frp is a fast reverse proxy written in Go that exposes a local server behind a NAT or firewall to the internet, built for operators and developers who need inbound access to machines they cannot port-forward.

What it is

frp is a reverse proxy that creates a tunnel from a machine on a private network to a host with a public, reachable address. The client runs next to the internal service, the server runs where inbound traffic can arrive, and requests travel through the tunnel to the internal service. It supports TCP and UDP transport as well as the HTTP and HTTPS protocols, which allows requests to be forwarded to internal services by domain name. A P2P connect mode is also available. The project is written in Go and released under Apache-2.0, with 109,502 stars, 15,213 forks and 48 open issues at the time of writing.

The concrete problem it solves is reachability. Internal services behind NAT or a firewall normally require either a router port-forwarding rule, a dedicated public IP, or a VPN before anything outside the network can connect. frp replaces those arrangements with an outbound tunnel: the internal host dials out, and frp fans inbound connections back down that tunnel. That covers cases such as reaching a workstation over SSH, publishing an internal web service on a custom domain, or forwarding DNS queries and Unix domain sockets to services that were never designed to face the internet directly.

Key capabilities

• Protocol coverage spans TCP, UDP, HTTP and HTTPS, with domain-name forwarding and a P2P connect mode for reaching peers directly.
• Multiple transports are supported, including KCP, QUIC, TCP stream multiplexing and connection pooling, so the tunnel can trade latency against reliability.
• Several internal services can share a single exposed port, demonstrated in the README by multiple SSH services sharing the same port, alongside port reuse and load balancing.
• Authentication supports token authentication and OIDC authentication.
• Operational surfaces include a server dashboard, a client admin UI, dynamic proxy management (the store), Prometheus monitoring and proxy status retrieval from the client.
• Configuration supports environment variables and splitting configures into different files, and the frpc configuration can be hot-reloaded without restarting the client.
• Traffic controls cover per-proxy bandwidth limits, service health checks, an allowlist of permitted ports on the server, HTTP Host header rewriting, X-Forwarded-For and Proxy Protocol real-IP handling, HTTP Basic Auth for web services, plus TLS, encryption and compression.

Who uses it and how

• Individuals and small teams reaching a computer on a LAN network over SSH, which is the first example usage the README presents.
• Operators consolidating several SSH endpoints behind one shared port rather than publishing a separate port per machine.
• Teams publishing internal web services under custom domains without moving those services out of the private network.
• Administrators forwarding DNS query requests or Unix domain sockets to internal resolvers and services.
• Anyone needing a temporary public face for a local HTTP file server, or HTTPS termination in front of a local HTTP or HTTPS service.

Getting started

Release binaries are published on GitHub releases; the README documents example usage, configuration files and environment variables for running the server on a reachable host and the frpc client beside the internal service.

How it compares

The facts in this registry name no comparable tunneling or reverse-proxy products, so frp stands alone here. No side-by-side comparison with paid alternatives can be made from the information provided.

When to use it — and when not to

A self-hoster must run the server component on a host with a public address, manage TLS and certificate handling, configure token or OIDC authentication, maintain the firewall's permitted port list, and optionally wire up Prometheus monitoring. Anyone who wants a fully managed tunnel with no server to operate, or who is unwilling to run and patch a public-facing daemon, should look elsewhere. Honest weaknesses: the README is a dense feature inventory rather than a guided introduction, the configuration surface is large enough to overwhelm newcomers, and an "About V2" section signals a next major version under development, so frpc configuration details may shift.