Skip to main content

​
Deployment Modes

FRP Auto Deploy has two server deployment modes: Direct and Enterprise single-443. NAT is not a third mode; it is a network topology around either deployment.

​
Which mode should I choose?

​
Direct mode

Direct is the default and easiest mode to reason about.

​
Enterprise single-443

Use this when an enterprise client network strongly prefers TLS on TCP/443 or allows the TCP connection to a non-standard port but resets TLS there.
In single-443 mode, backend ports 6099 and 7000 are not intended to be Internet-exposed.

​
Side-by-side summary

​
Server behind firewall/NAT

Either mode can be placed behind a firewall/NAT device if the public endpoints are forwarded correctly. For a Direct example with public-to-private port translation, see Firewall & NAT.

​
Switching modes

Direct ↔ single-443 is a maintenance-window cutover, not a zero-downtime change. Persistent identity, CA, token, registry, and port reservations are designed to remain, but the client transport must match the new topology. After any mode change:
Do not solve TLS interception/reset by disabling certificate verification or by switching enrollment to plain HTTP. The supported management plane remains verified HTTPS.
Last modified on September 7, 2026