frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet. Now, it supports tcp, udp, http and https protocol when requests can be forwarded by domains to backward web services.
- What can I do with frp?
- Status
- Architecture
- Example Usage
- Features
- Development Plan
- Contributing
- Donation
- Expose any http and https service behind a NAT or firewall to the internet by a server with public IP address(Name-based Virtual Host Support).
- Expose any tcp or udp service behind a NAT or firewall to the internet by a server with public IP address.
frp is under development and you can try it with latest release version. Master branch for releasing stable version when dev branch for developing.
We may change any protocol and can't promise backward compatible. Please check the release log when upgrading.
Firstly, download the latest programs from Release page according to your os and arch.
Put frps and frps.ini to your server with public IP.
Put frpc and frpc.ini to your server in LAN.
- Modify frps.ini:
# frps.ini
[common]
bind_port = 7000- Start frps:
./frps -c ./frps.ini
- Modify frpc.ini,
server_addris your frps's server IP:
# frpc.ini
[common]
server_addr = x.x.x.x
server_port = 7000
[ssh]
type = tcp
local_ip = 127.0.0.1
local_port = 22
remote_port = 6000- Start frpc:
./frpc -c ./frpc.ini
- Connect to server in LAN by ssh assuming that username is test:
ssh -oPort=6000 [email protected]
Sometimes we want to expose a local web service behind a NAT network to others for testing with your own domain name and unfortunately we can't resolve a domain name to a local ip.
However, we can expose a http or https service using frp.
- Modify frps.ini, configure http port 8080:
# frps.ini
[common]
bind_port = 7000
vhost_http_port = 8080- Start frps:
./frps -c ./frps.ini
- Modify frpc.ini and set remote frps server's IP as x.x.x.x. The
local_portis the port of your web service:
# frpc.ini
[common]
server_addr = x.x.x.x
server_port = 7000
[web]
type = http
local_port = 80
custom_domains = www.yourdomain.com- Start frpc:
./frpc -c ./frpc.ini
-
Resolve A record of
www.yourdomain.comto IPx.x.x.xor CNAME record to your origin domain. -
Now visit your local web service using url
http://www.yourdomain.com:8080.
- Modify frps.ini:
# frps.ini
[common]
bind_port = 7000- Start frps:
./frps -c ./frps.ini
- Modify frpc.ini, set remote frps's server IP as x.x.x.x, forward dns query request to google dns server
8.8.8.8:53:
# frpc.ini
[common]
server_addr = x.x.x.x
server_port = 7000
[dns]
type = udp
local_ip = 8.8.8.8
local_port = 53
remote_port = 6000- Start frpc:
./frpc -c ./frpc.ini
- Send dns query request by dig:
dig @x.x.x.x -p 6000 www.goolge.com
Using tcp port to connect unix domain socket like docker daemon.
- Modify frps.ini:
# frps.ini
[common]
bind_port = 7000- Start frps:
./frps -c ./frps.ini
- Modify frpc.ini:
# frpc.ini
[common]
server_addr = x.x.x.x
server_port = 7000
[unix_domain_socket]
type = tcp
remote_port = 6000
plugin = unix_domain_socket
plugin_unix_path = /var/run/docker.sock- Start frpc:
./frpc -c ./frpc.ini
- Get docker version by curl command:
curl http://x.x.x.x:6000/version
Configure frps same as above.
- Modify frpc.ini:
# frpc.ini
[common]
server_addr = x.x.x.x
server_port = 7000
[http_proxy]
type = tcp
remote_port = 6000
plugin = http_proxy- Start frpc:
./frpc -c ./frpc.ini
- Set http proxy
x.x.x.x:6000in your browser and visit website through frpc's network.
Check frp's status and proxies's statistics information by Dashboard.
Configure a port for dashboard to enable this feature:
[common]
dashboard_port = 7500
# dashboard's username and password are both optional，if not set, default is admin.
dashboard_user = admin
dashboard_pwd = adminThen visit http://[server_addr]:7500 to see dashboard, default username and password are both admin.
Since v0.10.0, you only need to set privilege_token in frps.ini and frpc.ini.
Note that time duration between server of frpc and frps mustn't exceed 15 minutes because timestamp is used for authentication.
Howerver, this timeout duration can be modified by setting authentication_timeout in frps's configure file. It's defalut value is 900, means 15 minutes. If it is equals 0, then frps will not check authentication timeout.
Defalut value is false, you could decide if the proxy will use encryption or compression:
# frpc.ini
[ssh]
type = tcp
local_port = 22
remote_port = 6000
use_encryption = true
use_compression = trueThis feature is removed since v0.10.0.
Privilege mode is the default and only mode support in frp since v0.10.0. All proxy configurations are set in client.
privilege_allow_ports in frps.ini is used for preventing abuse of ports:
# frps.ini
[common]
privilege_allow_ports = 2000-3000,3001,3003,4000-50000privilege_allow_ports consists of a specific port or a range of ports divided by ,.
frp support tcp stream multiplexing since v0.10.0 like HTTP2 Multiplexing. All user requests to same frpc can use only one tcp connection.
You can disable this feature by modify frps.ini and frpc.ini:
# frps.ini and frpc.ini, must be same
[common]
tcp_mux = falsefrp support kcp protocol since v0.12.0.
KCP is a fast and reliable protocol that can achieve the transmission effect of a reduction of the average latency by 30% to 40% and reduction of the maximum delay by a factor of three, at the cost of 10% to 20% more bandwidth wasted than TCP.
Using kcp in frp:
- Enable kcp protocol in frps:
# frps.ini
[common]
bind_port = 7000
# kcp needs to bind a udp port, it can be same with 'bind_port'
kcp_bind_port = 7000- Configure the protocol used in frpc to connect frps:
# frpc.ini
[common]
server_addr = x.x.x.x
# specify the 'kcp_bind_port' in frps
server_port = 7000
protocol = kcpBy default, frps send message to frpc for create a new connection to backward service when getting an user request.If a proxy's connection pool is enabled, there will be a specified number of connections pre-established.
This feature is fit for a large number of short connections.
- Configure the limit of pool count each proxy can use in frps.ini:
# frps.ini
[common]
max_pool_count = 5- Enable and specify the number of connection pool:
# frpc.ini
[common]
pool_count = 1When forwarding to a local port, frp does not modify the tunneled HTTP requests at all, they are copied to your server byte-for-byte as they are received. Some application servers use the Host header for determining which development site to display. For this reason, frp can rewrite your requests with a modified Host header. Use the host_header_rewrite switch to rewrite incoming HTTP requests.
# frpc.ini
[web]
type = http
local_port = 80
custom_domains = test.yourdomain.com
host_header_rewrite = dev.yourdomain.comIf host_header_rewrite is specified, the Host header will be rewritten to match the hostname portion of the forwarding address.
Anyone who can guess your tunnel URL can access your local web server unless you protect it with a password.
This enforces HTTP Basic Auth on all requests with the username and password you specify in frpc's configure file.
It can only be enabled when proxy type is http.
# frpc.ini
[web]
type = http
local_port = 80
custom_domains = test.yourdomain.com
http_user = abc
http_pwd = abcVisit http://test.yourdomain.com and now you need to input username and password.
It is convenient to use subdomain configure for http、https type when many people use one frps server together.
# frps.ini
subdomain_host = frps.comResolve *.frps.com to the frps server's IP.
# frpc.ini
[web]
type = http
local_port = 80
subdomain = testNow you can visit your web service by host test.frps.com.
Note that if subdomain_host is not empty, custom_domains should not be the subdomain of subdomain_host.
frp support forward http requests to different backward web services by url routing.
locations specify the prefix of URL used for routing. frps first searches for the most specific prefix location given by literal strings regardless of the listed order.
# frpc.ini
[web01]
type = http
local_port = 80
custom_domains = web.yourdomain.com
locations = /
[web02]
type = http
local_port = 81
custom_domains = web.yourdomain.com
locations = /news,/aboutHttp requests with url prefix /news and /about will be forwarded to web02 and others to web01.
frpc can connect frps using HTTP PROXY if you set os environment HTTP_PROXY or configure http_proxy param in frpc.ini file.
It only works when protocol is tcp.
# frpc.ini
[common]
server_addr = x.x.x.x
server_port = 7000
http_proxy = http://user:[email protected]:8080frpc only forward request to local tcp or udp port by default.
Plugin is used for providing rich features. There are built-in plugins such as unix_domain_socket, http_proxy and you can see example usage.
Specify which plugin to use by plugin parameter. Configuration parameters of plugin should be started with plugin_. local_ip and local_port is useless for plugin.
Using plugin http_proxy:
# frpc.ini
[http_proxy]
type = tcp
remote_port = 6000
plugin = http_proxy
plugin_http_user = abc
plugin_http_passwd = abcplugin_http_user and plugin_http_passwd are configuration parameters used in http_proxy plugin.
- Log http request information in frps.
- Direct reverse proxy, like haproxy.
- Load balance to different service in frpc.
- Frpc can directly be a webserver for static files.
- P2p communicate by make udp hole to penetrate NAT.
- kubernetes ingress support.
Interested in getting involved? We would like to help you!
- Take a look at our issues list and consider sending a Pull Request to dev branch.
- If you want to add a new feature, please create an issue first to describe the new feature, as well as the implementation approach. Once a proposal is accepted, create an implementation of the new features and submit it as a pull request.
- Sorry for my poor english and improvement for this document is welcome even some typo fix.
- If you have some wanderful ideas, send email to [email protected].
Note: We prefer you to give your advise in issues, so others with a same question can search it quickly and we don't need to answer them repeatly.
If frp help you a lot, you can support us by:
frp QQ group: 606194980
Donate money by paypal to my account [email protected].