ClashFX Enhanced Mode (TUN) Setup Guide on macOS

Published on 2026-03-01 · Last updated 2026-11-11

What is Enhanced Mode (TUN)?

In standard operation, ClashFX functions as a local HTTP and SOCKS5 proxy server (typically listening on port 7890). When you select Set as System Proxy, ClashFX adjusts macOS Network Preferences so that standard applications forward their web traffic to this local port.

However, many development tools, command-line utilities, background daemons, and games bypass system proxy settings completely.

Enhanced Mode (TUN) solves this limitation. Powered by the mihomo (Clash Meta) core, Enhanced Mode creates a virtual TUN (network tunnel) device on macOS. All outbound IP packets—TCP, UDP, and ICMP—are intercepted directly at the network layer (Layer 3/4) and evaluated against your routing rules.

Comparison: System Proxy vs. Enhanced Mode

Why Developers & Power Users Need Enhanced Mode

If you work on macOS, you have likely encountered these friction points with standard proxy clients:

1. Terminal Command Line Tools: Tools such as git clone, curl, wget, npm install, and brew update ignore macOS system proxy settings unless you manually export http_proxy and https_proxy environment variables in every shell session.
2. Docker Desktop & Virtual Machines: Containerized builds and package downloads fail when pulling images behind strict regional firewalls.
3. DNS Poisoning & Leakage: Traditional proxies rely on OS resolver queries, which can leak private domain lookups or fail due to poisoned local ISP resolvers.
4. Desktop Applications Without Proxy Settings: Many proprietary desktop tools (such as specific cloud storage clients, gaming launchers, or IDE plugins) lack built-in proxy configuration interfaces.

Enhanced Mode routes all of these workloads cleanly and automatically according to your ClashFX rules.

How to Enable Enhanced Mode in ClashFX

Enabling Enhanced Mode takes just a few clicks:

Step 1: Open the ClashFX Menu

Click the ClashFX icon in your macOS top menu bar.

Step 2: Activate Enhanced Mode

Locate Enhanced Mode in the dropdown menu and click Enable.

Step 3: Authorize Privileged Helper

On the first activation, macOS will present a system authorization prompt:

“ClashFX wants to install a new helper tool to configure network interfaces.”

Enter your macOS administrator username and password (or use Touch ID). ClashFX will install the helper into /Library/PrivilegedHelperTools and configure the TUN device (utun).

Once activated, a checkmark appears next to Enhanced Mode in the menu bar.

How Enhanced Mode Works: Fake-IP & mihomo Core

ClashFX implements the high-performance Fake-IP mapping architecture within the mihomo core:

Application (e.g. curl https://github.com)
  │
  ▼
DNS Query for github.com
  │
  ▼
ClashFX Local DNS Engine (Fake-IP Pool: 198.18.0.0/16)
  │ returns immediately: 198.18.0.23 (Fake IP)
  ▼
Application sends TCP SYN to 198.18.0.23:443
  │
  ▼
macOS Routing Table -> utun interface -> ClashFX mihomo Core
  │
  ▼
Core maps 198.18.0.23 back to 'github.com'
  │ evaluates rules (e.g. Proxy Group: "Global-Auto")
  ▼
Remote Proxy Node resolves real IP and establishes connection

Advantages of Fake-IP:

• Zero Local DNS Latency: Applications receive instant DNS responses from the local pool, eliminating slow upstream DNS resolution round-trips.
• Prevent DNS Leaks: Remote target hostnames are resolved directly by your upstream proxy exit node.
• Accurate Domain-Based Rules: Even if an app only sends IP packets, ClashFX looks up the original hostname in its internal table and matches domain rules (DOMAIN-SUFFIX, GEOSITE).

Troubleshooting Enhanced Mode

Problem 1: No Internet Connection After Turning On TUN

1. Verify that your active proxy node is healthy by running a latency test in the Proxies menu.
2. Open Config → Edit Current Config and inspect the dns section. Ensure enhanced-mode: fake-ip is enabled and upstream nameservers (like 1.1.1.1 and 8.8.8.8) are accessible.
3. Check for conflicting VPN adapters (such as Cisco AnyConnect, WireGuard, or Tailscale). Disconnect third-party VPNs before activating ClashFX Enhanced Mode.

Problem 2: Permission Helper Installation Failed

If the privileged helper fails to install:

1. Ensure your user account possesses macOS Administrator rights.
2. Open Terminal and verify the helper directory permissions:

   ls -ld /Library/PrivilegedHelperTools

3. Restart ClashFX and try enabling Enhanced Mode again.

Next Steps

• Explore how to fine-tune routing rules in the Rule-Providers Guide.
• Learn how to edit DNS and TUN settings using the Built-in Config Editor.
• Read the Clash Meta & Mihomo Overview to understand advanced core capabilities.