Networking 12 min read

Clash Mixed Port and LAN Sharing: Proxy Devices on the Same Wi‑Fi

Learn what mixed-port, allow-lan, and bind-address do, configure proxy settings for TVs, game consoles, and phones, and review firewall access requirements.

What Traffic Does the Mixed Port Accept?

mixed-port is the local inbound port used by Clash and mihomo. It identifies HTTP proxy and SOCKS5 proxy protocols on the same TCP port. A desktop browser can use it as an HTTP proxy, while apps that support SOCKS5 can connect to that same port, eliminating the need to maintain separate port and socks-port settings.

A common configuration uses 7890 for the mixed port. If the computer running Clash has the address 192.168.1.20, LAN devices should use 192.168.1.20:7890 as the proxy address. This is the host's IPv4 address on the home network—not 127.0.0.1 and not the address of a Clash proxy node.

mixed-port: 7890
allow-lan: true
bind-address: '*'
mode: rule
log-level: info

external-controller: 127.0.0.1:9090

mixed-port vs. port vs. socks-port

Field Protocol Typical use
mixed-port HTTP and SOCKS5 One port for phones, TVs, and desktop apps
port HTTP Traditional HTTP proxy only
socks-port SOCKS5 For apps that explicitly support SOCKS5

There is no need to set all three fields to 7890 in the same configuration. A port cannot be claimed by multiple listeners. To support different types of devices, keep mixed-port: 7890; if you need to audit the two protocols separately, assign different values to port and socks-port.

What allow-lan and bind-address Actually Do

allow-lan: true lets other hosts access Clash's proxy inbound. It controls whether LAN connections are accepted. Enabling “system proxy” in a desktop client usually changes only that computer's system proxy settings; it does not automatically route a TV or phone through the computer.

bind-address determines which network addresses accept inbound connections. '*' listens on available interfaces, which suits home networks where the address may change through DHCP. Some clients convert this in their generated runtime configuration to an equivalent listening mode. To bind only to a specific network adapter, enter the computer's LAN address, such as 192.168.1.20; if that address changes, update the configuration as well.

Minimum Working Checklist

  1. Confirm that mixed-port has an explicit port in the Clash configuration, such as 7890.
  2. Enable LAN access with allow-lan: true.
  3. Make sure the listening address is not limited to the loopback address 127.0.0.1.
  4. Reload the configuration or restart the core so the updated inbound listener takes effect.
  5. On the host computer, run ipconfig, ip addr, or open the network settings and record the current IPv4 address.
  6. Make sure the host computer and target device are connected to the same home network and that client isolation is disabled on the router.

First Confirm That Clash Is Listening on the LAN

On Windows, run Get-NetTCPConnection -LocalPort 7890 -State Listen in PowerShell. If LocalAddress shows 0.0.0.0 or the host's LAN address, the port can accept connections through the corresponding interface. If it shows only 127.0.0.1, other devices cannot connect.

On Linux, run ss -lntp | grep 7890; on macOS, run lsof -nP -iTCP:7890 -sTCP:LISTEN. Check the listening state before checking the firewall. “Allow LAN” in the client does not mean that the system firewall permits inbound connections.

Proxy Settings for Phones, TVs, and Game Consoles

LAN sharing relies on a manual proxy. The target device still gets its IP address, gateway, and DNS from the existing Wi-Fi network; only apps that support proxies send requests to Clash. The host computer must stay powered on and connected, with the Clash core running. When the computer sleeps, other devices immediately lose this proxy endpoint.

Android and iPhone

A common Android path is “Settings” → “Network & internet” → “Wi‑Fi” → current network → “Modify” → “Advanced options” → “Proxy” → “Manual.” On iPhone and iPad, go to “Settings” → “Wi‑Fi” → the info button beside the current network → “Configure Proxy” → “Manual.” Enter the host computer's address, such as 192.168.1.20, and set the port to 7890.

System-level Wi-Fi proxy settings primarily use HTTP proxying. Most browsers and apps that follow system network settings will work, but some apps create their own connections, bypass the system proxy, or use UDP traffic that HTTP proxying cannot carry. If webpages open but a particular app still connects directly, that does not mean the mixed-port configuration failed; first check whether the app follows the system proxy.

Android TV, Google TV, and Smart TVs

Android TV menu names vary by manufacturer. A common path is “Settings” → “Network & internet” → connected Wi‑Fi → “Proxy settings” → “Manual.” Enter the computer's LAN IP as the proxy hostname and 7890 as the proxy port. If the TV provides only a “hostname” field, enter the numeric IP directly—do not add http:// or append the port in the same field.

Some TV systems have no manual proxy option, or only the browser follows the proxy settings. In that case, Clash's mixed-port cannot take over the entire TV by itself. To cover every app, use a router or gateway with transparent proxy support, or run a client directly on a supported device.

PlayStation, Nintendo Switch, and Other Gaming Devices

On PlayStation, find “Proxy Server” during the custom connection setup and enter the host computer's IP address and 7890. On Nintendo Switch, go to “System Settings” → “Internet” → “Internet Settings” → current network → “Change Settings” → “Proxy Settings” to configure the server and port.

Game traffic often includes UDP, peer-to-peer connections, and strict NAT checks. A manual HTTP proxy usually covers only TCP requests such as account sign-in, store pages, and download APIs; it is not the same as a transparent proxy for the entire device. Matchmaking, voice chat, and NAT type will not necessarily change just because an HTTP proxy is configured. To forward all TCP and UDP traffic from the device, use a transparent proxy solution on the router rather than continuing to adjust mixed-port.

Allowing Clash Through the Windows, macOS, and Linux Firewall

After a LAN connection reaches the computer's network adapter, it must also pass through the operating system firewall. Allow access to the proxy port only from the home subnet rather than opening it to every remote address. The examples below assume the home network is 192.168.1.0/24 and the mixed port is 7890.

Windows Inbound Rules

In Windows, go to “Windows Security” → “Firewall & network protection” → “Advanced settings” → “Inbound Rules” → “New Rule.” Select “Port,” choose TCP, enter 7890 as the specific local port, and select only the currently used “Private” profile. In Scope, restrict remote IP addresses to the home subnet.

You can also use an elevated PowerShell window to create a rule limited to the home subnet:

New-NetFirewallRule `
  -DisplayName "Clash mixed-port LAN" `
  -Direction Inbound `
  -Action Allow `
  -Protocol TCP `
  -LocalPort 7890 `
  -RemoteAddress 192.168.1.0/24 `
  -Profile Private

If Windows identifies the Wi-Fi network as “Public” while the rule applies only to “Private,” connections will still be blocked. On a home router, check the network profile under “Settings” → “Network & Internet” → “Wi‑Fi” → the current network. Do not disable the entire firewall just to test; check the rule, port, and network profile first.

macOS and Linux

On macOS, go to “System Settings” → “Network” → “Firewall” → “Options” and confirm that the Clash client is allowed to accept incoming connections. Application names vary between clients; the process listening on the port may be the main client or a separate core process. After upgrading or replacing the core, macOS may ask again whether to allow connections.

On a Linux host using UFW, run the rule below to allow TCP 7890 only from the specified home subnet:

sudo ufw allow from 192.168.1.0/24 to any port 7890 proto tcp
sudo ufw status numbered

If the system uses firewalld, nftables, or a cloud security group, configure the firewall layer that is actually enforcing access instead of stacking several rule sets. LAN sharing does not require port forwarding on the router; port forwarding exposes an internal listener outside the router, which is different from sharing it within the same Wi‑Fi network.

Troubleshoot Connectivity Layer by Layer

Step 1: Confirm That the Devices Can Reach Each Other

Before testing the proxy from a phone or another computer, confirm that both devices are on the same subnet. For example, a host at 192.168.1.20/24 and a phone at 192.168.1.36/24 can usually communicate directly. If one address is 192.168.1.x and the other is 192.168.50.x, check for guest Wi-Fi, mesh isolation, or different VLANs.

Many routers use “guest network,” “AP isolation,” or “wireless client isolation” to prevent Wi-Fi devices from reaching LAN hosts. The devices may still access the internet but be unable to connect to 192.168.1.20:7890. Move both devices to the regular home network, or allow communication between the relevant subnets in the router.

Step 2: Test the Port Before Testing a Node

From another computer, use Test-NetConnection 192.168.1.20 -Port 7890 to test a Windows host, or use nc -vz 192.168.1.20 7890. If the TCP connection fails, the issue is with the listening address, firewall, or LAN isolation; there is no need to change proxy nodes first.

After the port is reachable, run the following from a device with command-line proxy support:

curl -x http://192.168.1.20:7890 https://example.com/
curl --socks5-hostname 192.168.1.20:7890 https://example.com/

The first command verifies the HTTP proxy endpoint on mixed-port; the second verifies the SOCKS5 endpoint. With --socks5-hostname, DNS requests are handled by the SOCKS5 proxy, which helps distinguish local DNS issues from proxy-path issues.

Step 3: Check Clash Logs and Rule Matches

If the port connects but the target website does not open, check the client's connection list or logs. If no new connection appears, the target device probably did not save the proxy settings, or the app bypasses the system proxy. If a connection appears but ultimately uses DIRECT, check the current mode and rule match. If it times out after entering a proxy group, check the selected group and node status.

  • Connection refused: Clash is not listening on that address, or the port is incorrect.
  • Connection timed out: The firewall, client isolation, or subnet routing is blocking access.
  • Logs appear but the webpage fails: Check the rules, DNS, proxy group, and upstream node.
  • Browser works but the app fails: The app may ignore the system proxy or primarily use UDP.
  • Stops working after a while: The host's DHCP address changed, the computer went to sleep, or a client update disabled LAN access.

Addressing and Access Control for Long-Term Use

Manual proxy settings depend on the host's IP address. If the router assigns a different address each time, proxy settings on phones and TVs will stop working. Create a DHCP reservation for the host computer in the router, such as always assigning 192.168.1.20. This is easier to maintain than setting a static IP on the computer because the gateway, DNS, and subnet parameters remain consistent.

Open the shared port only on a trusted LAN. mihomo supports authentication for inbound proxies, which is useful on networks with many users or devices you cannot fully trust:

mixed-port: 7890
allow-lan: true
bind-address: '*'

authentication:
  - "livingroom:change-this-password"

After authentication is enabled, the TV or game console must provide fields for the proxy username and password; devices without authentication support cannot use this endpoint. In a home network, you can also restrict remote addresses in the firewall to specific devices, such as allowing only 192.168.1.36 and 192.168.1.48, reducing access from other devices on the subnet.

LAN sharing is suitable for temporarily providing HTTP and SOCKS5 proxy access to a phone, TV, or a small number of devices. To automatically cover every device in the home, support apps that do not understand proxies, or handle gaming UDP traffic, deploy the proxy on a router or dedicated gateway. mixed-port is an explicit application proxy endpoint—not a transparent gateway—and it does not replace router forwarding or NAT configuration.

Download Clash Client View installers for every platform