FlClash Mixed Port and Allow LAN: Share Your PC Proxy with Phones and TVs

1. What the Mixed Port and LAN Sharing Settings Do

To use FlClash on a PC from a phone or TV, three things must be in place: the client must have a working configuration loaded, the PC must listen for proxy traffic on its LAN address, and the phone or TV must send requests to that address. Enabling the PC’s system proxy does not automatically configure other devices.

This guide uses a PC with the LAN IPv4 address 192.168.1.20, a mixed port of 7890, and a phone and TV connected to the home router. These are example values, not FlClash defaults. Use the PC’s actual address and the port shown in the client.

HTTP or SOCKS5: Which Should You Use?

The manual proxy setting for a phone’s Wi-Fi is usually HTTP. Set the host to 192.168.1.20 and the port to 7890. If an app offers SOCKS5 settings, you can use the same mixed port, but make sure to select SOCKS5. For HTTPS websites, an HTTP proxy typically creates a tunnel with CONNECT; you don’t need to change the phone’s proxy type to “HTTPS.”

2. Check the Configuration and Listening Port on the PC

1. Open FlClash, confirm that your subscription has been imported, and select the configuration you want to use. If the PC itself cannot reach the target service, troubleshoot the configuration or outbound connection first; don’t change LAN settings at the same time.
2. Open the client’s settings and look for “Mixed Port” and “Allow LAN.” Labels and menu organization may vary by version, so identify the settings by their function. Don’t mistake the controller port for the proxy port.
3. Note the mixed port—for example, 7890 in this guide—and enable Allow LAN. Apply the configuration or restart the core if prompted, then check that the setting was saved.
4. Keep FlClash running. The phone and TV will lose access to the proxy endpoint if you shut down the PC, exit the client, or let the PC go to sleep.

If you manage these settings in a configuration file, the corresponding mihomo fields are shown below. This snippet covers listening settings only; it does not include a subscription, outbound connections, or rules, so it is not a complete configuration.

mixed-port: 7890
allow-lan: true
bind-address: "*"

bind-address: "*" listens on all available addresses, exposing the service more broadly than listening on 127.0.0.1 alone. Restrict access with your firewall. FlClash may generate or override the effective configuration based on its UI settings, so check the client’s runtime parameters before editing the subscription source to avoid conflicts between the UI and file.

Check the Listening Address to Verify the Setting

On Windows, run the command below in PowerShell. If your port isn’t 7890, replace the number in the command with the actual port.

Get-NetTCPConnection -State Listen -LocalPort 7890 |
  Select-Object LocalAddress, LocalPort, OwningProcess

• If you see only 127.0.0.1, the endpoint is available only to the PC. Check Allow LAN and the listening address.
• If you see 0.0.0.0, the service is listening on all IPv4 interfaces. Next, check the firewall and the network connection between devices.
• If you see the PC’s LAN address, the service is listening on that interface. Confirm that the phone’s network can reach it.
• No results? Check that the core is running and the port is correct. If the port is already in use, identify the process by its PID; don’t terminate an unfamiliar system process.

3. Find the PC’s LAN IP and Check Device Connectivity

On Windows, run ipconfig in a terminal and find the IPv4 address for the connected “Wireless LAN adapter WLAN” or Ethernet adapter. Don’t use a TUN virtual adapter, disconnected adapter, or loopback address. On macOS, find the IPv4 address under System Settings → Network → your active connection → Details → TCP/IP. On Linux, use ip -4 addr to check the active network interface.

PC IPv4: 192.168.1.20
Phone IPv4: 192.168.1.35
Subnet mask: 255.255.255.0
Proxy endpoint: 192.168.1.20:7890

The addresses above are on the same 192.168.1.0/24 subnet, a common home network setup. But connecting to Wi-Fi with the same name doesn’t guarantee that devices can reach each other: guest networks, AP isolation, and enterprise Wi-Fi policies may block peer-to-peer connections. A wired PC and a phone on Wi-Fi can usually share a proxy, as long as the router allows traffic between those networks.

• On your phone, don’t enter 127.0.0.1 or localhost; both refer to the phone itself.
• Don’t enter the router’s admin address unless the proxy is actually running on the router.
• The PC’s IP may change when it reconnects to the network. For long-term use, reserve the same LAN address for the PC in the router’s DHCP settings.
• For the initial test, use an explicit IPv4 address to avoid introducing hostname resolution and IPv6 reachability issues.

4. Set Up an HTTP Proxy on Your Phone or TV

Android: Change the Proxy for the Current Wi-Fi Network

A common path on Android is Settings → Network & internet → Internet → current Wi-Fi network → Edit network → Advanced options → Proxy → Manual. Some manufacturers place this under WLAN → current network details. Find the proxy hostname and port fields, then enter the PC’s IP and mixed port.

1. Set the proxy hostname to 192.168.1.20. Don’t add http:// or a path.
2. Set the proxy port to 7890. If there’s a separate port field, don’t append it to the hostname.
3. For the first test, leave the bypass list as is. Don’t add a rule that bypasses all domains.
4. After saving, test in a browser and check FlClash’s connection log on the PC to confirm that requests are arriving.

iPhone and iPad: Configure the Current Wi-Fi Network

Go to Settings → Wi-Fi → tap the info button next to the current network → Configure Proxy → Manual. Set Server to 192.168.1.20 and Port to 7890, then save. Enable Authentication and enter the credentials only if authentication is configured on the proxy endpoint. This is a system Wi-Fi proxy setting; you don’t need to run FlClash on your phone.

This setting applies only to the current Wi-Fi network; it doesn’t apply automatically to cellular data or another Wi-Fi network. If you leave the PC’s network but remain connected to a network with the same proxy settings, apps that use the proxy may lose internet access when the PC can’t be reached. Set Configure Proxy to Off in that case.

TVs: Check Whether the System or App Supports Proxies

Some Android TV systems offer a manual proxy setting in the current network’s advanced options; setup is similar to Android phones. Some TVs let you edit the proxy only for Wi-Fi, with no equivalent option for wired connections. Others don’t offer proxy settings at all. If you can’t find the setting, enabling Allow LAN on the PC alone won’t route the TV’s traffic through it.

If a TV app has its own network settings, configure the same endpoint using the HTTP or SOCKS5 protocol it supports. If a browser works but a video app doesn’t, first check whether the app follows the system proxy instead of repeatedly changing the mixed port. To route all traffic from a device, consider a proxy on the device or a gateway solution; enabling TUN on the PC does not make it the TV’s gateway.

5. Allow Proxy Traffic Through the Firewall Only on Trusted Networks

When Windows first prompts you to allow network access, choose permissions based on your actual network. On a trusted home network, you can use the Private profile; don’t mark hotel or public Wi-Fi as private just to share a proxy. Don’t disable the entire firewall to test the connection.

If the service is listening but other devices time out, you can create a restricted test rule in an elevated PowerShell session. The command below allows TCP port 7890 from the local subnet on the Private profile only; it does not change the current network profile.

New-NetFirewallRule -DisplayName "FlClash LAN TCP 7890" `
  -Direction Inbound -Action Allow -Protocol TCP `
  -LocalPort 7890 -Profile Private -RemoteAddress LocalSubnet

This rule is for the HTTP proxy test in this guide. To restrict access further, replace LocalSubnet with the phone and TV’s reserved IP addresses and constrain the rule by program path. On macOS, check whether the relevant app is blocked under System Settings → Network → Firewall → Options. For managed devices, contact your administrator.

When you’re done testing, run the command below to remove this manual rule if you no longer need it. If you created other rules, review them individually in the firewall; don’t clear them all at once.

Remove-NetFirewallRule -DisplayName "FlClash LAN TCP 7890"

6. Troubleshoot by Symptom: Check the Endpoint, Then Rules and DNS

Change one setting at a time while testing. First check whether requests reach the PC, then check where the rules send them. A phone showing “Connected to Wi-Fi” confirms only the wireless connection—not that the proxy port or upstream connection is working.

Test the Proxy Protocol from Another Computer

If there’s another computer on the same LAN, use the command below to send an HTTP proxy request. On Windows, curl.exe avoids alias differences in some PowerShell environments; on macOS and Linux, use curl. The destination is for testing and may not be reachable on every network.

curl.exe -I --connect-timeout 5 --max-time 15 --proxy http://192.168.1.20:7890 https://example.com/

If the connection fails while reaching 192.168.1.20:7890, keep troubleshooting the LAN endpoint. If the proxy tunnel is established but the destination is unreachable, check the outbound connection and DNS. A 407 response means you need to check the proxy endpoint’s username and password—not reimport your subscription.

In Rule Mode, Shared Devices Still Follow the PC’s Routing Rules

In Rule Mode, requests from a phone to the mixed port are matched against the client’s current rules and sent through the selected outbound. Enabling Allow LAN does not automatically route every request through a proxy. If a domain matches DIRECT, check the rule order and policy group instead of assuming proxy sharing is broken.

A Wi-Fi HTTP proxy does not send all of the phone’s DNS requests through the PC. For domain requests sent through the proxy, subsequent resolution and routing depend on the mihomo configuration; apps that bypass the proxy may still use the device’s own DNS resolution. Before troubleshooting a resolution issue, confirm that the request is actually reaching the client.

7. Restore Settings After Use

• When you no longer need to share with a phone or TV, set the proxy for the current network back to “None” or “Off” to prevent connection failures when the PC is offline.
• When the PC no longer needs to share its proxy, disable Allow LAN and check that the proxy endpoint is accessible only from the PC again.
• Remove temporary firewall rules. If you keep a rule for ongoing use, restrict it to the required network profile, source addresses, and port.
• Before enabling sharing again, check the PC’s IP, mixed port, subscription configuration, and rule mode in that order. Don’t reuse an address that may have changed.

A complete connection path looks like this: the device connects to the PC’s LAN IP and mixed port, the firewall allows the connection, and FlClash receives the request and selects an outbound according to its rules. Checking these steps in order helps distinguish an unreachable endpoint from an app that isn’t using the proxy or an upstream connection failure.