The previous article documented a reader’s process of configuring TAG on a 2015 Intel MacBook Pro + macOS Mojave 10.14.6.

That attempt ultimately did not succeed.

There are always ways to keep tinkering with an old system, but considering that many network clients now have increasingly high macOS version requirements, I offered two realistic options at the time:

Upgrade macOS, or if you already plan to replace the computer, just buy a new one.

Ultimately, the reader chose the second option.

On September 17, 2026, they contacted me again.

This time, they had switched to a new Lenovo Windows 11 laptop and also prepared a new Xiaomi Android phone as a work device.

So we started over from:

Registration → Purchasing a plan → Windows installation → Network mode troubleshooting → Android installation → System network connection authorization → Actual YouTube playback

and went through the entire process.

This time, it ultimately succeeded.

However, we encountered a few representative issues along the way: Windows TUN mode showed as connected, but some applications couldn’t access the internet; after switching to the system proxy, the browser and YouTube returned to normal; Microsoft Store behaved differently under the system proxy; and when installing a web-downloaded APK on the Xiaomi phone, several layers of security prompts appeared consecutively.

Therefore, I decided to document this entire process as well.

If more readers come to me for TAG in the future, they can follow the steps in this article first. If they get truly stuck on a specific step, they can just send me the specific step and screenshots, without needing remote guidance from step one all over again.

1. Starting from the correct TAG registration portal

This time, we used my TAG Internet invitation registration link.

After entering, you can see the registration and login portals.

That day, we initially encountered a very minor issue that can easily confuse ordinary users:

The URL was entered incorrectly.

After failing to enter the correct user. subdomain, Cloudflare returned:

Error 1034
Edge IP Restricted

Seeing this error page makes it easy to mistakenly assume there is a problem with the computer, the network, or the TAG website itself.

None of those were the case.

The correct user portal domain should be:

user.tagss14.pro

user.tagss14.pro

So if a Cloudflare 1034 error appears right from the start, the first thing to check is:

Whether the URL was entered correctly.

After changing to the correct address, the page opens normally.

2. How to choose a plan

After logging into the backend and entering the store, you can see different plans like Bronze, Silver, and Gold.

The main specifications shown for Bronze that day were:

250 GB / month, plan data resets monthly, up to 10 devices, up to 500 Mbps.

Silver was:

500 GB / month, up to 10 devices, up to 500 Mbps.

Gold provided more data, with a correspondingly higher price.

There was also a lower-priced annual Special plan.

The page showed:

162 CNY / year, 200 GB total data, data does not reset monthly, up to 5 devices.

Based on price alone, it is indeed very cheap.

But you shouldn’t only compare:

“How much it costs per year.”

You should also look at:

“How much total data you can actually use in a year.”

This user had already explicitly mentioned they would use YouTube and also wanted to use it across multiple devices, including a Windows PC, a Xiaomi phone, and other mobile devices.

If you frequently watch videos, a total of 200 GB per year isn’t actually that much.

So the final choice was:

Bronze, 3 months.

3. Why only purchase 3 months for the first time

After selecting Bronze, the page offered:

3 months for 185 CNY, 6 months for 363 CNY, 12 months for 720 CNY.

Buying a longer term averages out to be slightly cheaper.

However, when truly using a network service for the first time, I generally do not recommend purchasing a full year outright just because “the average monthly cost is a bit cheaper.”

A more practical sequence should be:

First confirm that the device runs normally and the routes meet your needs, then consider long-term renewal.

The final purchase this time was for 3 months.

The Alipay checkout page showed:

订单原价：185.00 元
支付手续费：9.25 元
预计需支付：194.25 元

订单原价：185.00 元
支付手续费：9.25 元
预计需支付：194.25 元

After completing the payment, the page showed that the payment was successful and prompted that the subscription plan was being activated.

At this point, the account and plan parts were basically complete.

4. Using TAG’s own client first on Windows

After the purchase was complete, we went to the Windows page in the TAG Help Center.

You can see multiple client options, including the dedicated TAG Windows client, FlClash, Clash Verge Rev, etc.

The previous article on the old Mac already demonstrated:

For ordinary users, the more complex the client choice, the higher the subsequent troubleshooting cost usually is.

So this time, instead of having the user configure a Clash subscription right from the start, we prioritized trying:

The dedicated TAG Windows client.

The benefit is that it doesn’t require ordinary users to first understand concepts like subscription addresses, YAML, Profiles, rule sets, and node updates.

You can use it simply by logging into your TAG account.

The Windows client version that day was:

1.0.18.13

1.0.18.13

The installer size was approximately:

24.6 MB

24.6 MB

5. Edge warns “File not commonly downloaded”

After downloading the installer from the TAG help page, Microsoft Edge displayed a security warning.

The gist was:

File not commonly downloaded. Make sure you trust the file before opening it.

This type of warning does not mean:

Windows has confirmed this file is malware.

It may simply be because the file has a low download volume, SmartScreen hasn’t accumulated enough reputation data, or the publisher lacks common software signing.

Because we confirmed this time that:

The file came from the current TAG help page, the filename and version matched, and it was the installer we had just actively downloaded.

It was safe to keep it.

However, the prerequisite here is always:

Confirm the source first.

You shouldn’t just ignore all browser security warnings in the future simply because this article chose to proceed with the installation.

6. Windows may continue to show security alerts

After running the installer, Windows might display another similar alert:

Windows protected your PC

Or Microsoft Defender SmartScreen couldn’t confirm this app.

If you have confirmed it is still the installer just downloaded from the TAG help page, you can continue running it.

There is no need to:

Disable Windows Defender, permanently turn off SmartScreen, or directly shut down the Windows Security Center.

You only need to handle this specific installer whose source has been confirmed.

7. Windows firewall prompt after installation is complete

The TAG installation process itself is fairly simple; you can basically just proceed with the default steps.

After installation is complete, you can choose to keep TAG running and create a desktop shortcut.

Subsequently, Windows will also show a firewall permission prompt.

The network component mihomo-tag.exe used by TAG later may also individually trigger a similar network access prompt.

There is also no need to resolve this by:

“Completely turning off the Windows firewall”

Simply allowing the program to use the network in the current trusted network environment is sufficient.

8. Windows client successfully recognizes the plan

After opening the TAG Windows client, you can directly see:

Current plan, remaining time, data used, number of nodes, number of regions, TUN mode, and system proxy information.

The page displayed roughly that day:

91 days remaining, 250 GB plan, 307 nodes, 211 countries or regions.

From the interface, this method is indeed much simpler for ordinary users than importing a Profile themselves.

You can just select the fastest server or a specific region.

However, the truly troublesome issues of the day also started appearing from here.

9. First connection: interface shows success, but actual internet access is abnormal

Initially, we used the TUN mode in the TAG client.

After selecting a Taiwan node, the client page showed:

Connected.

For example, the one used that day was:

TW 台湾 02

TW 台湾 02

From TAG’s own interface, everything seemed normal.

But when actually opening YouTube, a connection timeout occurred.

This easily confuses ordinary users:

The software clearly shows “Connected”, so why can’t the actual web pages open?

This also shows that to determine whether a network service is truly usable, you can’t just look at the word “Connected” in the client.

10. First use Fast.com to confirm the actual line status

During troubleshooting, we also ran an actual speed test via Fast.com.

The results that day were approximately:

下载：170 Mbps
上传：69 Mbps
空闲延迟：104 ms
负载延迟：329 ms

下载：170 Mbps
上传：69 Mbps
空闲延迟：104 ms
负载延迟：329 ms

The user’s local connection uses telecom broadband.

This speed is completely sufficient for YouTube, ordinary web pages, social apps, and daily online videos.

However, it must be emphasized here:

170 Mbps only represents the actual situation of that specific connection on that day, and should not be understood as TAG being able to achieve this speed in any region, at any time, and on any node.

Actual speed is affected by many factors, including the local ISP, local broadband, Wi-Fi, current node, international exit, time of use, and speed test server.

So speed test data is only suitable as a one-time reference for the environment at that time.

11. Client shows connected, but YouTube still times out

The real problem was that although the client showed a successful connection, the browser still encountered the following when accessing YouTube:

ERR_CONNECTION_TIMED_OUT

If it were just occasional line fluctuation, then:

Disconnect → Reconnect

could certainly be attempted.

But we confirmed multiple times that day:

TAG can show connected, but YouTube still cannot be accessed normally, and the network performance of different apps is not exactly the same.

At this point, there was no need to mechanically repeat:

“Try connecting one more time.”

What was more worth checking was:

Whether the current network takeover method is suitable for this computer.

12. Turn off TUN, switch to system proxy

There are two relatively key switches in the bottom left corner of the TAG Windows client:

TUN mode and system proxy.

It was later adjusted to:

TUN：关闭
系统代理：开启

TUN：关闭
系统代理：开启

After reconnecting, we opened YouTube again.

This time, it returned to normal.

The YouTube page could load normally, and videos could be played.

This indicates:

The node itself was not broken.

The real problem that day was closer to:

A compatibility issue between this Windows environment and the client’s TUN working method.

So in the end, we didn’t keep struggling with TUN, but simply kept using the system proxy.

13. Why we didn’t continue researching TUN

If it were my own development machine, I might have continued analyzing:

TUN adapter, DNS, IPv4 / IPv6, routing table, Windows Filtering Platform, firewall, network card driver, and mihomo logs.

But what ordinary users really care about is:

“Can YouTube open normally?”

Not:

“Why is this computer’s virtual network environment different from another computer?”

Since switching to the system proxy already met the main needs, continuing to invest a lot of time into researching TUN had little practical value.

This point is actually very similar to the handling logic for the old Mac in the previous article:

Just because it can be technically researched further doesn’t mean it’s worth researching further in practice.

14. A single speed test already used a lot of data

When configuring the Android client later that day, the account showed that about:

948 MB

had been used. And prior to this, the main things done were just:

Windows network testing, opening some web pages, playing YouTube, and running Fast.com once.

Fast.com likely contributed a significant portion of the data.

Because the principle of bandwidth speed testing is inherently:

To continuously transfer data as much as possible, pushing the line to a high load.

So there is no need to run speed tests multiple times in the future just to confirm “exactly how fast it is”.

If you are using a data-capped plan, a more practically meaningful test is actually:

Whether YouTube opens normally, whether video playback is smooth, and whether the software you truly need can be used.

These are more valuable than mere numbers.

15. Different Windows apps behave differently under the system proxy

After switching to the system proxy:

Edge was normal, YouTube was normal, and Fast.com was also normal.

But another phenomenon was discovered that day:

Microsoft Store stayed on the loading screen for a long time.

This is actually not particularly strange.

The network implementations of different apps in Windows are not exactly the same.

So it cannot be simply understood as:

“If the browser can open, it means all Windows apps must connect to the network in the exact same way.”

For ordinary users, there is no need to dig deep into the underlying system for this issue.

If you only need Microsoft Store temporarily, the simplest method is actually:

Disconnect TAG first, then open Microsoft Store.

After you are done using the store, you can reconnect.

16. The final usage method retained on Windows

The final configuration adopted for this new computer that day was:

TUN：关闭
系统代理：开启

TUN：关闭
系统代理：开启

When you need to use TAG daily:

Open TAG → Connect.

When not in use:

Disconnect.

If future client upgrades improve the relevant compatibility issues, you can also retest TUN.

There is no need to interpret today’s settings for this computer as:

“All Windows computers should turn off TUN.”

This is just:

The more stable option for this computer after actual testing that day.

17. Next, configuring the new Xiaomi Android work phone

After the Windows side was basically handled, we continued configuring the newly purchased Xiaomi phone.

This phone will mainly serve as a:

Work device.

Entering TAG:

Help → Android

You can see the dedicated Android client.

The client version that day was:

1.0.18

1.0.18

Installer size:

72.2 MB

72.2 MB

The page also provides both mainland network drive and direct link downloads.

This time, we directly used the direct link.

18. Xiaomi’s first security prompt when installing a web APK

When downloading the APK, the Xiaomi system adds quite a few security checks.

First, you need to allow:

The browser to install apps.

Since we confirmed this time that:

The APK came from the TAG help page, the version matched the page, and it was a file we had just actively downloaded.

We could temporarily allow the browser to complete this installation.

I did not recommend selecting:

Remember my choice

Because there is no need to grant all APKs downloaded by the browser in the future the same installation permissions automatically.

19. Xiaomi prompts “No ICP filing information found”

After continuing the installation, another prompt appeared:

No ICP filing information found for this app.

It also prompted:

This app may be an overseas app, a standalone app, or has not completed ICP filing procedures.

It is easy for ordinary users to interpret this as:

“The system detected a virus in this software.”

In reality, these are two completely different concepts.

No ICP filing information found does not mean malware was detected.

It is more stating that:

The current installation check did not find corresponding filing information.

Given that the source of the installer has been confirmed, you can proceed to the next step.

20. “Not reviewed by Xiaomi Security” appears again

While continuing the installation, the Xiaomi app installer will prompt again:

This app has not been reviewed by Xiaomi Security.

The reason to continue installing here is still not:

“These kinds of warnings can be ignored.”

Rather, it is:

We have confirmed the source of this APK.

This point is very important.

Do not interpret this article as:

Randomly downloading an APK from the web and just clicking “Continue installation” is fine.

For web-downloaded APKs, source confirmation should always come first.

21. After installation, no need to grant all sensitive permissions

After installation is complete, Xiaomi may also prompt:

Sensitive permissions denied for this app.

When ordinary users see “permissions denied”, it is easy to mistakenly assume they must enter system settings and open up all permissions.

In reality, there is no need.

Network clients generally do not need access to:

Contacts, text messages, call logs, photo albums, and other information unrelated to network connections.

A more appropriate principle is:

Only allow what is actually used.

There is no need to grant all sensitive permissions at once just to ensure the software “definitely runs”.

22. Android client automatically syncs the plan

After opening the TAG Android client, the account plan had automatically synced.

The page showed that day:

250 GB plan, about 249 GB remaining, 91 days remaining, 211 countries or regions, 307 nodes.

No additional configuration is basically needed here.

Just click:

Quick Connect

and that’s it.

23. The first Android connection requires allowing system network access

After clicking Quick Connect for the first time, Android will pop up a system-level network connection prompt.

Click here:

OK

and that’s it.

This is the network connection mechanism provided by the Android system. The client needs to obtain this permission before it can take over the network traffic that needs to be transmitted through TAG.

After a successful connection, a small key or network connection status icon may appear at the top of the phone.

This is normal.

24. No more speed tests on the phone, just open YouTube directly

After the Android connection was successful, we did not run Fast.com again this time.

Because the Windows side had already experienced:

Bandwidth speed tests themselves can consume a lot of data.

So the phone directly opened:

YouTube

to play a video.

The video could load and play normally.

At this point, the Android side was considered truly configured.

25. Android was actually simpler than Windows

After comparing the actual processes on both sides, the Android side was actually noticeably simpler this time.

Windows required considering:

Client → Firewall → TUN → System proxy → Network access methods of different apps.

Android was basically just:

Download APK → Install → Login → Quick Connect → Allow system network connection.

Then it was ready to use.

So for ordinary users unfamiliar with network technology:

The phone side is not necessarily more complex than the computer side.

26. WhatsApp, Telegram, and Instagram don’t need to be fully configured in one day

That day, they also wanted to use:

WhatsApp, Telegram, Instagram, YouTube.

The WhatsApp client on Windows was already able to reach the linked device login page.

Initially, the QR code area loaded slowly, so we later tried switching to:

Link with phone number.

Only then did we further confirm that:

The current WhatsApp main account was actually already logged in on an iPhone.

The new Xiaomi phone was primarily intended for use as a work device.

So we didn’t keep pushing to “get all software fully configured today”.

This approach is actually more reasonable.

Because:

The truly critical network environment has already been resolved.

As for whether the Xiaomi phone will use the existing WhatsApp account, act as a linked device, use a new work number, or install WhatsApp Business in the future, all of that can be decided when there is an actual need.

27. What ordinary users really need to remember is actually very little

After all the previous troubleshooting, the actual daily operation is very simple.

This Windows computer currently maintains:

TUN：关闭
系统代理：开启

TUN：关闭
系统代理：开启

When you need to use it:

Open TAG → Connect.

When not in use:

Disconnect.

If Microsoft Store or a certain Windows system app behaves abnormally, you can disconnect TAG first and then test again.

The Xiaomi Android is even simpler:

Open TAG → Quick Connect.

When not in use:

Disconnect.

The appearance of a system network connection icon at the top is a normal phenomenon.

28. Do not run multiple similar network clients at the same time

If you install in the future on your computer or phone:

Clash Verge Rev, FlClash, v2rayN, Shadowsocks, or other similar network clients,

it is best not to run several of them at the same time.

Because they may simultaneously modify:

System proxy, TUN, DNS, routing.

This easily leads to a very typical situation:

Every client shows itself running normally, but the actual network is completely abnormal.

Just use one at a time daily.

29. If it still won’t open, don’t just say “it doesn’t work”

During this manual assistance process, a rather obvious problem was:

“It seems to not work.”

This phrase actually provides very little troubleshooting information.

“Doesn’t work” could respectively mean:

The client won’t open, the client opens but can’t connect, it shows connected but the browser won’t open, the browser is normal but a certain app won’t open, or one app is normal while another is abnormal.

So if you still encounter problems after following this article, it is best to provide the key information all at once completely.

For the Windows side, it is recommended to state:

Windows version, TAG client version, whether TUN is enabled, whether system proxy is enabled, current node, which specific app cannot be accessed, and a screenshot of the error page.

For the Android side, it is recommended to state:

Phone model, Android / HyperOS version, TAG client version, whether system network connection has been allowed, whether TAG shows connected, which app won’t open, and the corresponding error screenshot.

This is usually much more efficient than a single sentence like:

“Why won’t it still open?”

It is much more efficient.

30. If you are also planning to use TAG

If your own devices and system versions meet the requirements, you can create an account through the TAG Internet registration portal, and then choose a plan based on your actual data needs.

For first-time use, I still recommend:

Test it short-term first; don’t just buy a very long period the first time because the average annual price is low.

At least first confirm that:

The computer client can run, the phone client can be installed, the line quality in your region is acceptable, and the main websites and software can be used normally.

After confirming these, then consider whether to renew long-term.

If you are using an old Mac, it is especially recommended to read the previous article in this series first.

Because the place where the previous article got truly stuck wasn’t even a line issue, but rather:

Operating system and client compatibility.

31. Compared to the previous article, it was finally resolved this time

The final result for the old Mac in the previous article was:

It was not truly resolved successfully.

In the end, the only choice was between:

Upgrading macOS, or buying a new computer

The reader ultimately chose a new computer.

And this time:

The Windows side succeeded.

Although a compatibility issue occurred with TUN mode, after switching to the system proxy, YouTube could be used normally.

The new Xiaomi Android phone:

Also succeeded.

Installation, system network connection authorization, and actual YouTube playback were all completed.

So putting these two articles together actually illustrates one point well:

The same network service can have completely different experiences across different operating systems, system versions, and client environments.

The problem in the previous article mainly occurred in:

Client compatibility.

The problem encountered with Windows in this article mainly occurred in:

Network takeover method.

Android ended up being the smoothest.

This is also why I don’t really like using a simple sentence like:

“Is this node good to use?”

to evaluate the entire network service.

The real experience is far more complex than a single speed test number.

Finally

This time, from purchasing the plan to fully configuring Windows and Android, actually took quite a bit of time.

However, the entire process basically covered the issues that ordinary users are more likely to encounter:

Registration portal, plan selection, payment, Windows client, Edge download warning, SmartScreen, Windows firewall, TUN, system proxy, YouTube, Microsoft Store, Android APK, Xiaomi security prompts, ICP prompt, Android system network connection authorization, and actual YouTube playback.

So I decided to document the entire process as completely as possible.

If more readers come to me for TAG in the future, they can follow this article from the beginning first.

If they get truly stuck, they can just send me:

Which step they are stuck on + screenshots at the time

and that will be it.

This is much more efficient than starting from step one and guiding remotely screenshot by screenshot and sentence by sentence on WeChat.