Intranet penetrating FRP: hidden communication tunnel technology

1 frp Introduce

matters needing attention ：
1） The version downloaded on the server side and the intranet machine side should be the same , Otherwise, intranet penetration may be affected
2） Select the appropriate script according to the server system

Scripts are mainly divided into server and client files
1. The server side of the Internet uses Frps and Frps.ini
2.win10 The computer uses Frpc and Frpc.ini

notes ：
Server deployment , You can only keep the server files frps**
​ Client Deployment , You can keep only client files frpc**

Download address ：

https://github.com/fatedier/frp/releases/tag/v0.37.1

Note the download version

tar -zxvf frp_0.37.1_linux_arm64.tar.gz
mv frp_0.37.1_linux_arm64 frp
cd frp

2 Server configuration

2.1 Modify the configuration

vim frps.ini

[common]
#  The intranet penetrates the server side to listen IP Address , It can be omitted , The default is 127.0.0.1
bind_addr = 0.0.0.0
#  The port on which the server listens , The default is 7000, Customizable 
bind_port = 7000
#  For authentication , Please modify , Ensure that the server is consistent with the client 
token = ch

2.2 start-up

./frps -c frps.ini

3 Client configuration

3.1 win10

360 Can report poison

3.1.1 Modify the configuration

frpc.ini

[common]
#  Extranet - Server side ip
server_addr = 121.**.**.124
#  Extranet - The port on which the server listens ( Must be with Frps.ini The configuration in is consistent )
server_port = 7000
#  For authentication , Please modify , Ensure that the server is consistent with the client 
token = ch

[ssh]
#  The configuration type is http agreement 
type = tcp
#  Intranet machines IP
local_ip = 127.0.0.1
# The port that the intranet needs to listen on （win10 Enabled service port ）
local_port = 8888
remote_port = 6000

3.1.2 start-up

./frpc -c frpc.ini

3.1.3 visit

vps function

curl 127.0.0.1

Despite the success , But the description is still not detailed , The following is a specific case

4 adopt ssh Access intranet machine

• Intranet linux
• Public network vps
• Intranet kali

scene ： Put the intranet linux 22 Port maps to vps,kali visit vps, Achieve access to the intranet linux The effect of

4.1 Server side

frps.ini

[common]
#  The intranet penetrates the server side to listen IP Address , It can be omitted , The default is 127.0.0.1
bind_addr = 0.0.0.0
#  The port on which the server listens , The default is 7000, Customizable 
bind_port = 7000
#  For authentication , Please modify , Ensure that the server is consistent with the client 
token = charles

./frps -c frps.ini

4.2 client

frpc.ini

[common]
#  Extranet - Server side ip
server_addr = 121.**.**.124
#  Extranet - The port on which the server listens ( Must be with Frps.ini The configuration in is consistent )
server_port = 7000
#  For authentication , Please modify , Ensure that the server is consistent with the client 
token = charles

[ssh]
type = tcp
local_ip = 127.0.0.1
local_port = 22
remote_port = 6000

./frpc -c frpc.ini

4.3 visit

ssh -oPort=6000 [email protected]**.**.124

Have to say , very nice

5 Access the intranet through the domain name Web service

5.1 Server side

frps.ini, Set up http Access port is 8080,

https equally ：type Set to https that will do

[common]
#  The port on which the server listens , The default is 7000, Customizable 
bind_port = 7000
#  Set up  http  Access port is  8080
vhost_http_port = 8080
#  For authentication , Please modify , Ensure that the server is consistent with the client 
token = charles

./frps -c ./frps.ini

5.2 client

frpc.ini

[common]
#  Extranet - Server side ip
server_addr = 121.**.**.124
#  Extranet - The port on which the server listens ( Must be with Frps.ini The configuration in is consistent )
server_port = 7000
#  For authentication , Please modify , Ensure that the server is consistent with the client 
token = charles

[web]
type = http
#  On the local machine  Web  The port corresponding to the service 
local_port = 80
#  Bind custom domain name 
custom_domains = www.***.net

./frpc -c ./frpc.ini

5.3 visit

http://frp.***.net:8080

6 Provide simple external file access services ( Test to fail )

adopt static_file The plug-in can provide a simple interface based on HTTP File access service .

6.1 Server side

[common]
#  The port on which the server listens , The default is 7000, Customizable 
bind_port = 7000
#  Set up  http  Access port is  8080
vhost_http_port = 8080
#  For authentication , Please modify , Ensure that the server is consistent with the client 
token = charles

./frps -c ./frps.ini

6.2 client

[common]
#  Extranet - Server side ip
server_addr = 121.**.**.124
#  Extranet - The port on which the server listens ( Must be with Frps.ini The configuration in is consistent )
server_port = 7000
#  For authentication , Please modify , Ensure that the server is consistent with the client 
token = charles

[test_static_file]
type = tcp
remote_port = 6000
plugin = static_file
#  Directory of files to be exposed 
plugin_local_path = /tmp
#  visit  url  Prefixes to be removed from , The reserved content is the file path to be accessed 
plugin_strip_prefix = static
#  user name 
plugin_http_user = admin
#  password 
plugin_http_passwd = root

./frpc -c ./frpc.ini

6.3 visit

http://121.**.**.124:6000/static/ 

7 Statistics panel

View... Through a browser frp Status and agent statistics display .

notes ：Dashboard Not yet for a large number of proxy Optimize data presentation , If appear Dashboard Slow access , Please do not enable this feature .

Need to be in frps.ini It is specified in dashboard The port used by the service , This function can be turned on ：

7.1 Server side

frps.ini

[common]
dashboard_port = 7500
# dashboard  User name, password , The default is  admin
dashboard_user = admin
dashboard_pwd = root

7.2 visit

http://121.**.**.124:7500 

8 Encryption and compression

These two functions are not enabled by default , Need to be in frpc.ini Enables encryption and compression for the specified agent through configuration , The compression algorithm uses snappy：

8.1 client

frpc.ini

[ssh]
type = tcp
local_port = 22
remote_port = 6000
use_encryption = true
use_compression = true

If the company's intranet firewall has carried out traffic identification and shielding for external network access , For example, it's banned SSH Agreements, etc , By setting use_encryption = true, take frpc And frps Encrypted transmission of communication content between , Will effectively prevent traffic from being intercepted .

If the transmitted message length is long , By setting use_compression = true Compress the transmitted content , Can effectively reduce frpc And frps Network traffic between , Speed up traffic forwarding , But it will consume some extra CPU resources .

9 TLS

from v0.25.0 Version start frpc and frps Support between TLS Protocol encrypted transmission . By means of frpc.ini Of common Middle configuration tls_enable = true To enable this feature , safer .

For port multiplexing ,frp establish TLS The first byte of the connection is 0x17.

Be careful ： When this function is enabled, except xtcp Outside , No need to set again use_encryption.

10 Proxy speed limit

At present, it supports setting the speed limit of the agent level in the agent configuration of the client , Limit individual proxy Available bandwidth .

10.1 client

frpc.ini

[ssh]
type = tcp
local_port = 22
remote_port = 6000
bandwidth_limit = 1MB

Add... In the agent configuration bandwidth_limit Field enables this feature , Currently only supported MB and KB Company .

11 Range port mapping

stay frpc Mapping multiple ports can be specified in the configuration file of , Currently only supported tcp and udp The type of .

This function passes through range: Paragraph markers to achieve , The client will parse the configuration in this tag , Split it into multiple proxy, every last proxy Name with numbers as suffixes .

For example, to map local 6000-6005, 6007 this 6 Ports , The main configuration is as follows ：

11.1 client

[range:test_tcp]
type = tcp
local_ip = 127.0.0.1
local_port = 6000-6006,6007
remote_port = 6000-6006,6007

After the actual connection is successful, it will create 8 individual proxy, Name it test_tcp_0, test_tcp_1 ... test_tcp_7.

12 Other reference

12.1 Server side

frps.ini

#  The following sentence must begin with , Indicates the beginning of the configuration 
[common]
# frps Binding port  ( Mandatory )
bind_port = 7000
# frps  journal  ( Optional )
log_file = ./frps.log
# frps  The log level  ( Optional )
log_level = warn
# frps  Log storage days  ( Optional )
log_max_days = 30
#  The default is 900 second , namely 15 minute , If I set it to 0 There will be no timeout verification for the message timestamp 
authentication_timeout = 900
#  Instrument cluster port , The instrument cluster can only be used if it is set （ Backstage ）
dashboard_port = 7500
#  Username and password for dashboard access , If not set , The default is  admin
dashboard_user = admin
dashboard_pwd = admin
# frp  Penetrate the website listening port in the intranet   Used together with the later nginx Do domain name binding access 
vhost_http_port = 7001
#  take  frp.so.codeceo.org  After parsing to the server , You can use this domain name to access the corresponding... Of the client  http
subdomain_host = frp.so.codeceo.org

12.2 client

frpc.ini

[common]
#  Server public network IP
server_addr = xxx.xxx.xxx.xxx 
#  Server side frps Binding port 
server_port = 7000

[web1]
type = http
local_port = 80
custom_domains = web1.***.org

[web2]
type = http
local_ip = localhost
local_port = 9528
use_gzip = true
custom_domains = web2.***.org

[web6]
type = http
local_port = 80
custom_domains = web6.***.org

13 It's common to report mistakes

./frps: cannot execute binary file: Exec format error  
 It indicates that the software version does not match the server architecture , It can be solved by changing the version .

Reference address ：

https://www.jianshu.com/p/6be158cc3685

https://segmentfault.com/a/1190000021876836

https://www.cnblogs.com/liscookie/p/11237615.html