Clash Verge Rev on Windows: Install, Service Mode & TUN Setup Guide

Why Clash Verge Rev Is a Solid Pick on Windows

There's no shortage of clients that run Clash rule sets on Windows, but Clash Verge Rev stands out for its steady release cadence and a UI that's not overwhelming. It builds its interface on the Tauri framework and runs on the mihomo core (the one the community usually calls Clash Meta), so its rule syntax and proxy-group logic stay compatible with mainline Clash while filling in gaps the original Clash never had — TUN mode, script enhancements, and automatic subscription updates. Compared to running the core straight from the command line, the GUI turns proxy-group switching, log viewing, and connection details into clickable panels, which is a lot friendlier if you're not comfortable hand-editing config files.

This guide follows a real install sequence and flags the spots where beginners typically get stuck: how to pick an install path, what the system proxy and service mode each actually do, why TUN mode so often looks "on" but isn't working, and what to check first when the connection drops.

Before You Install: Build Type and Install Location

When downloading, pay attention to the release type: builds labeled setup or x64-setup are installer versions that write to the registry through a standard install flow; portable builds just need unzipping and don't touch the system at all — handy if you don't want an install footprint or need to carry it across machines. Both ship the same core and features; only the install method differs.

• Avoid paths with non-ASCII characters or special symbols: if your install folder or username contains accented characters, spaces, exclamation marks, and the like, some core subprocesses can choke while parsing the config path. Stick to a plain ASCII path, such as the default C:\Program Files\Clash Verge.
• Avoid cloud-sync folders: don't put the install or config directory inside OneDrive, Synology Drive, or similar sync folders. The sync process periodically locks the subscription cache file, which causes read/write errors or a frozen UI when the client tries to touch its config.
• Check your Windows build: the Wintun virtual adapter driver that TUN mode relies on requires Windows 10 version 1809 or later. On older builds, run Windows Update first — otherwise the driver install step will fail silently.

First Launch: What System Proxy and Service Mode Actually Do

Once the app opens for the first time, you'll usually spot two toggles on the home screen that look similar but do very different jobs. Getting their boundaries straight up front saves a ton of troubleshooting later.

System Proxy Toggle

This toggle does one simple thing: it points Windows' system-level proxy setting at the local mixed port (listening on something like 127.0.0.1:7897 by default), so browsers and most desktop apps route their traffic through it. Under the hood it's just editing the fields in Windows Settings → Network & Internet → Proxy — functionally the same as filling in a proxy address by hand, except the client does the filling (and restoring) for you. With it on, browser traffic goes through the proxy, but not every process respects the system proxy setting — command-line tools, some games, and background services routinely bypass it and connect directly. That's the usual reason behind "I turned the proxy on, but this one app still can't connect."

Service Mode

Service mode exists to solve a permissions problem. TUN mode needs to create a virtual network adapter and modify the local routing table, and on Windows both require administrator rights. Having to relaunch the client "as administrator" every time you flip TUN would be miserable, so Clash Verge Rev offers an optional background Windows service: install it once (which needs one admin confirmation), and from then on the client itself runs with normal user permissions, delegating anything that needs elevation to that service instead of prompting for admin rights every time.

Setting Up TUN Mode: Virtual Adapter and Route Hijacking

TUN mode works by creating a virtual network adapter on the system (backed by the Wintun driver on Windows). The client points the default route at this adapter, so every packet at the IP layer that isn't excluded by the routing table passes through it first and gets routed by the core according to your rules — no more relying on individual processes to check proxy settings on their own. This fixes the "some apps bypass the proxy" problem you get with system proxy mode, and it's especially useful when you need to route everything — games, UDP apps, non-browser clients — through the proxy.

When turning on TUN mode in the settings panel, a few options are worth paying attention to:

1. Stack mode: the System stack calls into the OS network stack directly, which performs better but is more sensitive to driver compatibility issues; gVisor is a userspace network stack implementation that's more stable across setups but has slightly lower throughput. If you can't get a connection working the first time, try gVisor first to rule out driver conflicts, then switch to the System stack once things are confirmed working.
2. DNS hijacking: TUN mode usually takes over DNS queries too, folding resolution requests into the routing logic. That's exactly why some internal/LAN services stop being reachable once TUN is on — local DNS gets redirected to a Fake-IP, so you need to add internal domains or your LAN subnet to the direct-connect list in your config.
3. Strict route: some builds include a "strict route" option that controls whether all outbound traffic gets hijacked or only the traffic outside the default route. If you're not sure what it does, leave it at the default — don't flip advanced options just to see what happens.

If you have zero internet access after enabling TUN, check things in this order:
1. Confirm service mode is installed and its status shows "Running"
2. Open Task Manager and check whether the virtual adapter (named something with Wintun) was actually created
3. Turn TUN off and test whether the system proxy alone gets you online
4. If the system proxy works fine but TUN doesn't, switch the stack mode to gVisor and try again

Common Fixes: Firewall Blocks and Port Conflicts

Windows Defender Firewall Blocking

The first time you enable TUN mode, or the first time you run the client at all, Windows typically pops up a "Windows Defender Firewall has blocked some features of this app" prompt asking which network types to allow. Check both "Private networks" and "Public networks" here — otherwise, even after the virtual adapter is created, the firewall will keep blocking its traffic. That shows up as the UI saying you're connected and proxy-group latency tests passing, while pages still won't load. If you accidentally clicked "Cancel," you can re-enable it manually from Control Panel → System and Security → Windows Defender Firewall → Allow an app through Windows Firewall.

On corporate machines or ones running third-party security software, there's one more layer to watch for: some endpoint management tools additionally block virtual adapter drivers from loading, which shows up as the Wintun driver install step failing over and over. That usually needs your IT department to whitelist it — the client itself can't work around that kind of policy restriction.

Port Conflicts

By default, Clash Verge Rev listens on the mixed port, the HTTP port, and a few others. If another program on your machine is already using the same port (common when multiple proxy tools are installed, or a previous client process didn't fully exit), startup will fail with a port-binding error, or the service will look fine on the surface while the proxy simply doesn't work. Start by checking whether the port is actually in use:

netstat -ano | findstr 7897

The last column of the command output is the PID holding that port. Look it up in Task Manager's "Details" tab to see whether it's a leftover process or a conflicting app. If it's a leftover process, just end it — or change the port in the client's settings to something that isn't taken and restart to apply it.

A Few Tips for Everyday Use

Once everything's working, day-to-day maintenance mostly comes down to subscription updates and rule tweaks. Set an auto-update interval for your subscription link so you're not still connecting to nodes that have already expired. Rule sets (GeoIP/GeoSite) have their own separate update mechanism — that's a different thing from updating your subscription, and letting them go stale will throw off your routing decisions. After switching proxy-group nodes, check that a latency test has finished running in the connections panel first; picking an untested node at random is a good way to end up connected to a dead exit.

If you want to keep the same routing setup across multiple devices down the line, back up your config file and subscription link separately — then just import them again after a reinstall or on a new machine, instead of redoing all of the above from scratch.