A virtual adapter catches the programs that ignore proxies
TUN creates a virtual network adapter and has the system hand traffic to it. A program no longer needs to know what a proxy is: its packets reach the adapter and the core takes over. That is how games and command line tools that ignore the system proxy get covered.
The price is depth. When the system proxy misbehaves, one browser stops working. When TUN misbehaves, the whole machine does.
There is a prerequisite. On Windows the service mode has to be installed first; on macOS and Linux the first activation asks for an administrator password. Without it, the switch flips itself back a second after you touch it.
The toggle bouncing back is not a fault
It means the privileged part is not in place. Install the service, then flip it again.
Settle these three before you flip the switch
- 1
Turn the system proxy off
Running both is not faster. Once the coverage overlaps, you cannot tell whether a misbehaving program reached the network through the adapter or through a proxy setting. One path is far easier to reason about.
- 2
Leave the network stack alone at first
The settings offer several implementations such as gVisor, system and mixed. The default has the widest compatibility. Change it only when a specific kind of traffic misbehaves, and switch TUN off and on afterwards: the stack is chosen when the adapter comes up.
- 3
Work out what must stay off the adapter
Intranet domains, local device names, printers and the NAS are worth handling in the rules ahead of time. Discover it later and you will suspect the device long before TUN.
What happens once DNS moves too
With TUN on, DNS belongs to it as well. That is the mechanism, not a side effect: without owning resolution there is no way to route by domain. It is also where trouble starts. Intranet domains and local device names may fail to resolve, or resolve and then get shipped to a remote node, and a DIRECT rule for your local subnet and those domains clears them. TUN also handles UDP better than the system proxy, though games only improve if the node forwards UDP.
- System proxy stays off while TUN is on
- Local subnets and device names go to DIRECT near the top of the rules
- After changing the stack, switch TUN off and on so the new one loads
Common questions
Can the system proxy and TUN be enabled at the same time?
They can, and there is almost never a reason to. Their coverage overlaps heavily, so nothing gets faster; all you add is an unknown. When a program behaves strangely you cannot say whether its packets came through the adapter or through a proxy setting.
After enabling TUN I cannot reach the NAS or the printer on my own network.
Routing and DNS both moved to the virtual adapter, so the device name does not resolve, or resolves and then gets sent to a proxy. Put a DIRECT rule for your local subnet and device names near the top of the list, and point those domains at a local DNS server. The fake-ip pool defaults to 198.18.0.1/16, so exclude your own range if it is close.