> ## Documentation Index
> Fetch the complete documentation index at: https://frp.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Quick Start

> Install the server, enroll a client, and publish your first SSH service.

# Quick Start

This is the shortest stable **v2.1.2** path from an empty server to a working remote SSH connection.

## What you are building

```mermaid theme={null}
flowchart LR
    U[Your laptop]
    S[FRP Auto Deploy server]
    C[Remote Linux client\nbehind NAT/firewall]
    SSH[sshd\n127.0.0.1:22]

    C -->|outbound tunnel| S
    U -->|ssh -p assigned-port| S
    S --> C
    C --> SSH
```

## Before you start

You need:

* a Linux/systemd server that remote clients can reach through a public entry point
* a Linux/systemd client
* an SSH account that already exists on that client
* server firewall/NAT rules for the chosen deployment
* `sudo`/root privileges for installation

For a first deployment, **Ubuntu 24.04 x86\_64** is the clearest real-validated baseline.

<Tip>
  If you do not already have a static public IP or spare Linux server, start with [OCI Free Tier Server Preparation](/getting-started/oci-free-tier-server) to prepare an Always Free-eligible VM with a Reserved Public IPv4 address.
</Tip>

### Direct mode network requirements

| Direction       | Purpose                       |           Default TCP |
| --------------- | ----------------------------- | --------------------: |
| Client → Server | FRP control                   |                   443 |
| Client → Server | Enrollment / management HTTPS |                  6099 |
| User → Server   | Published services            | 6000-6098 as assigned |

<Warning>
  FRP Auto Deploy does not automatically change cloud security groups, external firewalls, NAT rules, UFW, firewalld, or iptables.
</Warning>

## 1. Install the server

```bash theme={null}
curl -fsSL \
  https://raw.githubusercontent.com/datarelay-labs/frp-auto-deploy/v2.1.2/dist/bootstrap-server.sh \
  | sudo bash
```

The interactive installer asks for the public endpoint, optional published-service hostname, internal IP, deployment mode, and port settings.

If the server is behind a firewall/NAT device, read [Firewall & NAT](/deployment/firewall-nat) before accepting the defaults.

## 2. Verify the server

```bash theme={null}
sudo frpctl show version
sudo frpctl show status
sudo frpctl doctor
```

<Check>
  Continue only after the expected services are active and `doctor` does not report a blocking configuration/trust problem.
</Check>

## 3. Create the client enrollment

### Easiest interactive path

Start the CLI:

```bash theme={null}
sudo frpctl
```

Then use:

```text theme={null}
create zero-touch
```

This is the recommended everyday onboarding path.

### Explicit SSH one-liner profile

For a predictable SSH profile from the shell:

```bash theme={null}
sudo frpctl create enrollment \
  --one-line \
  --ssh \
  --ssh-user aella \
  --label branch-a
```

Replace `aella` with an SSH user that **already exists on the remote client**.

FRP Auto Deploy does not create OS users, install/configure `sshd`, change passwords, or manage SSH keys.

## 4. Run the generated command on the client

Send the **exact generated command** to the remote operator through an appropriate private channel and run it once on the Linux client.

```mermaid theme={null}
sequenceDiagram
    participant A as Server admin
    participant S as FRP server
    participant C as Remote client

    A->>S: create zero-touch / enrollment
    S-->>A: one-time bootstrap command
    A-->>C: send privately
    C->>S: HTTPS bootstrap + enrollment
    S-->>C: persistent identity + service config
    C->>S: outbound FRP control tunnel
```

Treat the generated bootstrap command as sensitive until it is used, expires, or is revoked.

## 5. Verify on the client

```bash theme={null}
sudo frpctl show version
sudo frpctl show status
sudo frpctl show services
sudo frpctl show info
sudo frpctl doctor
```

## 6. Verify on the server

```bash theme={null}
sudo frpctl show clients
sudo frpctl show enrollments
```

Then inspect the assigned service port:

```bash theme={null}
sudo frpctl show client <CLIENT-ID> services
```

The client receives a persistent CLIENT ID and the SSH service receives a persistent public-port reservation.

## 7. Connect over SSH

```bash theme={null}
ssh -p <public-port> aella@<FRP-server-public-IP>
```

With an optional public service hostname:

```bash theme={null}
ssh -p <public-port> aella@fw.example.com
```

## Success checklist

You are finished when all of these are true:

* the client appears in `show clients`
* the client has a CLIENT ID
* the SSH service has an assigned public port
* the client reports healthy FRP state
* the public service port is allowed through the server-side firewall/NAT
* SSH reaches the intended target

## If it does not work

Use [Troubleshooting](/troubleshooting/overview) and run `frpctl doctor` on both sides **before** editing generated config, registry, identity, or PKI files.

## Next steps

* [Concepts & Mental Model](/getting-started/concepts)
* [Linux Client](/getting-started/linux-client)
* [Publishing Services](/guides/services)
* [Deployment Modes](/deployment/modes)
* [frpctl Guide](/frpctl/overview)