# Troubleshooting Proxy Connection Timeout

## Issue
Connection test timeout when connecting to proxy from iPhone/Shadowrocket.

## Status Check
✅ Clash is running
✅ Listening on ports 7890, 7891, 7892
✅ Local connection works (tested from server2)
✅ Authentication configured
✅ UFW firewall allows ports

## Possible Causes

### 1. Oracle Cloud Security List / Firewall
Oracle Cloud has a **Security List** that acts as a firewall. Even if UFW allows the ports, Oracle's firewall might be blocking them.

**Solution:** Check Oracle Cloud Console:
1. Go to Oracle Cloud Console
2. Networking → Virtual Cloud Networks
3. Find your VCN
4. Security Lists → Ingress Rules
5. Add rules for ports 7890, 7891, 7892, 9090
   - Source: 0.0.0.0/0 (or your IP for security)
   - Protocol: TCP
   - Port: 7890, 7891, 7892, 9090

### 2. Network ACL
Oracle Cloud also has Network ACLs that might block traffic.

### 3. IPv6 vs IPv4
Clash shows as `tcp6` but `*:7890` means it listens on both IPv4 and IPv6. This should be fine.

### 4. Connection from iPhone
Test from a different network to see if it's network-specific.

## Quick Tests

### Test 1: Check if port is reachable
```bash
# From your Mac (not iPhone)
nc -zv 158.101.140.85 7890
# or
telnet 158.101.140.85 7890
```

### Test 2: Test from server2 itself
```bash
ssh server2 'curl -v --proxy http://proxy_user:Cs7yBx1Rh9oK@127.0.0.1:7890 http://httpbin.org/ip'
```

### Test 3: Check Oracle Cloud Security List
- Log into Oracle Cloud Console
- Check Security List rules for your instance

## Most Likely Issue: Oracle Cloud Security List

Oracle Cloud blocks all incoming traffic by default unless explicitly allowed in the Security List. UFW on the server won't help if Oracle's firewall blocks it first.

## Solution Steps

1. **Check Oracle Cloud Console:**
   - Go to your instance
   - Click on the VCN/subnet
   - Security Lists → Ingress Rules
   - Add rules for ports 7890, 7891, 7892

2. **Or use Oracle Cloud CLI:**
```bash
# Add security list rule (example - adjust for your setup)
oci network security-list update --security-list-id <your-security-list-id> ...
```

3. **Test again from iPhone after adding rules**