Almost every failure is a permissions failure
TUN has to create a virtual network adapter and take over routing. That is a system level operation, and ordinary user privileges cannot do it. Which is why the failure always looks the same: you flip the switch, it spins for a moment, it flips back, and the interface says nothing at all.
The real information is on the log page. At the moment the switch reverts, a line about adapter creation or privileges is usually written. Find that line first, then work through the four suspects below.
Close every other proxy client first
A virtual adapter is an exclusive resource. Two programs competing for it will knock each other out, and this single step resolves a surprising share of cases.
Four suspects, in order
- 1
The service is missing or out of date
By far the most common. You upgraded the client, the helper service stayed on the old version, and now the switch does nothing. Uninstall the service from settings and install it again, then restart the client. Windows needs administrator rights for that install, and macOS will prompt for your password.
- 2
Authorisation expired
After a major macOS upgrade, permission granted to a helper tool can stop being valid and has to be granted again. This is not a defect in the client. The operating system changed what it requires from helper tools between releases.
- 3
Security software blocked the adapter
Creating a virtual network adapter looks suspicious to antivirus software, which will block it outright and leave a creation failure in the log. Whitelist the client and its helper service together. Whitelisting only the main executable is why people repeat this step twice.
When TUN starts but nothing loads
This is a different problem, so stop reinstalling the service. Turn the system proxy off and leave only TUN running, because having both on makes the result impossible to interpret. If that does not help, switch to a different network stack implementation, then turn TUN off and on again so the change takes effect. Still nothing, and the culprit is often a strict routing style option that some adapter drivers do not tolerate.
- After a crash, check the OS network adapter list and confirm the virtual adapter is gone
- A leftover adapter will keep you offline even with the client closed, so remove it or reboot
- If internal company domains stop resolving, exempt those suffixes explicitly in the configuration
Common questions
It keeps saying the service is not installed even after reinstalling it several times.
The install itself is probably being blocked. Run the client as an administrator on Windows and install once more, and check your antivirus quarantine log at the same time. A silently removed service installer is a common cause and leaves no visible error.
With TUN on I can no longer reach devices on my local network.
TUN takes over DNS as well, so local device names and internal domains get sent outside for resolution and come back empty. Point those suffixes at a local resolver in your configuration, or add them to the list of names that are not given a fake IP.