788 字
4 分钟
FRP 内网穿透综合部署手册

FRP 内网穿透综合部署手册#

1. 部署方案选择#

方案类型适用场景核心优势
传统二进制部署物理服务器/长期稳定运行环境资源占用低,直接进程管理
容器化部署云环境/快速部署场景环境隔离,一键启停

2. 服务端部署#

2.1 传统二进制部署#

2.1.1下载安装#

Terminal window
$ wget https://github.com/fatedier/frp/releases/download/v0.61.1/frp_0.61.1_linux_amd64.tar.gz
$ tar -zxvf frp_0.61.1_linux_amd64.tar.gz
$ mv frp_0.61.1_linux_amd64 /usr/local/frps

2.1.2修改配置文件#

Terminal window
$ vi /usr/local/frps/frps.toml
bindPort = 7000 #服务端监听端口
auth.method = "token" #服务端连接身份认证,默认token
auth.token = "Token值" #服务端token密码
vhostHTTPPort = 80
vhostHTTPSPort = 443
transport.tls.force = false #是否只接受启用了TLS的客户端连接
transport.maxPortsPerClient = 20 #每个客户端可以创建多少隧道
allowPorts = [
{ start = 10000, end = 15000 }, #端口范围设置为10000-15000可用
{ start = 30000, end = 40000 }, #同理,可设置多个端口范围开放
{ single = 25565 }, #单端口设置,指定25565端口可用
{ single = 25566 } #同理,可以设置多个单端口开放
]

2.1.3创建Systemd服务#

Terminal window
$ vi /etc/systemd/system/frps.service
[Unit]
Description=frps
After=network.target
[Service]
Type=simple
ExecStart=/usr/local/frps/frps -c /usr/local/frps/frps.toml
Restart=always
[Install]
WantedBy=multi-user.target

2.1.4启动服务器端的FRP#

Terminal window
$ systemctl enable --now frps
$ systemctl start frps

2.2 容器化部署#

2.2.1创建配置目录#

Terminal window
$ mkdir -p /opt/frps && cd /opt/frps

2.2.2配置文件#

Terminal window
$ vi frps.toml
bindAddr = "0.0.0.0" # 公网IP地址
bindPort = 7000
auth.method = "token"
auth.token = "your_secure_token"
webServer.addr = "0.0.0.0"
webServer.port = 7500 # 管理界面端口

2.2.3Docker-compose配置#

Terminal window
$ vi docker-compose.yaml
version: '3'
services:
frps:
image: snowdreamtech/frps:0.61.1
container_name: frps
restart: always
network_mode: host
volumes:
- ./frps.toml:/etc/frp/frps.toml

2.2.4启动服务#

Terminal window
$ docker-compose up -d

2.2.5停止服务#

Terminal window
$ docker-compose stop

3. 客户端部署#

3.1 传统二进制部署#

3.1.1安装步骤同服务端#

Terminal window
$ mv frp_0.61.1_linux_amd64 /usr/local/frpc

3.1.2修改配置文件#

Terminal window
$ vi /usr/local/frpc/frpc.toml
serverAddr = "frp_server_ip" # frp服务器端IP地址
serverPort = 7000
auth.token = "your_secure_token"
[[proxies]]
name = "ssh"
type = "tcp"
localIP = "127.0.0.1"
localPort = 22
remotePort = 7080
transport.useEncryption = true

3.1.3创建Systemd服务#

Terminal window
$ vi /etc/systemd/system/frpc.service
[Unit]
Description=frpc
After=network.target syslog.target
Wants=network.target
[Service]
Type=simple
ExecStart=/usr/local/frpc/frpc -c /usr/local/frpc/frpc.toml
Restart=always
[Install]
WantedBy=multi-user.target

3.1.4启动客户端的FRP#

Terminal window
$ systemctl enable --now frpc
$ systemctl start frpc

3.2 容器化部署#

3.2.1创建配置目录#

Terminal window
$ mkdir -p /opt/frpc && cd /opt/frpc

3.2.2修改配置文件#

Terminal window
$ vi frpc.toml
serverAddr = "frp_server_ip" # frp服务器端IP地址
serverPort = 7000
auth.token = "your_secure_token"
[[proxies]]
name = "web"
type = "http"
localPort = 8080
customDomains = ["your.domain.com"]

3.2.3Docker-compose配置#

Terminal window
$ vi docker-compose.yml
version: '3'
services:
frpc:
image: snowdreamtech/frpc:0.61.1
container_name: frpc
restart: always
network_mode: host
volumes:
- ./frpc.toml:/etc/frp/frpc.toml

3.2.4启动服务#

Terminal window
$ docker-compose up -d

3.2.5停止服务#

Terminal window
$ docker-compose stop

4. 多服务器连接配置#

4.1 传统方式多实例#

4.1.1创建多个配置文件#

Terminal window
$ cp /usr/local/frpc/frpc.toml /usr/local/frpc/frpc@1.toml
$ cp /usr/local/frpc/frpc.toml /usr/local/frpc/frpc@2.toml

4.1.2创建多实例服务文件#

Terminal window
$ vi /etc/systemd/system/frpc@1.service
[Unit]
Description=frpc instance %i
After=network.target
[Service]
Type=simple
ExecStart=/usr/local/frpc/frpc -c /usr/local/frpc/frpc-%i.toml
Restart=always
[Install]
WantedBy=multi-user.target

4.1.3启动实例#

Terminal window
$ systemctl enable --now frpc@1 frpc@2
$ systemctl start frpc@1 frpc@2

4.2 容器化多实例#

4.2.1为每个实例创建独立目录#

Terminal window
$ mkdir -p /opt/frpc/{instance1,instance2}

4.2.2启动时指定配置路径#

Terminal window
$ docker run -d --name frpc1 \
-v /opt/frpc/instance1/frpc.toml:/etc/frp/frpc.toml \
--network host \
snowdreamtech/frpc:0.61.1

5. 安全加固措施#

5.1 通用安全配置#

5.1.1服务端配置增强#

transport.tls.force = true # 强制TLS加密
transport.maxPortsPerClient = 10 # 限制单客户端端口数

附:网络拓扑示意图

[ 内网客户端 ] → (FRP Client) → [ 公网FRP Server ] ← (外部访问者)
加密隧道 端口映射
FRP 内网穿透综合部署手册
http://blog.xeu.asia/posts/技术折腾/frp-内网穿透综合部署手册/
作者
Xeu
发布于
2025-01-06
许可协议
CC BY-NC-SA 4.0