iOS

iOS lets you configure a per-Wi-Fi HTTP proxy with authentication built into the UI — easier than Android.

Per-Wi-Fi proxy

1. Settings → Wi-Fi → {your network → ⓘ}.
2. Scroll to HTTP Proxy → Configure Proxy → Manual.
3. Fill in:

   • Server: gate.helodata.io (or ISP IP)
   • Port: 7777
   • Authentication: on
   • Username: full proxy username
   • Password: sub-user password
4. Save.

[screenshot: iOS HTTP Proxy form]

This affects all apps on the device when connected to that Wi-Fi — including Safari, Mail, App Store, and any app that uses the system HTTP stack.

What doesn't work

• Cellular data — there's no system proxy field for cellular. Use Wi-Fi or Shadowrocket.
• Apps with their own network stack — some games, some banking apps. Use Shadowrocket to force OS-level routing.
• SOCKS5 — iOS native UI doesn't support SOCKS proxies. Use Shadowrocket.

Auto / PAC config

In the Configure Proxy screen, pick Automatic and supply a PAC URL — useful for switching between targets without re-typing creds:

function FindProxyForURL(url, host) {
  if (host === "example.com")
    return "PROXY gate.helodata.io:7777";
  return "DIRECT";
}

Host a PAC file on any HTTPS URL and point iOS at it.

Verify

In Safari, visit https://ipv4.icanhazip.com — expect a helodata IP, not your home network's.

Common pitfalls

• Per-network only — different Wi-Fi networks each need their own proxy config.
• Captive portals — iOS shows the captive portal regardless of proxy, but post-login traffic uses the proxy. If portal pages don't render, briefly disable the proxy.
• App-bound certs — apps that pin their own TLS certs won't accept any proxy intercepting their connections. helodata doesn't intercept (it's a forwarder), so this rarely matters — but if you also run a MITM debug proxy alongside, that breaks pinning.