fatedier/frp
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
How frp is put together
frp is a high-performance reverse proxy written in Go that exposes services behind NAT/firewalls to the internet over TCP, UDP, HTTP, HTTPS, KCP, and QUIC, including a P2P (xtcp/NAT-hole-punching) mode. It is split into two binaries: frpc (client) running on the internal LAN and frps (server) running on a public host; the client dials a control session to the server, authenticates (token or OIDC), and registers proxies/visitors that tunnel traffic. Both binaries expose a Gorilla/mux-based admin/dashboard HTTP API (frpc admin UI and frps dashboard) backed by embedded Vue 3 + Element Plus web frontends. Data flow centers on a message-based control protocol (pkg/msg, wire v1/v2) with pluggable transport, multiplexing (yamux), encryption, and proxy/visitor managers on each side.
Languages
Frameworks
Datastores
Infrastructure
Major components
client (frpc)
Runs on the internal network, dials the control session, authenticates, and manages local proxies and visitors that tunnel traffic to the server.
server (frps)
Runs on a public host, accepts client control connections, registers/manages proxies, and routes external traffic to clients.
pkg/config
Loads, completes, validates, and templates TOML/INI (including legacy) client and server configuration and manages config sources/aggregation.
pkg/auth
Provides client/server authentication via token and OIDC (plus legacy) for login and ping messages.
pkg/msg + pkg/proto/wire
Defines the control-plane message protocol and v1/v2 wire framing, crypto negotiation, and read/writers.
pkg/nathole + xtcp visitors/proxies
Implements NAT hole-punching discovery/analysis to enable P2P (xtcp) connections between visitor and proxy.
pkg/vnet + pkg/ssh
Provides the VirtualNet (TUN/WireGuard) overlay and the SSH tunnel gateway feature.
web (frpc/frps dashboards)
Vue 3 + Element Plus single-page dashboards embedded into the Go binaries for admin/monitoring UI.
A single maintenance change swapped the networking library for a project-maintained version.
5 weeksWeek of 2026-08-17
Week of 2026-08-17latest
A single maintenance change swapped the networking library for a project-maintained version.
Week of 2026-08-10
A light week of housekeeping covering security patches, build tooling, and logging polish.
Week of 2026-08-03
The 0.71.0 release shipped alongside a batch of security and stability fixes.
Week of 2026-07-27
Faster binary UDP packet handling landed alongside a major frontend tooling refresh.
Week of 2026-07-20
A busy week mixing new visitor-plugin support with numerous crash fixes and dependency upgrades.
Over the past several weeks the frp project has focused heavily on hardening security and stability—patching vulnerable dependencies, tightening input validation, and fixing crashes and resource leaks—while shipping the 0.71.0 release. Alongside this, the team modernized its plumbing by swapping in a self-maintained networking library, upgrading frontend build tooling, and adding new binary formats for faster UDP traffic. The overall arc is one of maturing a stable product: fewer flashy features, more reliability, safety, and maintenance work.
Week by week
2026-08-17A single maintenance change swapped the networking library for a project-maintained version.latest1 change
Chore
Switched to in-house networking library
The multiplexing library was moved from a third-party version to the project's own maintained fork (yamux v0.2.0) for better control over updates.
2026-08-10A light week of housekeeping covering security patches, build tooling, and logging polish.3 changes
Chore
Pinned code-quality checker version
The automated code linter used in continuous integration was locked to a specific version (v2.12.2) for consistent results.
Fix
Patched vulnerable web dependencies
Third-party packages used by the web dashboard were updated to close known security vulnerabilities.
Fix
Improved log prefix handling
The way log messages are labeled was refined so entries are clearer and more consistent.
2026-08-03The 0.71.0 release shipped alongside a batch of security and stability fixes.6 changes
Chore
Released version 0.71.0
A new official version of frp was cut and published.
Fix
Stricter domain name validation
Subdomain configuration now rejects inconsistent letter-casing to prevent confusing or conflicting setups.
Fix
Safer bandwidth limiting
The bandwidth limiter now caps its burst allowance to avoid runaway spikes in traffic.
Fix
Hardened connection handling
The client now rejects invalid work-connection addresses and the server handles closed UDP channels gracefully.
Fix
More reliable SSH tunneling
Writes to SSH tunnel channels are now serialized to prevent data corruption under concurrent use.
Docs
Added release notes for fixes
Documentation was updated to explain the domain validation fix to users.
2026-07-27Faster binary UDP packet handling landed alongside a major frontend tooling refresh.6 changes
Feature
Binary format for UDP packets
UDP traffic now uses a compact negotiated binary format for better performance and efficiency.
Fix
Validated server control pools
The server now checks control pool counts to prevent misconfiguration or abuse.
Chore
Upgraded frontend build tools
The web dashboard's build tooling, including ESLint v10 and auto-import plugins, was upgraded.
Chore
Added frontend test baseline
A first set of automated unit tests was introduced for the web interface.
Fix
Patched vulnerable web dependencies
Third-party frontend packages were updated to close security vulnerabilities.
Fix
Fixed visitor plugin validation
A validation bug affecting the SUDP visitor plugin in the web and client was corrected.
2026-07-20A busy week mixing new visitor-plugin support with numerous crash fixes and dependency upgrades.6 changes
Feature
Virtual net visitor plugin support
The web and client gained support for a virtual network visitor plugin, expanding connectivity options.
Fix
Prevented SSH crash
A malformed SSH command payload that could crash the server is now handled safely.
Fix
Fixed connection resource leaks
A bug where replaced server control connections leaked resources was resolved.
Fix
Smoother client shutdown
The client's graceful shutdown timing was synchronized to shut down cleanly.
Chore
Upgraded key dependencies
Several libraries including quic-go, go-oidc, and the project's golib were updated for security and reliability.
Refactor
Simplified cryptography code
Key-derivation was switched to use the standard library, reducing custom code.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required