free-mtproto-proxies

### Bypassing Telegram Censorship: Country-Specific Tactics and Why MTProto with FakeTLS Works

You open Telegram. The gray cloud appears. Messages don't send. You're not alone — this is the daily reality for millions in Iran, Russia, China, and other regions where governments actively block Telegram's traffic. But the blocking methods vary by country, and so do the bypass strategies.

#### How Each Country Blocks Telegram

**Iran** uses deep packet inspection (DPI) to detect Telegram's protocol handshake. The telecom infrastructure, controlled by the government, identifies MTProto traffic by its specific byte patterns and drops the connection. They also maintain blocklists of known proxy IPs, which get updated daily. Additionally, Iran throttles VPN traffic using port-based filtering and protocol fingerprinting, making many standard VPNs unusable.

**Russia** employs a two-layer approach. First, Roskomnadzor maintains a registry of banned IP ranges and domains, which ISPs are required to block. Second, they use DPI to detect Telegram's obfuscated traffic — even when it runs on non-standard ports. In 2022, they began blocking traffic to known Telegram server IPs, forcing users to rely on proxies. Russia also actively monitors and blocks proxies that don't use TLS obfuscation.

**China** is the most aggressive. The Great Firewall uses DPI plus active probing — sending fake connection requests to detect Telegram servers and proxy endpoints. They also employ machine learning classifiers that recognize Telegram's traffic patterns. Chinese ISPs block IPs associated with proxies within hours of detection. VPNs using OpenVPN or WireGuard are often detected by their handshake signatures.

**Turkmenistan** and **Uzbekistan** use a simpler but effective method: they block all traffic to Telegram's known IP ranges via ISP-level filtering. No DPI needed — just a blocklist applied at the border gateway level. This hits all Telegram users equally, but also makes bypassing straightforward.

#### Why MTProto with FakeTLS Works

Standard MTProto proxies send traffic with a predictable header — a 4-byte length prefix followed by encrypted data. DPI systems recognize this pattern and drop it. FakeTLS wraps the MTProto traffic inside a TLS 1.2 or 1.3 handshake, making it look exactly like normal HTTPS traffic to a web server.

Here's what happens under the hood:

1. Your Telegram client connects to the proxy via a TLS handshake.

2. The proxy responds with a valid TLS certificate.

3. The client and proxy establish an encrypted tunnel.

4. Inside that tunnel, MTProto traffic flows normally.

5. To a passive observer, it looks like a regular HTTPS session to an unknown website.

This defeats DPI because the traffic matches the expected pattern of encrypted web browsing. Active probing is harder to defeat, but FakeTLS proxies that use domain fronting or ride on legitimate CDN IPs can bypass even that.

The key is that FakeTLS doesn't require a valid certificate from a real CA — the proxy generates its own, and the client doesn't verify it. The handshake just needs to look plausible to the DPI system. Newer FakeTLS implementations also support TLS 1.3, which further complicates fingerprinting because the handshake is encrypted.

#### The Proxy Reliability Problem

FakeTLS proxies get blocked too. In Iran, a working proxy might last 2-5 days. In China, that drops to 12-48 hours. In Russia, you might get a week. The constant churn means you need a fresh list of proxies, regularly updated.

That's where auto-updated sources become essential. The [free-mtproto-proxies repository](https://github.com/dubblebyte/free-mtproto-proxies) is one such source — it scrapes and publishes working MTProto proxies with FakeTLS support, and the list refreshes every few hours. The repo includes a live web listing so you can grab a proxy without cloning anything.

For a more detailed breakdown of how censorship differs by country and why specific techniques work, see the companion post on [censorship techniques and FakeTLS](https://dev.to/humja_jaan_fca09049ae97d5/censorship-techniques-by-country-and-how-mtproto-with-faketls-beats-them-237p).

#### Country-Specific Tips

**Iran**: Use proxies on ports 443 or 8443. Avoid port 80 — it's often throttled. FakeTLS is mandatory here; standard MTProto proxies get blocked within hours. Try rotating proxies every 48 hours.

**Russia**: Proxies on port 443 work best, but some ISPs (Rostelecom, MTS) also block these. Have a backup on port 993 (IMAPS) or 5222 (XMPP) — these are less commonly filtered. Check if your ISP uses "DPI boxes" from VAS Experts — if so, FakeTLS with TLS 1.3 is required.

**China**: Use proxies behind CDN IPs (Cloudflare, Akamai). These are harder to block because the IP is shared with legitimate websites. Avoid using proxies from public lists that are older than 24 hours. Set up automatic rotation every 12 hours.

**Turkmenistan / Uzbekistan**: Standard MTProto proxies (without FakeTLS) often work because ISPs don't use DPI. But carry a FakeTLS proxy as backup — blocklists update without warning.

#### How to Add a Proxy from the Repo

When you find a proxy in the repo's listing, it will look like:

tg://proxy?server=123.45.67.89&port=443&secret=ee...

Open Telegram, go to Settings > Data and Storage > Use Proxy > Add Proxy. Paste the URL. Telegram parses it automatically. Test it by sending a message. If the gray cloud turns green, you're set.

The repo also includes direct links for each proxy — tap or click to open in Telegram. The web listing shows the last check time, so you know which proxies are still live. For a full guide on setting up proxies across devices, check the [MTProto proxy setup walkthrough](https://telegra.ph/free-mtproto-proxies-07-25-2).

#### One Tip That Saves Time

Don't test proxies manually. The repo's live listing only shows proxies that passed a recent connectivity check, and it notes whether FakeTLS is enabled. Even so, a proxy that works from one network may fail from another — your ISP might route differently. If a proxy fails from your home connection, try it on mobile data. If it works there, your ISP is specifically blocking that proxy IP.

#### Final Thought

Governments improve their blocking techniques. But FakeTLS, combined with regularly updated proxy lists, gives you a reliable path through the censorship landscape. The key is automation — don't rely on static lists from months ago. Use a source that updates frequently, test before you rely on a proxy, and keep a few backups.