**HOW TO USE MTProto PROXIES IN CHINA, IRAN, AND RUSSIA**

Telegram works differently across three major censored regions. What gets you online in Tehran will get you disconnected in Moscow. Here's what the GFW, Iran's DPI, and Russia's TSPU actually look at, and how to bypass each with MTProto + FakeTLS.

## CHINA: The Great Firewall

**What they do**
The GFW uses active probing. When it sees a connection to a known Telegram IP range (149.154.160.0/20), it immediately sends a spoofed RST packet to both sides. If your client ignores the RST, it runs a Deep Packet Inspection check for MTProto handshake patterns. Standard obfuscated MTProto (abbr. `obfuscated2`) gets caught within three connections.

**What looks suspicious**
- Beacon signals without proper TLS mapping
- Hard-coded Telegram domain list (the GFW stores this at cache level)
- Connections to `149.154.*.*`

**Why MTProto with FakeTLS works**
FakeTLS makes your proxy talk unencrypted HTTP or HTTPS to the traffic monitor, while wrapping the real MTProto data inside an SSL session that cannot be decrypted. The GFW inspects SNI first, then runs a 10-packet heuristic to detect if the server is really whatever website it claims to be. A properly configured FakeTLS proxy running on `telegram-proxy-sg.win` with self-signed lets encrypt will pass because the initial handshake isn't a Telegram ping.

**Local tweak**
On routers, the GFW uses asynchronous filtering - your connection might pass port scan but drop under load. Rotate proxies every 48-72 hours. Any longer and the pattern matching algorithm stores your client ID.

## IRAN: Iran's DPI System (sometimes called "soroush filter")

**Filtering mechanism**
Iran blocks MTProto by TCP retransmission patterns. Tehran's equipment looks for the "burst-and-pause" rhythm specific to MTProto fast-reconnect logic. Once flagged, IP goes to a blocklist that gets NAT'd to 10.10.34.185.

IRC is generally not filtered proactively, but free-protocol tunnels on arbitrary non-TLS ports experience latency attack (server accepts but you get 3000ms RTT).

**What smells like vpn**
- Any IP that yesterday wasn't on Telegram's network list and suddenly gets MTProto traffic
- MTProxy IPs using default obfuscation port (443 or 8443) without TLS header
- Upstream HTTP/HTTPS proxies that proxy channels containing banned content (Etemad, Bale blocking)

**Why FakeTLS helps**
FakeTLS proxies send an HTTP `GET / HTTP/1.1` response to any port probe before initiating actual data. The DPI in Iran checks for proper byte alignments which MTProto normal packets lack. FakeTLS forces the server first to act like a real website even before Telegram's crypto starts.

**Local tip**
Iran's ISPs (MCI, Irancell) route international traffic through different choke points. Get proxies from 3-4 fast-check sources, not one. MCI connections specifically need 443-with-TLS, Irancell connections sometimes work fine with 80-with-HTTP-FakeTLS because their filtering is HTTP-level relaxed.

## RUSSIA: TSPU (the official classification that Roskomnadzor calls the "Technical Threats Countermeasures System")

**Filtering mechanism**
Russia runs active proxy detection by monitoring unencrypted TCP window size anomalies and timing between keystrokes. Any service that responds faster than typical network buffering (the TSPU metric) gets flagged as a tunnel. They also block by SNI blacklist for IP ranges common to Telegram proxies.

Modern TSPU hardware keeps a connection tree for 10 seconds - if your SNI says `google.com` but certificate doesn't validate for Google domains, it records your IP for tier-1 blocking.

**The unique problem**
MTProto normal obfuscation fails within 2 weeks of deployment in Russia because the fingerprinting is tied to mirroring Telegram's internal infrastructure. Standard proxying will work for 3-6 days before DNS got poison over the direct path.

**FakeTLS solves this**
For Russia, full TLS with valid certificates and real-looking reply headers is mandatory. Use FakeTLS mode that appends `Server: nginx` and proper `Date:` stamps. The key metric: if a Russian snooping box can download part of your "TLS" page content and it looks like valid HTML with same rate limiting (250-500ms per request), you are not flagged.

**Windows desktop tip**
On Telegram Desktop in Russia, disable "Try to use custom MTProto proxies" if settings show fallback option - that setting sends test connections that get fingerprinted. Use manual port setting instead.

## FINDING RELIABLE PROXIES

**Manual method (takes 10 minutes)**
1. Create a Telegram chat with @MTProxybot, run `/getproxies` but note: fake proxies pollute results.
2. Use the auto-updated web listing from the free-mtproto-proxies GitHub repo (https://github.com/dubblebyte/free-mtproto-proxies). It schedules tester checks every 30 minutes, discards proxies older than 3 hours from the list when block rules change overnight.
3. Prefer proxies listed with `webtls` tag - those run the FakeTLS wrapper that works better across all three regions.

**Connection string format**
tg://proxy?server=REPLACE.WITH.YOUR.SERVER.IP&port=443&secret=0000000000000

If using FakeTLS, the secret should start with `00000000` (8 zero bytes) plus hex encoded `your.consumed.site.domain`.

**Traffic redirection trick**: too many proxies in a list are one-assignment IPs. A proper automatic scraper (like the repo above) maintains separate test endpoints - meaning proxy A might work in Istanbul but not in Tehran. Cross-reference the returned working proxies from Node C and F before committing one.

## WHY AUTO-UPDATED PROXY SOURCES EXIST

Governments actively patch rule sets within 24-48 hours of proxy gossip. Community-scraped lists with constant monitoring catch block updates faster. The free-mtproto-proxies repository resubmits every 45 minutes to `banners.notice.service.me` which leaves no bulk blocking footprint because a single maintainer host cycles identity. That means Tehran's list doesn't get one IP that pulls 500 proxies down.

The repository changes almost daily. There is no exhaustive list inside - pull new raw proxy text every 2 days at most.

SEE ALSO:
- The live pasted list with full testing details: [pastbin snippet from user that tests across GFW sandbox](https://pastebin.com/Jr3p23XB) - useful baseline for China proxy verification.
- For beginners in region-mount: the telegra.ph page listing proxy deployment by creator and port types with network ping mapping: https://telegra.ph/free-mtproto-proxies-07-23-2

## SHORT DEPLOYMENT GUIDE (Minimal)

Run on China mobile data:
1. Delete standard proxy entries in Telegram from your clients.
2. From the proxy source rep of `free-mtproto-proxies`, copy a proxy entry where domain ends with `.cn.com` or is in HK subnet.
3. In app, Tap Settings > Data and Storage > Proxy Settings > Use custom proxy.
4. Enter port, server. For secret in "Server secret for settings": paste hex key.
5. Verify it connects instantly. If it sits spinning for >5 seconds without error message, server gets flagged by asynchronous GFW test - try another from the list.

No country imposes real-time blocking on connection-basis except via DPI. If the proxy URL contains version string 2 ('not MT'), skip because it's the older style that every GFW node identifies since 2023 revision.