Deployment guide

frp

Overview

frp (fast reverse proxy) lets you expose a local server that sits behind NAT or a firewall to the public internet through a relay. The SecureAnyCloud image ships the server side, frps 0.69.1, a single Go binary.

frps runs as a systemd service and listens on the tunnel control port 7000, where frpc clients connect. Its web dashboard stays on loopback behind an nginx reverse proxy on port 80. First boot of every VM generates a unique dashboard password and a unique client authentication token.

What you get:

frps 0.69.1 (binary /usr/local/bin/frps) run as the dedicated frp system user
The tunnel control port 7000/tcp where frpc clients connect
nginx on :80 as a reverse proxy to the loopback frps web dashboard (127.0.0.1:7500)
A per-VM dashboard password and a per-VM client auth.token, generated on first boot and recorded in a root-only file
frps.service and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point, because frps is lightweight.

Set the NSG inbound rules to allow 22/tcp from your management network, 80/tcp for the dashboard, and 7000/tcp for the tunnel control port so that frpc clients can reach the server. The dashboard serves plain HTTP on port 80, so terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal and choose Create a resource. Search the Marketplace for frp Server by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Then choose Review + create, and then Create. After creation, add an inbound rule for 7000/tcp, the tunnel control port (see Step 5).

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:frp-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name frps \
  --image sac1647283583153:frp-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name frps --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name frps --port 7000 --priority 1020

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active frps.service nginx.service

Both services report active. On first boot, frps is configured with a per-VM dashboard password and a per-VM client authentication token.

active active

Step 5 - Open the tunnel control port (7000)

frpc clients connect to the server on 7000/tcp. The SecureAnyCloud image opens 22 and 80 by default. You must open 7000 in the VM's Network Security Group. From your workstation, run this Azure CLI command:

az vm open-port --resource-group <your-rg> --name frps --port 7000 --priority 1020

Or use the Azure Portal. Choose Virtual machine -> Networking -> Add inbound port rule, then set Destination port to 7000, Protocol to TCP and Action to Allow.

Step 6 - Retrieve the per-VM dashboard password and client token

The dashboard password and the client auth.token are unique to each VM. They are stored in a root-only credentials file:

sudo cat /root/frp-credentials.txt

The file contains the dashboard URL and user, the dashboard password (frp.dashboard.pass), the client FRP_AUTH_TOKEN, and the tunnel port. Verify that the dashboard responds locally. An unauthenticated request is rejected, and the admin credentials succeed:

PW=$(sudo grep '^frp.dashboard.pass=' /root/frp-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'no-auth: %{http_code}\n' http://127.0.0.1/api/serverinfo
curl -s -o /dev/null -w 'admin: %{http_code}\n' -u "admin:$PW" http://127.0.0.1/api/serverinfo

no-auth: 401 admin: 200

Step 7 - Open the web dashboard

Browse to http://<vm-public-ip>/ and sign in as admin with the dashboard password from Step 6. The Overview page shows connected clients, active proxies, current connections and total traffic, plus the server configuration (bind port, max pool count and version).

The Clients page lists every frpc client currently connected to the server, with its online or offline status.

The Proxies page lists every tunnel the connected clients have registered, grouped by type (TCP, UDP, HTTP, HTTPS and more).

Step 8 - Connect an frpc client

On the machine whose local service you want to expose (for example a web app on 127.0.0.1:8080), install the frpc client from the frp releases and create an frpc.toml. Use this server's public IP, port 7000, and the auth.token from /root/frp-credentials.txt:

# frpc.toml on the CLIENT machine serverAddr = "<vm-public-ip>" serverPort = 7000 auth.method = "token" auth.token = "<FRP_AUTH_TOKEN from /root/frp-credentials.txt>"
# Expose a local web app on 127.0.0.1:8080 as a public TCP tunnel on the server's :6000 [[proxies]] name = "my-web" type = "tcp" localIP = "127.0.0.1" localPort = 8080 remotePort = 6000

Start the client with frpc -c ./frpc.toml. The client appears on the dashboard Clients page, and its tunnel appears on the Proxies page. Reach the exposed service at <vm-public-ip>:6000. Open that port in the NSG too. The token must match, or the server rejects the client.

Step 9 - Review the server configuration

The server reads /etc/frp/frps.toml. The file pins the tunnel control port to 7000, binds the dashboard to loopback 127.0.0.1:7500, and enables token authentication:

sudo grep -E '^(bindPort|webServer\.(addr|port|user)|auth\.method)' /etc/frp/frps.toml

bindPort = 7000 webServer.addr = "127.0.0.1" webServer.port = 7500 webServer.user = "admin" auth.method = "token"

To change a setting, for example to add vhost HTTP routing, edit /etc/frp/frps.toml and restart:

sudo systemctl restart frps.service

Step 10 - Maintenance

The image keeps receiving OS security updates through unattended-upgrades.

To update frps to a newer release, download the new frps binary from the frp releases, replace /usr/local/bin/frps, and run sudo systemctl restart frps.service. Check the service logs with journalctl -u frps.service.

Support

frp is licensed under the Apache License 2.0. The SecureAnyCloud charge covers packaging, security patching, image maintenance and 24/7 support. Email sales@secureanycloud.com.

frp and the frp logo are trademarks of their respective owners. SecureAnyCloud is not affiliated with or endorsed by the frp project. This image repackages the open source frp software in accordance with its Apache-2.0 license.

Deploy on Azure

Launch frp Server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs frp (Fast Reverse Proxy), the open source, high-performance reverse proxy that exposes a local service behind NAT or a firewall to the public internet. An frps server runs on a host with a public IP. frpc clients running next to your private services connect out to it and register named tunnels. Traffic that reaches the public server is forwarded back to the private service over a single persistent connection. You do not need to open any inbound firewall ports on the private network.

What you get:

The frps server binary installed under /opt/frp. It runs as a dedicated unprivileged frp system account under a systemd service that starts it on boot and restarts it on failure.
The frpc client binary installed alongside it, so you can test a tunnel from the same host.
The server configuration in /etc/frp/frps.toml, and the server runtime state at /var/lib/frp, which is a dedicated, independently resizable EBS data volume.
frps listening on the control port 7000 for frpc clients, with a built-in web dashboard. The dashboard binds to the loopback interface only and is never exposed directly. An nginx reverse proxy publishes it on port 80, and frps performs its own HTTP Basic authentication on it.
A dashboard password and a server authentication token generated on the first boot of every deployed instance, so two instances launched from the same Amazon Machine Image never share credentials. Both are written to /root/frp-aws-credentials.txt with mode 0600, so only the root user can read them.

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network, port 80 for the web dashboard, and port 7000 for frpc clients to register
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for frp. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of t3.small or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Then create or select a security group that opens port 22 from your management network, port 80 for the dashboard, and port 7000 for frpc clients. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

The following block launches an instance from the SecureAnyCloud frp Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80 and 7000 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.small \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=frp}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Connect to Your Instance

Connect over SSH using your key pair. On Ubuntu 24.04, the login user is ubuntu.

ssh -i <key-name>.pem ubuntu@<public-ip>

Retrieve the Dashboard Password and Server Token

The dashboard password and the server authentication token are unique to your instance. First boot generated them. Read them as root:

sudo cat /root/frp-aws-credentials.txt

The file lists the dashboard URL, the dashboard user (admin) and the generated password. It also lists the server address, the control port (7000) and the generated server token that frpc clients use to authenticate. Keep this file somewhere safe.

Sign In to the frps Web Dashboard

nginx serves the frps web dashboard on port 80, and frps applies its own HTTP Basic authentication. In a browser, go to:

http://<instance-public-ip>/

The browser prompts you for credentials. Sign in as admin with the password from the credentials file. The dashboard opens on the Overview page. It shows the number of connected clients, active proxies, current connections and total traffic, along with the server configuration, including the frp version and the bind port.

The Proxies page lists every registered proxy with its type, remote port, owning client and live traffic counters. Each proxy shows whether it is currently online.

The Clients page lists every connected frpc client with its run ID, source IP, frp version and online status. You can see at a glance which clients are registered with the server.

Confirm frp Is Running

Over SSH, confirm that the server and the nginx proxy are active and that the ports are listening:

sudo systemctl is-active frps nginx
sudo ss -tlnp | grep -E ':(80|7000|7500) '

Both services report active. frps listens on the control port 7000 for frpc clients, the dashboard listens on 127.0.0.1:7500 (loopback only), and nginx listens on port 80.

You can also query the dashboard server-info API over loopback on the instance. Read the generated dashboard password and call the API:

DASH_PASS=$(sudo grep '^frp.dashboard.pass=' /root/frp-aws-credentials.txt | cut -d= -f2-)
curl -s -u "admin:${DASH_PASS}" http://127.0.0.1/api/serverinfo

The response is JSON reporting the frp version, the bind port and the current client and proxy counts.

Register Your First Tunnel with frpc

frpc clients run next to the private service you want to expose and connect out to the frps server on the control port. The frpc client binary is bundled on this instance at /opt/frp/frpc (and on your PATH as frpc), so you can test a tunnel immediately. In production, run frpc on the machine that hosts the private service.

Create an frpc configuration file. Replace <public-ip> with the instance public IP and <server-token> with the frp.server.token value from the credentials file. This example exposes a local web server (listening on 127.0.0.1:8080 on the frpc host) on the public port 6080 of the frps server:

serverAddr = "<public-ip>" serverPort = 7000 auth.method = "token" auth.token = "<server-token>" [[proxies]] name = "my-web" type = "tcp" localIP = "127.0.0.1" localPort = 8080 remotePort = 6080

Save it as frpc.toml and start the client:

frpc -c frpc.toml

Once the client registers, the proxy appears on the dashboard Proxies page. Traffic to <public-ip>:6080 is forwarded to the private service on the frpc host. Open the public port you choose (here 6080) in the instance security group for the clients that should reach the tunnel.

Proxy Types

frp supports several proxy types beyond plain TCP. Set the type field of each proxy in your frpc configuration:

tcp and udp: forward a raw TCP or UDP port. Use these for SSH, databases, game servers and similar.
http and https: route by virtual host and domain name through frp's HTTP and HTTPS vhost listeners.
stcp, sudp and xtcp: secret and peer-to-peer tunnels. They need a matching visitor configuration and are not published on a public port.

See the frp documentation for the full set of options for each type. The bundled server accepts token-authenticated clients on the control port 7000 for every type.

The Data Volume

The frps server runtime state lives on a dedicated EBS volume mounted at /var/lib/frp. This keeps the server working directory off the operating system disk, and you can resize or snapshot the volume independently. Confirm the mount:

df -h /var/lib/frp

To grow the volume, expand the EBS volume in the AWS console. Then grow the file system on the instance with sudo resize2fs on the underlying device. frps and nginx start automatically on boot.

Rotate the Dashboard Password and Server Token

Both secrets are stored in /etc/frp/frps.toml. To rotate them, edit the webServer.password and auth.token values in that file as root. Then restart frps:

sudo systemctl restart frps

After you change auth.token, update the auth.token in every frpc client configuration so that clients can continue to register. Update your saved copy of /root/frp-aws-credentials.txt to match.

Enable HTTPS

nginx serves the dashboard over plain HTTP on port 80. For production use, place it behind TLS.

Obtain a certificate for your domain. For example, use a managed certificate on an Application Load Balancer in front of the instance, or install Certbot on the instance for your-domain. Then configure nginx to listen on 443 with your certificate and proxy to 127.0.0.1:7500, exactly as the bundled site does for port 80.

Restrict the security group so that only the networks that administer the server can reach the dashboard.

Backup and Maintenance

Back up the server configuration by copying /etc/frp/frps.toml. Snapshot the /var/lib/frp EBS volume to capture the server runtime state.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade. Reboot when a new kernel is installed. frps and nginx start automatically on boot.

Support

SecureAnyCloud publishes and supports this image. Support covers deployment, frpc client configuration, proxy type selection, the dashboard, token and dashboard credential rotation, TLS and tuning. Contact SecureAnyCloud through the support channel listed on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch frp on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS