Inbound

Overview

Inbound settings define how local applications send traffic into Clash. Common inbound listeners include HTTP, SOCKS, mixed-port and TUN. A desktop GUI often configures these for you, but the profile still needs valid ports and permissions.

Common listeners

• mixed-port accepts both HTTP and SOCKS traffic on one port.
• port is the HTTP proxy port.
• socks-port is the SOCKS proxy port.
• allow-lan controls whether other devices on the same LAN can connect.
• tun captures traffic at the network layer when supported.

Operational notes

If another program already uses a port, Clash cannot bind it. Change the port or close the conflicting application. When allowing LAN access, keep firewall rules and network trust in mind.

Support Checks

Port conflicts, missing administrator permissions and firewall prompts are the most common inbound support checks. Check logs for bind failed, permission denied or TUN initialization status messages.

Related pages

• Outbound Configuration
• Rules
• Clash DNS

Reference examples

These examples mirror the corresponding Chinese documentation page so the English page carries the same configuration material.

# reference note
# port: 7890

# reference note
socks-port: 7891

# reference note
mixed-port: 7890

# reference note
# redir-port: 7892

# reference note
# tproxy-port: 7893

# reference note
# allow-lan: false

$ curl -x socks5h://127.0.0.1:7890 -v http://connect.rom.miui.com/generate_204
*   Trying 127.0.0.1:7890...
* SOCKS5 connect to connect.rom.miui.com:80 (remotely resolved)
* SOCKS5 request granted.
* Connected to (nil) (127.0.0.1) port 7890 (#0)
> GET /generate_204 HTTP/1.1
> Host: connect.rom.miui.com
> User-Agent: curl/7.81.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 204 No Content
< Date: Thu, 11 May 2023 06:18:22 GMT
< Connection: keep-alive
< Content-Type: text/plain
<
* Connection #0 to host (nil) left intact