From HAProxy to VLESS+Reality: Overcoming DPI Blocks for MTProto Telegram Proxies
A technical case study details the difficulties of operating a reliable MTProto proxy for Telegram inside Russia when facing modern ISP deep-packet inspection. The author began with the popular mtg implementation and quickly discovered that simple forwarding solutions were insufficient against active protocol fingerprinting.
The first architecture placed HAProxy in TCP passthrough mode on a Russian server, forwarding traffic to a foreign mtg instance. Because HAProxy and raw iptables DNAT preserve every byte of the original stream, the ISP’s DPI continued to recognize the characteristic MTProto and fake-TLS patterns and throttled the connection. Changing ports or replacing HAProxy with SOCKS5 produced identical results, proving that any unauthenticated TCP tunnel remains detectable.
Only the introduction of VLESS+Reality delivered consistent connectivity. Reality performs a genuine TLS 1.3 handshake with a live destination domain, making the traffic indistinguishable from ordinary HTTPS for passive observers. The final topology routes client connections through local mtg, then through a localhost SOCKS5 listener into an Xray client that establishes a multiplexed VLESS+Reality tunnel to a foreign Xray server.
Several configuration errors were encountered and resolved. Enabling the xtls-rprx-vision flow caused immediate connection resets because the flow parser expects structured TLS records that MTProto payloads do not contain. Removing the flow parameter restored functionality. Even after that fix, short-lived Telegram connections frequently timed out during the full TLS handshake; enabling mux with concurrency 32 on the outbound eliminated repeated handshakes and stabilized the link.
Testing across multiple Russian providers revealed that some hosters apply aggressive DPI at their network edge while others do not. The same configuration that failed on the original provider worked immediately on a second provider, confirming that the root cause was the first provider’s traffic policy rather than the proxy architecture itself.
The article supplies complete configuration files, docker-compose stacks, Reality key-generation commands, and a practical checklist covering flow settings, IPv4 preference, destination domain selection, and connectivity validation with the built-in mtg doctor command.
Related articles
TLS MITM and Throttling to 10 Mbps: Two Distinct Network Degradation Patterns Observed in Russia
Russian users have reported sudden slowdowns and instability on international connections over the past several days. Analysis of Tunnel Cat logs revealed two separate issues that produce similar user symptoms but require different diagnostic approaches. The first pattern involves successful TCP and TLS handshakes followed by sharp drops in throughput, often from 80 Mbps to 8-12 Mbps, consistent with DPI-based throttling of international traffic. The second pattern shows TLS certificate substitution on Windows systems, indicating active man-in-the-middle interception. Tunnel Cat now detects invalid certificates and terminates such sessions, yet the underlying network phenomena persist. The observations highlight the need to examine both bandwidth dynamics and certificate chains when troubleshooting connectivity problems from Russia.
Deleted Database Records Remain Recoverable in SQLite Files Despite DELETE Operations
A standard DELETE query in SQLite removes rows from the table view but leaves the actual data intact inside the database file until pages are reused. The pragma secure_delete setting controls whether freed pages are zeroed immediately or simply marked as available. With the default setting of 0, strings containing names and credit card numbers can still be extracted using grep even after deletion. The same behavior appears in PostgreSQL through dead row versions until VACUUM runs and in MySQL InnoDB through undo logs and the binary log. The issue directly affects compliance with personal data deletion requests because backups, replicas, and analytics exports often retain the original records. Proper mitigation requires enabling secure_delete, running VACUUM after bulk deletions, or encrypting sensitive fields with per-record keys that can be destroyed on request.
Russian TSPU Systems Redirect DNS Queries to Google and Cloudflare Servers Toward National Domain Name System
Since the evening of August 26, Russian technical means of countering threats (TSPU) began intercepting open DNS queries sent to Google and Cloudflare public resolvers. For domains such as YouTube and RuTracker, UDP-based queries received NXDOMAIN responses while TCP queries successfully reached the original servers and returned valid IP addresses. Analysis with low TTL packets revealed that responses originated from IP address 195.208.5.1 belonging to the National System of Domain Names (NSDI). The mechanism performs targeted DNAT on recognized DNS traffic, making the query appear directed to NSDI rather than the foreign resolver. The redirection is imperfect, allowing subsequent identical queries sent in quick succession to bypass the system and reach Google. The findings come from experiments conducted by Habr user angry_agent and have not yet received official confirmation from Russian authorities.
HTTPS Lock Icon Present but List of Visited Sites Remains Visible
Even when HTTPS is active and passwords stay protected, DNS queries and the SNI field in TLS handshakes expose the exact domains a user visits over public Wi-Fi. Classic unencrypted DNS over UDP sends domain names in plaintext, allowing anyone on the same network to observe them with simple packet captures. The SNI extension reveals the target hostname before encryption is negotiated, enabling domain-based filtering without decrypting traffic. DNS over HTTPS moves queries inside encrypted channels but shifts visibility to the chosen resolver instead of the local network. Encrypted Client Hello offers partial protection for SNI yet requires support from both browsers and server infrastructure. The practical takeaway is that metadata about services used, timing, and frequency leaks more readily than credentials in modern public networks.