nas-tools/shadowrocket_cellular_setup.md

Shadowrocket Setup for Cellular Data

The Solution

Since iOS doesn't support HTTP proxy for cellular data, you need to use Shadowrocket VPN mode. Here's how:

Setup Steps

Step 1: Configure Server (Already Done ✅)

• Clash now listens on all interfaces
• Firewall allows Tailscale network (100.x.x.x) only
• Proxy accessible at: 100.70.115.1:7890

Step 2: On Your iPhone

Option A: Use Shadowrocket VPN Mode (Recommended for Cellular)

1. Disable Tailscale VPN:

   • Open Tailscale app
   • Toggle VPN OFF (but keep app installed/running)
   • This frees up the VPN slot for Shadowrocket

2. Configure Shadowrocket:

   • Open Shadowrocket
   • Go to Home tab
   • Tap "+" to add server
   • Select HTTP
   • Enter:
     • Address: 100.70.115.1
     • Port: 7890
     • Remark: server2-proxy
   • Tap Done

3. Enable Shadowrocket:

   • Select server2-proxy in Home tab
   • Toggle switch ON
   • VPN icon should appear in status bar

4. Test:

   • Open Safari
   • Visit: https://api.ipify.org
   • Should show: 158.101.140.85 (server2's IP)
   • Works on both Wi-Fi and cellular! ✅

How it works:

• Shadowrocket creates a VPN connection
• It routes all traffic (Wi-Fi + cellular) through the proxy
• Traffic goes: iPhone → Shadowrocket VPN → Tailscale network → server2 proxy → Internet

Note: You'll lose direct Tailscale network access (can't SSH to other Tailscale devices), but proxy will work on both Wi-Fi and cellular.

Option B: Keep Tailscale VPN, Use System Proxy (Wi-Fi Only)

If you need Tailscale network access:

1. Keep Tailscale VPN ON
2. Don't use Shadowrocket VPN mode
3. Configure system proxy for Wi-Fi:
   • Settings → Wi-Fi → ⓘ → HTTP Proxy → Manual
   • Server: 100.70.115.1
   • Port: 7890
4. Cellular won't work with this method (iOS limitation)

Recommendation

Use Option A (Shadowrocket VPN mode) if you:

• Need proxy on cellular data
• Don't need direct Tailscale network access while using proxy
• Want it to work everywhere

Use Option B (System proxy) if you:

• Only need proxy on Wi-Fi
• Need direct Tailscale network access
• Can live without cellular proxy

Switching Between Modes

You can easily switch:

• Need proxy on cellular? → Disable Tailscale VPN, enable Shadowrocket VPN
• Need Tailscale network? → Disable Shadowrocket VPN, enable Tailscale VPN
• Need both? → Use system proxy on Wi-Fi (but no cellular proxy)

Testing

After setup:

1. Turn OFF Wi-Fi (use cellular only)
2. Open Safari
3. Visit: https://api.ipify.org
4. Should show server2's IP: 158.101.140.85
5. If it shows your cellular IP, proxy isn't working

Troubleshooting

Proxy not working on cellular?

• Make sure Shadowrocket VPN is enabled (VPN icon in status bar)
• Check that server2 is online: ssh server2 'sudo systemctl status clash-meta'
• Verify Tailscale network is reachable (even with VPN off, the network should exist)

Can't reach other Tailscale devices?

• That's expected when Shadowrocket VPN is on
• Disable Shadowrocket VPN and enable Tailscale VPN when you need direct access