Clash Mixed Port & LAN Proxy Sharing: One Config for Every Device

What the mixed port is and why LAN sharing needs it

The Clash core listens locally on several proxy ports at once: an HTTP proxy port, a SOCKS5 proxy port, and a mixed port (mixed-port). The first two each handle a single protocol, so clients connecting to them have to know exactly which one to use. The mixed port merges HTTP and SOCKS5 into a single port — the core automatically detects which protocol a client is speaking and handles it accordingly. The benefit for users is straightforward: you only need to remember one port number. Whether it's a browser, a download manager, or a device like a TV or game console that only supports one specific proxy protocol, they can all point at the same port instead of needing separate ports configured for each device.

Most modern Clash clients (including GUI clients built on the Mihomo core) enable a mixed port by default, commonly 7890. If you open the config file (config.yaml), you'll usually see fields like this:

mixed-port: 7890
allow-lan: true
bind-address: "*"

These three lines each do something different: set the mixed port number, allow connections from other devices on the LAN, and bind the listening address to all network interfaces instead of just the local loopback address. If any one of the three is missing, LAN sharing simply won't work — many people only change allow-lan and forget to check bind-address, and end up still unable to connect. The next section explains how these two settings relate.

Two switches for LAN sharing: allow-lan and bind-address

allow-lan controls whether the proxy accepts connection requests that aren't from the local machine. By default, for security, most clients set this to false — meaning only programs running on the same computer can connect to the proxy port, and requests from other devices on the LAN get rejected outright. Switching it to true is the first, and most commonly remembered, step in enabling LAN sharing.

bind-address determines which network interface the core actually binds the service to. If it's bound only to 127.0.0.1 (the local loopback address), devices on the LAN still can't connect even with allow-lan turned on, because the traffic never reaches an outward-facing interface at all. Setting bind-address to "*" or a specific LAN IP (such as 192.168.1.5) is what actually makes the port visible to external devices. Most GUI clients turn this into a single toggle labeled something like "Allow LAN connections" — checking it quietly changes both allow-lan and bind-address under the hood, so you don't need to edit the config file by hand.

Finding your computer's LAN IP is simple: on Windows, open Command Prompt and run ipconfig, then look for "IPv4 Address"; on macOS, go to System Settings → Network and select the active connection to see its IP; on Linux, run ip addr or hostname -I. Note this IP down — you'll need it when setting up other devices. It typically looks like 192.168.1.x or 10.0.0.x.

How to open the firewall on each OS

Even after enabling allow-lan in the config, the operating system's built-in firewall can silently block incoming connections — this is the second most common reason LAN sharing fails to connect. The approach is similar across the three major desktop platforms: locate the relevant program or port and allow inbound connections on the "private/local network" profile.

One thing worth noting: Windows Firewall sometimes treats "private" and "public" networks separately — if the system mistakenly classifies your home or office network as "public," the connection will still be blocked even if the app itself is allowed through. You can manually set the active Wi-Fi or Ethernet connection to "Private network" under Network & Internet settings, then recheck the firewall rules.

Getting TVs, consoles, and tablets onto the same config

Many devices can't run a Clash client at all, but as long as they support manually configuring a proxy, they can still borrow the config running on your computer. The approach is the same everywhere: find the "Proxy" option in the device's network settings, and manually enter your computer's LAN IP and the mixed port number.

• Smart TVs / streaming boxes: Open Wi-Fi settings, long-press or tap the currently connected network to view its details, find "Proxy settings," choose "Manual," and enter the IP and port. Most Android-based TVs support this; some custom skins may hide it under "Advanced settings."
• Game consoles: Mainstream consoles have a proxy option in their network settings too, usually under something like Settings → Network → Set Up Internet Connection → Custom → Proxy Server → Use, where you enter the same IP and port.
• Tablets / phones: After connecting to the same Wi-Fi, long-press the network to view its details, find "Configure proxy," choose "Manual," and enter your computer's IP and mixed port. The exact menu location differs slightly between iOS and Android, but the field names are essentially the same.

Because the mixed port handles both HTTP and SOCKS5, devices that only offer an "HTTP proxy" field will still work fine — the requests they send are HTTP requests, and the core automatically detects and handles the protocol correctly without any extra configuration needed.

Troubleshooting a connection that still won't work

If LAN sharing is configured but devices still can't connect, the cause usually falls into one of the following — check them in order for the fastest results:

1. allow-lan or the corresponding toggle didn't actually take effect. After changing the setting, confirm the client has reloaded the config or restarted — some clients require clicking "Apply" for changes to be written to the running core.
2. bind-address is still bound to the loopback address. The GUI's "Allow LAN connections" toggle should sync this automatically, but if you edited the YAML file by hand, it's easy to miss this line.
3. The firewall is blocking the connection. Refer to the previous section and check the relevant setting on Windows, macOS, or Linux — pay special attention to the difference between "private" and "public" network profiles.
4. Wrong IP or port entered. A computer's LAN IP can change after a restart or when switching networks, especially in environments using DHCP; consider setting a static IP binding for your computer in the router's admin panel so you don't have to look it up every time.
5. The two devices aren't on the same subnet. If your computer is connected to 5GHz Wi-Fi while other devices are on a guest network or an isolated 2.4GHz network, even devices on the same router can be blocked by the router's guest-network isolation feature. Turn off "guest network isolation" in the router settings, or move both devices onto the same network.

If you've checked everything and it still doesn't work, try manually setting the same proxy address in a browser on the computer itself to confirm the proxy is working correctly, then go back and check whether the issue is on the device side or a network isolation problem — this makes it much faster to pin down exactly where things are stuck.