Skip to main content

Server Installation

The FRP Auto Deploy server is the public entry point. It runs official frps plus enrollment, registry, lifecycle, and frpctl management components. For the simplest first deployment, use an Ubuntu 24.04 x86_64 server with a direct public IP. Ubuntu 22.04/24.04 are the documented real-VM baseline for the stable release. Other Linux families have different validation levels; see Supported Platforms.

Choose the topology first

NAT is a network topology, not a third FRP Auto Deploy mode. The two product modes are Direct and Enterprise single-443.

Direct mode defaults

TCP/22 is optional for your own administrative SSH access to the server; it is not part of the FRP Auto Deploy tunnel path.

If the server is behind NAT

Example: Clients must use the public control/enrollment endpoints, not the server’s private address. See Firewall & NAT.

Install the current stable release

Current published stable: v2.1.2.
Use the immutable stable tag for field installs rather than mutable main unless you intentionally want development behavior.

What the installer asks for

Expect questions about:
  1. public IP / public control endpoint
  2. optional public service hostname
  3. internal server IP
  4. Direct vs Enterprise single-443
  5. public and local control ports
  6. public and local enrollment/allocator ports
  7. published service range
The installer does not create AWS Security Groups, OCI Security Lists, external firewall/NAT rules, UFW/firewalld/iptables policy, or DNS records.

Verify immediately after installation

doctor is read-only and checks installation state, permissions, PKI, service state, registry consistency, topology, and common network problems.

Persistent state you should understand

These files/state protect trust, identity, and public-port reservations. Do not manually edit them during normal operation.

Server readiness checklist

  • required systemd services are active
  • frpctl doctor has no blocking finding
  • public control/enrollment endpoints are reachable from the client network
  • published service range is allowed by the server-side firewall/NAT
  • if using DNS, the public hostname resolves to the correct public entry point

Next

Last modified on September 7, 2026