Your service runs on a machine without a public IP (home server, company intranet, school lab), but you want to reach it from anywhere: SSH home, browse your home NAS, let colleagues reach your local debug service. No public IP available/affordable, no port mapping, VPN too heavy — frp is the tool: the intranet machine dials out and keeps a long connection to a public server; external users access "server IP:port" and traffic is tunneled back to your intranet service.

Use it when:

• Exposing intranet services without a public IP (SSH/HTTP/database/self-hosted);
• Temporary demos/co-debugging: let remote people reach a local port;
• Remote development: SSH back to a home/lab machine (matches D7 remote-dev direction).

Don't use it when: both ends have public IPs (connect directly); one-off port forwarding is enough (ssh -L); compliance-sensitive scenarios (tunneling has usage boundaries — check your own network rules first).

China network reality: frp binaries live on GitHub Releases, slow to reach directly — ghfast.top acceleration measured working (see Quick install).

One command runs a local tunnel end to end (download → extract → frps → frpc → verify through the tunnel; fully isolated on 127.0.0.1 loopback, port range 27000):

# Source: Trove detailed guide · verified 2026-08-31
mkdir -p /tmp/frp-demo && cd /tmp/frp-demo && curl -L -o frp.tar.gz https://ghfast.top/https://github.com/fatedier/frp/releases/download/v0.71.0/frp_0.71.0_linux_amd64.tar.gz && tar xzf frp.tar.gz --strip-components=1 && printf 'frp tunnel demo page
' > index.html && (python3 -m http.server 27081 --bind 127.0.0.1 >/dev/null 2>&1 &) && printf 'bindAddr = "127.0.0.1"
bindPort = 27000
' > frps.toml && ./frps -c frps.toml >/dev/null 2>&1 & sleep 1; printf 'serverAddr = "127.0.0.1"
serverPort = 27000

[[proxies]]
name = "web-demo"
type = "tcp"
localIP = "127.0.0.1"
localPort = 27081
remotePort = 27082
' > frpc.toml && ./frpc -c frpc.toml >/dev/null 2>&1 & sleep 2; curl -s http://127.0.0.1:27082/index.html

Expected output: frp tunnel demo page (tunnel works); otherwise debug step by step per "Step by step"

Prerequisite: one binary copy per machine (intranet + public). This quick command simulates both machines on 127.0.0.1 loopback; replace with real addresses once the mechanism is verified.

Confirm:

• curl through the tunnel returns the page = frps + frpc + proxy chain all work;
• ./frpc status -c frpc.toml (with webServer enabled) shows the proxy running.

Install variants (deep dive)

frp is a reverse tunnel: instead of "pushing" public traffic in, the intranet machine dials out and keeps a long connection to the public server. When an external user hits "server IP:port", frps forwards traffic along the tunnel to frpc on the intranet machine, which forwards it to the local real service.

• frps (server): runs on the machine with a public IP; listens, accepts traffic, forwards along tunnels;
• frpc (client): runs on the intranet machine; dials frps, registers proxies, receives forwarded traffic and hands it to local services;
• proxy: one mapping rule in frpc.toml (e.g. "server port 6000 → local port 22").

Where it writes: two standalone binaries (frps/frpc) + their config files; touches no system package manager, no global config; systemd for auto-start is recommended.

Measured key pitfalls:

• Dual-stack/loopback: isolated test 2026-08-31: with frps bindAddr=127.0.0.1 forced, IPv4 loopback works; watch address-family matching in dual-stack environments (pitfall recorded in warnings/FAQ);
• admin server: frpc status / frpc reload need the webServer config; without it you get web server port should be set if you want to use this feature (measured).

Step 1: download & install (one copy per machine)

Explanation: frp is a no-install binary package; download one copy on each side and extract.

# Source: Trove detailed guide · verified 2026-08-31
curl -L -o frp.tar.gz https://ghfast.top/https://github.com/fatedier/frp/releases/download/v0.71.0/frp_0.71.0_linux_amd64.tar.gz
tar xzf frp.tar.gz
cd frp_0.71.0_linux_amd64
./frps --version && ./frpc --version

Expected output: 0.71.0 / 0.71.0 (measured 2026-08-31)

If stuck:

• slow/interrupted download → switch ghfast.top to another accelerator (gh-proxy.com etc.) or wait for a proxy window; resume with curl -C -;
• wrong architecture → check uname -m (amd64/arm64) and download the matching package.

Step 2: configure frps (public server)

Explanation: frps only needs a listen port (bindPort); the externally exposed port range comes from proxy config.

# Source: Trove detailed guide · verified 2026-08-31
printf 'bindAddr = "0.0.0.0"
bindPort = 7000
' > frps.toml
./frps -c frps.toml

Expected output: frps startup log (frps started successfully shape; loopback port 27000 measured 2026-08-31)

If stuck:

• port busy → change bindPort;
• log errors → check toml syntax (key = value, strings quoted).

Step 3: configure frpc (intranet machine)

Explanation: frpc sets serverAddr/serverPort + proxy sections (local service address + remote port).

# Source: Trove detailed guide · verified 2026-08-31
printf 'serverAddr = "127.0.0.1"
serverPort = 27000

[[proxies]]
name = "web-demo"
type = "tcp"
localIP = "127.0.0.1"
localPort = 27081
remotePort = 27082
' > frpc.toml
./frpc -c frpc.toml

Expected output: log login to server success + start proxy success (measured 2026-08-31); external access to http://serverIP:27082 reaches local port 27081

If stuck:

• login ok but no start proxy success → proxy section misconfigured (localPort/remotePort conflict);
• remote access fails → first curl 127.0.0.1:27082 locally to verify the frps side, then check the public firewall/security group allows remotePort.

Step 4: auto-start (systemd, measured 2026-09-01)

Explanation: production uses systemd to keep frpc resident; measured 2026-09-01 with a systemd-run transient unit (start active, proxy registered, tunnel closes on stop); a persistent unit only adds /etc/systemd/system, behavior is equivalent.

# Source: Trove detailed guide · verified 2026-08-31
# /etc/systemd/system/frpc.service (example, not tested)
# [Unit] Description=frp client; After=network.target
# [Service] ExecStart=/usr/local/frp/frpc -c /etc/frp/frpc.toml; Restart=always
# [Install] WantedBy=multi-user.target

Expected output: not tested (example config, follow official docs)

Step 5: view tunnel status

Explanation: confirm each proxy's state and remote port. Prerequisite: frpc.toml must enable webServer (admin server), otherwise it errors (measured pitfall).

# Source: Trove detailed guide · verified 2026-08-31
cat >> /etc/frp/frpc.toml <<'TOML'
webServer.addr = "127.0.0.1"
webServer.port = 7400
TOML

Expected output: (none; restart frpc once before status/reload so the admin server takes effect)

# Source: Trove detailed guide · verified 2026-08-31
frpc status -c /etc/frp/frpc.toml

Expected output: Proxy Status... table, one row per proxy (measured v0.71.0): Name Status LocalAddr Plugin RemoteAddr Error, e.g. web-demo running 127.0.0.1:27081 127.0.0.1:27082 (Status running = OK)

How to read: when Status is not running, look at the Error column (port busy, local service down, etc.); LocalAddr = local service address, RemoteAddr = external port.

Step 6: change config without restart (hot reload)

Scenario: add another proxy without restarting frpc or dropping existing tunnels.

# Source: Trove detailed guide · verified 2026-08-31
frpc reload -c /etc/frp/frpc.toml

Expected output: reload success (measured: with 2 proxies running, reload added a 3rd; new proxy immediately running, old ones unaffected)

Steps: ① append the proxy section to frpc.toml; ② run reload; ③ frpc status confirms the new proxy; ④ access the new remotePort externally.

Note: reload handles proxy add/remove/edit only; connection-level config (serverAddr/serverPort/auth) still needs a frpc restart.

Step 7: logs

# Source: Trove detailed guide · verified 2026-08-31
# systemd deployment
journalctl -u frpc -f
# manual run: `login to server success` = connected to frps; `start proxy success` = that proxy ready

Expected output: systemd prints the frpc log stream; manual run shows login to server success / start proxy success (measured 2026-08-31)

Same source as the tool-page matrix; full pairs, states and evidence on the conflict matrix. Known relations:

• hoop × frp: hoop is an access-control layer (MCP/LLM/DB policy), frp is a network tunnel; different layers, non-overlapping write surfaces, static: can coexist;
• Others: non-overlapping write surfaces (standalone binaries + config files), static possible-compatible;
• Combo: combo-tunnel-remote-dev not created (single tool satisfies "intranet tunneling/remote access").

• Symptom: frpc status/reload says web server port should be set → frpc.toml lacks the webServer section; add it and restart frpc
• Symptom: login success but no start proxy success → proxy section misconfigured (localPort/remotePort conflict or already taken)
• Symptom: remote access fails → curl serverIP:remotePort locally first (frps side), then check public firewall/security group
• Symptom: tunnel fails in dual-stack env → check address-family matching (IPv4/IPv6), keep frps bindAddr and frpc serverAddr consistent (measured pitfall)
• Symptom: slow/interrupted download → switch accelerators (ghfast.top → gh-proxy.com etc.) or wait for a proxy window; curl -C - to resume

Full four-section entries (symptom→cause→fix→evidence): site docs (if recorded)

# Source: Trove detailed guide · verified 2026-08-31
# stop services (systemd deployment)
systemctl disable --now frpc 2>/dev/null || true
# remove binaries and config
rm -rf /usr/local/frp /etc/frp

Expected output: commands exit cleanly; frpc --version says command not found; /etc/frp gone = clean

Note: stop frpc/frps before uninstalling (otherwise tunnels keep running); deleting /etc/frp loses all proxy config.

• Q: frpc status says web server port should be set — what is it? A: status/reload need the admin server; configure webServer.addr/webServer.port in frpc.toml and restart frpc (measured v0.71.0).
• Q: What can reload change? A: proxy add/remove/edit only; connection-level config (serverAddr/serverPort/auth) requires a frpc restart.
• Q: Public access fails — what to check first? A: curl serverIP:remotePort locally first (frps side); if it works, the tunnel is fine and the problem is the public firewall/security group not allowing remotePort; if not, check frpc status's Error column.
• Q: Does it work on Windows? A: official Windows binaries (frpc.exe/frps.exe) behave the same; Windows not measured here.
• Q: Security notes? A: an exposed frps port gets scanned by the whole internet — use token auth, expose only needed ports, whitelist in the public firewall; this guide's loopback demo did not involve real public exposure.
• Q: Where do I report issues? A: install/uninstall issues go through this entry's feedback; project issues go to the author repo.

• Version: 0.71.0 (manifest locked; measured 2026-08-31).
• Environment: Linux amd64 (WSL2 Ubuntu measured); official binaries exist for Windows/macOS (not tested).
• Network: GitHub Release via ghfast.top (measured); official direct is slow.
• Write surface: two standalone binaries + own configs (frps.toml/frpc.toml); no system package manager.
• Port: frps bindPort (example 7000/27000); proxy remotePort from config; admin server 7400.

• Sources: official project docs (English README/docs) + local measurements (2026-08-31/09-01)
• Entry signature: fatedier/frp (Apache-2.0, kept as 0.71.0)

• Measured: local repro log 2026-08-31 (isolated loopback full chain: download v0.71.0 → frps bindAddr=127.0.0.1 → frpc registers → curl through tunnel returns page; dual-stack pitfall recorded); local repro log 2026-09-01 (daily use: webServer dependency, status table, reload hot-add proxy)
• Not tested: real public deployment (loopback-isolated demo, no public exposure); Windows/macOS forms. (systemd managed hosting measured: transient unit start/stop, tunnel closes on stop)