FRP NAT Traversal: Local Service Without Port Forwarding

Yes, you can expose a local service behind NAT to the internet using FRP (Fast Reverse Proxy) without configuring port forwarding on your router. FRP achieves this by establishing an outbound connection from your internal machine to a public server with a public IP, then tunneling inbound traffic through that connection. This article explains how FRP works, how to set it up, and what to consider when using it.

Background: Why Port Forwarding Is a Problem

Traditional port forwarding requires you to log into your router’s admin panel, find the port forwarding section, and map an external port to an internal IP and port. This fails in several common situations:

• Your ISP uses Carrier-Grade NAT (CGNAT), meaning your “public” IP is actually shared and not reachable from the internet.
• You don’t have admin access to the router (e.g., office or dorm network).
• Your public IP changes frequently, making the forwarded port unreliable.
• You want to expose a service on a device that is not on your main LAN (e.g., a cellular hotspot).

FRP solves these by using a relay server with a public IP. The internal machine (FRP client) initiates a connection to the relay server (FRP server), and the relay server forwards traffic between the internet and your internal service. Because the connection is outbound, no router configuration is needed.

How FRP Works: The Tunnel Explained

FRP consists of two components:

• frps – runs on a public server (VPS, cloud instance). It listens on a port (default 7000) for client connections and also on a public port (e.g., 8080) for incoming user traffic.
• frpc – runs on the internal machine. It connects to frps and registers a tunnel for a local service (e.g., a web server on port 80).

When a user visits http://your-server-ip:8080, frps forwards that request through the already-established connection to frpc, which then sends it to the local service. The response travels back the same way. This is a form of reverse tunneling, similar to how SSH reverse tunnels work, but FRP is more flexible and supports multiple protocols (TCP, UDP, HTTP, HTTPS) and features like load balancing and authentication.

Setting Up FRP: Step-by-Step

Here is a minimal configuration to expose a local web server on port 80 via a public server at example.com.

1. Download FRP – Get the latest release from the official GitHub repository (github.com/fatedier/frp) for your operating systems (Linux, Windows, macOS).
2. Configure frps – On your public server, create a file frps.toml (or frps.ini in older versions) with:

   bindPort = 7000

   Then run ./frps -c frps.toml.

3. Configure frpc – On your internal machine, create frpc.toml:

   serverAddr = "example.com"
   serverPort = 7000
   
   [[proxies]]
   name = "web"
   type = "tcp"
   localIP = "127.0.0.1"
   localPort = 80
   remotePort = 8080

   Then run ./frpc -c frpc.toml.

4. Test – Visit http://example.com:8080. You should see your local web server’s content.

If you want to use a domain name with HTTP, you can set type = "http" and use customDomains instead of remotePort, which allows multiple domains on the same port.

Choosing a Relay Server and Security Considerations

The relay server is the most critical piece. It must have a public IP and be reachable from both the internet and your internal machine. Options include:

• A cheap VPS from providers like DigitalOcean, Linode, or AWS Lightsail (but you must check their terms; some block proxy services).
• A free tier from cloud providers (e.g., Oracle Cloud Free Tier) – but be aware of limited bandwidth.
• A home server with a static IP (but then you could just port forward).

Security is paramount because you are exposing your internal service to the internet. Always:

• Use strong authentication: set auth.token in both frps and frpc to a long random string.
• Use TLS encryption: set transport.tls.enable = true in frpc.
• Limit exposure: only expose the specific port, not the entire machine.
• Consider using a firewall on the relay server to allow only the necessary ports.
• If the service itself has no authentication, add one (e.g., HTTP Basic Auth) or use FRP’s built-in HTTP auth for web services.

Common Problems and How to Fix Them

Here are typical issues you might encounter:

• Connection refused – frpc cannot reach frps. Check that the server port (7000) is open in the server’s firewall and that the server is running.
• Remote port already in use – The remotePort is already taken on the relay server. Choose another port or use HTTP type with domains.
• Slow performance – FRP adds overhead. If you need high throughput, consider using a dedicated tunnel protocol like WireGuard, but FRP is fine for most web services.
• Client disconnects – Network instability. FRP has automatic reconnect, but you can also use a process manager like systemd to restart frpc if it crashes.
• CGNAT issues – Even with FRP, if your ISP blocks outbound connections on certain ports, you may need to change the frps port to something like 443 (HTTPS) to avoid filtering.

Alternatives to FRP

FRP is not the only tool for NAT traversal without port forwarding. Other popular options include:

• ngrok – A commercial service with a free tier that provides a public URL to your local server. It’s easier to set up but less customizable and may have bandwidth limits.
• Cloudflare Tunnel – Uses Cloudflare’s edge network to expose your service via a domain. Requires a domain and Cloudflare account, but offers DDoS protection and no open ports on your router.
• Tailscale – A mesh VPN that creates a private network between your devices. It doesn’t expose your service to the public internet by default, but you can use it to access your local service remotely from your own devices.
• SSH Reverse Tunnel – A simple one-off solution: ssh -R 8080:localhost:80 user@server. Works but lacks FRP’s features like multiple proxies and automatic reconnect.

Costs and Performance Considerations

FRP itself is free and open-source. The main cost is the relay server. A basic VPS with 1GB RAM and 1TB bandwidth typically costs a few dollars per month, but prices vary. Free tiers exist but may have limited uptime or bandwidth. Performance depends on the relay server’s bandwidth and latency. If the relay server is far from your users, latency will increase. For high-traffic services, you should consider a CDN or a dedicated tunnel service with a global network.

Frequently Asked Questions

Is FRP safe to expose my home server?

It can be, if you follow security best practices: use strong authentication, enable TLS, and keep the software updated. Exposing any service to the internet increases risk, so only expose what is necessary and consider putting the service in a DMZ or container.

Can I use FRP with a dynamic IP on the relay server?

Yes, as long as the relay server has a domain name that resolves to its current IP. You can use a dynamic DNS service to update the domain, and frpc will connect to the domain name instead of a static IP.

Does FRP work with UDP services like game servers?

Yes, FRP supports UDP proxies. Set type = "udp" in the proxy configuration. However, UDP tunneling can have higher latency, and some games may not work well due to packet loss.

What is the difference between FRP and a VPN?

A VPN (like WireGuard or OpenVPN) creates a secure network between devices, allowing you to access your local network as if you were on it. FRP exposes a specific service to the public internet. VPNs are more secure for private access, while FRP is for making a service publicly available.

Can I expose multiple services with one FRP client?

Yes, you can define multiple [[proxies]] sections in frpc.toml, each with a different name and remote port or domain. This is a key advantage over simple SSH tunnels.

What if my ISP blocks inbound connections on port 80?

FRP does not require inbound connections on your home router, so this is not an issue. The relay server handles the inbound traffic on its own ports, which you can choose (e.g., 8080 or 443).

Related

• Stellar Phoenix Mac Data Recovery Alternatives
• AI Benchmark Scores: What They Really Tell You
• Use Raspberry Pi Improve? 7 Practical Ways