mhr-vps-worker

mhr-vps-worker is a specialized adaptation of the mhr-cfw engine that replaces Cloudflare Workers with a private VPS-based node.js worker. This is the procedure I used to test it.

Step 1. Configure VPS

1.1. Install Node.JS and PM2

In this step, you will connect to your VPS via SSH and install Node.JS and PM2 (a production-grade daemon process manager for Node.JS).

SSH into your server, substituting in your real server IP where it says YOUR_SERVER_IP:

ssh root@YOUR_SERVER_IP

Get your server up to date:

apt update && apt upgrade -y

Download and install nvm:

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.4/install.sh | bash

In lieu of restarting your shell:

\. "$HOME/.nvm/nvm.sh"

Download and install Node.js:

nvm install 24

Verify the Node.js version:

node -v

It should print v24.15.0.

Verify npm version:

npm -v

It should print 11.12.1.

Install PM2:

npm install pm2 -g

1.2. Install mhr-vps-worker server.js

Open port 8081 in your Linux firewall:

iptables -I INPUT -p tcp --dport 8081 -j ACCEPT

Persist the new rule across reboots:

dpkg reconfigure iptables-persistent

Deploy the server.js file from https://github.com/aliasoblomov/mhr-vps-worker/tree/main/node-worker, and run it:

apt install -y git

git clone https://github.com/aliasoblomov/mhr-vps-worker.git

cd mhr-vps-worker/node-worker

pm2 start server.js --name mhr-relay --node-args="--max-http-header-size=65536"

You should see a green status indicating that mhr-relay is online.

Take a snapshot of your currently running process list and save it to a file:

pm2 save

1.3. Initial checks

To double-check, run:

pm2 logs mhr-relay

You should see the message:

Rock-Solid Worker running on port 8081

To exit the live stream of PM2 logs in your terminal, press Ctrl+c.

Check that it is listening on port 8081:

ss -tulpn | grep 8081

Response:

tcp LISTEN 0 511 0.0.0.0:8081 0.0.0.0:* users:(("node /root/mhr-",pid=2714,fd=23))

Exit your SSH session:

exit

Step 2. Set up Google Apps Script relay

Open Google Apps Script https://script.google.com.
Sign in with your Google account.
Click New project.
Rename it to, for example, mhr-vps-worker.
Delete all the default code in the editor.
Open the Code.gs file from this project https://github.com/aliasoblomov/mhr-vps-worker/tree/main/script (under script/), copy everything, and paste it into the Apps Script editor.
Change the authentication key STRONG_SECRET_KEY to something only you know.
Also substitute in your actual server IP for YOUR_VPS_IP.

// Replace with your Secret
const AUTH_KEY = "STRONG_SECRET_KEY";
// Replace with your VPS IP
const VPS_IP = "YOUR_VPS_IP"; 
const WORKER_URL = "http://" + VPS_IP + ":8081";

Save your edited script.
Click Deploy > New deployment.
Click the gear icon next to Select type, and choose Web app.
Enter a description, e.g. mhr-vps-worker.
Set Execute as Me (your Google account).
Set Who has access to Anyone.
Click Deploy.
Click Authorize access.
You will see a warning window. Click Advanced, Go to mhr-vps-worker (unsafe), Continue, and Done to approve it.
Click Deploy.
Copy the Deployment ID (it is a 72-character string). You'll need it when you configure the client.

Step 3. Install client on Windows

3.1. Install Python on client

If you have not already done so, install Python for Windows from https://www.python.org/downloads.

Once the installation is complete, check that you now have Python installed:

py --version

3.2. Download pip to client

If C:\Users\<your-windows-id>\AppData\Local\Python\pythoncore-3.14-64\Scripts does not already contain pip.exe, then download pip.exe like this:

Download the get-pip.py script by right-clicking and Save Link As from https://bootstrap.pypa.io/get-pip.py.
Open a command prompt.
cd to the folder containing the get-pip.py file:
Run the Python script by issuing the command py get-pip.py
You will see a message, WARNING: The scripts pip.exe, pip3.14.exe and pip3.exe are installed in 'C:\Users\<your-windows-id>\AppData\Local\Python\pythoncore-3.14-64\Scripts' which is not on PATH.

3.3. Add pip to path

Add pip.exe to your execution path:

In the Windows search box type env, and select Edit the system environment variables.
Click Environent Variables.
Click Path.
Click Edit.
Click New.
Fill in C:\Users\<your-windows-id>\AppData\Local\Python\pythoncore-3.14-64\Scripts, replacing <your-windows-id> by your actual Windows id on your local PC.
Click OK.
Click OK.
Click OK.

Restart your computer. After restarting, check that your path includes the Python scripts:

Either in a command prompt, issue the command echo %PATH%
Or in Windows PowerShell, issue the command $Env:Path

Check that you have pip installed:

pip --version

Response:

pip 26.1 from C:\Users\<your-windows-id>\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\pip (python 3.14)

3.4. Install mhr-vps-worker on client

Now download the project from https://github.com/aliasoblomov/mhr-vps-worker/archive/refs/heads/main.zip.

Unzip the zip file main.zip.

Change into the unzipped folder:

cd Downloads\mhr-vps-worker-main\mhr-vps-worker-main

Open a command prompt window here. Install the requirements:

pip install -r requirements.txt

Step 4. Configure client

In the mhr-vps-worker-main folder, make a copy of config.example.json named config.json.

Edit the config.json file (for example with Notepad or Notepad++).

        ...
	"script_id": "YOUR_APPS_SCRIPT_DEPLOYMENT_ID",
	"auth_key": "CHANGE_ME_TO_A_STRONG_SECRET",
        ...
	"relay_timeout": 25,
        ...

Make the following adjustments:

Update the script_id. You can enter either one Deployment ID or multiple Deployment IDs separated by commas (for load balancing).
Enter the authentication key you chose for the Google relay in Step 2.
Set relay_timeout to 60.

Save the file with your changes in it.

Step 5. Run client

Double-click the run.bat file to start the relay.

If necessary, click Run.

Say Yes to install the mhr-cfw root certificate.

You should see messages:

INFO [Proxy ] HTTP proxy listening on 0.0.0.0:8085 INFO [Proxy ] SOCKS5 proxy listening on 0.0.0.0:1080

A message may appear advising you to restart your browser at this stage.

Step 6. Configure browser to use client

Choose which proxy you prefer to use:

HTTP proxy on 127.0.0.1 port 8085
SOCKS5 proxy on 127.0.0.1 port 1080

Also set up one of these method to direct your browser to use the proxy:

Directly in Firefox network settings
Install FoxyProxy in Chrome
Windows system-wide proxy settings
Define a SOCKS5 proxy in v2rayN

Step 7. End-to-end test

Open ipleak.net in your browser.

You should see your VPS IP address.