Deploy and Host Telegram MTProto Proxy on Railway

Run a self-hosted Telegram MTProto Proxy on Railway with the telegrammessenger/proxy container. The template supports automatic secret generation, configurable workers, optional advertisement tags, and Railway TCP Proxy networking.

About Hosting Telegram MTProto Proxy

MTProto Proxy is a lightweight proxy that uses Telegram's native MTProto protocol. It communicates over raw TCP, not HTTP/HTTPS, so Telegram clients must connect through a Railway TCP Proxy.

This template includes:

One MTProto Proxy service
Automatic secret generation
Configurable worker processes
Optional advertisement tag
Railway TCP Proxy support
No database, Redis, dashboard, or additional services

Common Use Cases

Run a private Telegram proxy
Share a proxy with friends, teams, or communities
Register a proxy with @MTProxybot
Promote a Telegram channel with an optional TAG
Deploy disposable or regional proxy instances

Dependencies for Telegram MTProto Proxy

Dependency	Required	Purpose
`telegrammessenger/proxy`	✅	Runs the proxy
Railway TCP Proxy	✅	Exposes raw TCP traffic
Railway Variables	✅	Stores proxy configuration
Railway Volume	❌	Optional `/data` persistence
PostgreSQL / Redis	❌	Not required
HTTP Domain	❌	Not used by MTProto

Important: Do not use a normal Railway HTTP domain such as *.up.railway.app. Telegram requires the Railway TCP Proxy hostname and external port.

Features

Single-service deployment
Automatic 32-character hexadecimal secret
Raw TCP networking
Configurable WORKERS
Optional TAG support
No database or cache
No web interface

Environment Variables

Variable	Description	Default	Required
`SECRET`	Secret used by Telegram clients	Auto-generated 32-character hex	✅
`WORKERS`	Number of proxy workers	`2`	✅
`TAG`	Optional tag from `@MTProxybot`	Empty	❌

Recommended Railway variables:

TAG="" # Optional advertisement tag
SECRET="${{secret(32, '0123456789abcdef')}}" # 32-character hexadecimal secret
WORKERS="2" # Balanced default for Railway

WORKERS

WORKERS=2 is a balanced default. More workers consume additional CPU and memory, so increase the value only when traffic requires it.

Workload	WORKERS
Personal proxy	`1–2`
Normal shared proxy	`2`
Higher traffic	`4`

Networking Setup

MTProto Proxy uses raw TCP.

Open the service in Railway.
Go to Settings → Networking.
Enable TCP Proxy.
Set the internal application port to:

Railway will generate an endpoint similar to:

your-service.proxy.rlwy.net:12345

The endpoint consists of:

RAILWAY_TCP_PROXY_DOMAIN
RAILWAY_TCP_PROXY_PORT

Telegram must use the generated external port, not necessarily 443.

Connect to Your Proxy

You need:

TCP Proxy hostname
TCP Proxy port
SECRET

Create a Telegram link:

https://t.me/proxy?server=YOUR_TCP_PROXY_HOST&port=YOUR_TCP_PROXY_PORT&secret=YOUR_SECRET

Example:

https://t.me/proxy?server=my-proxy.proxy.rlwy.net&port=12345&secret=0123456789abcdef0123456789abcdef

You can also use:

tg://proxy?server=YOUR_TCP_PROXY_HOST&port=YOUR_TCP_PROXY_PORT&secret=YOUR_SECRET

Open the link in Telegram to add the proxy.

Advertisement TAG

A TAG can associate the proxy with a Telegram channel.

Deploy the proxy and enable TCP Proxy.
Copy the TCP hostname, port, and SECRET.
Open @MTProxybot in Telegram.
Send:

/newproxy

Follow the bot instructions.
Add the returned tag to Railway Variables:

TAG="YOUR_TAG"

Redeploy the service.

The tag is preserved across redeployments as long as it remains configured as a Railway variable.

Random Padding

Some Telegram clients support random padding. Prefix the client secret with dd:

dd0123456789abcdef0123456789abcdef

This changes the client connection secret, not the server's underlying SECRET.

Random padding is not the same as TLS tunneling or a VPN.

Persistent Storage

A Railway Volume is optional. If used, mount it at:

/data

Because SECRET is stored as a Railway variable, a volume is not required to preserve the secret across normal redeployments.

Architecture

Telegram Client
      │ MTProto / TCP
      ▼
Railway TCP Proxy
      │ TCP :443
      ▼
Telegram MTProto Proxy
      │
      ▼
Telegram Network

No HTTP server, database, Redis instance, or frontend is required.

Important Notes

MTProto Proxy is a TCP service, not a web application.
A blank browser response is expected.
Enable Railway TCP Proxy on internal port 443.
Use the generated TCP hostname and external port.
Keep SECRET private for private deployments.
TAG is optional.
Start with WORKERS=2.
A volume is optional when SECRET is configured in Railway Variables.

Troubleshooting

Telegram Stays on “Connecting”

Check that:

TCP Proxy is enabled.
The internal port is 443.
The TCP Proxy hostname is correct.
The external TCP port is used.
The client secret matches SECRET.
The deployment is running.

Railway Domain Shows Nothing

This is normal. MTProto Proxy has no HTTP interface. Use the Railway TCP Proxy endpoint.

Proxy Link Fails

Verify:

server=RAILWAY_TCP_PROXY_DOMAIN
port=RAILWAY_TCP_PROXY_PORT
secret=SECRET

Do not assume the external port is 443.

TAG Is Not Applied

Check that:

The proxy was registered with @MTProxybot.
The tag was copied correctly.
TAG exists in Railway Variables.
The service was redeployed.

High CPU Usage

Check CPU and memory usage.
Review actual proxy traffic.
Scale Railway resources if needed.
Increase WORKERS gradually.

Why Deploy on Railway?

Railway simplifies deployment of small TCP services by providing managed infrastructure, logs, metrics, environment variables, optional volumes, and TCP Proxy networking without requiring VPS administration.

This template provides a compact self-hosted Telegram MTProto Proxy with minimal operational overhead.