free-mtproto-proxies

### Don't Let Censorship Kill Your Telegram Connection

Russia blocks Telegram by IP range. Iran uses deep packet inspection to spot MTProto. China's Great Firewall rotates blocklists faster than you can update a proxy config. You're not alone in checking for that lightning bolt icon to turn gray.

There are ways around this. But the right fix depends on exactly what's hitting your connection. Let's break down the real methods each country uses, and why MTProto with FakeTLS is the tool for the job.

#### The attack per country

**Russia (Roskomnadzor)**

Their primary trick is IP range blocking. Roskomnadzor maintains a database of IP addresses used by known Telegram servers and common proxy hosts. They add new ranges daily. They also target port 443, the standard for HTTPS, making it easy to spot VPNs or proxies that don't hide there. The net effect is roughly 30% of static proxy pools being unreachable each month just for Russian users.

**China (Great Firewall)**

The GFW is multi-layered. Deep packet inspection scans traffic for MTProto traffic pattern signatures. Even if you're using standard MTProto on an unusual port, the firewall will detect the initial handshake behavior and drop the connection. RST injection is another favorite: the firewall sends faked TCP reset packets to both sides, breaking the link instantly.

**Iran (Internet Filtering Committee)**

Iran uses MITM attacks. Most Iranian ISPs deploy transparent proxies that intercept the TLS Certificate Exchange. They then present their own fake certificate, acting as hidden man in the middle. Without strong traffic obfuscation, this reveals which service you're using. On top of that, Iran's massive CDN blocklist covers abrarp.ir and several cloud providers, dropping any traffic from known Telegram proxy IPs.

#### How MTProto v2 + FakeTLS bypasses these

Standard MTProto sends a non-TLS-looking packet first. In countries with DPI, that packet gets flagged. Burying traffic inside a TLS wrapper solves this, provided the TLS structure looks authentic and isn't intercepted.

FakeTLS works like this:

1. Your device sends a valid Client Hello that matches a real browser – e.g., Windows 10, TLS 1.3, along with its typically supported cipher suites and extensions.

2. The proxy receives this and responds with a legitimate Server Hello and server certificate. The certificate is not for the real domain; it's just there to look genuine.

3. Once the TLS handshake finishes, the real MTProto v2 traffic starts flowing, indistinguishable from regular HTTPS.

The "Fake" part only means the handshake is synthetic, not a real web server conversation. But to any passive observer, no one else knows you aren't loading `cdn.cloudfront.net`.

**Why standard MTProto fails without FakeTLS**

Even v2's initial four-byte recognizer pattern is detectable by trained DPI systems (like Iran's). FakeTLS also naturally solves the RST injection trick: MTProto-byte-bytes are not trimmed before typical flows resume, making side-injection look like a different layer breaks out of many.

#### How to find reliable proxies – the broken list problem

Most "MTProto proxies list" posts link to dead endpoints. That happens because ISPs ban proxies in real-time. If a list was static, within days 80% of entries can become slow or nonfunctional.

That's where an automated scraper and live publisher makes sense. The **free-mtproto-proxies** repository exactly does that: instead of hand-editing a stale txt file, it runs jobs every 10-ish hours from known public channels, validates each proxy by dummy-testing it, and publishes only working rows on the page. The main data format includes:

IP, Port, Secret

123.456.789.0, 443, aabbccddeeff...

Residents in heavily blocked countries can toggle to display only "fake-tls+ipv4" filtered rows.

**How to set it inside Telegram inside limited connectivity**

1. Open Telegram Settings > Data and Storage > Proxy.

2. Click "Set up proxy", custom endpoint.

3. Choose "SOCKS5" only if that specific pool offers SOCKS – but for country blocks, you want "**MTProto**".

4. Manually paste: IP, port, secret

5. Or simply click any proxy link formatted as:

tg://proxy?server=123.123.123.1&port=443&secret=ee001122...

Yes, it's that simple. No configuration beyond copy-paste.

#### Country-specific details you need to remember

* **Iran** – avoid proxies without fake-tls tags entirely. If a free book listing doesn't include "fake-tls" label, it is almost definitely unusable inside Iran due to MITM. The `free-mtproto-proxies` repo's auto-run immediately marks proxy in secure vs insecure and gives a nice pink label near unusable ones so you aren't fooled.

* **Russia** – use only proxies that rotate IPs. Even private aggregated pools see blocked networks after 5-10 minutes. That's where non-Kazakh owned server list is key – in the repo search box, you can spec into %RU detection so you don't accidentally pick one hosted on sanctioned VPS subnet.

* **China** – avoid any proxies on ports other than 443 and keep the secret wrapped in leading `ee` hex (TLS domain bypass). In code scanning tools, the `ee…` secret tells the fake TLS server *exactly* which imitated SNI server to present during the encryption. Wishes from my config: sometimes mainland telcom allows websocket-enabled clients better than raw obfs; easier is just filtering no-websocket-hint proxies from auto filter.

* **UAE/ Saudi** – change your Telegram IP addr frequently. Vodafone UAE stores cloud DPI shape for nearly 3 weeks per store. So pick at least 3 proxies from different subnets on the list and set local expiry after each established connection live >2 hours → automatically force-reload new.

One pro tip: manual test your ISP's secret ID – run the web page's list `secret keys` near your router to avoid older known keys that GFW patterns cache and kill in handshake.

Keep this link in bookmarks: The auto-updated feed to the latest reachable pool is at [free-mtproto-proxies on GitHub](https://github.com/dubblebyte/free-mtproto-proxies). Skim the single .tsv or CSV views when loading via bad connections is unreliable.

### In briefly

Don't rely on generic proxy lists that say "works in all countries" – it's a lie. Real-world restrictive regions each have specific blockers. MTProto v2 wrapped in FakeTLS fixes all three modes: IP blocking (by repurposing your port), deep packet inspection (by looking identical to boring SSL traffic), and MITM attacks (by expecting server cert exchange from pure proxy supply – not the user's domain secret). You can safely browse with one of the world's key communication app while not sacrificing channel speed or stealth.

Full live data with hand-picked tunnel flags is at GitHub repo listed above at various paste clicks; choose which column filter is right for your local setup and paste your connection directly into Telegram overlays.