Mixed Port 7890 & Allow LAN: Share Your PC’s Clash Proxy with Your Phone

Check first: Your PC must be online, and your phone must be able to reach it

To share your PC’s proxy with your phone, use the Clash or mihomo client on your computer as a proxy endpoint on your local network. Your phone sends supported requests to the PC, which then routes them directly or through a proxy node according to its current rules and proxy groups. You don’t need to import a subscription on your phone for this setup, but the PC must be powered on, connected to the internet, and running the proxy core.

First, open a website on your PC that requires a proxy. Make sure your subscription is enabled and a working node is selected in the relevant proxy group, then configure LAN sharing. If the PC itself can’t connect, troubleshoot the subscription and node first; changing the proxy address on your phone won’t fix an upstream issue.

• Network requirements: Your PC can use Ethernet and your phone can use Wi-Fi, but they must be able to communicate over the local network. The simplest setup is to connect both to the same home router.
• Network isolation: Guest Wi-Fi, wireless client isolation, and enterprise network controls may block your phone from reaching your PC. Being connected to Wi-Fi with the same network name doesn’t guarantee that the devices can communicate.
• Scope: A manual HTTP proxy in your phone’s Wi-Fi settings mainly works for apps that honor the system proxy settings. It doesn’t route all traffic from the device.

This example uses 192.168.1.50 for the PC, 192.168.1.80 for the phone, and 7890 for the mixed port. These are example private network addresses, not automatically detected values. Find your own addresses before entering them.

Understand mixed-port, allow-lan, and the bind address

mixed-port accepts both HTTP proxy requests and SOCKS5 connections on a single TCP listening port. It doesn’t combine the two protocols, and you don’t need to configure both on your phone. Phone Wi-Fi settings generally offer an HTTP proxy, so when you enter the mixed port, your phone uses its HTTP proxy capability.

7890 is a common configuration value, not a required standard. Clients may use a different port, so check the active configuration and actual listening address. port is usually the HTTP port, while socks-port is the SOCKS port. Don’t enter a number on your phone without checking what it’s used for.

127.0.0.1 is the loopback address. If your PC listens on it, only local connections from that PC are accepted; entering it on your phone points to the phone itself. Setting bind-address to '*' usually means listening on all interfaces, which exposes the proxy more broadly. This guide uses a specific local IPv4 address and a firewall rule to limit access.

Why HTTPS websites work through an HTTP proxy

When accessing an HTTPS website, proxy-aware apps typically use HTTP CONNECT to create a tunnel, then establish TLS with the destination site through that tunnel. Standard proxying doesn’t require installing a root certificate or disabling certificate verification. If you see a certificate warning after setting up sharing, stop sensitive activity and check the time, network, and destination site. Don’t install an unfamiliar certificate to “fix” the proxy.

Step 1: Find your PC’s current local IPv4 address

Windows: Find the active network adapter

Press Win + R, type cmd, press Enter, and run the command below. If your PC is connected by Ethernet, check “Ethernet adapter”; if it’s on Wi-Fi, check the connected “Wireless LAN adapter.”

ipconfig

Note the adapter’s “IPv4 Address.” For example, if the IPv4 address is 192.168.1.50 and the default gateway is 192.168.1.1, enter the former as the proxy server on your phone—not the gateway. Ignore addresses for disconnected adapters, VPN virtual adapters, and TUN adapters. Don’t use the address shown by a public IP lookup site.

macOS: Check network details

On macOS 13 or later, go to System Settings → Network → your active Wi-Fi or Ethernet connection → Details → TCP/IP, and note the IPv4 address. You can also open Details for the connected network on the Wi-Fi page and check TCP/IP there.

The address assigned by your router’s DHCP server may change after reconnecting. Once the setup works, you can reserve the current address for your PC in the router’s DHCP reservation settings. Otherwise, if 192.168.1.50 changes, you’ll need to update both the listening configuration and the proxy settings on your phone.

Step 2: Enable LAN sharing and check the port

Menu names vary between Clash desktop clients. In Settings, look for “Allow LAN” or “Allow LAN connections,” turn it on, and check the actual value under “Port” or “Mixed Port.” If your client lets you edit a persistent configuration, merge the three top-level fields below into your existing config. Don’t replace the entire subscription file with these lines.

mixed-port: 7890
allow-lan: true
bind-address: 192.168.1.50

Don’t indent these fields or place them under proxies or dns, and don’t define a field that already exists. After saving, use the client’s reload or core restart option to apply the changes. If your PC’s actual address differs from the example, update bind-address first; otherwise, the core may fail to bind.

A subscription update may overwrite edits to the subscription file, and a desktop client may override the port and LAN settings from its UI. Prefer the client’s persistent settings or override feature, then check the active configuration after reloading. Seeing true in a file doesn’t mean the running core has applied it.

Confirm that port 7890 is listening

On Windows, run this command in Command Prompt:

netstat -ano -p tcp | findstr ":7890"

Check the Local Address and State columns. 192.168.1.50:7890 with state LISTENING matches this example; 0.0.0.0:7890 means the port is listening on all IPv4 interfaces; 127.0.0.1:7890 means it’s still limited to the local PC. Seeing 7890 under Remote Address doesn’t mean your PC is listening on that port.

On macOS, run lsof -nP -iTCP:7890 -sTCP:LISTEN in Terminal. If nothing is listening, check that the core is running, that another program hasn’t claimed the port, and that reloading the configuration didn’t produce an error.

Allow LAN doesn’t mean the proxy is open to the internet. Don’t set up port forwarding for 7890 on your router, and don’t expose the external controller port to share the proxy. The control API and the proxy port used by your phone are separate endpoints.

Step 3: Use the firewall to allow only trusted devices

Even when the port is listening, the system firewall may block connections from your phone. Don’t disable the firewall. On Windows, once you’ve confirmed your home network is trusted, check the network profile under Settings → Network & Internet → your active connection, then create a narrowly scoped inbound rule for the Private profile.

The PowerShell command below requires administrator privileges. It allows only the example phone at 192.168.1.80 to access TCP port 7890 on this PC, and only on the Private profile. Before running it, replace the example with the address shown in your phone’s Wi-Fi details.

New-NetFirewallRule -DisplayName "Mihomo LAN TCP 7890" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 7890 -RemoteAddress 192.168.1.80 -Profile Private

Adding a narrowly scoped rule doesn’t remove existing rules that allow broader access. Go to Windows Security → Firewall & network protection → Advanced settings → Inbound Rules and check whether the client already has an allow rule for all sources; tighten it as needed. If the phone’s address changes, update the allowed source address too.

On macOS, go to System Settings → Network → Firewall → Options and check whether the client or the actual core process is blocked. Public Wi-Fi isn’t a safe place to expose an unauthenticated proxy. If you can’t control who’s on the local network, use a standalone client on your phone instead of loosening all inbound restrictions.

Step 4: Set up an HTTP proxy in your phone’s Wi-Fi settings

iPhone and iPad

1. Go to Settings → Wi-Fi and tap the info button next to the connected network.
2. Find Configure Proxy and select Manual.
3. Enter the PC’s local network address under “Server,” for example 192.168.1.50. Enter 7890 under “Port.”
4. This example doesn’t use proxy authentication, so leave Authentication turned off. Save the settings and test by opening a website in Safari.

Android

On a typical Android interface, go to Settings → Network & internet → Internet → your current Wi-Fi network → Edit network → Advanced options → Proxy → Manual. Other manufacturers may put this under Modify network in the Wi-Fi details.

• Proxy hostname: 192.168.1.50. Enter the address only—don’t include http:// or the port.
• Proxy port: 7890. Use the same value as the mixed port on your PC.
• Bypass proxy for: Leave the default setting while troubleshooting. Don’t accidentally add the site you’re testing to the bypass list.

Save the settings and reopen your browser. This setting usually applies only to the current Wi-Fi network; it won’t automatically proxy cellular data. Some Android apps ignore the system HTTP proxy, and others may reuse connections opened before the setting changed. If needed, fully close the app and reopen it.

Verify the connection: Check the connection log, then confirm which apps are covered

Open the Connections or Logs page in your PC client, then refresh a webpage on your phone. If you see a new connection from the phone’s address, it has reached the PC proxy. Check the rule and proxy group matched by that connection: DIRECT means it goes direct; a proxy policy means it uses the selected node.

Your phone is using the PC’s current routing rules, not automatically sending every website through the same node. To troubleshoot, check the route for an individual request rather than judging success only by whether your public IP changes. And don’t assume that because a browser works, every app and protocol is being routed through the proxy.

DNS, UDP, and TUN limitations

HTTP proxy requests and CONNECT can include the destination hostname, which the PC then resolves according to its core configuration. But this doesn’t guarantee that all DNS requests from your phone go through the PC. An app may resolve hostnames before using the proxy or open other connections on its own, so a Wi-Fi proxy alone isn’t a complete DNS leak protection solution.

The HTTP proxy in your phone’s Wi-Fi settings isn’t a general-purpose UDP relay. Games, voice calls, and some QUIC-based traffic may behave differently. Even if TUN mode is enabled on the PC, it can’t capture phone traffic that isn’t routed through the PC. To cover more apps, install a suitable client on your phone. Gateway-level routing requires routing and transparent proxy configuration; changing these three fields alone won’t do it.

Stop sharing: Restore your phone first, then close the PC proxy endpoint

When you’re done sharing, on iPhone go to Configure Proxy and select Off; on Android, set the proxy for the current Wi-Fi network to None. Confirm websites work over your regular connection, then turn off Allow LAN on the PC or quit the client. This prevents your phone from continuing to send requests to a proxy endpoint that’s no longer running.

If you added a Windows Firewall rule just for this test, you can remove it in an elevated PowerShell session:

Remove-NetFirewallRule -DisplayName "Mihomo LAN TCP 7890"

Keep these three mappings in mind: The phone’s server address is the PC’s local IP, the phone’s port is the mixed port that’s actually listening, and the traffic covered depends on whether each app supports the system HTTP proxy. Follow this order—test the PC, confirm local network access, check the listening port, configure the phone, then verify the connection log—to pinpoint the problem.