01

What each port is for

The mixed port accepts HTTP and SOCKS5 on the same listener, and for almost everyone it is the only port that matters. The external controller port is the management API: the client interface, dashboards and third-party tools all read status and switch nodes through it. The defaults have changed between versions, 7897 and 9097 on current builds and 7890 and 9090 on older ones, so a config carried over from an old install may still use the old numbers.

If your config also defines port or socks-port, those listen alongside the mixed port. There is rarely a reason to keep them; every extra listener is extra exposure.

Trust the interface, not the tutorial
Check the port your client is actually showing before you copy a number out of any guide, including this one.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes
02

Change ports in this order

  1. 1

    Change it in the client first

    Edit the mixed port in Clash settings and save. The system proxy follows automatically; you do not need to touch the Windows or macOS proxy settings by hand.

  2. 2

    Then update everything configured manually

    There are usually four places: git config --global http.proxy, the npm proxy setting, http_proxy in your shell profile, and any browser proxy switcher extension. None of them update themselves.

  3. 3

    Verify one layer at a time

    A page loading in the browser proves the system proxy is fine. Test the command line separately with curl. If only some apps fail, an old port is still written down somewhere.

03

When the port is taken

On Windows, find the PID with netstat -ano filtered by the port number, then identify it with tasklist. On macOS and Linux, lsof -i with the port does the same job in one command.

There is a stealthier case: nothing holds the port, yet it still cannot be bound. Hyper-V and WSL reserve large dynamic port ranges at boot, and nothing can bind inside them. Run netsh interface ipv4 show excludedportrange protocol=tcp to list the reserved ranges. If your port falls inside one, moving to a port outside the range is by far the quickest fix.

  • Pick something above 1024 and away from well-known services
  • Sharing with other devices also needs the allow LAN switch, not just a port change
  • Reload the browser afterwards so it stops reusing old connections
04

Common questions

It says the address is already in use but netstat shows nothing.

Either the port sits inside a Windows excluded range, or a previous core process never exited. Check Task Manager for a leftover core process first, then check the reserved ranges.

Can I disable the external controller port?

Not recommended. The dashboard, node switching and the connections list all depend on it. If you are worried about exposure, keep it bound to 127.0.0.1 rather than 0.0.0.0.