System proxy, TUN and mixed ports explained

The mixed port is a door on your own machine

The moment the client starts it listens on a local port, commonly 7890. mixed-port means that single port takes both HTTP proxy and SOCKS5 traffic and works out which is which by itself. Older configs that split port and socks-port still work; the mixed port is one less number to remember.

mixed-port: 7890
allow-lan: false

An open door is not traffic. Something has to deliberately send its requests to that address. The commands below show whether the port is listening and whether it reaches the outside; on macOS use lsof -i :7890, on Linux ss -tlnp. A 204 from curl means the chain from port to node is intact.

netstat -ano | findstr 7890
curl -x http://127.0.0.1:7890 https://www.gstatic.com/generate_204 -I

The system proxy is a note left for the OS

That switch does less than people assume: it writes 127.0.0.1:7890 into the operating system proxy settings, and that is all. Windows shows the value under Settings, Network and Internet, Proxy; macOS under System Settings, Network, Details, Proxies. Turning it off erases the line.

• Browsers read it, and Electron apps read it behind Chromium, so those two start working first.
• Command line tools usually ignore it and honour only http_proxy and https_proxy.
• UDP is out of reach. Games, voice calls and the real-time side of some messengers go direct regardless.

TUN plants a virtual adapter in the system

TUN does not ask programs to cooperate. The core creates a virtual adapter and rewrites the routing table so the default exit points at it. Every outbound packet on the machine, UDP included, lands in the rule engine, whether or not the program has any idea what a proxy is.

tun:
  enable: true
  stack: mixed
  auto-route: true
  dns-hijack:
    - any:53

stack is usually system, gvisor or mixed, and switching it is the cheapest thing to try when one app misbehaves under TUN. auto-route is the routing-table step: with it off the adapter exists but nothing flows through it. The price is privilege, so Windows installs a background service and macOS asks for an admin password the first time.

The three side by side

• Reach: the port serves programs that come to it, the system proxy adds those willing to read a setting, TUN takes the machine.
• UDP: only TUN is dependable. SOCKS5 defines UDP relaying, but each application has to implement it and few do.
• Privilege: the first two run as a normal user; TUN needs admin or a helper service, and on a work laptop that toggle is often greyed out.
• Leftovers: the port dies with the process, but the system proxy is a persistent OS setting that survives a force-kill.
• LAN sharing: allow-lan: true lets other devices on the subnet use port 7890 here. Port only, nothing to do with TUN.