> The full list of articles is in [llms.txt](https://docs.f3cloud.com/llms.txt). Every page has a Markdown version: add .md to its address. This page as Markdown: [https://docs.f3cloud.com/en/proxy-guide/mtproto-proxy-telegram.md](https://docs.f3cloud.com/en/proxy-guide/mtproto-proxy-telegram.md).

# Your own MTProto proxy for Telegram on a VPS – installing mtg with FakeTLS

How to run your own MTProto proxy for Telegram on a VPS in 10 minutes. Installing mtg v2 in Docker, a FakeTLS secret disguised as a real website, a link and QR code for connecting, common errors.

An **MTProto proxy** is a proxy that speaks Telegram's own protocol. All official Telegram apps support it, so it is enough to open a single link and the messenger starts working through your server, with no VPN and no extra apps. In this article we set up a proxy with **mtg**, one of the best-known MTProto proxy implementations, turn on **FakeTLS** masking and get a link you can send to family and friends. We tested every command on our test server with Debian 12, and the mtg version at the time of testing was **2.2.8**.

***

## Why your own proxy beats free lists

Free MTProto proxies from channels and lists do work, but they share one problem. Thousands of people use them at the same time, so they are slow, short-lived and quickly blocked, because their addresses are published openly. Your own proxy on a VPS belongs only to you, nobody publishes its address, and its speed depends only on your server.

It is important to understand what such a proxy does. The traffic between the Telegram app and Telegram's servers is encrypted by the messenger itself, and the proxy only passes it on. That is why the proxy cannot see the content of the messages, even if other people use it.

***

## How FakeTLS masking works

To understand why FakeTLS is needed, it helps to look at how a proxy appears from the provider's side. An ordinary connection to an MTProto proxy is not hard to recognise by the characteristic start of the exchange, and traffic filtering systems have learned to do this. FakeTLS solves the problem the same way many modern VPN protocols do. The connection to the proxy is dressed up as an **ordinary secure connection (TLS) to a well-known website**, for example `www.microsoft.com`, and from the outside it looks like a visit to that site.

Which site to imitate is set right in the **secret**, the key Telegram uses to connect to the proxy. A FakeTLS secret always starts with the letters `ee`, and the name of the chosen site is encoded at its end. mtg has one more useful protection called domain fronting. If something other than Telegram connects to the proxy, for example a probing system or an ordinary browser, mtg does not drop the connection but transparently passes it to the real website. We checked this on the test server. When we connected to port 443 of our proxy with the name `www.microsoft.com`, the reply came with **Microsoft's real certificate**, exactly the same as the site's own.

***

## What you will need

* **A server** with Debian 12 or Ubuntu 24.04. The proxy puts almost no load on the server, so the simplest plan is enough, for example **DE-Promo**. If you do not have a server yet, order one using [this guide](https://docs.f3cloud.com/en/client-area/order-vps.md) or try a [free trial server](https://docs.f3cloud.com/en/client-area/trial-server.md).
* **An SSH connection to the server**, for example via [Termius](https://docs.f3cloud.com/en/vps/termius-connection.md). All commands below are run as `root`.
* **A free port 443**. If a website or a VPN already uses this port on the server, choose another port for the proxy as described in [If something does not work](#if-something-does-not-work).

***

## 1. Install Docker

mtg is easiest to run in Docker, so it can be updated and removed without a trace. Install Docker with the official script.

```bash
# Install Docker with the official script from the Docker website
curl -fsSL https://get.docker.com | sh

# Check that Docker works
docker --version
```

The last command prints the version, for example `Docker version 29.9.1`.

***

## 2. Create a secret

mtg generates the secret itself. At the end of the command, specify the site the proxy will disguise itself as.

```bash
# Generate a FakeTLS secret disguised as www.microsoft.com
docker run --rm nineseconds/mtg:2 generate-secret --hex www.microsoft.com
```

The command prints a long string of digits and letters starting with `ee`. This is the secret, copy it, you will need it in the next step.

> **Which site to choose for masking.**
>
> A large foreign website that opens over HTTPS will do, for example `www.microsoft.com`. The mtg developer advises choosing a site that is logically connected to your server and not using `google.com`, because Google has a known list of its own networks and the substitution is easy to notice. If you have your own domain on this server, you can use it too.

> **The secret is the password to your proxy.**
>
> Anyone who has the secret and the server address can connect to the proxy. Do not publish it in open channels and chats.

***

## 3. Create the settings file

mtg keeps its settings in a small file. Create a folder for it and the file itself, putting the string from the previous step in place of `YOUR_SECRET`.

```bash
# Folder for the proxy settings
mkdir -p /opt/mtg

# Settings file with the secret and the port
cat > /opt/mtg/config.toml <<'EOF'
secret = "YOUR_SECRET"
bind-to = "0.0.0.0:443"
EOF
```

The file has only two lines. `secret` holds the secret, and `bind-to` tells mtg to accept connections on port **443**, like an ordinary HTTPS website. The other mtg parameters already have sensible defaults and do not need changing.

***

## 4. Start the proxy

```bash
# Run mtg in the background, starting automatically after a server reboot
docker run -d --name mtg-proxy --restart=unless-stopped \
  -v /opt/mtg/config.toml:/config.toml \
  -p 443:443 \
  nineseconds/mtg:2

# Check that the container is running
docker ps
```

The `docker ps` output should show a `mtg-proxy` line with the status **Up** and the port `0.0.0.0:443->443/tcp`. The `--restart=unless-stopped` option brings the proxy back up after a server reboot.

> **The port inside and outside must match.**
>
> In the mtg instructions the proxy listens on port `3128` inside the container, while port `443` is opened outside. That works too, but then the command from the next step gives a link with port **3128**, and Telegram will not connect to it. We checked this on the test server, so in our version the proxy runs on **443** both inside and outside, and the link is correct straight away.

***

## 5. Get the connection link

mtg builds ready-made links itself.

```bash
# Print the links for connecting to the proxy
docker exec mtg-proxy /mtg access /config.toml
```

The reply contains an `ipv4` block with the server address, port `443` and several links.

* **`tme_url`**, a link like `https://t.me/proxy?...`. It is the most convenient one to send to other people, it opens both in a browser and in Telegram.
* **`tg_url`**, a link like `tg://proxy?...` that opens Telegram straight away.

> **A QR code without third-party services.**
>
> The mtg reply also has links to QR codes, but they are generated on an external website, and the secret goes there too. It is safer to draw the QR code right in the terminal. Install the tool with `apt install -y qrencode` and run `qrencode -t ansiutf8 'tme_url_link'`. The QR code can be scanned with a phone camera.

***

## 6. Connect Telegram

Open the `tme_url` link on a device with Telegram, for example send it to your Saved Messages and tap it. Telegram shows a window with the proxy details, confirm the connection there. From that moment the messenger works through your server.

You can also add the proxy manually. Open the proxy section in the Telegram settings, choose the **MTProto** type and enter the server address, port `443` and the secret.

***

## If you need an ad tag or a setup without the terminal

* **An ad tag**, that is, promoting your channel through a special Telegram bot, is not supported by mtg version 2. The mtg author himself recommends the [telemt](https://github.com/telemt/telemt) project for that.
* **Without the terminal**, a Telegram proxy can be installed by the **AmneziaVPN** app version 5.0.0.5 and newer, on its services tab. This is described in detail in the [Amnezia documentation](https://docs.amnezia.org/documentation/instructions/telegram-proxy). If you have already set up a VPN with [our guide](https://docs.f3cloud.com/en/vpn-guide/setup-amnezia.md), this is the quickest way.

***

## How to update or remove the proxy

To update mtg to a new version, download a fresh image and recreate the container. The settings and the secret are stored in `/opt/mtg/config.toml`, so the connection link does not change.

```bash
# Download the new version of mtg
docker pull nineseconds/mtg:2

# Remove the old container and start a new one with the same settings
docker rm -f mtg-proxy
docker run -d --name mtg-proxy --restart=unless-stopped \
  -v /opt/mtg/config.toml:/config.toml \
  -p 443:443 \
  nineseconds/mtg:2
```

To remove the proxy completely, run `docker rm -f mtg-proxy` and delete the folder with `rm -rf /opt/mtg`. All links you have given out will stop working after that.

***

## If something does not work

<details>

<summary>The container does not start, port 443 is busy</summary>

Check which program already uses the port.

```bash
# Who is listening on port 443
ss -lntp | grep ':443 '
```

If it is a web server or a VPN, choose another port for the proxy, for example `8443`. Change it in the settings file on the line `bind-to = "0.0.0.0:8443"`, and start the container with `-p 8443:8443`. The link from step 5 picks up the new port by itself.

</details>

<details>

<summary>The link shows port 3128</summary>

This means the proxy listens on `3128` inside the container while a different port is open outside. Check the `bind-to` line in `/opt/mtg/config.toml` and the `-p` option of the container, the port numbers on the left and right must match the port in `bind-to`. After fixing it, recreate the container as described in the update section.

</details>

<details>

<summary>Telegram does not connect to the proxy</summary>

Check in order.

1. The container is running. In the `docker ps` output, `mtg-proxy` has the status **Up**.
2. The port is open in the server firewall. If you enabled UFW following [our guide](https://docs.f3cloud.com/en/vps/security/firewall.md), allow the port with `ufw allow 443/tcp`.
3. The link has the correct server IP address and port.

If everything is fine but there is still no connection, your provider may be restricting connections to this masking site or to the port. Create a new secret with a different site, change it in the settings file and recreate the container. Old links stop working after the secret changes, so share the new ones.

</details>

<details>

<summary>How to see what is happening with the proxy</summary>

mtg writes events to the container log.

```bash
# The last 50 lines of the proxy log
docker logs --tail 50 mtg-proxy
```

An empty log does not mean something is broken, mtg only writes notable events to it, such as errors and blocked addresses.

</details>

***

## Our resources

**Telegram channel:** [https://t.me/f3cloud_news](https://t.me/f3cloud_news)\
**F3 Cloud:** [https://f3cloud.com](https://f3cloud.com/en)