Clash Verge Rev
LAN sharing lets a phone, tablet or test device on the same trusted home or lab network use the proxy running on your computer. It is not a way to publish a proxy service to the internet. Based on the LAN gateway workflow commonly shown in advanced tutorials, this guide keeps exposure as small as possible.
Define the trust boundary first
The host and clients should be on a network you control. Do not enable sharing on public Wi-Fi, an unmanaged dorm network or any LAN whose members you cannot trust. Turn the feature off and remove temporary firewall rules when the session ends.
Configure the host
- Verify that the current profile works locally in Clash Verge Rev.
- Enable Allow LAN, which maps to the core
allow-lanoption. - Record the actual mixed port shown by your configuration; do not assume that an example port applies.
- Find the computer's IPv4 address on the current LAN.
- Allow inbound access to that port only from the trusted private subnet.
Labels and listen options can vary by release, so use the values displayed by your installed version and compare them with the official configuration reference.
Connect a phone or another device
In the client's Wi-Fi proxy settings, enter the host's LAN IP and mixed port. Test a normal web page first. When the client leaves that Wi-Fi, restore its proxy setting to Off; otherwise it will continue trying to contact a host that is no longer reachable.
Troubleshoot in order
- Confirm both devices share the same subnet and guest Wi-Fi client isolation is disabled.
- Check that the host IP is reachable and has not changed after a DHCP renewal.
- Verify that Clash Verge Rev is still listening on the recorded port.
- Limit the firewall rule to the correct private network and subnet.
- Prove the profile works on the host before debugging the LAN path.
Never forward the proxy port to the internet
Do not create WAN port forwarding for the mixed port, and do not expose the external controller directly to the internet. If controller access is genuinely required, prefer localhost binding and add a strong secret, access controls and a firewall allowlist. System Proxy and TUN mode control traffic on the host; LAN sharing is a separate network boundary.
Close the session safely
Disable Allow LAN, remove temporary firewall access, return client proxy settings to Off and review logs for unknown LAN devices. Redact private IP addresses, subscription URLs, node credentials and controller secrets before sharing screenshots.