Common Features on frp

Configuration File

Mon, 01 Jan 0001 00:00:00 +0000

Starting from v0.52.0, frp began supporting TOML, YAML, and JSON as configuration file formats.

Please note that INI has been deprecated and will be removed in future releases. New features can only be used in TOML, YAML, or JSON. Users who wish to use these new features should switch their configuration format accordingly.

Format

You can use any format you like among TOML/YAML/JSON to write configuration files, and frp will automatically adapt and parse them.

Monitoring

Mon, 01 Jan 0001 00:00:00 +0000

Currently, frps server supports two monitoring systems: memory monitoring and Prometheus monitoring.

Memory Monitoring

Monitoring data stored in memory is primarily used for Dashboard display. When the Dashboard feature is enabled in frps configuration, memory monitoring is enabled by default.

Please note that monitoring data in memory will be cleared after each process restart, or retained for 7 days. Monitoring data can be obtained by sending HTTP requests to the Dashboard address, but this API is not currently standardized and direct use is not recommended.

Authentication

Mon, 01 Jan 0001 00:00:00 +0000

Currently, frpc and frps support two authentication methods: token and oidc, with token being the default. These authentication methods allow you to verify communication between the client and server, ensuring that only authorized users can establish connections.

Token

Token authentication is a simple authentication method that only requires configuring the same token in both the frp client (frpc) and server (frps) configuration files.

Configuration Example

# frps.toml
bindPort = 7000
auth.token = "abc"

# frpc.toml
auth.token = "abc"

Loading Token from File

Added in v0.64.0

Web Interface

Mon, 01 Jan 0001 00:00:00 +0000

Currently, frpc and frps have built-in corresponding web interfaces for user convenience.

Server Dashboard

The server Dashboard allows users to view frp status and proxy statistics through a browser.

Note: Dashboard has not been optimized for displaying large amounts of proxy data. If you experience slow Dashboard access, please do not enable this feature.

You need to specify the port used by the dashboard service in frps.toml to enable this feature:

Load Balancing and Health Check

Mon, 01 Jan 0001 00:00:00 +0000

Load Balancing

You can add multiple proxies of the same type to the same group to implement load balancing capabilities.

Currently supported proxy types include: tcp, http, https, tcpmux.

# frpc.toml
[[proxies]]
name = "test1"
type = "tcp"
localPort = 8080
remotePort = 80
loadBalancer.group = "web"
loadBalancer.groupKey = "123"

[[proxies]]
name = "test2"
type = "tcp"
localPort = 8081
remotePort = 80
loadBalancer.group = "web"
loadBalancer.groupKey = "123"

When users connect to port 80 of the frps server, frps will randomly distribute received user connections to one of the surviving proxies. This ensures that even if one frpc machine fails, other nodes can still provide services.

Get Real User IP

Mon, 01 Jan 0001 00:00:00 +0000

HTTP X-Forwarded-For

Currently, only http type proxies or proxies with https2http or https2https plugins enabled support this feature.

You can get the real user IP through the X-Forwarded-For in HTTP request headers, which is enabled by default.

Proxy Protocol

frp supports passing the real IP of requests proxied through frp via the Proxy Protocol protocol.

After the Proxy Protocol feature is enabled, frpc will first send a section of Proxy Protocol protocol content to the local service after establishing a connection with the local service. The local service can obtain the real IP of the accessing user by parsing this content. So not only HTTP services, but any TCP service that supports this protocol can obtain the user’s real IP address.

Port Range Mapping

Mon, 01 Jan 0001 00:00:00 +0000

Added in v0.56.0

We can use Go template’s range syntax combined with the built-in parseNumberRangePair function to implement port range mapping.

In the example below, after the application runs, 8 proxies will be created, named test-6000, test-6001 ... test-6007, which will map remote ports to local ports respectively.

{{- range $_, $v := parseNumberRangePair "6000-6006,6007" "6000-6006,6007" }}
[[proxies]]
name = "tcp-{{ $v.First }}"
type = "tcp"
localPort = {{ $v.First }}
remotePort = {{ $v.Second }}
{{- end }}

Client

Mon, 01 Jan 0001 00:00:00 +0000

Dynamic Configuration Updates

When you need to modify frpc proxy configuration, you can use the frpc reload command to achieve dynamic configuration file loading, usually completing proxy updates within seconds.

To enable this feature, you need to enable webServer in frpc to provide API services. The configuration is as follows:

webServer.addr = "127.0.0.1"
webServer.port = 7400

Then execute the following command to reload the configuration:

frpc reload -c ./frpc.toml

After waiting for a period of time, the client will create, update, or delete proxies according to the new configuration file. Note that parameters in the non-proxy related common section cannot currently be modified except for start.

Server Management

Mon, 01 Jan 0001 00:00:00 +0000

Port Whitelist

To prevent port abuse, you can manually specify which ports are allowed to be used. In the server configuration, specify through allowPorts:

# frps.ini
allowPorts = [
  { start = 2000, end = 3000 },
  { single = 3001 },
  { single = 3003 },
  { start = 4000, end = 50000 }
]

allowPorts can configure a specific port or all ports within a range to be allowed.

Port Reuse

Currently, vhostHTTPPort and vhostHTTPSPort in frps support being configured as the same port as bindPort. frps will analyze the connection protocol and then handle it differently.

Client Plugin

Mon, 01 Jan 0001 00:00:00 +0000

By default, frpc will only forward requests to local TCP or UDP ports, i.e., the local service address specified by localIP and localPort.

By enabling client plugin functionality, you can build in some simple local services when only starting frpc, thereby achieving functionality that would normally require starting additional services.

In each proxy’s configuration, you can configure the plugin to use and related parameters through plugin. After enabling client plugins, you no longer need to configure localIP and localPort.

Server Plugin

Mon, 01 Jan 0001 00:00:00 +0000

The purpose of frp server plugins is to extend the capabilities of the frp server without intruding on its own code.

frp server plugins run as separate processes and listen on a port, providing RPC interfaces externally to respond to frps requests.

Before executing certain operations, frps will send RPC requests to server plugins according to configuration, and execute corresponding operations based on the plugin’s response.

RPC Requests

After receiving operation requests, server plugins can give three types of responses:

SSH Tunnel Gateway

Mon, 01 Jan 0001 00:00:00 +0000

Added in v0.53.0

Concept

SSH supports reverse proxy capability rfc.

frp supports listening on an SSH port on the frps side, completing TCP protocol proxy through the SSH -R protocol. In this mode, there is no need to depend on frpc.

SSH reverse tunnel proxy and proxying SSH ports through frp are two different concepts. SSH reverse tunnel proxy is essentially using ssh client to connect to frps to complete basic reverse proxy when you don’t want to use frpc.

Virtual Network (VirtualNet)

Mon, 01 Jan 0001 00:00:00 +0000

Alpha feature, added in v0.62.0

Note: VirtualNet is an Alpha stage feature that is currently unstable. Its configuration methods and functionality may change at any time in future versions. Please do not use this feature in production environments; it is only recommended for testing and evaluation purposes.

Overview

The Virtual Network (VirtualNet) feature allows frp to create and manage virtual network connections between clients through TUN interfaces. This feature extends frp’s capabilities beyond traditional port forwarding to achieve complete network layer communication.