Deploy and Host Self-Hosted Telegram MTProto Proxy on Railway

Run your own private Telegram MTProto proxy in minutes using Railway. This template uses the official telegrammessenger/proxy container with persistent storage and Railway TCP Proxy support.

About

This template deploys a lightweight Telegram MTProto Proxy using Telegram's native protocol. It is designed for simple self-hosted deployment without managing a VPS, firewall rules, or server infrastructure.

The proxy runs as a pure TCP service (not HTTP), so it requires Railway TCP Proxy to expose it correctly to Telegram clients.

Features

One-click deployment with sensible defaults
Persistent configuration using Railway Volume
Pre-configured with WORKERS=4 for better performance
Support for Advertisement Tag (TAG) via @MTProxybot
Easy proxy link generation
No web dashboard or unnecessary services

Environment Variables

Variable	Description	Default	Required
`SECRET`	MTProto proxy secret (32 hexadecimal characters). Keep this value private.	Auto-generated (32 hex)	Yes
`WORKERS`	Number of worker processes. Higher value = better performance with many concurrent users.	`4`	No
`TAG`	Advertisement tag from @MTProxybot (used to promote a Telegram channel to users connecting through your proxy).	(empty)	No

Note about TAG: This value is not persistent. You must set it as an environment variable every time you redeploy the service.

How to Get a TAG (Advertisement Tag)

Deploy the proxy first and copy your SECRET.
Open Telegram and search for @MTProxybot.
Send the command /newproxy.
Input your Railway TCP Proxy hostname, port, and your SECRET.
The bot will reply with a TAG (example: 3f40462915a3e6026a4d790127b95ded).
Copy the TAG and paste it into the TAG environment variable in your Railway service.

Networking Setup

Telegram MTProto Proxy uses raw TCP, not HTTP/HTTPS.

After deployment:

Enable Railway TCP Proxy on your service.
Set Internal Port to 443.
Railway will generate a TCP endpoint like:
```
your-service.proxy.rlwy.net:12345
```

Use this hostname and port when creating the proxy link in Telegram.

Creating the Telegram Proxy Link

After deployment, create your proxy link using this format:

https://t.me/proxy?server=YOUR_TCP_PROXY_HOST&port=YOUR_TCP_PROXY_PORT&secret=YOUR_SECRET

Example:

https://t.me/proxy?server=my-proxy.proxy.rlwy.net&port=12345&secret=0123456789abcdef0123456789abcdef

You can also use the tg:// format:

tg://proxy?server=my-proxy.proxy.rlwy.net&port=12345&secret=0123456789abcdef0123456789abcdef

Improving DPI Resistance (Optional)

The official proxy supports Fake-TLS mode, which disguises MTProto traffic as normal HTTPS traffic. This can help bypass DPI in restrictive networks.

To enable Fake-TLS, your SECRET must start with ee. You can generate one manually using:

echo "ee$(openssl rand -hex 15)"

Then replace the SECRET environment variable with the generated value.

Note: Fake-TLS support in the official image is basic. For stronger anti-DPI features, modern implementations are recommended for production use in heavily censored networks.

Comparison

Aspect	This Template on Railway	Manual VPS Setup	Free Public Proxies
Setup time	✅ ~1-2 minutes	❌ 15-40 minutes	✅ Instant
No server management	✅ Yes	❌ Required	✅ Yes
Persistent storage	✅ Railway Volume	✅ Manual	❌ No
Private & controlled	✅ Fully under your control	✅ Yes	❌ Shared / risky
Performance tuning	✅ `WORKERS` variable	✅ Full control	❌ Limited
Ad tag / channel promotion	✅ Supported via `TAG`	✅ Supported	❌ Not available
TCP exposure	✅ Railway TCP Proxy	✅ Manual configuration	✅ Usually available
Cost	Pay only for actual usage	Fixed monthly cost	Free (but unreliable)

Important Notes

This template does not expose a web interface or dashboard.
Do not use the normal Railway HTTP domain. MTProto requires raw TCP via Railway TCP Proxy.
The SECRET is stored in the persistent volume (/data). Without attaching a volume, the secret will be lost on redeploy.
The TAG must be re-entered as an environment variable after every redeploy.

Troubleshooting

Proxy shows "Connecting..." or doesn't work

Confirm Railway TCP Proxy is enabled.
Internal Port must be 443.
Double-check the server, port, and secret in the Telegram proxy settings.

Secret changes after redeploy

You did not attach a persistent volume to /data.

Want to promote a channel through the proxy

Follow the guide above to get a TAG from @MTProxybot and set it in the environment variables.

High traffic / many users

Increase the WORKERS value (e.g. 8 or 16) according to your Railway plan resources.

Why Deploy on Railway?

Railway provides a simple platform to deploy infrastructure without managing servers, firewalls, or low-level networking. This template leverages Railway's TCP Proxy and persistent volumes so you can run a reliable private MTProto proxy with minimal effort.