frp reverse proxy
/frp
frp: Securely Expose Local Services frp earns its reputation as a workhorse for NAT traversal. The split between frps and frpc gives you a controlled public endpoint while keeping your actual service on a private network. Security-conscious teams will appreciate TLS by default since v0.50.0 and the OIDC authentication option for enterprise environments. The secret TCP (STCP) mode is particularly useful when you want to expose a service to specific clients only, using a preshared key rather than opening ports to the world. Reach for frp if you need reliable, configurable tunneling without a SaaS subscription. Skip it if you want zero-configuration hosting โ ngrok handles that tradeoff with less flexibility but faster setup.
Understanding frp's Core Functionality
Understanding frp's Core Functionality frp is a reverse proxy written in Go that tunnels traffic from a public server (frps) to a client (frpc) running on a private network behind NAT or a firewall. Unlike SSH tunnels that require shell access, frp maintains persistent tunnels you configure declaratively, supporting TCP, UDP, HTTP, HTTPS, and P2P modes. It handles the NAT traversal by keeping the frpc-to-frps connection alive so external traffic can reach your local services.
Key Capabilities of frp
- โMulti-protocol support: TCP, UDP, HTTP, HTTPS, plus P2P modes (XTCP for direct client-to-client transfer, STCP for preshared-key access)
- โTLS encryption enabled by default since v0.50.0, with custom certificate support for the dashboard
- โAuthentication via shared token or OIDC (OpenID Connect Client Credentials flow) for enterprise identity providers
- โBuilt-in dashboard on frps showing proxy status and statistics, with Prometheus metrics export
- โDynamic proxy management through the web UI or API without restarting frpc
- โClient admin UI at localhost for inspecting and updating running configuration
- โEnvironment variable substitution in config files, plus file includes for modular proxy definitions
- โPlugin system for exposing Unix domain sockets, static files, and HTTPS-to-HTTP translation
Practical frp Configuration Examples
The basic flow involves writing TOML configs (YAML and JSON are also supported), starting frps on the public server, then frpc on your LAN. For example, to expose SSH: set bindPort = 7000 on frps, and on frpc configure serverAddr, serverPort, plus a TCP proxy mapping localPort 22 to remotePort 6000. Once running, SSH to the public IP on port 6000 reaches your LAN machine. For HTTP services, configure vhostHTTPPort on frps and use customDomains in the proxy definition. Visit http://{serverAddr}:7500 to view the dashboard (default credentials admin/admin).
Strengths
- โOver 108k GitHub stars โ battle-tested with a large community and active maintenance
- โProtocol flexibility: TCP, UDP, HTTP, HTTPS, plus P2P modes for bandwidth-sensitive transfers
- โTLS and OIDC authentication support for environments with strict security requirements
- โNo dependency on cloud infrastructure โ you control the server, data never touches a third-party SaaS
- โLightweight single-binary deployment with straightforward configuration format
Current Development Status and V2 Vision
- โณV2 has been in development with no ETA โ the author cites fragmented time and constant interruptions, and it will not be backwards compatible with v1
- โณXTCP P2P mode relies on STUN and may fail with symmetric NAT or certain enterprise firewalls, requiring fallback to STCP
- โณConfiguration depth can be steep for simple use cases compared to SaaS tunneling tools
- โณNo built-in high availability or load balancing between multiple frps instances
- โณAntivirus false positives on frpc require manual whitelisting on some systems
Exploring Other Reverse Proxy Solutions
Who Benefits Most from Using frp?
Devs with a VPS or public server who need reliable, persistent access to local services without configuring router port forwarding. Security teams appreciate the OIDC integration for tying tunnel access to their identity provider. Homelab enthusiasts exposing self-hosted services benefit from avoiding dynamic DNS and port forwarding complexity. Teams doing webhook integration testing avoid cloud redeployment cycles. If you need zero-config or don't have a public server available, a SaaS option like ngrok is faster.
Frequently Asked Questions about frp
frp supports TCP, UDP, HTTP, and HTTPS for standard proxying. It also offers STCP (Secret TCP) for preshared-key access and XTCP for P2P client-to-client connections bypassing the frps server.
TLS encryption is enabled by default since v0.50.0. frp supports token authentication and OIDC for enterprise identity integration. STCP mode requires a preshared key, and traffic between frpc and frps can be encrypted independently of transport TLS.
frp is production-capable for stable deployments where you control the server infrastructure. The community includes companies using it in production, but high availability across multiple frps instances requires manual configuration.
Since v0.52.0, frp supports TOML, YAML, and JSON. INI format is deprecated and will be removed. New features only target the three supported formats.
frp supports token-based authentication where both frps and frpc share the same secret, and OIDC (OpenID Connect Client Credentials) for integration with enterprise identity providers.
Yes, XTCP mode establishes direct connections between frpc clients using STUN for NAT traversal. It requires a frps server for signaling but data bypasses it. XTCP may fail on symmetric NATs, falling back to STCP.
The problem it solves
The problem it solves
Best use cases
- โขExposing local development webhooks to external services during integration testing
- โขAccessing home lab services (like NAS, smart home dashboards) from outside your LAN
- โขSharing a local demo environment with clients or stakeholders without deploying to the cloud
- โขRemote debugging of mobile apps that communicate with a local backend
- โขP2P file transfer between machines behind separate NATs using XTCP mode
- โขRunning multiple SSH services on the same port via tcpmux HTTP Connect multiplexing
How to install / try
Download precompiled binaries for your OS and architecture from the GitHub releases page. You need two machines: one with a public IP running frps, and one on your LAN running frpc. On the server, place the frps binary and configuration file. On the client, place the frpc binary and its configuration pointing to the server's public address. Note that some antivirus software flags frpc as malware because it creates reverse proxies โ you may need to whitelist it to prevent quarantine.
Related repositories
Curious whether frp is right for you?
Let ChatGPT, Claude, or Perplexity look into it โ click below and see what AI actually says about frp.