fatedier/frp

frp is a self-hosted reverse proxy for reaching services that sit behind NAT or a firewall. You run frps on a machine with a public IP and frpc next to the private service; the client keeps a tunnel open to the server, which forwards inbound traffic to the internal port or socket. It handles TCP and UDP as well as HTTP and HTTPS, and can forward to a domain name with virtual hosts. The upside over a hosted tunnel service is that the data path goes through infrastructure you control. The project supports TOML, YAML and JSON configs; INI is deprecated and new features only arrive in the other formats (configuration docs).

What a real setup looks like

Both binaries come from the release page for your OS and architecture (example usage). The server config sets a client bindPort and, for web traffic, vhostHTTPPort/vhostHTTPSPort; the client config lists proxies with a local target and a remote port or custom domain. A typical SSH example maps local port 22 to remote port 6000, then connects with ssh -oPort=6000 user@server-ip. The same pattern covers UDP DNS forwarding, Unix domain sockets, static file serving and HTTPS termination.

Enhancements are mostly per-proxy: token or OIDC authentication between client and server, optional TLS, encryption and compression, bandwidth limits, health checks, load-balancing groups, connection pooling, and TCP or QUIC transport. There are also STCP and xtcp modes: STCP requires a shared key and a separate visitor config instead of a public remote port, while xtcp attempts direct client-to-client transfer but may fail on some NAT types, in which case the docs suggest falling back to STCP. The frps server needs to stay reachable at a fixed address; the private machine only needs an outbound connection.

Operational details worth knowing

• The dashboard and client admin UI are optional; metricsServer provides /healthz and Prometheus metrics on a separate listener (monitoring docs). /healthz only proves the HTTP server responds, not that a client is connected or proxies are ready.
• Proxies can be changed at runtime through the Store/API and persist to a file, and frpc reload applies config changes — but global client parameters other than start are not modified (hot-reload docs).
• Some antivirus products quarantine frpc because reverse proxies can bypass firewall port restrictions; the README points to an issue for whitelisting guidance (issue 3637).
• frp is still developed as version 1. The maintainer says a planned v2 would not be compatible with version 1 and has been slowed by limited time; v1 remains the version to use for now (development status).

Fit

frp suits operators who can supply their own public server and want a configurable tunnel for SSH, databases, web apps or file transfer without a hosted tunnel service. It is less appropriate if you cannot run a public relay or cannot manage the security posture of a publicly reachable endpoint; the docs themselves describe exposure risks and point to STCP and HTTP Basic Auth as mitigations.