Imported from reason-machines/trending-skills (skills/masterhttprelayvpn-rust/SKILL.md). Install upstream with npx skills add reason-machines/trending-skills --skill masterhttprelayvpn-rust. Copyright stays with the author.

MasterHttpRelayVPN-RUST

Skill by ara.so — Daily 2026 Skills collection.

A Rust port of MasterHttpRelayVPN that routes traffic through a Google Apps Script relay, hiding the real destination from DPI/censorship systems. The ISP sees TLS SNI www.google.com; the actual request is proxied inside the encrypted tunnel through your own Google Apps Script deployment.

How it works

Browser → HTTP(8085)/SOCKS5(8086) → mhrv-rs → TLS to Google IP (SNI: www.google.com)
       → Google edge → Apps Script relay → real destination

Install

Prebuilt binaries (recommended)

Download from releases page:

Linux: mhrv-rs-linux-x86_64.tar.gz
macOS: mhrv-rs-macos-aarch64.tar.gz or mhrv-rs-macos-x86_64.tar.gz
Windows: mhrv-rs-windows-x86_64.zip
Android: mhrv-rs-android-universal-v*.apk

Build from source

# CLI only
cargo build --release

# CLI + desktop UI (egui)
cargo build --release --features ui

# Binaries output to:
# target/release/mhrv-rs       (CLI)
# target/release/mhrv-rs-ui    (Desktop UI)

First Run: Install MITM CA

Required for HTTPS interception. Run once with elevated privileges:

# macOS / Linux
sudo ./mhrv-rs --install-cert

# Windows (run as Administrator)
mhrv-rs.exe --install-cert

# Or use platform launchers (also starts the UI):
./run.command   # macOS
./run.sh        # Linux
run.bat         # Windows

The CA keypair is generated locally (ca/ca.crt + ca/ca.key) and never leaves your machine.

Configuration

Config file locations

macOS: ~/Library/Application Support/mhrv-rs/config.json
Linux: ~/.config/mhrv-rs/config.json
Windows: %APPDATA%\mhrv-rs\config.json
Fallback: ./config.json (current directory)

Minimal `config.json`

{
  "mode": "apps_script",
  "script_id": "AKfycby...",
  "auth_key": "$AUTH_KEY_FROM_CODE_GS",
  "google_ip": "216.239.38.120",
  "front_domain": "www.google.com",
  "http_port": 8085,
  "socks5_port": 8086
}

Full `config.json` with all options

{
  "mode": "apps_script",
  "script_id": "AKfycby...,AKfycbz...",
  "auth_key": "$YOUR_AUTH_KEY",
  "google_ip": "216.239.38.120",
  "front_domain": "www.google.com",
  "http_port": 8085,
  "socks5_port": 8086,
  "hosts": {
    "example.com": "direct"
  },
  "upstream_socks5": null
}

Key fields:

mode: "apps_script" (default) or "google_only" (no relay, Google domains only)
script_id: Deployment ID from Google Apps Script. Comma-separate multiple for round-robin rotation
auth_key: Secret matching AUTH_KEY in your Code.gs
google_ip: Google edge IP — 216.239.38.120 is a reliable default
front_domain: Keep as www.google.com
hosts: Per-domain overrides — "direct" bypasses the relay entirely
upstream_socks5: Forward through an external SOCKS5 (e.g. "127.0.0.1:1080")

Google-only mode (no Apps Script needed)

{
  "mode": "google_only",
  "google_ip": "216.239.38.120",
  "front_domain": "www.google.com",
  "http_port": 8085,
  "socks5_port": 8086
}

Use this to bootstrap — access script.google.com to deploy Code.gs when Google is blocked.

CLI Commands

# Start proxy server (reads config.json)
mhrv-rs serve

# Start with explicit config file
mhrv-rs serve --config /path/to/config.json

# Test end-to-end relay connectivity
mhrv-rs test

# Test SNI fronting only (no config required beyond google_ip + front_domain)
mhrv-rs test-sni

# Scan for fastest Google IP from your network
mhrv-rs scan-ips

# Install MITM CA to system trust store
mhrv-rs --install-cert

# Show version
mhrv-rs --version

# Show help
mhrv-rs --help

Deploy the Google Apps Script Relay

Go to https://script.google.com → New project
Replace default code with contents of Code.gs

Set your auth key:

const AUTH_KEY = "your-strong-secret-here";

Deploy → New deployment → Web app
- Execute as: Me
- Who has access: Anyone
Copy the Deployment ID (looks like AKfycby...)
Paste it into config.json as script_id

Common Patterns

Proxy browser traffic (HTTP proxy)

Set browser proxy to 127.0.0.1:8085 (HTTP). Most browsers: Settings → Network → Manual proxy.

# Test with curl through the HTTP proxy
curl -x http://127.0.0.1:8085 https://example.com

Proxy via SOCKS5

# curl via SOCKS5
curl --socks5 127.0.0.1:8086 https://example.com

# Use with any SOCKS5-aware application
export ALL_PROXY=socks5://127.0.0.1:8086

Multiple script IDs for higher quota

{
  "script_id": "AKfycby_first...,AKfycby_second...,AKfycby_third..."
}

Each Google Apps Script deployment has its own quota. Round-robin rotation spreads load.

Per-domain direct routing

{
  "hosts": {
    "internal.company.com": "direct",
    "192.168.1.0/24": "direct"
  }
}

Use with xray/v2ray as upstream

{
  "upstream_socks5": "127.0.0.1:10808"
}

Headless server deployment

# Run CLI in background
nohup mhrv-rs serve > mhrv-rs.log 2>&1 &

# Or with systemd
cat > /etc/systemd/system/mhrv-rs.service << 'EOF'
[Unit]
Description=MasterHttpRelayVPN-RUST
After=network.target

[Service]
ExecStart=/usr/local/bin/mhrv-rs serve
Restart=on-failure
User=nobody
WorkingDirectory=/etc/mhrv-rs

[Install]
WantedBy=multi-user.target
EOF

systemctl enable --now mhrv-rs

Desktop UI

# Launch UI directly
./mhrv-rs-ui        # Linux/macOS
mhrv-rs-ui.exe      # Windows

UI features:

Config form with all settings
Start / Stop proxy server
Test button — sends one request through the relay end-to-end
Scan button — finds fastest Google IP for your network
Live traffic stats
Log panel

Android

Install mhrv-rs-android-universal-v*.apk
Follow docs/android.md
The app uses TUN via tun2proxy to capture all device IP traffic

Android HTTPS caveat: From Android 7+, apps must opt in to trust user CAs. Chrome and Firefox work; Telegram, WhatsApp, Instagram, etc. do not. For those apps:

Use SOCKS5 mode: point in-app proxy to 127.0.0.1:1081
Use google_only mode for Google services (no CA needed)
Set upstream_socks5 to an external VPS

Troubleshooting

"Connection refused" on proxy port

# Check if mhrv-rs is running
ps aux | grep mhrv-rs

# Check ports are listening
ss -tlnp | grep -E '8085|8086'   # Linux
netstat -an | grep -E '8085|8086' # macOS/Windows

# Try a different port if 8085 is taken
# Set http_port: 8181 in config.json

HTTPS sites show certificate error

# CA not installed — run:
sudo mhrv-rs --install-cert

# Firefox: manually import ca/ca.crt
# Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import

Apps Script relay errors / quota exceeded

Add more script_id entries (comma-separated) for rotation
Check your Apps Script execution log at https://script.google.com
Verify AUTH_KEY in Code.gs matches auth_key in config.json

Find a working Google IP

mhrv-rs scan-ips

Update google_ip in config with the fastest result.

Can't reach script.google.com to deploy Code.gs

Use google_only mode temporarily:

cp config.google-only.example.json config.json
mhrv-rs serve
# Set browser proxy to 127.0.0.1:8085
# Now open script.google.com in browser and deploy Code.gs

Test SNI fronting without full config

mhrv-rs test-sni

Verify relay is working end-to-end

mhrv-rs test
# Or via curl:
curl -v -x http://127.0.0.1:8085 https://httpbin.org/ip

File Structure

mhrv-rs/                     # binary
mhrv-rs-ui/                  # desktop UI binary
config.json                  # your config
ca/
  ca.crt                     # MITM root cert (public, installed to system)
  ca.key                     # MITM root key (private, stays local)
assets/
  apps_script/
    Code.gs                  # Apps Script relay source to deploy to Google

masterhttprelayvpn-rust

About

MasterHttpRelayVPN-RUST

How it works

Install

Prebuilt binaries (recommended)

Build from source

First Run: Install MITM CA

Configuration

Config file locations

Minimal `config.json`

Full `config.json` with all options

Google-only mode (no Apps Script needed)

CLI Commands

Deploy the Google Apps Script Relay

Common Patterns

Proxy browser traffic (HTTP proxy)

Proxy via SOCKS5

Multiple script IDs for higher quota

Per-domain direct routing

Use with xray/v2ray as upstream

Headless server deployment

Desktop UI

Android

Troubleshooting

"Connection refused" on proxy port

HTTPS sites show certificate error

Apps Script relay errors / quota exceeded

Find a working Google IP

Can't reach script.google.com to deploy Code.gs

Test SNI fronting without full config

Verify relay is working end-to-end

File Structure

Use it

Manifest

Reviews

About

MasterHttpRelayVPN-RUST

How it works

Install

Prebuilt binaries (recommended)

Build from source

First Run: Install MITM CA

Configuration

Config file locations

Minimal config.json

Full config.json with all options

Google-only mode (no Apps Script needed)

CLI Commands

Deploy the Google Apps Script Relay

Common Patterns

Proxy browser traffic (HTTP proxy)

Proxy via SOCKS5

Multiple script IDs for higher quota

Per-domain direct routing

Use with xray/v2ray as upstream

Headless server deployment

Desktop UI

Android

Troubleshooting

"Connection refused" on proxy port

HTTPS sites show certificate error

Apps Script relay errors / quota exceeded

Find a working Google IP

Can't reach script.google.com to deploy Code.gs

Test SNI fronting without full config

Verify relay is working end-to-end

File Structure

Use it

Manifest

Reviews

Minimal `config.json`

Full `config.json` with all options