diff --git a/nixos/modules/programs/clash-verge.nix b/nixos/modules/programs/clash-verge.nix
index 0128bf6e79ed..1f9d91619516 100644
--- a/nixos/modules/programs/clash-verge.nix
+++ b/nixos/modules/programs/clash-verge.nix
@@ -21,7 +21,15 @@
       defaultText = lib.literalExpression "pkgs.clash-verge-rev";
     };
     serviceMode = lib.mkEnableOption "Service Mode";
-    tunMode = lib.mkEnableOption "Setcap for TUN Mode. DNS settings won't work on this way";
+    tunMode = lib.mkEnableOption "" // {
+      description = ''
+        Whether to set the capabilities required for TUN mode.
+
+        Without these capabilities, Clash Verge's DNS settings will not work in TUN mode.
+
+        When enabled, reverse path filtering will be set to loose instead of strict.
+      '';
+    };
     autoStart = lib.mkEnableOption "Clash Verge auto launch";
     group = lib.mkOption {
       type = lib.types.str;
@@ -59,6 +67,22 @@
         source = "${lib.getExe cfg.package}";
       };
 
+      assertions = [
+        {
+          assertion =
+            cfg.tunMode
+            ->
+              config.networking.firewall.checkReversePath != true
+              && config.networking.firewall.checkReversePath != "strict";
+          message = ''
+            {option}`programs.clash-verge.tunMode` requires {option}`networking.firewall.checkReversePath`
+            to be set to `false` or `"loose"`.
+          '';
+        }
+      ];
+
+      networking.firewall.checkReversePath = lib.mkIf cfg.tunMode (lib.mkDefault "loose");
+
       systemd.services.clash-verge = lib.mkIf cfg.serviceMode {
         enable = true;
         description = "Clash Verge Service Mode";