Clash LAN Proxy Sharing: Use allow-lan to Proxy Your Phone or TV Through Your PC

How proxy sharing works: devices connect to your PC on port 7890

Clash LAN proxy sharing works like this: your phone or TV sends requests to a proxy port on your PC, where Clash or mihomo applies the current rules and routes the traffic through a proxy node or directly. Remote devices use the HTTP or SOCKS proxy endpoint exposed by your PC; they don't import the subscription configured on it.

This guide uses a consistent example: the PC's local IPv4 address is 192.168.1.20, the phone's address is 192.168.1.35, and the mixed port is 7890. Use your PC's actual address when following the steps. The PC can connect to the router over Ethernet while the phone uses Wi-Fi. What matters is that the devices can reach each other, not that they use the same type of connection.

• mixed-port: Accepts both HTTP and SOCKS proxy connections on the same port. In this guide, the phone uses its HTTP proxy endpoint.
• allow-lan: Allows other devices to connect to the proxy. Turning on your PC's system proxy alone usually does not make it accessible over the LAN.
• bind-address: Sets which local addresses the proxy listens on. Use it together with allow-lan: true.
• external-controller: The address used by the management API. This is not the proxy address to enter on your phone.

Check your PC's IP address, network isolation, and local proxy first

Find the IPv4 address of your active network adapter

On Windows, go to Settings → Network & Internet → select your current Wi-Fi or Ethernet connection → view its network properties to find the IPv4 address. You can also run the command below. If your PC has virtual machine, VPN, or TUN adapters, use the address of the physical adapter connected to your home router—not a virtual adapter.

ipconfig

On macOS, go to System Settings → Network → select your current connection → Details → TCP/IP to find the IP address. On Linux, run ip -4 addr and check the inet field for your active Ethernet or Wi-Fi adapter. 127.0.0.1 is the device's loopback address; entering it on your phone connects the phone to itself.

Make sure the devices can communicate

• Temporarily turn off mobile data on your phone and connect it to the home Wi-Fi network that can reach your PC.
• Don't use your router's guest network. Guest network, AP, or wireless client isolation may prevent devices from accessing your PC.
• Different subnets need routing and access rules to communicate. For example, 192.168.1.0/24 and 192.168.50.0/24 won't necessarily reach each other just because they're on the same router.
• First make sure the Clash subscription works on your PC, a proxy node is selected, and rule mode can access the sites you need. Then troubleshoot the sharing connection.

Consider reserving a fixed lease for your PC in your router's DHCP settings, such as 192.168.1.20. If the PC's address changes each time it connects, update the proxy server address saved on your phone as well.

Configure allow-lan, bind-address, and mixed-port

In the client interface, the setting may be called “Allow LAN” or “Allow LAN connections,” and the mixed port may be under port settings. Menu layouts vary by client, so check the active configuration and listening status to confirm the change. In a mihomo configuration file, the three fields below belong at the YAML top level. Don't indent them under proxies or dns.

# Add these fields to the top level of your existing config; don't replace the entire subscription
mixed-port: 7890
allow-lan: true
bind-address: "192.168.1.20"

This example listens only on the specified IPv4 address. Your PC must actually have that address, or the listener may fail to start. To listen on multiple network adapters, use bind-address: "*", but this expands which networks can connect, so tighten your firewall rules accordingly. Binding only to 127.0.0.1 won't accept LAN connections from your phone.

1. Save your existing configuration and make sure no other proxy process is using 7890.
2. Save the changes through the client's settings or configuration override feature. Avoid editing temporary files that may be replaced when the subscription updates.
3. Apply the configuration. If the listener doesn't change, restart the core as required by your client.
4. Check the runtime logs for address binding failures or port conflicts.

In Windows PowerShell, you can check the listening address. The output's LocalAddress should include the specified LAN address; if the listener is bound to all interfaces, you may see a wildcard address instead. If you see only 127.0.0.1, the LAN endpoint isn't active yet.

Get-NetTCPConnection -State Listen -LocalPort 7890 |
  Select-Object LocalAddress, LocalPort, OwningProcess

On Linux, run ss -lntp 'sport = :7890'. On macOS, run lsof -nP -iTCP:7890 -sTCP:LISTEN. If the client overrides the YAML file, make the change through the client's configuration settings instead of repeatedly editing a file that isn't being loaded.

Allow only trusted LAN traffic on TCP port 7890 through your firewall

A successful listener check only means the program is ready to accept connections; your operating system's firewall may still block other devices. The Wi-Fi HTTP proxy test in this guide needs only inbound TCP on 7890. You don't need to open every port or disable your PC's firewall.

Windows: limit the source subnet and network profile

First, make sure you're on a trusted home network and set its Windows network profile to Private. Then open PowerShell as an administrator and change the source address below to match your subnet. This example accepts connections only from 192.168.1.0/24 and applies only to the Private network profile.

New-NetFirewallRule `
  -DisplayName "Clash LAN TCP 7890" `
  -Direction Inbound `
  -Action Allow `
  -Protocol TCP `
  -LocalPort 7890 `
  -RemoteAddress 192.168.1.0/24 `
  -Profile Private

To allow just one phone, change -RemoteAddress to the phone's IP address and reserve that address in DHCP. When you no longer need to share the proxy, remove this rule:

Remove-NetFirewallRule -DisplayName "Clash LAN TCP 7890"

macOS and Linux: check app permissions and port rules

On macOS, go to System Settings → Network → Firewall → Options and check whether incoming connections are allowed for the client or core that handles them. If “Block all incoming connections” is enabled, review and adjust that setting first. Third-party firewalls can block connections independently, so system settings alone don't confirm that the port is allowed.

If you're already using UFW on Linux, you can add a rule limited to trusted sources. Otherwise, configure your existing firewall system, such as nftables or firewalld. Don't switch firewall tools just to run a one-off test.

sudo ufw allow from 192.168.1.0/24 to any port 7890 proto tcp

Set the proxy server address on your phone or TV

The instructions below configure an HTTP proxy. Enter only 192.168.1.20 in the server field and 7890 in the port field. Don't add http://, a path, or the port to the server field. Use http://192.168.1.20:7890 only in apps that require a complete proxy URL.

Android and iOS: what to expect

On some Android devices, proxy settings are under “Modify network” or the edit icon. Keep IP settings on DHCP; you usually don't need to switch to a static IP to configure a proxy. On iOS, proxy settings apply only to the current Wi-Fi network. They won't automatically apply to mobile data or other Wi-Fi networks.

Some apps read proxy settings when they start. After changing the settings, fully quit and reopen the app. If a browser works but another app doesn't, first check whether that app supports the system HTTP proxy instead of immediately switching to global mode.

What if your TV has no proxy settings?

Some TV firmware doesn't offer a manual HTTP proxy setting, or only the browser follows it. In that case, enabling allow-lan on your PC won't force the TV to use the proxy. You'll need a client supported by the TV, proxy settings within the app, or a separately configured router gateway. Sharing your PC's proxy port doesn't change the TV's default gateway.

Test in stages: check the port, watch the logs, and verify the rules

Don't assume all traffic is proxied just because a webpage loads once. First test the port and proxy protocol from another computer, then try a browser on your phone while checking Clash's connection log. Run the commands below from another device on the LAN to also test firewall and network isolation between devices.

# Windows: check whether the TCP port is reachable
Test-NetConnection 192.168.1.20 -Port 7890

# macOS, Linux, or another device with curl: explicitly use the HTTP proxy
curl -I --connect-timeout 5 \
  --proxy http://192.168.1.20:7890 \
  https://example.com/

TcpTestSucceeded: True confirms only that the TCP connection succeeded; it doesn't guarantee that the proxy node works. In the curl test, HTTPS uses an HTTP CONNECT tunnel. A normally configured shared proxy doesn't require installing a certificate on your phone. If you see a certificate error, check the device's clock, the destination site, and any existing certificate settings. Don't disable certificate validation to work around the error.

1. Connection timed out: Check the PC's IP address, listening address, firewall, and router client isolation in that order.
2. Connection refused: Check that the core is running, the mixed port is actually 7890, and the listener isn't bound only to the loopback address.
3. The proxy receives requests, but access fails: Check node connectivity, whether the subscription has expired, the matched policy group, and DNS logs.
4. Web pages load, but an app doesn't: Check whether the app ignores the system proxy or uses UDP traffic that an HTTP proxy can't carry.

In rule mode, requests from shared devices still follow the rules and policy groups currently configured on your PC. Requests matching DIRECT connect directly from the PC; they don't necessarily go through a proxy node. The process name shown in the desktop client may not reflect the actual app on your phone, so it can't reliably identify which phone app made a request.

TUN, DNS, and proxy-sharing security: common limitations

Enabling TUN on your PC doesn't automatically route your phone through it

A PC's TUN usually takes over connections sent through the PC's own virtual network adapter. When your phone is simply on the same Wi-Fi, its default route still points to the router; its traffic doesn't automatically pass through your PC's TUN. This guide uses an explicit proxy connection from the phone to 192.168.1.20:7890, so you don't need to enable TUN for this setup.

Making your PC the phone's gateway requires IP forwarding, routing, address translation, and DNS—a different network topology. Changing only the gateway address without configuring forwarding can disconnect the phone from the internet. For full UDP support and device-wide traffic routing, use a VPN/TUN client designed for the device or a properly planned gateway setup.

An HTTP proxy doesn't send all of your phone's DNS queries through your PC

When an app sends a domain name to an HTTP proxy, the proxy can handle name resolution and routing according to its own configuration. But apps may resolve names locally, use encrypted DNS built in to the app, or bypass the system proxy entirely. So setting a Wi-Fi proxy doesn't mean mihomo handles every DNS query from your phone. When troubleshooting, consider the destination domain, actual connection logs, and DNS settings. Don't blindly apply Fake-IP settings intended for TUN.

Keep access to a minimum while sharing

• Don't forward a public port on your router to port 7890 on your PC, and don't expose the management API to the public internet.
• If authentication is required, you can configure mihomo's authentication setting, but first make sure the device's manual proxy settings support proxy authentication. Some TVs don't.
• Devices relying on this proxy may lose internet access if the PC goes to sleep, shuts down, switches Wi-Fi networks, or exits the core.
• When you're done sharing, set the proxy on your phone and TV to “None” or “Off,” then disable Allow LAN and remove any firewall rules you no longer need.

Reliable sharing depends on four things: a stable PC address, the proxy listening on the right interface, firewall access limited to trusted devices, and apps that actually follow proxy settings. Start by testing a single HTTP proxy request in a browser, then add the TV and other apps. This makes problems easier to isolate than changing TUN, DNS, and routing all at once. For more configuration options, see Advanced Config. If you're importing a subscription for the first time, start with the Clash setup guide.