Clash Mixed Port and Allow LAN: Share Your PC Proxy with Phones and TVs

First, understand what you’re sharing: a proxy endpoint, not your PC’s entire internet connection

To use Clash on your PC from a phone or TV, you generally need three things: the PC’s mixed port listening, LAN access enabled in the client, and the operating system firewall allowing trusted devices to reach that port. Then enter the PC’s LAN IP address and port on each device. Keep the PC on, with the client and active configuration running.

This is not the same as turning on a PC hotspot or changing your router’s gateway. When you manually configure an HTTP proxy, only traffic from apps that honor that proxy setting goes through Clash. Game traffic, some TV apps, and apps with their own network stack may still connect directly. Enabling TUN on the PC does not automatically route traffic from other devices on the same Wi-Fi network.

Example settings used in this guide

• PC LAN IPv4 address: 192.168.50.10.
• Home network subnet: 192.168.50.0/24, with subnet mask 255.255.255.0.
• Clash mixed port: 7890.
• Connect your phone or TV and PC to the same trusted LAN, with device-to-device access enabled.

These addresses illustrate where to enter the settings; they may not match your network. Replace the example IP and subnet with the values you find in the steps below. Use the port currently configured in your client—don’t assume a commonly used default.

What mixed-port, allow-lan, and the listen address control

mixed-port is a listening port shared by HTTP and SOCKS5 proxies. Both types of client can connect to the same port, and the core identifies the protocol from the connection. It does not convert HTTP to SOCKS5, nor does it automatically route all traffic from a device through the proxy.

Check allow-lan: true and the listen address together. If the port listens only on 127.0.0.1, other devices can’t connect. A loopback address always points to the device it’s entered on: if you enter 127.0.0.1 on your phone, it points to the phone, not the PC.

bind-address: "*" listens on a broader range of interfaces and may include more than one network adapter. On a fixed home network, consider binding to the PC’s specific LAN address to limit exposure. If the PC’s address changes, update the configuration too, so consider reserving its DHCP address in your router.

An HTTP proxy can still handle HTTPS websites

The “HTTP proxy” setting on a phone can usually also carry connections to HTTPS websites: the app sends a CONNECT request to the proxy, then TLS data travels through the tunnel. You don’t need to install an extra certificate for this to work. The proxy type describes how the device communicates with the proxy endpoint; it doesn’t require the destination website to use HTTP.

Set up the PC: find its IP, enable the proxy, and check the listener

Step 1: Find the address of the active network adapter

In Windows Terminal, run ipconfig. Find the Wi-Fi or Ethernet adapter that’s currently connected, and note its IPv4 address, subnet mask, and default gateway. Don’t use an address from a virtual adapter, TUN adapter, or disconnected adapter. On macOS, go to System Settings → Network → your active connection → Details → TCP/IP.

If your phone is on a guest network, it may not be able to reach the PC even if the Wi-Fi names look similar. Connect both devices to a home network that allows them to communicate. If they must connect across subnets, ask your network administrator to check routing and access controls rather than broadly exposing the proxy.

Step 2: Configure the mixed port and allow LAN access

In the client settings, look for “Mixed Port” and “Allow LAN.” Menu names vary between graphical clients, so checking the active configuration is more reliable than following a specific interface path. With the mihomo core, merge the following top-level fields into your existing configuration. Keep your existing proxies, proxy groups, and rules—don’t replace the entire subscription with these lines.

mixed-port: 7890
allow-lan: true
bind-address: "192.168.50.10"
mode: rule

Keep the YAML indentation correct: all four fields above belong at the same level. If your client supports configuration overrides or merging, save the local settings there so a subscription update won’t overwrite them. Some clients generate the active configuration from port options in the UI. After editing, reload the configuration and verify the listen address that’s actually in use.

Step 3: Verify that the port is listening

In Windows PowerShell, run the following command to check TCP listeners:

Get-NetTCPConnection -State Listen -LocalPort 7890 |
  Select-Object LocalAddress, LocalPort, OwningProcess

• If you see 192.168.50.10: the listener is bound to the specific address used in this example.
• If you see 0.0.0.0 or ::: the listener is bound to a wildcard address; check the IPv4, IPv6, and firewall scope.
• If you see only 127.0.0.1: the proxy is still listening on the local machine only. Check the LAN settings.
• No listener shown? Check that the client is running, the configuration loaded successfully, and another process isn’t already using the port.

If the port is already in use, don’t terminate an unknown process. Use OwningProcess to identify the process before deciding which program’s port to change. If you switch to a different port, update the settings on your phone and TV, and the firewall rule as well.

Allow the connection through the firewall: restrict the network profile and source subnet

A proxy working on the PC doesn’t mean devices on the LAN can connect to it. Connections from the PC to a loopback address generally don’t go through the same inbound checks, so test the firewall separately. First make sure the current connection is to a trusted home network, then set its network profile to Private. Don’t mark a public Wi-Fi network as trusted just to share the proxy.

Example Windows inbound rule

Open PowerShell as an administrator and create a TCP inbound rule using the actual addresses in this example. Before running the command, check LocalAddress and RemoteAddress: they restrict the local address receiving connections and the remote source subnet, respectively.

New-NetFirewallRule `
  -DisplayName "Clash LAN TCP 7890" `
  -Direction Inbound `
  -Action Allow `
  -Protocol TCP `
  -LocalPort 7890 `
  -LocalAddress 192.168.50.10 `
  -RemoteAddress 192.168.50.0/24 `
  -Profile Private

This rule is for the HTTP proxy test in this guide; it doesn’t open the port to every network. If a broader rule of the same type already exists, review it too—a narrower new rule won’t restrict an existing one. When you’re done sharing, delete the rule you created with this command:

Remove-NetFirewallRule -DisplayName "Clash LAN TCP 7890"

On macOS, go to System Settings → Network → Firewall → Options and check whether the client or core providing the proxy service is allowed to accept incoming connections. The wording may differ slightly between macOS versions. If you use a separate network filter, check its access rules too; don’t rely on the system firewall alone.

Set the proxy address on phones, TVs, and game consoles

Phone: Set up a manual proxy for the current Wi-Fi network

1. Connect to a Wi-Fi network that allows your phone to communicate with the PC.
2. Open the details for the current network, find “Proxy” or “Configure Proxy,” and select “Manual.”
3. For “Server” or “Proxy hostname,” enter 192.168.50.10. Don’t add http:// or enter your router’s gateway address.
4. Enter 7890 for “Port,” save the settings, then open a webpage to test the connection.

On some phones, go to Settings → Wi-Fi → the info button for the current network → Configure Proxy. On others, the setting may be under “Modify network” or “Advanced options.” This setting usually applies only to the current Wi-Fi network, so it won’t carry over to mobile data.

If the client requires proxy authentication, enter the matching username and password. If authentication isn’t configured, don’t enable it on your phone without a reason. Some apps and devices don’t support authenticated manual proxies, so check compatibility before choosing this setup.

TV: Check which proxy settings the system and apps support

Look for an HTTP proxy under the advanced settings for the TV’s current network. If there are fields for a host and port, use the same values as on your phone. Some TVs let you set a proxy only while connecting to a network; some apps ignore the system proxy entirely. A TV being online or its browser loading a page doesn’t prove that a streaming app is using the proxy.

If the network menu only has fields for IP address, subnet mask, gateway, and DNS, don’t enter 7890 as the DNS server or gateway. A DNS server address is not an HTTP proxy address. Use a proxy option supported by the app instead, or plan a separate gateway-based setup.

Game consoles: An HTTP proxy does not route all game UDP traffic

If your console’s network settings offer a proxy server option, try entering the PC’s IP address and mixed port. It may affect only some requests, such as sign-in, the store, downloads, or system checks. Real-time multiplayer games often use UDP, so a successful store connection doesn’t mean game traffic is going through the proxy.

SOCKS5 UDP forwarding also depends on whether the app supports UDP ASSOCIATE, the core configuration, node capabilities, and UDP firewall rules. The TCP rule shown here doesn’t cover those requirements. Don’t open UDP ports without a clear need, and don’t assume that enabling allow-lan provides a complete route for game traffic.

Test the connection: port reachability, incoming requests, and rule matches

Checking one layer at a time makes problems easier to locate than repeatedly switching nodes. First verify that the PC can reach the destination through the port. Then check whether another device can reach the proxy endpoint, and finally check rules and nodes. Change one setting at a time and note the results before and after.

1. Check the PC’s connection. Use the client’s current node to open a known-working HTTPS page. If the PC itself can’t connect, fix the subscription, node, or rules before troubleshooting the phone.
2. Check LAN port connectivity. If you have another Windows PC, run Test-NetConnection 192.168.50.10 -Port 7890 and check TcpTestSucceeded. A successful result confirms that the TCP endpoint is reachable; it doesn’t mean the node is working.
3. Check a real proxy request. From another device with curl installed, run the following command and explicitly specify the HTTP proxy.
4. Check the connection log. In the client’s connections panel, look for the remote device’s source address, destination domain, matched rule, and final policy.

curl --proxy http://192.168.50.10:7890 --connect-timeout 10 --max-time 20 -I https://clash67.com/

Here, 10 and 20 are test timeouts in seconds, not expected latency or performance guarantees. An HTTP response from the site means the request reached the response stage; the status code also depends on the site itself. If you get a proxy authentication error, check the authentication settings instead of opening the port further.

In Rule mode, connections from phones and TVs are still routed according to the PC’s active configuration. Seeing DIRECT may simply mean a rule selected a direct connection; it doesn’t mean the LAN proxy failed. To test with SOCKS5, socks5h://192.168.50.10:7890 lets curl send the domain to the proxy for resolution. With regular socks5://, DNS resolution happens differently, so distinguish the two when troubleshooting DNS.

Common problems: narrow down the cause based on symptoms

Do I need to open the external control port?

No. Phones only need the mixed port to use the proxy. external-controller is a management interface, separate from the proxy endpoint devices connect to. Don’t open it just to share the proxy on your LAN. Keep the management interface bound to localhost and configure an access key as required by your client.

Do I need to enable TUN or change my phone’s DNS?

Manual HTTP proxying doesn’t require TUN on the PC and usually doesn’t require changing your phone’s DNS. How domains are resolved for proxied requests depends on the protocol and core configuration; apps that bypass the proxy may resolve domains themselves. Test with an explicitly proxied request first, then check for DNS issues if needed.

How do I undo the setup when I’m done sharing?

First set the proxy on your phone and TV to “None” or turn off manual proxying. Then disable LAN access in the client and remove the temporary firewall rule. Otherwise, devices may keep trying to reach the offline proxy after the PC is shut down, leaving them connected to Wi-Fi but unable to load webpages.

Keep a short record of the PC’s reserved IP address, mixed port, allowed subnet, and devices using the proxy. After updating the client or subscription, check the listener and rules; there’s no need to broaden network access again. For an introduction to importing subscriptions and setting up rules, read the Clash Getting Started Guide.