Gan, Jimmy
119 lines
2.8 KiB
Markdown
119 lines
2.8 KiB
Markdown
# Fix Oracle Cloud Firewall for Proxy
|
|
|
|
## The Problem
|
|
Connection times out because **Oracle Cloud Security List** is blocking the ports, even though UFW allows them.
|
|
|
|
## Solution: Add Security List Rules in Oracle Cloud
|
|
|
|
### Method 1: Via Web Console (Easiest)
|
|
|
|
1. **Log into Oracle Cloud Console**
|
|
- Go to: https://cloud.oracle.com
|
|
- Navigate to your instance
|
|
|
|
2. **Find Your VCN/Subnet:**
|
|
- Go to **Networking** → **Virtual Cloud Networks**
|
|
- Click on your VCN
|
|
- Click on your **Subnet**
|
|
|
|
3. **Edit Security List:**
|
|
- Click on **Security Lists** tab
|
|
- Click on the default security list (or the one attached to your subnet)
|
|
- Click **Edit All Rules**
|
|
|
|
4. **Add Ingress Rules:**
|
|
Click **Add Ingress Rules** for each port:
|
|
|
|
**Rule 1: HTTP Proxy (7890)**
|
|
- **Source Type:** CIDR
|
|
- **Source CIDR:** `0.0.0.0/0` (or your IP for security)
|
|
- **IP Protocol:** TCP
|
|
- **Destination Port Range:** `7890`
|
|
- **Description:** Clash HTTP Proxy
|
|
|
|
**Rule 2: SOCKS5 Proxy (7891)**
|
|
- **Source Type:** CIDR
|
|
- **Source CIDR:** `0.0.0.0/0`
|
|
- **IP Protocol:** TCP
|
|
- **Destination Port Range:** `7891`
|
|
- **Description:** Clash SOCKS5 Proxy
|
|
|
|
**Rule 3: Mixed Proxy (7892)**
|
|
- **Source Type:** CIDR
|
|
- **Source CIDR:** `0.0.0.0/0`
|
|
- **IP Protocol:** TCP
|
|
- **Destination Port Range:** `7892`
|
|
- **Description:** Clash Mixed Proxy
|
|
|
|
**Rule 4: Web UI (9090)**
|
|
- **Source Type:** CIDR
|
|
- **Source CIDR:** `0.0.0.0/0`
|
|
- **IP Protocol:** TCP
|
|
- **Destination Port Range:** `9090`
|
|
- **Description:** Clash Web UI
|
|
|
|
5. **Save** the rules
|
|
|
|
6. **Wait 30 seconds** for rules to propagate
|
|
|
|
7. **Test again** from your iPhone
|
|
|
|
### Method 2: Via OCI CLI
|
|
|
|
If you have OCI CLI installed:
|
|
|
|
```bash
|
|
# Get your security list OCID
|
|
oci network security-list list --compartment-id <your-compartment-id>
|
|
|
|
# Add ingress rule
|
|
oci network security-list update \
|
|
--security-list-id <your-security-list-id> \
|
|
--ingress-security-rules file://ingress-rules.json
|
|
```
|
|
|
|
### Security Note
|
|
|
|
Using `0.0.0.0/0` allows access from anywhere. For better security:
|
|
- Use your home IP: `YOUR_IP/32`
|
|
- Or use a VPN IP range
|
|
- The proxy has authentication, so it's somewhat protected
|
|
|
|
## Verify Rules Are Applied
|
|
|
|
After adding rules, test:
|
|
|
|
```bash
|
|
# From your Mac (not iPhone)
|
|
nc -zv 158.101.140.85 7890
|
|
# Should show: Connection succeeded
|
|
```
|
|
|
|
## Alternative: Use Tailscale Instead
|
|
|
|
If you don't want to open ports publicly:
|
|
- Keep proxy on Tailscale IP only (100.70.115.1)
|
|
- Use Tailscale VPN on iPhone
|
|
- Access proxy via Tailscale network
|
|
|
|
But this requires Tailscale VPN, which conflicts with Shadowrocket VPN.
|
|
|
|
## Quick Checklist
|
|
|
|
- [ ] Logged into Oracle Cloud Console
|
|
- [ ] Found VCN and Subnet
|
|
- [ ] Opened Security List
|
|
- [ ] Added ingress rules for ports 7890, 7891, 7892, 9090
|
|
- [ ] Saved rules
|
|
- [ ] Waited 30 seconds
|
|
- [ ] Tested from iPhone
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|