masterhttprelayvpn-rust

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

MasterHttpRelayVPN-RUST

Skill by ara.so — Daily 2026 Skills collection.

A Rust port of MasterHttpRelayVPN that routes traffic through a Google Apps Script relay, hiding the real destination from DPI/censorship systems. The ISP sees TLS SNI

www.google.com

; the actual request is proxied inside the encrypted tunnel through your own Google Apps Script deployment.

来自ara.so的技能 — 2026每日技能合集。

这是MasterHttpRelayVPN的Rust移植版本，通过Google Apps Script中继路由流量，向DPI/审查系统隐藏真实目标地址。ISP看到的TLS SNI为

www.google.com

；实际请求会在加密隧道内通过你自行部署的Google Apps Script进行代理。

How it works

工作原理

Browser → HTTP(8085)/SOCKS5(8086) → mhrv-rs → TLS to Google IP (SNI: www.google.com)
       → Google edge → Apps Script relay → real destination

浏览器 → HTTP(8085)/SOCKS5(8086) → mhrv-rs → 与Google IP建立TLS连接（SNI: www.google.com）
       → Google边缘节点 → Apps Script中继 → 真实目标地址

Install

安装

Prebuilt binaries (recommended)

预编译二进制文件（推荐）

Download from releases page:

Linux:
```
mhrv-rs-linux-x86_64.tar.gz
```

macOS:

mhrv-rs-macos-aarch64.tar.gz

mhrv-rs-macos-x86_64.tar.gz

Windows:
```
mhrv-rs-windows-x86_64.zip
```
Android:
```
mhrv-rs-android-universal-v*.apk
```

从发布页面下载：

Linux:
```
mhrv-rs-linux-x86_64.tar.gz
```

macOS:

mhrv-rs-macos-aarch64.tar.gz

或

mhrv-rs-macos-x86_64.tar.gz

Windows:
```
mhrv-rs-windows-x86_64.zip
```
Android:
```
mhrv-rs-android-universal-v*.apk
```

Build from source

从源码构建

bash

undefined

bash

undefined

CLI only

仅构建CLI

cargo build --release

CLI + desktop UI (egui)

构建CLI+桌面UI（基于egui）

cargo build --release --features ui

Binaries output to:

二进制文件输出路径：

target/release/mhrv-rs (CLI)

target/release/mhrv-rs (CLI版本)

target/release/mhrv-rs-ui (Desktop UI)

target/release/mhrv-rs-ui (桌面UI版本)

undefined

undefined

First Run: Install MITM CA

首次运行：安装MITM CA证书

Required for HTTPS interception. Run once with elevated privileges:

bash

undefined

HTTPS拦截功能需要此步骤。使用管理员权限运行一次：

bash

undefined

macOS / Linux

sudo ./mhrv-rs --install-cert

Windows (run as Administrator)

Windows（以管理员身份运行）

mhrv-rs.exe --install-cert

Or use platform launchers (also starts the UI):

或使用平台启动器（同时启动UI）：

./run.command # macOS ./run.sh # Linux run.bat # Windows


The CA keypair is generated locally (`ca/ca.crt` + `ca/ca.key`) and never leaves your machine.

./run.command # macOS ./run.sh # Linux run.bat # Windows


CA密钥对在本地生成（`ca/ca.crt` + `ca/ca.key`），绝不会离开你的设备。

Configuration

配置

Config file locations

配置文件位置

macOS:

~/Library/Application Support/mhrv-rs/config.json

Linux:
```
~/.config/mhrv-rs/config.json
```
Windows:
```
%APPDATA%\mhrv-rs\config.json
```
Fallback:
```
./config.json
```
(current directory)

macOS:

~/Library/Application Support/mhrv-rs/config.json

Linux:
```
~/.config/mhrv-rs/config.json
```
Windows:
```
%APPDATA%\mhrv-rs\config.json
```
备选路径：
```
./config.json
```
（当前目录）

Minimal

config.json

极简版

config.json

json

{
  "mode": "apps_script",
  "script_id": "AKfycby...",
  "auth_key": "$AUTH_KEY_FROM_CODE_GS",
  "google_ip": "216.239.38.120",
  "front_domain": "www.google.com",
  "http_port": 8085,
  "socks5_port": 8086
}

json

{
  "mode": "apps_script",
  "script_id": "AKfycby...",
  "auth_key": "$AUTH_KEY_FROM_CODE_GS",
  "google_ip": "216.239.38.120",
  "front_domain": "www.google.com",
  "http_port": 8085,
  "socks5_port": 8086
}

Full

config.json

with all options

包含所有选项的完整

config.json

json

{
  "mode": "apps_script",
  "script_id": "AKfycby...,AKfycbz...",
  "auth_key": "$YOUR_AUTH_KEY",
  "google_ip": "216.239.38.120",
  "front_domain": "www.google.com",
  "http_port": 8085,
  "socks5_port": 8086,
  "hosts": {
    "example.com": "direct"
  },
  "upstream_socks5": null
}

Key fields:

```
mode
```
:
```
"apps_script"
```
(default) or
```
"google_only"
```
(no relay, Google domains only)
```
script_id
```
: Deployment ID from Google Apps Script. Comma-separate multiple for round-robin rotation
```
auth_key
```
: Secret matching
```
AUTH_KEY
```
in your
```
Code.gs
```
```
google_ip
```
: Google edge IP —
```
216.239.38.120
```
is a reliable default
```
front_domain
```
: Keep as
```
www.google.com
```
```
hosts
```
: Per-domain overrides —
```
"direct"
```
bypasses the relay entirely
```
upstream_socks5
```
: Forward through an external SOCKS5 (e.g.
```
"127.0.0.1:1080"
```
)

json

{
  "mode": "apps_script",
  "script_id": "AKfycby...,AKfycbz...",
  "auth_key": "$YOUR_AUTH_KEY",
  "google_ip": "216.239.38.120",
  "front_domain": "www.google.com",
  "http_port": 8085,
  "socks5_port": 8086,
  "hosts": {
    "example.com": "direct"
  },
  "upstream_socks5": null
}

核心字段说明：

```
mode
```
:
```
"apps_script"
```
（默认）或
```
"google_only"
```
（无中继，仅访问Google域名）
```
script_id
```
: Google Apps Script的部署ID，多个ID用逗号分隔可实现轮询负载均衡
```
auth_key
```
: 需与
```
Code.gs
```
中的
```
AUTH_KEY
```
一致的密钥
```
google_ip
```
: Google边缘节点IP —
```
216.239.38.120
```
是可靠的默认值
```
front_domain
```
: 保持为
```
www.google.com
```
即可
```
hosts
```
: 按域名设置路由规则 —
```
"direct"
```
表示完全绕过中继
```
upstream_socks5
```
: 转发至外部SOCKS5代理（例如
```
"127.0.0.1:1080"
```
）

Google-only mode (no Apps Script needed)

仅Google模式（无需Apps Script）

json

{
  "mode": "google_only",
  "google_ip": "216.239.38.120",
  "front_domain": "www.google.com",
  "http_port": 8085,
  "socks5_port": 8086
}

Use this to bootstrap — access

script.google.com

to deploy

Code.gs

when Google is blocked.

json

{
  "mode": "google_only",
  "google_ip": "216.239.38.120",
  "front_domain": "www.google.com",
  "http_port": 8085,
  "socks5_port": 8086
}

当Google被屏蔽时，可使用此模式访问

script.google.com

来部署

Code.gs

。

CLI Commands

CLI命令

bash

undefined

bash

undefined

Start proxy server (reads config.json)

启动代理服务器（读取config.json）

mhrv-rs serve

Start with explicit config file

使用指定配置文件启动

mhrv-rs serve --config /path/to/config.json

Test end-to-end relay connectivity

测试端到端中继连通性

mhrv-rs test

Test SNI fronting only (no config required beyond google_ip + front_domain)

仅测试SNI前置（仅需google_ip + front_domain，无需完整配置）

mhrv-rs test-sni

Scan for fastest Google IP from your network

扫描网络中最快的Google IP

mhrv-rs scan-ips

Install MITM CA to system trust store

安装MITM CA证书到系统信任库

mhrv-rs --install-cert

Show version

显示版本

mhrv-rs --version

Show help

显示帮助

mhrv-rs --help

undefined

mhrv-rs --help

undefined

Deploy the Google Apps Script Relay

部署Google Apps Script中继

Go to https://script.google.com → New project
Replace default code with contents of
```
Code.gs
```

Set your auth key:

javascript

const AUTH_KEY = "your-strong-secret-here";

Deploy → New deployment → Web app
- Execute as: Me
- Who has access: Anyone
Copy the Deployment ID (looks like
```
AKfycby...
```
)
Paste it into
```
config.json
```
as
```
script_id
```

访问https://script.google.com → 新建项目
将默认代码替换为
```
Code.gs
```
的内容

设置你的认证密钥：

javascript

const AUTH_KEY = "your-strong-secret-here";

部署 → 新建部署 → Web应用
- 执行方式：我
- 访问权限：任何人
复制部署ID（格式类似
```
AKfycby...
```
）
将其粘贴到
```
config.json
```
的
```
script_id
```
字段中

Common Patterns

常见使用场景

Proxy browser traffic (HTTP proxy)

代理浏览器流量（HTTP代理）

Set browser proxy to

127.0.0.1:8085

(HTTP). Most browsers: Settings → Network → Manual proxy.

bash

undefined

将浏览器代理设置为

127.0.0.1:8085

（HTTP）。大多数浏览器设置路径：设置 → 网络 → 手动配置代理。

bash

undefined

Test with curl through the HTTP proxy

使用curl通过HTTP代理测试

curl -x http://127.0.0.1:8085 https://example.com

undefined

curl -x http://127.0.0.1:8085 https://example.com

undefined

Proxy via SOCKS5

通过SOCKS5代理

bash

undefined

bash

undefined

curl via SOCKS5

使用curl通过SOCKS5代理

curl --socks5 127.0.0.1:8086 https://example.com

Use with any SOCKS5-aware application

在支持SOCKS5的应用中使用

export ALL_PROXY=socks5://127.0.0.1:8086

undefined

export ALL_PROXY=socks5://127.0.0.1:8086

undefined

Multiple script IDs for higher quota

多脚本ID提升配额

json

{
  "script_id": "AKfycby_first...,AKfycby_second...,AKfycby_third..."
}

Each Google Apps Script deployment has its own quota. Round-robin rotation spreads load.

json

{
  "script_id": "AKfycby_first...,AKfycby_second...,AKfycby_third..."
}

每个Google Apps Script部署都有独立配额，轮询模式可分散负载。

Per-domain direct routing

按域名设置直连路由

json

{
  "hosts": {
    "internal.company.com": "direct",
    "192.168.1.0/24": "direct"
  }
}

json

{
  "hosts": {
    "internal.company.com": "direct",
    "192.168.1.0/24": "direct"
  }
}

Use with xray/v2ray as upstream

与xray/v2ray配合作为上游代理

json

{
  "upstream_socks5": "127.0.0.1:10808"
}

json

{
  "upstream_socks5": "127.0.0.1:10808"
}

Headless server deployment

无头服务器部署

bash

undefined

bash

undefined

Run CLI in background

后台运行CLI

nohup mhrv-rs serve > mhrv-rs.log 2>&1 &

Or with systemd

或使用systemd管理

cat > /etc/systemd/system/mhrv-rs.service << 'EOF' [Unit] Description=MasterHttpRelayVPN-RUST After=network.target

[Service] ExecStart=/usr/local/bin/mhrv-rs serve Restart=on-failure User=nobody WorkingDirectory=/etc/mhrv-rs

[Install] WantedBy=multi-user.target EOF

systemctl enable --now mhrv-rs

undefined

cat > /etc/systemd/system/mhrv-rs.service << 'EOF' [Unit] Description=MasterHttpRelayVPN-RUST After=network.target

[Service] ExecStart=/usr/local/bin/mhrv-rs serve Restart=on-failure User=nobody WorkingDirectory=/etc/mhrv-rs

[Install] WantedBy=multi-user.target EOF

systemctl enable --now mhrv-rs

undefined

Desktop UI

桌面UI

bash

undefined

bash

undefined

Launch UI directly

直接启动UI

./mhrv-rs-ui # Linux/macOS mhrv-rs-ui.exe # Windows


UI features:
- Config form with all settings
- **Start / Stop** proxy server
- **Test** button — sends one request through the relay end-to-end
- **Scan** button — finds fastest Google IP for your network
- Live traffic stats
- Log panel

./mhrv-rs-ui # Linux/macOS mhrv-rs-ui.exe # Windows


UI功能：
- 包含所有设置的配置表单
- **启动/停止**代理服务器
- **测试**按钮 — 通过中继发送端到端请求
- **扫描**按钮 — 为你的网络查找最快的Google IP
- 实时流量统计
- 日志面板

Android

Android端使用

Install
```
mhrv-rs-android-universal-v*.apk
```
Follow docs/android.md
The app uses TUN via
```
tun2proxy
```
to capture all device IP traffic

Android HTTPS caveat: From Android 7+, apps must opt in to trust user CAs. Chrome and Firefox work; Telegram, WhatsApp, Instagram, etc. do not. For those apps:

Use SOCKS5 mode: point in-app proxy to
```
127.0.0.1:1081
```
Use
```
google_only
```
mode for Google services (no CA needed)
Set
```
upstream_socks5
```
to an external VPS

安装
```
mhrv-rs-android-universal-v*.apk
```
参考docs/android.md
应用通过
```
tun2proxy
```
使用TUN捕获设备所有IP流量

Android HTTPS注意事项： 从Android 7开始，应用必须主动选择信任用户CA证书。Chrome和Firefox可正常使用；但Telegram、WhatsApp、Instagram等应用不行。针对这些应用：

使用SOCKS5模式：在应用内设置代理为
```
127.0.0.1:1081
```
针对Google服务使用
```
google_only
```
模式（无需CA证书）
将
```
upstream_socks5
```
设置为外部VPS代理

Troubleshooting

故障排查

"Connection refused" on proxy port

代理端口出现“Connection refused”

bash

undefined

bash

undefined

Check if mhrv-rs is running

检查mhrv-rs是否在运行

ps aux | grep mhrv-rs

Check ports are listening

检查端口是否处于监听状态

ss -tlnp | grep -E '8085|8086' # Linux netstat -an | grep -E '8085|8086' # macOS/Windows

Try a different port if 8085 is taken

如果8085端口被占用，尝试更换端口

Set http_port: 8181 in config.json

在config.json中设置http_port: 8181

undefined

undefined

HTTPS sites show certificate error

HTTPS网站显示证书错误

bash

undefined

bash

undefined

CA not installed — run:

未安装CA证书 — 执行：

sudo mhrv-rs --install-cert

Firefox: manually import ca/ca.crt

Firefox：手动导入ca/ca.crt

Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import

设置 → 隐私与安全 → 证书 → 查看证书 → 证书颁发机构 → 导入

undefined

undefined

Apps Script relay errors / quota exceeded

Apps Script中继报错/配额超限

Add more
```
script_id
```
entries (comma-separated) for rotation
Check your Apps Script execution log at https://script.google.com
Verify
```
AUTH_KEY
```
in
```
Code.gs
```
matches
```
auth_key
```
in
```
config.json
```

添加多个
```
script_id
```
（逗号分隔）实现轮询
在https://script.google.com查看Apps Script执行日志
验证
```
Code.gs
```
中的
```
AUTH_KEY
```
与
```
config.json
```
中的
```
auth_key
```
是否一致

Find a working Google IP

查找可用的Google IP

bash

mhrv-rs scan-ips

Update

google_ip

in config with the fastest result.

bash

mhrv-rs scan-ips

将

config.json

中的

google_ip

更新为最快的结果。

Can't reach script.google.com to deploy Code.gs

无法访问script.google.com部署Code.gs

Use

google_only

mode temporarily:

bash

cp config.google-only.example.json config.json
mhrv-rs serve

临时使用

google_only

模式：

bash

cp config.google-only.example.json config.json
mhrv-rs serve

Set browser proxy to 127.0.0.1:8085

将浏览器代理设置为127.0.0.1:8085

Now open script.google.com in browser and deploy Code.gs

现在在浏览器中打开script.google.com并部署Code.gs

undefined

undefined

Test SNI fronting without full config

无需完整配置即可测试SNI前置

bash

mhrv-rs test-sni

bash

mhrv-rs test-sni

Verify relay is working end-to-end

验证中继端到端工作正常

bash

mhrv-rs test

bash

mhrv-rs test

Or via curl:

或使用curl测试：

curl -v -x http://127.0.0.1:8085 https://httpbin.org/ip

undefined

curl -v -x http://127.0.0.1:8085 https://httpbin.org/ip

undefined

File Structure

文件结构

mhrv-rs/                     # binary
mhrv-rs-ui/                  # desktop UI binary
config.json                  # your config
ca/
  ca.crt                     # MITM root cert (public, installed to system)
  ca.key                     # MITM root key (private, stays local)
assets/
  apps_script/
    Code.gs                  # Apps Script relay source to deploy to Google

mhrv-rs/                     # CLI二进制文件
mhrv-rs-ui/                  # 桌面UI二进制文件
config.json                  # 你的配置文件
ca/
  ca.crt                     # MITM根证书（公钥，安装到系统）
  ca.key                     # MITM根密钥（私钥，仅保存在本地）
assets/
  apps_script/
    Code.gs                  # 需部署到Google的Apps Script中继源码

masterhttprelayvpn-rust

Original

Translation

MasterHttpRelayVPN-RUST

MasterHttpRelayVPN-RUST

How it works

工作原理

Install

安装

Prebuilt binaries (recommended)

预编译二进制文件（推荐）

Build from source

从源码构建

CLI only

仅构建CLI

CLI + desktop UI (egui)

构建CLI+桌面UI（基于egui）

Binaries output to:

二进制文件输出路径：

target/release/mhrv-rs (CLI)

target/release/mhrv-rs (CLI版本)

target/release/mhrv-rs-ui (Desktop UI)

target/release/mhrv-rs-ui (桌面UI版本)

First Run: Install MITM CA

首次运行：安装MITM CA证书

macOS / Linux

macOS / Linux

Windows (run as Administrator)

Windows（以管理员身份运行）

Or use platform launchers (also starts the UI):

或使用平台启动器（同时启动UI）：

Configuration

配置

Config file locations

配置文件位置

Minimal config.json

极简版config.json

Full config.json with all options

包含所有选项的完整config.json

Google-only mode (no Apps Script needed)

仅Google模式（无需Apps Script）

CLI Commands

CLI命令

Start proxy server (reads config.json)

启动代理服务器（读取config.json）

Start with explicit config file

使用指定配置文件启动

Test end-to-end relay connectivity

测试端到端中继连通性

Test SNI fronting only (no config required beyond google_ip + front_domain)

仅测试SNI前置（仅需google_ip + front_domain，无需完整配置）

Scan for fastest Google IP from your network

扫描网络中最快的Google IP

Install MITM CA to system trust store

安装MITM CA证书到系统信任库

Show version

显示版本

Show help

显示帮助

Deploy the Google Apps Script Relay

部署Google Apps Script中继

Common Patterns

常见使用场景

Proxy browser traffic (HTTP proxy)

代理浏览器流量（HTTP代理）

Test with curl through the HTTP proxy

使用curl通过HTTP代理测试

Proxy via SOCKS5

通过SOCKS5代理

curl via SOCKS5

使用curl通过SOCKS5代理

Use with any SOCKS5-aware application

在支持SOCKS5的应用中使用

Multiple script IDs for higher quota

多脚本ID提升配额

Per-domain direct routing

按域名设置直连路由

Use with xray/v2ray as upstream

与xray/v2ray配合作为上游代理

Headless server deployment

Minimal
`config.json`

极简版
`config.json`

Full
`config.json`
with all options

包含所有选项的完整
`config.json`