Inbound, listeners, and TUN
Clash creates a Packet Tunnel through Apple Network Extension. Apple owns the virtual interface, routes, and lifecycle, so Linux and desktop TUN settings do not map literally to iOS, macOS, and tvOS.
What is supported
- iOS, macOS, and tvOS support Packet Tunnel and TUN configuration. Routine use does not require a virtual-device name or desktop routing parameters.
- Hako installs platform-appropriate routes and may force, repair, or ignore TUN fields that do not apply to Network Extension.
- macOS can expose process name, path, and UID routing metadata. iOS and tvOS cannot.
Three TUN stacks on Apple platforms
On iOS, macOS, and tvOS, Hako supports the gVisor, System, and Mixed TUN stacks across startup, TCP/UDP/DNS traffic, routing, reconnection, cross-stack switching, and clean shutdown.
Mixed runtime state is currently confirmed through configuration readback, switch state, and data-plane behavior; a dedicated runtime stack identifier will follow in a later Core delivery.
Not a default product surface
Local ports, allow-lan, custom listeners, tunnels, server configurations, and external controllers can expose services on the device. Core recognition does not mean a field is appropriate to enable by default. Apple Packet Tunnel also does not provide Linux interface-name, routing-mark, iptables, or TPROXY routing.
83 fields shown
| Field | Type | iOS | macOS | tvOS | Platform notes |
|---|---|---|---|---|---|
allow-lan | bool | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
authentication | []string | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
bind-address | string | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
inbound-mptcp | bool | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
inbound-tfo | bool | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
interface-name | string | Unsupported | Unsupported | Unsupported | Linux-style interface, mark, or iptables routing is unavailable in Apple Packet Tunnel. |
iptables.bypass | []string | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
iptables.dns-redirect | bool | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
iptables.enable | bool | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
iptables.inbound-interface | string | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
lan-allowed-ips | []netip.Prefix | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
lan-disallowed-ips | []netip.Prefix | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
listeners | []map[string]any | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
mixed-port | int | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
port | int | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
redir-port | int | Unsupported | Unsupported | Unsupported | Removed or not consumed in the Apple Packet Tunnel runtime. |
routing-mark | int | Unsupported | Unsupported | Unsupported | Linux-style interface, mark, or iptables routing is unavailable in Apple Packet Tunnel. |
skip-auth-prefixes | []netip.Prefix | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
socks-port | int | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
ss-config | string | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tproxy-port | int | Unsupported | Unsupported | Unsupported | Removed or not consumed in the Apple Packet Tunnel runtime. |
tuic-server.alpn | []string | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tuic-server.authentication-timeout | int | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tuic-server.certificate | string | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tuic-server.congestion-controller | string | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tuic-server.cwnd | int | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tuic-server.enable | bool | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tuic-server.listen | string | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tuic-server.max-idle-time | int | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tuic-server.max-udp-relay-packet-size | int | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tuic-server.private-key | string | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tuic-server.token | []string | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tuic-server.users | map[string]string | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
tun.auto-detect-interface | bool | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.auto-redirect | bool | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
tun.auto-redirect-input-mark | uint32 | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
tun.auto-redirect-iproute2-fallback-rule-index | int | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
tun.auto-redirect-output-mark | uint32 | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
tun.auto-route | bool | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.device | string | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.disable-icmp-forwarding | bool | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.dns-hijack | []string | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.enable | bool | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.endpoint-independent-nat | bool | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.exclude-dst-port | []uint16 | Unsupported | Unsupported | Unsupported | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.exclude-dst-port-range | []string | Unsupported | Unsupported | Unsupported | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.exclude-interface | []string | Unsupported | Unsupported | Unsupported | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.exclude-mac-address | []string | Unsupported | Unsupported | Unsupported | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.exclude-package | []string | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
tun.exclude-src-port | []uint16 | Unsupported | Unsupported | Unsupported | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.exclude-src-port-range | []string | Unsupported | Unsupported | Unsupported | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.exclude-uid | []uint32 | Unsupported | Unsupported | Unsupported | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.exclude-uid-range | []string | Unsupported | Unsupported | Unsupported | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.file-descriptor | int | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.gso | bool | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.gso-max-size | uint32 | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.icmp-timeout | int64 | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.include-android-user | []int | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
tun.include-interface | []string | Unsupported | Unsupported | Unsupported | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.include-mac-address | []string | Unsupported | Unsupported | Unsupported | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.include-package | []string | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
tun.include-uid | []uint32 | Unsupported | Unsupported | Unsupported | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.include-uid-range | []string | Unsupported | Unsupported | Unsupported | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.inet4-route-address | []netip.Prefix | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.inet4-route-exclude-address | []netip.Prefix | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.inet6-address | []netip.Prefix | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.inet6-route-address | []netip.Prefix | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.inet6-route-exclude-address | []netip.Prefix | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.iproute2-rule-index | int | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
tun.iproute2-table-index | int | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
tun.loopback-address | []netip.Addr | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.mtu | uint32 | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.recvmsgx | bool | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.route-address | []netip.Prefix | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.route-address-set | []string | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
tun.route-exclude-address | []netip.Prefix | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.route-exclude-address-set | []string | Not applicable | Not applicable | Not applicable | Belongs to Android, Linux, or another non-Apple environment. |
tun.sendmsgx | bool | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.stack | C.TUNStack | Supported | Supported | Supported | iOS, macOS, and tvOS support gVisor, System, and Mixed. A dedicated Mixed runtime stack identifier will follow in a later Core delivery. |
tun.strict-route | bool | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tun.udp-timeout | int64 | Managed / limited | Managed / limited | Managed / limited | Apple Network Extension owns routes and interfaces; Hako may force or ignore desktop TUN fields. |
tunnels | []LC.Tunnel | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
vmess-config | string | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |