MTProto Proxy Server

Stash can serve as an MTProto proxy for Telegram: the Telegram client connects to a port Stash listens on, Stash picks a currently usable address for the data center (DC) the client asks for, and the connection then goes through your rules like any other TCP connection to choose an outbound.

Compared with pointing Telegram at a SOCKS5 proxy, the MTProto path lets Stash decide which address each DC actually connects to. That avoids connections hanging on an address the client picked on its own, and makes Telegram far less likely to get stuck on “Updating” after a network change.

An MTProto proxy only relays Telegram’s transport layer. It never holds the account’s authorization keys and cannot decrypt message contents.

Configuration

Add an mtproto section to the configuration:

mtproto:
  port: 5753
  secret: 0123456789abcdef0123456789abcdef
  ipv6: false
  # dc-config-url: https://example.com/mtproto-dc-config.json

• port: Required. The TCP port to listen on.
• secret: Required. The 32-hex-digit proxy secret, optionally prefixed with dd for Telegram’s padded transport. The secret is the only credential a client needs, so do not publish it. Generate one with openssl rand -hex 16.
• ipv6: Optional, false by default. When true, Stash connects only to the data centers’ IPv6 addresses; otherwise only to their IPv4 addresses. It does not affect the listening address.
• dc-config-url: Optional. Overrides where the data center address table is refreshed from; it must be an HTTP or HTTPS URL. Stash’s bundled table is used when omitted.

Stash listens on both the loopback address and the LAN address; whether LAN devices may connect follows the “Allow LAN” switch.

The mtproto section in the configuration takes precedence over the MTProto switch in the app settings. On reload, keeping the port only updates the parameters, changing it rebinds the listener, and removing the section closes it.

Using It in Telegram

In Telegram’s proxy settings choose MTProto and enter the address of the device running Stash, the port, and the secret. A secret with the dd prefix is entered in Telegram with the prefix included.

You can also build a proxy link to import in one tap:

tg://proxy?server=192.168.1.10&port=5753&secret=0123456789abcdef0123456789abcdef

Routing

A connection accepted over MTProto enters rule matching with the data center’s IP address as its destination. The PROTOCOL,MTPROTO rule matches every Telegram connection:

rules:
  - PROTOCOL,MTPROTO,Proxy
  - MATCH,DIRECT

Because the destination is an IP address rather than a domain, IP-based rules (IP-CIDR, IP-ASN, GEOIP) apply as well.

Data Center Addresses

Each data center has several usable addresses. Stash ships a table generated from Telegram’s official configuration, so the first connection does not depend on a network update; when an address fails to connect, the next connection to the same data center moves on to the next address, and all addresses are tried again after a network change.

dc-config-url points Stash at a table you maintain yourself, in the same format as the bundled one. Updates run in the background, and the current table stays in use if a download fails.