Updated July 2026 · 6 min read
External controller port and web panels
The controller port is the core management interface, and every live number in the client UI is read from it. If a third-party dashboard can reach it, so can somebody else.
What it is for
external-controller exposes an HTTP management interface used to query node latency, switch policy groups, and read connections and logs. Everything moving on screen comes from that interface.
Clash Verge Rev puts it on 9097 on the local machine by default, with the mixed proxy port on 7897. Both are editable in Settings, so trust what your own UI shows.
Connecting a web dashboard
A dashboard only needs the address with port plus the secret to take over control. These panels usually expose more detail than the built-in UI and are handy for checking a machine at home from a phone.
The core also supports external-ui, which serves a dashboard from local files. That removes the dependency on an outside website and still works while your uplink is down.
The controller port is not the proxy port. Getting the proxy port wrong just means no internet; exposing the controller port hands over your whole proxy configuration.
Always set a secret
An empty secret is tolerable while the listener stays on 127.0.0.1. The moment you bind it to every interface for remote access, any device on the same network can rewrite your config and read your connection history.
Use a long random string, not a birthday or 123456. After changing it, every connected dashboard has to be re-entered, including the one on your phone.
If you genuinely need remote access
Prefer a tunnel back home or a VPN so the controller port is only ever reachable from a network you trust, instead of forwarding the port to the public internet.
If it is a one-off debugging session, set the listen address back to 127.0.0.1 afterwards. The firewall rule and the secret are two independent locks; do not rely on only one.
What is the project?
Clash Verge Rev is a Tauri-based GUI for Mihomo with profile management, system proxy, TUN mode, rule editing and WebDAV backups.