Clash mixed-port and allow-lan: Share Your PC Proxy with Phones and TVs on Your LAN

What You Need to Share a Proxy: A Listening Port, LAN Access, and App Support

To use Clash on your PC as a proxy for a phone or TV, you usually just need to expose a LAN proxy port, then enter your PC’s address and port in the device’s Wi-Fi settings. Your PC acts as the proxy server; it does not need to act as the router. The device connects to your PC first, then Clash’s rules and policies determine whether its traffic goes direct or through a proxy node.

This guide uses 7890 as the mixed-port example and 192.168.1.10 as the PC’s LAN IPv4 address. These are sample values, not universal settings. Before proceeding, check your PC’s current address and make sure no other process is using that port.

• Your PC, phone, and TV must be able to reach one another on the LAN. Being connected to Wi-Fi with the same network name does not guarantee that devices can communicate.
• Keep the client running on your PC, and verify that the selected configuration and proxy nodes work locally before sharing them.
• A manual Wi-Fi proxy primarily works with apps that honor the system’s HTTP proxy settings. It does not route all traffic from the device.
• The proxy settings on your devices may stop working if your PC sleeps or shuts down, changes networks, or gets a new IP address.

Configure mixed-port and allow-lan

What the three fields do

Use this snippet if you already have a working configuration. Add the fields at the YAML top level, alongside rules and proxies. Do not nest them under a proxy group or add duplicate keys.

mixed-port: 7890
allow-lan: true
bind-address: 192.168.1.10
mode: rule

This is not a standalone configuration file; it does not include nodes, proxy groups, or rules. Keep your existing working configuration and merge in the snippet. mode: rule means shared requests still follow the rules on your PC. Enabling LAN sharing does not automatically switch the mode to global proxy.

Binding to all interfaces vs. a specific address

bind-address: '*' is a common way to listen on all addresses, but it broadens the range of interfaces that can be accessed. If your PC is connected to Ethernet, Wi-Fi, and virtual machine networks, bind to the LAN address you want to share and use your firewall to restrict access. Binding to 127.0.0.1 makes the listener available only to the PC itself; a phone cannot connect to the PC using that address.

GUI clients may regenerate the core configuration at startup. Use the client’s persistent configuration override or merge feature instead of editing a temporary runtime file. Menu names vary between clients. After saving and reloading, check the active configuration and listening address; after subscription updates, confirm these three fields are still in effect.

Find Your PC’s LAN IP and Check That Port 7890 Is Listening

Windows: Identify the Active Network Adapter

Run ipconfig in PowerShell or Command Prompt. Find the connected “Wireless LAN adapter Wi-Fi” or Ethernet adapter and note its IPv4 address and subnet mask. Do not use a VPN, virtual machine, or disconnected adapter. For example, if your PC’s address is 192.168.1.10 and its mask is 255.255.255.0, the subnet is 192.168.1.0/24.

ipconfig

Next, check the listening port. The following command works in Windows PowerShell. LocalAddress should show the expected LAN address or 0.0.0.0, which means all IPv4 interfaces. If it shows only 127.0.0.1, the service is still listening only for local connections.

Get-NetTCPConnection -State Listen -LocalPort 7890 |
  Select-Object LocalAddress, LocalPort, OwningProcess

macOS and Linux: Check the Interface and Process

On macOS, go to “System Settings” → “Network,” select your active connection, then open “Details” → “TCP/IP” to find the IP address. Run the command below in Terminal to check the listening process; use sudo if needed to see complete process details.

lsof -nP -iTCP:7890 -sTCP:LISTEN

On Linux, check the IPv4 address and TCP listening status separately:

ip -4 addr show
ss -lntp 'sport = :7890'

Consider setting up a DHCP reservation for your PC in your router settings so the same network adapter keeps the same IP address. Do not assign a static IP without checking the DHCP address pool and gateway settings, or it may conflict with another device.

Allow Only Trusted Sources Through Your Firewall

allow-lan: true does not create a firewall rule in your operating system. If the port is listening but connections time out, check your PC’s inbound firewall and router client isolation first. For the Wi-Fi HTTP proxy in this guide, allow TCP 7890; there is no need to also open UDP or external control ports.

Windows: Allow Traffic from a Specific Subnet on Private Networks

Use this example only on a trusted home network. First check that the current network profile is set to “Private,” then open PowerShell as an administrator. The command restricts access to TCP 7890 on this PC at 192.168.1.10, and allows connections only from 192.168.1.0/24:

New-NetFirewallRule `
  -DisplayName "Clash LAN TCP 7890" `
  -Direction Inbound `
  -Action Allow `
  -Protocol TCP `
  -LocalAddress 192.168.1.10 `
  -LocalPort 7890 `
  -RemoteAddress 192.168.1.0/24 `
  -Profile Private

When you no longer need to share the proxy, delete the rule using its display name:

Get-NetFirewallRule -DisplayName "Clash LAN TCP 7890" |
  Remove-NetFirewallRule

If a broad inbound rule already allows connections to the client, adding a more restrictive rule will not automatically narrow the existing one. Check the current inbound rules in “Windows Defender Firewall with Advanced Security” as well, so other allow rules do not leave the port open to a wider range of sources.

macOS and Linux: Use Your Existing Firewall

On macOS, go to “System Settings” → “Network” → “Firewall” → “Options” and check that the client or core process handling incoming connections is allowed. The built-in app firewall mainly manages access by application. To restrict access by source subnet, you can also use the mihomo access control fields below.

If UFW is already enabled on Linux, you can add the source restriction below. If your system does not use UFW, configure the rule with your existing firewall instead of enabling another firewall management tool just for this command.

sudo ufw allow from 192.168.1.0/24 to 192.168.1.10 port 7890 proto tcp

Set Up a Manual HTTP Proxy on a Phone or TV

iPhone and iPad

1. Open “Settings” → “Wi-Fi” and tap the info button next to the current network.
2. Tap “Configure Proxy” and select “Manual.”
3. Enter 192.168.1.10 for “Server” and 7890 for “Port.”
4. If you have not configured proxy authentication, turn “Authentication” off. Save the settings, then test by opening a website in Safari.

Enter only your PC’s IP address in the server field. Do not include http://, a path, or the port number. This setting applies to the current Wi-Fi network; it will not carry over when you switch to cellular data or another Wi-Fi network.

Android Phones

Usually, go to “Settings” → “Network & internet” → “Internet” and open the current Wi-Fi network’s settings. Under “Advanced options,” change “Proxy” to “Manual.” The menu may be under “WLAN” or “Modify network” on some manufacturers’ devices. The fields to enter are the same:

• Proxy hostname: 192.168.1.10.
• Proxy port: 7890.
• Bypass proxy for: You can leave this blank for the initial test to avoid excluding the site you are testing.

Android TV and Other TV Systems

If your TV’s network settings offer “Proxy settings” → “Manual,” enter the same address and port. Some systems require you to edit or reconnect to the current Wi-Fi network. Others have no system proxy settings at all; in that case, these two fields alone are not enough. The app must support proxies, or you will need to set up a gateway instead.

The proxy option in Wi-Fi settings is usually an HTTP proxy. mixed-port supports both HTTP and SOCKS, but that does not mean you need to select SOCKS here. HTTPS websites usually connect through an HTTP proxy using a CONNECT tunnel; you do not need to install a decryption certificate on your phone.

mihomo: Restrict Access to Specific Subnets or Devices

In mihomo, use lan-allowed-ips and lan-disallowed-ips to further restrict incoming connections. Check the configuration documentation for your core version; do not assume these fields are supported by legacy upstream Clash or every derivative client. This example allows one IPv4 subnet while excluding a device within it. The deny list takes precedence over the allow list.

mixed-port: 7890
allow-lan: true
bind-address: 192.168.1.10

lan-allowed-ips:
  - 192.168.1.0/24

lan-disallowed-ips:
  - 192.168.1.50/32

To share with just one phone and one TV, restrict the allow list to their individual IP addresses instead of the entire subnet. For example, if the phone is 192.168.1.21 and the TV is 192.168.1.31:

lan-allowed-ips:
  - 192.168.1.21/32
  - 192.168.1.31/32

/32 represents a single IPv4 address, while /24 covers the entire subnet in this example. Use DHCP reservations to keep the source addresses stable, or a phone may lose access when its IP changes. If you use IPv6 or listen on all interfaces, review IPv6 listening and access rules separately; an IPv4 restriction alone is not a complete dual-stack security boundary.

You can also configure authentication to require an HTTP/SOCKS username and password, but some phone and TV system proxy settings do not support authentication. Do not include credentials in screenshots of shared subscriptions. For home devices, prioritize subnet or individual IP restrictions and firewall rules.

Troubleshoot by Layer: Listener, Connectivity, Proxy, and Rules

Test the Proxy on Your PC First

Send a request with an explicitly specified proxy from your PC to rule out browser cache or system proxy settings. On Windows, use curl.exe to avoid differences with the curl alias in older versions of PowerShell:

curl.exe -I --connect-timeout 5 --max-time 15 --proxy http://192.168.1.10:7890 https://example.com/

On macOS and Linux, replace curl.exe in the command with curl. An HTTP response means this request went through the specified proxy listener. It does not prove the request used a remote proxy node; the rules may have selected DIRECT.

Test the Listener from Another Device on the LAN

If you have a second Windows PC, run the command below to test TCP connectivity. A True value for TcpTestSucceeded means the port is reachable; it does not mean the proxy node, DNS resolution, or destination website is working.

Test-NetConnection -ComputerName 192.168.1.10 -Port 7890

Finally, check the client’s connection list or logs for the phone or TV’s source IP. Confirm whether the request reached the core, which rule it matched, and which policy was selected. To verify the proxy exit, use a test destination that is explicitly routed through the proxy and check the connection records. Do not assume all device traffic is proxied just because a website opens.

During troubleshooting, change one thing at a time. First get the proxy working on the PC itself, then check whether the other device can reach the port, and finally investigate the specific app. This helps pinpoint whether the issue is the listener, firewall, app proxy support, or rule selection instead of resetting everything at once.

Stop Sharing and Maintain Your Configuration

When you stop sharing, first set the Wi-Fi proxy on your phone or TV to “Off” or “None” so it does not keep requesting a proxy after your PC shuts down. Then set allow-lan to false in your PC’s configuration, reload it, and remove any firewall rules you no longer need.

For ongoing sharing, keep track of three things: your PC’s DHCP reservation, the active mixed port, and the addresses allowed to connect. After updating a subscription, upgrading the client, or changing network adapters, check the active configuration and listening status again. For details on the core fields, see Advanced Configuration. For installation and importing a configuration, start with the Setup Guide.

Configuration References

• mihomo documentation: Inbound configuration, for checking the mixed port, LAN access, bind address, and authentication fields.
• Microsoft Learn: New-NetFirewallRule, for checking inbound rules, source addresses, and network profile parameters.