Clash LAN Proxy Sharing: mixed-port 7890 and Allow LAN Explained

Choose your setup: connect devices manually to your phone’s proxy

To use your Android phone running Clash as a proxy for a computer on the same LAN, you usually need just three settings: open a proxy listening port on the phone, allow LAN connections, and enter the phone’s LAN IP address and port on the computer. This guide uses 7890 as the mixed-port example. It’s a common setting, not a fixed port for every client.

This is an explicit proxy setup: a browser or app on the computer connects to the phone, then Clash selects an outbound route according to its rules. Enabling VPN or TUN on the phone does not automatically route traffic from every connected device through it. Android hotspot traffic in particular may not pass through the phone’s VPN, so start by testing with a manual proxy.

1. Connect the phone and computer to the same trusted Wi-Fi network. Avoid guest Wi-Fi for now.
2. Find the phone’s IPv4 address in the Wi-Fi network details, for example 192.168.1.23.
3. In Clash, check the mixed port, Allow LAN setting, and actual listening address.
4. Set up an HTTP proxy on the computer. Enter the phone’s IP address and port 7890.
5. Open a webpage, then check the connection log on the phone for a new request.

What’s the difference between mixed-port, HTTP, and SOCKS ports?

mixed-port accepts both HTTP proxy and SOCKS proxy requests on the same listening port. You can use it for an HTTP proxy on a computer, or with an app that supports SOCKS5, but the app still needs to use the correct proxy protocol. A mixed port does not automatically recognize arbitrary network traffic as proxy requests.

The three ports in the table are examples for clarity; you don’t need to enable all of them. For most manual sharing setups, mixed-port: 7890 is enough. Don’t set all three listening fields to 7890, or they may conflict and prevent the service from starting.

HTTP proxies also work with HTTPS websites

“HTTP” in the proxy settings describes how the client connects to the proxy endpoint; it doesn’t limit you to HTTP websites. For HTTPS sites, apps typically use HTTP CONNECT to establish a tunnel. Standard proxying does not require installing a certificate on the computer, and you should never disable website certificate checks just to share a proxy.

SOCKS5 UDP forwarding also depends on the app, core, node protocol, and network conditions. Setting an HTTP proxy in the system settings won’t cover game traffic over UDP, all messaging traffic, or apps that ignore the system proxy.

Android settings: Allow LAN and listening address

In the classic Clash for Android interface, open “Profiles” and confirm that the profile you want is selected. Then go to “Settings” → “Override” and look for the port and “Allow LAN” options. Menu names and locations may differ across forks. If these options aren’t there, check the client’s configuration editing or override documentation and use the settings that actually take effect. Don’t look for an exact match in another client’s menus.

Example configuration fields

These are the top-level fields needed for a shared proxy endpoint, not a complete, standalone subscription. Add them to a configuration that already has nodes, proxy groups, and rules. If a field with the same name already exists, edit its value instead of adding a duplicate.

mixed-port: 7890
allow-lan: true
bind-address: '*'
mode: rule

• mixed-port: The port the phone uses to accept proxy requests. Enter the same number on the computer.
• allow-lan: true: Allows devices other than the phone itself to connect to the proxy endpoint.
• bind-address: '*': On cores that support this field, listens on available interfaces. It does not restrict access to the current Wi-Fi network.
• mode: rule: Selects an outbound route according to the rules. Connecting a computer through the phone does not mean every website will use a proxy node.

If the service listens only on 127.0.0.1, apps on the phone can connect, but a computer can’t reach it through the phone’s Wi-Fi address. Clients that support binding to a specific address can use the phone’s current Wi-Fi IPv4 address to narrow the listening scope. If that address changes, update it too, or the listener may fail to start.

After saving, reload the configuration or restart the service as required by the client. Check the logs for a successful listener startup or a port conflict. Some clients override YAML values with settings from the interface; others replace the file when a subscription is updated. A value in the file is not necessarily active, so check again whenever you change configurations.

Set up the proxy address on a computer or another phone

Suppose the phone running Clash has the Wi-Fi address 192.168.1.23 and the mixed port is 7890. Other devices should use this address—not the router’s address, the node server’s address, or 127.0.0.1. The latter always points to the device where it’s entered.

Windows 11: Set up a manual proxy

1. Open “Settings” → “Network & internet” → “Proxy.”
2. Under “Manual proxy setup,” select “Set up” and turn on “Use a proxy server.”
3. Enter 192.168.1.23 as the proxy IP address and 7890 as the port, then save.
4. Reopen the browser and visit a webpage. Check the connection page on the phone for the request.

Not every Windows program uses the system proxy. If a browser works but another program doesn’t, check that program’s proxy settings first instead of changing the node or DNS right away.

Another Android phone: Change the Wi-Fi proxy

On the phone that will use the proxy, open “Settings” → “WLAN” or “Network & internet” → the current Wi-Fi network details. Find “Proxy” under Edit network and select “Manual.” Enter 192.168.1.23 as the proxy hostname and 7890 as the proxy port. Don’t combine them into a URL with a protocol prefix. Menu locations vary by manufacturer; you may need to expand “Advanced options.”

This setting usually applies only to the current Wi-Fi network, and apps may ignore it. If an app has its own SOCKS5 settings, select SOCKS5 and enter the phone’s IP address and mixed port. When you’re done sharing, set the receiving device’s proxy to “None” or turn off the manual proxy. Otherwise, it may be unable to load webpages when the phone is offline.

Troubleshoot by connection stage: timeouts, refused connections, and routing

Check three stages: can the computer reach the phone’s port, can the phone accept the proxy protocol, and can the node reach the destination? Don’t change the port, DNS, and proxy mode all at once, or you won’t know which change fixed the problem.

Test the HTTP proxy with a command first

In a Windows terminal, use curl.exe to avoid older versions of PowerShell interpreting curl as a different command. The address below is an example; replace it with the phone’s current IPv4 address before running the command.

curl.exe -I --connect-timeout 5 --max-time 15 --proxy http://192.168.1.23:7890 https://example.com/

On macOS or Linux, replace curl.exe with curl. The command sets a 5-second connection timeout and a 15-second total time limit. An HTTP response header means the request made it through the proxy path, but it doesn’t guarantee that every domain is reachable or that the request used a remote node. Check Clash’s rule-match logs to confirm the final outbound route.

SOCKS5 testing and where DNS is resolved

curl.exe -I --connect-timeout 5 --max-time 15 --proxy socks5h://192.168.1.23:7890 https://example.com/

In curl, socks5h sends the destination hostname to the proxy for resolution; socks5 usually resolves the hostname locally first. If HTTP proxying works but a SOCKS app fails for some domains, check whether “Resolve DNS through proxy” is enabled. Filling in an HTTP proxy does not automatically route all DNS traffic from the receiving device through the phone.

Firewalls, guest Wi-Fi, and hotspot limitations

Devices on the same Wi-Fi name may still be unable to connect

A router’s “AP isolation,” “client isolation,” or guest network policy can block wireless devices from reaching each other, even if they show the same Wi-Fi name. Connect both devices to a trusted main network before testing the phone’s port. A failed ping alone doesn’t prove the proxy is unavailable, since ICMP may be filtered too. Check the actual port and connection logs.

In this setup, Windows initiates the connection, so you usually don’t need to open inbound port 7890 on the computer. The phone running the proxy is the device that must allow access. If the phone has a firewall or enterprise management software, check its restrictions on incoming LAN connections. Some VPN-based firewalls may also conflict with Clash’s VPN service. Don’t permanently disable device protection as a troubleshooting step.

When using a phone hotspot, check the address again

The hotspot network and the phone’s connected home Wi-Fi use different interfaces. When the computer is connected to the phone’s hotspot, run ipconfig in Windows and check the “Default Gateway” for that wireless connection. It’s usually the hotspot phone’s address on that subnet. Android hotspots don’t always use 192.168.43.1, so don’t rely on an address you found online.

1. Turn on the phone’s hotspot, connect the computer, and note the gateway address for that connection.
2. Make sure Clash is reachable through the hotspot interface, not just bound to the original Wi-Fi address.
3. Change the computer’s manual proxy address to the hotspot gateway. Keep the actual mixed port.
4. Run the proxy test again. If no connections appear in the logs, check hotspot device-to-device access and listener restrictions first.

Some systems restrict hotspot clients from accessing services on the phone itself, or prevent VPN and network sharing from working at the same time. An explicit proxy can work if the phone is reachable and the system allows it, but support isn’t guaranteed on every Android device. For USB tethering, check the address again on its own subnet.

Finish up and troubleshoot common issues

• Disconnects when the phone locks: Go to the system “Settings” → “Apps” → the relevant client → battery settings, and check for background restrictions. Menu names vary by system. After changing them, lock the screen and check whether the connection stays active.
• Stops working after changing Wi-Fi: Check the phone’s IP address again. On a home network, reserve an address for the phone in the router’s DHCP settings to reduce address changes. If randomized MAC is enabled, also check which device address the router recognizes.
• Do I need to open port 9090? No. Some configurations use 9090 for the external controller interface. It is not a proxy endpoint for browsers and should not be exposed for sharing.
• Do I need Global mode? No. You can share the proxy in Rule mode; requests from the phone are still handled according to the current rules. To check a specific rule, look at the connection’s policy and outbound route.
• Can I share a proxy on public networks? Avoid exposing an unauthenticated proxy endpoint. If authentication is needed, check whether your core supports authentication and confirm that the receiving client supports proxy authentication. Authentication does not replace network access controls.

After testing, first turn off the manual proxy on the computer or other phone, then disable Allow LAN on the phone. Next time, check in this order: phone IP → listening port → receiving device settings → connection logs. This is usually more useful than repeatedly reinstalling the client. For full installation steps, see the Quick Start Guide. For more on configuration fields, see the Complete Documentation.