Share Clash over Your LAN: Configure mixed-port and allow-lan for Phones and TVs

First, understand the setup: your computer hosts the proxy, and other devices connect to it

A common way to share Clash over a LAN is to have your computer listen on a proxy port, then set your phone, tablet, or TV to use the computer's LAN IP as its proxy server. The computer continues to handle these connections using its existing subscription, proxy groups, and rules. You don't need to copy the computer's node configuration to your phone, but the computer must stay on, connected to the network, and running the Clash core.

This does not turn your computer into a router automatically. Enabling allow-lan alone won't take over traffic from every device on the same Wi-Fi network; other devices still need to specify the proxy manually, unless you configure a separate gateway to forward traffic. This guide covers explicit HTTP/SOCKS5 proxy connections only—not a secondary router, transparent router proxying, or port forwarding.

• Computer: First, confirm that the current configuration lets this computer reach the sites you need. This helps distinguish a node issue from a sharing issue.
• Network: The computer and client devices must be able to communicate directly. Wired and wireless devices on the same router can usually reach each other, but guest networks may block communication between devices.
• Example addresses: This guide uses 192.168.1.20 as the computer's IPv4 address and 7890 as the mixed port. Replace these with your actual address and port.

What mixed-port, allow-lan, and bind-address control

One port, not one protocol

mixed-port identifies the protocol used by each incoming request. The “HTTP Proxy” setting in your phone's Wi-Fi settings can connect to 7890, and apps that support SOCKS5 can use the same port. HTTPS sites usually connect through an HTTP proxy's CONNECT tunnel. You don't need a separate “HTTPS port” to browse HTTPS sites or install a certificate.

The separate port field is for HTTP proxy connections, while socks-port is for SOCKS proxy connections. When using a mixed listener, make sure no other listener uses the same address and port. If another program on the computer is already listening on 7890, identify it first or choose an unused port and update the device settings to match.

Check both the listening address and firewall rules

127.0.0.1 is the loopback address and only serves the local computer. Even if your phone is connected to the same Wi-Fi, it can't reach a proxy listening only on the computer's loopback interface. bind-address: "*" is convenient for an initial test, but it may expose the listener on wired, wireless, and other network interfaces. For regular use, bind to a fixed LAN address and further restrict access with your firewall.

Configure the shared proxy and verify the values the client actually uses

Back up your working configuration first. The snippet below should be merged into the top level of your existing configuration; it is not a complete subscription with proxy nodes. Keep your existing proxies, proxy-providers, proxy-groups, and rules—don't replace the entire file with these lines.

mixed-port: 7890
allow-lan: true
bind-address: "*"
mode: rule
log-level: info

1. Check the actual “Mixed Port” and “Allow LAN” values in your client settings. Menu names may vary slightly between clients.
2. If your client supports configuration overrides, merges, or patches, use that feature to save the sharing settings. Direct edits to a subscription-generated file may be lost the next time the subscription updates.
3. Save and reload the configuration, restarting the core if needed. Check the logs for YAML parsing errors or port conflicts.
4. Check the active configuration or listening status again. The GUI may override the port and switches in the YAML, so use the core's runtime status as the source of truth.

Don't indent top-level YAML fields or declare the same field more than once. Put the asterisk in quotes; an unquoted * has a special meaning in YAML and may cause a parsing error. To bind only to a wired network adapter, use bind-address: "192.168.1.20" instead, but remember to update the configuration if the computer's IP address changes.

Find your computer's IP and allow the port through your firewall

Windows: Check the IP address and TCP listener

In Windows 11, find the IPv4 address under “Settings” → “Network & internet” → the current “Wi-Fi” or “Ethernet” connection properties, or run ipconfig in a terminal. Use the address of the physical network adapter connected to your router—not an address assigned to a TUN, VPN, or other virtual adapter.

ipconfig
Get-NetTCPConnection -State Listen -LocalPort 7890

Run the second command in PowerShell. If LocalAddress is 127.0.0.1, the proxy is still listening only on the local computer. 0.0.0.0 usually means all IPv4 interfaces, while 192.168.1.20 means it is bound to that specific address. If there's no output, check that the core is running and that the actual port is 7890.

Once you've confirmed that the current connection is a trusted network, create a TCP port rule under “Windows Security” → “Firewall & network protection” → “Advanced settings” → “Inbound Rules.” The following PowerShell command is an equivalent example to run as an administrator. It allows connections only from 192.168.1.0/24 on a private network; update the subnet first if your home network uses a different range:

New-NetFirewallRule -DisplayName "Clash LAN TCP 7890" `
  -Direction Inbound -Action Allow -Protocol TCP `
  -LocalPort 7890 -RemoteAddress 192.168.1.0/24 `
  -Profile Private

This rule is for the HTTP proxy connectivity test in this guide; it doesn't configure UDP sharing. When you're done sharing, remove the rule with this command so the port isn't left open:

Remove-NetFirewallRule -DisplayName "Clash LAN TCP 7890"

macOS and Linux: Check the relevant core process

On macOS, find your IP address under “System Settings” → “Network” → your current connection → “Details” → “TCP/IP.” Under “Network” → “Firewall” → “Options,” check whether the client or core is blocked. The controls may move between macOS versions. If a client update replaces the core, check its firewall permission again.

On Linux, run ip -4 addr to find the IP address and ss -lntp to check listening ports. If UFW is already enabled and your home subnet is 192.168.1.0/24, you can add the following rule to restrict access by source address. Don't enable or reset the firewall just for this rule without understanding how it may affect remote access.

sudo ufw allow from 192.168.1.0/24 to any port 7890 proto tcp

Set up the proxy on your phone or TV: the server is your computer, not your router

iPhone and iPad

1. Open “Settings” → “Wi-Fi” and tap the info button next to your current network.
2. Find “Configure Proxy” and select “Manual.”
3. Enter the computer's address, 192.168.1.20, for “Server” and 7890 for “Port.”
4. If the computer's proxy doesn't require authentication, leave “Authentication” off. Save the settings, then open a new page in Safari to test.

This setting applies only to the current Wi-Fi network; it won't automatically apply to cellular data. Don't enter your phone's IP address, the router's gateway, or 127.0.0.1 as the server, and don't add http:// to the server field. If the proxy requires authentication, enter the correct username and password. Support for proxy authentication varies by app, so test each one.

Android phones

In your system's WLAN settings, edit the current network, find “Advanced options” or “Proxy,” and select “Manual.” Enter 192.168.1.20 as the hostname and 7890 as the port. On many Pixel phones, the path is “Settings” → “Network & internet” → “Internet” → current network settings → Edit → “Advanced options” → “Proxy.” Other brands may use different menus; follow the options in your network's edit screen.

“Bypass proxy for” is a device-side exclusion list, separate from Clash rules. Leave it at its default setting for the initial test; don't enter wildcard patterns unless you know what they do. Android's manual Wi-Fi proxy setting is primarily for apps that use the system HTTP proxy. It doesn't guarantee that games, video apps, or background services will use it.

TVs and streaming devices

Open the current connection under “Settings” → “Network” on your TV and look for “Proxy Settings” or network editing options. If manual HTTP proxy settings are available, enter your computer's IP address and 7890. Some TVs offer proxy settings only when editing a Wi-Fi connection, and wired connections may not support them. Don't switch to a static IP just to find proxy settings—you could enter the wrong gateway or DNS address.

If your TV doesn't have a proxy setting, check whether the app supports its own HTTP/SOCKS5 proxy settings or whether a compatible standalone client is available. Changing the TV's DNS to your computer's address is not a substitute for proxy settings; this guide doesn't set up a DNS service for LAN devices.

Verify sharing at three levels: listener, network, and rules

Start by using your phone's browser to test an HTTPS site that you know should use the proxy. At the same time, check the computer client's connection list or logs. Look for whether the request reached the core, which domain it targeted, which rule matched, and where the connection exited. Don't rely only on whether a proxy icon appears in the phone's status bar.

1. First, check that the port is reachable: If you have another Windows computer, run Test-NetConnection 192.168.1.20 -Port 7890. TcpTestSucceeded: True confirms that the TCP port is reachable, but doesn't guarantee that the node or rules are working.
2. Next, test a proxy request: On another computer with curl installed, run the command below and specify the proxy explicitly. This rules out the possibility that the app is ignoring the system proxy setting.
3. Finally, test each app: After the browser works, test your TV apps, LAN casting, and other services separately. A successful web page test doesn't mean all traffic is being routed through the proxy.

curl --proxy http://192.168.1.20:7890 --connect-timeout 5 --max-time 20 -I https://example.com/

Here, 5 seconds is the connection timeout, and 20 seconds is the total request timeout; neither is a latency measurement. If a request in the connection list matches DIRECT, it may still have entered through the computer's proxy listener, but the computer then connected directly to the destination. Check the rule and exit route to understand what happened.

A failed ping doesn't prove that the proxy is unreachable; the system may block ICMP responses. Conversely, a successful ping confirms only some network connectivity—you still need to test the TCP connection to 7890. If the same site won't open on the computer itself, fix the configuration or upstream node first instead of repeatedly changing the phone's port.

TUN, DNS, and UDP: the limits of proxy sharing

Enabling TUN on the computer doesn't automatically route phone traffic

TUN mainly handles traffic that enters the computer's virtual network interface. Enabling TUN in the desktop client won't automatically configure phones on the same network to use a proxy, nor will it make an ordinary computer the default gateway for other devices. This explicit proxy setup generally doesn't require TUN. The computer's system proxy setting is also separate from LAN sharing—the key is the listening proxy and the settings on each device.

HTTP proxy settings don't cover every protocol

A standard HTTP proxy and HTTPS CONNECT mainly handle TCP connections; they can't guarantee support for game traffic over UDP, QUIC, casting discovery, or LAN broadcasts. SOCKS5 has a UDP relay mechanism, but whether it works depends on the app, core, node, and firewall. Entering an HTTP proxy in your phone's Wi-Fi settings doesn't automatically enable SOCKS5 UDP.

DNS handling depends on how each request is made

An HTTP proxy usually receives the destination hostname, then the computer handles resolution and connection according to its current configuration. However, an app may resolve the domain beforehand or ignore the system proxy. Whether SOCKS5 passes the domain to the proxy for resolution also depends on how the app makes its request. So setting a Wi-Fi proxy doesn't guarantee that Clash handles every DNS request from the device.

For everyday use: reserve an IP, prevent sleep, and turn off the proxy when you're done

• Reserve the computer's IP: If possible, reserve an address for the computer in your router's DHCP settings. That way, it won't change from 192.168.1.20 to a different IP after reconnecting. If you set a static IP manually, check the subnet, gateway, and address conflicts.
• Check power settings: The proxy connection will usually drop when a laptop is closed or goes to sleep. If you need to keep sharing, adjust the system's power settings as needed, and make sure the computer has adequate ventilation and power.
• Limit access: Check for existing firewall rules that allow broader app access; adding a source-restricted rule won't automatically tighten older rules. Take extra care on computers with multiple network adapters.
• Turn off the proxy on client devices: Before stopping sharing, change the proxy setting on your phone or TV to “Off” or “None.” Otherwise, the device may keep sending requests to a computer that's no longer online.

You can boil the troubleshooting process down to four steps: confirm the computer can connect, confirm the mixed port is listening on the LAN, confirm the device can reach that port through the firewall, and then check the rules and exit route for the app's request. Following this chain makes the issue easier to pinpoint than repeatedly importing subscriptions or changing several network settings at once.