Environment
- mhrv-rs version:
v1.9.15
- Mode:
full (GitHub Actions tunnel via cloudflared Quick)
- OS: Windows 10
- ISP: ADSL (Mokhaberat Iran)
Problem Summary
I followed the official cloudflared-quick.md guide exactly. The GitHub Actions workflow runs, the tunnel URL is generated, CodeFull.gs is deployed with correct TUNNEL_SERVER_URL and TUNNEL_AUTH_KEY. However, every batch operation through the relay returns:
WARN batch failed (script AKfy...): relay error: batch tunnel HTTP 403
The response body is a Google Docs HTML page (in Persian) that says:
<!DOCTYPE html><html lang="fa" dir="rtl"><head><meta name="description" content="پردازش کلمه وب، ارائه‌ها و صفحات گسترده">
This means CodeFull.gs is trying to reach the trycloudflare.com tunnel URL via UrlFetchApp.fetch(), but Google's outbound servers are being blocked/403'd by Cloudflare (or vice versa). The script then gets blacklisted for 600 seconds.
What This Confirms
The apps_script outbound IP range is so heavily flagged or restricted that even connecting to a free Cloudflare Quick Tunnel is forbidden. The same IP range that causes sites like val.town, chatgpt.com, and aistudio.google.com to return errors or CAPTCHAs, also prevents the relay from talking to any Cloudflare-backed exit node.
This means the GitHub Actions tunnel method — which was added precisely for users without VPS access — is unusable from Iran for the same underlying reason that apps_script mode itself is failing for many sites.
Request
Is there any planned workaround for this? Could CodeFull.gs be modified to route its outbound traffic through a different path (e.g., a user-supplied SOCKS5 proxy via upstream_socks5 or a future tunnel_socks5 setting), so that the outbound request to trycloudflare.com does not originate from the flagged Google IP range? Or is an alternative tunnel provider (ngrok, etc.) known to work where cloudflared does not?
For now, users in Iran are completely stuck: apps_script times out, exit_node signup is impossible, and the free tunnel path is blocked. A solution that allows the relay to reach an exit node through a different outbound IP would unlock the entire setup.
Attachments
My config.json (with secrets redacted):
{
"mode": "full",
"google_ip": "216.239.38.120",
"front_domain": "www.google.com",
"script_id": "***",
"auth_key": "***",
"listen_host": "127.0.0.1",
"listen_port": 8085,
"socks5_port": 8086,
"log_level": "info",
"verify_ssl": true,
"sni_hosts": [
"www.google.com",
"mail.google.com",
"drive.google.com",
"docs.google.com",
"calendar.google.com",
"accounts.google.com",
"scholar.google.com",
"maps.google.com",
"chat.google.com",
"translate.google.com",
"play.google.com",
"lens.google.com",
"chromewebstore.google.com"
],
"fetch_ips_from_api": true,
"max_ips_to_scan": 100,
"scan_batch_size": 500,
"google_ip_validation": true,
"tunnel_doh": true,
"block_doh": false
}Log output showing the 403 error:
2026-05-07T09:13:11.371975Z INFO batch: 1 ops → AKfycbw9, rtt=1.0326297s
2026-05-07T09:13:11.371982Z WARN batch failed (script AKfycbw9): relay error: batch tunnel HTTP 403: <!DOCTYPE html><html lang="fa" dir="rtl"><head><meta name="description" content="پردازش کلمه وب، ارائه‌ها و صفحات گسترده"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-
2026-05-07T09:13:11.372005Z ERROR tunnel connect_data error for beacons5.gvt2.com:443: relay error: batch tunnel HTTP 403: <!DOCTYPE html><html lang="fa" dir="rtl"><head><meta name="description" content="پردازش کلمه وب، ارائه‌ها و صفحات گسترده"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-
2026-05-07T09:13:11.634633Z WARN blacklisted script AKfy...k5Qo for 600s: HTTP 403
2026-05-07T09:13:11.634648Z INFO batch: 2 ops → AKfycbw9, rtt=1.0631053s
2026-05-07T09:13:11.634654Z WARN batch failed (script AKfycbw9): relay error: batch tunnel HTTP 403: <!DOCTYPE html><html lang="fa" dir="rtl"><head><meta name="description" content="پردازش کلمه وب، ارائه‌ها و صفحات گسترده"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-
2026-05-07T09:13:11.634677Z ERROR tunnel connect_data error for optimizationguide-pa.googleapis.com:443: relay error: batch tunnel HTTP 403: <!DOCTYPE html><html lang="fa" dir="rtl"><head><meta name="description" content="پردازش کلمه وب، ارائه‌ها و صفحات گسترده"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-
2026-05-07T09:13:11.634681Z ERROR tunnel connect_data error for translate.google.com:443: relay error: batch tunnel HTTP 403: <!DOCTYPE html><html lang="fa" dir="rtl"><head><meta name="description" content="پردازش کلمه وب، ارائه‌ها و صفحات گسترده"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-
2026-05-07T09:13:11.636970Z INFO dispatch beacons5.gvt3.com:443 -> full tunnel (via batch mux)
2026-05-07T09:13:12.833895Z WARN blacklisted script AKfy...k5Qo for 600s: HTTP 403
2026-05-07T09:13:12.833915Z INFO batch: 1 ops → AKfycbw9, rtt=1.1816635s
2026-05-07T09:13:12.833924Z WARN batch failed (script AKfycbw9): relay error: batch tunnel HTTP 403: <!DOCTYPE html><html lang="fa" dir="rtl"><head><meta name="description" content="پردازش کلمه وب، ارائه‌ها و صفحات گسترده"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-
2026-05-07T09:13:12.833944Z ERROR tunnel connect_data error for beacons5.gvt3.com:443: relay error: batch tunnel HTTP 403: <!DOCTYPE html><html lang="fa" dir="rtl"><head><meta name="description" content="پردازش کلمه وب، ارائه‌ها و صفحات گسترده"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-
2026-05-07T09:13:12.835204Z INFO dispatch beacons5.gvt3.com:443 -> full tunnel (via batch mux)
2026-05-07T09:13:13.478302Z WARN blacklisted script AKfy...k5Qo for 600s: HTTP 403
2026-05-07T09:13:13.478327Z INFO batch: 1 ops → AKfycbw9, rtt=624.1577ms
2026-05-07T09:13:13.478340Z WARN batch failed (script AKfycbw9): relay error: batch tunnel HTTP 403: <!DOCTYPE html><html lang="fa" dir="rtl"><head><meta name="description" content="پردازش کلمه وب، ارائه‌ها و صفحات گسترده"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-
2026-05-07T09:13:13.478379Z ERROR tunnel connect_data error for beacons5.gvt3.com:443: relay error: batch tunnel HTTP 403: <!DOCTYPE html><html lang="fa" dir="rtl"><head><meta name="description" content="پردازش کلمه وب، ارائه‌ها و صفحات گسترده"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-
Environment
v1.9.15full(GitHub Actions tunnel via cloudflared Quick)Problem Summary
I followed the official
cloudflared-quick.mdguide exactly. The GitHub Actions workflow runs, the tunnel URL is generated,CodeFull.gsis deployed with correctTUNNEL_SERVER_URLandTUNNEL_AUTH_KEY. However, every batch operation through the relay returns:The response body is a Google Docs HTML page (in Persian) that says:
This means
CodeFull.gsis trying to reach thetrycloudflare.comtunnel URL viaUrlFetchApp.fetch(), but Google's outbound servers are being blocked/403'd by Cloudflare (or vice versa). The script then gets blacklisted for 600 seconds.What This Confirms
The
apps_scriptoutbound IP range is so heavily flagged or restricted that even connecting to a free Cloudflare Quick Tunnel is forbidden. The same IP range that causes sites likeval.town,chatgpt.com, andaistudio.google.comto return errors or CAPTCHAs, also prevents the relay from talking to any Cloudflare-backed exit node.This means the GitHub Actions tunnel method — which was added precisely for users without VPS access — is unusable from Iran for the same underlying reason that
apps_scriptmode itself is failing for many sites.Request
Is there any planned workaround for this? Could CodeFull.gs be modified to route its outbound traffic through a different path (e.g., a user-supplied SOCKS5 proxy via
upstream_socks5or a futuretunnel_socks5setting), so that the outbound request totrycloudflare.comdoes not originate from the flagged Google IP range? Or is an alternative tunnel provider (ngrok, etc.) known to work where cloudflared does not?For now, users in Iran are completely stuck:
apps_scripttimes out,exit_nodesignup is impossible, and the free tunnel path is blocked. A solution that allows the relay to reach an exit node through a different outbound IP would unlock the entire setup.Attachments
My
config.json(with secrets redacted):{ "mode": "full", "google_ip": "216.239.38.120", "front_domain": "www.google.com", "script_id": "***", "auth_key": "***", "listen_host": "127.0.0.1", "listen_port": 8085, "socks5_port": 8086, "log_level": "info", "verify_ssl": true, "sni_hosts": [ "www.google.com", "mail.google.com", "drive.google.com", "docs.google.com", "calendar.google.com", "accounts.google.com", "scholar.google.com", "maps.google.com", "chat.google.com", "translate.google.com", "play.google.com", "lens.google.com", "chromewebstore.google.com" ], "fetch_ips_from_api": true, "max_ips_to_scan": 100, "scan_batch_size": 500, "google_ip_validation": true, "tunnel_doh": true, "block_doh": false }Log output showing the 403 error: