nas-tools/shadowrocket_public_ip_setup.md

Shadowrocket Setup with Public IP (No Tailscale VPN Needed)

✅ Solution: Proxy Now Accessible via Public IP

The proxy is now configured to listen on the public IP, so you can use Shadowrocket without Tailscale VPN!

Setup Steps

Step 1: Get Proxy Credentials

ssh server2 'cat ~/.clash_credentials.txt'

You'll see: username:password

Step 2: Configure Shadowrocket on iPhone

1. Disable Tailscale VPN (Settings → Tailscale → toggle OFF)

   • This frees up the VPN slot for Shadowrocket

2. Open Shadowrocket

   • Go to Home tab
   • Tap "+" to add server

3. Add HTTP Proxy with Authentication:

   • Type: HTTP
   • Address: 158.101.140.85 (server2's public IP)
   • Port: 7890 (HTTP) or 7892 (Mixed)
   • Username: (from credentials file)
   • Password: (from credentials file)
   • Remark: server2-proxy

4. Enable Shadowrocket:

   • Select your proxy server
   • Toggle switch ON
   • VPN icon should appear in status bar

Step 3: Test

1. Turn OFF Wi-Fi (use cellular only)
2. Open Safari
3. Visit: https://api.ipify.org
4. Should show: 158.101.140.85 (server2's IP) ✅

Proxy Details

• Public IP: 158.101.140.85
• Ports:
  • 7890 - HTTP
  • 7891 - SOCKS5
  • 7892 - Mixed (HTTP + SOCKS5) - Recommended
• Authentication: Required (username/password)

Security Notes

✅ Protected by:

• Username/password authentication
• Firewall rules (UFW active)
• Only proxy ports exposed (not SSH or other services)

⚠️ Considerations:

• Proxy is accessible from public internet
• Anyone with credentials can use it
• Monitor usage: ssh server2 'sudo journalctl -u clash-meta -f'

Advantages

✅ Works on both Wi-Fi and cellular ✅ No Tailscale VPN needed (can keep it off) ✅ Shadowrocket VPN mode works independently ✅ Simple setup

Get Credentials

Run this command to get your proxy credentials:

ssh server2 'cat ~/.clash_credentials.txt'

Then use them in Shadowrocket when adding the proxy server.

Troubleshooting

Can't connect?

1. Check server2 is online: ssh server2 'sudo systemctl status clash-meta'
2. Verify credentials are correct
3. Try different port: 7890, 7891, or 7892
4. Check firewall: ssh server2 'sudo ufw status'

Proxy slow?

• Normal - traffic goes: iPhone → Internet → server2 → Internet
• Depends on server2's connection speed

Change Credentials

If you want to change the password:

ssh server2 'openssl rand -base64 12'

Then update ~/.config/clash-meta/config.yaml and restart Clash.