An MTProto proxy is a proxy that speaks Telegram's own protocol. All official Telegram apps support it, so it is enough to open a single link and the messenger starts working through your server, with no VPN and no extra apps. In this article we set up a proxy with mtg, one of the best-known MTProto proxy implementations, turn on FakeTLS masking and get a link you can send to family and friends. We tested every command on our test server with Debian 12, and the mtg version at the time of testing was 2.2.8.

---

Why your own proxy beats free lists

Free MTProto proxies from channels and lists do work, but they share one problem. Thousands of people use them at the same time, so they are slow, short-lived and quickly blocked, because their addresses are published openly. Your own proxy on a VPS belongs only to you, nobody publishes its address, and its speed depends only on your server.

It is important to understand what such a proxy does. The traffic between the Telegram app and Telegram's servers is encrypted by the messenger itself, and the proxy only passes it on. That is why the proxy cannot see the content of the messages, even if other people use it.

---

How FakeTLS masking works

To understand why FakeTLS is needed, it helps to look at how a proxy appears from the provider's side. An ordinary connection to an MTProto proxy is not hard to recognise by the characteristic start of the exchange, and traffic filtering systems have learned to do this. FakeTLS solves the problem the same way many modern VPN protocols do. The connection to the proxy is dressed up as an ordinary secure connection (TLS) to a well-known website, for example www.microsoft.com, and from the outside it looks like a visit to that site.

Which site to imitate is set right in the secret, the key Telegram uses to connect to the proxy. A FakeTLS secret always starts with the letters ee, and the name of the chosen site is encoded at its end. mtg has one more useful protection called domain fronting. If something other than Telegram connects to the proxy, for example a probing system or an ordinary browser, mtg does not drop the connection but transparently passes it to the real website. We checked this on the test server. When we connected to port 443 of our proxy with the name www.microsoft.com, the reply came with Microsoft's real certificate, exactly the same as the site's own.

---

What you will need

• A server with Debian 12 or Ubuntu 24.04. The proxy puts almost no load on the server, so the simplest plan is enough, for example DE-Promo. If you do not have a server yet, order one using this guide or try a free trial server.
• An SSH connection to the server, for example via Termius. All commands below are run as root.
• A free port 443. If a website or a VPN already uses this port on the server, choose another port for the proxy as described in If something does not work.

---

1. Install Docker

mtg is easiest to run in Docker, so it can be updated and removed without a trace. Install Docker with the official script.

# Install Docker with the official script from the Docker website
curl -fsSL https://get.docker.com | sh

# Check that Docker works
docker --version

The last command prints the version, for example Docker version 29.9.1.

---

2. Create a secret

mtg generates the secret itself. At the end of the command, specify the site the proxy will disguise itself as.

# Generate a FakeTLS secret disguised as www.microsoft.com
docker run --rm nineseconds/mtg:2 generate-secret --hex www.microsoft.com

The command prints a long string of digits and letters starting with ee. This is the secret, copy it, you will need it in the next step.

Which site to choose for masking

A large foreign website that opens over HTTPS will do, for example www.microsoft.com. The mtg developer advises choosing a site that is logically connected to your server and not using google.com, because Google has a known list of its own networks and the substitution is easy to notice. If you have your own domain on this server, you can use it too.

The secret is the password to your proxy

Anyone who has the secret and the server address can connect to the proxy. Do not publish it in open channels and chats.

---

3. Create the settings file

mtg keeps its settings in a small file. Create a folder for it and the file itself, putting the string from the previous step in place of YOUR_SECRET.

# Folder for the proxy settings
mkdir -p /opt/mtg

# Settings file with the secret and the port
cat > /opt/mtg/config.toml <<'EOF'
secret = "YOUR_SECRET"
bind-to = "0.0.0.0:443"
EOF

The file has only two lines. secret holds the secret, and bind-to tells mtg to accept connections on port 443, like an ordinary HTTPS website. The other mtg parameters already have sensible defaults and do not need changing.

---

4. Start the proxy

# Run mtg in the background, starting automatically after a server reboot
docker run -d --name mtg-proxy --restart=unless-stopped \
  -v /opt/mtg/config.toml:/config.toml \
  -p 443:443 \
  nineseconds/mtg:2

# Check that the container is running
docker ps

The docker ps output should show a mtg-proxy line with the status Up and the port 0.0.0.0:443->443/tcp. The --restart=unless-stopped option brings the proxy back up after a server reboot.

The port inside and outside must match

In the mtg instructions the proxy listens on port 3128 inside the container, while port 443 is opened outside. That works too, but then the command from the next step gives a link with port 3128, and Telegram will not connect to it. We checked this on the test server, so in our version the proxy runs on 443 both inside and outside, and the link is correct straight away.

---

5. Get the connection link

mtg builds ready-made links itself.

# Print the links for connecting to the proxy
docker exec mtg-proxy /mtg access /config.toml

The reply contains an ipv4 block with the server address, port 443 and several links.

• tme_url, a link like https://t.me/proxy?.... It is the most convenient one to send to other people, it opens both in a browser and in Telegram.
• tg_url, a link like tg://proxy?... that opens Telegram straight away.

A QR code without third-party services

The mtg reply also has links to QR codes, but they are generated on an external website, and the secret goes there too. It is safer to draw the QR code right in the terminal. Install the tool with apt install -y qrencode and run qrencode -t ansiutf8 'tme_url_link'. The QR code can be scanned with a phone camera.

---

6. Connect Telegram

Open the tme_url link on a device with Telegram, for example send it to your Saved Messages and tap it. Telegram shows a window with the proxy details, confirm the connection there. From that moment the messenger works through your server.

You can also add the proxy manually. Open the proxy section in the Telegram settings, choose the MTProto type and enter the server address, port 443 and the secret.

---

If you need an ad tag or a setup without the terminal

• An ad tag, that is, promoting your channel through a special Telegram bot, is not supported by mtg version 2. The mtg author himself recommends the telemt project for that.
• Without the terminal, a Telegram proxy can be installed by the AmneziaVPN app version 5.0.0.5 and newer, on its services tab. This is described in detail in the Amnezia documentation. If you have already set up a VPN with our guide, this is the quickest way.

---

How to update or remove the proxy

To update mtg to a new version, download a fresh image and recreate the container. The settings and the secret are stored in /opt/mtg/config.toml, so the connection link does not change.

# Download the new version of mtg
docker pull nineseconds/mtg:2

# Remove the old container and start a new one with the same settings
docker rm -f mtg-proxy
docker run -d --name mtg-proxy --restart=unless-stopped \
  -v /opt/mtg/config.toml:/config.toml \
  -p 443:443 \
  nineseconds/mtg:2

To remove the proxy completely, run docker rm -f mtg-proxy and delete the folder with rm -rf /opt/mtg. All links you have given out will stop working after that.

---

If something does not work

The container does not start, port 443 is busy

Check which program already uses the port.

# Who is listening on port 443
ss -lntp | grep ':443 '

If it is a web server or a VPN, choose another port for the proxy, for example 8443. Change it in the settings file on the line bind-to = "0.0.0.0:8443", and start the container with -p 8443:8443. The link from step 5 picks up the new port by itself.

The link shows port 3128

This means the proxy listens on 3128 inside the container while a different port is open outside. Check the bind-to line in /opt/mtg/config.toml and the -p option of the container, the port numbers on the left and right must match the port in bind-to. After fixing it, recreate the container as described in the update section.

Telegram does not connect to the proxy

Check in order.

1. The container is running. In the docker ps output, mtg-proxy has the status Up.
2. The port is open in the server firewall. If you enabled UFW following our guide, allow the port with ufw allow 443/tcp.
3. The link has the correct server IP address and port.

If everything is fine but there is still no connection, your provider may be restricting connections to this masking site or to the port. Create a new secret with a different site, change it in the settings file and recreate the container. Old links stop working after the secret changes, so share the new ones.

How to see what is happening with the proxy

mtg writes events to the container log.

# The last 50 lines of the proxy log
docker logs --tail 50 mtg-proxy

An empty log does not mean something is broken, mtg only writes notable events to it, such as errors and blocked addresses.

---

Our resources

Telegram channel: https://t.me/f3cloud_news
F3 Cloud: https://f3cloud.com