Zyrln
Zyrln helps you access blocked sites through Google. Use a config from someone you trust, or create your own connection with a Google account and a Cloudflare Worker or VPS server. Results depend on your network.
Start here
| What do you have? | Follow this path | |---|---| | A config from someone you trust | Install the app and connect with your config | | No config; you want your own relay | Follow Create your own relay, then return here | | You only need direct access to Google services | Try Direct mode |
A config contains a Google Apps Script URL ending in /exec and an app key. Never enter a VPS or Worker URL as the app's relay URL. Keep configs private: anyone with a working config can use its relay and quota.
Download the right file
Open Releases, choose a release, and expand Assets.
| Device | File ending |
|---|---|
| Android 9 or newer, with the 2.1 preview | -android.apk |
| Windows | -windows-amd64.exe |
| Linux, Intel/AMD 64-bit | -linux-amd64 |
| Mac, Apple Silicon | -darwin-arm64 |
| Mac, Intel | -darwin-amd64 |
The -vps.zip file is for server owners. You do not need it to use an existing config. GitHub's Source code archives are not the apps.
Upgrading Android from v2.0 to v2.1-pre-1: export your configs first. The signing key changed, so uninstall the old app before installing the preview. Uninstalling removes app data; import your saved configs afterward.
Connect with a config
Android
You do not need a computer, browser proxy, or CA certificate.
- Install the Android APK.
- Copy the complete config text, including its opening
{and closing}. - Open Zyrln and use Import. Alternatively, use + and enter the Apps Script URL and app key manually.
- Select the imported profile, then tap Connect and allow Android's VPN permission.
- Open a website in your browser to check that traffic works. A successful Ping alone does not confirm browsing.
Windows, Linux, or macOS
The desktop interface opens in your browser. That interface controls a local proxy; opening it does not route browser traffic automatically.
- Launch the download. On Windows, double-click the
.exe. On Linux/macOS, make it executable and launch with-gui:
chmod +x ./YOUR_DOWNLOADED_FILE
./YOUR_DOWNLOADED_FILE -gui- Use + to add a profile. Enter the Apps Script URL and app key, then save and select it.
- Under Tools → Security, generate/download Zyrln's CA certificate (the file your browser needs to trust relay connections). Import it into the browser you will use for relay browsing and enable website trust. In Firefox: Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import. Chrome/Edge certificate controls depend on your operating system; use their certificate manager to import it as a trusted authority. Only trust the certificate generated by your own Zyrln installation.
- Set that browser's HTTP proxy to
127.0.0.1, port8085. In Firefox, also enable using this proxy for HTTPS. Chrome/Edge normally use the operating system proxy settings, which may affect other apps. SOCKS5 is also available at127.0.0.1:1080. - Click Connect, then load a website in the configured browser.
To send your config to Android, use Tools → Mobile Export and transfer the complete text privately.
Direct mode (no relay config)
Direct mode is intended for Google services; it is not a replacement for a relay for other destinations. It may help with some filtering but cannot overcome every network block.
- Android: select the Direct/Google entry, tap Connect, and allow VPN permission.
- Desktop: select Direct (Google), connect, and set your browser proxy as described above. No Zyrln CA certificate is needed for direct mode.
If it does not work
| What you see | What to do next |
|---|---|
| Config will not import | Copy the whole JSON config; check that it contains url and key. |
| Unauthorized / wrong key | Ask the config owner to check the app key against Apps Script's AUTH_KEY. |
| Connected, but desktop browsing fails | Check the browser proxy and certificate steps above. |
| Only some sites fail with Cloudflare | Its TCP tunnel cannot connect to Cloudflare IP ranges. Try a VPS profile; this restriction particularly affects Android's tunnel path. |
| Google quota reached | Try a profile from a different Google account or wait for the quota to recover. Another deployment on the same account shares its quota. |
| HTML instead of JSON / relay unavailable | The owner should check Apps Script deployment access, its current published version, and quota errors. HTML alone does not prove quota exhaustion. |
| Android asks for VPN permission again | Allow it. Another VPN may have replaced Zyrln. |
If you own the relay, use the setup checkpoints. Otherwise ask its owner to check it. Report your device, app version, backend, error, and steps to reproduce in GitHub Issues. Remove keys and private config from logs.
More information
Only import configs from people you trust. The desktop relay can read the web requests it forwards; the Android tunnel keeps HTTPS content encrypted to the destination. Google and the exit provider can still see connection information such as timing and volume.Credits: domain fronting from denuitt1/mhr-cfw; TLS fragmentation from GFW-knocker. MIT license.