Your own Telegram proxy (MTProxy) on a VPS

Order a VPS

The button on this page opens the bot with the cheapest matching plan. Choose Ubuntu 22.04, 24.04 or Debian 12 and pay for the server; the IP address and root password arrive in the chat.

Connect over SSH

ssh root@SERVER_IP

Run the command

Port 443 must be free. If the server already hosts a website, read the port 443 section below first.

command -v docker >/dev/null || curl -fsSL https://get.docker.com | sh; S=$(docker run --rm nineseconds/mtg:2 generate-secret --hex google.com) && printf 'secret = "%s"\nbind-to = "0.0.0.0:3128"\n' "$S" > /etc/mtg.toml && docker run -d -v /etc/mtg.toml:/config.toml -p 443:3128 --name mtg-proxy --restart=unless-stopped nineseconds/mtg:2

Get the link

The command prints JSON with the tg_url and tme_url links and their QR codes. The -p 443 flag is required: inside the container mtg listens on port 3128 and puts that port into the link without the flag.

docker exec mtg-proxy /mtg access -p 443 /config.toml

Change the FakeTLS domain

google.com is the example from the mtg documentation. The author advises a domain related to your server’s IP: how to choose and change it is in the domain section below.

Install Docker

The get.docker.com script installs Docker Engine with one command. Docker itself calls it a quick-install option and recommends the apt repository for production.

curl -fsSL https://get.docker.com | sh

Create a secret

The secret is the client password; keep it private. In hex it starts with ee, followed by the key and the FakeTLS domain. Replace DOMAIN with a domain; how to choose one is below.

docker run --rm nineseconds/mtg:2 generate-secret --hex DOMAIN

Write the config

Save it as /etc/mtg.toml. Inside the container mtg listens on port 3128, and Docker publishes it outside. bind-to takes an IP address only: mtg rejects host names and *.

secret = "SECRET"
bind-to = "0.0.0.0:3128"

Start the container

443 is the port clients connect to, 3128 is the port from bind-to. The 2 tag is the current major version: the author advises against latest and stable.

docker run -d -v /etc/mtg.toml:/config.toml -p 443:3128 --name mtg-proxy --restart=unless-stopped nineseconds/mtg:2

Check the setup

mtg doctor checks clock drift, connectivity to the Telegram data centres, the cover website and whether the domain’s DNS matches the server IP (SNI-DNS). With someone else’s domain the last check fails, as expected.

docker exec mtg-proxy /mtg doctor /config.toml

Get the links

-p is the port published outside: without it mtg puts 3128 from bind-to into the link. mtg learns the public IP from ifconfig.co; if the address is wrong, add it to the config as public-ipv4.

docker exec mtg-proxy /mtg access -p 443 /config.toml

Build the proxy

The binary lands in objs/bin/mtproto-proxy. If the build fails, run make clean before trying again.

apt install git curl build-essential libssl-dev zlib1g-dev
git clone https://github.com/TelegramMessenger/MTProxy
cd MTProxy
make && cd objs/bin

Download Telegram’s key and config

The Telegram server config changes now and then; the README advises updating it once a day. The third command creates the secret for clients.

curl -s https://core.telegram.org/getProxySecret -o proxy-secret
curl -s https://core.telegram.org/getProxyConfig -o proxy-multi.conf
head -c 16 /dev/urandom | xxd -ps

Start the proxy

-H 443 is the client port, -p 8888 the local statistics port (wget localhost:8888/stats, from the server itself only), -M 1 the number of workers. For permanent operation the README gives an example systemd unit.

./mtproto-proxy -u nobody -p 8888 -H 443 -S USER_SECRET --aes-pwd proxy-secret proxy-multi.conf -M 1

Register the proxy with @MTProxybot

The bot issues a tag; add it to the start command as -P PROXY_TAG. The client link is tg://proxy?server=SERVER_IP&port=443&secret=USER_SECRET, and the bot can generate it too. With the dd prefix on the secret, the client turns on random packet padding.

Open the link

tg://proxy?… opens straight in the app, https://t.me/proxy?… goes through the browser and is handy to forward in chats. Telegram offers to add the proxy.

Or scan the QR code

The output has tg_qrcode and tme_qrcode, links to a QR code image. The third-party service api.qrserver.com draws it, and the secret goes to it in the URL. If that matters, make the QR code from the link yourself.

Or add it by hand

In Telegram’s proxy settings choose MTProto and enter the server (IP or domain), the port and the secret: the same three parameters as in the link.

Share it with a small circle

The mtg author advises sharing the proxy with family and friends and never announcing it publicly: public proxies are the first to get blocked by IP. If the link went to the wrong place, change the secret and the old link stops working.

Need separate links

The official MTProxy takes several secrets (-S more than once). For mtg with several secrets, the author points to the mtg-multi fork.

Choose a domain

The mtg README advises a domain related to the server IP. The most robust option, per the author’s recommendations, is your own domain: its A record points at the VPS, a website with a Let’s Encrypt certificate runs there, and mtg sits in front of the web server. Then DNS and SNI match, which is what mtg doctor checks. The [domain-fronting] section (host and port) sets the address of the site behind mtg.

Create a new secret

docker run --rm nineseconds/mtg:2 generate-secret --hex DOMAIN

Replace the secret and restart

Put the new secret into /etc/mtg.toml. Old links stop working, so send out new ones from mtg access.

docker restart mtg-proxy
docker exec mtg-proxy /mtg access -p 443 /config.toml

See what holds the port

The command shows the process listening on TCP port 443.

ss -tlnp | grep ':443 '

Publish the proxy on another port

For example 8443: -p 8443:3128 when starting the container and -p 8443 in mtg access, so that this port goes into the link.

docker rm -f mtg-proxy
docker run -d -v /etc/mtg.toml:/config.toml -p 8443:3128 --name mtg-proxy --restart=unless-stopped nineseconds/mtg:2
docker exec mtg-proxy /mtg access -p 8443 /config.toml

Or put mtg in front of the website

mtg takes 443 and the website moves to another port; set its address and port in [domain-fronting], and mtg hands stray requests to the site. This is the own-domain setup from the section above.

Pull the image and recreate the container

docker pull nineseconds/mtg:2
docker rm -f mtg-proxy
docker run -d -v /etc/mtg.toml:/config.toml -p 443:3128 --name mtg-proxy --restart=unless-stopped nineseconds/mtg:2

Before moving to 2.3.0

Since 2.3.0 (3 November 2026) the domain-fronting-ip and [domain-fronting].ip options are ignored; replace them with [domain-fronting].host. The secret stays. At startup mtg now checks DNS/SNI and the public IP itself: the warnings do not stop it.