On this page
Sharing your computer’s proxy with a phone requires both letting the phone connect and keeping unknown devices out. The phone’s manual proxy setting may remain active after the computer sleeps, leaves the home network, or changes address. Plan the access scope and how to undo sharing before turning it on.
Which Apps Can Use the Computer’s Proxy Through Allow LAN?
After enabling Allow LAN, a phone, tablet, or another computer can use the Clash Verge Rev computer's local-network address and mixed-port as an HTTP proxy. Web pages and apps that support a system proxy send requests to that computer, where Mihomo forwards them according to the rules.
It does not automatically change other devices' default gateway or capture all UDP traffic. TV apps, games, and some system services still connect directly if they do not read the HTTP proxy. Sending all devices' traffic through a proxy requires a separate gateway or routing setup; repeatedly changing the Allow LAN port will not provide that.
| Item | Correct value | Common mistake |
|---|---|---|
| Server/host | The Windows computer's LAN IPv4, such as 192.168.1.20 | Entering 127.0.0.1 or the public outbound IP |
| Port | The current Clash Verge Rev mixed-port | Copying 7890 from a tutorial without checking the actual setting |
| Proxy type | An HTTP proxy supported by the device; use SOCKS when the app supports it | Treating the proxy port as a VPN configuration |
| Network scope | The same trusted local network or an explicitly reachable subnet | Opening it directly on public Wi-Fi or the internet |
Reserve the Computer’s Address and Configure LAN Listening
Run ipconfig in a Windows terminal and find the IPv4 address, subnet mask, and default gateway for the current connection. Do not select a WSL, Hyper-V, Tailscale, or TUN adapter address. When the phone and computer are both on home Wi-Fi, their addresses commonly share the same 192.168.x.x subnet.
The safest approach is to reserve a fixed DHCP lease for this computer on the router. A manually assigned static IP also works, but it must stay outside the DHCP pool and use the correct gateway and DNS. Otherwise, an address conflict later may look like “Allow LAN works only sometimes.”
ipconfigThe selected address should meet these conditions
- The adapter status is connected
- The default gateway is the current home router
- The phone and computer are on a mutually reachable LAN, not an isolated guest network
- The address is not 127.0.0.1, 169.254.x.x, or a virtual-adapter address
Enable Allow LAN in Clash Verge Rev settings and record the mixed-port. If you use configuration overrides, the corresponding Mihomo fields are allow-lan and bind-address. For stricter control, you can also use authentication and lan-allowed-ips.
Restart the core after editing and verify the listening port to confirm that the configuration took effect; do not rely only on the toggle color.
Replace 192.168.1.0/24 in the example with your home subnet and REPLACE_WITH_RANDOM_PASSWORD with a long password generated by a password manager. If the computer address is 192.168.50.20, the home subnet should usually follow the router's configuration, such as 192.168.50.0/24, rather than copying 192.168.1.0/24.
mixed-port: 7890
allow-lan: true
bind-address: "*"
authentication:
- "homeuser:REPLACE_WITH_RANDOM_PASSWORD"
lan-allowed-ips:
- 192.168.1.0/24Get-NetTCPConnection -LocalPort 7890 -State ListenAllow mixed-port through Windows Firewall only on Private networks
Windows Defender Firewall may block the inbound request the first time the phone connects. Open “Windows Security → Firewall & network protection → Advanced settings → Inbound Rules” and create a TCP rule for the current mixed-port. Select only the “Private” profile and limit remote addresses to “Local subnet” or a smaller trusted range.
Do not disable the entire firewall for convenience or apply the rule to “Public” networks. When you take a laptop to a hotel or coffee shop, its network profile usually becomes public; the local-network proxy should be unreachable there.
The phone immediately says it cannot connect to the proxy server
Common cause:The port is not listening, the address is wrong, or the firewall rejected the request
Resolution:Test the TCP port from another computer first, then inspect Mihomo logs.
It works when the firewall is disabled
Common cause:The precise inbound allow rule is missing
Resolution:Restore the firewall and create a port rule only for private networks and trusted sources.
It works at home but not on guest Wi-Fi
Common cause:The router has client isolation enabled
Resolution:That isolation is appropriate; do not disable all guest isolation merely to share the proxy.
Enter the computer's address in the phone's Wi-Fi details, not 127.0.0.1
Example using the current Wi-Fi network's manual proxy
Stay on the same local network
Connect the computer and phone to the same network where devices may reach one another; first confirm that the phone can open the router admin page.
Open Wi-Fi details
Choose “Manual” in the proxy settings for the current network; do not change how the IP address is assigned.
Enter the host and port
Enter the computer’s LAN IPv4 and actual mixed-port. If authentication is enabled, enter the credentials through a control that supports proxy authentication. If the Wi-Fi page has no authentication fields, use an app’s proxy settings with authentication support.
Save and open a test page
Open an ordinary HTTPS site while checking the Clash Verge Rev “Connections” screen for records from the phone's IP.
An HTTPS site normally uses an HTTP CONNECT tunnel through the proxy, so you do not need to install a Clash certificate on the phone. If the system displays a certificate warning, stop and check for accidental packet inspection, a man-in-the-middle proxy, or an untrusted configuration.
Check the phone IP and rules, and remove its Wi-Fi proxy before stopping the computer proxy
A successful connection proves only that the phone found the computer's port. Continue on the Clash Verge Rev “Connections” or log screen and verify that the source address is the phone, the target domain matches the expected rule, and the outbound policy group is correct. Test one site that should connect directly and another that requires the proxy so all traffic is not mistakenly sent to one group.
Before closing Clash Verge Rev, set the phone's Wi-Fi proxy back to “None.” Otherwise, the phone keeps contacting a computer port that is no longer listening, making it look as though Wi-Fi is broken. Do the same when the laptop leaves the home network, its LAN address changes, or it sleeps.
When a shared device is outside skip-auth-prefixes (authentication-exempt ranges), enabled authentication should reject requests with no password or a wrong password and forward only those with valid credentials. Connections from untrusted subnets should also fail. Test only with devices you control, without disabling the firewall or widening the listener’s scope.