The Complete Guide to FRP (Fast Reverse Proxy) – Internal Network Penetration

1.1 What is FRP?#

FRP (Fast Reverse Proxy) is a high‑performance reverse proxy application focused on internal network penetration. It is written in Go and supports TCP, UDP, HTTP, HTTPS, and many other protocols. It can expose internal services to the public internet securely and conveniently via a node with a public IP address.

Official GitHub repository: https://github.com/fatedier/frp

1.2 What Can FRP Do?#

FRP has a wide range of use cases:

2.1 The Problem with Internal Network Devices#

For hosts on the internet to communicate with each other, they need to know each other’s public IP addresses. But in reality:

• IPv4 address exhaustion – Global IPv4 addresses have long run out, making it difficult for regular users to obtain a public IP
• NAT (Network Address Translation) – Most users are behind a network topology like this:

1
User Device → Home Router → ISP NAT → Internet

Your home router assigns a private IP (192.168.x.x, 172.16.x.x, or 10.x.x.x), and your ISP may further use CGNAT (Carrier‑Grade NAT), sharing a small pool of public IPs among many users.

The result is: the outside world cannot initiate a connection to any of your devices.

2.2 Comparison of Common Solutions#

2.3 Advantages of FRP#

Compared to other solutions, FRP offers:

• Full control – Only a cheap cloud server (VPS) is needed, costing around $3‑5/month
• Multi‑protocol support – TCP, UDP, HTTP, HTTPS, etc.
• High performance – Uses TCP connection multiplexing to save resources
• Security – Supports TLS encryption and authentication
• Cross‑platform – Works on Linux, Windows, macOS, Raspberry Pi, and more

3.1 Core Components#

FRP uses a C/S (Client/Server) architecture with two core programs:

3.2 Workflow#

FRP works as follows:

1
┌─────────────────────────────────────────────────────────────┐
2
│                    Public Server (frps)                     │
3
│  ┌─────────┐                                                │
4
│  │  frps   │◄────── Control connection (TCP long‑live) ────► frpc │
5
│  │         │                                                │
6
│  │   Port  │◄──────── Data forwarding ────────────────── Internal Service │
7
│  │   Mapped │                                                │
8
│  └─────────┘                                                │
9
└─────────────────────────────────────────────────────────────┘

1. Outbound connection from internal network: When frpc starts, it actively connects to frps’s listening port (default 7000) and establishes a persistent TCP long connection

2. Service registration: frpc tells frps: “I can proxy the local HTTP service at 127.0.0.1:8080”

3. External request arrives: A user visits http://public_ip:port or http://domain, and DNS resolves to the frps server

4. Smart routing: frps finds the corresponding frpc based on the port number or HTTP Host header

5. Data forwarding: frps notifies frpc via the existing connection, the two establish a data channel, and all subsequent traffic is forwarded bidirectionally

3.3 Supported Proxy Types#

FRP supports multiple proxy types for different use cases:

4.1 Prerequisites#

Before you start, you’ll need:

• A Linux public server (VPS) – Ubuntu or CentOS recommended, minimum 1 vCPU 1 GB RAM
• An internal device (Windows/Linux/macOS/Raspberry Pi)
• A domain name (optional, but required for HTTP/HTTPS mode)

4.2 Download FRP#

Download the latest binary from the GitHub Releases page:

1
# Download (choose the version for your system architecture)
2
wget https://github.com/fatedier/frp/releases/download/v0.62.0/frp_0.62.0_linux_amd64.tar.gz
3

4
# Extract
5
tar -xzf frp_0.62.0_linux_amd64.tar.gz
6
cd frp_0.62.0_linux_amd64

After extraction, you’ll see the following files:

1
.
2
├── frpc          # Client binary
3
├── frpc.toml     # Client configuration
4
├── frps          # Server binary
5
├── frps.toml     # Server configuration
6
└── LICENSE

The server and client use the same binary – just different config files. Let’s separate them:

1
# Create directories for server and client
2
mkdir -p /opt/frp/server
3
mkdir -p /opt/frp/client
4

5
# Server gets frps and frps.toml
6
mv frps frps.toml /opt/frp/server/
7

8
# Client gets frpc and frpc.toml
9
mv frpc frpc.toml /opt/frp/client/

4.3 Configure the Server (frps)#

Edit the server config file /opt/frp/server/frps.toml:

1
[common]
2
# Server listening port – clients connect here
3
bindPort = 7000
4

5
# HTTP entry port (if using HTTP proxies)
6
vhostHttpPort = 8080
7

8
# HTTPS entry port (if using HTTPS proxies)
9
# vhostHttpsPort = 8443
10

11
# Authentication
12
auth.method = "token"
13
auth.token = "your_strong_token_here"  # Use a strong password
14

15
# Dashboard config (web admin interface)
16
webServer.addr = "0.0.0.0"
17
webServer.port = 7500
18
webServer.user = "admin"
19
webServer.password = "your_dashboard_password"
20

21
# Logging
22
log.to = "/var/log/frp/frps.log"
23
log.level = "info"
24
log.maxDays = 7
25

26
# Enable Prometheus metrics (optional)
27
enablePrometheus = true

Note: Remember to open ports 7000, 7500, 8080, etc., in your cloud server’s security group.

Start the server:

1
# Run in foreground (for testing)
2
./frps -c ./frps.toml
3

4
# Run in background
5
nohup ./frps -c ./frps.toml &

Using systemd (recommended):

1
[Unit]
2
Description = frp server
3
After = network.target
4

5
[Service]
6
Type = simple
7
ExecStart = /opt/frp/server/frps -c /opt/frp/server/frps.toml
8
Restart = always
9
RestartSec = 5
10

11
[Install]
12
WantedBy = multi-user.target

1
sudo systemctl daemon-reload
2
sudo systemctl enable frps
3
sudo systemctl start frps
4
sudo systemctl status frps

Visit http://your_server_ip:7500, enter the Dashboard username and password, and you’ll see the admin interface.

4.4 Configure the Client (frpc)#

Edit the client config file /opt/frp/client/frpc.toml:

1
[common]
2
# Server address and port
3
serverAddr = "your_server_ip"
4
serverPort = 7000
5

6
# Authentication – must match the server
7
auth.method = "token"
8
auth.token = "your_strong_token_here"
9

10
# Logging
11
log.to = "./frpc.log"
12
log.level = "info"
13
log.maxDays = 7
14

15
# ==== TCP Proxy Example ====
16
# Map local port 22 to server port 6000
17
[[proxies]]
18
name = "ssh"
19
type = "tcp"
20
localIP = "127.0.0.1"
21
localPort = 22
22
remotePort = 6000
23

24
# ==== HTTP Proxy Example ====
25
# Map local web service at port 8080 to the server
26
[[proxies]]
27
name = "web"
28
type = "http"
29
localIP = "127.0.0.1"
30
localPort = 8080
31
customDomains = ["your-domain.com"]

Start the client:

1
# Run in foreground
2
./frpc -c ./frpc.toml
3

4
# Run in background
5
nohup ./frpc -c ./frpc.toml &

4.5 Advanced: Access via Domain Name#

If you have a domain, you can configure HTTP/HTTPS proxies to access internal services via the domain.

Additional server config:

1
# In frps.toml, make sure this is set
2
vhostHttpPort = 8080

Client config:

1
[[proxies]]
2
name = "web"
3
type = "http"
4
localIP = "127.0.0.1"
5
localPort = 8080
6
customDomains = ["web.your-domain.com"]

Then add a DNS record at your domain registrar:

1
web.your-domain.com  →  your_server_ip

Now visiting http://web.your-domain.com:8080 will automatically forward to your internal service.

4.6 Advanced: Load Balancing#

FRP supports load balancing across proxy groups, which is great for multi‑instance deployments:

1
[[proxy groups]]
2
name = "web_group"
3
type = "load-balance"
4
selector = "round-robin"
5
servers = [
6
    { name = "web1", localIP = "192.168.1.100", localPort = 8080 },
7
    { name = "web2", localIP = "192.168.1.101", localPort = 8080 },
8
]

5.1 Mandatory Security Measures#

1. Use a strong token – Don’t use simple passwords; generate a random, strong one
2. Restrict Dashboard access – Use firewall rules to allow only specific IPs to access port 7500
3. Enable TLS encryption – Add transport.tls.tlsCertFile and transport.tls.tlsKeyFile in the [common] section
4. Avoid running as root – Create a dedicated frp user

5.2 TLS Encryption Example#

1
# Server frps.toml
2
[common]
3
transport.tls.tlsCertFile = "/path/to/cert.pem"
4
transport.tls.tlsKeyFile = "/path/to/key.pem"
5
transport.tls.force = true
6

7
# Client frpc.toml
8
[common]
9
transport.tls.tlsCertFile = "/path/to/cert.pem"
10
transport.tls.tlsKeyFile = "/path/to/key.pem"
11
transport.tls.force = true

Q1: Connection fails with “login to server failed”#

• Check that the server is running properly
• Verify that serverAddr, serverPort, and auth.token match the server config
• Check firewall and security group rules to ensure the ports are open

Q2: HTTP service is not accessible#

• Confirm that vhostHttpPort is set correctly on the server
• Check that the customDomains in the client config resolves to the server IP
• Confirm DNS records have propagated

Q3: How do I check connection status?#

• Visit the Dashboard (default http://server_ip:7500)
• Check the log files
• Use sudo systemctl status frps to see the service status