{"id":13393703,"url":"https://github.com/fatedier/frp","last_synced_at":"2026-01-04T09:05:11.233Z","repository":{"id":37334437,"uuid":"48378947","full_name":"fatedier/frp","owner":"fatedier","description":"A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","archived":false,"fork":false,"pushed_at":"2025-04-28T06:25:22.000Z","size":30447,"stargazers_count":93470,"open_issues_count":67,"forks_count":13987,"subscribers_count":1578,"default_branch":"dev","last_synced_at":"2025-05-05T15:08:33.294Z","etag":null,"topics":["expose","firewall","frp","go","http-proxy","nat","p2p","proxy","reverse-proxy","tunnel"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fatedier.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null},"funding":{"github":["fatedier"],"custom":["https://afdian.com/a/fatedier"]}},"created_at":"2015-12-21T15:24:59.000Z","updated_at":"2025-05-05T14:58:13.000Z","dependencies_parsed_at":"2024-01-09T11:45:55.668Z","dependency_job_id":"40c39ec9-706a-403a-a09b-c3454b5f6d98","html_url":"https://github.com/fatedier/frp","commit_stats":{"total_commits":842,"total_committers":105,"mean_commits":8.019047619047619,"dds":"0.24584323040380052","last_synced_commit":"0214b974ddd928f74f0922dd28ee8aa9e5b0743f"},"previous_names":[],"tags_count":104,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fatedier%2Ffrp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fatedier%2Ffrp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fatedier%2Ffrp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fatedier%2Ffrp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fatedier","download_url":"https://codeload.github.com/fatedier/frp/tar.gz/refs/heads/dev","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253789285,"owners_count":21964649,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["expose","firewall","frp","go","http-proxy","nat","p2p","proxy","reverse-proxy","tunnel"],"created_at":"2024-07-30T17:00:58.915Z","updated_at":"2026-01-04T09:05:11.225Z","avatar_url":"https://github.com/fatedier.png","language":"Go","readme":"# frp\n\n[![Build Status](https://circleci.com/gh/fatedier/frp.svg?style=shield)](https://circleci.com/gh/fatedier/frp)\n[![GitHub release](https://img.shields.io/github/tag/fatedier/frp.svg?label=release)](https://github.com/fatedier/frp/releases)\n[![Go Report Card](https://goreportcard.com/badge/github.com/fatedier/frp)](https://goreportcard.com/report/github.com/fatedier/frp)\n[![GitHub Releases Stats](https://img.shields.io/github/downloads/fatedier/frp/total.svg?logo=github)](https://somsubhra.github.io/github-release-stats/?username=fatedier\u0026repository=frp)\n\n[README](README.md) | [中文文档](README_zh.md)\n\n## Sponsors\n\nfrp is an open source project with its ongoing development made possible entirely by the support of our awesome sponsors. If you'd like to join them, please consider [sponsoring frp's development](https://github.com/sponsors/fatedier).\n\n\u003ch3 align=\"center\"\u003eGold Sponsors\u003c/h3\u003e\n\u003c!--gold sponsors start--\u003e\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://jb.gg/frp\" target=\"_blank\"\u003e\n    \u003cimg width=\"420px\" src=\"https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg\"\u003e\n\t\u003cbr\u003e\n\t\u003cb\u003eThe complete IDE crafted for professional Go developers\u003c/b\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://github.com/beclab/Olares\" target=\"_blank\"\u003e\n    \u003cimg width=\"420px\" src=\"https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg\"\u003e\n\t\u003cbr\u003e\n\t\u003cb\u003eThe sovereign cloud that puts you in control\u003c/b\u003e\n\t\u003cbr\u003e\n\t\u003csub\u003eAn open source, self-hosted alternative to public clouds, built for data ownership and privacy\u003c/sub\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\n\u003cdiv align=\"center\"\u003e\n\n## Recall.ai - API for meeting recordings\n\nIf you're looking for a meeting recording API, consider checking out [Recall.ai](https://www.recall.ai/?utm_source=github\u0026utm_medium=sponsorship\u0026utm_campaign=fatedier-frp),\n\nan API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and more.\n\n\u003c/div\u003e\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://requestly.com/?utm_source=github\u0026utm_medium=partnered\u0026utm_campaign=frp\" target=\"_blank\"\u003e\n    \u003cimg width=\"480px\" src=\"https://github.com/user-attachments/assets/24670320-997d-4d62-9bca-955c59fe883d\"\u003e\n    \u003cbr\u003e\n    \u003cb\u003eRequestly - Free \u0026 Open-Source alternative to Postman\u003c/b\u003e\n    \u003cbr\u003e\n    \u003csub\u003eAll-in-one platform to Test, Mock and Intercept APIs.\u003c/sub\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://go.warp.dev/frp\" target=\"_blank\"\u003e\n    \u003cimg width=\"360px\" src=\"https://raw.githubusercontent.com/warpdotdev/brand-assets/refs/heads/main/Github/Sponsor/Warp-Github-LG-01.png\"\u003e\n    \u003cbr\u003e\n    \u003cb\u003eWarp, built for collaborating with AI Agents\u003c/b\u003e\n    \u003cbr\u003e\n\t\u003csub\u003eAvailable for macOS, Linux and Windows\u003c/sub\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\u003c!--gold sponsors end--\u003e\n\n## What is frp?\n\nfrp is a fast reverse proxy that allows you to expose a local server located behind a NAT or firewall to the Internet. It currently supports **TCP** and **UDP**, as well as **HTTP** and **HTTPS** protocols, enabling requests to be forwarded to internal services via domain name.\n\nfrp also offers a P2P connect mode.\n\n## Table of Contents\n\n\u003c!-- vim-markdown-toc GFM --\u003e\n\n* [Development Status](#development-status)\n    * [About V2](#about-v2)\n* [Architecture](#architecture)\n* [Example Usage](#example-usage)\n    * [Access your computer in a LAN network via SSH](#access-your-computer-in-a-lan-network-via-ssh)\n    * [Multiple SSH services sharing the same port](#multiple-ssh-services-sharing-the-same-port)\n    * [Accessing Internal Web Services with Custom Domains in LAN](#accessing-internal-web-services-with-custom-domains-in-lan)\n    * [Forward DNS query requests](#forward-dns-query-requests)\n    * [Forward Unix Domain Socket](#forward-unix-domain-socket)\n    * [Expose a simple HTTP file server](#expose-a-simple-http-file-server)\n    * [Enable HTTPS for a local HTTP(S) service](#enable-https-for-a-local-https-service)\n    * [Expose your service privately](#expose-your-service-privately)\n    * [P2P Mode](#p2p-mode)\n* [Features](#features)\n    * [Configuration Files](#configuration-files)\n    * [Using Environment Variables](#using-environment-variables)\n    * [Split Configures Into Different Files](#split-configures-into-different-files)\n    * [Server Dashboard](#server-dashboard)\n    * [Client Admin UI](#client-admin-ui)\n    * [Monitor](#monitor)\n        * [Prometheus](#prometheus)\n    * [Authenticating the Client](#authenticating-the-client)\n        * [Token Authentication](#token-authentication)\n        * [OIDC Authentication](#oidc-authentication)\n    * [Encryption and Compression](#encryption-and-compression)\n        * [TLS](#tls)\n    * [Hot-Reloading frpc configuration](#hot-reloading-frpc-configuration)\n    * [Get proxy status from client](#get-proxy-status-from-client)\n    * [Only allowing certain ports on the server](#only-allowing-certain-ports-on-the-server)\n    * [Port Reuse](#port-reuse)\n    * [Bandwidth Limit](#bandwidth-limit)\n        * [For Each Proxy](#for-each-proxy)\n    * [TCP Stream Multiplexing](#tcp-stream-multiplexing)\n    * [Support KCP Protocol](#support-kcp-protocol)\n    * [Support QUIC Protocol](#support-quic-protocol)\n    * [Connection Pooling](#connection-pooling)\n    * [Load balancing](#load-balancing)\n    * [Service Health Check](#service-health-check)\n    * [Rewriting the HTTP Host Header](#rewriting-the-http-host-header)\n    * [Setting other HTTP Headers](#setting-other-http-headers)\n    * [Get Real IP](#get-real-ip)\n        * [HTTP X-Forwarded-For](#http-x-forwarded-for)\n        * [Proxy Protocol](#proxy-protocol)\n    * [Require HTTP Basic Auth (Password) for Web Services](#require-http-basic-auth-password-for-web-services)\n    * [Custom Subdomain Names](#custom-subdomain-names)\n    * [URL Routing](#url-routing)\n    * [TCP Port Multiplexing](#tcp-port-multiplexing)\n    * [Connecting to frps via PROXY](#connecting-to-frps-via-proxy)\n    * [Port range mapping](#port-range-mapping)\n    * [Client Plugins](#client-plugins)\n    * [Server Manage Plugins](#server-manage-plugins)\n    * [SSH Tunnel Gateway](#ssh-tunnel-gateway)\n    * [Virtual Network (VirtualNet)](#virtual-network-virtualnet)\n* [Feature Gates](#feature-gates)\n    * [Available Feature Gates](#available-feature-gates)\n    * [Enabling Feature Gates](#enabling-feature-gates)\n    * [Feature Lifecycle](#feature-lifecycle)\n* [Related Projects](#related-projects)\n* [Contributing](#contributing)\n* [Donation](#donation)\n    * [GitHub Sponsors](#github-sponsors)\n    * [PayPal](#paypal)\n\n\u003c!-- vim-markdown-toc --\u003e\n\n## Development Status\n\nfrp is currently under development. You can try the latest release version in the `master` branch, or use the `dev` branch to access the version currently in development.\n\nWe are currently working on version 2 and attempting to perform some code refactoring and improvements. However, please note that it will not be compatible with version 1.\n\nWe will transition from version 0 to version 1 at the appropriate time and will only accept bug fixes and improvements, rather than big feature requests.\n\n### About V2\n\nThe complexity and difficulty of the v2 version are much higher than anticipated. I can only work on its development during fragmented time periods, and the constant interruptions disrupt productivity significantly. Given this situation, we will continue to optimize and iterate on the current version until we have more free time to proceed with the major version overhaul.\n\nThe concept behind v2 is based on my years of experience and reflection in the cloud-native domain, particularly in K8s and ServiceMesh. Its core is a modernized four-layer and seven-layer proxy, similar to envoy. This proxy itself is highly scalable, not only capable of implementing the functionality of intranet penetration but also applicable to various other domains. Building upon this highly scalable core, we aim to implement all the capabilities of frp v1 while also addressing the functionalities that were previously unachievable or difficult to implement in an elegant manner. Furthermore, we will maintain efficient development and iteration capabilities.\n\nIn addition, I envision frp itself becoming a highly extensible system and platform, similar to how we can provide a range of extension capabilities based on K8s. In K8s, we can customize development according to enterprise needs, utilizing features such as CRD, controller mode, webhook, CSI, and CNI. In frp v1, we introduced the concept of server plugins, which implemented some basic extensibility. However, it relies on a simple HTTP protocol and requires users to start independent processes and manage them on their own. This approach is far from flexible and convenient, and real-world demands vary greatly. It is unrealistic to expect a non-profit open-source project maintained by a few individuals to meet everyone's needs.\n\nFinally, we acknowledge that the current design of modules such as configuration management, permission verification, certificate management, and API management is not modern enough. While we may carry out some optimizations in the v1 version, ensuring compatibility remains a challenging issue that requires a considerable amount of effort to address.\n\nWe sincerely appreciate your support for frp.\n\n## Architecture\n\n![architecture](/doc/pic/architecture.png)\n\n## Example Usage\n\nTo begin, download the latest program for your operating system and architecture from the [Release](https://github.com/fatedier/frp/releases) page.\n\nNext, place the `frps` binary and server configuration file on Server A, which has a public IP address.\n\nFinally, place the `frpc` binary and client configuration file on Server B, which is located on a LAN that cannot be directly accessed from the public internet.\n\nSome antiviruses improperly mark frpc as malware and delete it. This is due to frp being a networking tool capable of creating reverse proxies. Antiviruses sometimes flag reverse proxies due to their ability to bypass firewall port restrictions. If you are using antivirus, then you may need to whitelist/exclude frpc in your antivirus settings to avoid accidental quarantine/deletion. See [issue 3637](https://github.com/fatedier/frp/issues/3637) for more details.\n\n### Access your computer in a LAN network via SSH\n\n1. Modify `frps.toml` on server A by setting the `bindPort` for frp clients to connect to:\n\n  ```toml\n  # frps.toml\n  bindPort = 7000\n  ```\n\n2. Start `frps` on server A:\n\n  `./frps -c ./frps.toml`\n\n3. Modify `frpc.toml` on server B and set the `serverAddr` field to the public IP address of your frps server:\n\n  ```toml\n  # frpc.toml\n  serverAddr = \"x.x.x.x\"\n  serverPort = 7000\n\n  [[proxies]]\n  name = \"ssh\"\n  type = \"tcp\"\n  localIP = \"127.0.0.1\"\n  localPort = 22\n  remotePort = 6000\n  ```\n\nNote that the `localPort` (listened on the client) and `remotePort` (exposed on the server) are used for traffic going in and out of the frp system, while the `serverPort` is used for communication between frps and frpc.\n\n4. Start `frpc` on server B:\n\n  `./frpc -c ./frpc.toml`\n\n5. To access server B from another machine through server A via SSH (assuming the username is `test`), use the following command:\n\n  `ssh -oPort=6000 test@x.x.x.x`\n\n### Multiple SSH services sharing the same port\n\nThis example implements multiple SSH services exposed through the same port using a proxy of type tcpmux. Similarly, as long as the client supports the HTTP Connect proxy connection method, port reuse can be achieved in this way.\n\n1. Deploy frps on a machine with a public IP and modify the frps.toml file. Here is a simplified configuration:\n\n  ```toml\n  bindPort = 7000\n  tcpmuxHTTPConnectPort = 5002\n  ```\n\n2. Deploy frpc on the internal machine A with the following configuration:\n\n  ```toml\n  serverAddr = \"x.x.x.x\"\n  serverPort = 7000\n\n  [[proxies]]\n  name = \"ssh1\"\n  type = \"tcpmux\"\n  multiplexer = \"httpconnect\"\n  customDomains = [\"machine-a.example.com\"]\n  localIP = \"127.0.0.1\"\n  localPort = 22\n  ```\n\n3. Deploy another frpc on the internal machine B with the following configuration:\n\n  ```toml\n  serverAddr = \"x.x.x.x\"\n  serverPort = 7000\n\n  [[proxies]]\n  name = \"ssh2\"\n  type = \"tcpmux\"\n  multiplexer = \"httpconnect\"\n  customDomains = [\"machine-b.example.com\"]\n  localIP = \"127.0.0.1\"\n  localPort = 22\n  ```\n\n4. To access internal machine A using SSH ProxyCommand, assuming the username is \"test\":\n\n  `ssh -o 'proxycommand socat - PROXY:x.x.x.x:%h:%p,proxyport=5002' test@machine-a.example.com`\n\n5. To access internal machine B, the only difference is the domain name, assuming the username is \"test\":\n\n  `ssh -o 'proxycommand socat - PROXY:x.x.x.x:%h:%p,proxyport=5002' test@machine-b.example.com`\n\n### Accessing Internal Web Services with Custom Domains in LAN\n\nSometimes we need to expose a local web service behind a NAT network to others for testing purposes with our own domain name.\n\nUnfortunately, we cannot resolve a domain name to a local IP. However, we can use frp to expose an HTTP(S) service.\n\n1. Modify `frps.toml` and set the HTTP port for vhost to 8080:\n\n  ```toml\n  # frps.toml\n  bindPort = 7000\n  vhostHTTPPort = 8080\n  ```\n\n  If you want to configure an https proxy, you need to set up the `vhostHTTPSPort`.\n\n2. Start `frps`:\n\n  `./frps -c ./frps.toml`\n\n3. Modify `frpc.toml` and set `serverAddr` to the IP address of the remote frps server. Specify the `localPort` of your web service:\n\n  ```toml\n  # frpc.toml\n  serverAddr = \"x.x.x.x\"\n  serverPort = 7000\n\n  [[proxies]]\n  name = \"web\"\n  type = \"http\"\n  localPort = 80\n  customDomains = [\"www.example.com\"]\n  ```\n\n4. Start `frpc`:\n\n  `./frpc -c ./frpc.toml`\n\n5. Map the A record of `www.example.com` to either the public IP of the remote frps server or a CNAME record pointing to your original domain.\n\n6. Visit your local web service using url `http://www.example.com:8080`.\n\n### Forward DNS query requests\n\n1. Modify `frps.toml`:\n\n  ```toml\n  # frps.toml\n  bindPort = 7000\n  ```\n\n2. Start `frps`:\n\n  `./frps -c ./frps.toml`\n\n3. Modify `frpc.toml` and set `serverAddr` to the IP address of the remote frps server. Forward DNS query requests to the Google Public DNS server `8.8.8.8:53`:\n\n  ```toml\n  # frpc.toml\n  serverAddr = \"x.x.x.x\"\n  serverPort = 7000\n\n  [[proxies]]\n  name = \"dns\"\n  type = \"udp\"\n  localIP = \"8.8.8.8\"\n  localPort = 53\n  remotePort = 6000\n  ```\n\n4. Start frpc:\n\n  `./frpc -c ./frpc.toml`\n\n5. Test DNS resolution using the `dig` command:\n\n  `dig @x.x.x.x -p 6000 www.google.com`\n\n### Forward Unix Domain Socket\n\nExpose a Unix domain socket (e.g. the Docker daemon socket) as TCP.\n\nConfigure `frps` as above.\n\n1. Start `frpc` with the following configuration:\n\n  ```toml\n  # frpc.toml\n  serverAddr = \"x.x.x.x\"\n  serverPort = 7000\n\n  [[proxies]]\n  name = \"unix_domain_socket\"\n  type = \"tcp\"\n  remotePort = 6000\n  [proxies.plugin]\n  type = \"unix_domain_socket\"\n  unixPath = \"/var/run/docker.sock\"\n  ```\n\n2. Test the configuration by getting the docker version using `curl`:\n\n  `curl http://x.x.x.x:6000/version`\n\n### Expose a simple HTTP file server\n\nExpose a simple HTTP file server to access files stored in the LAN from the public Internet.\n\nConfigure `frps` as described above, then:\n\n1. Start `frpc` with the following configuration:\n\n  ```toml\n  # frpc.toml\n  serverAddr = \"x.x.x.x\"\n  serverPort = 7000\n\n  [[proxies]]\n  name = \"test_static_file\"\n  type = \"tcp\"\n  remotePort = 6000\n  [proxies.plugin]\n  type = \"static_file\"\n  localPath = \"/tmp/files\"\n  stripPrefix = \"static\"\n  httpUser = \"abc\"\n  httpPassword = \"abc\"\n  ```\n\n2. Visit `http://x.x.x.x:6000/static/` from your browser and specify correct username and password to view files in `/tmp/files` on the `frpc` machine.\n\n### Enable HTTPS for a local HTTP(S) service\n\nYou may substitute `https2https` for the plugin, and point the `localAddr` to a HTTPS endpoint.\n\n1. Start `frpc` with the following configuration:\n\n  ```toml\n  # frpc.toml\n  serverAddr = \"x.x.x.x\"\n  serverPort = 7000\n\n  [[proxies]]\n  name = \"test_https2http\"\n  type = \"https\"\n  customDomains = [\"test.example.com\"]\n\n  [proxies.plugin]\n  type = \"https2http\"\n  localAddr = \"127.0.0.1:80\"\n  crtPath = \"./server.crt\"\n  keyPath = \"./server.key\"\n  hostHeaderRewrite = \"127.0.0.1\"\n  requestHeaders.set.x-from-where = \"frp\"\n  ```\n\n2. Visit `https://test.example.com`.\n\n### Expose your service privately\n\nTo mitigate risks associated with exposing certain services directly to the public network, STCP (Secret TCP) mode requires a preshared key to be used for access to the service from other clients.\n\nConfigure `frps` same as above.\n\n1. Start `frpc` on machine B with the following config. This example is for exposing the SSH service (port 22), and note the `secretKey` field for the preshared key, and that the `remotePort` field is removed here:\n\n  ```toml\n  # frpc.toml\n  serverAddr = \"x.x.x.x\"\n  serverPort = 7000\n\n  [[proxies]]\n  name = \"secret_ssh\"\n  type = \"stcp\"\n  secretKey = \"abcdefg\"\n  localIP = \"127.0.0.1\"\n  localPort = 22\n  ```\n\n2. Start another `frpc` (typically on another machine C) with the following config to access the SSH service with a security key (`secretKey` field):\n\n  ```toml\n  # frpc.toml\n  serverAddr = \"x.x.x.x\"\n  serverPort = 7000\n\n  [[visitors]]\n  name = \"secret_ssh_visitor\"\n  type = \"stcp\"\n  serverName = \"secret_ssh\"\n  secretKey = \"abcdefg\"\n  bindAddr = \"127.0.0.1\"\n  bindPort = 6000\n  ```\n\n3. On machine C, connect to SSH on machine B, using this command:\n\n  `ssh -oPort=6000 127.0.0.1`\n\n### P2P Mode\n\n**xtcp** is designed to transmit large amounts of data directly between clients. A frps server is still needed, as P2P here only refers to the actual data transmission.\n\nNote that it may not work with all types of NAT devices. You might want to fallback to stcp if xtcp doesn't work.\n\n1. Start `frpc` on machine B, and expose the SSH port. Note that the `remotePort` field is removed:\n\n  ```toml\n  # frpc.toml\n  serverAddr = \"x.x.x.x\"\n  serverPort = 7000\n  # set up a new stun server if the default one is not available.\n  # natHoleStunServer = \"xxx\"\n\n  [[proxies]]\n  name = \"p2p_ssh\"\n  type = \"xtcp\"\n  secretKey = \"abcdefg\"\n  localIP = \"127.0.0.1\"\n  localPort = 22\n  ```\n\n2. Start another `frpc` (typically on another machine C) with the configuration to connect to SSH using P2P mode:\n\n  ```toml\n  # frpc.toml\n  serverAddr = \"x.x.x.x\"\n  serverPort = 7000\n  # set up a new stun server if the default one is not available.\n  # natHoleStunServer = \"xxx\"\n\n  [[visitors]]\n  name = \"p2p_ssh_visitor\"\n  type = \"xtcp\"\n  serverName = \"p2p_ssh\"\n  secretKey = \"abcdefg\"\n  bindAddr = \"127.0.0.1\"\n  bindPort = 6000\n  # when automatic tunnel persistence is required, set it to true\n  keepTunnelOpen = false\n  ```\n\n3. On machine C, connect to SSH on machine B, using this command:\n\n  `ssh -oPort=6000 127.0.0.1`\n\n## Features\n\n### Configuration Files\n\nSince v0.52.0, we support TOML, YAML, and JSON for configuration. Please note that INI is deprecated and will be removed in future releases. New features will only be available in TOML, YAML, or JSON. Users wanting these new features should switch their configuration format accordingly.\n\nRead the full example configuration files to find out even more features not described here.\n\nExamples use TOML format, but you can still use YAML or JSON.\n\nThese configuration files is for reference only. Please do not use this configuration directly to run the program as it may have various issues.\n\n[Full configuration file for frps (Server)](./conf/frps_full_example.toml)\n\n[Full configuration file for frpc (Client)](./conf/frpc_full_example.toml)\n\n### Using Environment Variables\n\nEnvironment variables can be referenced in the configuration file, using Go's standard format:\n\n```toml\n# frpc.toml\nserverAddr = \"{{ .Envs.FRP_SERVER_ADDR }}\"\nserverPort = 7000\n\n[[proxies]]\nname = \"ssh\"\ntype = \"tcp\"\nlocalIP = \"127.0.0.1\"\nlocalPort = 22\nremotePort = {{ .Envs.FRP_SSH_REMOTE_PORT }}\n```\n\nWith the config above, variables can be passed into `frpc` program like this:\n\n```\nexport FRP_SERVER_ADDR=x.x.x.x\nexport FRP_SSH_REMOTE_PORT=6000\n./frpc -c ./frpc.toml\n```\n\n`frpc` will render configuration file template using OS environment variables. Remember to prefix your reference with `.Envs`.\n\n### Split Configures Into Different Files\n\nYou can split multiple proxy configs into different files and include them in the main file.\n\n```toml\n# frpc.toml\nserverAddr = \"x.x.x.x\"\nserverPort = 7000\nincludes = [\"./confd/*.toml\"]\n```\n\n```toml\n# ./confd/test.toml\n\n[[proxies]]\nname = \"ssh\"\ntype = \"tcp\"\nlocalIP = \"127.0.0.1\"\nlocalPort = 22\nremotePort = 6000\n```\n\n### Server Dashboard\n\nCheck frp's status and proxies' statistics information by Dashboard.\n\nConfigure a port for dashboard to enable this feature:\n\n```toml\n# The default value is 127.0.0.1. Change it to 0.0.0.0 when you want to access it from a public network.\nwebServer.addr = \"0.0.0.0\"\nwebServer.port = 7500\n# dashboard's username and password are both optional\nwebServer.user = \"admin\"\nwebServer.password = \"admin\"\n```\n\nThen visit `http://[serverAddr]:7500` to see the dashboard, with username and password both being `admin`.\n\nAdditionally, you can use HTTPS port by using your domains wildcard or normal SSL certificate:\n\n```toml\nwebServer.port = 7500\n# dashboard's username and password are both optional\nwebServer.user = \"admin\"\nwebServer.password = \"admin\"\nwebServer.tls.certFile = \"server.crt\"\nwebServer.tls.keyFile = \"server.key\"\n```\n\nThen visit `https://[serverAddr]:7500` to see the dashboard in secure HTTPS connection, with username and password both being `admin`.\n\n![dashboard](/doc/pic/dashboard.png)\n\n### Client Admin UI\n\nThe Client Admin UI helps you check and manage frpc's configuration.\n\nConfigure an address for admin UI to enable this feature:\n\n```toml\nwebServer.addr = \"127.0.0.1\"\nwebServer.port = 7400\nwebServer.user = \"admin\"\nwebServer.password = \"admin\"\n```\n\nThen visit `http://127.0.0.1:7400` to see admin UI, with username and password both being `admin`.\n\n### Monitor\n\nWhen web server is enabled, frps will save monitor data in cache for 7 days. It will be cleared after process restart.\n\nPrometheus is also supported.\n\n#### Prometheus\n\nEnable dashboard first, then configure `enablePrometheus = true` in `frps.toml`.\n\n`http://{dashboard_addr}/metrics` will provide prometheus monitor data.\n\n### Authenticating the Client\n\nThere are 2 authentication methods to authenticate frpc with frps. \n\nYou can decide which one to use by configuring `auth.method` in `frpc.toml` and `frps.toml`, the default one is token.\n\nConfiguring `auth.additionalScopes = [\"HeartBeats\"]` will use the configured authentication method to add and validate authentication on every heartbeat between frpc and frps.\n\nConfiguring `auth.additionalScopes = [\"NewWorkConns\"]` will do the same for every new work connection between frpc and frps.\n\n#### Token Authentication\n\nWhen specifying `auth.method = \"token\"` in `frpc.toml` and `frps.toml` - token based authentication will be used.\n\nMake sure to specify the same `auth.token` in `frps.toml` and `frpc.toml` for frpc to pass frps validation\n\n##### Token Source\n\nfrp supports reading authentication tokens from external sources using the `tokenSource` configuration. Currently, file-based token source is supported.\n\n**File-based token source:**\n\n```toml\n# frpc.toml\nauth.method = \"token\"\nauth.tokenSource.type = \"file\"\nauth.tokenSource.file.path = \"/path/to/token/file\"\n```\n\nThe token will be read from the specified file at startup. This is useful for scenarios where tokens are managed by external systems or need to be kept separate from configuration files for security reasons.\n\n#### OIDC Authentication\n\nWhen specifying `auth.method = \"oidc\"` in `frpc.toml` and `frps.toml` - OIDC based authentication will be used.\n\nOIDC stands for OpenID Connect, and the flow used is called [Client Credentials Grant](https://tools.ietf.org/html/rfc6749#section-4.4).\n\nTo use this authentication type - configure `frpc.toml` and `frps.toml` as follows:\n\n```toml\n# frps.toml\nauth.method = \"oidc\"\nauth.oidc.issuer = \"https://example-oidc-issuer.com/\"\nauth.oidc.audience = \"https://oidc-audience.com/.default\"\n```\n\n```toml\n# frpc.toml\nauth.method = \"oidc\"\nauth.oidc.clientID = \"98692467-37de-409a-9fac-bb2585826f18\" # Replace with OIDC client ID\nauth.oidc.clientSecret = \"oidc_secret\"\nauth.oidc.audience = \"https://oidc-audience.com/.default\"\nauth.oidc.tokenEndpointURL = \"https://example-oidc-endpoint.com/oauth2/v2.0/token\"\n```\n\n### Encryption and Compression\n\nThe features are off by default. You can turn on encryption and/or compression:\n\n```toml\n# frpc.toml\n\n[[proxies]]\nname = \"ssh\"\ntype = \"tcp\"\nlocalPort = 22\nremotePort = 6000\ntransport.useEncryption = true\ntransport.useCompression = true\n```\n\n#### TLS\n\nSince v0.50.0, the default value of `transport.tls.enable` and `transport.tls.disableCustomTLSFirstByte` has been changed to true, and tls is enabled by default.\n\nFor port multiplexing, frp sends a first byte `0x17` to dial a TLS connection. This only takes effect when you set `transport.tls.disableCustomTLSFirstByte` to false.\n\nTo **enforce** `frps` to only accept TLS connections - configure `transport.tls.force = true` in `frps.toml`. **This is optional.**\n\n**`frpc` TLS settings:**\n\n```toml\ntransport.tls.enable = true\ntransport.tls.certFile = \"certificate.crt\"\ntransport.tls.keyFile = \"certificate.key\"\ntransport.tls.trustedCaFile = \"ca.crt\"\n```\n\n**`frps` TLS settings:**\n\n```toml\ntransport.tls.force = true\ntransport.tls.certFile = \"certificate.crt\"\ntransport.tls.keyFile = \"certificate.key\"\ntransport.tls.trustedCaFile = \"ca.crt\"\n```\n\nYou will need **a root CA cert** and **at least one SSL/TLS certificate**. It **can** be self-signed or regular (such as Let's Encrypt or another SSL/TLS certificate provider).\n\nIf you using `frp` via IP address and not hostname, make sure to set the appropriate IP address in the Subject Alternative Name (SAN) area when generating SSL/TLS Certificates.\n\nGiven an example:\n\n* Prepare openssl config file. It exists at `/etc/pki/tls/openssl.cnf` in Linux System and `/System/Library/OpenSSL/openssl.cnf` in MacOS, and you can copy it to current path, like `cp /etc/pki/tls/openssl.cnf ./my-openssl.cnf`. If not, you can build it by yourself, like:\n```\ncat \u003e my-openssl.cnf \u003c\u003c EOF\n[ ca ]\ndefault_ca = CA_default\n[ CA_default ]\nx509_extensions = usr_cert\n[ req ]\ndefault_bits        = 2048\ndefault_md          = sha256\ndefault_keyfile     = privkey.pem\ndistinguished_name  = req_distinguished_name\nattributes          = req_attributes\nx509_extensions     = v3_ca\nstring_mask         = utf8only\n[ req_distinguished_name ]\n[ req_attributes ]\n[ usr_cert ]\nbasicConstraints       = CA:FALSE\nnsComment              = \"OpenSSL Generated Certificate\"\nsubjectKeyIdentifier   = hash\nauthorityKeyIdentifier = keyid,issuer\n[ v3_ca ]\nsubjectKeyIdentifier   = hash\nauthorityKeyIdentifier = keyid:always,issuer\nbasicConstraints       = CA:true\nEOF\n```\n\n* build ca certificates:\n```\nopenssl genrsa -out ca.key 2048\nopenssl req -x509 -new -nodes -key ca.key -subj \"/CN=example.ca.com\" -days 5000 -out ca.crt\n```\n\n* build frps certificates:\n```\nopenssl genrsa -out server.key 2048\n\nopenssl req -new -sha256 -key server.key \\\n    -subj \"/C=XX/ST=DEFAULT/L=DEFAULT/O=DEFAULT/CN=server.com\" \\\n    -reqexts SAN \\\n    -config \u003c(cat my-openssl.cnf \u003c(printf \"\\n[SAN]\\nsubjectAltName=DNS:localhost,IP:127.0.0.1,DNS:example.server.com\")) \\\n    -out server.csr\n\nopenssl x509 -req -days 365 -sha256 \\\n\t-in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \\\n\t-extfile \u003c(printf \"subjectAltName=DNS:localhost,IP:127.0.0.1,DNS:example.server.com\") \\\n\t-out server.crt\n```\n\n* build frpc certificates：\n```\nopenssl genrsa -out client.key 2048\nopenssl req -new -sha256 -key client.key \\\n    -subj \"/C=XX/ST=DEFAULT/L=DEFAULT/O=DEFAULT/CN=client.com\" \\\n    -reqexts SAN \\\n    -config \u003c(cat my-openssl.cnf \u003c(printf \"\\n[SAN]\\nsubjectAltName=DNS:client.com,DNS:example.client.com\")) \\\n    -out client.csr\n\nopenssl x509 -req -days 365 -sha256 \\\n    -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \\\n\t-extfile \u003c(printf \"subjectAltName=DNS:client.com,DNS:example.client.com\") \\\n\t-out client.crt\n```\n\n### Hot-Reloading frpc configuration\n\nThe `webServer` fields are required for enabling HTTP API:\n\n```toml\n# frpc.toml\nwebServer.addr = \"127.0.0.1\"\nwebServer.port = 7400\n```\n\nThen run command `frpc reload -c ./frpc.toml` and wait for about 10 seconds to let `frpc` create or update or remove proxies.\n\n**Note that global client parameters won't be modified except 'start'.**\n\nYou can run command `frpc verify -c ./frpc.toml` before reloading to check if there are config errors.\n\n### Get proxy status from client\n\nUse `frpc status -c ./frpc.toml` to get status of all proxies. The `webServer` fields are required for enabling HTTP API.\n\n### Only allowing certain ports on the server\n\n`allowPorts` in `frps.toml` is used to avoid abuse of ports:\n\n```toml\n# frps.toml\nallowPorts = [\n  { start = 2000, end = 3000 },\n  { single = 3001 },\n  { single = 3003 },\n  { start = 4000, end = 50000 }\n]\n```\n\n### Port Reuse\n\n`vhostHTTPPort` and `vhostHTTPSPort` in frps can use same port with `bindPort`. frps will detect the connection's protocol and handle it correspondingly.\n\nWhat you need to pay attention to is that if you want to configure `vhostHTTPSPort` and `bindPort` to the same port, you need to first set `transport.tls.disableCustomTLSFirstByte` to false.\n\nWe would like to try to allow multiple proxies bind a same remote port with different protocols in the future.\n\n### Bandwidth Limit\n\n#### For Each Proxy\n\n```toml\n# frpc.toml\n\n[[proxies]]\nname = \"ssh\"\ntype = \"tcp\"\nlocalPort = 22\nremotePort = 6000\ntransport.bandwidthLimit = \"1MB\"\n```\n\nSet `transport.bandwidthLimit` in each proxy's configure to enable this feature. Supported units are `MB` and `KB`.\n\nSet `transport.bandwidthLimitMode` to `client` or `server` to limit bandwidth on the client or server side. Default is `client`.\n\n### TCP Stream Multiplexing\n\nfrp supports tcp stream multiplexing since v0.10.0 like HTTP2 Multiplexing, in which case all logic connections to the same frpc are multiplexed into the same TCP connection.\n\nYou can disable this feature by modify `frps.toml` and `frpc.toml`:\n\n```toml\n# frps.toml and frpc.toml, must be same\ntransport.tcpMux = false\n```\n\n### Support KCP Protocol\n\nKCP is a fast and reliable protocol that can achieve the transmission effect of a reduction of the average latency by 30% to 40% and reduction of the maximum delay by a factor of three, at the cost of 10% to 20% more bandwidth wasted than TCP.\n\nKCP mode uses UDP as the underlying transport. Using KCP in frp:\n\n1. Enable KCP in frps:\n\n  ```toml\n  # frps.toml\n  bindPort = 7000\n  # Specify a UDP port for KCP.\n  kcpBindPort = 7000\n  ```\n\n  The `kcpBindPort` number can be the same number as `bindPort`, since `bindPort` field specifies a TCP port.\n\n2. Configure `frpc.toml` to use KCP to connect to frps:\n\n  ```toml\n  # frpc.toml\n  serverAddr = \"x.x.x.x\"\n  # Same as the 'kcpBindPort' in frps.toml\n  serverPort = 7000\n  transport.protocol = \"kcp\"\n  ```\n\n### Support QUIC Protocol\n\nQUIC is a new multiplexed transport built on top of UDP.\n\nUsing QUIC in frp:\n\n1. Enable QUIC in frps:\n\n  ```toml\n  # frps.toml\n  bindPort = 7000\n  # Specify a UDP port for QUIC.\n  quicBindPort = 7000\n  ```\n\n  The `quicBindPort` number can be the same number as `bindPort`, since `bindPort` field specifies a TCP port.\n\n2. Configure `frpc.toml` to use QUIC to connect to frps:\n\n  ```toml\n  # frpc.toml\n  serverAddr = \"x.x.x.x\"\n  # Same as the 'quicBindPort' in frps.toml\n  serverPort = 7000\n  transport.protocol = \"quic\"\n  ```\n\n### Connection Pooling\n\nBy default, frps creates a new frpc connection to the backend service upon a user request. With connection pooling, frps keeps a certain number of pre-established connections, reducing the time needed to establish a connection.\n\nThis feature is suitable for a large number of short connections.\n\n1. Configure the limit of pool count each proxy can use in `frps.toml`:\n\n  ```toml\n  # frps.toml\n  transport.maxPoolCount = 5\n  ```\n\n2. Enable and specify the number of connection pool:\n\n  ```toml\n  # frpc.toml\n  transport.poolCount = 1\n  ```\n\n### Load balancing\n\nLoad balancing is supported by `group`.\n\nThis feature is only available for types `tcp`, `http`, `tcpmux` now.\n\n```toml\n# frpc.toml\n\n[[proxies]]\nname = \"test1\"\ntype = \"tcp\"\nlocalPort = 8080\nremotePort = 80\nloadBalancer.group = \"web\"\nloadBalancer.groupKey = \"123\"\n\n[[proxies]]\nname = \"test2\"\ntype = \"tcp\"\nlocalPort = 8081\nremotePort = 80\nloadBalancer.group = \"web\"\nloadBalancer.groupKey = \"123\"\n```\n\n`loadBalancer.groupKey` is used for authentication.\n\nConnections to port 80 will be dispatched to proxies in the same group randomly.\n\nFor type `tcp`, `remotePort` in the same group should be the same.\n\nFor type `http`, `customDomains`, `subdomain`, `locations` should be the same.\n\n### Service Health Check\n\nHealth check feature can help you achieve high availability with load balancing.\n\nAdd `healthCheck.type = \"tcp\"` or `healthCheck.type = \"http\"` to enable health check.\n\nWith health check type **tcp**, the service port will be pinged (TCPing):\n\n```toml\n# frpc.toml\n\n[[proxies]]\nname = \"test1\"\ntype = \"tcp\"\nlocalPort = 22\nremotePort = 6000\n# Enable TCP health check\nhealthCheck.type = \"tcp\"\n# TCPing timeout seconds\nhealthCheck.timeoutSeconds = 3\n# If health check failed 3 times in a row, the proxy will be removed from frps\nhealthCheck.maxFailed = 3\n# A health check every 10 seconds\nhealthCheck.intervalSeconds = 10\n```\n\nWith health check type **http**, an HTTP request will be sent to the service and an HTTP 2xx OK response is expected:\n\n```toml\n# frpc.toml\n\n[[proxies]]\nname = \"web\"\ntype = \"http\"\nlocalIP = \"127.0.0.1\"\nlocalPort = 80\ncustomDomains = [\"test.example.com\"]\n# Enable HTTP health check\nhealthCheck.type = \"http\"\n# frpc will send a GET request to '/status'\n# and expect an HTTP 2xx OK response\nhealthCheck.path = \"/status\"\nhealthCheck.timeoutSeconds = 3\nhealthCheck.maxFailed = 3\nhealthCheck.intervalSeconds = 10\n```\n\n### Rewriting the HTTP Host Header\n\nBy default frp does not modify the tunneled HTTP requests at all as it's a byte-for-byte copy.\n\nHowever, speaking of web servers and HTTP requests, your web server might rely on the `Host` HTTP header to determine the website to be accessed. frp can rewrite the `Host` header when forwarding the HTTP requests, with the `hostHeaderRewrite` field:\n\n```toml\n# frpc.toml\n\n[[proxies]]\nname = \"web\"\ntype = \"http\"\nlocalPort = 80\ncustomDomains = [\"test.example.com\"]\nhostHeaderRewrite = \"dev.example.com\"\n```\n\nThe HTTP request will have the `Host` header rewritten to `Host: dev.example.com` when it reaches the actual web server, although the request from the browser probably has `Host: test.example.com`.\n\n### Setting other HTTP Headers\n\nSimilar to `Host`, You can override other HTTP request and response headers with proxy type `http`.\n\n```toml\n# frpc.toml\n\n[[proxies]]\nname = \"web\"\ntype = \"http\"\nlocalPort = 80\ncustomDomains = [\"test.example.com\"]\nhostHeaderRewrite = \"dev.example.com\"\nrequestHeaders.set.x-from-where = \"frp\"\nresponseHeaders.set.foo = \"bar\"\n```\n\nIn this example, it will set header `x-from-where: frp` in the HTTP request and `foo: bar` in the HTTP response.\n\n### Get Real IP\n\n#### HTTP X-Forwarded-For\n\nThis feature is for `http` proxies or proxies with the `https2http` and `https2https` plugins enabled.\n\nYou can get user's real IP from HTTP request headers `X-Forwarded-For`.\n\n#### Proxy Protocol\n\nfrp supports Proxy Protocol to send user's real IP to local services.\n\nHere is an example for https service:\n\n```toml\n# frpc.toml\n\n[[proxies]]\nname = \"web\"\ntype = \"https\"\nlocalPort = 443\ncustomDomains = [\"test.example.com\"]\n\n# now v1 and v2 are supported\ntransport.proxyProtocolVersion = \"v2\"\n```\n\nYou can enable Proxy Protocol support in nginx to expose user's real IP in HTTP header `X-Real-IP`, and then read `X-Real-IP` header in your web service for the real IP.\n\n### Require HTTP Basic Auth (Password) for Web Services\n\nAnyone who can guess your tunnel URL can access your local web server unless you protect it with a password.\n\nThis enforces HTTP Basic Auth on all requests with the username and password specified in frpc's configure file.\n\nIt can only be enabled when proxy type is http.\n\n```toml\n# frpc.toml\n\n[[proxies]]\nname = \"web\"\ntype = \"http\"\nlocalPort = 80\ncustomDomains = [\"test.example.com\"]\nhttpUser = \"abc\"\nhttpPassword = \"abc\"\n```\n\nVisit `http://test.example.com` in the browser and now you are prompted to enter the username and password.\n\n### Custom Subdomain Names\n\nIt is convenient to use `subdomain` configure for http and https types when many people share one frps server.\n\n```toml\n# frps.toml\nsubDomainHost = \"frps.com\"\n```\n\nResolve `*.frps.com` to the frps server's IP. This is usually called a Wildcard DNS record.\n\n```toml\n# frpc.toml\n\n[[proxies]]\nname = \"web\"\ntype = \"http\"\nlocalPort = 80\nsubdomain = \"test\"\n```\n\nNow you can visit your web service on `test.frps.com`.\n\nNote that if `subdomainHost` is not empty, `customDomains` should not be the subdomain of `subdomainHost`.\n\n### URL Routing\n\nfrp supports forwarding HTTP requests to different backend web services by url routing.\n\n`locations` specifies the prefix of URL used for routing. frps first searches for the most specific prefix location given by literal strings regardless of the listed order.\n\n```toml\n# frpc.toml\n\n[[proxies]]\nname = \"web01\"\ntype = \"http\"\nlocalPort = 80\ncustomDomains = [\"web.example.com\"]\nlocations = [\"/\"]\n\n[[proxies]]\nname = \"web02\"\ntype = \"http\"\nlocalPort = 81\ncustomDomains = [\"web.example.com\"]\nlocations = [\"/news\", \"/about\"]\n```\n\nHTTP requests with URL prefix `/news` or `/about` will be forwarded to **web02** and other requests to **web01**.\n\n### TCP Port Multiplexing\n\nfrp supports receiving TCP sockets directed to different proxies on a single port on frps, similar to `vhostHTTPPort` and `vhostHTTPSPort`.\n\nThe only supported TCP port multiplexing method available at the moment is `httpconnect` - HTTP CONNECT tunnel.\n\nWhen setting `tcpmuxHTTPConnectPort` to anything other than 0 in frps, frps will listen on this port for HTTP CONNECT requests.\n\nThe host of the HTTP CONNECT request will be used to match the proxy in frps. Proxy hosts can be configured in frpc by configuring `customDomains` and / or `subdomain` under `tcpmux` proxies, when `multiplexer = \"httpconnect\"`.\n\nFor example:\n\n```toml\n# frps.toml\nbindPort = 7000\ntcpmuxHTTPConnectPort = 1337\n```\n\n```toml\n# frpc.toml\nserverAddr = \"x.x.x.x\"\nserverPort = 7000\n\n[[proxies]]\nname = \"proxy1\"\ntype = \"tcpmux\"\nmultiplexer = \"httpconnect\"\ncustomDomains = [\"test1\"]\nlocalPort = 80\n\n[[proxies]]\nname = \"proxy2\"\ntype = \"tcpmux\"\nmultiplexer = \"httpconnect\"\ncustomDomains = [\"test2\"]\nlocalPort = 8080\n```\n\nIn the above configuration - frps can be contacted on port 1337 with a HTTP CONNECT header such as:\n\n```\nCONNECT test1 HTTP/1.1\\r\\n\\r\\n\n```\nand the connection will be routed to `proxy1`.\n\n### Connecting to frps via PROXY\n\nfrpc can connect to frps through proxy if you set OS environment variable `HTTP_PROXY`, or if `transport.proxyURL` is set in frpc.toml file.\n\nIt only works when protocol is tcp.\n\n```toml\n# frpc.toml\nserverAddr = \"x.x.x.x\"\nserverPort = 7000\ntransport.proxyURL = \"http://user:pwd@192.168.1.128:8080\"\n```\n\n### Port range mapping\n\n*Added in v0.56.0*\n\nWe can use the range syntax of Go template combined with the built-in `parseNumberRangePair` function to achieve port range mapping.\n\nThe following example, when run, will create 8 proxies named `test-6000, test-6001 ... test-6007`, each mapping the remote port to the local port.\n\n```\n{{- range $_, $v := parseNumberRangePair \"6000-6006,6007\" \"6000-6006,6007\" }}\n[[proxies]]\nname = \"tcp-{{ $v.First }}\"\ntype = \"tcp\"\nlocalPort = {{ $v.First }}\nremotePort = {{ $v.Second }}\n{{- end }}\n```\n\n### Client Plugins\n\nfrpc only forwards requests to local TCP or UDP ports by default.\n\nPlugins are used for providing rich features. There are built-in plugins such as `unix_domain_socket`, `http_proxy`, `socks5`, `static_file`, `http2https`, `https2http`, `https2https` and you can see [example usage](#example-usage).\n\nUsing plugin **http_proxy**:\n\n```toml\n# frpc.toml\n\n[[proxies]]\nname = \"http_proxy\"\ntype = \"tcp\"\nremotePort = 6000\n[proxies.plugin]\ntype = \"http_proxy\"\nhttpUser = \"abc\"\nhttpPassword = \"abc\"\n```\n\n`httpUser` and `httpPassword` are configuration parameters used in `http_proxy` plugin.\n\n### Server Manage Plugins\n\nRead the [document](/doc/server_plugin.md).\n\nFind more plugins in [gofrp/plugin](https://github.com/gofrp/plugin).\n\n### SSH Tunnel Gateway\n\n*added in v0.53.0*\n\nfrp supports listening to an SSH port on the frps side and achieves TCP protocol proxying through the SSH -R protocol, without relying on frpc.\n\n```toml\n# frps.toml\nsshTunnelGateway.bindPort = 2200\n```\n\nWhen running `./frps -c frps.toml`, a private key file named `.autogen_ssh_key` will be automatically created in the current working directory. This generated private key file will be used by the SSH server in frps.\n\nExecuting the command\n\n```bash\nssh -R :80:127.0.0.1:8080 v0@{frp address} -p 2200 tcp --proxy_name \"test-tcp\" --remote_port 9090\n```\n\nsets up a proxy on frps that forwards the local 8080 service to the port 9090.\n\n```bash\nfrp (via SSH) (Ctrl+C to quit)\n\nUser:\nProxyName: test-tcp\nType: tcp\nRemoteAddress: :9090\n```\n\nThis is equivalent to:\n\n```bash\nfrpc tcp --proxy_name \"test-tcp\" --local_ip 127.0.0.1 --local_port 8080 --remote_port 9090\n```\n\nPlease refer to this [document](/doc/ssh_tunnel_gateway.md) for more information.\n\n### Virtual Network (VirtualNet)\n\n*Alpha feature added in v0.62.0*\n\nThe VirtualNet feature enables frp to create and manage virtual network connections between clients and visitors through a TUN interface. This allows for IP-level routing between machines, extending frp beyond simple port forwarding to support full network connectivity.\n\nFor detailed information about configuration and usage, please refer to the [VirtualNet documentation](/doc/virtual_net.md).\n\n## Feature Gates\n\nfrp supports feature gates to enable or disable experimental features. This allows users to try out new features before they're considered stable.\n\n### Available Feature Gates\n\n| Name | Stage | Default | Description |\n|------|-------|---------|-------------|\n| VirtualNet | ALPHA | false | Virtual network capabilities for frp |\n\n### Enabling Feature Gates\n\nTo enable an experimental feature, add the feature gate to your configuration:\n\n```toml\nfeatureGates = { VirtualNet = true }\n```\n\n### Feature Lifecycle\n\nFeatures typically go through three stages:\n1. **ALPHA**: Disabled by default, may be unstable\n2. **BETA**: May be enabled by default, more stable but still evolving\n3. **GA (Generally Available)**: Enabled by default, ready for production use\n\n## Related Projects\n\n* [gofrp/plugin](https://github.com/gofrp/plugin) - A repository for frp plugins that contains a variety of plugins implemented based on the frp extension mechanism, meeting the customization needs of different scenarios.\n* [gofrp/tiny-frpc](https://github.com/gofrp/tiny-frpc) - A lightweight version of the frp client (around 3.5MB at minimum) implemented using the ssh protocol, supporting some of the most commonly used features, suitable for devices with limited resources.\n\n## Contributing\n\nInterested in getting involved? We would like to help you!\n\n* Take a look at our [issues list](https://github.com/fatedier/frp/issues) and consider sending a Pull Request to **dev branch**.\n* If you want to add a new feature, please create an issue first to describe the new feature, as well as the implementation approach. Once a proposal is accepted, create an implementation of the new features and submit it as a pull request.\n* Sorry for my poor English. Improvements for this document are welcome, even some typo fixes.\n* If you have great ideas, send an email to fatedier@gmail.com.\n\n**Note: We prefer you to give your advise in [issues](https://github.com/fatedier/frp/issues), so others with a same question can search it quickly and we don't need to answer them repeatedly.**\n\n## Donation\n\nIf frp helps you a lot, you can support us by:\n\n### GitHub Sponsors\n\nSupport us by [Github Sponsors](https://github.com/sponsors/fatedier).\n\nYou can have your company's logo placed on README file of this project.\n\n### PayPal\n\nDonate money by [PayPal](https://www.paypal.me/fatedier) to my account **fatedier@gmail.com**.\n","funding_links":["https://github.com/sponsors/fatedier","https://afdian.com/a/fatedier","https://www.paypal.me/fatedier"],"categories":["HarmonyOS","Go","开源类库","Misc","软硬件功能","\u003ca id=\"1a9934198e37d6d06b881705b863afc8\"\u003e\u003c/a\u003e通信\u0026\u0026代理\u0026\u0026反向代理\u0026\u0026隧道","Repositories","proxy","Proxy","内网穿透","Open source library","Network","Networking","Uncategorized","Go (531)","\u003ca id=\"01e6651181d405ecdcd92a452989e7e0\"\u003e\u003c/a\u003e工具","语言资源库","Test tools","go","💻 软件","DDNS","Tunneling","工具推荐"],"sub_categories":["Windows Manager","网络","内网穿透","\u003ca id=\"a136c15727e341b9427b6570910a3a1f\"\u003e\u003c/a\u003e反向代理\u0026\u0026穿透","The Internet","Kubernetes","Uncategorized","\u003ca id=\"8ea8f890cf767c3801b5e7951fca3570\"\u003e\u003c/a\u003e公网访问局域网","go","frp (Fast Reverse Proxy)"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffatedier%2Ffrp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffatedier%2Ffrp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffatedier%2Ffrp/lists"}