Clash mixed-port and allow-lan: Share a Proxy with Devices on Your Local Network

1. Choose a sharing method: connect devices to your computer’s proxy

The simplest option is to run Clash or a Clash Meta (mihomo)-based client on your computer and enable LAN access. Connect your phone and computer to the same home network, then enter your computer’s LAN IPv4 address and mixed port in the phone’s Wi-Fi proxy settings. Keep the computer on and the client running. Apps on your phone that support proxies can then send traffic through the computer’s core, which forwards it according to the rules and policy groups currently in use.

This guide uses 192.168.50.10 for the computer’s address, 192.168.50.0/24 for the home subnet, and 7890 for the mixed port. These are examples; replace them with the details of your actual network. Don’t enter 127.0.0.1 on your phone: that address always points to the phone itself, not the computer.

1. First, confirm that your subscription is enabled on the computer, the policy groups have a working node selected, and the computer’s browser can reach the sites you need.
2. Make sure your phone and computer aren’t on a guest network and that wireless client isolation is disabled. Being connected to Wi-Fi with the same network name doesn’t necessarily mean devices can communicate with each other.
3. Note the address of the network adapter your computer is using. A wired computer and a phone on Wi-Fi can share a proxy, as long as the router allows them to communicate.

2. What mixed-port, allow-lan, and the bind address control

A mixed port combines the HTTP and SOCKS5 proxy entry points on a single port. The core identifies the protocol from the connection handshake. It doesn’t convert every network protocol to HTTP or map a port on your router. Enter 7890 when configuring an HTTP proxy on your phone. Apps that support SOCKS5 can also connect to that port, but you must select the correct proxy type in the app.

allow-lan: true is only one of the settings needed to allow LAN access. If the actual listener is still bound to 127.0.0.1, or your system firewall blocks inbound connections, your phone still won’t be able to connect. Conversely, binding to all interfaces doesn’t make it safe to expose the port. You must also restrict access at the network boundary.

Traditionally, port is the HTTP proxy port and socks-port is a separate SOCKS port. If you’re already using a mixed port, there’s no need to open both additional listeners just to share the proxy. If multiple settings try to use the same port and you get an address-in-use error, remove the duplicate listener or assign different ports to each listener.

3. Update the active configuration and verify the port is listening

Save the configuration, then edit the top-level fields

Back up your existing configuration first. If your GUI client has an “Allow LAN” switch under Settings, you can use it; menu paths and labels vary between clients. The important thing is to verify the final running configuration, not just the switch. If the client manages your subscription, use its overrides, merge settings, or persistent configuration options so an update won’t overwrite your changes.

Add the following top-level fields to your existing configuration; this is not a complete subscription. Keep your existing nodes, policy groups, rules, and DNS settings. YAML uses spaces for indentation, not tabs. Don’t define mixed-port twice at the same level.

mixed-port: 7890
allow-lan: true
bind-address: '192.168.50.10'
mode: rule

Binding to a specific LAN address narrows the listener’s scope, but the address must actually belong to your computer. Reserve a fixed DHCP lease for the computer in your router settings; otherwise, the address may change and prevent the listener from starting. If you need to keep the computer’s existing loopback proxy listener, consider using bind-address: '*' and carefully restrict the source addresses with your firewall. After making the change, test that the local proxy still works.

Check the listener after reloading

Save the changes and reload the configuration using your client’s recommended method. If the listener settings haven’t updated, restart the core. On Windows, check for a TCP listener in PowerShell; on macOS and Linux, use the corresponding system tools:

# Windows PowerShell
Get-NetTCPConnection -LocalPort 7890 -State Listen

# macOS
lsof -nP -iTCP:7890 -sTCP:LISTEN

# Linux
ss -lntp 'sport = :7890'

You should see the computer’s LAN address or a wildcard listener, not just 127.0.0.1:7890. If there’s no output, check the core logs for a port conflict, an unavailable address, or a configuration parsing error. Some systems show process details only to administrators. If needed, check with administrator privileges instead of disabling the firewall to troubleshoot.

4. Allow firewall access only from trusted local networks

HTTP proxies and HTTPS CONNECT tunnels first require a TCP connection. For phone web browsing, start by allowing TCP 7890; there’s no need to open UDP. SOCKS5 UDP forwarding also depends on client support for UDP ASSOCIATE, core capabilities, and the actual proxy route. Enabling the mixed port alone doesn’t mean UDP gaming traffic will work.

Windows: Restrict the network profile and source subnet

Go to Settings → Network & Internet and open the properties for your current connection. Set the network profile to Private only on a trusted home network. Then add the following rule in an elevated PowerShell window. Replace the local address and remote subnet in the example with your actual network details:

New-NetFirewallRule `
  -DisplayName "Clash LAN TCP 7890" `
  -Direction Inbound `
  -Action Allow `
  -Protocol TCP `
  -LocalPort 7890 `
  -LocalAddress 192.168.50.10 `
  -RemoteAddress 192.168.50.0/24 `
  -Profile Private

Security software may also have its own firewall rules. If the system firewall allows the connection but it still times out, check your security software’s network protection logs. Don’t replace troubleshooting with a broad rule that allows all ports, sources, and networks. When you’re done sharing, remove the rule created for this guide:

Remove-NetFirewallRule -DisplayName "Clash LAN TCP 7890"

macOS and Linux: Identify the process actually listening

On macOS, check the app’s incoming connection permissions under System Settings → Network → Firewall → Options. On older systems, look under Security & Privacy. The proxy listener may belong to a separate core process, so check the listener output and system prompts instead of allowing only the client’s GUI.

On Linux with UFW, you can add a rule for the source subnet. If you don’t use UFW, use the firewall tool your system actually manages. Don’t start a second firewall manager just to copy these commands.

sudo ufw allow from 192.168.50.0/24 to 192.168.50.10 port 7890 proto tcp

5. Configure phones, TVs, and consoles

iPhone and iPad: Set an HTTP proxy for the current Wi-Fi network

1. Open Settings → Wi-Fi, then tap the info button next to your current network.
2. Tap Configure Proxy and select Manual. Enter 192.168.50.10 as the server and 7890 as the port.
3. If the core requires a username and password, turn on Authentication and enter the credentials. Save the settings, then reopen your browser to test the connection.

Enter only the IP address in the Server field; don’t enter http://192.168.50.10:7890. This setting applies to the current Wi-Fi network. It won’t automatically apply to cellular data and isn’t a system-wide VPN. For HTTPS sites, a standard HTTP proxy uses CONNECT to establish a tunnel; you don’t need to install a root certificate. If you see a certificate warning, first check the system time, the site’s certificate, and your network.

Android: Change the proxy settings for a connected network

A common path is Settings → Network & internet → Internet → current Wi-Fi network → Edit → Advanced options → Proxy → Manual. Some manufacturers put this option on the network details page instead. Enter 192.168.50.10 for the proxy hostname and 7890 for the proxy port. When testing sharing, leave the bypass list empty so your destination domains aren’t excluded.

Some Android Wi-Fi proxy screens don’t have fields for a username and password, so you can’t use an authenticated configuration as-is. Instead, use an app-level proxy setting that supports authentication, or assess your options on a trusted, isolated home network with strict firewall rules. Changing this setting won’t force apps that ignore the system HTTP proxy to use it.

TVs and consoles: Check whether the device offers a proxy setting

If your TV’s browser or network settings offer an HTTP proxy, enter the same address and port. For a media player that supports SOCKS5, select SOCKS5 in the app. A console’s HTTP proxy setting usually affects only some system services or downloads; don’t assume it will also change online multiplayer, voice chat, or NAT type.

Routing all TCP and UDP traffic from a device through a proxy usually requires a transparent proxy on the router or a carefully designed gateway. That involves forwarding, routing, DNS, and the return path. Changing the console’s gateway to your computer’s IP or simply enabling TUN on the computer isn’t a complete solution. If you’re not familiar with networking, stick to explicit proxy settings in supported apps.

6. Use connection logs to distinguish port, authentication, and rule issues

Change one variable at a time during testing: keep the computer’s rule mode and node unchanged, test the port from another device, then test a proxy request, and finally check the core’s connection logs. The domains in the commands below are for connectivity testing only. A site loading doesn’t prove the request went through a proxy node; check which rule it actually matched.

# Check TCP connectivity from another Windows device
Test-NetConnection 192.168.50.10 -Port 7890

# Test the HTTP proxy; call curl.exe explicitly in Windows PowerShell
curl --proxy http://192.168.50.10:7890 --connect-timeout 5 -I https://example.com/

# Test SOCKS5 with the proxy resolving the destination hostname
curl --proxy socks5h://192.168.50.10:7890 --connect-timeout 5 -I https://example.com/

Seeing 200 Connection established in an HTTP test means only that the proxy accepted the CONNECT request. Check whether the subsequent TLS handshake and destination response succeed. Filter the connection panel by your phone’s source address and confirm the destination domain, matched rule, and final outbound route. Shared requests still follow the computer’s rule mode. If a request matches DIRECT, a direct connection is expected; it doesn’t mean LAN sharing has failed.

Consider DNS based on the app’s connection path: an HTTP proxy usually receives the destination hostname; socks5h explicitly has the proxy resolve the destination, while common uses of socks5 may resolve it on the requesting device first. A manual Wi-Fi proxy doesn’t redirect all of your phone’s DNS queries to the computer. Don’t point your phone’s DNS at the computer just for this example unless you’ve separately configured and verified DNS listening and the corresponding firewall rules.

7. Final checklist: authentication, sleep, and stopping sharing

Even on a trusted network, use a separate account for devices that support authentication. HTTP and SOCKS authentication don’t encrypt the connection across your LAN, and you shouldn’t reuse passwords from important services. The values below are examples of the syntax only. Replace them with unique, randomly generated credentials before use, and make sure your devices support authentication:

authentication:
  - "lan-device:ChangeThisLocalPass7890"

• Check authentication bypass settings: If your configuration contains skip-auth-prefixes, make sure it doesn’t exclude the entire shared subnet. Don’t assume authentication is enabled just because you entered a username and password.
• Keep the address stable: Reserve a DHCP lease for the computer. After changing routers, switching networks, or reconnecting, check the address and firewall scope again.
• Account for sleep: If the computer sleeps, its lid is closed, or the core exits, phones still pointed at its proxy may lose internet access. Check the computer first instead of immediately resetting your phone’s network settings.
• Stop sharing: On your phone, set Configure Proxy to Off; on Android, set Proxy to None. Then disable LAN access in the client and remove the dedicated firewall rule.

After setup, you should be able to answer three questions: Which device is listening? Which sources can connect? Which rule handles requests after they enter the core? Troubleshooting these layers separately means mixed-port sharing doesn’t require repeatedly switching to Global mode, reinstalling the client, or disabling the entire firewall. For more core and routing settings, see Advanced Setup. If you’re importing a subscription for the first time, start with the Getting Started guide.