# LAN proxy sharing

Source: https://onexray.com/docs/advanced/lan-proxy/
Description: Use an optional HTTP and SOCKS5 listener on a trusted network, with explicit startup, routing, Raw JSON and Apple platform limitations.
Language: en-US
Last updated: 2026-10-09


## Configure another device to use OneXray

Open **Advanced → Xray → LAN proxy sharing**, enable sharing and choose a port (`1024–65535`, default `11024`). Sharing is off by default. Start or restart VPN **from OneXray** to compile and apply the settings. On the other device, enter the OneXray device's actual LAN IP address and the sharing port in its HTTP or SOCKS5 proxy settings.

The listener binds to `0.0.0.0` and has **no authentication**. Any client able to reach it can use it; enable it only on a trusted network and control access with your firewall. `0.0.0.0` is a listening address, not the address to enter on another device and not a LAN-only access restriction.

HTTP, including CONNECT, and SOCKS5 share the same port. SOCKS5 UDP uses UDP ASSOCIATE with dynamically allocated relay ports; opening only the configured UDP port does not guarantee UDP connectivity. This is an explicit proxy, not hotspot or gateway traffic capture.

## When changes take effect

Saving the switch or port does not restart VPN or change a running listener. The next start/restart from the app applies the new setting. Widgets, tiles, Android automation and Apple on-demand starts reuse the last generated configuration, including its old sharing setting.

To disable an active listener, stop VPN and start it from the app after saving sharing as off. Stopping VPN closes the running listener, but a later background start can reuse the previous configuration until the app generates a new one.

## Routing and configuration ownership

Sharing applies to normal routing and both Custom Routing types. It adds one SOCKS inbound, `app-lan-proxy`; no separate HTTP inbound is needed. The selected routing rules apply to shared traffic. Rules restricted to `tunIn` do not match this inbound. Connection statistics count `tunIn` only and exclude shared traffic.

Complete Raw JSON is unaffected: configure any listener in your own Raw `inbounds`. The sharing setting is local to this device and is not transferred in connection backups. The local HTTP API and metrics remain loopback-only. Sharing ports must not conflict with the saved HTTP API port or advanced-template inbounds; existing user inbounds are not silently replaced.

## Platform limits

A visible setting is not proof of cross-device connectivity. Firewalls, mobile background restrictions, lock-screen behavior and UDP require testing on the actual device and installation channel.

Apple does not support hosting proxy listeners in Packet Tunnel Providers. OneXray's extension-based implementation has that platform limitation; the iOS foreground app is also not a reliable background proxy. See [Apple TN3120](https://developer.apple.com/documentation/technotes/tn3120-expected-use-cases-for-network-extension-packet-tunnel-providers).

[Fragment routing](https://onexray.com/docs/configuration/fragment/) · [Android automation](https://onexray.com/docs/advanced/android/) · [Windows modes](https://onexray.com/docs/advanced/windows/)