Clash Mixed Port 7890 and Allow LAN: Share Your PC Proxy with Phones and TVs

Sharing your PC proxy with a phone or TV requires three things: the proxy port must accept LAN connections, the firewall must allow access from the device, and the device must use your PC’s local IP address. Turning on “System Proxy” on your PC does not automatically route traffic from other devices on the same Wi-Fi network.

This guide uses 192.168.1.20 as the PC address and 7890 as the mixed port. These are configuration examples, not tested results; use your PC’s current LAN IPv4 address in practice. If your client uses the mihomo core, check the settings below. Menu names and available features in clients such as ClashX depend on the version.

1. What the mixed-port 7890 accepts

mixed-port is a shared listening port for HTTP and SOCKS proxies. The client identifies the protocol from the connection, so a phone can use HTTP proxy settings while a command-line tool uses SOCKS5, both connecting to the same 7890 port. The port number itself determines neither the protocol nor which proxy node handles the traffic.

The table shows different configuration options; it does not mean you need to enable every port. Avoid configuring port and mixed-port to compete for the same listening address at 7890. When using a mixed port, you generally do not need a separate HTTP port.

2. Check your PC’s IP, listening address, and Allow LAN setting

Find the network adapter you’re actually using

1. On Windows, open Terminal and run ipconfig. Find the IPv4 address and subnet mask for the active Wi-Fi or Ethernet adapter. Don’t use the address for a virtual adapter, TUN adapter, or disconnected adapter.
2. On macOS, open “System Settings” → “Network” → your active connection → “Details” → “TCP/IP” to find the IP address.
3. Make sure your phone and PC can reach each other on the LAN. The PC can use Ethernet while the phone uses Wi-Fi, as long as the router does not isolate them on separate guest networks.
4. For long-term sharing, reserve the PC’s address in your router’s DHCP settings. Otherwise, the proxy server address saved on your phone may stop working when the PC reconnects with a different IP.

Apply the settings to the running core

In your client’s settings, find “Allow LAN” or “Allow LAN connections” and check the mixed port. Settings locations vary between clients, so verify the active configuration and listening port. Here’s a mihomo snippet you can merge into the top level of an existing configuration. It is not a complete subscription with proxies and rules:

mixed-port: 7890
allow-lan: true
bind-address: 192.168.1.20
mode: rule

allow-lan: true allows connections from the LAN; bind-address specifies the listening address. This example listens only on the PC’s 192.168.1.20 address, so update it if that address changes. Some clients generate these fields automatically. Manual edits to a subscription file may be overwritten on update, so prefer the client’s persistent settings or override feature, then verify the configuration after reloading.

If your client only supports bind-address: "*", it listens on all interfaces, so use the firewall to restrict the source addresses. “All interfaces” does not mean “only devices on your home Wi-Fi”—other network interfaces on the PC may accept connections too.

You only need the proxy listener here; TUN does not need to be enabled. mode: rule means requests from LAN devices continue to be matched against the current rules; it does not automatically send every request through the same proxy node. Check which policy group your rules match and make sure that group has an available node selected.

3. Allow only the traffic you need through the firewall

“Allow LAN” and the system firewall are separate controls. A listening core does not mean Windows or macOS will allow inbound connections. First make sure the home network is trusted, then create a narrowly scoped rule. Don’t leave the firewall disabled as a substitute for troubleshooting.

Windows: Restrict access to private networks, TCP 7890, and your LAN subnet

Open “Windows Security” → “Firewall & network protection” → “Advanced settings” → “Inbound Rules” to create a port rule and restrict remote IP addresses under “Scope.” You can also run this example in an elevated PowerShell window:

New-NetFirewallRule -DisplayName "mihomo LAN TCP 7890" `
  -Direction Inbound -Action Allow -Protocol TCP `
  -LocalAddress 192.168.1.20 -LocalPort 7890 `
  -RemoteAddress 192.168.1.0/24 -Profile Private

192.168.1.0/24 applies only to the corresponding home subnet. To allow just one phone, set the remote address to the phone’s reserved IP for an even narrower rule. The network profile must actually be set to “Private” for the rule to work as expected. Don’t change a hotel or public Wi-Fi network to Private to use this rule.

The HTTP sharing setup in this guide uses TCP. SOCKS5 UDP forwarding also depends on app support, core configuration, and UDP firewall rules; opening every port is not the answer. Remove the example rule when you no longer need to share the proxy:

Remove-NetFirewallRule -DisplayName "mihomo LAN TCP 7890"

macOS: Allow the app that actually receives connections

Open “System Settings” → “Network” → “Firewall” → “Options” and check that the client or core process actually in use is allowed to accept incoming connections. If “Block all incoming connections” is enabled, consider whether it conflicts with your sharing needs. Third-party security software may also have separate network filtering rules.

4. Set up a proxy on phones, TVs, and consoles

On the device, enter your PC’s LAN IP address and proxy port—not a proxy node’s server address or a subscription URL. The examples below use server 192.168.1.20 and port 7890. The server field usually takes just the IP address: don’t add http:// or append the port in the same field.

iPhone and iPad: Set a manual proxy for the current Wi-Fi network

1. Open “Settings” → “Wi-Fi,” then tap the info button next to the connected network.
2. Go to “Configure Proxy” → “Manual.”
3. Enter 192.168.1.20 for the server and 7890 for the port, then save.
4. Leave “Authentication” off if you haven’t configured authentication in the core. If you have, enter the same username and password configured in the core.
5. Open an HTTPS page in your browser, then check the client’s connections or logs on the PC.

This setting applies only to the current Wi-Fi network, not cellular data. Some apps ignore the system HTTP proxy, so a working browser does not prove that all apps are routed through the PC. When you’re done, set “Configure Proxy” back to “Off” to avoid connection failures if the PC goes to sleep.

Android: Edit the proxy for a connected network

Using the Pixel’s Android 14 interface as an example, go to “Settings” → “Network & internet” → “Internet” → the settings button for your current Wi-Fi network → Edit network → “Advanced options” → “Proxy” → “Manual.” Other manufacturers may put this under “Modify network” or “Advanced settings.”

• Proxy hostname: 192.168.1.20.
• Proxy port: 7890.
• Addresses to bypass the proxy: keep the default for your first test, then add local service exceptions after confirming the connection works.

Android’s system Wi-Fi proxy is not a transparent proxy for every app on the device either. Some apps use their own connections and ignore the system proxy, so they may still connect directly. If the system interface has no authentication fields but the core requires authentication, you may not be able to connect through that interface. Don’t remove necessary access controls on a shared network to work around this.

TVs and consoles: Check for HTTP proxy support first

TV network settings vary widely. Enter the details above only if the advanced settings for your current network explicitly include a proxy server and port. A TV without this option cannot use a proxy just because Allow LAN is enabled on your PC; use a client supported by the device or configure traffic routing on your router.

On a PS5, for example, go to “Settings” → “Network” → “Settings” → “Set Up Internet Connection,” select a registered network, then open “Advanced Settings” and check for a “Proxy Server” option. Even if you can enter an HTTP proxy, that doesn’t mean game traffic, voice chat, or all downloads will use it. Check the PC’s connection logs to see which traffic is actually routed through the proxy.

5. Troubleshoot in order: listener → reachability → proxy → rules

Step 1: Make sure the port isn’t bound only to the loopback address

Run this in Windows PowerShell:

Get-NetTCPConnection -State Listen -LocalPort 7890 |
  Select-Object LocalAddress, LocalPort, OwningProcess

Run this in macOS Terminal:

lsof -nP -iTCP:7890 -sTCP:LISTEN

If the only result is 127.0.0.1:7890, LAN devices can’t connect through your PC’s Wi-Fi address. With the example configuration in this guide, you should see a listener on 192.168.1.20:7890. If nothing appears, check that the core is running, the configuration reloaded successfully, and another app hasn’t occupied the port.

Step 2: Test TCP and a proxy request from another device

If there’s another Windows PC on your LAN, run the port test below on that device. Testing from the PC itself won’t catch wireless client isolation or inbound firewall issues.

Test-NetConnection 192.168.1.20 -Port 7890

A TcpTestSucceeded value of True only confirms that a TCP connection can be established; it does not confirm that the proxy protocol or outbound node is working. Next, test with curl using a proxy. In Windows PowerShell, you can call curl.exe explicitly:

curl --proxy http://192.168.1.20:7890 --connect-timeout 5 --max-time 20 -I https://example.com/

curl --socks5-hostname 192.168.1.20:7890 --connect-timeout 5 --max-time 20 -I https://example.com/

The second command sends the destination domain over SOCKS5 so the proxy resolves it, helping distinguish the proxy’s DNS path from local resolution. The 5-second connection timeout and 20-second total timeout are troubleshooting settings, not latency test results. The two commands test HTTP and SOCKS through the mixed port separately; you don’t need to configure both proxy types on the device.

Step 3: Narrow down the issue based on what you see

If requests to domain names fail but an IP connection test succeeds, check the mihomo core’s DNS settings and logs. Don’t change your phone’s DNS to the PC’s address at random: the mixed port is not a DNS server, and listening on 7890 does not mean the PC provides DNS resolution on port 53.

6. Limits and cleanup before sharing long-term

A LAN proxy depends on the PC staying online, the core continuing to run, and the PC’s IP address remaining stable. If you plan to use it with a TV long-term, check the PC’s sleep settings so it doesn’t go to sleep when the screen turns off. After subscription updates or client upgrades, verify that Allow LAN, the mixed port, and override settings are still in effect.

• Rule limitations: Requests from your phone are routed according to the PC’s current rules. Don’t rely on rules that match the PC app’s process name to identify phone apps; ordinary LAN proxy requests don’t carry the phone’s local process identity.
• TUN limitations: Enabling TUN on your PC does not automatically make your phone a downstream device. Transparent proxying also requires gateway, routing, DNS, and forwarding configuration; it is not the same as manually setting up an HTTP proxy.
• Security: Restrict access to trusted subnets. On shared networks, you can also configure authentication in mihomo, but first make sure the client device supports the required authentication method.
• Stop sharing: Turn off the proxy settings on your phone or TV, disable Allow LAN in the client, and remove any firewall rules you no longer need.

The quickest way to verify the setup is to confirm that the PC is listening on 192.168.1.20:7890, check that the port is reachable from another device, then look for the corresponding request in the client. Once all three checks pass, troubleshoot nodes, rules, and app compatibility. This is easier than repeatedly switching TUN, system proxy, and DNS settings. For an overview of the key fields, see the mixed-port section in the user guide.