First confirm that your node works, then run v2rayN as an administrator, enable TUN, and verify routing and DNS. This guide is for anyone whose browser works but terminal apps or games don’t. Learn to distinguish system proxy settings, virtual adapter routing, and global proxy rules, then use the checklist to restore network access if something goes wrong.
1. System Proxy, TUN, and Global Proxy: What’s the Difference?
A system proxy is a proxy setting provided by the operating system. An application must support and read this setting to send requests to the local proxy. Browsers usually do; some command-line tools, games, and apps that create their own network connections do not. If your browser works but another app fails, first check whether that app supports proxies instead of immediately switching nodes.
TUN is a virtual network interface that operates at the network layer and sends and receives IP packets. Once the client creates the adapter and configures routes, matching traffic can be sent through the proxy processing chain without requiring each app to support HTTP or SOCKS proxies. HTTP is a common protocol for web traffic; SOCKS is a proxy protocol for forwarding application connections.
| Feature | System proxy | TUN mode |
|---|---|---|
| Traffic capture point | Forwards requests when an app uses the proxy settings | Receives IP packets through a virtual adapter and system routes |
| App requirements | The app must support the system proxy or allow manual proxy settings | Usually works without a proxy option in the app |
| UDP traffic | Typically not covered by the system HTTP proxy | Can capture it, depending on the core, rules, and node support |
| Permissions required | Usually no administrator privileges needed | Elevated privileges are usually needed to create the adapter and change routes |
| Actual outbound route | Determined by the client’s routing rules | Also determined by the client’s routing rules |
Bottom line: choose how to capture traffic, then choose the routing rules
TUN doesn’t mean every connection goes through a remote node. Enable it when you need to capture traffic from apps that ignore proxy settings. Change routing rules separately to control which destinations use the proxy. Testing each setting independently makes problems easier to pinpoint.
2. How a Virtual Adapter Routes Traffic to a Node
When an app opens a connection, the system checks its routing table. Traffic matching a TUN route enters the virtual adapter, where the core processes it and checks the rules. Those rules determine whether traffic goes direct, through a proxy, or gets blocked. So “captures all traffic” describes the coverage—not a guarantee that every connection passes through a proxy server.
v2rayN is a client interface for managing configurations and launching a core; it isn’t the same thing as the V2Ray or Xray core. TUN implementation depends on the client version and the core it uses. Some versions rely on sing-box for TUN processing. Using a VMess or VLESS node doesn’t, by itself, tell you how TUN is implemented locally.
- Keep the server connection on the right route: The client must prevent its own connection to the proxy server from looping back through TUN. Prefer routes generated by the client, and avoid adding manual default routes without a clear reason.
- Check DNS separately: DNS translates domain names into IP addresses. If name resolution fails, the request may never reach the remote connection stage, so switching nodes may not help.
- Don’t equate games with UDP: Games may use both TCP and UDP. A successful TCP connection only confirms that one type of connection works.
3. Save Your Settings and Check the Local Proxy Before Enabling TUN
These steps use the v2rayN 7.x desktop interface on Windows. Button locations and settings groups can vary between minor releases. Look for “Enable TUN” and the TUN options in your version rather than expecting screenshots from another release to match exactly. Before you begin, note your version, selected node, routing mode, and local listening port.
Baseline: standard proxy
- Active configuration
- Select an imported, working node
- System proxy
- Use it first to verify browser connectivity
- Local proxy
- Note the actual SOCKS or mixed inbound port
- Back up
- Subscription, routing, and DNS settings
Confirm the node works before adding a virtual adapter to the mix.
TUN prerequisites
- Permissions
- Run as administrator
- Processing core
- Make sure all core files required by the client are present
- Other tunnels
- Pause potentially conflicting connections during testing
- Routing and DNS
- Keep the client’s default setup for now
Only make changes on devices you’re authorized to manage. Don’t bypass your organization’s network policies.
The three port numbers below are commonly used for troubleshooting. They’re not speed test results or fixed defaults across all versions. In particular, check the actual local proxy port under Settings → Parameter Settings; don’t rely on values from an old guide.
4. Run v2rayN as Administrator and Enable TUN
- Verify your current node. Select the configuration you plan to use, then temporarily use the system proxy to open a known-accessible HTTPS page. If the standard proxy also fails, troubleshoot the subscription, server address, authentication, or network first.
- Exit the client completely. Quit v2rayN from the system tray menu; don’t just close the main window. An older process still running in the tray may cause a restart to keep using the previous permissions.
- Run as administrator. Right-click the v2rayN app or shortcut, select “Run as administrator,” and approve the system prompt. Versions with service mode may also obtain the required permissions through a service. For initial troubleshooting, use one clearly defined elevation method.
- Check the TUN settings. Go to Settings → Parameter Settings and find the TUN section for your version. Keep the default stack and MTU for the first test. Don’t also change DNS, the adapter name, or routes. MTU is the maximum transmission unit—the largest size of a single network packet.
- Turn on “Enable TUN.” Return to the main window and enable the corresponding switch. Check the logs for core startup, adapter creation, and route configuration. If core files are missing, use the full release package or the client’s update option to install them.
- Isolate system proxy settings. To verify that TUN works independently, set the system proxy to “Clear system proxy” while leaving the client and TUN running. Then test your browser and target app.
After enabling TUN, open Windows Settings → Network & internet → Advanced network settings to check the network adapters, or use the commands below. Seeing a virtual adapter only confirms that it was created; it doesn’t mean the node, DNS resolution, or target app is working.
5. Verify Traffic Capture with Commands, Not Just the Toggle
Run both tests in the same terminal window for an apples-to-apples comparison. The first explicitly uses the local SOCKS proxy to verify the standard proxy connection. The second doesn’t use an app-level proxy and checks whether the connection works over TUN. The example port is 10808 and the target is a public example domain; confirm the port and your node’s routing policy before running the commands.
curl.exe --proxy socks5h://127.0.0.1:10808 --connect-timeout 10 --max-time 20 -I https://example.com
curl.exe --noproxy "*" --connect-timeout 10 --max-time 20 -I https://example.comsocks5h means the domain name is resolved through the SOCKS proxy. --noproxy "*" tells this curl request to ignore application-level proxy settings, but it doesn’t bypass system routes or TUN. On Windows, use curl.exe to avoid terminal environments that may interpret curl as a different command.
Get-NetAdapter
Get-NetRoute -AddressFamily IPv4
Get-NetRoute -AddressFamily IPv6
Get-DnsClientServerAddress- Compare before and after enabling TUN: Note changes to network interfaces and routes with TUN off and on. Don’t expect one specific default route to appear; different implementations may route traffic using more specific entries.
- Check outbound logs: See which destination and outbound route matched the same test connection. A successful request alone doesn’t prove it went through the proxy—a direct connection may also succeed.
- Check IPv6: If an app prefers IPv6 but TUN only covers IPv4, it may behave differently from your browser. Confirm that the core and rules support and cover the address family actually in use.
- Test the actual app: Restart the target game or command-line task before trying again. Existing long-lived connections may not reconnect automatically when you switch modes.
Bottom line: confirm the route with a successful request and its matching outbound log
After the second command succeeds, check whether the logs show the expected proxy outbound. If the request only succeeded over a direct connection, try a different test destination or adjust the routing rules. Don’t assume that every app is using the proxy.
6. DNS, Local Networks, and UDP: What to Check
Fix name resolution before changing routing. Traditional DNS commonly uses UDP or TCP port 53; encrypted DNS may also use HTTPS on port 443. Capturing port 53 alone won’t cover encrypted DNS built into an app. If your browser has its own secure DNS setting, check it alongside the client’s DNS setup to prevent conflicts.
| Symptom | Check first | What to do |
|---|---|---|
| Domain names fail, but existing IP connections still work | DNS upstream and resolution route | Restore the default DNS setup, check the logs for resolution timeouts, then change one upstream at a time |
| Can’t reach a local printer or storage device | Is local network traffic being routed through the proxy by mistake? | Check direct-routing rules for the subnets actually in use, such as 192.168.0.0/16 and 10.0.0.0/8 |
| Web pages work, but game login or voice chat fails | UDP support and rules | Confirm the node supports UDP, then check whether game traffic is being blocked |
| Some pages hang or uploads stop midway | MTU and path issues | Record the original value and test one setting at a time. You can try 1400, but it isn’t a universal best value |
Local networks aren’t limited to the two ranges in the table. Check for 172.16.0.0/12, IPv6 local addresses, and organization-specific routes in your environment. Don’t route all corporate traffic through a proxy indiscriminately, and don’t add unknown public IP ranges to direct routes wholesale.
Command-line tools don’t always need TUN. Tools that support proxies can use environment variables or an explicitly specified SOCKS proxy; games with built-in proxy options may have other ways to connect. TUN is useful for capturing connections from apps that ignore proxy settings. It doesn’t guarantee lower game latency or add UDP support that the server doesn’t provide.
7. Common Questions and How to Restore Your Network
TUN reports insufficient permissions, even after running as administrator. What now?
First quit the app completely from the system tray and check for any remaining processes. Then right-click the app and select “Run as administrator” again. If it still fails, note the failed operation in the logs and determine whether adapter creation or file access failed. Don’t just keep toggling the setting.
The browser works, but the terminal still can’t connect. What should I do?
Clear the system proxy first, then run the test above with --noproxy "*". If it fails, check the TUN routes and outbound logs. If it succeeds, check the terminal tool’s own proxy variables, certificate settings, and destination address.
Enabling TUN breaks another tunnel or my work network. What should I do?
Turn off TUN first to restore the work connection, then compare the routes used by each tunnel. During approved testing, enable only one tunnel at a time. If both must run simultaneously, ask your network administrator to specify the organization’s subnets, DNS, and outbound priority. Don’t simply delete routes belonging to the other tunnel.
I still can’t connect after closing the client. How do I restore network access?
Reopen the client, turn off TUN, clear the system proxy, and exit normally. Check whether system DNS still points to a local service that’s no longer running. If the network was originally set to obtain DNS automatically, restore that setting. If the problem persists, reconnect to the network or restart the device, then check for leftover configuration.
Does v2rayNG on Android also need administrator privileges?
Don’t follow the Windows steps. v2rayNG uses the Xray core and captures traffic through Android’s VPN permission prompt at startup; root access is usually unnecessary. Approve the system prompt and check the app’s per-app proxy settings. Apps on the bypass list won’t use the same route.
Once troubleshooting is complete, note the working node, routing mode, DNS setup, and client version. Change one setting at a time and restore its original value if the test fails. For more on how direct and proxy outbounds are matched, see the Configuration Fields Guide. If you’re importing a subscription for the first time, start with the beginner’s guide.