diff --git a/experimental/clashapi/server.go b/experimental/clashapi/server.go
index 1eec8448af..a62e67e169 100644
--- a/experimental/clashapi/server.go
+++ b/experimental/clashapi/server.go
@@ -95,6 +95,7 @@ func NewServer(ctx context.Context, router adapter.Router, logFactory log.Observ
 		AllowedHeaders: []string{"Content-Type", "Authorization"},
 		MaxAge:         300,
 	})
+	chiRouter.Use(setPrivateNetworkAccess)
 	chiRouter.Use(cors.Handler)
 	chiRouter.Group(func(r chi.Router) {
 		r.Use(authentication(options.Secret))
@@ -270,6 +271,15 @@ func castMetadata(metadata adapter.InboundContext) trafficontrol.Metadata {
 	}
 }
 
+func setPrivateNetworkAccess(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodOptions && r.Header.Get("Access-Control-Request-Method") != "" {
+			w.Header().Add("Access-Control-Allow-Private-Network", "true")
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
 func authentication(serverSecret string) func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		fn := func(w http.ResponseWriter, r *http.Request) {