How to Bypass OpenClash for One LAN Device

Start with the device, not a list of websites

Devices connected to the same router do not always need the same proxy setup. If you want one device to connect without using a proxy node, you do not need to put all of OpenClash into direct mode or write a separate rule for every website that device visits. LAN access control can exclude traffic by its source address before it reaches transparent proxy handling.

Here, a blacklist does not mean blocking Internet access. It is a list of devices that bypass OpenClash’s transparent proxy handling. This is a different entry point from a DIRECT rule evaluated by the core after traffic enters it. Whether the device can reach a service directly still depends on the underlying network.

This guide was checked against the fixed source of the actively maintained OpenClash v0.47.156. Its scope is an already working installation on an OpenWrt main router using fw4/nftables, Redir-Host compatibility mode without TUN, and IPv4. The verified LuCI labels are Simplified Chinese; the steps below use the corresponding English labels from the official source. OpenClash is a router plugin, not the desktop application Clash Verge Rev. No plugin installation or core replacement is involved, so you do not need to select a new CPU architecture or download an installer. Keep your working firmware and core.

Already using a whitelist? These steps assume blacklist mode is already in use. Switching between a whitelist and a blacklist changes how the entire LAN is handled; do not switch just to add one device without checking the effect on the others. The conclusions below do not cover Fake-IP, TUN, a side-router setup, multiple layers of NAT, or custom VLANs. Do not change your working mode simply to match this guide.

Add the device’s IPv4 address under Black&White

First compare the device’s current IPv4 address in its network information with the router’s device list. 192.168.1.50 is only an example. Enter the actual device address, not the router’s address or a website’s public IP. A DHCP-assigned address can change. If a reservation is already configured, use the corresponding address after checking it; an old screenshot is not enough to identify the device.

Before making changes, record the current access control mode and the complete list. Keep the existing entries for other devices. You need permission to administer this router, and you should make the change when a brief network interruption is acceptable.

Sign in to your router’s LuCI interface. Open Services → OpenClash → Plugin Settings, then the Black&White tab.
Confirm that LAN Access Control Mode is set to Black List Mode. If it is currently a whitelist, stop here and assess the existing policy first.
Add the device’s actual IPv4 address to LAN Bypassed Host List. Preserve existing entries and add only the device, not an entire subnet. Do not put its address in the separate WAN IP bypass field.
Check the address and mode again, then click Apply Settings. This saves the settings and restarts OpenClash. Wait for it to resume running before testing connections.

Commit and apply are different: Commit Settings only commits the settings. In this version, Apply Settings also restarts the application. Seeing an address remain in the list does not establish that the running rules have changed.

If these fields are missing, check the plugin version, current operating mode, and page location first. Do not respond by copying UCI commands from an unrelated guide or changing DNS hijacking. The instructions here were checked against the interface definitions and execution logic of the stated version. No real screenshot matching that exact interface could be confirmed, so an older image is not used as a substitute.

Check new connections, not just whether a page opens

After applying the change, reopen the application you want to test or establish a new connection on the target device. First check that an ordinary site you normally access directly still works. Then compare the result for a test destination that you confirmed used the proxy before the change and that you can confirm is reached over IPv4. A page that was already going direct and still opens afterwards does not demonstrate that the blacklist is working.

What you observe	What it tells you
New IPv4 connections no longer use the previous proxy exit	This is consistent with the device bypass. An exit-IP comparison is useful only when the direct connection and proxy node have different public exit addresses.
Devices not on the blacklist still follow their previous policy	This helps confirm that you did not switch the global mode or change the access control direction for the entire LAN.
Some connections still use a proxy	Check whether the device’s IP changed, whether the connection uses IPv6, and whether the device has its own proxy or VPN enabled.
Ordinary direct access also fails	Remove the entry you just added and keep the original configuration. Check the actual network path before making further changes.

The absence of a new proxy connection for that device in the connections panel can support the result, but cannot prove success by itself. The request might not have been sent, or there may be no corresponding connection when you look. An ongoing download or long-lived connection is also unsuitable for judging a new rule. Do not interrupt somebody else’s important work for this test.

Bypassing IPv4 does not bypass every connection from a device. This version handles IPv4 and IPv6 separately; adding one IPv4 address does not automatically cover IPv6. If the router uses Dnsmasq to forward DNS to Mihomo, the blacklist also does not mean that DNS queries will now avoid the core entirely. The result being checked is that this device’s IPv4 data connections bypass the transparent proxy. The guide makes no promise to change the DNS path and does not require disabling IPv6 across the network.

Remove this entry to restore the previous behavior

Return to the same blacklist page and remove only the device IPv4 address you just added. Keep all other entries, then click Apply Settings. Wait for OpenClash to resume running and use new connections to confirm that the device follows its original rules again. Those rules may themselves choose direct access, so restoring the previous behavior does not mean that every website must use a proxy.

If you changed other options during testing, use your initial notes to restore only those changes. There is no need to delete subscriptions, clear the configuration, update the core, or factory-reset the router. If you did not change the access control mode, leave that mode alone when undoing this entry.

If the device’s address changes later, the old entry may stop matching it. It may even match another device that is subsequently assigned the address. Periodically checking the relationship between an address and its device is more useful than continually adding similar entries. The aim remains one specific change: in the verified operating environment, let this device’s IPv4 connections bypass OpenClash’s transparent proxy handling.

Official sources and version scope

Version numbers, filenames, and interface labels can change. Confirm them in the linked project documentation before making changes.