Updated July 2026 · 6 min read
Bypass LAN and private addresses
A router admin page that will not load and LAN shares that vanish are usually the same story: private addresses being shipped off to a remote exit. Local ranges have to stay local, and TUN mode makes that harder.
Recognising the symptom
The signs are always the same handful: a 192.168 router page spinning forever, network shares gone from the file manager, a network printer that cannot be found, a local development server that will not open in the browser.
Those requests should never leave your own cable, but they get treated as ordinary traffic and handed to a remote node. That node obviously cannot reach the NAS in your living room, so everything times out. Turning the proxy off fixes it instantly, which is the giveaway.
Which ranges have to stay local
Three private blocks are the baseline: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Home routers almost always live in the last one, corporate networks favour the first two, and Docker and virtual machines like the 172 block.
Add loopback 127.0.0.0/8, where local dev servers and the external controller port 9097 both sit, plus the link-local range 169.254.0.0/16 that printers and other hardware fall back to when no address has been handed out.
Do not confuse this with the allow-LAN setting. That one lets other devices use the proxy on this machine, which is the opposite of keeping your own local traffic off the proxy.
Local hostnames need covering too
An address range only catches requests whose IP is already known. What you actually type is nas.local, or whatever name the router handed out, and resolving that name is the step where the lookup can be sent to a remote DNS server.
A public resolver has never heard of a device in your house, so it either returns nothing or redirects you to an unrelated page. Suffixes such as .local and .lan, along with any internal corporate domain, need to be marked direct and resolved locally.
TUN mode raises the stakes
Under a system proxy, anything that ignores proxy settings goes out directly by default, so local access rarely breaks. TUN pulls the whole machine into a virtual adapter, and even a ping to the router takes a detour through the core, which is when the problem surfaces.
The TUN section of the client normally ships with a list of private ranges to leave alone, so check that it is on. It works alongside the direct rules in your rule table rather than instead of them, so configure both. Relying on one of them tends to leave a gap.
What is the project?
Clash Verge Rev is a Tauri-based GUI for Mihomo with profile management, system proxy, TUN mode, rule editing and WebDAV backups.