FRP搭建內網穿透

簡介

frp是啥

frp 是一個可用於內網穿透的高效能的反向代理應用，支援 tcp, udp, http, https 協議。

frp 的作用

利用處於內網或防火牆後的機器，對外網環境提供 http 或 https 服務。
對於 http, https 服務支援基於域名的虛擬主機，支援自定義域名繫結，使多個域名可以共用一個80埠。
利用處於內網或防火牆後的機器，對外網環境提供 tcp 和 udp 服務，例如在家裡通過 ssh 訪問處於公司內網環境內的主機。

免費FRP伺服器

伺服器是0.20.0版本，請使用相同版本客戶端，支援UDP打洞直連穿透,免費伺服器僅供測試，安全問題自己掂量 如果有需要內網穿透的，可以聯絡我，我自己伺服器有搭建對應的FRP服務端

FRP相關站點資料

GITHUB: github.com/fatedie

官網： diannaobos.com/frp

本次安裝環境

安裝環境：
伺服器：阿里雲 centos 7
客戶端：ubuntu 16

安裝配置

服務端安裝

• 下載frp軟體，為了方便我這裡從官網下載 星空大神一鍵指令碼，下載下來的只有一個frp.bat檔案
• 在伺服器上執行sh frp.bat，會出現兩個選項，選擇1，‘ 搭建自己的frps伺服器’
• 選擇3 ‘更新frps程式版本’，升級為最高版本
• 更新完成後回到frps配置的介面，然後選擇1 ‘配置服務端資訊’
• 配置完成，回到frps配置的介面，選擇2 ‘配置完成後臺啟動服務端’
• 啟動完成，選擇4 ‘將frps服務端加入開機服務’，如果這裡出現‘/run/user/1000/gvfs’: 許可權不夠，後面提供的解決方案操作下，然後回來再繼續操作4 ‘將frps服務端加入開機服務’
• 如果不執行‘配置服務端資訊’，在frp的目錄下新建一個frps.ini的檔案，直接把我的配置拷貝過去改下，
• frps.ini 有修改如果配置沒有生效那麼執行下 ‘配置完成後臺啟動服務端’，則會生效

# 手動配置frps.ini檔案需要注意 = 前後都有空格,如果沒有空格，則會配置不生效

[common]
bind_port=7000 # 客戶端連線服務端的對外埠
dashboard_port = 7500 # 服務端管理頁面對外埠
token = 123456 # 這裡是客戶端連線授權的憑證 

# dashboard 使用者名稱密碼，預設都為 admin
dashboard_user = admin # 服務端管理頁面登入賬號
dashboard_pwd = admin  # 服務端管理頁面登入密碼

vhost_http_port = 80    # http 開放80埠
vhost_https_port = 443  # https 開放443埠

# frps 服務端日誌配置
log_file=/home/jesn/tool/frp/logs/frps.log
log_level=info
log_max_day=7

複製程式碼

• 你伺服器如果有開啟防火牆，則要先開放對外埠
• 如果你是阿里雲或者其他的雲主機，伺服器提供商開通了防火牆，那麼你需要操作此步驟，否則不用。登入阿里雲https://ecs.console.aliyun.com,在你伺服器當前例項下，開啟安全組頁面，配置‘入口方’的埠,這裡先開放兩個埠 7000/7000 7500/7500
• 通過伺服器對外IP和7500埠 如果能訪問到FTP的web管理介面，那說明服務端已經執行起來了

客戶端配置

• 通過wget下載frp.bat檔案 wget http://www.lu8.win/downloads/frp/frp.bat
• 在客戶端執行sh frp.bat,然後選擇2 ‘配置並執行frpc客戶端’
• 選擇1 ‘配置要連線的伺服器’，一步步操作，如果不想配置的話，可以和服務端一樣，複製下面的配置改成自己的即可

[common]
server_addr = 100.100.100.100 # 伺服器公網IP
server_port = 7001  # FRPS對外介面埠
token = 123456 # 伺服器token憑證
log_file = frpc.log
log_level = info
log_max_days = 3

# ssh 配置
[ssh]
type = tcp
local_ip = 127.0.0.1
local_port = 22
remote_port = 7022
複製程式碼

• 然後啟動，新增開機自啟動和服務端操作一樣
• 在伺服器和阿里雲平臺開啟7022 對外抵埠
• 通過ssh連線工具測試ssh伺服器是否能連線成功

Web配置HTTP

• 申請域名
• 域名解析
• 網站備案 <由於伺服器是基於阿里雲的所有站點需要提前備案>
• frps服務端啟動http或者https配置埠

vhost_http_port = 80    # http 開放80埠
vhost_https_port = 443  # https 開放443埠
複製程式碼

• frpc客戶端配置內網站點

[web]
type = http # 型別為http
local_port = 80 # 本地埠
custom_domains = www.yourdomain.com # 你的域名
複製程式碼

完整的frps和frpc的配置

frps 完整配置

# [common] is integral section
[common]
# A literal address or host name for IPv6 must be enclosed
# in square brackets, as in "[::1]:80", "[ipv6-host]:http" or "[ipv6-host%zone]:80"
bind_addr = 0.0.0.0
bind_port = 7000

# udp port to help make udp hole to penetrate nat
bind_udp_port = 7001

# udp port used for kcp protocol, it can be same with 'bind_port'
# if not set, kcp is disabled in frps
kcp_bind_port = 7000

# specify which address proxy will listen for, default value is same with bind_addr
# proxy_bind_addr = 127.0.0.1

# if you want to support virtual host, you must set the http port for listening (optional)
# Note: http port and https port can be same with bind_port
vhost_http_port = 80
vhost_https_port = 443

# response header timeout(seconds) for vhost http server, default is 60s
# vhost_http_timeout = 60

# set dashboard_addr and dashboard_port to view dashboard of frps
# dashboard_addr's default value is same with bind_addr
# dashboard is available only if dashboard_port is set
dashboard_addr = 0.0.0.0
dashboard_port = 7500

# dashboard user and passwd for basic auth protect, if not set, both default value is admin
dashboard_user = admin
dashboard_pwd = admin

# dashboard assets directory(only for debug mode)
# assets_dir = ./static
# console or real logFile path like ./frps.log
log_file = ./frps.log

# trace, debug, info, warn, error
log_level = info

log_max_days = 3

# auth token
token = 12345678

# heartbeat configure, it's not recommended to modify the default value
# the default value of heartbeat_timeout is 90
# heartbeat_timeout = 90

# only allow frpc to bind ports you list, if you set nothing, there won't be any limit
allow_ports = 2000-3000,3001,3003,4000-50000

# pool_count in each proxy will change to max_pool_count if they exceed the maximum value
max_pool_count = 5

# max ports can be used for each client, default value is 0 means no limit
max_ports_per_client = 0

# authentication_timeout means the timeout interval (seconds) when the frpc connects frps
# if authentication_timeout is zero, the time is not verified, default is 900s
authentication_timeout = 900

# if subdomain_host is not empty, you can set subdomain when type is http or https in frpc's configure file
# when subdomain is test, the host used by routing is test.frps.com
subdomain_host = frps.com

# if tcp stream multiplexing is used, default is true
tcp_mux = true
複製程式碼

frpc完整配置

# [common] is integral section
[common]
# A literal address or host name for IPv6 must be enclosed
# in square brackets, as in "[::1]:80", "[ipv6-host]:http" or "[ipv6-host%zone]:80"
server_addr = 0.0.0.0
server_port = 7000

# if you want to connect frps by http proxy or socks5 proxy, you can set http_proxy here or in global environment variables
# it only works when protocol is tcp
# http_proxy = http://user:passwd@192.168.1.128:8080
# http_proxy = socks5://user:passwd@192.168.1.128:1080

# console or real logFile path like ./frpc.log
log_file = ./frpc.log

# trace, debug, info, warn, error
log_level = info

log_max_days = 3

# for authentication
token = 12345678

# set admin address for control frpc's action by http api such as reload
admin_addr = 127.0.0.1
admin_port = 7400
admin_user = admin
admin_pwd = admin

# connections will be established in advance, default value is zero
pool_count = 5

# if tcp stream multiplexing is used, default is true, it must be same with frps
tcp_mux = true

# your proxy name will be changed to {user}.{proxy}
user = your_name

# decide if exit program when first login failed, otherwise continuous relogin to frps
# default is true
login_fail_exit = true

# communication protocol used to connect to server
# now it supports tcp and kcp and websocket, default is tcp
protocol = tcp

# specify a dns server, so frpc will use this instead of default one
# dns_server = 8.8.8.8

# proxy names you want to start divided by ','
# default is empty, means all proxies
# start = ssh,dns

# heartbeat configure, it's not recommended to modify the default value
# the default value of heartbeat_interval is 10 and heartbeat_timeout is 90
# heartbeat_interval = 30
# heartbeat_timeout = 90

# 'ssh' is the unique proxy name
# if user in [common] section is not empty, it will be changed to {user}.{proxy} such as 'your_name.ssh'
[ssh]
# tcp | udp | http | https | stcp | xtcp, default is tcp
type = tcp
local_ip = 127.0.0.1
local_port = 22
# true or false, if true, messages between frps and frpc will be encrypted, default is false
use_encryption = false
# if true, message will be compressed
use_compression = false
# remote port listen by frps
remote_port = 6001
# frps will load balancing connections for proxies in same group
group = test_group
# group should have same group key
group_key = 123456
# enable health check for the backend service, it support 'tcp' and 'http' now
# frpc will connect local service's port to detect it's healthy status
health_check_type = tcp
health_check_interval_s = 10
health_check_max_failed = 1
health_check_timeout_s = 3

[ssh_random]
type = tcp
local_ip = 127.0.0.1
local_port = 22
# if remote_port is 0, frps will assign a random port for you
remote_port = 0

# if you want to expose multiple ports, add 'range:' prefix to the section name
# frpc will generate multiple proxies such as 'tcp_port_6010', 'tcp_port_6011' and so on.
[range:tcp_port]
type = tcp
local_ip = 127.0.0.1
local_port = 6010-6020,6022,6024-6028
remote_port = 6010-6020,6022,6024-6028
use_encryption = false
use_compression = false

[dns]
type = udp
local_ip = 114.114.114.114
local_port = 53
remote_port = 6002
use_encryption = false
use_compression = false

[range:udp_port]
type = udp
local_ip = 127.0.0.1
local_port = 6010-6020
remote_port = 6010-6020
use_encryption = false
use_compression = false

# Resolve your domain names to [server_addr] so you can use http://web01.yourdomain.com to browse web01 and http://web02.yourdomain.com to browse web02
[web01]
type = http
local_ip = 127.0.0.1
local_port = 80
use_encryption = false
use_compression = true
# http username and password are safety certification for http protocol
# if not set, you can access this custom_domains without certification
http_user = admin
http_pwd = admin
# if domain for frps is frps.com, then you can access [web01] proxy by URL http://test.frps.com
subdomain = web01
custom_domains = web02.yourdomain.com
# locations is only available for http type
locations = /,/pic
host_header_rewrite = example.com
# params with prefix "header_" will be used to update http request headers
header_X-From-Where = frp
health_check_type = http
# frpc will send a GET http request '/status' to local http service
# http service is alive when it return 2xx http response code
health_check_url = /status
health_check_interval_s = 10

[web02]
type = https
local_ip = 127.0.0.1
local_port = 8000
use_encryption = false
use_compression = false
subdomain = web01
custom_domains = web02.yourdomain.com

[plugin_unix_domain_socket]
type = tcp
remote_port = 6003
# if plugin is defined, local_ip and local_port is useless
# plugin will handle connections got from frps
plugin = unix_domain_socket
# params with prefix "plugin_" that plugin needed
plugin_unix_path = /var/run/docker.sock

[plugin_http_proxy]
type = tcp
remote_port = 6004
plugin = http_proxy
plugin_http_user = abc
plugin_http_passwd = abc

[plugin_socks5]
type = tcp
remote_port = 6005
plugin = socks5
plugin_user = abc
plugin_passwd = abc

[plugin_static_file]
type = tcp
remote_port = 6006
plugin = static_file
plugin_local_path = /var/www/blog
plugin_strip_prefix = static
plugin_http_user = abc
plugin_http_passwd = abc

[secret_tcp]
# If the type is secret tcp, remote_port is useless
# Who want to connect local port should deploy another frpc with stcp proxy and role is visitor
type = stcp
# sk used for authentication for visitors
sk = abcdefg
local_ip = 127.0.0.1
local_port = 22
use_encryption = false
use_compression = false

# user of frpc should be same in both stcp server and stcp visitor
[secret_tcp_visitor]
# frpc role visitor -> frps -> frpc role server
role = visitor
type = stcp
# the server name you want to visitor
server_name = secret_tcp
sk = abcdefg
# connect this address to visitor stcp server
bind_addr = 127.0.0.1
bind_port = 9000
use_encryption = false
use_compression = false

[p2p_tcp]
type = xtcp
sk = abcdefg
local_ip = 127.0.0.1
local_port = 22
use_encryption = false
use_compression = false

[p2p_tcp_visitor]
role = visitor
type = xtcp
server_name = p2p_tcp
sk = abcdefg
bind_addr = 127.0.0.1
bind_port = 9001
use_encryption = false
use_compression = false
複製程式碼

問題vS解決方案

• 在設定frps為開機自啟動的時候提示：‘/run/user/1000/gvfs’: 許可權不夠 解決方案:

umount /run/user/1000/gvfs

rm -rf /run/user/1000/gvfs
複製程式碼