frp Reachability and Control

Overview

frp turns an outbound connection from a private-side frpc into selected reachability through a public frps rendezvous. The series follows login and work-connection allocation, compares TCP/UDP, HTTP(S), tcpmux, and private visitor contracts, then examines multiplexing, pools, health feedback, and XTCP’s conditional NAT traversal. It separates registration, proxy admission, audience, confidentiality, and operations, and places the SSH gateway, alpha VirtualNet, and v2 vision in context. The inspected 0.71.0 repository supports deliberate trade-offs, not universal speed, NAT success, VPN behavior, or deployment safety.

Learning outcomes

frp exposes selected private services through an owned outbound client relationship, not an entire private network by default.
Exposure modes should match protocol semantics and audience: raw ports, HTTP routes, shared listeners, or authorized visitors have different surfaces.
Multiplexing, pools, limits, and health checks trade setup cost, shared failure scope, reserved capacity, and measured availability.
XTCP can move payloads directly when NAT conditions allow, but coordination, authorization, fallback, and deployment limits remain.

Keywords

frpReachabilityNATfrpsfrpcXTCPSTCPMultiplexingTLSVirtualNet

Chapters

frp’s Reachability Model

A public entry point without automatic private-network routing

9 min · A public entry point without automatic private-network routing

9 min

frp Tunnel Lifecycle

How login becomes request-specific work

9 min · How login becomes request-specific work

9 min

frp Exposure Modes

Match protocol meaning to the smallest audience

8 min · Match protocol meaning to the smallest audience

8 min

frp Performance and Health

Balance streams, pools, transport, and failure scope

9 min · Balance streams, pools, transport, and failure scope

9 min

frp XTCP and NAT Hole Punching

Direct payload with coordination and relay fallback

10 min · Direct payload with coordination and relay fallback

10 min

Securing and Operating frp

Separate identity, access, confidentiality, and control

11 min · Separate identity, access, confidentiality, and control

11 min

frp Programmable Reachability

A design model for paths, audiences, controls, and extensions

9 min · A design model for paths, audiences, controls, and extensions

9 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans

Ch.1-3 FreeCh.4-7 Premium

FAQ

What does frp actually make reachable?

frp makes a configured private service reachable through a public frps rendezvous; it does not automatically route an entire private network or replace a VPN.

Is frp traffic always relayed through frps?

No. Ordinary modes relay payloads through frps, while XTCP can attempt a direct KCP or QUIC path between clients; coordination and authorization still use frps, and fallback may be needed.

How should an frp exposure mode be chosen?

Choose TCP or UDP for opaque transport, HTTP or HTTPS for host-and-path routing, tcpmux for named services sharing a listener, and STCP for an authorized visitor without an ordinary public port.

Does frp authentication protect application data?

No. Registration authentication identifies an frpc session; TLS, control-channel AEAD, per-proxy protection, visitor secrets, and application authentication cover different boundaries.