Clash

Appearance

Inbound ​

Device traffic is captured through TUN / Network Extension. Add local proxy ports when software needs to connect explicitly using HTTP or SOCKS.

Local proxy ports ​

yaml
mixed-port: 7890
allow-lan: false
bind-address: 127.0.0.1

In the software's proxy settings, enter host 127.0.0.1, port 7890, and HTTP or SOCKS5. This address refers to the same device, not a remote proxy server.

FieldPurpose
portHTTP proxy port
socks-portSOCKS proxy port
mixed-portHTTP and SOCKS on one port
allow-lanRequest LAN access; the app must also allow sharing
bind-addressBinding address; use 127.0.0.1 for local-only access
authenticationCredentials list, such as ["user:YOUR_PASSWORD"]
skip-auth-prefixesSource ranges allowed to bypass entry authentication, only when needed
lan-allowed-ips / lan-disallowed-ipsAllowed or denied source IP ranges

Custom listeners ​

This creates another local mixed entry with a separate port to avoid conflicting with 7890 above:

yaml
listeners:
  - name: Local-Proxy
    type: mixed
    listen: 127.0.0.1
    port: 7891
    users:
      - username: user
        password: YOUR_PASSWORD

name identifies the entry, type selects its protocol, listen is the local address, and port is the listening port. users configures this entry's credentials. Normal device capture does not require listeners. Custom services must also meet protocol certificate, authentication, and system listening requirements.

Platform behavior and field status ​

redir-port, tproxy-port, and Linux iptables settings do not operate on Apple platforms. Proxy authentication and allow-lan do not uniformly protect DNS or controllers; see Security.

Some TUN settings vary by version. TUN guide and version notes.

34 fields shown

FieldTypeiOSmacOStvOSPlatform notes
allow-lanBooleanManaged / limitedManaged / limitedManaged / limitedYAML true is kept only when the app permits LAN sharing; this does not control DNS or controller access globally.
authenticationListAdvancedAdvancedAdvancedSets credentials for applicable local proxy listeners, not DNS or controller credentials.
bind-addressStringAdvancedAdvancedAdvancedSets binding or source restrictions for applicable local proxy listeners, not all other services.
inbound-mptcpBooleanAdvancedAdvancedAdvancedRequests the feature for inbound connections; actual use depends on the system and connection negotiation.
inbound-tfoBooleanAdvancedAdvancedAdvancedRequests the feature for inbound connections; actual use depends on the system and connection negotiation.
interface-nameStringUnsupportedUnsupportedUnsupportedThe requested interface is not used; Clash manages the physical outbound interface.
iptables.bypassListNot applicableNot applicableNot applicableLinux iptables setting; no effect on Apple platforms.
iptables.dns-redirectBooleanNot applicableNot applicableNot applicableLinux iptables setting; no effect on Apple platforms.
iptables.enableBooleanNot applicableNot applicableNot applicableLinux iptables setting; no effect on Apple platforms.
iptables.inbound-interfaceStringNot applicableNot applicableNot applicableLinux iptables setting; no effect on Apple platforms.
lan-allowed-ipsListAdvancedAdvancedAdvancedSets binding or source restrictions for applicable local proxy listeners, not all other services.
lan-disallowed-ipsListAdvancedAdvancedAdvancedSets binding or source restrictions for applicable local proxy listeners, not all other services.
listenersListAdvancedAdvancedAdvancedConfigures custom listeners or forwarding; use protocol-specific binding and authentication. Availability also depends on system constraints.
mixed-portIntegerAdvancedAdvancedAdvancedSets a local proxy port; access depends on binding, sharing permission, and listener authentication.
portIntegerAdvancedAdvancedAdvancedSets a local proxy port; access depends on binding, sharing permission, and listener authentication.
redir-portIntegerUnsupportedUnsupportedUnsupportedNo effect; this top-level listening port is not created.
routing-markIntegerUnsupportedUnsupportedUnsupportedNo effect; this routing mark is not used on Apple platforms.
skip-auth-prefixesListAdvancedAdvancedAdvancedSkips authentication for the specified source ranges on applicable proxy listeners.
socks-portIntegerAdvancedAdvancedAdvancedSets a local proxy port; access depends on binding, sharing permission, and listener authentication.
ss-configStringAdvancedAdvancedAdvancedConfigures custom listeners or forwarding; use protocol-specific binding and authentication. Availability also depends on system constraints.
tproxy-portIntegerUnsupportedUnsupportedUnsupportedNo effect; this top-level listening port is not created.
tuic-server.alpnListAdvancedAdvancedAdvancedSets TUIC server TLS; certificates/keys may be valid content or readable files. These are not outbound-node settings.
tuic-server.authentication-timeoutIntegerAdvancedAdvancedAdvancedSets the relevant TUIC server timeout in milliseconds; zero uses default handling.
tuic-server.certificateStringAdvancedAdvancedAdvancedSets TUIC server TLS; certificates/keys may be valid content or readable files. These are not outbound-node settings.
tuic-server.congestion-controllerStringAdvancedAdvancedAdvancedSets TUIC server parameters; effective values depend on defaults, bounds, and negotiation.
tuic-server.cwndIntegerAdvancedAdvancedAdvancedSets TUIC server parameters; effective values depend on defaults, bounds, and negotiation.
tuic-server.enableBooleanAdvancedAdvancedAdvancedEnables the TUIC server or sets its UDP address, subject to system port and permission constraints.
tuic-server.listenStringAdvancedAdvancedAdvancedEnables the TUIC server or sets its UDP address, subject to system port and permission constraints.
tuic-server.max-idle-timeIntegerAdvancedAdvancedAdvancedSets the relevant TUIC server timeout in milliseconds; zero uses default handling.
tuic-server.max-udp-relay-packet-sizeIntegerAdvancedAdvancedAdvancedSets TUIC server parameters; effective values depend on defaults, bounds, and negotiation.
tuic-server.private-keyStringAdvancedAdvancedAdvancedSets TUIC server TLS; certificates/keys may be valid content or readable files. These are not outbound-node settings.
tuic-server.tokenListAdvancedAdvancedAdvancedSets TUIC server credentials separately from top-level authentication.
tuic-server.usersMappingAdvancedAdvancedAdvancedSets TUIC server credentials separately from top-level authentication.
vmess-configStringAdvancedAdvancedAdvancedConfigures custom listeners or forwarding; use protocol-specific binding and authentication. Availability also depends on system constraints.

Reference: mihomo.

Copyright © 2026 The Clash & Hako Team