> ## Documentation Index
> Fetch the complete documentation index at: https://frp.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Publishing Services

> Publish SSH, HTTP, HTTPS, custom TCP, and LAN services through an enrolled client.

# Publishing Services

A **Service** is one TCP target that an enrolled client publishes through the FRP server. One client can publish one service or many.

## The universal service path

```mermaid theme={null}
flowchart LR
    U[Internet user]
    S[FRP server\npublic-port]
    C[FRP client]
    T[target-host:target-port]

    U -->|public TCP port| S
    S -->|FRP tunnel| C
    C -->|normal TCP connection| T
```

The target can be on the client itself or on another LAN host the client can reach.

## Common service types

| Type       | Typical target     | Example public access     | Important note                     |
| ---------- | ------------------ | ------------------------- | ---------------------------------- |
| SSH        | `127.0.0.1:22`     | `ssh -p 6000 user@server` | user/sshd must already exist       |
| HTTP       | `127.0.0.1:80`     | `http://server:6001`      | raw TCP forwarding                 |
| HTTPS      | `127.0.0.1:443`    | `https://server:6002`     | TLS stays end-to-end to target     |
| Custom TCP | `10.10.20.30:5432` | application-specific      | keep target authentication enabled |

## Pattern 1 — publish the client's own SSH

```mermaid theme={null}
flowchart LR
    U[Operator] -->|TCP 6000| S[FRP server]
    S --> C[Client A]
    C -->|127.0.0.1:22| SSH[sshd]
```

Typical target:

```text theme={null}
127.0.0.1:22
```

## Pattern 2 — one client, multiple local services

```mermaid theme={null}
flowchart LR
    U[Internet user]
    S[FRP server]
    C[Client A]
    A[SSH\n127.0.0.1:22]
    B[HTTPS\n127.0.0.1:443]
    D[API\n127.0.0.1:8080]

    U -->|6000| S
    U -->|6001| S
    U -->|6002| S
    S --> C
    C --> A
    C --> B
    C --> D
```

Each service gets its own stable Service ID and persistent public-port reservation.

## Pattern 3 — use the client as a small LAN gateway

```mermaid theme={null}
flowchart LR
    U[Internet user]
    S[FRP server]
    C[FRP client\ngateway host]
    H1[10.10.20.30:22\nLAN SSH]
    H2[10.10.20.40:80\nLAN HTTP]
    H3[10.10.20.50:443\nLAN HTTPS]

    U --> S --> C
    C --> H1
    C --> H2
    C --> H3
```

The FRP client only needs normal IP reachability to those target hosts.

## HTTPS is passthrough

```mermaid theme={null}
sequenceDiagram
    participant B as Browser
    participant S as FRP server
    participant C as FRP client
    participant W as HTTPS application

    B->>S: TLS connection to public service port
    S->>C: Forward encrypted TCP stream
    C->>W: Forward encrypted TCP stream
    W-->>B: Application certificate / TLS response
```

FRP Auto Deploy does not terminate or replace the application's TLS certificate. If users connect with `fw.example.com`, the target application must present a certificate valid for that hostname where applicable.

## Persistent public-port lifecycle

```mermaid theme={null}
stateDiagram-v2
    [*] --> Published
    Published --> Disabled: disable service
    Disabled --> Published: enable service
    Published --> Published: edit target + apply
    Disabled --> Released: release service
    Published --> Released: release service
    Released --> [*]
```

* **Disable** stops publication and keeps the port reserved.
* **Enable** resumes on the same reserved port.
* **Edit + apply** changes the target without intentionally changing the reservation.
* **Release** returns the public port to the pool.

## Security reminder

Publishing a service makes that service reachable through the assigned public endpoint. Keep the target application's own authentication, authorization, host firewall, and access controls enabled.

<CardGroup cols={3}>
  <Card title="SSH" icon="terminal" href="/guides/ssh">
    SSH-specific setup and checks.
  </Card>

  <Card title="HTTP & HTTPS" icon="globe" href="/guides/http-https">
    Web publishing and TLS passthrough.
  </Card>

  <Card title="Custom TCP & LAN" icon="network-wired" href="/guides/custom-tcp-lan">
    Databases, appliances, APIs, and LAN targets.
  </Card>
</CardGroup>