How to Set Up Your Own Telegram Proxy: MTProto on a VPS

Contents

1. First things first: MTProto or SOCKS5
2. Why you need a proxy at all
3. What you will need
4. Step 1. Getting a server
5. Step 2. Setting up the proxy
6. Step 3. Getting the connection link
7. Step 4. Connecting in the app
8. Step 5. Checking that it worked
9. If it does not connect
10. Telegram's own program: why we did not pick it
11. What it costs and how much it handles
12. When your own MTProto proxy is not enough
13. Frequently asked questions
14. In short

Free Telegram proxy lists last a matter of hours. You find a fresh server, paste it in, it works for a day — and the next morning the icon in the corner glows red and you are off searching again. The reason is simple: thousands of people share that proxy, so it gets found and blocked fast.

Your own Telegram proxy settles this for good. It costs less than a cup of coffee per month, nobody knows about it except you, and it has no reason to go down. How to set up your own Telegram proxy — we go through it step by step below, with real commands from official repositories rather than guides written five years ago.

First things first: MTProto or SOCKS5

When people look for a Telegram proxy, they usually mean one of two things, and those things are different.

Telegram has two separate menu entries, and that is the first thing people trip over.

	MTProto proxy	SOCKS5 proxy
What you enter	server, port, secret key	server, port, username, password
What runs it	a dedicated program on the server	an ordinary proxy server
Traffic disguise	yes, it can pose as ordinary HTTPS	no, it is visible as a proxy
Where to get one	set it up yourself on your own VPS	buy a ready-made one or set it up

MTProto is Telegram's own protocol. It is exactly what people mean when they ask for “server, port and key”. It can pose as an ordinary visit to a website, so it gets through where a plain proxy no longer does.

SOCKS5 is a general-purpose proxy, and Telegram works with it too. You pick it when the address is needed for more than Telegram, or when it matters that the IP looks like a real person's.

In this article we set up MTProto — it costs nothing to run and is built precisely for Telegram. We come back to SOCKS5 at the end: there are jobs where nothing else will do.

Why you need a proxy at all

Let's check rather than take it on faith. Here is what Telegram answers from a server inside Russia and from one outside it — measurements taken while preparing this article:

Where we connect	From a Russian address	From abroad
api.telegram.org	no answer, drops after 4 seconds	answer in 0.35 seconds
Telegram data centre ports	unreachable	open

Hence the demand for a Telegram proxy: the problem is neither the app nor the phone — the channel to Telegram's servers simply does not go through from Russian addresses. A proxy gives that channel back: your phone connects to a rented server, and that server does the talking to Telegram.

What you will need

• A server outside Russia — the cheapest one will do: 1 core, 1 GB of memory. MTProto barely touches resources, it only shuffles bytes.
• A dedicated IP without NAT — the address must be yours, not shared with a hundred other customers.
• Your own domain — any one, even the cheapest. It is needed for the disguise, and this is the part that does not fit into ten minutes: registration and DNS propagation take anywhere from a few minutes to a day. Get it in advance.
• A web server with a certificate on port 443 of that domain. Below we explain why it is needed and why without it the proxy gives itself away to the first scanner that comes along.
• Half an hour and the ability to copy a command into a terminal. No programming required: the proxy commands themselves take about ten minutes, the rest goes on the domain and the certificate.

Step 1. Getting a server

We rent our servers from Aeza: European locations, payment by Russian card and hourly billing — if you change your mind, the experiment costs pennies. The link is an affiliate one; the price is the same for you. We do not quote specific plans: they change more often than articles get updated.

When ordering, pick Ubuntu 22.04 or 24.04 — everything below assumes them. After payment you receive the server address and the root password. Connect (the address in the examples is fictional, substitute your own):

ssh root@203.0.113.10

A phone works too — install the free Termius, add a host, enter the address and password. Everything below works from there as well.

Step 2. Setting up the proxy

We will go with mtg, a modern implementation of an MTProto proxy. Why not Telegram's own program? That is explained a bit further down: there is an unpleasant detail most guides keep quiet about.

What follows is eight points in order. Do them one after another without skipping: each one relies on the previous. Why it is done this way comes right after the instructions, in four subsections.

1. Get a domain and point it at the server. Any domain will do, even the cheapest. In your registrar's control panel find the DNS records section and create an A record: name @ (or empty, which means the domain itself), value — your server's IP. Why the domain has to be yours is explained below: without that the proxy will not work over mobile internet.

2. Wait until the domain resolves. After the A record is added, DNS propagation takes from a few minutes to a day. Check like this:

getent ahostsv4 your-domain.com

The answer must contain your server's IP — it will appear three times, on STREAM, DGRAM and RAW lines, and that is how it should be. If the record is not there yet, the command prints nothing. Until the IP shows up you cannot go further: the next points will not work until the domain resolves. getent exists on every system, there is nothing to install. Use ahostsv4 specifically rather than getent hosts: the latter shows only the IPv6 record if the domain has one, and you will not see your address. And about IPv6: if the domain has an AAAA record, it must point at an address where the web server from point 4 answers. If the server has no IPv6 at all, the domain should not carry that record either — otherwise certificate issuance may stumble over it.

3. Install Docker.

apt update && apt install -y docker.io

4. Bring up a web server on 443 and issue a certificate. This is the cover: it is what will answer the curious instead of the proxy. First open the site ports in the firewall — certbot verifies domain ownership with a request to port 80, and with the firewall on, issuance breaks with a Timeout during connect error:

ufw allow 80,443/tcp

If you get command not found in response, the firewall is simply not installed — skip this line and move on. Now the web server and the certificate themselves, two commands and free of charge:

apt install -y nginx certbot python3-certbot-nginx
certbot --nginx -d your-domain.com

Certbot will ask for an email address and agreement to the terms, and do the rest itself. If this server already hosts your site and port 443 is taken by it, install nothing — you already have a certificate, move on to point 5.

5. Check the cover. Port 443 of your domain must be answered by a web server with TLS 1.3. The disguise imitates exactly the modern TLS 1.3 handshake. If the cover site answers over the outdated TLS 1.2, the discrepancy shows at the very first comparison: to one and the same request your proxy answers the new way and the site the old way. One command checks it:

openssl s_client -tls1_3 -connect your-domain.com:443 </dev/null

The handshake went through — the domain is suitable. An error like alert number 70 means the site does not speak TLS 1.3, and such a domain must not be used for the disguise. The sign of success is the line New, TLSv1.3, Cipher is … in the output; a fresh nginx with a Let's Encrypt certificate passes this check, we verified it on our own server. The advice “take your hosting provider's domain”, which turns up in some guides, does not always work: aeza.ru and selectel.ru answer the same command with alert number 70, meaning they have no TLS 1.3. So check rather than take it on trust.

If instead you see Connection refused or the command stays silent until it times out, nobody is answering on 443 — that is, point 4 was not done or nginx did not come up. Look at systemctl status nginx.

6. Generate the key. Put your own domain in place of your-domain.com: mtg does not verify what you typed and will honestly hand you a non-working key for a placeholder.

docker run --rm nineseconds/mtg:2 generate-secret your-domain.com

In response comes a long string like 7pwQ0L3T9UR8CUt_dfgzLv9leGFtcGxlLmNvbQ. That is your key — copy it, you will need it twice. The disguise domain is baked into the key, so your string will be a different length if you chose a different domain: that is how it should be.

7. Start the proxy. Put your key in place of YOUR_KEY:

docker run -d --name mtg-proxy --restart=unless-stopped -p 2053:3128 nineseconds/mtg:2 simple-run 0.0.0.0:3128 YOUR_KEY

8. Allow the port in the firewall — just in case. Same as in point 4: no ufw command means no firewall, and the point can be skipped.

ufw allow 2053/tcp

A caveat that usually goes unwritten: when you run it through Docker, this command changes nothing. Docker publishes the port with its own rules, which sit earlier in the chain than the ufw ones, so 2053 will be open from outside even with the firewall on. The command matters if you set the proxy up without Docker — for example Telegram's own program from the section below: there the port stays closed until you open it. What Docker cannot bypass is the external firewall in your hosting panel: if the proxy does not answer from outside, look there first.

That is all, the proxy is running: docker ps shows whether the container is alive, and we will do the full check from a phone in Step 5.

Why the disguise domain must be yours

Not google.com, not www.microsoft.com — a domain pointed by an A record at this very server. The mtg authors put it more mildly: “hide behind some domain that has some relation to this IP address”, and give the hosting provider's domain as an example. We went further and took a domain of our own — here is what led us to it.

We ran two proxies side by side on one server: one with the domain www.microsoft.com on port 8443, the other with our own domain on port 2053. Over home Wi-Fi both worked. Over mobile internet — only ours. An honest caveat: this experiment changed two things at once, the domain and the port, so we did not separate their contributions: the carrier may dislike port 8443 itself. And we tested on a single carrier; about the others we do not know. But the pattern is telling: with someone else's domain the connection breaks at the handshake, and the explanation is simple — the name in the request does not match the owner of the address: Microsoft's networks belong to Microsoft, while your server sits at a hosting provider.

This is not an isolated case. On 30 July 2026 we caught something similar on a different protocol, VLESS with REALITY: with the domain www.microsoft.com the same mobile carrier produced 850 drops in a row and not one successful connection — the log said failed to read client hello, meaning the handshake was not reaching the server. With our own domain the request did arrive, although the connection still failed that time, for a different reason. So the July case is not proof but a second similar symptom: changing the domain changed how the network behaved.

Why not 443, but a separate port

Port 443 is the port of ordinary websites, and the temptation to put the proxy straight on it is strong: traffic to 443 looks like an open web page and gets through almost any network. But that is exactly what you must not do, and here is why. The disguise domain points by an A record at your own server, and mtg is built like this: when a non-Telegram connection arrives at its port (a scanner, a browser, a checking robot), it silently forwards that connection to port 443 of the domain from the key — so the visitor sees a real site. If mtg itself occupies 443, it forwards the connection to itself, then again, and so on in a loop.

We checked this rather than assumed it. A single browser request under such a scheme produced 10,338 connections of the server to itself and hung without an answer. A correctly configured scheme on the same server answered with a real page in 0.03 seconds. So the loop does not merely break the cover story — it hands any scanner a way to take your server down with one request.

Hence the layout: port 443 carries a web server with your domain's certificate, and mtg listens on a separate port. Do not pick something exotic like 8888; pick a port commonly used for HTTPS: 2053 works for us — it is one of the ports Cloudflare serves HTTPS on, and networks let it through. Verified both on home Wi-Fi and on mobile internet.

In the command above, -p 2053:3128 means exactly that: we listen on 2053 from outside and on 3128 inside the container. Port 443 is meanwhile occupied by your web server — which is what serves as the cover.

What “disguise as a website” means

The key you generated carries the name of a site inside it: in the example above that is the domain pointed by an A record at the server with the proxy. Thanks to this, a connection to your proxy looks from the outside like an ordinary visit to that site. The mode is called Fake TLS, and it is what lets the proxy live long.

mtg has a second line of defence too — a “doppelganger” mode, where the proxy imitates the behaviour of the real site, including response delays. In the simple run we did above it works on pre-collected statistics; to tune it to your specific domain you need a configuration file. For a start that is overkill, but it is worth knowing the headroom is there.

The key is a password, treat it as one

Whoever has the key uses the proxy. Do not publish it in open chats and forums: the moment it lands in a public list, your personal proxy becomes a shared one and repeats the fate of the free ones. If you need to give access to family and friends, make them separate keys.

Step 3. Getting the connection link

We assemble the link following Telegram's official pattern — substitute the server address and your key:

tg://proxy?server=203.0.113.10&port=2053&secret=YOUR_KEY

The same link as an ordinary web link, convenient to send to your own Saved Messages:

https://t.me/proxy?server=203.0.113.10&port=2053&secret=YOUR_KEY

The fastest way to connect is to send this link to yourself in Telegram and tap it. The app opens a dialog offering to enable the proxy, and nothing has to be typed by hand.

Step 4. Connecting in the app

If the link did not work for some reason, add the proxy manually. The paths differ by platform.

Android

Settings → Data and Storage → Proxy Settings → Add Proxy → choose MTProto. Fill in three fields: server, port, key. No username and password here — MTProto has none at all. Save and switch it on.

iPhone

Settings → Data and Storage → Proxy → Add Proxy → MTProto. The same three fields. After saving, check that the new proxy is ticked.

Desktop

Menu → Settings → Advanced → Connection type → Use custom proxy → MTProto. Enter the server, port and key.

Web version

The browser version of Telegram has no proxy settings. There you either open the site through a VPN or use the app.

Step 5. Checking that it worked

Three checks, in increasing order of reliability.

The icon in the app. A proxy icon appears next to the search bar. Steady — the connection is up; red or spinning — it did not connect.

The port from outside. From any other computer, check that the server is visible:

curl -sv -m 5 telnet://203.0.113.10:2053

The answer must contain Connected to — that means the port is open and visible from outside. The -m 5 flag is mandatory here: without it curl waits for input after connecting and the command hangs. If instead of Connected to you get a timeout, the port is closed by a firewall — see the next section.

The proxy logs. They show whether connections are reaching you:

docker logs --tail 20 mtg-proxy

If it does not connect

• The port is closed by the hosting provider's external firewall. The most common cause. Look for the network rules section in your server control panel and allow your port. The server's own firewall does not close the port when you run through Docker (Docker publishes it bypassing ufw), but the hosting panel does.
• You entered the internal address instead of the external one. The link must carry the IP your hosting provider gave you, not 172.17.0.2 from inside the container.
• Works on Wi-Fi, not over mobile internet. Check the disguise domain first: it must be yours and point by an A record at this server. Reissue the key with your own domain and rebuild the link — the old one stops working, and that is normal. If that did not help, try another port from the ones Cloudflare uses for HTTPS: 2083, 2087, 2096. In our experiment the domain and the port changed at the same time, so we did not isolate the port's contribution.
• The domain does not resolve yet. After the A record is added, DNS propagation takes from a few minutes to a day. Check getent ahostsv4 your-domain.com — the answer must contain your server's IP.
• The key was not copied in full. It is long, and it is easy to lose the tail when copying from a terminal. Compare the beginning and the end.
• The container did not start. Check with docker ps. If the list is empty, look for the reason in docker logs mtg-proxy.
• The server rebooted and the proxy did not come back. The --restart=unless-stopped flag in the run command is exactly the insurance against this — make sure you did not drop it.
• The phone says “proxy unavailable” although the proxy is fine. The most galling case: the server answers, the password is accepted, and the app still shows an error. You can find out who is at fault in a minute, without touching the server. Enable the same proxy in a desktop browser (in Firefox this is done with the FoxyProxy extension: type SOCKS5, your address, port, username and password) and open any site that shows your IP, for example api.ipify.org. If it displays your server's address there, and your usual one with the proxy off, then the proxy is entirely healthy and the problem is in the app. In that case delete the proxy entry in Telegram and add it again from the link in Step 3, without typing the fields by hand, and make sure it is marked as active. If even that does not help, use MTProto: for Telegram it is both more reliable and less conspicuous.

Telegram's own program: why we did not pick it

Telegram has its own MTProxy implementation, and many guides recommend exactly that — along with the ready-made telegrammessenger/proxy image. Here is the detail those guides keep quiet about: the image tagged latest has not been updated since February 2020. Easy to verify — the publication date is public on Docker Hub. A fresher build appeared there only in April 2026 and is marked as beta.

The code itself is alive, though: the latest changes in Telegram's repository are dated August 2026. So the option works, you just have to install it by building from source rather than from the stale image:

apt install -y git curl build-essential libssl-dev zlib1g-dev xxd
git clone https://github.com/TelegramMessenger/MTProxy
cd MTProxy && make && cd objs/bin

Next we download Telegram's service files — the program needs them to talk to the data centres:

curl -s https://core.telegram.org/getProxySecret -o proxy-secret
curl -s https://core.telegram.org/getProxyConfig -o proxy-multi.conf

Generate your own key:

head -c 16 /dev/urandom | xxd -ps

And start it:

./mtproto-proxy -u nobody -p 8888 -H 2053 -S YOUR_KEY --aes-pwd proxy-secret proxy-multi.conf -M 1

Note two differences from the recipe above. The port here is also not 443: your cover web server occupies 443. And the key in this variant is a plain one, with no domain inside — which means there is no disguise as a website, and over mobile internet such a proxy may fail to come up.

It works no worse, but there is more fuss: you have to write the autostart service yourself and refresh proxy-multi.conf once a day. We chose the container to save time.

What it costs and how much it handles

A cheap server is plenty. An MTProto proxy uses a handful of megabytes of memory and barely loads the processor — all the work comes down to passing bytes along. One such proxy comfortably serves a family or a small team; you will run into your hosting provider's bandwidth sooner than into the proxy itself.

Figures from our own server, where such a proxy is in its third week: mtg takes 17 MB of memory, and processor load at the moment of measurement was 0.02 on a one-core scale. The server simply does not notice the proxy.

When your own MTProto proxy is not enough

Your own proxy solves one task perfectly — getting your access to Telegram back. But there are scenarios where it will not help.

Task	What fits	Why
Get Telegram back	your own MTProto on a VPS	cheap, private, full control over the key
Several work accounts	a mobile proxy for each	a shared address links the accounts to one another
Bulk messaging, promotion, bots	mobile proxy	a server address is recognisable as such and quickly runs into restrictions
Work on other platforms	mobile or residential	there they check not only the country but the type of address

The difference is the type of address. The address of a rented server looks like a server address to platforms, and it is treated with suspicion. A mobile carrier's address looks like an ordinary subscriber — dozens of real people sit behind it, so there is more trust in it.

If your task goes beyond “get Telegram back”, have a look at mobile proxies — locations outside Russia are in stock, and the current list of countries and cities is visible right on the catalogue page. If you need an address shared with nobody, there are elite mobile proxies. And when you need many such addresses permanently, it is cheaper to run your own farm.

Frequently asked questions

Why set up my own Telegram proxy when there are plenty of free ones?

A free one is shared by thousands of people: it is slow, it gets found and blocked quickly, and whoever runs it sees your address and your traffic volumes. Your own costs pennies and belongs to you alone.

Is it legal?

A proxy is an ordinary network technology; companies use it to protect corporate traffic. You are setting up a server for personal access to a messenger, not for anything prohibited.

Can the proxy see my messages?

No. Telegram messages are encrypted between your device and Telegram's servers, and the proxy only passes sealed packets along. But that holds for your proxy. Somebody else's free proxy sees that you use Telegram, your IP and your traffic volumes — one more reason to set up your own.

How is a proxy different from a VPN?

A proxy works for one app, a VPN wraps all of the device's traffic. For Telegram a proxy is more convenient: the other apps keep going directly, speed does not suffer and neither does the battery. If you need a tunnel for all traffic, we have a separate guide on how to set up your own VPN.

How many people can one proxy handle?

A small team without trouble. The limit is not in the program but in the server's bandwidth, so as the number of users grows, look at the hosting plan rather than at the proxy.

Does the proxy need updating?

The container is updated with four commands: pull the fresh image (docker pull nineseconds/mtg:2), stop it, remove it and start it again with the same key. Without docker pull there is no update: the run takes the image from cache. It does not need doing often — once every few months is enough.

Why did my proxy stop working?

Check in order: is the container alive (docker ps), is the port open, did the server's IP change, did the hosting payment run out. Nine times out of ten it is one of these four.

In short

• Free lists last a matter of hours — thousands of people share them. Your own Telegram proxy costs less than a cup of coffee and does not go down.
• MTProto and SOCKS5 are different menu entries. MTProto needs a server, a port and a key; it has no username and password.
• The proxy itself is two commands: generate the key and start the container. But before them you need your own domain pointed by an A record at this server, and a web server with a certificate on its port 443 — that is what serves as the cover.
• Put the proxy on a separate port (2053 in our case), not on 443: occupying 443 makes mtg forward connections to itself — we got 10,338 connections from a single request.
• The key is equivalent to a password. Once it lands in a public list, a personal proxy becomes a shared one.
• Do not use the image tagged latest from the official program: it is over five years old. Either a fresh container or a build from source.
• For several accounts your own proxy is not suitable — there you need an address that looks like a real subscriber's.