Clash Mixed Port and Allow LAN: Share Your Proxy with Devices on the Same Network

1. When to Use It: Let LAN Devices Connect to Your Computer’s Proxy

If installing a proxy client on a phone, tablet, or TV isn’t practical, you can use a computer on the same local network as an HTTP proxy. Run Clash or a client powered by the mihomo core on the computer, then enter the computer’s IP address and mixed port in the other device’s Wi-Fi settings. Traffic reaching the computer is handled according to its active configuration, rules, and proxy groups, which determine whether it goes direct or through a proxy.

This does not automatically turn your computer into a router. Enabling “Allow LAN” lets other devices access the proxy’s listening port; it does not change a phone’s gateway or make every app use the proxy automatically. For full-device routing, UDP forwarding, or apps that ignore the system proxy, consider a client on the device, a gateway solution, or TUN instead of repeatedly toggling this setting.

• Good for: Phone browsers, tablet browsing, and TV apps on a home network that support manual HTTP proxy settings.
• Requirements: The computer and device must be able to reach each other, the computer must stay on, and the proxy core must be running properly.
• Not a drop-in solution for: Hotel or guest Wi-Fi, public networks with client isolation, or setups that need to route all game traffic.

2. What Each Setting Does: mixed-port, allow-lan, and bind-address

The “mixed” in mixed-port refers to the proxy protocols accepted on that port, not to combining multiple proxy nodes. You can also enter this port as the HTTP proxy port in a phone’s Wi-Fi settings. HTTPS sites usually use HTTP CONNECT to establish a tunnel, so you don’t need to enter a separate “HTTPS port.”

Check allow-lan: true together with the listening address. 127.0.0.1, which allows access only from the same device, won’t work as the phone’s destination; on the phone, 127.0.0.1 points back to the phone itself. bind-address: "*" usually listens on every interface, but exposes the service more broadly. For sharing on a home network, bind to the computer’s current local IPv4 address and restrict access with the firewall.

The external-controller management interface is separate from the mixed port. Your phone doesn’t need to connect to the controller to use the proxy, and there’s no need to expose the management port to the entire network. Don’t enter the dashboard address or a common management port such as 9090 in the Wi-Fi proxy port field.

3. Set Up the Computer: Find Its Address, Then Enable Listening

1. Find the Local IPv4 Address in Use

On Windows, open a terminal and run ipconfig. Find the active “Wireless LAN adapter Wi-Fi” or Ethernet adapter. Note its IPv4 address, subnet mask, and default gateway; ignore disconnected adapters, virtual machine adapters, and TUN adapters. On macOS, go to System Settings → Network → your current connection → Details → TCP/IP.

For example, the computer might be 192.168.1.10 and the phone 192.168.1.25, both with the subnet mask 255.255.255.0. They’re usually on the same subnet, though router guest isolation may still block them from communicating. A wired computer can share its proxy with a phone on Wi-Fi; they don’t need to use the same wireless band as long as the router allows them to reach each other.

2. Set the Mixed Port and Allow LAN

In the client settings, look for “Mixed Port” and note its current value, then enable “Allow LAN.” Menu labels vary between clients; some place these options under core or override settings. Check the final active configuration and actual listening state rather than relying only on fields in the subscription file.

The following network settings can be merged into the top level of an existing configuration; they are not a complete subscription. Keep your existing proxies, proxy-groups, and rules. Don’t replace the entire file with this snippet or declare the same top-level fields more than once.

mixed-port: 7890
allow-lan: true
bind-address: "192.168.1.10"
mode: rule

Save and apply the configuration. If the client asks you to restart the core, do so. If a graphical client generates the active configuration, use its persistent override feature so subscription updates don’t discard your changes. If you bind to a specific address and the computer changes networks or gets a new DHCP address, the listener may fail; update the binding as needed.

3. Verify That the Port Is Listening

Run the following command in Windows PowerShell. You should see LocalPort set to 7890 and LocalAddress set to the specified local address or an address that includes it. If the only address shown is 127.0.0.1, devices on your LAN still won’t be able to connect.

Get-NetTCPConnection -State Listen -LocalPort 7890 |
  Select-Object LocalAddress, LocalPort, OwningProcess

If there’s no output, first check whether the configuration failed to apply, the port is in use, or the core isn’t running. A port number alone doesn’t prove that Clash is listening; another program may own it. If you bind to a LAN address while the computer’s system proxy still points to 127.0.0.1:7890, check for compatibility issues. If both loopback and LAN access are required, you can listen on all interfaces, but tightly restrict access with the firewall.

4. Allow Access Through the Firewall: Restrict Ports, Addresses, and Trusted Networks

A working listener doesn’t guarantee that other devices can connect. The computer’s firewall may still block incoming connections. You can mark a home network as private if it’s trusted, but don’t change a public Wi-Fi network to private just to share a proxy, and don’t disable the firewall entirely.

Windows: Add a TCP Inbound Rule for the Local Subnet Only

First, confirm that the current network is set to Private, then open PowerShell as an administrator. This rule allows only 192.168.1.0/24 to access TCP port 7890 on 192.168.1.10, as used in this guide’s HTTP proxy test.

New-NetFirewallRule `
  -DisplayName "Clash LAN TCP 7890" `
  -Direction Inbound `
  -Action Allow `
  -Protocol TCP `
  -LocalPort 7890 `
  -LocalAddress 192.168.1.10 `
  -RemoteAddress 192.168.1.0/24 `
  -Profile Private

To stop sharing, remove the rule:

Remove-NetFirewallRule -DisplayName "Clash LAN TCP 7890"

If your computer already has broad application allow rules, check whether older rules expose more than intended. The restricted rule above won’t remove or narrow other permissions. Allowing TCP also doesn’t enable UDP traffic for phone games or other apps.

macOS and Linux: Check the Process Providing the Proxy

• macOS: Go to System Settings → Network → Firewall → Options and check incoming connection permissions for the client or core process. If “Block all incoming connections” is enabled, review its impact rather than repeatedly toggling the client setting.
• Linux: If UFW is enabled, add a rule restricted to your actual subnet. Apply the same least-access principle with other firewall tools, and avoid stacking multiple sets of rules you don’t fully understand.

sudo ufw allow proto tcp from 192.168.1.0/24 to 192.168.1.10 port 7890

5. Set Up a Phone, Tablet, or TV

iPhone and iPad: Set an HTTP Proxy for the Current Wi-Fi Network

1. Go to Settings → Wi-Fi, then tap the info button next to the current network.
2. Tap Configure Proxy, then select Manual.
3. Enter 192.168.1.10 under Server and 7890 under Port. Don’t add http:// or the port number to the Server field.
4. This guide’s basic configuration doesn’t use proxy authentication, so leave Authentication turned off. Save the settings, then reopen your browser to test.

This setting applies only to the current Wi-Fi network; it won’t automatically carry over to cellular data or another Wi-Fi network. Apps that follow this proxy setting may lose connectivity when the computer is off. When you no longer need to share the proxy, set Configure Proxy to Off.

Android: Edit the Proxy Settings for the Connected Network

A common path is Settings → Network & internet → Internet → current Wi-Fi network → Edit → Advanced options → Proxy → Manual. Some manufacturers place the option under Wi-Fi → current network details. Set the hostname to 192.168.1.10 and the port to 7890. Leave the bypass list unchanged unless you have a specific reason to edit it.

Don’t switch to a static IP just to set up a proxy. IP assignment and proxy settings are separate; changing the gateway or DNS without a clear reason can introduce another problem. Whether an Android app follows the Wi-Fi proxy depends on how it handles networking. Browser access alone doesn’t mean every app uses the same route.

TV: Check Whether Manual HTTP Proxy Settings Are Available

Some Android TV and Google TV devices let you choose Manual under Settings → Network & internet → current network → Proxy settings, then enter the same address and port. If the option isn’t available, or the target app ignores the system proxy, this method won’t cover that app. Don’t enter the computer’s address in the TV’s DNS field; they serve different purposes.

6. Test the Connection: Check the Port, Request, and Rules in Order

Start by testing from another computer to distinguish network connectivity from phone app compatibility. A Windows PowerShell port test verifies only that a TCP connection can be established; it doesn’t confirm that a proxy node is working:

Test-NetConnection 192.168.1.10 -Port 7890

TcpTestSucceeded: True means the TCP connection succeeded. Next, send a request that explicitly uses the proxy. On Windows, use curl.exe to avoid parameter parsing issues caused by the alias in older PowerShell versions:

curl.exe --proxy http://192.168.1.10:7890 --connect-timeout 5 --max-time 15 -I https://example.com/

On macOS or Linux, replace curl.exe with curl. Once you receive the target site’s response headers, check the client’s connection log to confirm the destination domain, matched rule, and actual route. A successful HTTP CONNECT response confirms only that the tunnel was established; check the subsequent TLS connection and the target site’s response as well.

If all requests go direct, first check whether the client is in Direct mode, then review rule order and proxy group selection. Allow LAN doesn’t automatically switch the rules mode to Global. For DNS, consider the specific request path: HTTP CONNECT can pass the destination hostname to the proxy, but an app may also make its own local DNS queries. Manual proxy settings don’t mean the computer handles all DNS requests.

7. Security Boundaries and Ongoing Checks

Restrict access even on a home network. When listening on all interfaces, the same port may also be exposed on the computer’s other network adapters. Recheck source restrictions after connecting to a VPN or virtual network. You don’t need to set up public port forwarding on your router, and you should never expose 7890 or the management interface to the internet.

• Keep the computer’s address stable: Prefer a DHCP reservation on your router so the computer’s address doesn’t change after reconnecting, leaving your phone pointed at an outdated address.
• Use authentication when needed: Clash-family cores can use authentication for HTTP/SOCKS authentication, but device support varies. If enabled, enter the credentials on each device and verify the response, such as HTTP 407. Authentication is not a substitute for a firewall.
• Keep the controller separate: Sharing a proxy doesn’t require remote management. Limit access to the management interface to necessary devices, and manage its authentication and firewall rules separately.
• Recheck after updates: After subscription updates, client upgrades, or network changes, verify that the mixed port, Allow LAN setting, bound address, and active configuration still match.
• Turn sharing off when finished: First disable the manual proxy on the phone or TV, then turn off LAN sharing on the computer and remove the related firewall permission. This prevents devices from trying to connect to a listener that’s no longer available.