may use encrypted DNS over a different connection, so don’t assume it follows the same port 53 rule.
• IPv6: IPv4 and IPv6 use separate routing tables. If only IPv4 is handled, some apps may use IPv6 to take a different route. Check route print -6 and the client’s IPv6 settings before making changes.
• LAN access: Printers, file sharing, and router admin pages usually need a direct connection. Check the subnet you actually use—192.168.0.0/16, 10.0.0.0/8, or 172.16.0.0/12—rather than forcing all LAN traffic through a proxy.
• FakeDNS: FakeDNS maps domain names to virtual IP addresses; it isn’t required to enable TUN. Don’t add it before verifying the basic connection, or you’ll also need to troubleshoot mappings, caches, and routing rules.

After changing DNS settings, run the command below if you think Windows is holding on to stale DNS records, then test again. This clears only the Windows DNS client cache. It won’t clear the browser’s cache or fix an incorrect upstream DNS server or routing rule.

ipconfig /flushdns

Common Problems: Troubleshoot the Right Layer

If webpages load but image uploads, video, or large file transfers often stall, check the MTU. Record the current value first, and change only one setting if your version provides it—for example, temporarily change 1500 to 1400 and retry the same task. This is a troubleshooting test, not a universal best value. Restore the original value if it doesn’t help, and don’t mistake occasional network fluctuations for proof that the setting worked.

Turn TUN Off and Roll Back: Restore the Original Traffic Path

When you no longer need TUN, turn off “Enable TUN” first and wait for the core to shut down or switch over. Then restore the system proxy state you need. Closing the main window alone may leave the tray process running, so it doesn’t stop traffic capture.

1. After turning TUN off, check the adapter status and routing table again. The virtual adapter can remain, but incorrect capture routes should no longer be present.
2. To keep using the browser proxy, select “Automatically configure system proxy” under “System Proxy.” To connect directly, select “Clear System Proxy.”
3. If internet access stops after the client exits unexpectedly, restart the same client and turn TUN off normally. Go to Windows “Settings” → “Network & Internet” → “Proxy” and check for a manual proxy pointing to a port that’s no longer listening.
4. If access still hasn’t returned, save the logs and restart Windows, then check for other VPN or virtual adapter software. Don’t jump straight to a network reset or bulk adapter removal; these can affect static IP settings, corporate networks, and remote management.

TUN controls how app traffic reaches the core; subscriptions provide available nodes; routing rules decide whether traffic goes direct or through a proxy; DNS resolves domain names. Check each layer separately to tell the difference between traffic not being captured, incorrect routing, and an unavailable node. For more on the basics, start with the usage guide. For protocol and transport settings, see the technical reference.