Miscellaneous Notes | Using FRP to build intranet penetration service

---

01 Demand scenario

1. There is a cloud server, Linux (CentOS7) system
2. The cloud server has a public network IP and can be accessed by the public network
3. The local computer is a home laptop with Windows operating system
4. The local computer does not have a public network IP and the public network cannot access
the requirements : Build the cloud server as an intranet penetration server to realize the function of accessing home computers (web pages) through the external network. And even if there is no domain name, it can be accessed through public network IP.

02 Project address

GitHub: https://github.com/fatedier/frp
releases page: https://github.com/fatedier/frp/releases
Download the run files according to your own situation. I downloaded the 2 items in the picture.


After downloading, unzip it.

03 File introduction

After decompression, you can see some files like this:

The left side of the picture is the files of the Linux system, and the right side is the Windows version.
Among them: the file
with frpsthe words is used on the server side, that is, the remote public network server, and the letter s at the end means server.
Files with frpcwords are used on the client, that is, the local home server, and the letter c at the end means client.
So, frp_0.49.0_linux_amd64pick these files in and upload to the cloud server: Pick these files in and keep them locally frps frps.ini frps_full.ini
:frp_0.49.0_windows_amd64frpc.exe frpc.ini frpc_full.ini

04 Write configuration file

This article takes HTTP penetration as an example. For other types of penetration, please refer to the official documentation: https://gofrp.org/docs/
Note: When actually writing the configuration file, the comments in each line of configuration and the spaces before the comments should be deleted. !
For example:
Don't write like this: bind_port = 7000 # 服务器接收客户端连接的端口
Instead write like this: bind_port = 7000
Otherwise everything that follows will be considered part of the configuration, at least in the latest 0.49.0version.

4.1 Write frps.ini

First write frps.inithe file located on the cloud server side.

[common]
bind_port = 7000				# 服务器接收客户端连接的端口
dashboard_port = 7500			# 后台管理端口
dashboard_user = admin			# 后台登录用户名
dashboard_pwd = admin			# 后台登录密码

vhost_http_port = 80			# http穿透端口（公网服务器的端口）
vhost_https_port = 443			# https穿透端口（公网服务器的端口）

token = abc123					# 身份验证令牌 frpc要和frps一致

log_file = /root/frp/frps.log	# 日志路径
log_level = info				# 日志级别
log_max_days = 3				# 日志文件保留天数

authentication_timeout = 0		# 身份验证超时时间 0表示不验证
subdomain_host = xxx.com		# 注册的主域名 不带前缀 没有域名就写公网ip

Start the server-side service

# 在文件所在的目录下输入命令启动
./frps -c ./frps.ini &

After completion, you can http://xxx.com:7500access the background management page and pay attention to the issuance-related ports.
In this example configuration, the ports that need to be released are: 7000, 7500, 80, and 443.

4.2 Create frpc.ini

Then write local frpc.inifiles.

[common]
server_addr = xxx.xxx.xxx.xxx	# 服务器的公网ip地址
server_port = 7000				# 客户端与服务器连接的端口

token = abc123					# 身份验证令牌 frpc要和frps一致
authentication_timeout = 0		# 身份验证超时时间 0表示不验证

[web]							# 添加web节点
type = http						# 访问类型为http
local_ip = 127.0.0.1			# 本地设备ip（*注）
local_port = 8080				# 本地访问的端口
custom_domains = xxx.com		# 指向远程服务器的域名 没有域名就写服务器公网ip

*Note: If it is the local machine, local_ipyou can omit it, or write 127.0.0.1, or write the IP address of the local intranet, usually 192.168.xxx.xxx
Start the client service:
Open Windows PowerShell, cd to the folder where frpc.exe is located. (Use PowerShell without cmd)
Enter the startup command: ./frpc.exe -c ./frpc.inito start.
If the configuration file is in the same folder and uses the default name, the startup command is simplified to ./frpc.exe

success. If success appears, the startup is successful!

05 test

http://127.0.0.1:8080Assume that there is a local nginx page that can be accessed through local input .
After turning on intranet penetration, enter http://xxx.com:80or http://公网ip:80to check whether it can be accessed. (Port 80 of the http protocol can be omitted)
For other types of intranet penetration, please refer to the official documentation: https://gofrp.org/docs/