nas-tools/troubleshoot_proxy_timeout.md

Troubleshooting Proxy Connection Timeout

Issue

Connection test timeout when connecting to proxy from iPhone/Shadowrocket.

Status Check

✅ Clash is running ✅ Listening on ports 7890, 7891, 7892 ✅ Local connection works (tested from server2) ✅ Authentication configured ✅ UFW firewall allows ports

Possible Causes

1. Oracle Cloud Security List / Firewall

Oracle Cloud has a Security List that acts as a firewall. Even if UFW allows the ports, Oracle's firewall might be blocking them.

Solution: Check Oracle Cloud Console:

1. Go to Oracle Cloud Console
2. Networking → Virtual Cloud Networks
3. Find your VCN
4. Security Lists → Ingress Rules
5. Add rules for ports 7890, 7891, 7892, 9090
   • Source: 0.0.0.0/0 (or your IP for security)
   • Protocol: TCP
   • Port: 7890, 7891, 7892, 9090

2. Network ACL

Oracle Cloud also has Network ACLs that might block traffic.

3. IPv6 vs IPv4

Clash shows as tcp6 but *:7890 means it listens on both IPv4 and IPv6. This should be fine.

4. Connection from iPhone

Test from a different network to see if it's network-specific.

Quick Tests

Test 1: Check if port is reachable

# From your Mac (not iPhone)
nc -zv 158.101.140.85 7890
# or
telnet 158.101.140.85 7890

Test 2: Test from server2 itself

ssh server2 'curl -v --proxy http://proxy_user:Cs7yBx1Rh9oK@127.0.0.1:7890 http://httpbin.org/ip'

Test 3: Check Oracle Cloud Security List

• Log into Oracle Cloud Console
• Check Security List rules for your instance

Most Likely Issue: Oracle Cloud Security List

Oracle Cloud blocks all incoming traffic by default unless explicitly allowed in the Security List. UFW on the server won't help if Oracle's firewall blocks it first.

Solution Steps

1. Check Oracle Cloud Console:

   • Go to your instance
   • Click on the VCN/subnet
   • Security Lists → Ingress Rules
   • Add rules for ports 7890, 7891, 7892

2. Or use Oracle Cloud CLI:

# Add security list rule (example - adjust for your setup)
oci network security-list update --security-list-id <your-security-list-id> ...

3. Test again from iPhone after adding rules