# Simple Workaround: Use Tailscale (Easiest)

## Quick Solution

Since you already have Tailscale set up, the **simplest workaround** is:

### Option 1: Use Tailscale + Shadowrocket (Temporarily)

1. **On iPhone:**
   - Enable **Tailscale VPN** (Settings → Tailscale → toggle ON)
   - Open **Shadowrocket**
   - Add server: `100.70.115.1:7890`
   - **Username:** `proxy_user`
   - **Password:** `Cs7yBx1Rh9oK`
   - Enable Shadowrocket

**Problem:** iOS only allows one VPN, so you can't use both...

### Option 2: Use Tailscale Only (No Shadowrocket)

1. **On iPhone:**
   - Enable **Tailscale VPN**
   - Settings → Wi-Fi → ⓘ → HTTP Proxy → Manual
   - **Server:** `100.70.115.1`
   - **Port:** `7890`
   - **Authentication:** Username/Password
     - **Username:** `proxy_user`
     - **Password:** `Cs7yBx1Rh9oK`

**Limitation:** Only works on Wi-Fi, not cellular (iOS limitation)

### Option 3: SSH Tunnel on Mac + Share with iPhone

**On your Mac:**

1. **Create SSH tunnel:**
```bash
ssh -L 7890:127.0.0.1:7890 -N server2
```

2. **Install a local proxy bridge** (like `cow` or `polipo`):
```bash
# Using polipo (if installed)
polipo proxyAddress=0.0.0.0 proxyPort=8080 parentProxy=127.0.0.1:7890
```

3. **On iPhone (same Wi-Fi):**
   - Settings → Wi-Fi → ⓘ → HTTP Proxy → Manual
   - **Server:** `192.168.1.XXX` (your Mac's IP)
   - **Port:** `8080`

### Option 4: Use WireGuard (You Already Have It!)

You have `wg0` interface on server2! Use WireGuard instead:

1. **On iPhone:** Install WireGuard app
2. **On server2:** Generate WireGuard config
3. **Connect via WireGuard** to access `100.70.115.1:7890`

This works because WireGuard creates a VPN, and you can use Shadowrocket's proxy chain feature.

## Recommended: Option 2 (Tailscale + System Proxy)

**Easiest and works now:**

1. Enable Tailscale VPN on iPhone
2. Configure system HTTP proxy:
   - Server: `100.70.115.1`
   - Port: `7890`
   - Username: `proxy_user`
   - Password: `Cs7yBx1Rh9oK`
3. Works on Wi-Fi (cellular won't work, but it's a temporary workaround)

## When You Get Console Access

Add Security List rules for ports 7890, 7891, 7892, 9090, then you can use Shadowrocket directly with public IP.