TGProxy Panel manages your own Telegram proxies: create users, issue subscription links, apply limits and inspect server health. The panel runs on one VPS and telemt on a separate proxy node. Client traffic goes through telemt rather than through the panel.
What to prepare
This guide covers installation with domains and HTTPS. If you are renting your first VPS, start with the from-scratch guide.
| Requirement | Panel host | Proxy host |
|---|---|---|
| System | Ubuntu 22.04+ or Debian 12+ | Ubuntu 22.04+ or Debian 12+, x86_64 |
| Resources | At least 1 CPU and 1 GB RAM | At least 1 CPU and 1 GB RAM; size for your traffic |
| Address | Domain with an A record pointing to the VPS | Public IPv4 and a separate domain with an A record |
| Inbound TCP ports | 22, 80, 443 | 22, 80, 443 and the Fake-TLS port, 8443 by default |
Ports 80 and 443 must be free before installation. Allow them in the VPS firewall and your provider’s network filter: the installer does not open firewall ports. The proxy needs outbound access to the panel, GitHub and Telegram datacenters. Check that DNS already points to the right servers.
1. Install the panel
Connect to the panel VPS over SSH and run the installer as root. The command downloads it from the official repository; you can read the script before running it.
curl -fsSL https://raw.githubusercontent.com/greenpandorik/tgproxy-panel/main/install.sh | sudo bashEnter your panel domain, certificate e-mail and administrator credentials. The script installs Docker if needed and starts the panel, PostgreSQL and Caddy. Open the HTTPS address printed at the end and sign in.
2. Connect a telemt node
Open Servers → Add server. Enter a name, proxy domain and e-mail. Choose telemt for a new installation: it serves Fake-TLS, the WEB proxy and the cover website.
The panel generates a command with a one-time registration token, valid for 24 hours. Run that exact command on the proxy VPS. Keep the token private. The installer checks DNS and ports, installs the engine and agent, obtains a certificate and registers the node after readiness checks.
Wait for the node to appear online. If registration fails, keep the error and consult the troubleshooting runbook.
3. Create a user and test the connection
Create a user under Users, assign an access expiry and select the node. Copy the subscription link: its page has device instructions plus Fake-TLS and WEB links.
Access starts after the configuration is applied, usually within a minute. First open a Fake-TLS link in Telegram and confirm the proxy. Then test WEB if your client supports it. Each user has their own secret; revoke access through the panel’s user controls.
4. Check health and secure the panel
Run “Check from the panel” and “Full server check” on the node page. Inspect DNS, the certificate, ports, telemt status and connections to Telegram. Success from the panel’s network does not prove reachability from every ISP: also test on the user’s device.
Enable two-factor sign-in, configure backups and Telegram alerts. Upgrade the panel with sudo /opt/tgproxy-panel/install.sh --update and both the agent and telemt with tgwp-agent upgrade. The command uses versions pinned by the panel. To update the agent alone, use tgwp-agent upgrade --agent. Preview the planned changes with tgwp-agent upgrade --check.
If Telegram cannot connect
- Confirm the node is online and the user’s changes have been applied.
- Check the address and port in the link; allow the Fake-TLS port in the firewall.
- Check the user’s access expiry and traffic quota.
- Compare mobile data with Wi-Fi, and Fake-TLS with WEB.
- Inspect the node’s route to Telegram. A backup domain may help when a hostname is blocked, but cannot repair a stopped engine or an unreachable datacenter.
Detailed commands and file paths are in the full setup guide. Read the MTProxy, Fake-TLS and WEB comparison to choose a transport.
Automate users and servers with the management API: personal tokens, permission scopes and working examples.