You open Telegram. The gray cloud appears. Messages don't send. You've been hit by deep packet inspection (DPI) that recognizes Telegram's protocol and drops the connection. This is the reality for millions of users in Iran, Russia, and China.
Governments use different tricks to block Telegram. But there's a common workaround: MTProto proxies with Fake-TLS. Here's how those specific censorship techniques work, why this proxy flavor is effective, and where to find proxies that stay alive—without scraping shady Telegram channels.
How Censorship Works in Key Regions
Iran: Protocol-Level DPI with Keyword Matching
Iran's censorship apparatus operates at the network layer. ISPs deploy DPI boxes that inspect packet payloads for Telegram's handshake bytes. The MTProto protocol has a recognizable signature—specific magic bytes in the initial connection. Once detected, the box either drops the packet or resets the TCP connection.
Iran also uses SNI filtering on HTTPS connections. But Fake-TLS transforms the MTProto handshake into a valid-looking TLS 1.2 or 1.3 ClientHello. The proxy operator's server presents a TLS certificate (self-signed or Let's Encrypt). To the DPI box, the traffic looks like regular HTTPS to an obscure domain. The gray cloud disappears.
Russia: IP Blocklists and DPI Based on Domain
Russia's Roskomnadzor maintains IP address blocklists. They also blacklist domains used by Telegram's built-in MTProto servers. The RKN does not block all HTTPS—that would break the country's internet—so Fake-TLS pass as normal traffic to an allowed IP.
However, Russian ISPs are now experimenting with active probing: if a connection behaves like Telegram on an unknown port, they send a test connection to mimic Telegram's protocol. If the server responds correctly, the IP gets added to the blocklist. This is why a static proxy server can die within hours. You need an auto-updating source of fresh proxies.
China: The Great Firewall's Multi-Layer Inspection
China uses the most sophisticated DPI in the world. The GFW inspects packet sizes, timing, and TLS handshake parameters. It also maintains a database of known proxy IPs and actively probes unknown servers.
Fake-TLS works in China but with caveats. If the proxy server's certificate subject or ciphers match Telegram's known patterns, the GFW blocks it. Proxies that use uncommon TLS parameters or host on cloud providers like Alibaba suffer higher blocking rates. The key is using a proxy that mimics real browser TLS fingerprints—not just any TLS.
Why MTProto with FakeTLS Works (and When It Doesn't)
MTProto is Telegram's own transport protocol. By default, its handshake is easily identified. Fake-TLS wraps that handshake inside a TLS 1.2/1.3 ClientHello and ServerHello sequence. The proxy acts as a TLS-terminating server, then forwards the underlying MTProto traffic to Telegram.
The success depends on:
- TLS fingerprinting: Some advanced DPI compares the ClientHello's cipher suites and extensions against known browsers. A minimal Fake-TLS implementation may get blocked because it looks like a DIY bot, not Chrome. Choose proxies that mimic modern browser TLS (TLS 1.3 with specific ciphers).
- Certificate validity: A self-signed cert works in most cases because DPI doesn't validate the chain. But some Chinese ISPs can even inspect the full chain with OCSP queries. Let's Encrypt certs are safer.
- Server location: A proxy in a datacenter with a known IP range is more likely to be blocked in China. Use proxies on residential or less-known hosting IPs.
When Fake-TLS fails, it's usually because the DPI has added the TLS signature to a blocklist. At that point, you need a fresh proxy with a different TLS profile.
Finding Reliable Proxies That Stay Alive
Manually searching Telegram channels for proxies is tedious and dangerous. Many channels share dead proxies or logs. Instead, use an auto-updated source that continuously scrapes public lists and validates them.
The free-mtproto-proxies repository does exactly that. It runs an automated scraper, tests each proxy for connectivity and Fake-TLS support, then publishes a live web listing. You can grab a proxy in one line:
{
"host": "123.123.123.123",
"port": 443,
"secret": "dddddddddddddddddddddddddddddddd"
}
Or directly open the tg:// link by copying it from the web listing. The list refreshes every 30 minutes, so you always have a working proxy even if the last one got blocked.
For developers, the repo's proxies.json URL is perfect for automated scripts. You can build your own quick checker or integrate it into a mobile app's proxy rotator.
Country-Specific Tips
-
Iran: Use proxies with
secretstarting withee(Fake-TLS with a domain). Avoid plainddsecrets (no obfuscation) as they get blocked quickly. Also, set a shorter connection timeout—Iranian ISPs often silently drop sessions after 30 seconds. -
Russia: Prefer proxies hosted in Western Europe (Netherlands, Germany) with low ping. Use the
tlsprotocol in Telegram's proxy settings if your version supports it. The RKN's active probing kills proxies hosted within Russia faster. - China: Rotate proxies daily. The GFW learns and blocks within 24 hours. Use the repo's list around 10 PM Beijing time when new scrapes are published. Also, enable "obfuscated" mode in Telegram's proxy settings if available—it adds extra padding that confuses DPI.
I've covered more details about setup and mobile behavior in my practical guide for censored regions (https://dev.to/humja_jaan_fca09049ae97d5/telegram-proxies-that-actually-work-a-practical-guide-for-censored-regions-48o6) and the underlying protocol dynamics on Telegra.ph (https://telegra.ph/free-mtproto-proxies-07-25).
The key takeaway: censorship varies by country, but Fake-TLS MTProto proxies remain a reliable bypass when sourced from an updated, validated list. Bookmark the free-mtproto-proxies repo and grab a fresh proxy whenever you need it.
Canonical URL: https://dev.to/yourusername/censorship-techniques-and-mtproto-faketls
Top comments (0)