Fix Clash "Address Already in Use" on Windows 11 and macOS: Free the Port or Change mixed-port

What the Error Means and Which Port Conflicts

A TCP port on your loopback or LAN interface is a single parking space. When Clash tries to bind to 7890 for the mixed-port (combined HTTP and SOCKS on one listener in many profiles), the operating system returns address already in use if any other program is already listening on that same IP and port. The conflict is local: you are not dealing with a blocked remote server yet. Common culprits include a forgotten copy of a proxy client, a dev server, a second Clash build started from the command line, or a corporate agent that reserved the same default port. The fix is always one of: stop the other process, or move Clash to a free high port and point your apps at the new one. If the core does start but traffic behaves oddly, reading connection logs for timeout and TLS errors is the next step—after the listener is actually up.

Know which fields your build actually uses. Many profiles set mixed-port to serve both HTTP and SOCKS; some older layouts split port (HTTP) and socks-port (SOCKS) separately. If you change one number, verify the others: a clash on 7890 is irrelevant if the real conflict is on 7891 or a DNS listen port. The Docker, CLI, and environment-variable guide for mixed-port shows how the same port appears in ALL_PROXY and browser switchers—if you reassign the listener, every consumer must move with it.

Windows 11: Find the Process and Free the Port

On Windows 11, the fastest way to see who holds a port is the built-in stack. Open PowerShell or Command Prompt and replace 7890 with the port your log line mentions. For a classic view, run netstat -ano | findstr :7890. The last column of the LISTENING line is a PID. Feed that to Task Manager: Details tab → right-click columns → enable PID, then match the number—or run tasklist /FI "PID eq 12345" to read the image name in text form.

PowerShell offers a more structured view: Get-NetTCPConnection -LocalPort 7890 -State Listen | Select OwningProcess on recent builds, then Get-Process -Id (that number) for a friendly name. If you are non-technical, open Resource Monitor (resmon) → Network → Listening Ports, sort by port, and read the process column—no install required. Before killing anything, ask whether the program should stay: ending an unrelated system service is not the goal; picking a new mixed-port in Clash is often kinder to your other tools.

If the PID belongs to an old Clash or helper tray app, quit it from the notification area, then confirm the port is free with a second netstat run. A zombie can linger when the GUI closed but a child process did not. For first-time Windows 11 installs with a GUI, Clash Verge Rev setup and TUN on Windows 11 shows where subscription import and “start on boot” interact with listeners—duplicated autostart is a common reason two cores fight for the same default port.

macOS: lsof, Activity Monitor, and Stopping a Listener

On the Mac, the terminal is usually quickest. For TCP port 7890: lsof -nP -iTCP:7890 -sTCP:LISTEN shows the process name, PID, and user. sudo lsof -i :7890 (broader) helps when multiple protocols appear. If you prefer a GUI, Activity Monitor → search by process name you saw in lsof, or use the Network tab in “Big Sur and later” / third-party inspectors—Console.app is not the right tool; stick to Activity Monitor or lsof for listen sockets.

To stop a user-owned process, kill PID is enough; for stubborn daemons, kill -9 only as a last step after you confirmed what you are ending. Re-run lsof to verify nothing is left in LISTEN state. Note that System Integrity Protection and Full Disk Access are unrelated to port binding, but a VPN kernel extension and Clash TUN on the same machine can create confusing startup order; after ports are free, if TUN and proxy both misbehave, the dedicated macOS TUN and system extension guide is the right long-form companion.

Change mixed-port, SOCKS, and HTTP in Profile or GUI

When you cannot or should not kill the other program, reassign Clash instead. In YAML at the top level (or your GUI’s “port” or “inbound” panel), set mixed-port: 17890 to an unused high port—odd numbers in the 17xxx–19xxx range rarely collide with web servers. If you still have separate port and socks-port fields, set them consistently with what your build expects, or use only mixed-port to reduce surface area, depending on the profile template your subscription ships.

Save the file, fully restart the client (tray “exit” and relaunch, not just minimize), and watch the log for “mixed http&socks proxy listening at …” with the new value. If your stack supports mixin for local overrides on top of a remote profile, you can place only the new port numbers in your local patch so the next subscription update does not wipe a hand-edited main file. That keeps “use port 17890 on this laptop” a three-line local delta.

mixed-port: 17890
# Optional if your profile does not use mixed:
# port: 17891
# socks-port: 17892
bind-address: '127.0.0.1'

Align Browsers, System Proxy, and Other Tools

Changing the port in YAML is only half the work: every tool that was pointed at the old number must follow. In browser switch extensions, update the local HTTP or SOCKS field to the new port. On Windows, if you previously set system proxy manually to 127.0.0.1:7890, open Settings → Network & internet → Proxy and adjust the static entry—or reset and let your client reapply after you use its “set system proxy” action. A mismatch here looks like “Clash is running but the browser is still direct,” not like a port bind error, but the same number must stay consistent. If you had symptoms where the app quit and the whole machine lost direct internet, the cleanup flow in fixing no internet after closing Clash on Windows 11 and macOS is relevant once you re-point ports and toggles in the right order.

WSL2, Docker, and IDEs that embed an HTTP client often have their own proxy settings or honor HTTP_PROXY. After you move the mixed port, update export HTTPS_PROXY=http://127.0.0.1:17890 (or the Windows host IP from inside WSL) in every shell profile that used the old value. A walked-through case for routing WSL2 through Clash on the Windows host is the reference when localhost in WSL does not mean the same loopback as on the host.

Verify: curl, Web UI, and a Clean Log Line

After the core starts, the log should show listeners without address already in use. Quick checks: curl -I -x http://127.0.0.1:17890 http://www.gstatic.com/generate_204 (replace port) should return quickly with a 204 or expected status through your proxy, not “connection refused.” For SOCKS, curl --socks5 127.0.0.1:... -I https://1.1.1.1 is a minimal handshake test. If you expose the Meta Web UI and external-controller, confirm that panel loads only after the core owns its ports; a failed bind often means the API never comes up, which looks like “Yacd is blank” when the true root cause is still the listener.

Revisit subscription update failures (404, 403, and cache) only after you are sure the local inbound is listening—otherwise you will chase remote HTTP codes while the engine never started.

Edge Cases: Second Clash, WSL, Docker, IDEs

Two GUI installs of a Clash family client, or one service plus one portable folder, can both try to use the same defaults on login. Unify on one launcher or give each profile a distinct mixed-port and config directory. IDEs and language package managers that ship a “local proxy for AI” may bind a port in the 78xx range—exactly the band many templates use—so a quick lsof or netstat often shows VS Code, JetBrains, or a test server as the winner, not malware.

Docker Desktop on Windows or Mac can forward host ports; if a container published -p 7890:7890, the host’s 7890 is gone for Clash. Change either the container mapping or Clash. When you are unsure which client distribution fits you, the cross-platform Clash client comparison helps separate Meta-class cores from wrappers so you do not run two full stacks at once.

Wrap-Up

Address already in use is one of the clearest errors in the book: a specific TCP port is taken on the address you asked Clash to bind. On Windows 11 and macOS, use netstat / Get-NetTCPConnection or lsof to get a PID, then decide to exit that program or to change mixed-port and every downstream reference—browser, system proxy, WSL, Docker, and scripts. A clean log line for the listener, a quick curl through the new port, and a working Web UI (if you use one) are enough to call the fix verified.

Get the habit of using one free high port for your own machine, documenting it, and reusing the same value in all helper configs so the next app update does not drag you back to 7890 by default. → Download Clash for free and experience the difference on a build that makes listener settings and effective YAML easy to read before you start routing real traffic.