Updated July 2026 · 6 min read
Route selected apps through proxy
Sending one game or one download tool through the proxy while everything else stays direct is done with process-name rules. There is one hard requirement: only TUN mode exposes which process opened a connection.
Why TUN is not optional here
Matching by process assumes the core knows who opened the connection. Under a system proxy the application hands the request over itself, and all the core sees is a connection from the local machine, with no process to look up.
TUN mode takes over the network stack of the whole machine, so the core can trace a connection back to the process behind it, which is what gives PROCESS-NAME something to compare. On Windows you also need service mode installed, since TUN depends on it for privileges.
Do not guess the process name
Turn TUN on, make the target application do something on the network, then find that connection on the Connections page. The row prints the process name outright, which beats guessing from filenames in the install folder.
Plenty of programs do not connect from the icon you clicked. Browsers run a separate network process, apps with auto-update run a second executable, and game platforms often split login and downloading across two processes, so naming only the main one misses half the traffic.
The rule matches a name, not an identity. Two executables sharing a filename both match, so use PROCESS-PATH with the full path when you need to tell them apart.
Syntax and platform differences
The rule is three fields: PROCESS-NAME, the process name, and the policy, and it lives in the same table as your domain rules. On Windows the name carries its extension, as in example.exe. On macOS and Linux you write the bare executable name.
Copy the capitalisation exactly as the Connections page shows it rather than tidying it up yourself. To separate two programs with the same filename by install location, switch to PROCESS-PATH, at the cost of the rule breaking the moment the software moves.
Keeping an application off the proxy
Same syntax, policy set to DIRECT. Local backup tools, a corporate VPN client, bulk file sync: anything that neither needs nor should use the proxy is a good candidate for being pulled out this way.
When testing, quit the target application completely and start it again instead of just closing the window. A process still sitting in the tray keeps its old connections, so what you observe is not the result of the new rule.
What is the project?
Clash Verge Rev is a Tauri-based GUI for Mihomo with profile management, system proxy, TUN mode, rule editing and WebDAV backups.