Clash Verge Rev Allow LAN Setup on Windows: A Quick Guide

Understand what Allow LAN actually does

Clash Verge Rev normally exposes its proxy port only to the Windows computer running the application. In that default arrangement, an address such as 127.0.0.1:7890 works locally but cannot be reached from a phone, tablet, television, or another computer on the same Wi-Fi network. Enabling Allow LAN changes the listening scope so that other devices can connect to the proxy through the Windows computer’s private network address.

This does not turn the Windows computer into a router, VPN gateway, or Internet-sharing hotspot. The other device still needs to be configured to use an HTTP proxy, SOCKS5 proxy, or mixed proxy endpoint. The Windows computer must remain powered on, connected to the same local network, and running Clash Verge Rev with an active profile and reachable proxy node.

The traffic path is therefore straightforward:

The client device sends a request to the Windows computer’s private IP address.
Clash Verge Rev receives the request on its LAN-enabled proxy port.
The mihomo core applies the selected mode, rules, DNS behavior, and policy group.
The selected outbound proxy connects to the destination and returns the response to the client device.

For example, if the Windows computer has the private address 192.168.1.25 and Clash Verge Rev listens on mixed port 7890, another device would normally use 192.168.1.25:7890 as its proxy address. The address 127.0.0.1 must not be entered on the other device because it refers to that device itself, not to the Windows computer.

Enable Allow LAN and confirm the listening port

Before changing anything, start Clash Verge Rev and activate the profile that contains the nodes and rules you intend to share. The exact menu names can differ between Clash Verge Rev releases and between English and localized interfaces, but the relevant controls are usually located in the general settings, proxy settings, or profile override area. Look for Allow LAN, LAN access, Bind address, Mixed Port, or similar labels.

Enable Allow LAN. If the interface provides a bind-address option, use 0.0.0.0 only when you understand that the proxy may listen on all available IPv4 interfaces. A safer and more controlled alternative is to bind to the Windows computer’s private address, if the client supports a specific address. Avoid selecting a public or untrusted interface when the application offers interface-level choices.

Next, identify the actual proxy port. The commonly seen value is 7890, but it is not guaranteed. Clash configurations may define separate ports such as:

Setting	Typical purpose	What another device should use
`mixed-port`	Accepts HTTP proxy and SOCKS5-style connections on one port	Usually the easiest port for phones and tablets
`port`	HTTP proxy listener	Use it when the client only supports HTTP proxy
`socks-port`	SOCKS5 proxy listener	Use it when the client specifically supports SOCKS5
`redir-port` or `tproxy-port`	Transparent proxy traffic for supported routing modes	Not normally entered in ordinary Wi-Fi proxy settings
`external-controller`	Management API used by the graphical client	Never use this as a device proxy port

If the active configuration uses a mixed port, a basic section may look like this:

mixed-port: 7890
allow-lan: true
bind-address: '*'
mode: rule
external-controller: 127.0.0.1:9090

The field names and accepted bind-address values depend on the mihomo version and the way Clash Verge Rev generates or overrides the configuration. Do not paste a complete example over an existing subscription configuration without reviewing it first. In many clients, the graphical setting is preferable because it can preserve the change when the subscription is updated.

Check the runtime state instead of trusting the toggle

After enabling LAN access, restart the active profile or restart Clash Verge Rev if the interface requests it. Then inspect the core log or runtime information. You want to confirm three independent facts: the core is running, the proxy port is listening, and the listening address is not limited to loopback.

On Windows, open PowerShell and replace 7890 with the port shown in Clash Verge Rev:

Get-NetTCPConnection -State Listen -LocalPort 7890 |
  Format-Table LocalAddress,LocalPort,OwningProcess

A local address of 127.0.0.1 means that the port is still restricted to the Windows computer. An address of 0.0.0.0, or the computer’s private address such as 192.168.1.25, indicates that the service can potentially accept connections through that interface. This command only confirms that something is listening; it does not prove that the Windows Firewall or the remote device can reach it.

Find the Windows address that other devices should use

The proxy address entered on a phone or another computer is the Windows computer’s private IPv4 address, not its public IP address and not the address shown by an Internet speed-test website. Press Win + R, enter cmd, and run:

ipconfig

Find the adapter currently connected to the same network as the client device. For Wi-Fi, inspect the Wireless LAN adapter Wi-Fi section; for Ethernet, inspect the relevant Ethernet adapter. Record the IPv4 Address, which commonly looks like 192.168.1.25, 192.168.0.18, or 10.0.0.42.

Address type	Example	Use for the client proxy?
Loopback	`127.0.0.1`	No, local to each individual device
Windows private IPv4	`192.168.1.25`	Yes, when both devices share the reachable LAN
Public IPv4	Address assigned by the ISP	No, do not expose the proxy through the Internet
IPv6 link-local	`fe80::...`	Usually no for a first setup; use private IPv4 instead

Check that both devices are genuinely on the same local network. A phone connected to a guest Wi-Fi network may be isolated from the main LAN even when both networks are provided by the same router. Public Wi-Fi, hotel networks, office networks, and some mesh systems may enable client isolation, which prevents wireless devices from connecting to one another. A VPN running on the client device can also change its routing behavior and prevent access to the Windows private address.

Windows may show several IPv4 addresses if it has Wi-Fi, Ethernet, a virtual machine adapter, a Hyper-V switch, Docker, or another VPN installed. Choose the address belonging to the adapter that is actually connected to the same network. If the Windows address changes frequently because of DHCP, reserve an address for the computer in the router or record the new address before reconfiguring the other devices.

Allow the proxy port through Windows Firewall

Allow LAN and Windows Firewall solve different parts of the problem. The first makes mihomo listen beyond loopback; the second decides whether inbound connections are accepted. A firewall prompt may appear when Clash Verge Rev first opens a network listener. If it does, permit access on Private networks only when the current network is trusted. Avoid enabling access on Public networks unless there is a specific, reviewed reason.

If no prompt appeared, open Windows Security → Firewall & network protection → Advanced settings. Create an inbound rule for the actual proxy port and protocol used by the client. For a normal mixed proxy, TCP is the essential protocol. If a particular configuration uses UDP-based proxy behavior and the client explicitly requires it, review that requirement separately rather than opening every protocol by default.

Open Inbound Rules and choose New Rule.
Select Port, choose TCP, and enter the active proxy port, such as 7890.
Select Allow the connection.
Apply the rule to Private networks only.
Give it a specific name such as Clash Verge Rev LAN Proxy 7890.
Limit the remote scope to the local subnet or known client addresses when the firewall interface provides that option.

To test the port from another Windows computer, open PowerShell on that computer and run:

Test-NetConnection 192.168.1.25 -Port 7890

Replace the address and port with your own values. A result of TcpTestSucceeded : True confirms that the TCP connection reached a listening service. A false result usually points to an incorrect IP address, a wrong port, firewall blocking, Wi-Fi isolation, or a core that is still bound only to loopback. It does not yet confirm that the proxy can reach external websites.

Configure the phone, tablet, or second computer

On the client device, open the network settings for the Wi-Fi connection and find the manual proxy option. Enter the Windows private IPv4 address as the host and the Clash Verge Rev mixed port as the port. For the example used in this guide, the values are 192.168.1.25 and 7890.

Client setting	Example value	Important note
Proxy mode	Manual	Disable automatic detection while testing
Proxy host	`192.168.1.25`	Use the Windows private IPv4 address
Proxy port	`7890`	Use the active HTTP or mixed port, not the controller port
Username and password	Usually blank	Only fill these fields if the proxy configuration explicitly requires authentication
Bypass list	Optional	Do not bypass the test domain during the first check

Android and iOS generally apply a manual proxy to the selected Wi-Fi network, but not every application respects the operating system’s HTTP proxy setting. Web browsers and many ordinary HTTP clients usually follow it. Some games, streaming applications, command-line tools, banking applications, and applications using their own network stack may ignore it. If an app does not use the system proxy, enabling a TUN or VPN-based mode on that device would be a separate solution; it is not fixed by changing the Clash Verge Rev LAN port.

For SOCKS5-only clients, select the SOCKS5 proxy type and use the configured socks-port. Do not assume that a SOCKS5 field can accept an HTTP-only port. A mixed port is usually the simplest choice because it can accept common HTTP proxy requests and SOCKS-style connections, but the client still needs to send a protocol supported by that listener.

Verify traffic in layers

Use a simple, controlled test instead of immediately testing a large application. First confirm the TCP port, then confirm that the request reaches the core, and finally confirm that the request leaves through the intended policy. Keep the Clash Verge Rev log visible while opening a web page from the client device. A new connection entry or access log line should appear when the client uses the proxy.

From a second Windows computer, you can test an HTTP proxy with:

curl.exe -x http://192.168.1.25:7890 https://example.com -I --max-time 15

Replace example.com with a permitted test destination if your network has filtering rules. A successful response proves that the remote computer can connect to the proxy and that the core can process the request. If the TCP test succeeds but curl reports a timeout, inspect the active profile, policy group, DNS settings, node health, and core logs.

No connection reaches the Clash log: Check the Windows IP, client proxy mode, port number, Wi-Fi isolation, and firewall rule.
The log shows a connection but the request fails: Check the selected proxy group, node availability, DNS resolution, and rule matching.
Only some applications work: Those applications may not support the system proxy, or they may require SOCKS5 instead of HTTP.
The setup works briefly and then stops: Check whether the Windows private IP changed, the profile restarted with different ports, or the firewall network profile changed from Private to Public.
Websites open but show the wrong route: Confirm the active policy group and test the egress address through a browser on the client device.
DNS leaks or local-name failures appear: Remember that ordinary HTTP proxying does not automatically make every DNS request pass through the proxy. Review the client’s DNS behavior and use a suitable routing mode when the application requires it.

When the setup is confirmed, write down the Windows private address, proxy port, and the devices that are allowed to use it. If the port is no longer needed, turn off Allow LAN and remove the corresponding inbound firewall rule. A small, temporary LAN proxy is easier to secure than a permanently open listener, especially on laptops that frequently move between home, office, hotel, and public networks.