Clash Mixed-Port & LAN Proxy Sharing: allow-lan Setup and Device Access Guide

Why Share a Proxy From One Machine

Many users get Clash running on a Linux box or router first, then realize installing separate clients on phones, tablets, TVs, and consoles is tedious and eats into subscription traffic quotas. These devices are often locked-down systems with no usable proxy client, or simply can't import a YAML config at all. A more practical approach is to treat the machine that's already working as the LAN's "proxy exit," so every other device just enters an IP and port in its network settings to reuse the same nodes and rules, without configuring a subscription on each one. This boils down to two config fields: mixed-port decides which port to listen on, and allow-lan decides whether that port serves only the local machine or the whole network.

What the mixed-port Field Actually Does

Older versions of Clash needed a separate port for HTTP proxy and socks-port for SOCKS5 proxy, with no overlap between the two. mixed-port was introduced later as a combined port that accepts both HTTP(S) and SOCKS5 proxy requests on the same port, automatically matching whatever protocol the client sends, no manual switching needed. Modern Clash Meta (mihomo) cores default to mixed-port, and keeping port/socks-port around is mainly for compatibility with older toolchains.

mixed-port: 7890
allow-lan: false
bind-address: "*"
mode: rule
log-level: info

The block above is the bare-bones setup. By default allow-lan is false, so Clash only listens on the loopback address (127.0.0.1) — meaning even with the port open, no other device on the LAN can connect. That's a deliberate security default, not a bug.

allow-lan and bind-address: the Switch That Opens LAN Access

allow-lan controls whether Clash accepts connections from addresses other than the local machine. Set it to true and Clash starts listening on your LAN network interface addresses instead of being limited to 127.0.0.1. bind-address further specifies which interface addresses to listen on — the default value "*" means listening on every available network interface, including Ethernet, Wi-Fi, and virtual adapters. If you want to restrict it to one interface, enter a specific LAN IP such as 192.168.1.20, so even if the machine has other network connections (a VM's internal network, a VPN adapter, etc.), the proxy port is only exposed on the chosen interface.

mixed-port: 7890
allow-lan: true
bind-address: "*"
mode: rule

After editing and saving these two lines, restart the Clash core or have the client reload its config for the change to take effect. Desktop clients usually have a separate "Allow LAN" toggle on the config detail page — checking it is equivalent to setting allow-lan to true, and it still writes to the same underlying YAML.

Connecting LAN Devices Step by Step

First confirm the actual LAN address of the machine running Clash — not 127.0.0.1 and not a public IP:

ip addr show | grep "inet "
# or
hostname -I

Say the output shows a LAN address of 192.168.1.20 and a listening port of 7890. Here's how to connect from different devices:

Phone (Android/iOS)

1. Connect to the same Wi-Fi network as the Clash host.
2. Go to Wi-Fi settings → current network details → proxy settings, and choose "Manual."
3. Enter 192.168.1.20 as the server address and 7890 as the port.
4. Save, then open a browser and visit a site to confirm traffic is going through the proxy. In rule mode, cross-check with Clash's connection logs in the dashboard.

TV Box / Smart TV

Most TV operating systems have a similar manual proxy option, usually under Settings → Network → Advanced → Proxy. Some manufacturer-customized systems don't expose a proxy option at all — for those, consider forwarding all traffic through the router instead, or fall back to a client on the box that supports importing config files.

Linux / Windows / macOS Devices

On desktop systems, just enter the LAN IP and port in the OS network proxy settings. If your browser has its own separate proxy setting, make sure it matches — a mismatch between system and browser proxy ports is a common source of confusing connection failures.

Firewall Rules and Connectivity Checks

If things don't connect after the config change, nine times out of ten it's the firewall blocking the port, not the Clash config itself. Start by opening the port on the Clash host:

# ufw (Debian/Ubuntu family)
sudo ufw allow 7890/tcp

# firewalld (Fedora/RHEL family)
sudo firewall-cmd --add-port=7890/tcp --permanent
sudo firewall-cmd --reload

Once the port is open, use nc or telnet from another device to check whether it's reachable:

nc -zv 192.168.1.20 7890

If the connection succeeds, the network layer is fine — if the phone still can't get online, go back and check the proxy mode (global/rule) and whether the node itself is working. If the probe times out, it's most likely a firewall rule that hasn't taken effect, or bind-address bound to the wrong interface. Try temporarily setting bind-address to "*" to rule out scope issues.

Security Boundaries and Access Control Recommendations

Once allow-lan is on, every device on the same LAN can connect to that port by default — including guest Wi-Fi users, freeloaders, or compromised IoT devices. If your LAN isn't fully trusted, consider layering on these restrictions:

• Add an authentication field to the config to require a username and password for proxy connections — unauthorized connections get rejected.
• Use bind-address to bind precisely to one interface's specific IP instead of the broad "*", shrinking the exposed surface.
• At the router level, put trusted devices on a separate VLAN or enable guest isolation, so devices on the guest network can't even probe the proxy port.
• If you don't need long-term sharing, switch allow-lan back to false once you're done instead of leaving it on indefinitely.

mixed-port: 7890
allow-lan: true
bind-address: 192.168.1.20
authentication:
  - "labuser:a-strong-password"

After adding authentication, connecting devices will usually also need the matching username and password entered in their system proxy settings — the exact location varies by OS. A wrong credential results in an outright connection refusal rather than a silent failure, so double-check this first if things stop connecting.

Troubleshooting Common Access Problems

LAN proxy sharing issues almost always fall into one of the cases below — check them in order:

• Phone connects to Wi-Fi but the proxy doesn't work: Check whether the server address in the system proxy settings has a typo. LAN IPs can change after a router reboot, so it's worth assigning the Clash host a static IP or a DHCP reservation on the router.
• One device on the LAN works, another doesn't: The failing device is likely on a guest network or a different Wi-Fi subnet than the Clash host, so it simply can't reach the port.
• Works fine, then breaks after a router reboot: Same IP-drift issue — fix it once by giving the host a fixed LAN address.
• No effect after changing the config: Make sure the edit was saved to the config file Clash actually loads, not a template or backup copy, and remember the core or client needs a restart/reload before changes take effect.

Work through these items one by one, combined with the port-probing commands mentioned earlier, and you should be able to pin down most LAN proxy sharing connectivity issues.