# Fix Network Security Group (NSG) Rules

## The Problem
Your instance has a **Network Security Group (NSG)** called `ig-quick-action-NSG` that might be blocking traffic even though Security List rules are added.

Oracle Cloud has **two firewall layers**:
1. **Security Lists** (VCN level) - ✅ You added rules here
2. **Network Security Groups (NSG)** (Instance level) - ❌ Might be blocking!

## Solution: Add Rules to NSG

### Step 1: Go to Network Security Group
From your instance details page (where you saw the VNIC info):

1. Find **"Network security groups"** section
2. Click on **"ig-quick-action-NSG"** (the blue link)
3. This opens the NSG details page

### Step 2: Add Ingress Rules
1. Click on **"Ingress Rules"** tab
2. Click **"Add Ingress Rules"**
3. Add the same 4 rules:

**Rule 1:**
- Source Type: CIDR
- Source CIDR: `0.0.0.0/0`
- IP Protocol: TCP
- Destination Port Range: `7890`
- Description: `Clash HTTP Proxy`

**Rule 2:**
- Source Type: CIDR
- Source CIDR: `0.0.0.0/0`
- IP Protocol: TCP
- Destination Port Range: `7891`
- Description: `Clash SOCKS5`

**Rule 3:**
- Source Type: CIDR
- Source CIDR: `0.0.0.0/0`
- IP Protocol: TCP
- Destination Port Range: `7892`
- Description: `Clash Mixed`

**Rule 4:**
- Source Type: CIDR
- Source CIDR: `0.0.0.0/0`
- IP Protocol: TCP
- Destination Port Range: `9090`
- Description: `Clash Web UI`

### Step 3: Save and Test
1. Click **"Add Ingress Rules"**
2. Wait 30-60 seconds
3. Test again: `curl --proxy http://proxy_user:Cs7yBx1Rh9oK@158.101.140.85:7890 http://httpbin.org/ip`

## Alternative: Remove NSG (If Not Needed)

If you don't need the NSG:
1. Go to instance → Primary VNIC
2. Click **"Edit"** next to Network security groups
3. Remove `ig-quick-action-NSG`
4. Save

Then Security List rules will be enough.

## Quick Path
```
Instance Details → Primary VNIC → Network security groups → ig-quick-action-NSG → Ingress Rules → Add Ingress Rules
```