# Shadowrocket Setup for Cellular Data

## The Solution

Since iOS doesn't support HTTP proxy for cellular data, you need to use **Shadowrocket VPN mode**. Here's how:

## Setup Steps

### Step 1: Configure Server (Already Done ✅)
- Clash now listens on all interfaces
- Firewall allows Tailscale network (100.x.x.x) only
- Proxy accessible at: `100.70.115.1:7890`

### Step 2: On Your iPhone

**Option A: Use Shadowrocket VPN Mode (Recommended for Cellular)**

1. **Disable Tailscale VPN:**
   - Open Tailscale app
   - Toggle VPN OFF (but keep app installed/running)
   - This frees up the VPN slot for Shadowrocket

2. **Configure Shadowrocket:**
   - Open Shadowrocket
   - Go to **Home** tab
   - Tap **"+"** to add server
   - Select **HTTP**
   - Enter:
     - **Address:** `100.70.115.1`
     - **Port:** `7890`
     - **Remark:** `server2-proxy`
   - Tap **Done**

3. **Enable Shadowrocket:**
   - Select `server2-proxy` in Home tab
   - Toggle switch **ON**
   - VPN icon should appear in status bar

4. **Test:**
   - Open Safari
   - Visit: https://api.ipify.org
   - Should show: `158.101.140.85` (server2's IP)
   - Works on both Wi-Fi and cellular! ✅

**How it works:**
- Shadowrocket creates a VPN connection
- It routes all traffic (Wi-Fi + cellular) through the proxy
- Traffic goes: iPhone → Shadowrocket VPN → Tailscale network → server2 proxy → Internet

**Note:** You'll lose direct Tailscale network access (can't SSH to other Tailscale devices), but proxy will work on both Wi-Fi and cellular.

### Option B: Keep Tailscale VPN, Use System Proxy (Wi-Fi Only)

If you need Tailscale network access:

1. **Keep Tailscale VPN ON**
2. **Don't use Shadowrocket VPN mode**
3. Configure system proxy for Wi-Fi:
   - Settings → Wi-Fi → ⓘ → HTTP Proxy → Manual
   - Server: `100.70.115.1`
   - Port: `7890`
4. **Cellular won't work** with this method (iOS limitation)

## Recommendation

**Use Option A (Shadowrocket VPN mode)** if you:
- Need proxy on cellular data
- Don't need direct Tailscale network access while using proxy
- Want it to work everywhere

**Use Option B (System proxy)** if you:
- Only need proxy on Wi-Fi
- Need direct Tailscale network access
- Can live without cellular proxy

## Switching Between Modes

You can easily switch:
- **Need proxy on cellular?** → Disable Tailscale VPN, enable Shadowrocket VPN
- **Need Tailscale network?** → Disable Shadowrocket VPN, enable Tailscale VPN
- **Need both?** → Use system proxy on Wi-Fi (but no cellular proxy)

## Testing

After setup:
1. Turn OFF Wi-Fi (use cellular only)
2. Open Safari
3. Visit: https://api.ipify.org
4. Should show server2's IP: `158.101.140.85`
5. If it shows your cellular IP, proxy isn't working

## Troubleshooting

**Proxy not working on cellular?**
- Make sure Shadowrocket VPN is enabled (VPN icon in status bar)
- Check that server2 is online: `ssh server2 'sudo systemctl status clash-meta'`
- Verify Tailscale network is reachable (even with VPN off, the network should exist)

**Can't reach other Tailscale devices?**
- That's expected when Shadowrocket VPN is on
- Disable Shadowrocket VPN and enable Tailscale VPN when you need direct access