nas-tools/cellular_proxy_solution.md

Cellular Data Proxy Solution

The Problem

• ✅ Wi-Fi proxy works (configured in Wi-Fi settings)
• ❌ Cellular data proxy doesn't work (iOS doesn't allow HTTP proxy for cellular)
• ❌ Can't disable Tailscale VPN (proxy only listens on Tailscale IP: 100.70.115.1)

Solution Options

Solution 1: Use Shadowrocket VPN Mode (Recommended)

Shadowrocket's VPN mode works on both Wi-Fi and cellular, and can route through Tailscale's network.

Setup:

1. Keep Tailscale VPN ON (needed to reach 100.70.115.1)
2. In Shadowrocket:
   • Go to Home tab
   • Add server: 100.70.115.1:7890 (HTTP)
   • Enable Shadowrocket VPN mode
3. Shadowrocket will:
   • Intercept all traffic (Wi-Fi + cellular)
   • Route through Tailscale network to reach proxy
   • Forward to server2's proxy

Wait - iOS only allows one VPN! This won't work...

Solution 2: Make Clash Listen on Public IP (Less Secure)

Configure Clash to also listen on the public IP, then use Shadowrocket VPN mode.

Pros: Works on cellular, Shadowrocket can use it Cons: Less secure (exposed to public internet, but firewall should protect)

Solution 3: Use Tailscale's Built-in Proxy Feature

Tailscale has a built-in proxy feature that might work better.

Solution 4: Use Shadowrocket with Tailscale Subnet Router

Configure server2 as a Tailscale subnet router, then use Shadowrocket.

Recommended: Solution 2 (Make Clash Listen on Public IP with Firewall)

Since you need cellular access, let's make Clash accessible via public IP but keep it secure with firewall rules.