accessing the vps and it's network in full tunnel mode

[runtimepath]

@therealaleph @vahidlazio

Thanks for your great project. it help alot in this state of internet in Iran.
I'm trying to access the VPS that i setup for full tunnel mode through the proxy but i can't.
also i tried to access the services that is connected to this VPS but that didn't work too.
is this the limitation of mhrv-tunnel and can it be fixed ?

[tixoonsp]

hey id suggest GooseRelayVPN
you can easily ssh to your vps after setting it up
it has a much more stable connection.

[therealaleph]

@(author) — accessing your VPS itself via Full Tunnel mode is a routing edge case. Your VPS is both:

1. The destination you want to reach (e.g., to admin it via SSH or visit a service running on it)
2. The tunnel endpoint that other traffic flows through

When mhrv-rs sends connect_data your-vps:22 through the Apps Script relay → tunnel-node → your-vps:22, the request goes:

Apps Script → tunnel-node (on your VPS:8443) → SSH on your VPS:22

The TCP connection from tunnel-node to localhost:22 SHOULD work because they're on the same machine. But two failure modes:

1. tunnel-node binds to 127.0.0.1:8443 instead of 0.0.0.0:8443. Apps Script can reach 0.0.0.0-bound services from the public internet but not 127.0.0.1-bound. Verify with:

ss -tlnp | grep :8443

Should show LISTEN 0 ... 0.0.0.0:8443 (or *:8443), NOT 127.0.0.1:8443.

2. UFW or cloud-provider firewall blocks tunnel-node from talking to localhost:22. Some restrictive cloud setups (especially Hetzner with strict default rules) firewall internal-bound traffic. Check:

sudo ufw status verbose | grep '22\|8443'

Recommended setup:

1. tunnel-node Docker:

   docker run -d --name mhrv-tunnel --restart unless-stopped \
     -p 8443:8443 -e TUNNEL_AUTH_KEY=your-secret \
     ghcr.io/therealaleph/mhrv-tunnel-node:latest

   The -p 8443:8443 binds to 0.0.0.0 automatically.

2. UFW open ports 8443/tcp and 22/tcp if you have UFW enabled:

   sudo ufw allow 8443/tcp
   sudo ufw allow 22/tcp
   sudo ufw reload

3. Configure browser/SSH client to use 127.0.0.1:8085 (HTTP) or 127.0.0.1:8086 (SOCKS5) and try connecting to your VPS by its public IP.

4. If you're running a web service on the VPS (port 80/443) and want to reach it via the tunnel, add it to passthrough_hosts in mhrv-rs config — that bypasses MITM for those hosts:

   "passthrough_hosts": ["your-vps-domain.com"]

Why "accessing services connected to it" doesn't work: if your service is talking to other Iran-blocked services from the VPS, mhrv-rs only proxies traffic from your local browser through the tunnel. Whatever the VPS itself reaches outbound is on the VPS's own network — that's not in scope for the client-side proxy.

If specific service is failing, paste:

• ss -tlnp | grep :8443 from VPS
• The actual mhrv-rs error message when you try to reach the VPS

---

_{[reply via Anthropic Claude | reviewed by @therealaleph]}