Clash Mixed-Port & LAN Sharing Guide: Share One Proxy Between Phone and PC

What Mixed-Port Is: One Port, Two Protocols

The Clash core (mihomo, aka Clash Meta) exposes three types of inbound proxy ports: the HTTP proxy port (config key port), the SOCKS5 port (socks-port), and the mixed port (mixed-port). The first two each speak only one protocol; the mixed port sniffs the request on the same TCP port instead — an HTTP CONNECT or plain HTTP forwarding request is handled as HTTP proxy traffic, while a SOCKS5 handshake is handled as SOCKS5. Downstream devices don't need to know which protocol they're using; they just point at the same port.

Most mainstream GUI clients enable only the mixed port by default: Clash for Windows historically defaulted to 7890, Clash Verge Rev defaults to 7897, and FlClash defaults to 7890 — check each client's port settings page for the exact value. The equivalent config file syntax is below; mixed-port can coexist with the standalone ports:

# Keep only the mixed port; both HTTP and SOCKS5 requests go through 7890
mixed-port: 7890

# Split them into separate ports when needed; all three can coexist
# port: 7890
# socks-port: 7891

allow-lan: true
bind-address: "*"

For most use cases, enabling only mixed-port is enough: older software that only understands HTTP proxies still works fine pointed at the mixed port, and a phone's system proxy settings only have an HTTP field anyway, so the mixed port is naturally compatible. Splitting port and socks-port apart is only worth doing if you need per-protocol traffic stats or want different protocols routed to different upstreams.

Where to Find the Mixed-Port Toggle in Each Client

GUI clients usually group the port setting with the LAN toggle, and changes take effect immediately or prompt a core reload:

Client	Location	Notes
Clash Verge Rev	Settings → Port Settings	Mixed port defaults to 7897; the "Allow LAN" toggle is on the same page
Clash for Windows	General → Port / Allow LAN	No longer maintained; mixed port defaults to 7890
FlClash	Settings → Network	Port setting is grouped with "Allow LAN Connection"
ClashX Meta	Menu bar icon → Preferences	Port is in the settings window; Allow LAN is a checkbox in the menu bar dropdown
Clash for Android	Settings → Network	Supports custom ports; sharing to phones over LAN is less commonly used here

If you manage the config file directly, just set mixed-port and allow-lan: true in your mihomo config — that's exactly what the GUI toggles do under the hood. After changing the port, remember to update the old port number on every downstream device too.

Allow LAN: Letting Your Phone Use Your PC's Proxy

By default, Clash only listens on the loopback address 127.0.0.1, so other devices can't reach it. Turning on "Allow LAN Connection" makes the core listen on 0.0.0.0 instead (equivalent to allow-lan: true with bind-address: "*"), so any phone, tablet, or other computer on the same Wi-Fi can forward traffic through it.

Setup Steps

On your PC, turn on "Allow LAN Connection / Allow LAN" and note the mixed-port number.
Find your PC's LAN IP: on Windows, run ipconfig and check "IPv4 Address"; on macOS, check System Settings → Wi-Fi → Details, or run ipconfig getifaddr en0 in Terminal; on Linux, run hostname -I. It's usually an address in the 192.168.x.x or 10.x.x.x range.
Connect your phone to the same Wi-Fi network as your PC.
iOS: Settings → Wi-Fi → tap the info button next to your current network → Configure Proxy → Manual, enter your PC's IP as the server and the mixed port as the port.
Android: Settings → Wi-Fi → edit your current network → Advanced options → set Proxy to "Manual," enter your PC's IP as the hostname, and the same port as above.

What the System Proxy Actually Covers

The manual proxy on a phone is an HTTP proxy, and it only affects apps that respect the system proxy setting. Some games and streaming apps ignore the system proxy entirely and need per-app configuration, or you'd need a different setup, like tethering from a PC running TUN mode.

Putting your PC to sleep will interrupt the shared connection, so if it's going to act as a long-term "proxy gateway," it's worth disabling automatic sleep. When you're done using the proxy on your phone, just set the Wi-Fi proxy back to "Off / None" — it won't affect the proxy running on the PC itself.

Firewall Rules and Security Boundaries

The first time you enable LAN connections on Windows, the firewall usually pops up an "Allow app to communicate" dialog — check "Private networks" and allow it. If you miss the prompt, manually allow the client in the "Allow an app through Windows Firewall" list, or add a dedicated inbound rule for the mixed port. On macOS, if the system firewall is on, allow the client to accept incoming connections under System Settings → Network → Firewall.

Only Enable It on Trusted Networks

Allow LAN exposes your proxy port to every device on the same subnet — anyone else on that network could piggyback on your outbound connection. It's fine to leave on at home; always turn it off on public Wi-Fi like cafes or hotels, or tighten bind-address to a specific local network interface address (e.g. bind-address: 192.168.1.10). mihomo also supports authentication: ["user:pass"] to require a username and password on the port, and iOS's manual proxy screen lets you enter credentials directly.

It's also worth setting a DHCP static/reserved IP for your PC in your router: otherwise the IP can change after a reboot or lease renewal, silently breaking the address saved on your phone, which wastes time troubleshooting.

Verifying and Troubleshooting

On your PC itself or any device on the same subnet, use curl to test both protocols (swap in the actual IP and port):

# HTTP method
curl -x http://192.168.1.10:7890 https://api.ipify.org

# SOCKS5 method, same mixed port
curl --socks5-hostname 192.168.1.10:7890 https://api.ipify.org

If both commands return the proxy's exit IP, the mixed port is working correctly for both protocols. Verifying from your phone is even simpler: open any IP-lookup site in the browser and check whether the exit IP matches a proxy node; you can also open the client's connections panel and confirm you see an entry sourced from your phone's LAN IP.

If It Won't Connect, Check in This Order

Your phone and PC aren't on the same subnet, or the router has AP/client isolation enabled (on by default for guest networks) — switch to the main network or disable isolation.
The PC's firewall isn't allowing the mixed port — follow the steps in the previous section.
Your PC's LAN IP has changed — look it up again and update the phone's config.
Your phone still has the old port entered, which no longer matches the client's current port.
The "Allow LAN Connection" toggle hasn't taken effect yet — restart the client or reload the config.
Your phone is actually on cellular data — confirm Wi-Fi is connected and the proxy is set on the current Wi-Fi network, not a different one.

Once everything's sorted, this "PC running Clash full-time + phone on the LAN proxy" setup can run indefinitely: subscription updates and rule maintenance happen once on the PC, and every other device connects with zero configuration — a solid fixed topology for a home network.