# Cellular Data Proxy Solution

## The Problem
- ✅ Wi-Fi proxy works (configured in Wi-Fi settings)
- ❌ Cellular data proxy doesn't work (iOS doesn't allow HTTP proxy for cellular)
- ❌ Can't disable Tailscale VPN (proxy only listens on Tailscale IP: 100.70.115.1)

## Solution Options

### Solution 1: Use Shadowrocket VPN Mode (Recommended)

Shadowrocket's VPN mode works on **both Wi-Fi and cellular**, and can route through Tailscale's network.

**Setup:**
1. **Keep Tailscale VPN ON** (needed to reach 100.70.115.1)
2. In Shadowrocket:
   - Go to **Home** tab
   - Add server: `100.70.115.1:7890` (HTTP)
   - Enable Shadowrocket VPN mode
3. Shadowrocket will:
   - Intercept all traffic (Wi-Fi + cellular)
   - Route through Tailscale network to reach proxy
   - Forward to server2's proxy

**Wait - iOS only allows one VPN!** This won't work...

### Solution 2: Make Clash Listen on Public IP (Less Secure)

Configure Clash to also listen on the public IP, then use Shadowrocket VPN mode.

**Pros:** Works on cellular, Shadowrocket can use it
**Cons:** Less secure (exposed to public internet, but firewall should protect)

### Solution 3: Use Tailscale's Built-in Proxy Feature

Tailscale has a built-in proxy feature that might work better.

### Solution 4: Use Shadowrocket with Tailscale Subnet Router

Configure server2 as a Tailscale subnet router, then use Shadowrocket.

## Recommended: Solution 2 (Make Clash Listen on Public IP with Firewall)

Since you need cellular access, let's make Clash accessible via public IP but keep it secure with firewall rules.