# 1. What NAT traversal is, and how to do it Because public IP addresses are limited, and because of firewalls and the like, most of our IoT devices and private servers don't have public IP addresses. That means they can't be accessed directly from the outside network. Only public cloud providers, or users with dedicated lines, usually get a limited number of independent public IPs. In that situation, if we want to provide network services from a personal computer or private server, or if we need to access and manage our IoT devices from the public internet, we need NAT traversal. That way, services provided by our servers and IoT devices—file sharing, FTP, websites, SSH remote management, and so on—can pass through the firewall and be reached from the public network. There are quite a few ways to make cross-network access work: - If all you need is remote management of a Windows desktop, you can use TeamViewer, though it's commercial software and comes with plenty of limits - You can also use commercial tools like Oray's SD-WAN/VPN products or other VPN software to build a VPN and access things through a virtual local network - You can use the NAT traversal feature from commercial software like Peanut Shell, but it's expensive and still pretty limited - Or you can build your own NAT traversal server with open-source tools like ngrok or frp. Since ngrok stopped being open source after version 2, I'm using the more popular frp here. To make NAT traversal work, you need a server with a public IP address. With cloud server prices continuing to fall, getting a small low-spec cloud server isn't hard for an individual anymore, and it costs much less than commercial software like Peanut Shell. Everything below assumes you have a public cloud server with a fixed IP address and another server inside a local network. The cloud server runs Ubuntu 18.04. The local private server runs Windows 10. To simulate a few more scenarios, the local server also runs Ubuntu 18.04 through WSL. The topology looks like this: ![](https://lxunzzzdnokdqhipbmdf.supabase.co/storage/v1/object/public/media/wp-backup/2022/09/frps1.png) # 2. Installing frp and basic configuration Installing and configuring frp is simple. Download the precompiled binary you need from the [official frp project page](https://github.com/fatedier/frp) (or from our [domestic frp mirror](https://www.wesinx.cn:30443/weizy0219/frp)) on the releases page. One thing to note: the downloaded package includes both the server, `frps`, and the client, `frpc`. On the server side you only need to start `frps`; on the client side you only need to start `frpc`. The operations on the server and client are as follows. Because cloud providers usually restrict server ports, and to make sure the later configuration goes smoothly, you should open the following ports in the cloud server's security group. If you later provide other services, open more ports as needed. If the server itself also has a firewall enabled, you'll need to allow these ports there too: - `7000` for data exchange between the frp server and client - `8000` for HTTP service - `7019~7021` for passive FTP service - `7022` for SSH remote management - `7389` for Windows Remote Desktop In the examples below, I'll assume the cloud server IP is `123.123.123.123`. In real use, replace that with your actual IP. I'll also assume you already have a domain, `www.domain.cc`, pointing to `123.123.123.123` via an A record, so the examples use the domain instead of the IP. The nice part is that if you replace the server later, you won't have to edit the IP on every client again. ## 2.1 Install and configure frp on the server (`frps`) After connecting to the cloud server over SSH, download and install `frps` with the following commands: ```bash # Download the package wget https://github.com/fatedier/frp/releases/download/v0.34.3/frp_0.34.3_linux_amd64.tar.gz # Extract it tar -xvf frp_0.34.3_linux_amd64.tar.gz # Open the extracted frps.ini with nano or vim and add this minimal config for testing # frps.ini [common] bind_port = 7000 # Start frps ./frps -c ./frps.ini ``` This startup method is only for debugging. Once you disconnect the SSH session, the service will stop automatically. I'll cover auto-start on both server and client later. ## 2.2 Install and access frp on a Windows client (`frpc`) Download the Windows client package and extract it, then open `frpc.ini` and configure it. - In `server_addr`, you can enter either the domain or the IP. Here I'm using the domain - To test things, Windows needs Remote Desktop enabled. In File Explorer, right-click **This PC** and choose **Manage**, then go to **Advanced system settings** → **Remote** → **Allow remote connections to this computer**. This only exists on Windows 10 Pro and above. Home edition doesn't have it, so if you're on Home, you can test later with an FTP server instead ```ini # frpc.ini [common] server_addr = www.domain.cc server_port = 7000 [rdp] type = tcp local_ip = 127.0.0.1 local_port = 3389 remote_port = 7389 ``` Open `Windows PowerShell` in the current directory and run the following command to start the client. If the connection to the server succeeds, you'll see `start proxy successful`: ```powershell > .\frpc.exe -c .\frpc.ini ``` On a third computer, press `Win + R` to open the Run dialog, type `mstsc`, then enter `www.domain.cc:7389`. After entering the username and password of the computer running `frpc`, you can remotely open and manage that Windows machine. So under these conditions, the third computer reaches the Windows client's port `3389` through port `7389` on the public cloud server. That's Windows port forwarding through NAT, done. ## 2.3 Install and access frp on a Linux client (`frpc`) Next, install the frp client inside the WSL subsystem on the Windows 10 server—or on a standalone Linux system, that works too. One thing to watch out for: Ubuntu under Windows 10 does not enable remote root SSH login by default, so you need to set that up first. ```bash # Open the ssh config file sudo nano /etc/ssh/sshd_config # Modify the following lines, then save: Port = 22 # remove the leading # to enable port 22 ListenAddress 0.0.0.0 # remove the leading # PasswordAuthentication yes # change no to yes to allow password login PermitRootLogin yes # allow remote root login # Restart sshd: dpkg-reconfigure openssh-server # used to install RSA_KEY, choose keep old config... sudo service ssh restart # restart SSH service sudo service ssh status # check SSH service status, it should be running ``` Then run the following commands to download, configure, and start the frp client: ```bash # Download the package wget https://github.com/fatedier/frp/releases/download/v0.34.3/frp_0.34.3_linux_amd64.tar.gz # Extract it tar -xvf frp_0.34.3_linux_amd64.tar.gz # Open the extracted frpc.ini with nano or vim and configure SSH # frpc.ini [common] server_addr = www.domain.cc server_port = 7000 [ssh] type = tcp local_ip = 127.0.0.1 local_port = 22 remote_port = 7022 # Start frpc ./frpc -c ./frpc.ini ``` From a third computer, run `ssh -p 7022 root@www.domain.cc`. Enter the password, and you'll be able to access the Linux host over SSH—in this case, the WSL subsystem on the Windows server. # 3. Notes on the frp configuration files In the extracted package, you'll find two example files: `frpc_full.ini` and `frps_full.ini`. They cover configuration for most features. The frp website also provides lots of [configuration examples](https://github.com/fatedier/frp#oidc-authentication), which are worth using as reference. ## 3.1 Encrypt frp with a token The frp setup described above is not safe. Without encryption, anyone can use your frp server for NAT traversal. To deal with that, frp supports token and OpenID authentication. If you want to use token authentication, just add the same token entry to both the server-side `frps.ini` and the client-side `frpc.ini`. ```ini # frps.ini [common] authentication_method = token token = 12345678 # frpc.ini [common] token = 12345678 ``` You can also use environment variables instead of putting passwords in plaintext in the config file. For example: ```ini # frpc.ini [common] server_addr = {{ .Envs.FRP_SERVER_ADDR }} server_port = 7000 [ssh] type = tcp local_ip = 127.0.0.1 local_port = 22 remote_port = {{ .Envs.FRP_SSH_REMOTE_PORT }} ``` ## 3.2 Configure the HTTP port and domain service On the server side, configure the HTTP service port and virtual host domain like this: ```ini # frps.ini [common] # HTTP service port vhost_http_port = 8000 # After setting the host domain, clients can configure subdomains for access subdomain_host = domain.com ``` If the client wants to configure an HTTP subdomain, use this setup. Then `test.domain.com:8000` will reach port `80` on the client machine: ```ini # frpc.ini [web] type = http local_port = 80 subdomain = test ``` If the client wants to use its own domain instead, use this setup, and point `www.mydomain.com` to the server IP. Then `www.mydomain.com:8000` will reach port `80` on the client machine: ```ini [web] type = http local_port = 80 custom_domains = www.mydomain.com ``` ## 3.3 Configure FTP service (passive mode for an internal FTP server) If you're running an `ftp` server inside a local network, you need passive mode so outside FTP clients can get through the firewall. Using `FileZilla Server` as an example: during server setup, configure passive mode like this. In this example, the FTP server uses port `21`, and the passive ports are defined as `7018~7020`. ![](https://lxunzzzdnokdqhipbmdf.supabase.co/storage/v1/object/public/media/wp-backup/2022/09/frps2.png) Then configure the client like this. `ftp` is for the FTP service itself, while `ftp1~3` are for the passive ports. After this, you can use port `7021` to access port `21` on the client: ```ini [ftp] type = tcp local_ip = 127.0.0.1 local_port = 21 remote_port = 7021 [ftp1] type = tcp local_ip = 127.0.0.1 local_port = 7018 remote_port = 7018 [ftp2] type = tcp local_ip = 127.0.0.1 local_port = 7019 remote_port = 7019 [ftp3] type = tcp local_ip = 127.0.0.1 local_port = 7020 remote_port = 7020 ``` ## 3.4 Configure the management page frp comes with a built-in management page. To enable the server-side management page, configure the `dashboard` parameters. After the following setup, you can visit port `7500` on the frp server and manage `frps` with the username and password you set. ```ini # frps.ini [common] dashboard_port = 7500 dashboard_user = admin dashboard_pwd = admin ``` If you want to manage and configure client parameters, add the following to `frpc.ini`. After that, you can manage the frp client locally on port `7400` on the client machine. ```ini # frpc.ini [common] admin_addr = 127.0.0.1 admin_port = 7400 admin_user = admin admin_pwd = admin ``` # 4. Make frp start automatically at boot ## 4.1 Configure `frps` as a system service under Ubuntu with systemd Newer Ubuntu systems use `systemd` to manage services instead of the old `init`. For a beginner-friendly introduction to `systemd`, you can refer to [this article by Ruan Yifeng](http://www.ruanyifeng.com/blog/2016/03/systemd-tutorial-commands.html). To configure `frps` as a system service, do the following: ```bash # 1. Create /usr/frp and copy frps and frps.ini into it. This just makes the later steps easier. # 2. Create frps.service under /lib/systemd/system/ and write the following content. [Unit] Description=Frp Server Service After=network.target [Service] Type=simple User=root Restart=on-failure RestartSec=5s ExecStart=/usr/frp/frps -c /usr/frp/frps.ini [Install] WantedBy=multi-user.target # After that, use systemctl to manage the frps service sudo systemctl enable frps.service # enable auto-start at boot, creates symlink based on Install sudo systemctl disable frps.service # disable auto-start, removes symlink sudo systemctl daemon-reload # reload config after modifying systemd settings systemctl status frps # check frps service status systemctl cat frps # view frps service config sudo systemctl start frps # start frps sudo systemctl stop frps # stop frps ``` ## 4.2 Configure `frpc` to start automatically on Windows with Task Scheduler Using a batch file and Task Scheduler to start a program is standard Windows practice. Create a new batch file named `start.bat` in the `frp` directory: ```bat @echo off :home frpc -c frpc.ini goto home ``` This script automatically restarts the service if it stops—once `frpc` exits, it jumps back to `home` and starts again. A simple way is to create a shortcut to this script and place it in: `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp` That will make it start at boot, but a command window will pop up every time Windows starts. So using Task Scheduler is cleaner. Search for **Task Scheduler** and open it. Create a new basic task. On the **General** tab, the name can be anything. Set it to run whether the user is logged in or not, check **Run with highest privileges**, and choose **Hidden**. On the **Triggers** tab, choose **At startup**. On the **Actions** tab, create a new action: point **Program/script** to `start.bat`, and set **Start in** to the script directory. Once the task is configured, the system will run it automatically at boot. ![](https://lxunzzzdnokdqhipbmdf.supabase.co/storage/v1/object/public/media/wp-backup/2022/09/frp3.png) ![](https://lxunzzzdnokdqhipbmdf.supabase.co/storage/v1/object/public/media/wp-backup/2022/09/frp4.png) ![](https://lxunzzzdnokdqhipbmdf.supabase.co/storage/v1/object/public/media/wp-backup/2022/09/frp5.png) ## 4.3 Register frp as a Windows service with `WinSW` for auto-start `WinSW` is a tool that can register almost any Windows program as a Windows service. [[Download WinSW]](https://github.com/winsw/winsw/releases/download/v3.0.0-alpha.7/WinSW-x86.exe) and save it in the frp directory. For convenience, rename `WinSW` to `myfrpc.exe`, then create a `myfrpc.xml` file in the same directory with the following content: ```xml frpc Frpc This service runs frp client system with configuration D:\services\frp\frpc.exe -c frpc.ini ``` Here, `executable` points to the location of `frpc.exe`, and `arguments` are the startup parameters. `onfailure` gives it two chances to restart so the service has a better shot at coming up normally. Run `myfrpc.exe`—that is, the renamed `winsw.exe`—from the command line to manage the service: ```bash ./myfrpc.exe install # register the service; winsw will automatically find the xml file in the same directory ./myfrpc.exe uninstall # remove the service ./myfrpc.exe start # start the service ./myfrpc.exe stop # stop the service ./myfrpc.exe status # check service status ./myfrpc.exe restart # restart the service ``` That registers `frpc` as a Windows system service, and you can see it in the Services tab of Windows Task Manager.