What Is Clash's Mixed Port: Enable LAN Sharing for Phones and TVs
Explains what the mixed-port and allow-lan settings do, walks through enabling LAN sharing in Clash Verge Rev step by step, and covers how to set the proxy address on phones and TVs plus firewall permissions to watch for.
What "mixed port" (mixed-port) actually means
Clash configuration files originally had two separate fields: port for the HTTP proxy port, and socks-port for the SOCKS5 proxy port. This split follows the convention of earlier proxy tools, but it's not particularly user-friendly — if a device only supports HTTP proxying you fill in one port, and if you switch to software that only understands SOCKS5 you have to fill in a different port. In daily use it's easy to mix them up, or to leave one of the two ports unopened, which leaves certain apps unable to reach the proxy.
mixed-port is the merged solution offered by the Clash core (including Clash Premium and the mihomo/Meta core): it listens for both HTTP and SOCKS5 traffic on the same port, and the core automatically detects which protocol a given request is using and handles it accordingly. In other words, whether the client software asks you for an HTTP proxy or a SOCKS proxy, entering this single port number works for either — no need to juggle two separate ports.
mixed-port: 7890
allow-lan: true
bind-address: "*"Most mainstream clients today (Clash Verge Rev, Clash Nyanpasu, FlClash, etc.) default to using mixed-port. The "Mixed Port" or "Proxy Port" field shown in their GUIs corresponds exactly to this setting, usually defaulting to 7890. When phones, TVs, routers, or other external devices connect to the proxy on this machine, they all use this single port — there's no need to distinguish protocol types.
allow-lan: whether devices on your network can connect in
By default, Clash's proxy port only listens on 127.0.0.1 (the local loopback address), meaning only the computer running Clash itself can use the proxy. Other devices on the same network — say, a phone, tablet, or smart TV on the same Wi-Fi — can't connect even if they know the port number, because the port isn't exposed on any outward-facing network interface.
allow-lan is the switch that controls this gate. Setting it to true makes Clash listen on all network interfaces (paired with bind-address: "*"), so other devices on the local network can simply enter this computer's LAN IP address plus the port number in their browser or system proxy settings, forwarding their traffic to this machine's Clash instance and effectively sharing the same rules and nodes.
Turning on allow-lan effectively exposes the proxy service to your entire local network — any device on that same network could, in theory, attempt to connect to this port. If the network isn't fully trusted (a public Wi-Fi hotspot, a shared router in a house-share, etc.), it's worth adding access control or only enabling it temporarily when needed and turning it off afterward.
Step-by-step: enabling LAN sharing in Clash Verge Rev
The wording differs slightly between clients; using Clash Verge Rev as an example, here's the path:
- Open Clash Verge Rev and go to "Settings" in the left-hand navigation.
- Under "Clash Settings" or "System Settings", find the "Allow LAN Connections" toggle (this maps to
allow-lan) and turn it on. - Check the "Mixed Port" value, which is usually 7890 by default; if another piece of software on this machine is already using that port, you can change it here — just make a note of the new value.
- Find this computer's current LAN IP address: on Windows, run
ipconfigin the command line and look for "IPv4 Address"; on macOS, check "System Settings → Network" for the currently connected IP. - Save the settings, make sure the client is running with system proxy or TUN mode enabled as needed, then move on to configuring the phone or TV.
Other clients have equivalent settings under similar names — Clash Nyanpasu also labels it "Allow LAN", and FlClash has its own LAN sharing toggle as well. The underlying mechanism is the same: they all modify the same allow-lan field.
Setting the proxy address on phones and smart TVs
Once LAN sharing is enabled, how other devices connect varies by platform, but the core idea is always the same: enter the computer's LAN IP plus the mixed port.
Android phones
Go to "Settings → Network & Internet → the connected Wi-Fi network → Modify network", expand the advanced options, switch "Proxy" to "Manual", enter the computer's LAN IP as the "Proxy hostname" and the mixed port number as the "Proxy port", then save. Menu paths vary slightly by device model, but the field names are essentially the same.
iPhone / iPad
Go to "Settings → Wi-Fi", tap the info icon next to the currently connected network, scroll to "Configure Proxy" at the bottom, select "Manual", enter the server address and port, and save.
Smart TVs / streaming boxes
Most TV platforms (Android TV, and some manufacturers' own systems) have a similar "Proxy settings" option under the Wi-Fi details or wired network settings — the steps are basically the same as on a phone: choose manual proxy, enter the LAN IP and port. A few TV systems don't support manual proxy entry at all; in that case you'd typically need a transparent proxy or bypass-router setup at the router level, which is outside the scope of this article.
Once it's set up, you can open a page on your phone's browser that shows your apparent location, or simply visit a site that's normally blocked in your region to confirm; if it loads normally, the proxy forwarding is working.
Firewall permissions and common connection failures
If a phone or TV still can't connect after enabling allow-lan and entering the correct IP and port, the most likely culprit is the system firewall blocking inbound connections — not a mistake in the config itself.
- Windows Firewall: the first time you enable LAN sharing, Windows usually shows a prompt asking to "Allow app through firewall" — be sure to check both "Private networks" and "Public networks" (or at least whichever type matches your current network if you're unsure). If you missed the prompt, you can go to "Control Panel → System and Security → Windows Defender Firewall → Allow an app through firewall" and manually find and check the Clash client.
- macOS Firewall: check "System Settings → Network → Firewall" to see whether it's blocking the app from accepting inbound connections, and add the Clash client to the allowed list if so.
- Wrong or changed IP address: LAN IPs are assigned dynamically by the router and can change after restarting the computer or router; if a connection fails, first re-check the current IP.
- Port in use or not updated after being changed: if you've changed the mixed port before, remember to update the phone/TV side to match the new port — a mismatch here means it simply won't connect.
- Devices not on the same subnet: confirm the phone/TV and the computer running Clash are on the same router or subnet; devices on separate segments (for example, a guest network isolated from the main network) can't normally reach each other by default.
Work through the list above in order when troubleshooting — first confirm the firewall is allowing the connection, then double-check that the IP and port match exactly on both ends. That will usually pinpoint the exact issue.
How LAN sharing relates to TUN mode
It's worth noting that allow-lan concerns exposing the HTTP/SOCKS mixed proxy port to the local network, whereas TUN mode (a virtual network adapter approach that takes over the whole machine's traffic) is a completely separate mechanism. TUN mode only affects the machine running Clash and doesn't automatically route traffic from other LAN devices through the proxy. To share the exit with phones and TVs, you still need the mixed-port + allow-lan manual proxy setup described in this article, or a more complete transparent proxy deployment at the router level. The two can be enabled at the same time without conflicting, but their scopes don't overlap — don't confuse them when configuring.