Free tools Windows power users keep installed
One-click scans. No signup required.
To access a service behind NAT without forwarding a port on the private network’s router, run frpc beside the service and have it connect outward to frps on a publicly reachable host. Configure a proxy from that host to the service’s local address and port. For a public endpoint, use a TCP, UDP, HTTP, or HTTPS proxy as appropriate; for visitor-restricted access, frp documents STCP with a shared secret and a visitor client.
How frp reaches a service behind NAT
frp uses two components in different locations: frps runs on a host that can be reached publicly, and frpc runs where it can reach the internal service. The client initiates a connection to the server, and the proxy configuration maps a remote endpoint or domain route to the local service. The public endpoint is therefore on the frps host; frp does not make the private home or office connection directly addressable. The project describes frp as a reverse proxy for exposing a local server behind NAT or a firewall.
As an Amazon Associate I earn from qualifying purchases.
What you need before configuring it
- A host with a public IP address to run
frps. - The
frpcclient on a machine or network that can reach the service you want to expose. - Firewall rules on the public host that permit the client’s connection to
frpsand, for public proxy types, the selected service port or ports. - The service’s reachable local address and port, plus the correct proxy type for its traffic.
These are separate network paths: the firewall at the public host must allow the tunnel connection and any chosen public-facing proxy port. The private site does not need an inbound port-forwarding rule for the documented outbound-client design. The official setup guide covers downloading the binaries and placing each component.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Basic TCP setup: understand the example ports
frp’s configuration reference illustrates a TCP proxy for SSH. The example sets bindPort = 7000 on frps; on frpc, it sets the server address and port, then maps local 127.0.0.1:22 to remote port 6000. Port 7000 is for the client-to-server connection. Port 6000 is where the proxied SSH service is reached on the public host. These are example values, not defaults to copy without checking the host firewall, port availability, and the service you intend to expose. See the configuration reference.
#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Set up frps and frpc
- Download the matching release binaries. Get the client and server for the relevant platforms from the frp releases page.
- Configure the public host. Put
frpsand its server configuration on the public-IP host. Set the server bind port and allow the required tunnel traffic and selected public proxy ports through that host’s firewall. - Configure the private-side client. Put
frpcwhere the target service is reachable. Set the server address and port to match the public host’s configuration. - Define the proxy. Choose a proxy type, set the local address and port to the service, and configure the remote endpoint or domain route required by that type.
- Start both components. Run
frpswith its server configuration andfrpcwith its client configuration. For a persistent deployment, the official guide recommends a process manager such as systemd or supervisor.
The official guide says frp is written in Go, supports cross-platform deployment, and can run from downloaded binaries without additional dependencies beyond platform requirements. Current documented configuration formats are TOML, YAML, and JSON. INI is still supported but deprecated, and new features are available only in TOML, YAML, or JSON. Check the setup guide for current instructions.
Choose a proxy type and decide who can connect
| Pattern | When it fits | Access model and caveat |
|---|---|---|
| TCP | Services using TCP, including the documented SSH example. | A configured remote port on the public host can make the service publicly reachable. |
| UDP | Services using UDP; official examples include DNS forwarding. | Configure the relevant public endpoint and firewall rules for the service. |
| HTTP or HTTPS | Web services, including domain-based routing. | Examples include serving an internal web service through a custom domain and using the https2http plugin to convert a local HTTP service to HTTPS at the frp endpoint. |
| STCP | A service intended for access by authorized visitor clients. | The documented pattern pairs a service proxy’s secretKey with a matching visitor configuration on a second frpc. The example omits remotePort, so it is not exposed as a conventional public remote port. Protect the shared secret. |
| XTCP | Attempting direct peer-to-peer traffic, with frps used for coordination. |
Direct traffic depends on NAT compatibility; the project warns that XTCP may fail with some NAT devices and suggests STCP as a fallback. |
These patterns do not offer the same access scope. A public TCP or UDP remote port is reachable through the public host, while STCP’s visitor-and-secret arrangement is designed for restricted access. XTCP is an attempt at direct P2P communication, not a guarantee that traffic can cross every carrier-grade or symmetric NAT. The project README and examples describe these proxy types and their use cases.
Rank #2
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
When the basic tunnel is not enough
Official examples also cover TCP multiplexing with tcpmux, DNS over UDP, exposing a Unix domain socket through TCP, and simple static-file access. These are separate patterns for particular services; they are not extra steps required to expose a basic TCP service. Domain-based web routing, HTTPS conversion, or restricted STCP access may be useful when the service or audience calls for them. Review the project’s examples for the relevant configuration.
Operational checks and limits
- Keep the public host’s firewall aligned with the ports configured for the tunnel and the chosen public proxy.
- Use a supported configuration format for new deployments; INI is deprecated.
- Run long-lived components under a suitable process manager so they can be supervised.
- Use a strong, carefully handled secret for STCP visitor access.
- Do not assume XTCP will work on every network; NAT behavior can prevent direct P2P connections.
- Choose the public host with its cost, network limits, region, and firewall controls in mind. The official material establishes frp’s deployment roles and features, not a comparison of hosting providers or prices.
The official overview and examples describe capabilities, but do not establish a general performance figure or guarantee for a particular deployment. Actual reachability depends on the public host, firewall configuration, service mapping, and network conditions. Consult the official project documentation and the release page for the version you deploy.
Quick Recap
Rank #4
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐏𝐫𝐨𝐨𝐟 𝐘𝐨𝐮𝐫 𝐇𝐨𝐦𝐞 𝐖𝐢𝐭𝐡 𝐖𝐢-𝐅𝐢 𝟕: Powered by Wi-Fi 7 technology, enjoy faster speeds with Multi-Link Operation, increased reliability with Multi-RUs, and more data capacity with 4K-QAM, delivering enhanced performance for all your devices.
- 𝐁𝐄𝟑𝟔𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐑𝐨𝐮𝐭𝐞𝐫: Delivers up to 2882 Mbps (5 GHz), and 688 Mbps (2.4 GHz) speeds for 4K/8K streaming, AR/VR gaming & more. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance, and obstacles like walls.
- 𝐔𝐧𝐥𝐞𝐚𝐬𝐡 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠 𝐒𝐩𝐞𝐞𝐝𝐬 𝐰𝐢𝐭𝐡 𝐃𝐮𝐚𝐥 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭𝐬 𝐚𝐧𝐝 𝟑×𝟏𝐆𝐛𝐩𝐬 𝐋𝐀𝐍 𝐏𝐨𝐫𝐭𝐬: Maximize Gigabitplus internet with one 2.5G WAN/LAN port, one 2.5 Gbps LAN port, plus three additional 1 Gbps LAN ports. Break the 1G barrier for seamless, high-speed connectivity from the internet to multiple LAN devices for enhanced performance.
- 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝟐.𝟎 𝐆𝐇𝐳 𝐐𝐮𝐚𝐝-𝐂𝐨𝐫𝐞 𝐏𝐫𝐨𝐜𝐞𝐬𝐬𝐨𝐫: Experience power and precision with a state-of-the-art processor that effortlessly manages high throughput. Eliminate lag and enjoy fast connections with minimal latency, even during heavy data transmissions.
- 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐟𝐨𝐫 𝐄𝐯𝐞𝐫𝐲 𝐂𝐨𝐫𝐧𝐞𝐫 - Covers up to 2,000 sq. ft. for up to 60 devices at a time. 4 internal antennas and beamforming technology focus Wi-Fi signals toward hard-to-reach areas. Seamlessly connect phones, TVs, and gaming consoles.
Rank #3
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐑𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 𝟕 - Designed with the latest Wi-Fi 7 technology, featuring Multi-Link Operation (MLO), Multi-RUs, and 4K-QAM. Achieve optimized performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra.
- 𝟔-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝐰𝐢𝐭𝐡 𝟔.𝟓 𝐆𝐛𝐩𝐬 𝐓𝐨𝐭𝐚𝐥 𝐁𝐚𝐧𝐝𝐰𝐢𝐝𝐭𝐡 - Achieve full speeds of up to 5764 Mbps on the 5GHz band and 688 Mbps on the 2.4 GHz band with 6 streams. Enjoy seamless 4K/8K streaming, AR/VR gaming, and incredibly fast downloads/uploads.
- 𝐖𝐢𝐝𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐒𝐭𝐫𝐨𝐧𝐠 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐨𝐧 - Get up to 2,400 sq. ft. max coverage for up to 90 devices at a time. 6x high performance antennas and Beamforming technology, ensures reliable connections for remote workers, gamers, students, and more.
- 𝐔𝐥𝐭𝐫𝐚-𝐅𝐚𝐬𝐭 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐖𝐢𝐫𝐞𝐝 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 - 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port and 3x 1 Gbps LAN ports offer high-speed data transmissions.³ Integrate with a multi-gig modem for gigplus internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
