Clash Mixed Port and Allow LAN: Share Your PC Proxy with Phones and Tablets

Know what you’re sharing: a Wi-Fi manual proxy doesn’t route all device traffic

Phones and tablets can use Clash on your computer as a proxy server on your local network. Your computer runs the client, loads your subscription, and applies routing rules; on your mobile device, enter the computer’s address and port in the current Wi-Fi network’s proxy settings. The computer must stay powered on and connected to the internet, with the Clash core running.

This setup works with browsers and apps that honor the Wi-Fi HTTP proxy settings. It is not the same as using a VPN on your phone, and it won’t automatically route traffic from every game, UDP connection, app-specific connection, or system service. To route more of your mobile device’s traffic, use a client on the device that supports the required features. See the Android getting started guide.

What mixed-port, allow-lan, and the listen address do

The mixed port mixed-port accepts both HTTP proxy and SOCKS proxy requests on the same TCP listening port. Wi-Fi proxy settings on phones generally use an HTTP proxy, so you can use this mixed port without looking for a separate “phone-only port.” This guide uses 7890 as an example; not every client uses this value by default.

127.0.0.1 refers to the device itself. If you enter it on your phone, requests go back to the phone—not to your computer. 0.0.0.0 is used by the server to listen on all interfaces; it is not a valid proxy server address for your phone. Enter your computer’s actual local IPv4 address instead, such as 192.168.1.23.

Don’t use the external-controller port as the mixed port. It’s an administrative API for the core, not a web proxy, and shouldn’t be exposed to your local network just to share web access.

On your computer: allow LAN connections and check the active configuration

Use the client settings first

1. Open the client’s Settings and turn on “Allow LAN” or “Allow local network connections.”
2. Find “Port” or “Mixed Port” settings and note the configured value. In this example, it’s 7890—not a port in your subscription URL or the proxy server’s port.
3. If there’s a “Listen address” setting, make sure it isn’t set to listen only on 127.0.0.1. You can use your local network adapter’s address, or listen on all IPv4 interfaces and restrict access with your firewall.
4. Apply the settings. If the client asks you to restart the core, do so, then verify that the configuration took effect.

Menu layouts vary between clients and versions. The labels above are names of settings to look for, not a universal menu path. If you manage your configuration in a file, these are common settings for Clash and Clash Meta (mihomo):

# Merge into the top level of your existing configuration; this is not a complete subscription configuration
mixed-port: 7890
allow-lan: true
bind-address: '0.0.0.0'
mode: rule

Keep your existing proxies, proxy-groups, rules, and DNS settings; don’t replace the entire file with these lines. Don’t define the same field more than once. Some clients override YAML values set in the interface, so check the active configuration rather than just the original subscription file.

Find your computer’s IP address and allow only the required firewall traffic

Note the IPv4 address of the active network adapter

On Windows, open a terminal and run ipconfig. Find the IPv4 address under the connected “Wireless LAN adapter Wi-Fi” or Ethernet adapter. Don’t use an address from a TUN virtual adapter, a disconnected adapter, or the loopback interface. On macOS, go to System Settings → Network → your current connection → Details → TCP/IP, then find the IP address.

For example, your computer might be 192.168.1.23 and your phone 192.168.1.56. Devices on the same regular home network can usually reach each other, but similar IP addresses don’t guarantee connectivity. Guest Wi-Fi, AP isolation, or VLAN policies may block communication. Your computer can use Ethernet while your phone uses Wi-Fi, as long as the network allows them to communicate.

On Windows, allow TCP 7890 on private networks only

1. First, make sure the network is a trusted home or work network, then set its Windows network profile to Private. Don’t change a public hotspot to a private network.
2. Open Windows Security → Firewall & network protection → Advanced settings.
3. Select Inbound Rules → New Rule → Port → TCP, then enter 7890 under Specific local ports.
4. Allow the connection, select the Private profile only, and name the rule “Clash LAN TCP 7890.”
5. In the rule’s Scope properties, restrict the remote IP addresses. Ideally, allow only the fixed addresses of your phone and tablet. If their addresses change, restrict access to your local subnet as appropriate.

The Wi-Fi HTTP proxy in this example needs TCP only. Don’t allow every protocol and port just to see if it works. If your computer’s mixed port is 7897, update the firewall rule and phone settings to use 7897 too.

If the macOS application firewall is enabled, go to System Settings → Network → Firewall → Options and check that the client or core receiving connections is allowed. On a computer managed by workplace security software, follow your administrator’s policies; don’t disable the firewall to get around restrictions.

On your phone or tablet: enter the computer address and mixed port

Set up a Wi-Fi proxy on iPhone or iPad

1. Open Settings → Wi-Fi and tap the info button next to the current network.
2. Tap Configure Proxy and select Manual.
3. Enter 192.168.1.23 for Server and 7890 for Port. Don’t add http:// or a path.
4. If proxy authentication isn’t configured on your computer, leave Authentication off, then save.
5. Stay connected to this Wi-Fi network and test the connection in a browser.

Set up a Wi-Fi proxy on Android

A common path is Settings → Network & internet → Internet → settings button for the current Wi-Fi network → Modify → Advanced options → Proxy → Manual. Some manufacturers put the setting under WLAN → current network details; follow the options on your device.

• Proxy hostname: 192.168.1.23.
• Proxy port: 7890.
• Addresses to bypass the proxy: keep the default for your first test, and don’t add the site you’re testing to the bypass list.
• IP settings: usually leave DHCP enabled; you don’t need to set a static IP to configure a proxy.

These settings apply to the current Wi-Fi network; they don’t automatically configure a proxy for mobile data. Check the settings again when you switch networks. Android’s system Wi-Fi proxy usually doesn’t offer general username and password fields. If your computer requires proxy authentication, first confirm that your device and apps support the required authentication method; entering just the address and port won’t be enough.

Check that traffic goes through your computer: verify the connection, then the routing rules

After saving, open a known-working HTTPS page in your phone’s browser and open the client’s Connections or Logs page on your computer. Look for requests from your phone, the destination domain, the matching rule, and the proxy group used. Some clients show the source IP, which can help you distinguish phone requests from those made by the computer.

1. First, confirm the request arrived. Open two different pages on your phone and check whether new entries appear in the computer’s connection list.
2. Then, check the routing result. In Rule mode, requests matching DIRECT still connect directly. Sending traffic through your computer doesn’t necessarily mean it uses a remote node.
3. Finally, test the app you need. Once the browser works, test other apps. If only some apps fail, check whether they honor the system HTTP proxy.

If another device on your local network can run a terminal, use the command below to check the proxy handshake. Run the test from that device, not just on the computer running the proxy:

curl -I -v --connect-timeout 5 --max-time 15 --proxy http://192.168.1.23:7890 https://example.com/

Here, example.com is a real domain used for demonstration. If the connection times out, check the network connection between your phone and computer, then the firewall. If the connection is refused immediately, first check whether the port is listening. If the CONNECT handshake succeeds but an upstream error follows, check the proxy group, node, and rules. An HTTP status code alone doesn’t mean sharing failed; consider the handshake and the destination site’s response too.

Common issues: check each step in the connection path

The computer works, but the phone connection keeps timing out

• Make sure the phone isn’t using 127.0.0.1, 0.0.0.0, or an outdated IP address for the computer.
• Make sure allow-lan is enabled and the mixed port isn’t listening only on the loopback address.
• Check that the firewall rule matches the current network profile and uses the same port as the client.
• Check for guest network isolation, router AP isolation, and restrictions on local network access from other VPNs.

On Windows, run the command below to check which address is listening locally. An entry such as 0.0.0.0:7890 or the computer’s actual network address means the port is listening on that IPv4 interface. If you see only 127.0.0.1:7890, other devices can’t connect through it. If there’s no output, check that the core is running and that you entered the correct port.

netstat -ano | findstr LISTENING | findstr :7890

The browser works, but games or video apps don’t use the proxy

The app probably doesn’t honor the Wi-Fi HTTP proxy, or it uses a connection method this setup doesn’t cover. Repeatedly changing the mixed port won’t help. Enabling TUN on your computer won’t route traffic from your phone unless the phone sends it to the computer. TUN routing on the computer and configuring it as a network gateway are two different things. Read the TUN guide to choose a traffic-routing method suited to the device itself.

A web page reports an authentication or certificate error

HTTP 407 usually means the proxy requires authentication. Check the computer’s authentication settings and confirm that your device supports them. A standard HTTP proxy forwards HTTPS using CONNECT; this guide doesn’t require installing a root certificate. If you see a certificate warning, check the device’s clock, the destination site’s certificate, and the network. Don’t dismiss the warning or install a certificate from an untrusted source.

After the computer sleeps, even regular web pages stop working on the phone

The manual proxy still points to a computer that has stopped serving requests, so apps that use the setting can’t connect. When you’re done sharing, set the proxy for the phone’s current Wi-Fi network to Off or None. If the computer’s IP changes because of DHCP, update the address on your phone. For long-term use, reserve an IP address for the computer in your router’s DHCP settings.

Secure sharing and cleanup: restrict access and don’t expose the proxy to the internet

Setting allow-lan: true while listening on all interfaces expands the number of devices that can reach the proxy. It doesn’t provide access control; use your firewall to restrict connections. Don’t set up public port forwarding for 7890 on your router, and don’t expose the core’s control interface to fix a phone’s proxy connection.

• Use only on trusted networks. Turn off LAN sharing before connecting to hotel, airport, or other public Wi-Fi.
• Allow only the devices you need. Ideally, restrict access to the specific IP addresses of your phone and tablet. If you allow the whole local subnet, other devices on it may also be able to connect.
• Check your subscription terms. Traffic from shared devices counts toward the subscription used on your computer. Providers may also limit simultaneous connections or device usage.
• Configure authentication only if supported. If authentication is required, use a unique, strong password and confirm that your mobile device supports it. Don’t use your subscription URL or control interface key as the proxy password.
• Restore your settings when you’re done. Turn off the manual proxy on your phone, disable LAN sharing on your computer, and disable any inbound firewall rules you no longer need.