Inbound Proxies

Clash supports several inbound protocols, including:

• SOCKS5
• HTTP(S)
• Redirect TCP
• TProxy TCP
• TProxy UDP
• Linux TUN device (Premium edition only)

Connections from every inbound protocol are handled by the same internal rule-matching engine. In other words, Clash currently does not support separate rule sets for different inbound protocols.

Configuration

# HTTP(S) 代理服务端口
# port: 7890

# SOCKS5 代理服务端口
socks-port: 7891

# HTTP(S) 和 SOCKS4(A)/SOCKS5 代理服务共用一个端口
mixed-port: 7890

# Linux 和 macOS 的透明代理服务端口 (TCP 和 TProxy UDP 重定向)
# redir-port: 7892

# Linux 的透明代理服务端口 (TProxy TCP 和 TProxy UDP)
# tproxy-port: 7893

# 设置为 true 以允许来自其他 LAN IP 地址的连接
# allow-lan: false

Mixed port

A mixed port is a special port that supports both HTTP(S) and SOCKS5. Any program that supports an HTTP or SOCKS proxy can connect to it, for example:

$ curl -x socks5h://127.0.0.1:7890 -v http://connect.rom.miui.com/generate_204
*   Trying 127.0.0.1:7890...
* SOCKS5 connect to connect.rom.miui.com:80 (remotely resolved)
* SOCKS5 request granted.
* Connected to (nil) (127.0.0.1) port 7890 (#0)
> GET /generate_204 HTTP/1.1
> Host: connect.rom.miui.com
> User-Agent: curl/7.81.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 204 No Content
< Date: Thu, 11 May 2023 06:18:22 GMT
< Connection: keep-alive
< Content-Type: text/plain
<
* Connection #0 to host (nil) left intact

Redirect and TProxy

Redirect and TProxy are two different ways to implement transparent proxying, and Clash supports both.

You do not necessarily need to configure both features manually. We recommend using Clash Premium edition for transparent proxying because it automatically manages the operating system's routing table, routing rules, and nftables.