By default the port your client opens is reachable only from the machine it runs on, and anything else that tries gets refused. That is a sensible default and a one-line change. Once it is changed, any device on the same subnet that can accept a proxy address gets to share the line — an Android TV, a console, an iPad, another laptop with nothing installed on it at all.

What the switch changes is the listen address

The option is usually labelled Allow LAN, and in the config it is allow-lan: true. With it off, the core listens on 127.0.0.1 alone, so nothing but the local machine can reach it. With it on, the listen address becomes 0.0.0.0 and connections arriving on any interface are accepted. If the host has several interfaces — an Ethernet cable plus a virtual adapter belonging to a VM, say — bind-address narrows that back to one specific address and leaves the rest closed.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes

Three steps to get connected

  1. On the host, turn on Allow LAN, and note the mixed port while you are there. Out of the box it is usually 7890.
  2. Find the host's address on the local network. You want the one starting with 192.168. or 10., not the public address a what-is-my-IP page shows you.
  3. On the other device, set a manual HTTP proxy: the host address as the server, that port as the port. On Android and most TV boxes this sits under the advanced settings of the Wi-Fi network; on iOS it is at the bottom of the network's detail page; on consoles it is inside the manual network configuration.
  4. Worth knowing before you start: plenty of TV boxes and consoles offer an HTTP proxy field and no SOCKS option anywhere in the menus. The mixed port accepts both protocols, so the same port number works and there is nothing else to hunt for.
ipconfig
ip -4 addr show
ifconfig | grep inet

Everything looks right and nothing connects

Nine times out of ten it is the firewall. The first time the client listens on an external address, Windows raises a prompt asking whether to allow communication on private networks, public networks, or both. That prompt often gets dismissed before anyone reads it, or only the public box is ticked while the home Wi-Fi is classified as private. The result is a host that works perfectly for itself and refuses every other device, with nothing in the client's interface hinting at a problem. Open the firewall's inbound rules, find the entry for the client or the core, and confirm it is allowed for the network type you are currently on. On macOS the equivalent lives in the firewall section of system settings; on Linux it depends on whether you run ufw or firewalld.

Test the port before you blame the device

curl -x http://127.0.0.1:7890 -I https://www.cloudflare.com
curl -x http://192.168.1.10:7890 -I https://www.cloudflare.com

Run the first line on the host and the second from another computer, with the address swapped for your own. Host works, other machine does not: firewall, or the two are not actually on the same subnet — on an ordinary home network both addresses should share their first three numbers. Neither works: the problem is the client or the node, and LAN sharing has nothing to do with it. On a device without curl, just open any page in a browser; if the images load, you are through.

Decide who gets to connect before you switch it on

  • Every device on the subnet can connect, and the proxy does not care who they are. To put a door on it, add authentication to the config — a list of user and password pairs — after which the device asks for two more fields when you set up the proxy. In a dorm, a shared flat or an office this is not optional.
  • DHCP hands out a different address sooner or later. Reboot the host or let the lease expire, the address moves, and every device you configured goes quiet at once. Reserve the address for the host on the router, or give the host a static one, and you never repeat this step.
  • Some devices have no proxy setting at all — plenty of smart appliances and older TVs. Making a whole subnet go through a proxy with nothing configured on the devices is a different exercise entirely, involving a gateway box or transparent routing, and both the difficulty and the blast radius are far larger. Out of scope here.
Do not switch this on for public Wi-Fi, a dorm network, an office network, or anything else sitting on a large subnet. allow-lan does not recognise people: any device sharing that subnet can use your proxy as a free exit, and the traffic and the access records are attributed to you. If you genuinely have to, bind-address plus authentication is the floor rather than a nicety — and more often the right answer is to leave it off.