#Clash LAN Proxy Sharing: mixed-port, allow-lan, and Firewall Setup

Why share a proxy over the LAN

Clash itself is a proxy core that runs on a single device, and by default it only listens on the local loopback address (127.0.0.1), meaning only software running on that computer can reach the internet through it. In many cases, though, phones, tablets, smart TVs, and game consoles also need to use the same route — installing a client on each device individually isn't practical, especially since TVs and consoles often have no client to install at all.

The idea behind LAN proxy sharing is straightforward: have Clash listen on all the network interfaces on the local machine, then point other devices' system proxy settings at that machine's IP and port. Traffic then passes through Clash's rule matching and node forwarding before going out. No extra software is required — it's just a matter of a few config fields plus allowing the traffic through the operating system's firewall.

mixed-port: know which port is actually listening

In a Clash config file, the port-related fields are mainly port (HTTP proxy port), socks-port (SOCKS5 proxy port), and mixed-port (mixed port). The first two are a legacy split setup, while mixed-port is the recommended field for today's mainstream clients (especially those built on the Clash Meta / mihomo core): the same port accepts both HTTP and SOCKS5 connections, and the client automatically detects the protocol — no need to configure two separate ports.

mixed-port: 7890

Once mixed-port is set, port and socks-port no longer need to be configured separately (some client UIs merge all three into a single "mixed port" field). Other devices on the LAN just fill in this one port for the proxy — no need to distinguish between HTTP and SOCKS5.

allow-lan: the master switch for LAN access

Setting the port alone isn't enough. By default Clash only listens on the local machine — a safety default that prevents a shared config file from accidentally exposing someone's proxy port to an entire LAN. To let other devices on the network connect in, you need to explicitly flip this switch:

allow-lan: true

Most client GUIs also expose this option, usually labeled "Allow LAN Connections" or similar — toggling it has the same effect as editing the config file directly. Once enabled, Clash starts accepting connection requests from other IPs on the LAN, not just from 127.0.0.1.

Note that turning on allow-lan doesn't automatically punch a hole through your system firewall — it only stops the Clash process itself from rejecting external connections. You still need to handle the firewall step separately, covered below.

bind-address: which network interfaces get listened on

bind-address controls which network interface (or interfaces) Clash binds its port to. There are three common values:

• 127.0.0.1: listens only on the local loopback address — LAN devices can't connect at all. This is the effective behavior when allow-lan is false.
• 0.0.0.0: listens on every network interface on the machine, including wired, wireless, and any virtual adapters that might exist (such as one created by a VPN client). This is the most commonly used value for LAN sharing.
• A specific interface IP, e.g. 192.168.1.5: listens only on that one interface — useful when a computer has multiple network interfaces and you only want to expose the proxy on one of them.

mixed-port: 7890
allow-lan: true
bind-address: "*"

Many clients shorten bind-address to *, which is equivalent to 0.0.0.0 — listening on every interface. If your computer is connected via both Ethernet and Wi-Fi and you're not sure which interface other devices will use to reach it, using * or 0.0.0.0 is the simplest choice, saving you from having to check each interface's assigned IP.

Finding this computer's LAN IP address

Once mixed-port, allow-lan, and bind-address are set, you still need to know the actual LAN IP address of the machine running Clash — that's the address other devices will enter.

On Windows

Open Command Prompt and run:

ipconfig

Under the network adapter currently in use ("Ethernet adapter" for wired, "Wireless LAN adapter Wi-Fi" for wireless), look for "IPv4 Address" — a value like 192.168.x.x or 10.0.x.x is the address you need.

On macOS

Open System Settings → Network, select the network you're currently connected to (Wi-Fi or Ethernet), and the IP address will be shown directly. Alternatively, run this in Terminal:

ipconfig getifaddr en0

en0 usually corresponds to the built-in wired or wireless adapter, though the numbering can vary by Mac model. If en0 returns nothing, try en1 or en2 next.

Opening the Windows firewall

Windows Firewall blocks external devices from reaching a newly opened port by default, even if Clash is already listening on 0.0.0.0:7890 — connections from LAN devices can still be dropped at the firewall layer. Here's how to open it up:

1. Open "Windows Defender Firewall" → "Advanced Settings", then go to "Inbound Rules".
2. Click "New Rule" on the right, and choose "Port" as the rule type.
3. Select TCP, and enter the port number matching mixed-port under "Specific local ports" — for example 7890.
4. Choose "Allow the connection", and select "Private" for network type as needed (recommended, to avoid opening it on public networks too).
5. Name the rule (e.g. "Clash LAN Proxy") and finish creating it.

If the client comes with its own installer, Windows usually prompts "Allow this app through the firewall?" the first time it runs. Just check "Private networks" and allow it — that has the same effect as the manual steps above, so no need to repeat them.

Opening the macOS firewall

macOS Firewall (found under System Settings → Network → Firewall) handles outgoing connections and inbound connections differently. If the firewall is enabled, the first time another device tries to connect to the port Clash is listening on, macOS will prompt whether to allow the app to accept incoming connections — choose "Allow".

If no prompt appears, or it was accidentally dismissed as "Deny", check manually:

1. Go to System Settings → Network → Firewall → Options.
2. Find the Clash client in the app list and confirm its status is set to allow incoming connections.
3. If it's not in the list, click "+" to add the client app manually, then set it to allow.

Also worth noting: if the computer has third-party security software installed (some corporate machines or security suites add an extra layer of network filtering), you'll need to allow the connection there as well — clearing the built-in firewall doesn't guarantee third-party software will let it through too.

How to set up the proxy on other devices

Phones, tablets, TVs, and consoles on the LAN generally all offer a manual proxy option in their Wi-Fi settings, and the configuration is essentially the same everywhere:

• Proxy server address: the LAN IP of the machine running Clash, e.g. 192.168.1.5.
• Port: the value of mixed-port, e.g. 7890.
• Protocol type: if a device only lets you pick one protocol, choose HTTP — mixed-port handles HTTP connections just fine.

On Android, this is usually under Wi-Fi details → Advanced options → Proxy → Manual, where you fill in the address and port above. On iOS, go to Wi-Fi details → Configure Proxy → Manual and enter the same values. Smart TVs and consoles label things slightly differently by manufacturer, but a "Proxy server" field can usually be found under advanced network settings.

Note

A manually configured system proxy only forwards traffic that respects system proxy settings. Some apps — especially games or streaming apps that implement their own networking — may bypass the system proxy entirely. That's an app-level limitation, unrelated to how Clash is configured.

Troubleshooting order when a device can't connect

If other devices can't connect after setting up LAN sharing, work through the following checks in order — this covers most cases:

1. Confirm both devices are on the same LAN segment. This matters especially if your home has multiple Wi-Fi networks (e.g. a guest network) — guest networks are often isolated from the main network and can't reach each other.
2. Confirm allow-lan is actually set to true, and that the client has reloaded the config after you saved it.
3. Confirm bind-address hasn't ended up as 127.0.0.1 — this is the single most common oversight.
4. Confirm the port number in your firewall rule matches the current mixed-port value — if you changed the port, update the firewall rule to match.
5. From the phone's browser, try visiting http://LAN-IP:port directly. If the connection is refused rather than timing out, the port is reachable and the issue is more likely in the other device's proxy configuration.

Router-level settings typically don't need any changes — devices on the same LAN reach each other directly without going through router forwarding rules. Routing and port forwarding only come into play when the proxy server and client are on different subnets (for example, connecting back to your home network over a VPN), which is a separate topic outside the scope of regular LAN sharing.