FRP Auto Deploy

Secure remote access to systems behind NAT and firewalls — without VPNs, inbound client firewall changes, or hand-written FRP configuration. FRP Auto Deploy keeps the official fatedier/frp binaries as the tunnel engine and adds the operational layer around them: secure enrollment, persistent client identity, service publishing, public-port allocation, lifecycle controls, diagnostics, backup/restore, and the frpctl operator CLI.

Designed for a few to a few dozen systems. It is intentionally not a 100+ node fleet-orchestration platform.

The basic idea

                       Internet / Operator
                               |
                               v
                    +-----------------------+
                    | FRP Auto Deploy       |
                    | Server / Public entry |
                    +-----------+-----------+
                                ^
                                | outbound FRP tunnel
               +----------------+----------------+
               |                                 |
        +------+-------+                  +------+-------+
        | Client A     |                  | Client B     |
        | behind NAT   |                  | behind NAT   |
        +------+-------+                  +------+-------+
               |                                 |
       localhost services                 reachable LAN hosts
        SSH / HTTPS / TCP                  SSH / HTTP / TCP

The remote client initiates the connection toward the FRP server. In normal deployments, the client does not need its own public IP, an inbound NAT rule, or an inbound firewall opening for the published service.

Choose your path

I want the fastest first connection

Install one server, issue a Zero-Touch command, and connect to SSH.

I am deploying the server

Review ports, deployment modes, firewall responsibilities, and installation checks.

I am onboarding a remote Linux host

Choose Zero-Touch or manual enrollment and verify the client.

I need to publish an application

Publish SSH, HTTP, HTTPS passthrough, custom TCP, or another reachable LAN target.

I operate the environment

Manage clients, services, enrollments, diagnostics, and lifecycle operations with frpctl.

My server is behind a firewall

Configure DNAT correctly and keep public service-port reservations understandable.

What it gives you

Zero-Touch or manual client enrollment
Stable CLIENT ID independent of hostname/IP changes
SSH, HTTP, HTTPS passthrough, and custom TCP publishing
Multiple services per client
Access to LAN services reachable from the client
Persistent public service-port reservations
Clear disable, release, and revoke lifecycle semantics
Read-only diagnostics with frpctl doctor
Backup/restore and controlled updates
Direct and Enterprise single-443 deployment modes
Optional DNS hostname for user-friendly published-service access

Before you deploy

Do I need to change the remote client firewall?

Normally no inbound rule is required on the remote client because the FRP client initiates the tunnel toward the public FRP server. The client still needs outbound connectivity to the configured server endpoints.

Does FRP Auto Deploy configure my cloud firewall or NAT?

No. AWS Security Groups, OCI Security Lists, external firewalls, UFW/firewalld/iptables, and DNAT remain infrastructure responsibilities.

Does HTTPS terminate on FRP Auto Deploy?

No. Published HTTPS is TCP passthrough. The target application remains responsible for the certificate presented to end users.

Can one client publish services on other LAN hosts?

Yes. A client can act as a small gateway for TCP services on other hosts that it can reach normally over the LAN.

Current stable baseline

Item	Current
Stable project release	v2.1.2
Project version on `main`	2.1.3
Pinned / tested FRP	v0.70.1
Stable client scope	Linux/systemd
Default deployment	Direct

Windows and macOS client automation are development targets, but they are not stable-supported in the current stable release.

If you are new to the product, start with the Quick Start. If something does not work, use Troubleshooting before editing generated state manually.

This site is user documentation. Internal roadmap, release-engineering gates, and product-development notes are intentionally kept separate from operational guides.

Getting Started

Client & Services

frpctl

Deployment

Operations

Security & Reference

FRP Auto Deploy

FRP Auto Deploy

The basic idea

Choose your path

I want the fastest first connection

I am deploying the server

I am onboarding a remote Linux host

I need to publish an application

I operate the environment

My server is behind a firewall

What it gives you

Before you deploy

Current stable baseline

​FRP Auto Deploy

​The basic idea

​Choose your path

I want the fastest first connection

I am deploying the server

I am onboarding a remote Linux host

I need to publish an application

I operate the environment

My server is behind a firewall

​What it gives you

​Before you deploy

​Current stable baseline

FRP Auto Deploy

The basic idea

Choose your path

What it gives you

Before you deploy

Current stable baseline