If your browser works but command-line tools or desktop apps cannot connect, first check whether they use the system proxy. If not, try enabling TUN. This guide walks through virtual adapters, administrator permissions, routing, and DNS on Windows 11, then shows how to verify traffic capture with read-only commands. TUN expands which traffic can be routed; it does not force every connection through the proxy or guarantee coverage of every type of network traffic.
System Proxy vs. TUN
The system proxy gives compatible apps a proxy endpoint. For example, an app can send requests to the local mixed-port listener at 127.0.0.1:10808, where the core managed by v2rayN handles the connection. This port is only an example; check the actual value under Settings → Parameter Settings. Some apps use their own network stack and neither read Windows proxy settings nor offer a built-in proxy option, so their traffic will not automatically use this endpoint.
TUN creates a virtual network adapter at the network layer and works with system routes to send matching IP traffic to the core. Apps generally do not need proxy addresses configured individually. In common v2rayN setups, sing-box handles TUN connectivity; the exact core and forwarding path depend on the version and configuration. Using Xray for a node does not mean Xray creates the virtual adapter, and the node protocol alone cannot tell you whether TUN is working.
“All apps” in the title means traffic capture no longer depends solely on whether an app supports the system proxy. Actual coverage still depends on routing, excluded addresses, IPv4/IPv6 settings, and app behavior. LAN traffic, loopback addresses, and explicitly excluded networks may remain direct; apps bound to a specific adapter also need separate testing. TUN does not convert arbitrary IP protocols into transports supported by a node, and UDP support still depends on the node and server.
Check permissions, nodes, and settings first
Get your node working in standard proxy mode before adding TUN. Enabling a virtual adapter will not fix an expired subscription, an unreachable server, or incorrect credentials. VMess and VLESS describe node connection protocols; TUN describes how traffic from your device reaches the core. They operate at different layers.
Standard proxy baseline
- System proxy
- Set system proxy automatically
- Listen address
- 127.0.0.1
- Example port
- 10808; check the configured value
- What to verify
- Can you access a specific website?
Confirm the current node works, then note the port and routing mode.
TUN verification baseline
- Run with
- Administrator privileges
- System proxy
- Clear system proxy
- Traffic capture
- Enable TUN
- What to verify
- Virtual adapter, routes, app connections
Test TUN on its own so a working system proxy is not mistaken for working TUN.
- Open v2rayN, select an imported node, right-click it, and choose “Set as active server.” First, use the standard system proxy to access a specific website.
- Open Settings → Parameter Settings and note the local listening port. Also note the current routing mode on the main screen so you can restore it if needed.
- Save your work and temporarily exit other network tools that create virtual adapters or change the default route. Do not experiment with traffic capture during a remote maintenance session.
- Make sure you are using the complete client folder and that core files have not been moved or quarantined. If your security software reports a block, verify the file source and exactly what was blocked; do not disable all protection.
Enable v2rayN TUN on Windows 11
These steps use the Chinese desktop interface with an “Enable TUN” switch. The desktop and classic WPF versions may have different layouts, and “TUN Mode Settings” may be under Parameter Settings. Follow the options shown in your version. If you cannot find the setting, first confirm you downloaded the appropriate desktop client instead of searching for it in an old screenshot.
- Exit the app completely, then relaunch it with elevated permissions. Exit v2rayN from the system tray, rather than just closing the window. Right-click the program file or shortcut, choose “Run as administrator,” and confirm the Windows permission prompt.
- Keep the verified active node. Make sure the node has not changed after restarting. Do not change the protocol, transport, or subscription URL at the same time.
- Clear the system proxy. From the system proxy menu on the main screen, choose “Clear system proxy.” This lets you test TUN separately; it does not mean the two modes can never be used together.
- Check the TUN settings. Open “TUN Mode Settings” under Settings. If your version places it under Parameter Settings, open that page instead. For the first test, keep the default MTU, network stack, and routing options. Do not copy configuration snippets from another version.
- Turn on “Enable TUN.” Wait for the core to start, then check the main-screen log for permission errors, virtual adapter creation failures, configuration parsing errors, or a port conflict.
- Test and record the results. Leave the system proxy cleared and test both your browser and an app that normally ignores proxy settings. Note the failing app, destination, time, and log error so you can investigate further.
Routing mode still applies. If you choose to bypass the LAN or route by domain, requests matching direct rules will not be proxied just because TUN is enabled. See Routing and split tunneling to learn how these options work, and Proxy modes for details on the system proxy.
Verify the adapter, routes, and apps
An enabled switch only confirms that the setting was accepted; it does not verify network traffic. Run these read-only commands in PowerShell. The first lists network adapters and interface indexes, the second shows IPv4 routes, and the third shows IPv6 routes. Run them before and after enabling TUN to compare changes; virtual adapter names vary.
Get-NetAdapter -IncludeHidden |
Select-Object Name, InterfaceDescription, ifIndex, Status
route print -4
route print -6| Layer | What to check | What this does not prove |
|---|---|---|
| Virtual adapter | Check whether the interface appears after enabling TUN and is in a normal state | An adapter appearing does not mean the node is working |
| Routing table | Check for new capture routes pointing to the virtual interface | You do not necessarily need to see a single default-route replacement |
| App traffic | With the system proxy cleared, check whether the target connection succeeds | A website loading does not prove UDP is working |
| Core logs | Check whether the request used the expected outbound and whether it encountered connection errors | No detailed log does not mean no traffic |
Next, use Windows’ built-in curl.exe to test a destination you know is allowed. This example uses this site and prints only the response headers, with a 15-second total timeout. --noproxy "*" bypasses curl's explicit proxy settings, but not TUN at the system routing layer.
curl.exe --noproxy "*" --connect-timeout 10 --max-time 15 -I https://v2raywindows11.com/A successful command only confirms that this HTTPS request reached the destination. If the domain matches a direct rule, the request may not use the proxy outbound at all. To confirm the traffic path, test a destination known to match a proxy rule and check the core's connection details or logs. For UDP use cases such as live voice chat, test the app itself; one HTTPS request is not a substitute.
Key takeaway: confirm the expected outbound is being used
Keep the node, destination, and routing rules unchanged while toggling TUN, then compare the adapter, routes, and connection logs. Confirm the traffic path before adjusting performance settings; a page loading does not prove that all apps are covered.
Coordinate DNS, routing, and LAN access
DNS determines where a domain resolves; routing determines where its traffic goes. Both need to work together. With TUN enabled, DNS requests from the system or apps may be captured, but browser secure DNS, app-specific resolvers, and cached results may take different paths. Enabling TUN alone does not guarantee consistent DNS routing.
- Check DNS settings. Under Settings → DNS Settings, review the configuration used by the current core. If the option is under Parameter Settings, open the corresponding DNS page. Check which queries use direct or proxied DNS, and avoid making a node's domain resolution depend on a proxy connection that has not been established yet.
- Check app-specific DNS. When troubleshooting a browser, temporarily turn off its secure DNS for a comparison test, then restore it if needed. Do not assume results from one browser apply to every app.
- Check LAN exceptions.
192.168.0.0/16,172.16.0.0/12, and10.0.0.0/8are common private address ranges. Printers, shared folders, and company services typically need direct access, but remote networks may also use these ranges. Set exceptions based on your actual network. - Check IPv6. If your network and apps use IPv6, check IPv6 routes and core settings as well. An IPv4-only check cannot confirm that IPv6 follows the same path. Permanently disabling IPv6 is not a recommended universal fix.
After changing DNS settings, run ipconfig /flushdns to clear the Windows DNS cache, then restart affected apps. This command does not clear every app's internal cache or fix incorrect routes. Change one setting at a time and retest the same destination to identify what helped.
Troubleshoot by symptom and restore connectivity
First identify whether the failure occurs during startup, traffic capture, or outbound connection. For startup issues, check permissions and core settings; for capture, check the adapter and routes; for outbound issues, check node availability, DNS, and rules. Do not change MTU, DNS, ports, and the network stack all at once, or you will not know which change fixed the problem.
TUN turns itself off as soon as I enable it. What should I do?
Exit the app completely, then run it as administrator. After enabling TUN again, check the first clear error: for access denied, check elevation and device policies; for a configuration parsing error, revert your latest change; for missing core files, check the program folder and security software logs. Do not start by removing all network adapters.
My browser works, but a desktop app still cannot connect. Why?
Choose “Clear system proxy” first to make sure the browser is not still relying on it. Then check the TUN adapter and IPv4/IPv6 routes, and see whether the app has its own proxy setting or is bound to a specific adapter. If only voice connections fail, check whether the node and server support the required UDP forwarding.
No websites load after enabling TUN. What should I check first?
Turn off “Enable TUN,” restore the standard system proxy, and test the same node. If standard mode also fails, troubleshoot the node first. If it works, check the TUN logs for DNS timeouts, route conflicts, or core startup errors. If a log reports a port conflict, look up the process using the actual port shown in Parameter Settings.
The internet still does not work after I turn off TUN. Do I need to reset Windows?
First clear the system proxy and exit v2rayN normally. Then check the manual proxy setting under Settings → Network & Internet → Proxy. Once you have confirmed no proxy settings remain, reconnect to the network and restart your computer if needed. Keep your route and log records; do not run commands that delete all routes or reset the network.
If the log specifically says local port 10808 is in use, run the command below in PowerShell to identify the listening process. This port is only an example; replace it with the port shown in the actual error. Confirm which app owns the process before closing it or changing the listening port. Do not force-terminate an unknown service based only on its process ID.
Get-NetTCPConnection -LocalPort 10808 -State Listen |
Select-Object LocalAddress, LocalPort, OwningProcessBefore using TUN regularly, test a browser, command-line tools, the desktop apps you actually use, and LAN devices. Then configure startup behavior if needed. Administrator permissions affect how the app starts, so do not assume it can create a virtual adapter when launched at sign-in without elevation. For more configuration details, see the TUN mode guide. If you only need browser access, the simpler system proxy may be enough.
Download v2rayN for Windows
Choose the installer for your operating system and architecture, then follow the guide to import a subscription and verify your connection.