> ## Documentation Index
> Fetch the complete documentation index at: https://frp.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom TCP & LAN Targets

> Publish arbitrary TCP services and services hosted on other LAN systems reachable from the FRP client.

# Custom TCP & LAN Targets

FRP Auto Deploy is not limited to SSH/web. The stable core can publish arbitrary **TCP** targets reachable from an enrolled client.

## Local custom TCP examples

```text theme={null}
Grafana       127.0.0.1:3000
API           127.0.0.1:8080
Custom agent  127.0.0.1:9000
```

```mermaid theme={null}
flowchart LR
    U[Internet client] -->|assigned public port| S[FRP Server]
    S --> C[FRP Client]
    C -->|127.0.0.1:3000| G[Grafana]
```

## LAN gateway pattern

The target does not have to run on the FRP client itself.

```mermaid theme={null}
flowchart LR
    U[Internet users]
    S[FRP Server]
    C[FRP Client\ngateway host]
    DB[10.10.30.30:5432\nPostgreSQL]
    UI[10.10.40.50:8443\nAppliance UI]
    API[10.10.30.20:8080\nAPI]

    U --> S --> C
    C --> DB
    C --> UI
    C --> API
```

The only FRP-specific requirement for the target path is that the FRP client can make a normal TCP connection to the configured `target-host:target-port`.

## Before publishing a LAN target

```mermaid theme={null}
flowchart TD
    A[Want to publish LAN target] --> B{Can the FRP client reach\ntarget-host:target-port directly?}
    B -->|No| C[Fix routing / ACL / target firewall / listener]
    B -->|Yes| D[Add FRP Auto Deploy service]
    D --> E[Verify assigned public port]
    E --> F[Test from external network]
```

## Stable Service ID

Use a descriptive stable Service ID, for example:

```text theme={null}
postgres-reporting
appliance-ui
branch-api
```

Changing the display name or target later should not require changing the Service ID.

## Security responsibility

Publishing a database, appliance, or API makes that TCP endpoint reachable through the public FRP entry point. FRP Auto Deploy does not automatically configure:

* database users or ACLs
* application authentication
* target host firewalls
* network segmentation
* source-IP allow lists

Keep the target application's own authentication and authorization enabled.

<Warning>
  Be especially cautious when publishing databases or administrative appliance ports. A reachable port is not the same thing as an appropriately secured service.
</Warning>

## Port lifecycle

Normal target edits and disable/enable operations are designed to preserve the public-port reservation. Use `release service` only when you intend to return the port to the pool.