DEV Community: Humja Jaan

Censorship Techniques by Country and How MTProto with FakeTLS Beats Them

Humja Jaan — Sat, 25 Jul 2026 17:08:30 +0000

You open Telegram. The gray cloud appears. Messages don't send. You've been hit by deep packet inspection (DPI) that recognizes Telegram's protocol and drops the connection. This is the reality for millions of users in Iran, Russia, and China.

Governments use different tricks to block Telegram. But there's a common workaround: MTProto proxies with Fake-TLS. Here's how those specific censorship techniques work, why this proxy flavor is effective, and where to find proxies that stay alive—without scraping shady Telegram channels.

How Censorship Works in Key Regions

Iran: Protocol-Level DPI with Keyword Matching

Iran's censorship apparatus operates at the network layer. ISPs deploy DPI boxes that inspect packet payloads for Telegram's handshake bytes. The MTProto protocol has a recognizable signature—specific magic bytes in the initial connection. Once detected, the box either drops the packet or resets the TCP connection.

Iran also uses SNI filtering on HTTPS connections. But Fake-TLS transforms the MTProto handshake into a valid-looking TLS 1.2 or 1.3 ClientHello. The proxy operator's server presents a TLS certificate (self-signed or Let's Encrypt). To the DPI box, the traffic looks like regular HTTPS to an obscure domain. The gray cloud disappears.

Russia: IP Blocklists and DPI Based on Domain

Russia's Roskomnadzor maintains IP address blocklists. They also blacklist domains used by Telegram's built-in MTProto servers. The RKN does not block all HTTPS—that would break the country's internet—so Fake-TLS pass as normal traffic to an allowed IP.

However, Russian ISPs are now experimenting with active probing: if a connection behaves like Telegram on an unknown port, they send a test connection to mimic Telegram's protocol. If the server responds correctly, the IP gets added to the blocklist. This is why a static proxy server can die within hours. You need an auto-updating source of fresh proxies.

China: The Great Firewall's Multi-Layer Inspection

China uses the most sophisticated DPI in the world. The GFW inspects packet sizes, timing, and TLS handshake parameters. It also maintains a database of known proxy IPs and actively probes unknown servers.

Fake-TLS works in China but with caveats. If the proxy server's certificate subject or ciphers match Telegram's known patterns, the GFW blocks it. Proxies that use uncommon TLS parameters or host on cloud providers like Alibaba suffer higher blocking rates. The key is using a proxy that mimics real browser TLS fingerprints—not just any TLS.

Why MTProto with FakeTLS Works (and When It Doesn't)

MTProto is Telegram's own transport protocol. By default, its handshake is easily identified. Fake-TLS wraps that handshake inside a TLS 1.2/1.3 ClientHello and ServerHello sequence. The proxy acts as a TLS-terminating server, then forwards the underlying MTProto traffic to Telegram.

The success depends on:

TLS fingerprinting: Some advanced DPI compares the ClientHello's cipher suites and extensions against known browsers. A minimal Fake-TLS implementation may get blocked because it looks like a DIY bot, not Chrome. Choose proxies that mimic modern browser TLS (TLS 1.3 with specific ciphers).
Certificate validity: A self-signed cert works in most cases because DPI doesn't validate the chain. But some Chinese ISPs can even inspect the full chain with OCSP queries. Let's Encrypt certs are safer.
Server location: A proxy in a datacenter with a known IP range is more likely to be blocked in China. Use proxies on residential or less-known hosting IPs.

When Fake-TLS fails, it's usually because the DPI has added the TLS signature to a blocklist. At that point, you need a fresh proxy with a different TLS profile.

Finding Reliable Proxies That Stay Alive

Manually searching Telegram channels for proxies is tedious and dangerous. Many channels share dead proxies or logs. Instead, use an auto-updated source that continuously scrapes public lists and validates them.

The free-mtproto-proxies repository does exactly that. It runs an automated scraper, tests each proxy for connectivity and Fake-TLS support, then publishes a live web listing. You can grab a proxy in one line:

{
  "host": "123.123.123.123",
  "port": 443,
  "secret": "dddddddddddddddddddddddddddddddd"
}

Or directly open the tg:// link by copying it from the web listing. The list refreshes every 30 minutes, so you always have a working proxy even if the last one got blocked.

For developers, the repo's proxies.json URL is perfect for automated scripts. You can build your own quick checker or integrate it into a mobile app's proxy rotator.

Country-Specific Tips

Iran: Use proxies with secret starting with ee (Fake-TLS with a domain). Avoid plain dd secrets (no obfuscation) as they get blocked quickly. Also, set a shorter connection timeout—Iranian ISPs often silently drop sessions after 30 seconds.
Russia: Prefer proxies hosted in Western Europe (Netherlands, Germany) with low ping. Use the tls protocol in Telegram's proxy settings if your version supports it. The RKN's active probing kills proxies hosted within Russia faster.
China: Rotate proxies daily. The GFW learns and blocks within 24 hours. Use the repo's list around 10 PM Beijing time when new scrapes are published. Also, enable "obfuscated" mode in Telegram's proxy settings if available—it adds extra padding that confuses DPI.

I've covered more details about setup and mobile behavior in my practical guide for censored regions (https://dev.to/humja_jaan_fca09049ae97d5/telegram-proxies-that-actually-work-a-practical-guide-for-censored-regions-48o6) and the underlying protocol dynamics on Telegra.ph (https://telegra.ph/free-mtproto-proxies-07-25).

The key takeaway: censorship varies by country, but Fake-TLS MTProto proxies remain a reliable bypass when sourced from an updated, validated list. Bookmark the free-mtproto-proxies repo and grab a fresh proxy whenever you need it.

Canonical URL: https://dev.to/yourusername/censorship-techniques-and-mtproto-faketls

Telegram Proxies That Actually Work: A Practical Guide for Censored Regions

Humja Jaan — Sat, 25 Jul 2026 12:06:10 +0000

You open Telegram. The gray cloud icon appears. Messages won't send. Videos won't load. If you live in Iran, Russia, or China, this is a familiar frustration. Telegram is actively blocked by governments using deep packet inspection (DPI) and IP blacklisting. A regular VPN might help, but not always — especially when the VPN itself is targeted. There's a lighter, more Telegram-specific solution: MTProto proxies.

This guide explains why Telegram gets blocked, how MTProto differs from a VPN, and exactly how to set up a working proxy on your phone or desktop. No fluff, no jargon. Just steps that work.

Why Telegram Is Blocked

Governments block Telegram for the same reason people use it: encrypted communication that's hard to intercept.

Iran blocks Telegram after protests, using DPI to detect the protocol and kill connections.
Russia tried to block Telegram in 2018, and while the ban is technically still active, they rely on IP blocking and bandwidth throttling.
China blocks Telegram entirely — the Great Firewall identifies and drops traffic by IP and protocol fingerprint.

The result: Telegram either doesn't connect at all, or connects only during off-peak hours when DPI systems are less aggressive.

What Is MTProto?

MTProto is Telegram's own encryption protocol. An MTProto proxy sits between your device and Telegram's servers. It wraps your Telegram traffic in a way that DPI systems can't easily recognize — especially if the proxy supports Fake-TLS, which makes the connection look like ordinary HTTPS web traffic.

When you connect through an MTProto proxy, your ISP sees only encrypted traffic to a random server, not to Telegram's IPs. The proxy doesn't decrypt your messages; it just forwards the encrypted packets.

MTProto vs VPN: The Real Differences

Feature	MTProto Proxy	VPN
What it protects	Only Telegram	All apps and web traffic
Speed	Very fast (single protocol)	Slower (encrypts everything)
Battery drain	Minimal	Higher on mobile
Setup	One tap in Telegram app	Requires separate app and config
Detection by DPI	Lower if using Fake-TLS	Increasingly blocked

When to use MTProto: If you only need Telegram and want the lowest overhead.

When to use a VPN: If you need to access other blocked services or want full anonymity.

For most users in censored regions, a combination works: keep a VPN for browsing, and use an MTProto proxy inside Telegram for reliable chat.

Step-by-Step Setup

Find a Working Proxy

You need a proxy in the format server:port:secret. A reliable source is the free-mtproto-proxies repository — it scrapes and publishes working proxies with Fake-TLS support, updated every few hours. You can also find them via Telegram bots, but the repo gives you a live web listing you can copy from.

Example proxy string:

45.67.89.12:443:ee2233445566778899aabbccddeeff0011223344

Android

Open Telegram settings (bottom right → gear icon).
Tap Data and Storage → Proxy Settings.
Tap Add Proxy.
Choose MTProto.
Enter the Server, Port, and Secret from your proxy.
Tap the checkmark to save, then toggle the proxy On.
The cloud icon should turn green.

iOS (iPhone/iPad)

Open Telegram settings (bottom right → gear).
Tap Data and Storage → Proxy.
Tap Add Proxy.
Choose MTProto.
Enter server, port, and secret.
Save and enable the proxy.
Verify the cloud icon shows green.

Desktop (Windows/macOS/Linux)

Open Telegram Desktop.
Click the hamburger menu (three lines) → Settings.
Go to Advanced → Connection Type → Proxy Settings.
Choose Use custom proxy → MTProto.
Fill in server, port, and secret.
Click Save. The connection should restore immediately.

You can also use a tg:// link. If your proxy is formatted as:

tg://proxy?server=45.67.89.12&port=443&secret=ee2233445566778899aabbccddeeff0011223344

Clicking it on your phone will open Telegram and auto-add the proxy.

Troubleshooting Tips

Proxy works for a few minutes, then dies. DPI can temporarily block a specific IP. Switch to another proxy from the list. The free-mtproto-proxies repo updates frequently for this reason.
Green cloud icon, but messages still slow. The proxy might be overloaded. Try one with lower ping (latency). The repo often shows ping times.
Cannot connect at all. Check that your secret is correct. For Fake-TLS, the secret must start with ee or contain a hex string. Invalid secrets get silently dropped.
Still blocked? Some regions block Telegram at the DNS level. Change your DNS to 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) in your device settings.
Desktop proxy doesn't apply to calls. Telegram voice/video calls use a separate connection. If calls fail, you may need a VPN for those.

Security Considerations

An MTProto proxy can see your IP address and the fact that you're using Telegram, but not your message content — that's end-to-end encrypted in secret chats and server-client encrypted in regular chats. Still, you're trusting the proxy operator not to log metadata. For a deeper dive into what an MTProto proxy operator can actually see, a previous article covers this in detail: Understanding What an MTProto Proxy Operator Can Actually See.

If you want to minimize trust, use proxies that are known to be run by reputable sources. The free-mtproto-proxies repo lists proxies scraped from public channels; treat them as you would any free service — not for sensitive chats.

Keep a Few Proxies Handy

Proxies die. Governments adapt. The best practice is to save 2–3 proxies in your Telegram settings at all times. When one stops working, switch to the next. And if you ever need a fresh batch, the free-mtproto-proxies GitHub repository is a reliable, automated source — updated daily with live-working proxies.

For a broader overview of how MTProto proxies work across different censorship zones, see the companion guide: How to Use MTProto Proxies in China, Iran, and Russia.

Final Note

Telegram won't become unblocked anytime soon in these regions. But proxies make it usable. Stick with MTProto for speed, keep a tested list, and never assume a proxy is permanent. Bookmark the repo, check it when your connection drops, and you'll almost always have a green icon within a minute.

#Understanding What an MTProto Proxy Operator Can Actually See

Humja Jaan — Fri, 24 Jul 2026 18:10:34 +0000

If you use Telegram in a region where it's blocked, you've probably installed an MTProto proxy without thinking twice. The gray cloud icon vanishes, messages send, and you move on. But what does running your traffic through someone else's server actually expose? And should you trust free proxies listed on random Telegram channels?

Let's walk through the encryption model, the limitations of trust, and how to pick a proxy that isn't a honeypot.

The MTProto Security Model

Telegram's MTProto is designed to encrypt messages end-to-end only in secret chats. Regular chats (cloud chats) are encrypted between your client and Telegram's servers, but the server holds the decryption keys. The proxy sits in the middle as a transport layer: it carries encrypted traffic between your device and Telegram's data centers.

From your client's perspective, the connection to the proxy is wrapped in a custom encryption scheme that resembles TLS but isn't real TLS. The proxy operator sees only the encrypted tunnel content—they cannot decrypt the inner Telegram packets. That's the theory.

In practice, the security depends on two things:

The proxy cannot break Telegram's end-to-end encryption for secret chats.
The proxy can observe metadata about your connection.

What the Proxy Server Knows

A proxy operator sees the following:

Your IP address – obvious, but worth stating. The operator knows where you're connecting from.
The destination Telegram IP – they can see which Telegram data center you're reaching.
Connection timing – how often you reconnect, session duration, idle patterns.
Traffic volume – rough size of encrypted blobs going in and out.

They cannot see:

Which chats you're in
Message content (unless you're using a cloud chat without secret chat, but even then the proxy only sees ciphertext)
Your phone number or username directly from traffic

However, if the proxy operator is malicious and also runs a Telegram bot or client, they could correlate IP addresses with user activity elsewhere. This is far-fetched but not impossible.

The Hidden Risks of Free Proxies

Free proxies are often run by volunteers—or by entities with unknown intentions. The biggest risk is not data theft (since the proxy can't decrypt), but these three:

Traffic logging and deanonymization – even if the proxy can't read messages, logging IPs over time builds a profile.
Malicious configuration – a fake proxy could redirect traffic to a phishing server that mimics Telegram's login page. This requires user action (like clicking a link), not passive interception.
MITM via fake TLS certificate – MTProto proxies with Fake-TLS support can present a forged certificate to your client. If you blindly accept it, your entire connection is compromised. The official Telegram client does verify server certificates, but older or modified clients may not.

The most common attack is simply harvesting IP addresses for resale or surveillance. In countries like Iran or Russia, using a proxy provided by an unknown entity could flag you to authorities.

How to Verify Proxy Authenticity

You cannot fully prove a proxy is safe without controlling the server yourself. But you can reduce risk:

Use only proxies from sources that publish their server configurations – raw host:port:secret strings are easy to verify. Compare across multiple listings.
Check the secret – in MTProto, the secret is a 32-character hex string. If the same secret appears on multiple unrelated servers, it's likely a shared secret used by a coordinator. That's not inherently bad, but it means the operator can rotate servers without changing clients.
Test with a burner account – if you're paranoid, create a throwaway Telegram account and use the proxy for a few days. Check if you receive unsolicited messages or see unusual login alerts.

A practical tip: when you add a proxy manually in Telegram, the format is:

tg://proxy?server=123.123.123.123&port=443&secret=ee...secret_hex_here...

You can extract the secret and verify it matches the one published by the proxy source.

Why This Repository Exists

The repo free-mtproto-proxies takes a different approach from Telegram channels that dump random proxy lists. It's an automated scraper that collects proxies from public sources, validates them, and publishes the results on a live web page. The code is open for inspection, and the proxy list is continuously updated.

The transparency matters: you can see where each proxy was found, and if the source is known to be unreliable, you can flag it. The repository also includes Fake-TLS proxy entries, which are harder to detect by deep packet inspection in Iran and China.

If you're already reading about MTProto proxy battery drain on mobile (a topic I covered in detail here), the same verification principles apply. A proxy that saves battery but logs your IP is no bargain.

For a deeper dive into the protocol itself, this Telegra.ph guide explains the Fake-TLS handshake in technical terms.

A Practical Note on Verification

No proxy list is 100% trustworthy. The best you can do is cross-reference multiple sources and avoid using a single proxy for extended periods. The free-mtproto-proxies repository is one such cross-reference: its automated checks at least confirm the proxy is reachable and returns valid MTProto responses. That's a step above a random link in a Telegram group.

If you're in a high-risk environment (e.g., Iran, Russia, China), consider running your own MTProto proxy on a cheap VPS. The repository includes scripts that can help you set one up. Failing that, rotate proxies weekly and never trust one that asks you to install a custom certificate.

The security model of MTProto gives you strong encryption at the transport layer, but no encryption can protect you from the operator who logs your IP and sells it. Choose your proxy sources as carefully as you choose your VPN.

##MTProto Proxies for Mobile: Battery, Data, and the Real Cost of Staying Connec

Humja Jaan — Fri, 24 Jul 2026 04:22:05 +0000

Every mobile Telegram user knows the drill: the gray cloud icon appears, messages stall, and your first instinct is to reach for a proxy. By using an MTProto proxy from the free-mtproto-proxies repository (https://github.com/dubblebyte/free-mtproto-proxies), you regain your connection. But a stable proxy can kill your phone's battery or devour your data plan if you're not careful.

This post compares those costs specifically for mobile users, with quick setup instructions for iOS and Android. I've used proxies in Beijing rush-hour Metro and short-notice VPN collapses, so this isn't abstract. Let's get practical.

Battery Drain: Which Proxies Hit Hardest?

All network traffic adds power usage, but MTProto proxies are designed with mobile efficiency in mind. Here's what leads to drain:

Fake-TLS proxy overhead: Sending fake TLS handshake data for each connection adds about 5-10% more processing time per request compared to plain MTProto or SOCKS. But since Telegram sessions are persistent, reconnection costs dominate. If your proxy drops often, your phone burns extra power in the reconnect cycle.
Streaming and voice calls over proxy: Use VoIP? Voice packets map poorly onto 2G and 3G. Add a proxy hop (delay of ~50-200ms), and your device may constantly switch radio states (from HSPA to LTE), eating battery much faster.
TAP (Telegram Access Point) with MTProto: On iOS, premium users can set the TAP to "Proxy Only" or "Prefer Proxy." The latter drains more because it constantly pings the proxy for all connection attempts.

Practical tip: Use type None (not Socks5 or built-in) in Telegram's proxy settings if you only need messaging. If you rely on channels with huge video files, hardcode a stable proxy URL and disable autoupdate for nonwifi connections.

Data Usage: Hidden Expenses

Standard Telegram messages compress well. Proxy overhead is real, but small: typically an additional 80-150 bytes per HTTP response due to MTProto framing and TLS handshake (if using FakeTLS). That's negligible for text ( maybe +1MB monthly for a heavy chatter).

But:

Telegram video autoplay: Combined with a high-latency proxy, your device may request video segments multiple times when timeouts appear. A user I worked with in Shenzhen used 400MB in one evening just in cached video aborts. Decide whether autoplay on cellular stays on.
Proxy listing overhead: If you're scraping proxy lists hourly within your Telegram client (using bots or webviews), each scraper request eats limited cellular data in a region where you also need that same proxy. Less overhead means less frustration.

Use Telegram's "Data and Storage" settings: limit transfers to Wi-Fi, disable autoplay above a certain cellular speed (put it to 2MB/s or lower).

Background Behavior: Keep It Alive Without Hamstringing the OS

Staying connected while phone is sleeping is important for receiving messages. On mobile, Android aggressively rams idle apps with workarounds. Here's how MTProto proxies behave:

Android: Telegram stays alive via FCM (Firebase). Proxy state echoes in the status bar (lightning icon appears when active). If your proxy drops after the phone has been asleep 30 minutes, notifications may stop. Check powertop and examine if "Process: org.telegram.messenger.*" reconnects every 1 hour (setting inside Telegram). iOS reclaims memory faster but reconnects upon app open. In China, notification pings may be blocked entirely on airplane roaming; be prepared to open Telegram manually when undocked.
Experimental Proxy types: Some SOCKS-based proxies lock TCP keepalives and prevent doze—unclean close results in 2x battery drain. If you see heavy drain overnight in official 8.x, check if you use SOCKS vs plain MTProto from https://github.com/dubblebyte/free-mtproto-proxies.

Quick Setup Steps for MTProto Proxy

iOS (Telegram for iPhone)

Tap Settings → Data and Storage → Proxy → Add Proxy.
Choose MTProto.
Enter your server: hostname (in tg://proxy?server=IP&port=443&secret=ee... format extract: Server, Port and Secret).
After entering, enable toggle.

To use a ready deep-link: your browser or Telegram client can open tg://proxy?server=12.34.56.78&port=443&secret=ee... which will bring a dialog to add the proxy automatically.

Android (Telegram apk from Telegram.org)

Open Telegram Settings (three-line hamburger or swiping right).
Data and Storage → Proxy.
Hit the plus (+) icon. Choose "MTProto" if listed; otherwise "SOCKS5 proxy" fails.
Paste proxy details. Enabled? The lightning icon must appear in the chat list status bar.

The fresh proxy list from the repo integrates regularly scraped MTProto proxies that work on both platforms.

Repo Dependability: Where I Get Working Links

Most mobile proxy share groups expire within 24 hours. Fake-TLS pairs survive longer. I combine two resources: the telegram channel @socks_proxy_list (volatile) and the http-accessible listing at the free-mtproto-proxies repository (updated via GitHub Actions each hour). That repo injects proxies that include the exact Secret format needed for Android's and iOS's strict parsers. For deep-diving: my previous piece on mTProto in China's situation explains why Fake-TLS matters: https://telegra.ph/free-mtproto-proxies-07-23-2.

One pro-tip: when using proxy host and port from this listing, test connection in Telegram settings twice: iOS users will notice the first request fails less than 20% of the time; right after that it stabilizes. I also keep a copy of a backup listing from repositories like: https://paste.rs/SecD9 for crisis connection scenarios.

Mobile speed varies enormously with region. Always try Proxy → Enable and allow 10 seconds of idle before claiming "everything works." Connectivity is more enjoyable when the lightning icon stays yellow, not gray.

How MTProto Proxies Slip Past DPI: A Technical Breakdown

Humja Jaan — Thu, 23 Jul 2026 20:11:00 +0000

MTProto proxies are a specialized beast. Unlike HTTP or SOCKS5 proxies, they're built specifically for Telegram's protocol. Their primary purpose, particularly in regions with heavy internet censorship, is not just to route traffic but to make that traffic indistinguishable from ordinary HTTPS.

This is not a high-level overview. We're going to look at exactly how the protocol's obfuscation layer works, how FakeTLS leverages real certificate structures, and why Deep Packet Inspection (DPI) equipment—even with modern heuristics—struggles to block it.

The Two-Layer Architecture

Every connection through an MTProto proxy involves two distinct layers. The first is the transport layer (running on a TCP port, typically 443). The second is the MTProto payload inside it.

+-----------------------------------------------------------------+
|                       TCP Connection (Port 443)                 |
+-----------------------------------------------------------------+
|   Obfuscation Layer (FakeTLS / Random Padding / Nonce)          |
+------+----------------------------------------------------------+
| MTProto Payload (Encrypted Message, Session Key, Seq No)        |
+------+----------------------------------------------------------+

The critical insight: DPI systems do not see Telegram packets unless they trigger a pattern match. The obfuscation layer is designed to ensure no pattern exists.

How the Obfuscation Handshake Works

When a client connects to an MTProto proxy, the proxy (or client) sends an initial obfuscation nonce. This is a random 64-byte payload that serves two purposes: it encrypts the inner protocol header using a derived AES key, and it validates the connection. The official Telegram documentation calls this "the obfuscation v2" handshake.

The inner header after decryption looks like this:

0xef (magic byte for obfuscated TCP)
random padding (up to the remaining MTU minus the nonce size)
crc32 checksum (4 bytes)

This random padding is the first major issue for DPI. The socket reads [nonce_size + random_padding] bytes before the actual protocol data. If the packet stream contains a session resume or a PING, the proxy shuffles bytes inside the envelope.

Where FakeTLS Comes In

FakeTLS is an optional but critical extension found in many MTProto proxy implementations—including those from the free-mtproto-proxies scraper. Instead of sending a raw obfuscated block, the proxy constructs a legitimate-looking TLS ClientHello message. This isn't a mock—it's a structure that matches real clients.

A standard TLS 1.3 ClientHello packet contains:

Handshake Type: 01 (ClientHello)
Length: variable
Version: 0x0303 (TLS 1.2) -> downgrade trick used to match median client fingerprint
Random: 32 bytes (structurally correct)
Cipher Suites: 2-4 modern suites, omitting weak DH ciphers
Extensions: SNI, Supported Groups (x25519), Key Share

The proxy replaces Random bytes with its obfuscation nonce. The cipher suite list, the SNI name (www.microsoft.com, usually), and the allowed extension list are hardcoded from real browser captures.

When DPI sees this, it parses it as a standard TLS handshake. The state machine in the DPI box transitions to "TLS session opened." Since the proxy responds with something that looks like a valid TLS continuation (but is also obfuscated), the DPI doesn't look deeper.

Why TLS Fingerprinting Fails Against Fractured Handshakes

Let's consider the DPI software approach. Systems like Nokia 7705 SAR or Qosmos' NBAR stack often use TLS fingerprints such as JA3 or Jabder. They compare the cipher suite ordering, extension order, and EC curve IDs to known malware or application profiles.

An MTProto proxy using FakeTLS from the common implementations sets parameters exactly like a typical curl or a Chrome 118 TLS handshake. The cipher suite order is the weaker trace: Chrome sends TLS_AES_128_GCM_SHA256 (0x1301) and a few elliptic curve suites. The proxy mirrors this. Every SSH- or HTTPS- disguised MTProto proxy must also ensure the server response timing (handling during SYN-ACK) matches real TCP delays, though some DPI firms now check round trip timing as a heuristic.

However, the critical layer of defense is injected random padding. After the encrypted inner packet, the proxy appends \x08\x08\x08\x08... or zeros to burn away the signature buffer.

[Nonce][Encrypted Payload][Random0x00 Pad up to 64 bytes]

This Random0x00 Pad makes a non-constant amount of padded bytes before and after each component. Even if the DPI reads enough bytes to extract the payload, it sees a disjointed TSDU that decoding logic discards because the frame size is technically smaller than the raw TCP buffer read. The DPI gets confused: it reads the buffer down to the TCP segment offset limit and hits random padding that states "segment unsized."

Putting It to Practical Use

On the client side, you don't need to manually implement the handshake. The MTPROTO protocol stack built into Telegram Desktop does it automatically once it resolves the proxy link format. A typical MTProto proxy link looks like:

tg://proxy?server=192.0.2.100&port=443&secret=ee...1243>some_secret

Modifying the secret hex string when connecting through FakeTLS adds extra obfuscated TLS extension parts to the outer packet. Implementation requires use of secret strings containing dd or ee leading bytes to toggle different encryption tiers.

One concrete tip: if you control the proxy server, run two instances. One on a high port (e.g., 3128) without FakeTLS for mobile usage where resources matter, and one on port 443 with FakeTLS for desktop. This ensures maximal compatibility without resorting to VPN layers.

The Repo and Practical Scanning

Maintaining a curated, up-to-date list of active MTProto proxies gets frustrating manually. IPs change daily, ports shift, and not all proxies support the crucial FakeTLS migration. That is exactly where the free-mtproto-proxies repository adds value. It runs a daily automated script that checks proxy availability, secret format correctness, and filters those with reliable connectivity. The published web listing displays the live secrets in ready-to-copy tg:// links, targeted specifically at users in restricted regions. If you run or maintain such an environment—or just want to inspect a source of working proxies to understand how the DPI-Testing ecosystem evolves—it's worth exploring as a practical resource rather than a static list of dead IPs.

Ultimately, MTProto proxies with obfuscation and randomized padding remain more resilient than typical transparent proxies due to this carefully designed misdirection at the transport layer. DPI no longer sees protocol markers; it sees noise occasionally wrapped in near-perfect TLS façades. Understanding this 'mathematical camouflage' gives developers far more reliable control over transmission circumvention, regardless of upstream filter policy changes.

Running my own Telegram bot and kept having proxies die mid-

Humja Jaan — Fri, 17 Jul 2026 11:45:09 +0000

Running my own Telegram bot and kept having proxies die mid-session. Manual scraping from channels was a drag -- half were already dead by the time I tried them.

Threw together a scraper that checks public channels every hour, tests each proxy with fake-tls, and only keeps the ones that actually respond. Outputs a plain txt list and a web page so I can curl it into anything.

Now my cron job pulls from https://github.com/Yagami200/free-mtproto-proxies and I don't think about it until a proxy actually dies. Which is way less often.

I kept losing connection every 10 minutes because the proxie

Humja Jaan — Thu, 16 Jul 2026 13:00:45 +0000

I kept losing connection every 10 minutes because the proxies I manually copied from Telegram channels were already dead. The issue is most published proxies aren't tested -- people dump them and they don't work.

I built a scraper that watches public Telegram channels for new proxy links, then tests each one with real fake-TLS handshake before publishing. Hourly batch. Only proxies that survive the test make it into the list.

The output is just a plain txt file with valid MTProto proxy lines. No api keys needed, no telegram account required. Pull it anytime from the GitHub repo: https://github.com/Yagami200/free-mtproto-proxies

Haven't had a dead proxy in the config since I hooked it into my cron.

Ended up building a quick scraper for mtproto proxies becaus

Humja Jaan — Wed, 15 Jul 2026 16:22:27 +0000

Ended up building a quick scraper for mtproto proxies because manually hunting for working ones in telegram channels was a waste of time. Drops dead ones, keeps only ones that pass fake-tls check, updates hourly. The output is a plain txt list and a basic web page. Just point your client at the raw txt and forget about it. You can find it here: https://github.com/Yagami200/free-mtproto-proxies

Every time I needed a working MTProto proxy, I'd go digging

Humja Jaan — Wed, 15 Jul 2026 02:19:50 +0000

Every time I needed a working MTProto proxy, I'd go digging through Telegram channels, paste a link, watch it fail, rinse and repeat. Drove me crazy.

So I built a scraper. It crawls those same channels automatically, tests each proxy with fake-tls confirmation, and only keeps the ones that actually work. The results get published as a simple text file and a web listing that refreshes hourly.

Now I just pull from https://github.com/Yagami200/free-mtproto-proxies and grab a live proxy in ten seconds. No more manual testing. Set a cron job to rotate every hour if you want. It's been running for weeks without touching it.

Pulled my hair out for an hour trying to connect to a random

Humja Jaan — Tue, 14 Jul 2026 02:11:57 +0000

Pulled my hair out for an hour trying to connect to a random MTProto proxy I found in some Telegram channel. Wouldn't work. Tried another. Dead too. Third one? You guessed it.

So I automated the whole thing. This scraper runs every hour, checks public channels for proxy links, then actually tests each one with proper fake-TLS before adding to a live list. The web page updates automatically with only working proxies, and there's a raw .txt for scripting.

No more guessing. No more testing dead links by hand. Just grab the latest from https://github.com/Yagami200/free-mtproto-proxies and move on with your life.

I was getting tired of manually copy-pasting MTProto proxies

Humja Jaan — Sat, 11 Jul 2026 17:11:38 +0000

I was getting tired of manually copy-pasting MTProto proxies from Telegram channels only to find half of them dead on arrival. So I set up this scraper to do the boring work.

It runs on a cron job, scrapes public Telegram channels for proxy links, tests each one with fake-TLS support, and publishes only the working ones. The output updates hourly in a plain text file and a web listing.

You can grab the latest list from here: https://github.com/Yagami200/free-mtproto-proxies

Just pipe it into your Telegram client config or script. Saved me from clicking through 50 channels every week.

Spent the morning debugging why my Telegram bot kept droppin

Humja Jaan — Sat, 11 Jul 2026 04:21:16 +0000

Spent the morning debugging why my Telegram bot kept dropping connections. Turns out half the MTProto proxies I'd manually collected were already dead. Classic.

Threw together a scraper that watches public Telegram channels for new proxy links, tests each one with fake-TLS support, and only keeps the ones that actually work. It runs hourly, so the list stays fresh without me babysitting it.

If you're tired of clicking through dead Telegram threads hoping for a working proxy, the automated list at https://github.com/Yagami200/free-mtproto-proxies updates itself. Just grab the latest from proxies.txt and move on.