DOCSEARCHbyAlgolia
Submit Docs

MTProxy by GetPageSpeed

repository·master·Indexed 42 days ago

https://github.com/getpagespeed/mtproxy

A high-performance, C-based implementation of the MT-Proto proxy protocol. This maintained fork of the original TelegramMessenger/MTProxy features improved stability, DPI resistance via Dynamic Record Sizing (DRS) and TCP splitting, Prometheus metrics, and IP access control. It supports standard mode via Telegram middle-end relays, Direct-to-DC mode, and advanced obfuscation modes including DD (random padding) and EE (Fake-TLS + Padding).

Tokens
8.4K
Snippets
32
Records
42
Agent score
50%

What's inside MTProxy

  1. Understand MTProxy Transfer Modes (DD and EE)

    master

    MTProxy supports different transfer modes to improve resistance against DPI (Deep Packet Inspection):

    DD Mode (Random Padding)

    Adds random data to packets to protect against packet size analysis. Client Secret Format: Prefix the secret with dd.

    EE Mode (Fake-TLS)

    Traffic appears as a standard TLS 1.3 connection. This mode supports Dynamic Record Size (DRS) automatically, mimicking real HTTPS server behavior. Client Secret Format: ee + server_secret + hex_domain.

    # Example of generating an EE mode client secret
SECRET="cafe1234567890abcdef1234567890ab"
DOMAIN="www.google.com"
echo -n "ee${SECRET}" && echo -n $DOMAIN | xxd -plain

  2. Configure DD Mode (Random Padding)

    master

    DD Mode adds random padding to packets to prevent ISPs from detecting MTProxy via packet size analysis.

    Setup:

    • Server: Use the -R argument to restrict access to only clients with random padding enabled.
    • Client: Prefix the secret with dd (e.g., if the secret is cafe...babe, the client secret becomes ddcafe...babe).

  3. Use Direct-to-DC mode

    master

    Direct mode bypasses Telegram's middle-end (ME) relay servers and connects directly to Telegram data centers. This reduces latency and simplifies deployment because it does not require proxy-multi.conf or proxy-secret files.

    Note: Direct mode is incompatible with the -P (proxy tag) flag used for promoted channels.

    ./mtproto-proxy -u nobody -p 8888 -H 443 -S <secret> --http-stats --direct

  4. Configure multiple secrets and labels

    master

    You can provide multiple secrets using the -S flag. You can also attach optional labels to secrets using a colon (:). Labels are useful for identifying connections in logs and statistics instead of seeing raw secrets.

    Example of multiple secrets with labels: -S <secret1>:family -S <secret2>:friends

    ./mtproto-proxy -S <secret1>:family -S <secret2>:friends ...

  5. Understand MTProxy transport modes (DD and EE)

    master

    MTProxy supports different transport modes to improve resistance to DPI (Deep Packet Inspection):

    DD-mode (Random Padding)

    Adds random data to packets to protect against size-based analysis. Client Secret: Prefix your secret with dd.

    EE-mode (Fake-TLS)

    Traffic mimics a standard TLS 1.3 connection. You can also run a real TLS backend (like Nginx with a valid certificate) behind MTProxy. Invalid connections are redirected to Nginx, making the server indistinguishable from a normal website. This mode includes DRS (Dynamic Record Sizing), which automatically varies TLS record sizes to mimic real HTTPS servers.

    Client Secret Format: ee + server_secret + hex_domain.

    Example of generating an EE-mode secret for www.google.com:

    SECRET="cafe1234567890abcdef1234567890ab"
DOMAIN="www.google.com"
echo -n "ee${SECRET}" && echo -n $DOMAIN | xxd -plain

  6. How Secret Labels and Connection Limits work

    master

    Secret Labels

    Labels allow you to identify specific connection groups (e.g., family, friends). This is useful for monitoring traffic or revoking specific secrets. Labels are alphanumeric plus _ and - (max 32 chars).

    Usage in Docker:

    • Inline: SECRET=hex1:family,hex2:friends
    • Numbered: SECRET_1=hex1, SECRET_LABEL_1=family

    Label visibility:

    • Logs: TLS handshake matched secret [family] from 1.2.3.4:12345
    • Prometheus: mtproxy_secret_connections{secret="family"} 3
    • Stats: secret_family_connections 3

    Per-Secret Connection Limits

    You can prevent a single secret from exhausting all proxy resources by setting a maximum number of concurrent connections.

    Usage in Docker:

    • Inline: SECRET=hex1:family:1000,hex2:public:200
    • Numbered: SECRET_1=hex1, SECRET_LABEL_1=family, SECRET_LIMIT_1=1000

    Behavior when limit is reached:

    • Fake-TLS (EE mode): The connection is rejected during the TLS handshake, and the client is proxied to the configured EE_DOMAIN (making it look like a normal website).
    • Obfuscated2 (DD mode): The connection is silently dropped.

    Note: In multi-worker mode, each worker enforces limit / N independently. In single-worker mode, the limit is exact.

    # Example of inline Docker environment variable for secrets with labels and limits
SECRET=cafe...90ab:family:1000,dead...90ef:public:200

  7. Configure per-secret connection limits

    master

    You can restrict the number of connections allowed for a specific secret by appending a limit to the secret string using the format -S <secret>:label:limit.

    # Limit the 'family' secret to 1000 connections
./mtproto-proxy -S <secret>:family:1000 ...

  8. Understand transmission modes: DD and EE

    master

    MTProxy supports different transmission modes to evade DPI (Deep Packet Inspection):

    DD Mode (Random Padding)

    Adds random data to packets to prevent packet size analysis. To use this, add the dd prefix to the client secret.

    EE Mode (Fake-TLS)

    Traffic appears as a standard TLS 1.3 connection. The client secret format for EE mode is ee + server_secret + hex_domain.

    Example of generating an EE client secret:

    SECRET="cafe1234567890abcdef1234567890ab"
DOMAIN="www.google.com"
echo -n "ee${SECRET}" && echo -n $DOMAIN | xxd -plain

  9. Configure EE Mode (Fake-TLS + Padding)

    master

    EE Mode provides high-level obfuscation by mimicking TLS 1.3 connections. Traffic appears as standard TLS 1.3 traffic to Deep Packet Inspection (DPI) systems.

    Server Setup:

    1. Provide a domain that supports TLS 1.3 using the -D flag.
    2. Example: ./mtproto-proxy ... -D www.google.com ...

    Client Setup: The client secret must be constructed using the format: ee + server_secret + domain_hex (where domain_hex is the hex representation of the domain name).

    Example Construction:

    • Server Secret: cafe1234567890abcdef1234567890ab
    • Domain: www.google.com
    • Domain HEX: 7777772e676f6f676c652e636f6d
    • Final Client Secret: eecafe1234567890abcdef1234567890ab7777772e676f6f676c652e636f6d
    # Generate complete client secret automatically
SECRET="cafe1234567890abcdef1234567890ab"
DOMAIN="www.google.com"
echo -n "ee${SECRET}" && echo -n $DOMAIN | xxd -plain

  10. Install MTProxy using Docker

    master

    You can quickly start MTProxy using Docker. The container automatically downloads configuration from Telegram, generates a random secret if one isn't provided, and starts the proxy on port 443. Use docker logs mtproxy to find the connection link in the logs.

    docker run -d \
  --name mtproxy \
  -p 443:443 \
  -p 8888:8888 \
  --restart unless-stopped \
  ghcr.io/getpagespeed/mtproxy:latest

  11. Persist Telegram Configuration via Volume Mounting

    master

    The container automatically manages the Telegram DC configuration (proxy-multi.conf) via a daily cron job. To ensure this configuration persists across container restarts or to allow the proxy to start if core.telegram.org is temporarily unreachable, you should mount a volume to /opt/mtproxy/data/.

    Mounting a volume:

    -v /path/to/host/data:/opt/mtproxy/data

    Note: The proxy-secret file is baked into the image and does not require persistence.

  12. Quick Start with Docker

    master

    The simplest way to run MTProxy is using the official Docker image. This method requires no manual configuration: it automatically downloads the latest Telegram DC configuration, generates a random secret, and starts the proxy on port 443.

    To run the container:

    docker run -d \
  --name mtproxy \
  -p 443:443 \
  -p 8888:8888 \
  --restart unless-stopped \
  ghcr.io/getpagespeed/mtproxy:latest

    Finding your connection links: After starting, check the container logs to find the ready-to-share connection links:

    docker logs mtproxy

    Note: If the links show <YOUR_SERVER_IP>, you must set the EXTERNAL_IP environment variable to your public IP address.