Fix Telegram on Restricted Networks: Full Troubleshooting

You open Telegram on the office Wi-Fi, the hotel network, or a SIM in a country that filters traffic, and the connecting spinner just sits there. Maybe it loads contacts but never delivers a message. Maybe it works on cellular and dies the second you join Wi-Fi. This guide is the same ladder we run when a customer on our managed hosting says “Telegram stopped connecting.” We isolate the cause first, then apply the fix that matches it. Guessing wastes hours; the network leaves fingerprints, and you can read them in a few minutes.

This is a troubleshooting walkthrough, not a sales pitch. We run TGYT, a Singapore-based managed Telegram hosting setup on dedicated hardware with mobile IPs across SingTel, M1, StarHub, and Vivifi plus a Samsung cloud-phone fleet. You bring your own number. But you do not need any of that to fix most restricted-network problems, and I will say plainly where a self-serve fix is enough and where managed hosting actually changes the outcome.

how to tell it is the network and not your account

Before you touch a proxy, rule out the two things people blame the network for when the cause is somewhere else.

First, your account. If Telegram connects fine but a specific action fails (sending to a group, joining a channel, logging in a new session), that is account-side, not network-side. A blocked or rate-limited account behaves differently from a blocked network: the connection succeeds, the action does not. If you suspect that, check it directly before going further. We cover that in how to check if your IP is banned by Telegram and the subtler detect if your Telegram IP is flagged. Do not spend an afternoon swapping proxies for a problem the proxy cannot fix.

Second, the network. The clean test takes thirty seconds: turn Wi-Fi off, switch to mobile data, open Telegram. If it connects instantly on cellular and stalls on Wi-Fi, the Wi-Fi network is filtering Telegram and your account is fine. If it stalls on both and you are on a mobile carrier that filters (some do), you have a carrier-level block, which is the same problem class with the same fixes. If it works everywhere except one network, that one network is the culprit. That single A/B test removes most of the confusion before you start.

the diagnostic ladder

A network can block Telegram at four layers, cheapest to most aggressive. Walk them in order, because the fix changes at each rung.

DNS block. The network refuses to resolve Telegram’s domains, or hands back a fake answer. Cheapest filter to deploy, easiest to beat.
SNI / DPI block. DNS resolves fine, but deep packet inspection reads the server name in your TLS handshake (or recognizes Telegram’s MTProto pattern) and drops the connection. This is what serious filtering looks like.
Port block. The network allows only specific ports (often 80 and 443) and Telegram’s data center connections on other ports never leave the building.
Full IP block. The network null-routes Telegram’s data center IP ranges outright. Nothing you send to those addresses arrives.

You can test the first three from a laptop in a couple of minutes. Run these on the affected network.

# Rung 1: DNS. Does the name resolve, and to a sane answer?
nslookup telegram.org
dig +short telegram.org
# Compare against a known-good resolver:
dig +short telegram.org @1.1.1.1
# If the network answer differs wildly (loopback, a portal IP, or NXDOMAIN
# while 1.1.1.1 returns real addresses), you have a DNS block.

# Rung 2: SNI / DPI. Can you complete a TLS handshake to Telegram?
openssl s_client -connect 149.154.167.50:443 -servername telegram.org </dev/null
# A handshake that hangs or resets only when -servername names Telegram,
# but succeeds with a neutral servername, points at SNI-based DPI.
curl -v --resolve telegram.org:443:149.154.167.50 https://telegram.org/ -o /dev/null

# Rung 3: Ports. Is the data center reachable on the ports Telegram uses?
ping -c 4 149.154.167.50
# TCP reachability per port (telnet or nc):
telnet 149.154.167.50 443
nc -vz 149.154.167.50 443
nc -vz 149.154.167.50 80
nc -vz 149.154.167.50 5222
# If 443/80 connect but the MTProto ports do not, you have a port block.

Read the results together, not in isolation. DNS fails but a direct-IP curl succeeds means a pure DNS block. DNS succeeds and the handshake dies the moment the Telegram SNI appears means DPI. Everything reachable on 443 but nothing on other ports means a port block. Nothing reachable at all, including a raw ping to the IP, means a full IP block (or the network blocks ICMP, so confirm with a TCP test before concluding). For an external, neutral read on what a whole country is filtering, run the OONI tests; they measure Telegram reachability from inside the network and publish the data.

fixes by cause

Match the fix to the rung. Applying a heavyweight fix to a lightweight block works but is slower than it needs to be; applying a lightweight fix to a heavyweight block fails and wastes your time.

DNS block, change your resolver. This is the one fix you can do with zero extra software. Point your device at a public resolver (1.1.1.1 or 8.8.8.8) instead of the network’s DHCP-assigned one, and better, turn on encrypted DNS (DNS-over-HTTPS or DNS-over-TLS) so the network cannot see or rewrite your lookups. On a phone this is “Private DNS” (Android) or “Encrypted DNS” via a profile (iOS). If the only block was DNS, Telegram connects immediately after this. If it still stalls, the block is deeper and you move down the ladder.
SNI / DPI or full IP block, use an MTProto proxy first. This is the workhorse for serious filtering. MTProto is Telegram’s own proxy protocol; it wraps the traffic so DPI cannot read a Telegram-shaped handshake, and it is built into the client, so there is no separate app. Add the proxy in Telegram’s settings and the whole client routes through it. Start here before reaching for anything else, because it is the most reliable against DPI and the simplest to configure. If you want the background on why this protocol survives filtering that kills plain TLS, read what is MTProto proxy explained.
When MTProto is also blocked, escalate the transport. Aggressive networks fingerprint and block known MTProto proxy endpoints too. The next steps up are a SOCKS5 proxy (still Telegram-native), or moving the whole connection onto an IP and protocol the filter does not recognize. The tradeoffs between MTProto, SOCKS5, and routing through a cloud phone are laid out in MTProto vs SOCKS5 vs cloud phone for Telegram. The short version: MTProto for stealth on the client, SOCKS5 when you need a generic tunnel, and a cloud phone when the local network is so hostile that you want the Telegram session to live somewhere else entirely.
Port block, the proxy fixes this for free. A proxy listening on 443 reroutes Telegram’s traffic through the one port the network does allow, so a port block usually disappears the moment you add an MTProto or SOCKS5 proxy on 443. You rarely need to treat a port block as its own problem.
Last resort, mobile data or a hotspot. If you cannot get a proxy working and you have cellular signal, tether. It is not a fix for the restricted network, it sidesteps it. Useful when you need Telegram now and will sort out the proxy later. Watch for carrier-grade NAT on the mobile side, which brings its own quirks, covered in carrier-grade NAT and Telegram.

per-platform proxy steps

The MTProto/SOCKS5 settings live in the same place across clients, but the path differs. These assume you already have proxy credentials (host, port, and a secret for MTProto).

On Android, open Settings, Data and Storage, Proxy Settings, Add Proxy. Choose MTProto Proxy, enter the server, port, and secret, then enable it. The proxy toggle sits at the top so you can flip it off on networks that do not need it. Full walkthrough with screenshots in connect Telegram proxy on Android.

On iPhone, open Settings, Data and Storage, Proxy, Add Proxy. iOS sometimes routes a few system calls outside the in-app proxy, so if part of the app still stalls, that is expected behavior, not a broken proxy. The platform-specific notes are in connect Telegram proxy on iPhone.

On desktop, open Settings, Advanced, Connection type, Use custom proxy, and add the MTProto or SOCKS5 entry. Desktop is the easiest place to run the diagnostic commands above and the proxy side by side, which is why we usually debug here first. See connect Telegram proxy on desktop.

After the proxy connects, confirm it is actually carrying your traffic and not leaking around itself. A proxy that “connects” but lets DNS or part of the app bypass it is worse than none, because you think you are protected and you are not. Run the check in how to test if your Telegram proxy is leaking before you trust it on a hostile network.

what can go wrong

A few traps that send people in circles:

The proxy connects but messages still do not send. Usually the proxy IP itself is flagged or rate-limited, which is a different problem from the network block you just solved. Test the proxy IP’s standing, not the network.

It works for a day, then stops. Public and shared MTProto endpoints get discovered and blocked by the filter operator, so a free proxy that worked Monday is dead by Friday. This is the core weakness of free proxy lists: they are public, so the filter sees them too. A dedicated IP that is not on any public list lasts far longer.

Captive portals. Hotel and airport Wi-Fi often holds you behind a login page; nothing connects until you accept the portal, and Telegram’s silent connection attempts make it look like a block when it is just an un-passed portal. Open a browser, clear the portal, then retest.

Country-level filtering is its own genre, and the working approach shifts by jurisdiction as filters change. If you are dealing with a national block rather than one venue, the country guides are kept current: Telegram in China, Telegram in Iran, Telegram in Russia, Telegram in the UAE and Dubai, Telegram in India, and Telegram in Pakistan. The ladder above still applies; the country pages tell you which rung the local filter actually sits on right now.

how managed hosting sidesteps this

Everything above is something you can do yourself, and for a one-off hostile network you should. Where it stops scaling is when the connection has to be reliable every day from networks you do not control: a flaky office, frequent travel, or a country that filters aggressively and keeps moving the goalposts.

The structural fix is to stop fighting the local network and put the Telegram session somewhere the network cannot reach it. On TGYT that means the session runs on our dedicated Singapore hardware behind a mobile IP from a real carrier (SingTel, M1, StarHub, or Vivifi), or on a Samsung cloud phone in our fleet. Your local Wi-Fi only has to carry a remote-control connection, not Telegram’s actual data center traffic, so the venue’s DNS rewrite, SNI filter, or port block has nothing to grab. The mobile IP matters here for reasons specific to how Telegram treats addresses, which is the whole point of what is a mobile IP and why Telegram cares and the Singapore mobile IP advantage for Telegram: carrier IPs are treated as ordinary residential users, not flagged data center ranges.

It is a bring-your-own-number model, so it is your account on dedicated infrastructure, not a shared pool. That is the difference between patching one bad network and not having the problem in the first place. If you also run general mobile-proxy needs, the same carrier IPs back Singapore Mobile Proxy, and the cloud-phone fleet is the same one behind cloudf.one.

final word

Restricted-network Telegram trouble is almost always diagnosable in under ten minutes if you run the ladder instead of guessing. Confirm it is the network and not your account, find the rung (DNS, SNI/DPI, port, or full IP), then apply the matching fix: change DNS for a DNS block, MTProto proxy first for DPI and IP blocks, mobile data as a stopgap. Most of the time that is all you need, and it costs nothing.

When you need it to work every day from networks you do not own, that is what managed hosting is for. If the self-serve ladder is not holding up against the networks you actually use, see how TGYT runs your Telegram on dedicated Singapore hardware with mobile IPs. Bring your number; we handle the connection. For the official client and protocol docs, telegram.org stays the source of truth.

Get new guides and videos first — join the Telegram channel.