Environment
- macOS: [your macOS version]
- Clash app: Clash - Rule based proxy utility
- App version: [version]
- Architecture: Apple Silicon
- TUN: Enabled
- Mode: Rule
- DNS:
dns.enable: false (using system DNS)
Problem
When the Clash app is connected with TUN enabled, I cannot access my LAN gateway at 192.168.1.1.
However, Internet access works normally through the proxy.
If I disable the Clash app and use another Clash client (Clash Verge) with essentially the same configuration, 192.168.1.1 is accessible normally.
Existing rules
My configuration already contains the standard private-network rules:
- GEOSITE,private,🎯 全球直连
- GEOIP,private,🎯 全球直连,no-resolve
Therefore 192.168.1.1 should match the private / GEOIP,private rule and use DIRECT.
I don't think an additional IP-CIDR,192.168.1.0/24,DIRECT rule should be necessary.
Expected behavior
Private LAN addresses such as 192.168.1.1 should remain directly accessible while TUN is enabled.
Actual behavior
192.168.1.1 becomes unreachable while the Clash app is connected.
Public Internet traffic continues to work normally.
Comparison
- Clash - Rule based proxy utility + TUN →
192.168.1.1 not accessible
- Clash Verge + same/similar configuration →
192.168.1.1 accessible
- Clash app disconnected →
192.168.1.1 accessible
This makes me suspect that the issue may be related to the macOS NetworkExtension/TUN routing or LAN bypass implementation rather than the Mihomo rule configuration.
Environment
dns.enable: false(using system DNS)Problem
When the Clash app is connected with TUN enabled, I cannot access my LAN gateway at
192.168.1.1.However, Internet access works normally through the proxy.
If I disable the Clash app and use another Clash client (Clash Verge) with essentially the same configuration,
192.168.1.1is accessible normally.Existing rules
My configuration already contains the standard private-network rules:
Therefore
192.168.1.1should match theprivate/GEOIP,privaterule and use DIRECT.I don't think an additional
IP-CIDR,192.168.1.0/24,DIRECTrule should be necessary.Expected behavior
Private LAN addresses such as
192.168.1.1should remain directly accessible while TUN is enabled.Actual behavior
192.168.1.1becomes unreachable while the Clash app is connected.Public Internet traffic continues to work normally.
Comparison
192.168.1.1not accessible192.168.1.1accessible192.168.1.1accessibleThis makes me suspect that the issue may be related to the macOS NetworkExtension/TUN routing or LAN bypass implementation rather than the Mihomo rule configuration.