Clash Mixed Port and allow-lan: Share Your PC Proxy with Phones and Tablets

Get the Client and Subscription Ready

Before sharing your LAN proxy, make sure the Clash client on your PC is already routing requests correctly. Visit the Clash client download page and choose a client for Windows, macOS or Linux. After installation, add your provider’s subscription link under the client’s “Subscriptions” or “Profiles” section, download the configuration and select it as the active profile. Menu names vary by client; see the quick-start guide for installation and import instructions.

After importing the profile, start in Rule mode, choose an available node in the proxy group your traffic actually uses, and verify the connection on your PC. The subscription provides nodes and rules; the client runs the core. Enabling LAN access does not add nodes or fix an expired subscription, unavailable nodes or incorrect rule selection.

1. Make sure the active configuration is enabled, not just downloaded.
2. Note the mixed port shown in the client. This guide uses 7890 as an example; replace it throughout if your port is different.
3. Connect your PC and phone to the same trusted local network. It’s fine to connect the PC by Ethernet and the phone by Wi-Fi, as long as the router allows them to communicate.
4. Temporarily turn off other VPN or proxy apps on your phone so test requests don’t take a different route.

mixed-port, HTTP and SOCKS5

mixed-port is a listening port that accepts both HTTP proxy and SOCKS5 requests. The core identifies each protocol from its initial handshake, so you don’t need a separate port for each one. It doesn’t randomly mix or forward all traffic; after a request reaches the core, rules, proxy groups and node selection still determine where it goes.

A phone’s Wi-Fi “Manual Proxy” setting usually expects an HTTP proxy, not SOCKS5. Enter the mixed port to accept these requests. To access HTTPS sites, clients typically use the HTTP proxy’s CONNECT method to establish a tunnel. You don’t need to enter the proxy address as https://192.168.50.23 or install a certificate for standard proxy sharing.

allow-lan and the Listening Address

allow-lan: true lets devices on your local network connect; the listening address determines which local addresses accept connections. If the core still listens only on 127.0.0.1, the PC can use the proxy but your phone can’t reach it. Here’s a typical sharing snippet for Clash and mihomo configurations. Merge it into the top level of your existing configuration rather than replacing the entire subscription:

mixed-port: 7890
allow-lan: true
bind-address: "*"
mode: rule

"*" listens on all interfaces, which is convenient for this example but exposes the service more broadly. On PCs with multiple network adapters or on untrusted networks, use firewall rules to restrict access; you can also bind to a specific LAN address if your core supports it. Subscription updates may overwrite manual changes, so prefer the client’s “Allow LAN” and “Mixed Port” options, or use its override or merge feature to preserve these settings. Reload the configuration and check the logs for port conflicts or invalid fields.

Find Your PC’s Local IP and Confirm the Port

On your phone, enter the computer’s LAN address—not its public IP or 127.0.0.1, which refers to the phone itself. This example uses 192.168.50.23 for the computer, 192.168.50.80 for the phone, and 255.255.255.0 for the subnet mask. Use the addresses shown on your own devices.

Windows

Go to “Settings” → “Network & Internet” → select the connected “Wi-Fi” or “Ethernet” network → “Properties” and find the IPv4 address. You can also run the command below in a terminal. Identify the active physical network adapter; don’t select a VPN, virtual machine or TUN adapter by mistake:

ipconfig
netstat -ano | findstr :7890

The listening address should usually show 0.0.0.0:7890 or your specific LAN address, along with LISTENING. If you see only 127.0.0.1:7890, check the LAN access and listening settings. If there’s no listening entry at all, make sure the core is running and confirm the actual port number.

macOS and Linux

On macOS, go to “System Settings” → “Network” → your active connection → “Details” → “TCP/IP” to find the IP address. On Linux, check IPv4 in Network Settings or use these commands to inspect the interfaces and listening ports:

ip -4 addr
ss -lntp 'sport = :7890'

A laptop’s IP address may change when it switches Wi-Fi networks. For regular use, reserve an address for the PC in your router’s DHCP settings; that’s easier than repeatedly changing the proxy host on your phone. The shared endpoint may stop working if the PC sleeps, its lid is closed or the client exits.

Firewall Rules and Trusted Networks

Enabling allow-lan lets the core accept external connections, but the operating system’s firewall may still block them. Allow access to the PC’s proxy listening port instead of disabling the entire firewall. Don’t forward 7890 to the public internet from your router.

Create a Windows Inbound Rule

1. Open “Windows Security” → “Firewall & network protection” → “Advanced settings.”
2. Select “Inbound Rules” → “New Rule” → “Port,” choose TCP, and enter 7890 as the specific local port.
3. Choose “Allow the connection.” On a trusted home network, select only the “Private” profile and make sure your current network is actually marked as private.
4. After creating the rule, open “Properties” → “Scope” and limit the remote IP addresses to your phone’s actual IP or a trusted subnet, such as 192.168.50.0/24.

The TCP rule described above is suitable for the HTTP browsing test in this guide; it doesn’t configure every SOCKS5 UDP use case. On office networks, shared apartment networks or guest Wi-Fi, don’t simply allow the entire subnet. Restrict access to specific devices instead.

Allow Access on macOS and Linux

On recent versions of macOS, go to “System Settings” → “Network” → “Firewall” → “Options” and check whether the relevant client or core process is allowed to accept incoming connections. The location may vary by macOS version. On Linux with UFW, add a rule for the example subnet and review your existing policies:

sudo ufw allow from 192.168.50.0/24 to any port 7890 proto tcp
sudo ufw status numbered

Set Up a Proxy on Phones, Tablets and TVs

iPhone and iPad

1. Open “Settings” → “Wi-Fi,” then tap the info button next to your connected network.
2. Under “HTTP Proxy,” tap “Configure Proxy” and select “Manual.”
3. Enter the PC’s actual address as the server, for example 192.168.50.23, and 7890 as the port. Don’t add a protocol prefix in the server field.
4. This guide’s example doesn’t use an inbound username or password, so turn off “Authentication.” Save the settings and test in a browser.

This setting applies only to the current Wi-Fi network; it won’t automatically apply to cellular data. Set it up separately for each Wi-Fi network. Not every app follows the system HTTP proxy, so a working browser doesn’t prove that all apps are routing through your PC.

Android Phones and Tablets

A common path is “Settings” → “Network & Internet” → “Internet” → your current Wi-Fi network → “Edit network” → “Advanced options” → “Proxy” → “Manual.” On some devices, you may need to long-press the network or open its details; the menu may also be called “WLAN.” Set the proxy hostname to 192.168.50.23 and the proxy port to 7890. Leave the bypass list empty while troubleshooting.

Android’s Wi-Fi HTTP proxy doesn’t route all traffic through VpnService. Games, real-time communication apps and apps with their own networking stack may ignore this setting. If an app doesn’t support HTTP proxies, installing a compatible client on the phone and routing traffic through its VPN is usually a better option than repeatedly changing the port on your PC.

TVs and Streaming Devices

Some Android TV devices let you set a manual proxy under “Settings” → “Network & Internet” → your current network → “Proxy settings,” but the menu depends on the manufacturer’s firmware. If the option isn’t available, check whether the app has its own proxy settings. A standard HTTP proxy won’t necessarily route every TV app or UDP traffic through your PC. If needed, use a client supported by the device or plan a separate router-based proxy setup.

Test the Connection and Check Rule Matching

Test in this order: confirm the port is reachable, verify that a proxy request succeeds, then check that the expected rule and route are being used. A failed page load could be caused by any layer of the setup—LAN connectivity, the firewall, the node or the rules—so don’t assume the subscription is at fault.

Test from Another Computer

If there’s another Windows PC on your LAN, test the TCP port first, then make a request using the HTTP proxy explicitly. These commands use the example host address; the destination site is only used to check for an HTTP response:

Test-NetConnection 192.168.50.23 -Port 7890
curl.exe -I --connect-timeout 5 --max-time 20 --proxy http://192.168.50.23:7890 https://example.com/

TcpTestSucceeded: True confirms only that the TCP connection succeeded; it doesn’t prove the node or rules are working. Receiving response headers from the destination site indicates that the request path is basically working. If the port is unreachable, check the address, listener and firewall. If the port is reachable but the request fails, check the core logs and proxy group status.

SOCKS5 and DNS Resolution

curl --head --connect-timeout 5 --max-time 20 --proxy socks5h://192.168.50.23:7890 https://example.com/

socks5h sends the destination hostname to the proxy for resolution, unlike socks5, which some tools may resolve locally first. This test checks a SOCKS5 TCP request only; it doesn’t confirm that UDP forwarding works.

While testing, open the client’s “Connections” page to check the phone’s source IP, destination domain, matched rule and proxy chain. In Rule mode, a request may match DIRECT or enter a proxy group. Check which node the matched group selected before judging the route. Temporarily switching to Global mode can help rule out a rule issue, but switch back to your usual mode when you’re done.

Common Issues and Sharing Limits

Turn Off Sharing When You’re Done

• Turn off the proxy for the current Wi-Fi network on your phone or tablet. Otherwise, the device may keep waiting for a proxy response after the PC goes offline.
• Turn off LAN sharing in the client and remove any firewall inbound rules you no longer need.
• Check the client’s connection list to see which devices are connected. Don’t leave the proxy available indefinitely to devices you don’t recognize.

A reliable shared setup depends on four things: the proxy works on the PC, the listener accepts LAN connections, the network and firewall allow devices to communicate, and the apps support the chosen proxy method. Checking these layers in order makes it easier to find the problem than changing ports, nodes and rules all at once.