Telegram Proxy
Overview
AmneziaVPN 5.0.0.5 and later lets you install a Telegram proxy service on your own server and manage it through the app:
- MTProxy — Telegram's official implementation of an MTProto proxy server.
- Telemt — an alternative MTProto proxy implementation with additional built-in traffic obfuscation mechanisms designed to bypass network blocking.
Whether MTProxy and Telemt work depends on the region from which you connect, your ISP and its network restrictions, and your server's IP address. For this reason, we cannot recommend settings that guarantee a proxy connection on every network.
AmneziaVPN only installs the proxy services on your server and lets you manage them.
Installing a Proxy on Your Server
- On the AmneziaVPN main screen, click any connection name.
- Click ⚙️ (gear icon) to the right of the server.
- Open the Services tab.
- Select MTProxy or Telemt. If necessary, specify a port that is not already in use on the server, then click Install.
You can install both proxy services on the same server, but they must use different ports. If XRay or OpenVPN over TCP is already installed on the server, do not use its port for the proxy.
After installation, AmneziaVPN takes you back to the Services tab. Select the installed MTProxy or Telemt service to open its details: connection information is available on the Connection tab, while proxy settings are on the Settings tab.
Connecting Through the Proxy in Telegram
The Connection tab contains two connection links and their QR codes, as well as the server address, port, and secret for manual setup.
For automatic setup, click the copy icon to the right of a proxy link and send it to Saved Messages or another Telegram user. Open the link in the chat and confirm adding the proxy server.
For manual setup, open the proxy settings in Telegram, select MTProto, and enter the proxy details from the Connection tab in AmneziaVPN. Save the connection settings and enable the proxy.
Proxy Settings
To open the proxy settings, go to the Services tab in the server settings, select MTProxy or Telemt, then open the Settings tab. Additional settings are available under Advanced on the same tab.
| Setting | Description |
|---|---|
| Enable MTProxy / Enable Telemt | Turns the service on or off. You cannot connect to the proxy while the service is disabled |
| Base secret | The primary secret, generated automatically. Click the refresh icon to generate a new random value |
| Public host / IP | The address added to connection links. Leave this field empty to use the address of the server where the proxy is installed |
| Server port | The TCP port used by the proxy. The default is 443 |
| Promoted channel tag | An optional 32-character tag issued by @MTProxyBot after you register the proxy. It provides access to statistics and lets you assign a promoted channel |
| Transport mode | The connection obfuscation method: Standard MTProto uses random packet padding, while FakeTLS disguises the connection as TLS traffic |
| Additional secrets | Additional secrets with their own proxy connection links, created by clicking Add additional secret. They can make access management easier: remove a secret at any time to prevent connections that use it |
| Worker mode | Controls the number of separate MTProxy processes that handle connections. Leave it set to Auto for a standard installation. Manual is useful only under high load on a multi-core server: there is no universal value, so increase the number gradually while monitoring the server load and proxy performance. In FakeTLS mode, the value is set to 0 and cannot be changed |
| Server is behind NAT / Docker bridge | Lets you specify the proxy's internal and external IP addresses manually. Leave this setting off when the proxy is installed on a VPS with a public IP address |
In AmneziaVPN 5.0.0.5, Worker mode and Server is behind NAT / Docker bridge appear in the Telemt settings, but changing them does not affect the service configuration on the server. This issue will be fixed in the next AmneziaVPN release.
Change these settings only when you need to change the port, enable FakeTLS, create an additional secret, or follow a specific configuration recommendation. If the proxy works, keep the settings applied during installation.
If port 443 is already in use by XRay or another TCP service, choose an available port, such as 8443 or 4515. These are examples only and do not guarantee that the proxy will be reachable from a particular network. FakeTLS may not work correctly if the proxy service uses a port other than 443.
AmneziaWG can use the same port number as the proxy because AmneziaWG uses UDP, while MTProxy, Telemt, and XRay use TCP.
After changing Base secret, Server port, Transport mode, or FakeTLS domain, use the new connection link. The previous link and any proxy connections configured with it will stop working.
FakeTLS Mode
- Under Transport mode, select FakeTLS.
- Leave FakeTLS domain empty or enter a different domain.
- Click Save.
If FakeTLS domain is empty, it is automatically set to googletagmanager.com. If you use a different domain, make sure it supports HTTPS and TLS 1.3. Enter only the domain name, without https://, a path, or query parameters—for example, deepseek.com.
Port 443 is preferred for FakeTLS. This mode may not work on other ports.
Diagnostics
The proxy diagnostics section is at the bottom of the service's Settings tab. Click the refresh icon next to Diagnostics to display the following information:
- Public port reachable — the proxy is listening on the selected TCP port;
- Telegram upstream reachable — the server can reach a Telegram service endpoint;
- Clients connected — the approximate number of IP addresses with active proxy connections;
- Last config refresh — when the configuration was last updated.
Successful server diagnostics do not guarantee that the proxy is reachable from your network or is not being blocked by your ISP.
Troubleshooting
If the proxy does not connect:
- Test the proxy separately over Wi-Fi and mobile data.
- Make sure the selected TCP port is not used by another service.
- Install the other proxy service on a different TCP port and compare the results.
For configuration advice, ask in our Telegram community.
If Telemt installation fails with error 202, connect to the server over SSH and run:
sudo nft delete table inet telemt_limit
