Clash Verge Rev is a widely used Windows GUI for the Mihomo (Clash Meta) core. It pairs a clean desktop experience with powerful rule-based routing, modern proxy protocols, and optional TUN mode for traffic that does not follow system proxy settings. This tutorial is a single, practical path: install the app, import a subscription, turn on system proxy for everyday browsing, then enable TUN when you want editors, terminals, package managers, and stubborn desktop apps to respect the same rules.
What you should know before you start
You will need administrator rights the first time you activate TUN mode, because Windows must allow a virtual network adapter
and elevated routing changes. You will also need a valid configuration source. Most readers use a provider subscription link
that downloads a remote profile in YAML format. Some teams distribute a static .yaml file instead.
Either path works in Clash Verge Rev as long as the document is compatible with the Mihomo feature set your profile expects.
Keep your expectations realistic about speed tests. Latency buttons are helpful for ranking nodes, but they are not a guarantee of throughput on your network at peak hours. A node that pings well might still degrade when streaming or syncing large repos. Prefer stable routes and sane DNS behavior over chasing the smallest millisecond figure on the surface.
1. Install Clash Verge Rev on Windows
Start from our official Clash download page and choose the Windows build you prefer.
Installers are typically published as .exe or .msi. Run the package, accept the license if prompted,
and install to the default location unless your organization requires a custom path. After setup completes, launch the app once
so it can finish initializing local folders for profiles, logs, and runtime data.
If the program fails to start, install the latest Visual C++ runtime prerequisites from Microsoft and reboot. That step resolves a surprising number of silent launch failures on fresh Windows images used for development VMs.
2. Map the interface before you import anything
The left navigation is your compass. Home often surfaces quick toggles such as system proxy and TUN. Proxies lists policy groups and individual servers so you can switch nodes or run batch latency tests. Profiles is where remote subscriptions and local files live. Settings controls language, theme, core behavior, and advanced networking options. Spending sixty seconds here prevents confusion later when a toggle moves between Home and Settings in a newer build.
- Profiles — add, refresh, and edit configuration sources
- Proxies — choose servers and groups defined by your profile rules
- Settings — system proxy, TUN mode, DNS-related options, and startup behavior
- Logs — read connection errors when something breaks after an update
3. Import a subscription URL or local profile
Open Profiles. If your operator gave you an HTTPS link, paste it into the subscription field and confirm import. The client fetches the document, validates it, and renders a profile card with a name derived from metadata or your label. Click the card to make it active. When the handshake succeeds, Proxies populate with the groups your provider publishes. If naming looks cryptic, edit the friendly title so you can recognize it after you add backup profiles later.
- Navigate to Profiles
- Paste the subscription URL that begins with
https://, then confirm import - Wait until parsing completes without errors
- Select the profile card to activate it
- Open Proxies and verify groups appear
.yaml file, use import from file instead of a remote URL.
Keep offline copies in a predictable folder if you reinstall Windows frequently.
Some providers rotate links for security. When a feed suddenly returns HTTP 403 or an empty body, assume the old token expired. Paste the refreshed URL, save, and manually refresh once. Clearing stale profiles you no longer use keeps the sidebar readable and reduces the chance that an outdated file hijacks routing after a reboot.
4. Pick a healthy node inside Proxies
Move to Proxies and locate the outbound group your operator expects you to steer, often named AUTO, Selector, or Proxy. Trigger a latency test if the UI exposes one, then pick a node that balances ping and geographic preference. Remember that tests use small probes; they do not mirror a long YouTube session or a multi-gigabyte cloud sync. If a server misbehaves, switch manually rather than chasing automatic rules you do not understand yet.
5. Enable system proxy for browser-first workflows
Toggle System Proxy on inside Settings or Home, depending on your build. When active, compliant applications read Windows proxy settings and send compatible HTTP traffic through Clash. This is usually enough for Edge, Chrome, and Firefox when they are configured to use system defaults. Confirm by visiting ip.sb or a similar egress checker and verifying that the displayed country aligns with your selected node policy.
System proxy is lightweight and easy to reason about, which makes it a good default for everyday browsing and office tools that honor WinHTTP or WinINET settings. It is not universal. Many console utilities, custom SDKs, and older Win32 programs speak raw TCP without consulting those settings. That gap is exactly why advanced users graduate to TUN mode for a consistent experience.
6. Enable TUN mode when you need full-device interception
TUN mode installs a virtual adapter—often surfaced as something inspired by Mihomo naming—and adjusts routing so traffic is steered through the Clash rule engine before it exits the machine. Compared with patching each tool individually, TUN reduces friction for developers who bounce between Git, Docker pulls, npm installs, SSH sessions, and IDEs throughout the day.
- Open Settings
- Enable the TUN Mode switch
- Approve the UAC prompt so the adapter can attach
- Wait until the indicator shows active status
- Validate with CLI commands such as
curl https://ip.sb
TUN integrates closely with DNS and routing semantics. When something feels half-connected, revisit DNS settings in your profile or the client overrides before blaming the upstream node outright.
If you previously relied on brittle per-app SOCKS injectors or manual environment variables scattered across terminals, TUN mode is the civilized compromise: one ruleset decides direct, reject, or proxy destinations, including UDP where your profile permits. That consistency matters when QUIC, HTTP/3, and mixed stacks blur the boundary between layers.
7. Sanity checks after TUN is on
Launch PowerShell and run a few commands you trust. Compare output with system proxy-only mode to ensure the datapath shifted. If you dual-stack IPv4 and IPv6, watch for asymmetric paths; some configurations disable IPv6 at the tunnel layer while leaving physical adapters unchanged, which surprises newcomers who suddenly see timeouts on AAA records only.
# Example quick check (results depend on your node)
curl.exe -s https://ip.sbInspect Task Manager networking when large downloads spike. Stable throughput with occasional rule misses usually points to DNS, inconsistent profile snippets, or a provider-side congestion event—not a defective GUI. Capture the timeframe in logs if you need to escalate to support staff who speak YAML.
8. Keep subscriptions fresh without micromanaging
Profiles age. Nodes retire, congestion shifts, and providers rebalance clusters. Inside Profiles, use the refresh control on each card when you suspect stale data. For hands-off upkeep, edit the profile metadata and configure an automatic polling interval measured in hours. Twenty-four hours is a conservative default during normal weeks; shorten it temporarily when traveling and relying on flaky hotel Wi‑Fi where your operator rotates addresses aggressively.
When edits fail silently, glance at bandwidth limits on public guest networks before assuming the worst. Captive portals and DNS hijacks mimic proxy failure even though Verge Rev is healthy. Disconnecting VPN-like layers momentarily confirms whether the choke point is upstream.
Practical troubleshooting you will actually hit
No nodes load after importing
Paste the subscription link into the browser address bar without the client middleware. If the download does not resemble YAML, the feed is expired, blocked by policy, or requires headers your operator forgot to mention. Firewall suites that intercept TLS can also break retrieval unless you whitelist the updater executable.
UAC loops or adapters that never attach cleanly
Confirm you are launching a release build that matches your CPU architecture and build channel. Retry as Administrator exclusively for diagnostics, then return to normal least-privilege launches once adapters initialize. If corruption lingers, remove the virtual adapter from Device Manager and let Verge recreate it on the next start.
Browser works but terminals do not
That split almost always means system proxy is on while TUN is off. Enable TUN for parity, or set explicit proxies per shell if organizational policy forbids adapters. Conversely, global corporate VPN stacks may collide with tunnel routes; simplify by pausing one layer temporarily.
Frequently Asked Questions
What is the difference between system proxy and TUN mode?
System proxy flips WinINET-compatible settings applications already respect. TUN adds a layered interface path so stubborn programs and many CLI ecosystems route through Mihomo regardless of their own SOCKS awareness. Combine them thoughtfully; most users toggle system proxy daily and keep TUN for development sessions only.
Why does Windows complain about unfamiliar drivers?
Virtual adapters look like niche hardware to heuristic scanners even when they ship with mainstream clients. Vet your download source rigorously during installation spikes. After that, declining random unsigned helper utilities from unknown forks remains the smartest habit.
What should I do if every latency test fails simultaneously?
Separate local connectivity from upstream health. Ping a known good IP independent of proxies. Inspect whether your profile forbids ICMP, accidentally marks nodes as rejects, or points DNS to unreachable resolvers during bootstrap. Narrow the failure domain before ripping out working rules.
How do I configure automatic subscription updates?
From Profiles, open the contextual menu or edit pane for each feed, toggle auto-update, and choose sane hour spacing. Large enterprises sometimes stagger intervals to reduce burst load on gateways; mimic that courtesy if dozens of workstations share NAT.
One-tool VPN wrappers often prioritize a glossy connect button while hiding brittle MTU quirks, sluggish protocol updates, or inflexible routing that breaks the moment an IDE opens a stray UDP channel. Lightweight SOCKS dashboards can be nimble yet push users toward endless per-app patching. Verge Rev with Mihomo offers a tempered middle ground: granular rules, approachable toggles like system proxy versus TUN, and observable logs without forcing enterprises to abandon disciplined review of their outbound strategy. Choosing an open toolchain that ages with your workloads is less about flashy marketing and more about maintaining transparent control surfaces when networks shift overnight. If policy allows, aligning your clients with supported distribution channels preserves security signals that SmartScreen relies on whenever drivers update. When you're ready for a repeatable Windows baseline, grabbing the installer from our download hub keeps your supply chain coherent.