> ## Documentation Index
> Fetch the complete documentation index at: https://frp.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment Modes

> Choose between Direct and Enterprise single-443 deployments.

# Deployment Modes

FRP Auto Deploy has **two** server deployment modes: **Direct** and **Enterprise single-443**.

NAT is not a third mode; it is a network topology around either deployment.

## Which mode should I choose?

```mermaid theme={null}
flowchart TD
    A[Start] --> B{Does the client network allow\nverified HTTPS / FRP traffic\non the normal public endpoints?}
    B -->|Yes| D[Use Direct\nrecommended default]
    B -->|No / TLS on non-443 is reset| C{Can public TCP 443\nbe used for both enrollment\nand FRP control?}
    C -->|Yes| S[Use Enterprise single-443]
    C -->|No| N[Fix upstream network policy\nFRP Auto Deploy does not support insecure fallback]
```

## Direct mode

```mermaid theme={null}
flowchart LR
    C[Remote client]
    I[Internet]
    S[FRP Auto Deploy server]
    U[Internet user]

    C -->|FRP control TCP 443| S
    C -->|Enrollment/management HTTPS TCP 6099| S
    U -->|Published service TCP 6000-6098| S
```

Direct is the default and easiest mode to reason about.

| Purpose                       | Public TCP | Typical local listen |
| ----------------------------- | ---------: | -------------------: |
| FRP control                   |        443 |                  443 |
| Enrollment / management HTTPS |       6099 |                 6099 |
| Published services            |  6000-6098 |            6000-6098 |

## Enterprise single-443

Use this when an enterprise client network strongly prefers TLS on TCP/443 or allows the TCP connection to a non-standard port but resets TLS there.

```mermaid theme={null}
flowchart LR
    C[Remote client]
    U[Internet user]
    FE[Public frontend\nTCP 443]
    A[Allocator backend\n127.0.0.1:6099]
    F[FRP backend\n127.0.0.1:7000]
    P[Published ports\n6000-6098]

    C -->|HTTPS enrollment| FE
    C -->|FRP control over WSS| FE
    FE --> A
    FE --> F
    U --> P
```

<Warning>
  In single-443 mode, backend ports `6099` and `7000` are not intended to be Internet-exposed.
</Warning>

## Side-by-side summary

| Question                | Direct                   | single-443                                  |
| ----------------------- | ------------------------ | ------------------------------------------- |
| Normal default?         | **Yes**                  | No, use for constrained enterprise networks |
| Public FRP control      | TCP 443                  | TCP 443 via WSS frontend                    |
| Public enrollment HTTPS | TCP 6099                 | TCP 443                                     |
| Published services      | 6000-6098                | 6000-6098                                   |
| Backend 6099            | public/listen by default | loopback backend                            |
| Backend 7000            | not normal Direct path   | loopback FRP backend                        |

## Server behind firewall/NAT

Either mode can be placed behind a firewall/NAT device if the public endpoints are forwarded correctly.

```mermaid theme={null}
flowchart LR
    C[Remote client] -->|public endpoint| F[Firewall / NAT]
    F -->|DNAT| S[Private FRP server]
```

For a Direct example with public-to-private port translation, see [Firewall & NAT](/deployment/firewall-nat).

## Switching modes

Direct ↔ single-443 is a maintenance-window cutover, not a zero-downtime change. Persistent identity, CA, token, registry, and port reservations are designed to remain, but the client transport must match the new topology.

After any mode change:

```bash theme={null}
sudo frpctl show status
sudo frpctl doctor
```

<Note>
  Do not solve TLS interception/reset by disabling certificate verification or by switching enrollment to plain HTTP. The supported management plane remains verified HTTPS.
</Note>