On this page
To let a phone or tablet use a Windows proxy, first understand what Allow LAN shares
After enabling Allow LAN, a phone, tablet, or another computer can use the Clash Verge Rev computer's local-network address and mixed-port as an HTTP proxy. Web pages and apps that support a system proxy send requests to that computer, where Mihomo forwards them according to the rules.
It does not automatically change another device's default gateway or capture all UDP. TV apps, games, and some system services still connect directly if they ignore the HTTP proxy. Transparent capture for an entire device requires a separate gateway or routing setup; repeatedly changing the Allow LAN port will not provide it.
| Item | Correct value | Common mistake |
|---|---|---|
| Server/host | The Windows computer's LAN IPv4, such as 192.168.1.20 | Entering 127.0.0.1 or the public outbound IP |
| Port | The current Clash Verge Rev mixed-port | Copying 7890 from a tutorial without checking the actual setting |
| Proxy type | An HTTP proxy supported by the device; use SOCKS when the app supports it | Treating the proxy port as a VPN configuration |
| Network scope | The same trusted local network or an explicitly reachable subnet | Opening it directly on public Wi-Fi or the internet |
First ensure that the computer's local-network address will not change after reconnecting
Run ipconfig in a Windows terminal and find the IPv4 address, subnet mask, and default gateway for the current connection. Do not select a WSL, Hyper-V, Tailscale, or TUN adapter address. When the phone and computer are both on home Wi-Fi, their addresses commonly share the same 192.168.x.x subnet.
The safest approach is to reserve a fixed DHCP lease for this computer on the router. A manually assigned static IP also works, but it must stay outside the DHCP pool and use the correct gateway and DNS. Otherwise, an address conflict later may look like “Allow LAN works only sometimes.”
ipconfigThe selected address should meet these conditions
- The adapter status is connected
- The default gateway is the current home router
- The phone and computer are on a mutually reachable LAN, not an isolated guest network
- The address is not 127.0.0.1, 169.254.x.x, or a virtual-adapter address
When enabling the listener, restrict both network ranges and access credentials
Enable Allow LAN in Clash Verge Rev settings and record the mixed-port. If you use configuration overrides, the corresponding Mihomo fields are allow-lan and bind-address. For stricter control, you can also use authentication and lan-allowed-ips.
Restart the core after editing and verify the listening port to confirm that the configuration took effect; do not rely only on the toggle color.
Replace 192.168.1.0/24 in the example with your home subnet and REPLACE_WITH_RANDOM_PASSWORD with a long password generated by a password manager. If the computer address is 192.168.50.20, the home subnet should usually follow the router's configuration, such as 192.168.50.0/24, rather than copying 192.168.1.0/24.
mixed-port: 7890
allow-lan: true
bind-address: "*"
authentication:
- "homeuser:REPLACE_WITH_RANDOM_PASSWORD"
lan-allowed-ips:
- 192.168.1.0/24Get-NetTCPConnection -LocalPort 7890 -State ListenAllow only this port on private networks in Windows Firewall
Windows Defender Firewall may block the inbound request the first time the phone connects. Open “Windows Security → Firewall & network protection → Advanced settings → Inbound Rules” and create a TCP rule for the current mixed-port. Select only the “Private” profile and limit remote addresses to “Local subnet” or a smaller trusted range.
Do not disable the entire firewall for convenience or apply the rule to “Public” networks. When you take a laptop to a hotel or coffee shop, its network profile usually becomes public; the local-network proxy should be unreachable there.
The phone immediately says it cannot connect to the proxy server
Common cause:The port is not listening, the address is wrong, or the firewall rejected the request
Resolution:Test the TCP port from another computer first, then inspect Mihomo logs.
It works when the firewall is disabled
Common cause:The precise inbound allow rule is missing
Resolution:Restore the firewall and create a port rule only for private networks and trusted sources.
It works at home but not on guest Wi-Fi
Common cause:The router has client isolation enabled
Resolution:That isolation is appropriate; do not disable all guest isolation merely to share the proxy.
Enter the computer's address in the phone's Wi-Fi details, not 127.0.0.1
Example using the current Wi-Fi network's manual proxy
Stay on the same local network
Connect the computer and phone to the same network where devices may reach one another; first confirm that the phone can open the router admin page.
Open Wi-Fi details
Choose “Manual” in the proxy settings for the current network; do not change how the IP address is assigned.
Enter the host and port
For the host, enter the computer's LAN IPv4; for the port, enter the actual mixed-port. If authentication is enabled, enter the corresponding username and password.
Save and open a test page
Open an ordinary HTTPS site while checking the Clash Verge Rev “Connections” screen for records from the phone's IP.
An HTTPS site normally uses an HTTP CONNECT tunnel through the proxy, so you do not need to install a Clash certificate on the phone. If the system displays a certificate warning, stop and check for accidental packet inspection, a man-in-the-middle proxy, or an untrusted configuration.
After phone connections appear, verify the rules and shutdown behavior
A successful connection proves only that the phone found the computer's port. Continue on the Clash Verge Rev “Connections” or log screen and verify that the source address is the phone, the target domain matches the expected rule, and the outbound policy group is correct. Test one site that should connect directly and another that requires the proxy so all traffic is not mistakenly sent to one group.
Before closing Clash Verge Rev, set the phone's Wi-Fi proxy back to “None.” Otherwise, the phone keeps contacting a computer port that is no longer listening, making it look as though Wi-Fi is broken. Do the same when the laptop leaves the home network, its LAN address changes, or it sleeps.
Expected final result
- The phone reaches the computer's LAN address and mixed-port
- Clash Verge Rev shows connections from the phone's IP
- Direct and proxied domains match their respective correct rules
- Windows Firewall remains enabled, and the rule applies only to private networks
- The phone returns to ordinary direct Wi-Fi access after disabling the proxy
- An untrusted subnet cannot reach the port