https://pastein.ru/t/SST
Загрузка данных
BusyBox v1.36.1 (2026-05-27 15:55:08 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 24.10.7, r29197-ab4c7d6af7
-----------------------------------------------------
root@OpenWrt:~# ls -la /tmp/tg-ws-proxy
-rwxr-xr-x 1 1001 1001 1445760 Aug 9 13:35 /tmp/tg-ws-proxy
root@OpenWrt:~# /tmp/tg-ws-proxy --help
Local MTProto proxy that tunnels Telegram Desktop traffic through WebSocket connections to Telegram DCs.
Useful on networks where raw TCP to Telegram is blocked.
Usage: tg-ws-proxy [OPTIONS]
Options:
--port <PORT>
Port to listen on
[env: TG_PORT=]
[default: 1443]
--host <HOST>
Host / IP address to bind. When omitted, the proxy binds `0.0.0.0` if a LAN IP can be auto-detected (so the address advertised in the proxy link is actually reachable), otherwise it falls back to `127.0.0.1`
[env: TG_HOST=]
--secret <SECRETS>
MTProto proxy secret(s) (32 hex chars each). Can be specified multiple times or as a comma-separated list. A random secret is generated if not provided
[env: TG_SECRET=]
--listen-faketls-domain <LISTEN_FAKETLS_DOMAIN>
Accept inbound Telegram clients using `ee` FakeTLS camouflage with this SNI hostname. The generated proxy link will use `secret=ee<key><hosthex>`
[env: TG_LISTEN_FAKETLS_DOMAIN=]
--dc-ip <DC:IP>
Target IP for a DC, e.g. `--dc-ip 2:149.154.167.220`. Can be specified multiple times. Default: DC 2 and DC 4 → 149.154.167.220
--buf-kb <BUF_KB>
Socket send/recv buffer size in KiB.
Currently has no effect — accepted for backwards compatibility with existing command lines and `TG_BUF_KB` deployments. The relay buffers are a fixed size chosen to keep the per-connection footprint small on low-memory devices.
[env: TG_BUF_KB=]
[default: 256]
--pool-size <POOL_SIZE>
Number of pre-warmed WebSocket connections per DC
[env: TG_POOL_SIZE=]
[default: 4]
--max-connections <MAX_CONNECTIONS>
Maximum number of concurrent client connections. When omitted, a safe value is computed automatically from the process's soft file-descriptor limit (ulimit -n): max_connections = (fd_limit - reserved_fds) / 2 where reserved_fds covers the pool, the listener socket, and runtime overhead. Set this explicitly only if you need to override the auto-computed limit
[env: TG_MAX_CONNECTIONS=]
-v, --verbose
Enable verbose (DEBUG) logging
[env: TG_VERBOSE=]
--danger-accept-invalid-certs
Skip TLS certificate verification when connecting to Telegram. Matches the Python reference implementation behaviour. **Do not use on untrusted networks unless you understand the risks.**
[env: TG_SKIP_TLS_VERIFY=]
-q, --quiet
Suppress all log output (useful on routers / embedded devices). Overrides `--verbose` when both are set
[env: TG_QUIET=]
--log-file <PATH>
Write log output to this file instead of stderr. Log lines written to a file never contain ANSI color codes
[env: TG_LOG_FILE=]
--mtproto-proxy <HOST:PORT:SECRET>
Upstream MTProto proxy to try when the WebSocket path fails. Format: `HOST:PORT:SECRET` (32 hex chars). Can be specified multiple times. Multiple proxies are tried in order until one succeeds. Via env: comma-separated list, e.g. `host1:443:sec1,host2:8888:sec2`
[env: TG_MTPROTO_PROXY=]
--link-ip <LINK_IP>
IP address to advertise in the generated `tg://proxy` link. Useful when the proxy listens on `0.0.0.0` or `127.0.0.1` but clients need to connect via a specific LAN or public IP. When omitted, the proxy attempts to auto-detect a non-loopback local IP; if that fails it falls back to `--host`
[env: TG_LINK_IP=]
--cf-domain <DOMAIN>
Cloudflare-proxied domain(s) for alternative WebSocket routing.
When set, the proxy will attempt to connect to Telegram DCs through Cloudflare's CDN using `kws{N}.{cf-domain}` subdomains. This can bypass ISP-level blocks on Telegram's IP ranges (common in Russia).
Setup: add `kws1`–`kws5` A records in your Cloudflare DNS pointing to the respective Telegram DC IPs, enable the orange-cloud proxy, and set SSL/TLS mode to **Flexible**. See docs/CfProxy.md for full instructions.
Multiple domains can be specified as a comma-separated list. They are tried in the order given (first domain has highest priority).
The CF proxy is tried as a fallback after direct WebSocket connections fail. For DCs without `--dc-ip`, the Python fallback order is used: Worker, regular CF proxy, upstream proxies, then direct TCP.
[env: TG_CF_DOMAIN=]
--cf-worker-domain <DOMAIN>
Cloudflare Worker domain for the TCP-tunnel fallback.
The Worker accepts WebSocket connections at `/apiws` and opens a raw TCP connection to the Telegram DC IP passed in the query string. Unlike `--cf-domain`, this does not require owning a Cloudflare DNS zone.
[env: TG_CF_WORKER_DOMAIN=]
--cf-priority
Prioritise the Cloudflare tiers over direct WebSocket connections for all DCs (even those with `--dc-ip` configured).
When set, the proxy tries the Cloudflare Worker tunnel and then the Cloudflare proxy first; if both fail, it falls back to the normal WS path, then upstream MTProto proxies, then direct TCP.
[env: TG_CF_PRIORITY=]
--cf-balance
Evenly distribute connections across multiple Cloudflare proxy domains.
When set and multiple `--cf-domain` values are given, each new connection starts from a different CF domain in round-robin order instead of always trying the first domain first. The remaining domains are still tried in order as fallbacks if the primary one fails.
Has no effect when only one CF domain is configured.
[env: TG_CF_BALANCE=]
--ws-connect-timeout <WS_CONNECT_TIMEOUT>
WebSocket connection timeout in seconds (normal path)
[env: TG_WS_CONNECT_TIMEOUT=]
[default: 10]
--ws-fail-probe-timeout <WS_FAIL_PROBE_TIMEOUT>
WebSocket connection timeout in seconds when the DC is in failure cooldown (fast-probe path, allows quick recovery after a network change)
[env: TG_WS_FAIL_PROBE_TIMEOUT=]
[default: 2]
--ws-fail-cooldown <WS_FAIL_COOLDOWN>
Seconds to back off from a DC's WebSocket after a connection failure
[env: TG_WS_FAIL_COOLDOWN=]
[default: 30]
--ws-redirect-cooldown <WS_REDIRECT_COOLDOWN>
Seconds to back off from a DC's WebSocket after all domains returned a redirect (WS blacklisted by Telegram)
[env: TG_WS_REDIRECT_COOLDOWN=]
[default: 300]
--ip-fail-cooldown <IP_FAIL_COOLDOWN>
Seconds to skip the direct WebSocket path for a `--dc-ip` address whose TCP connect timed out.
A timeout (rather than a refusal or a redirect) is what a DPI-blocked address looks like, and that does not lift within a connection's lifetime — so the address is stepped over for a long window and every client goes straight to the Cloudflare/upstream-proxy tiers instead of paying `--ws-connect-timeout` first.
Stepped over, not written off: a connection that finds every fallback tier dead re-probes the address anyway, and the first direct connect that succeeds clears the cooldown — so a window opened by a passing glitch cannot strand anyone. The skipping needs a fallback tier to be configured; the record itself is always kept, since the pool reads it to stop pre-connecting into the same hole. Matches upstream tg-ws-proxy's `IP_FAIL_COOLDOWN`.
[env: TG_IP_FAIL_COOLDOWN=]
[default: 3600]
--handshake-timeout <HANDSHAKE_TIMEOUT>
Client MTProto handshake read timeout in seconds
[env: TG_HANDSHAKE_TIMEOUT=]
[default: 10]
--tcp-fallback-timeout <TCP_FALLBACK_TIMEOUT>
TCP fallback connect timeout in seconds
[env: TG_TCP_FALLBACK_TIMEOUT=]
[default: 10]
--upstream-connect-timeout <UPSTREAM_CONNECT_TIMEOUT>
Connect timeout in seconds for upstream MTProto proxies
[env: TG_UPSTREAM_CONNECT_TIMEOUT=]
[default: 5]
--upstream-fail-cooldown <UPSTREAM_FAIL_COOLDOWN>
Seconds to back off from an upstream MTProto proxy after a failure
[env: TG_UPSTREAM_FAIL_COOLDOWN=]
[default: 60]
--cf-connect-timeout <CF_CONNECT_TIMEOUT>
Connect timeout in seconds for the Cloudflare proxy path
[env: TG_CF_CONNECT_TIMEOUT=]
[default: 10]
--cf-fail-cooldown <CF_FAIL_COOLDOWN>
Seconds to back off from the Cloudflare proxy path after a failure
[env: TG_CF_FAIL_COOLDOWN=]
[default: 60]
--fronting-domain <FRONTING_DOMAIN>
Domain to present as the TLS SNI for the domain-fronting fallback, used when direct WebSocket connects to a DC keep timing out (a sign of SNI-based DPI blocking). The real DC IP and `Host` are still used — only the SNI is swapped for this unrelated, presumably-unblocked domain, e.g. `sprinthost.ru` (the value upstream tg-ws-proxy uses).
**Only takes effect when `--dc-ip` is configured for that DC** — by design, matching upstream tg-ws-proxy exactly: fronting only ever applies to a direct connection to Telegram's real DC IP, never to the CF proxy/Worker/upstream-proxy paths. If you rely solely on `--cf-domain`/`--default-domains` (no `--dc-ip`), this flag has no effect — upstream's own troubleshooting guidance for a network where Telegram's IPs are blocked outright (where fronting can't help, since it still needs a real TCP connection to that IP) is to leave `--dc-ip` unset entirely so this path is never attempted.
Disabled unless set. TLS certificate verification is unconditionally skipped on connections using this fallback: the real Telegram certificate can never match a fronted SNI, so hostname verification would always fail — this is inherent to the technique, not a bug.
Once a fronted connection succeeds, the fallback stays active for `--fronting-cooldown` seconds so new connections (including background pool refills) keep using it.
[env: TG_FRONTING_DOMAIN=]
--fronting-cooldown <FRONTING_COOLDOWN>
Seconds to keep the domain-fronting fallback active after it last succeeded, before returning to normal direct WebSocket attempts
[env: TG_FRONTING_COOLDOWN=]
[default: 1800]
--fronting-fail-cooldown <FRONTING_FAIL_COOLDOWN>
Seconds to stop retrying the domain-fronting fallback after it fails.
Fronting only helps against SNI-based DPI blocking — it does nothing for a network that blocks Telegram's DC IPs outright (the fronted attempt still has to open a real TCP connection to that IP). Without this cooldown, every connection to that DC would retry fronting from scratch and pay a full `--ws-connect-timeout` for a doomed attempt on top of the already doomed direct/CF/upstream/TCP attempts.
[env: TG_FRONTING_FAIL_COOLDOWN=]
[default: 60]
--pool-max-age <POOL_MAX_AGE>
Maximum age of a pooled WebSocket connection in seconds. Connections older than this are discarded and re-established
[env: TG_POOL_MAX_AGE=]
[default: 55]
--check
Test configured Cloudflare proxy domains and upstream MTProto proxies for suitability, then exit.
For each CF domain, a WebSocket connection is attempted through `kws2.{domain}` (DC 2, non-media); the result is printed as OK/FAIL with the round-trip latency.
For each MTProto proxy, a TCP connection is made and the MTProto obfuscation handshake is sent. FakeTLS (0xee) proxies are also asked to complete their TLS handshake so the check verifies end-to-end protocol negotiation.
Exits with status code 0 when all configured items pass, 1 otherwise.
[env: TG_CHECK=]
--default-domains
Use the default Cloudflare-proxy domain list from the upstream repository.
When set, the proxy fetches an obfuscated list of working CF proxy domains from GitHub at startup, deobfuscates them, and uses them as `--cf-domain` entries. This lets users get started without having to configure their own Cloudflare DNS zone.
The fetched domains are appended after any domains supplied with `--cf-domain`. If the fetch fails the proxy falls back to a small built-in list.
Source: https://github.com/Flowseal/tg-ws-proxy/blob/main/.github/cfproxy-domains.txt
[env: TG_DEFAULT_DOMAINS=]
--outbound-proxy <URL>
Outbound proxy used for all outgoing connections.
Supports `http://user:pass@host:port` CONNECT proxies and `socks5://` / `socks5h://` proxies. Standard proxy environment variables are also honored when this option is omitted: `HTTPS_PROXY`, `ALL_PROXY`, then `HTTP_PROXY` (including lowercase variants).
[env: TG_OUTBOUND_PROXY=]
--no-outbound-proxy
Disable automatic outbound proxy discovery from standard environment variables. Also useful with `TG_OUTBOUND_PROXY=direct`
[env: TG_NO_OUTBOUND_PROXY=]
--no-proxy <LIST>
Comma-separated hosts that should bypass the outbound proxy.
Supports standard NO_PROXY host/domain entries, optional ports, CIDR, bracketed IPv6 and `*`. Bare domain entries may also match subdomains. Standard `NO_PROXY` / `no_proxy` variables are honored when omitted.
[env: TG_NO_PROXY=]
-h, --help
Print help (see a summary with '-h')
-V, --version
Print version