Clash LAN Proxy Sharing: Let Phones and TVs Use Your PC’s Proxy

1. You’re sharing a proxy endpoint, not your PC’s entire network

A common way to share a Clash proxy over a LAN is to run the proxy core on a PC, then connect phones or TVs on the same network to the PC’s HTTP proxy port. Devices send supported requests to the PC, where the core handles them according to the active rules, proxy groups, and nodes. The PC must stay on, and the Clash core must keep running.

This is not the same as turning your PC into a router. Setting a Wi-Fi proxy on a phone doesn’t route all apps or protocols through the PC; apps still need to honor the system proxy settings. Games using UDP, some video apps with their own network stacks, and services that make direct connections may bypass the proxy.

Before you start: three things to know

Your PC’s LAN IPv4 address: This guide uses 192.168.1.20 as an example. Replace it with your PC’s current address.
The proxy listening port: We use 7890 throughout. Use the Mixed or HTTP port shown in your client.
A working proxy setup on your PC: First confirm that your PC can reach the target site through this proxy port. Then set up LAN sharing.

Your PC can use Ethernet while your phone uses Wi-Fi; they don’t need the same type of connection. What matters is that the router allows devices to communicate with each other. Guest Wi-Fi, wireless client isolation, and enterprise VLANs may block this traffic. Devices on the same Wi-Fi network name aren’t necessarily able to reach each other.

2. Configure allow-lan, mixed-port, and the bind address

In clients based on Clash or Clash Meta (now mihomo), look for a setting such as “Allow LAN” or “Allow connections from LAN.” This corresponds to the allow-lan core setting. Menu names and override behavior vary between graphical clients, so check the active runtime configuration—not just the field in your subscription file.

Field	Example value	Purpose and what to check
`mixed-port`	`7890`	Accepts both HTTP and SOCKS proxy connections on one port. Phone system proxy settings typically use HTTP.
`allow-lan`	`true`	Allows proxy connections from devices on the LAN, subject to the bind address, firewall, and core access controls.
`bind-address`	`"*"`	Binds to all addresses. Restrict sources with the firewall and check which addresses are actually listening.
`mode`	`rule`	Requests from shared devices still follow the configured rules; they don’t all automatically use a remote node.

Merge these fields into your current configuration; don’t replace the entire subscription

# LAN sharing fields only; this is not a complete subscription
mixed-port: 7890
allow-lan: true
bind-address: "*"
mode: rule

This snippet doesn’t include nodes, proxy groups, or rules, so it can’t be imported as a complete configuration. Add it using your client’s persistent override or configuration merge feature, and keep the existing settings. Direct edits to a downloaded subscription file may be overwritten the next time the subscription updates. After saving, reload the configuration or restart the core as required by your client.

127.0.0.1 is only accessible from the local machine. If the actual listening address is still 127.0.0.1:7890, your phone won’t be able to connect. You can also bind to your PC’s LAN address, but note that programs on the PC connecting to 127.0.0.1:7890 may stop working if you bind only to 192.168.1.20. If you bind to all addresses, use the firewall to restrict access to trusted sources.

If your configuration only has port and socks-port, enter the port set by port as the phone’s HTTP proxy—not the SOCKS port. HTTPS sites typically work through an HTTP proxy’s CONNECT tunnel; you don’t need to install an extra certificate.

3. Find your PC’s IP and confirm the core is listening

Windows: Find the physical network adapter, then check port 7890

Run these two commands in PowerShell. The first shows IP addresses; the second checks listening ports. Use the address for the connected Ethernet or Wi-Fi adapter, and skip virtual adapters such as TUN, virtual machines, and containers.

ipconfig
Get-NetTCPConnection -State Listen -LocalPort 7890 |
  Select-Object LocalAddress, LocalPort, OwningProcess

If your PC’s Wi-Fi IPv4 address is 192.168.1.20, enter that address as the phone’s proxy server. A listening address of 0.0.0.0 usually means all IPv4 interfaces. If you see ::, also check how your system handles IPv6 and dual-stack connections; that line alone doesn’t confirm IPv4 access.

macOS and Linux: Check the IP address and listening status separately

On macOS, find the IP under System Settings → Network → your current connection → Details → TCP/IP. Then use Terminal to check which process is listening:

lsof -nP -iTCP:7890 -sTCP:LISTEN

On Linux, use these commands to check interface IPv4 addresses and listening ports. You may need administrator privileges to see some process details:

ip -4 addr show
ss -lntp 'sport = :7890'

On your phone, don’t enter localhost, 127.0.0.1, 0.0.0.0, or your router’s default gateway. The first two point to the phone itself, the third is a wildcard listening address, and the default gateway is usually the router—not the PC’s proxy address. Reserve an IP for your PC in your router’s DHCP settings to prevent its address from changing after a restart.

4. Allow trusted LAN sources through the firewall only

“Allow LAN” controls whether the core accepts connections; the operating system firewall controls whether those connections can reach the core. Don’t leave the entire firewall disabled for troubleshooting, and don’t forward port 7890 to the internet on your router. If your system already has broad app-allow rules, review and narrow them too; adding a restrictive rule doesn’t revoke other broad permissions.

Windows: Allow TCP 7890 on private networks only

Set your current network to “Private” only if it’s a trusted home network. In Windows 11, the Wi-Fi path is usually Settings → Network & internet → Wi-Fi → your current connection’s properties → Network profile type. Then add a rule in an administrator PowerShell window:

New-NetFirewallRule `
  -DisplayName "Clash LAN TCP 7890" `
  -Direction Inbound `
  -Action Allow `
  -Protocol TCP `
  -LocalPort 7890 `
  -Profile Private `
  -RemoteAddress LocalSubnet

This rule applies only to the Private network profile and allows traffic from the local subnet to TCP 7890. If only one phone with a fixed address needs access, replace LocalSubnet with its IP, such as 192.168.1.30. This guide uses an HTTP proxy, so there’s no need to open UDP 7890.

macOS and Linux: Configure the firewall for your system

On macOS, go to System Settings → Network → Firewall → Options and check whether the client or core process accepting connections is blocked. After upgrading the client or replacing its core file, you may need to check permissions again.

If UFW is enabled on Linux and your home subnet is actually 192.168.1.0/24, you can allow access as shown below. Don’t copy the wrong subnet, and don’t enable or reset the firewall on a remotely managed server without first assessing the impact.

sudo ufw allow from 192.168.1.0/24 to any port 7890 proto tcp
sudo ufw status numbered

5. Set up the HTTP proxy on your phone or TV

iPhone and iPad: Set a manual proxy for the current Wi-Fi network

Go to Settings → Wi-Fi, then tap the information button next to the current network.
Tap Configure Proxy and select Manual.
Enter your PC’s actual IP in Server, such as 192.168.1.20, and enter 7890 in Port.
If you haven’t configured proxy authentication, leave Authentication off. Save the settings and test a website in Safari.

Enter only the address in the Server field—don’t include http:// or append :7890. This setting applies to the current Wi-Fi network; don’t assume the same route will be used on cellular data or another Wi-Fi network.

Android: Enter the proxy in the current network’s advanced settings

Menu locations vary by manufacturer. A common path is Settings → Network & internet → Internet → current Wi-Fi network → Edit → Advanced options → Proxy → Manual. On some devices, open the network details first, then tap Edit.

Proxy hostname: Your PC’s IP address, such as 192.168.1.20.
Proxy port: 7890.
Bypass proxy for: Leave blank or use the default for your initial test. Add exceptions later if needed.

Android’s system proxy isn’t guaranteed to work with every app. If a browser works but another app doesn’t, first check whether that app supports the system HTTP proxy rather than immediately changing your subscription or reinstalling the client. Some Android settings screens also lack fields for a username and password, so confirm the device can authenticate before enabling proxy authentication.

TVs and TV boxes: Look for proxy settings; don’t change the default gateway

Android TV and some manufacturer TV systems may offer a Manual option under Settings → Network & internet → current network → Proxy settings. Enter your PC’s IP and HTTP port. Some models only show this option on certain networks, and others don’t support proxies at all.

If there’s no proxy option, don’t enter your PC’s IP in the Gateway or DNS field. Gateway forwarding, DNS resolution, and HTTP proxying are different functions. A gateway setup requires additional routing, forwarding, and access-control configuration; changing an address alone won’t do it. Even when the TV supports a system proxy, individual video apps may not use it.

6. Verify sharing in order: port → request → rule

Start by testing from another computer on the LAN; this is usually easier than troubleshooting directly in a TV app. On Windows, check whether the TCP port is reachable:

Test-NetConnection 192.168.1.20 -Port 7890

TcpTestSucceeded: True only confirms that a TCP connection was established; it doesn’t verify proxy authentication, the node, or routing rules. Next, use curl to send a specific HTTPS request through the proxy. In Windows PowerShell, use curl.exe to avoid interference from aliases in older environments.

curl --proxy http://192.168.1.20:7890 --connect-timeout 5 --max-time 20 -I https://example.com/

Here, 5 seconds is the connection timeout and 20 seconds is the time limit for the entire command—not a performance measurement. An HTTPS proxy may first return 200 Connection established; check the target site’s final response too. Then open Clash’s Connections or Logs page and confirm the request source, destination domain, matched rule, and final policy.

Symptom	Check first	What to do
Connection timed out	PC IP, firewall, guest network isolation	Confirm devices can reach each other; check inbound rules and the network profile.
Connection refused	Is the port listening? Is the core running?	Check the actual port and bind address, then reload the configuration.
HTTP 407 response	The proxy requires authentication	Enter valid credentials in a client that supports proxy authentication.
Web pages load, but some apps fail	Does the app honor the system proxy?	Check the app’s proxy support and distinguish HTTP requests from UDP traffic.
Accessible, but the egress IP hasn’t changed	The connection matched DIRECT or another policy	Check connection details and rule order, not just the mode toggle.
Everything disconnects when the PC sleeps	Is the PC on and the core running?	Adjust power settings for a trusted use case, or stop sharing.

In Rule mode, connections matched to DIRECT reach their destinations directly from the PC; only connections matched to a proxy policy go through the corresponding node. The public IP seen by your phone therefore depends on the policy matched by each request and may differ from the IP used by other apps on your PC. DNS routing also depends on the app, proxy protocol, and core configuration. A website loading in your browser doesn’t prove that all DNS requests from your device go through the PC.

7. Security and cleanup after sharing

Home networks may include guest devices. Prefer restricting access to specific sources with the firewall, and enable core-supported proxy authentication only if needed. Authentication doesn’t replace network isolation, and phones and TVs vary in their support for authenticated proxies. Don’t share screenshots that reveal subscription URLs, proxy passwords, or control interface credentials.

Turn off sharing before joining another network: Before taking your laptop to a hotel, office, or public Wi-Fi network, disable Allow LAN and review any broad firewall permissions.
Restore device settings when you’re done: Set the phone or TV’s Wi-Fi proxy back to Off or None so it doesn’t keep trying to connect to the old address after the PC shuts down.
Remove temporary firewall rules: On Windows, run the command below to delete the rule created in this guide. On Linux, remove the corresponding UFW rule you added.
Check again after updates: After a subscription update, client upgrade, or port change, recheck the active configuration and listening address to catch differences between the UI and the values used by the core.

Remove-NetFirewallRule -DisplayName "Clash LAN TCP 7890"

A reliable LAN sharing setup should have a stable PC address, a correctly configured listening port, firewall access limited to trusted sources, devices using the HTTP proxy, and connection logs that explain where requests go. Troubleshooting in this order is more effective than changing TUN, Global mode, and DNS settings all at once. For more on rules and the network stack, see the Protocol Guide; for the basics, see the Quick Reference.