A small FRP client package can be more useful than a full installer when the goal is temporary remote access, rapid deployment, or distribution to a limited number of trusted users.<\/p>\n\n\n\n
The key is not simply to copy A clean design can achieve all of this without installing FRPC as a system service on the client machine.<\/p>\n\n\n\n The intended architecture is based on one independent FRPS environment per distributed FRPC package<\/strong>.<\/p>\n\n\n\n Instead of sharing one server-side FRPS process among multiple recipients:<\/p>\n\n\n\n each package is assigned its own FRPS instance:<\/p>\n\n\n\n Each pair has its own:<\/p>\n\n\n\n For example:<\/p>\n\n\n\n and independently:<\/p>\n\n\n\n A compromised configuration from one package therefore does not automatically grant access to another FRPS security domain.<\/p>\n\n\n\n A simple FRPS directory can keep one executable while using multiple configuration files:<\/p>\n\n\n\n Each FRPS instance is then managed separately by systemd:<\/p>\n\n\n\n A generic service definition looks like:<\/p>\n\n\n\n The benefit is operational isolation.<\/p>\n\n\n\n Restarting:<\/p>\n\n\n\n does not affect:<\/p>\n\n\n\n A portable-client FRPS instance does not necessarily need a web dashboard.<\/p>\n\n\n\n A minimal configuration can look like:<\/p>\n\n\n\n If TCP and QUIC intentionally use the same numerical port:<\/p>\n\n\n\n the firewall must allow both:<\/p>\n\n\n\n The SSH proxy itself only requires:<\/p>\n\n\n\n There is no reason to open the SSH remote port over UDP.<\/p>\n\n\n\n A client possessing a valid FRPS token can request remote proxy ports.<\/p>\n\n\n\n Without a restriction, the client may potentially request arbitrary available ports on the FRPS machine.<\/p>\n\n\n\n Therefore each isolated FRPS instance should ideally contain a strict whitelist:<\/p>\n\n\n\n A temporary SSH-only FRPS instance therefore has access to exactly one server-side published port.<\/p>\n\n\n\n This creates a useful security boundary:<\/p>\n\n\n\n The client configuration can remain very small.<\/p>\n\n\n\n For an SSH-only package:<\/p>\n\n\n\n Using:<\/p>\n\n\n\n instead of:<\/p>\n\n\n\n removes hostname-resolution ambiguity and makes the local target explicit.<\/p>\n\n\n\n A cross-platform package can include both Linux and Windows binaries:<\/p>\n\n\n\n The lowercase package directory is convenient for Linux and other case-sensitive systems:<\/p>\n\n\n\n while the control scripts retain the explicit This is useful if one of the scripts is copied outside its intended directory. A generic filename such as:<\/p>\n\n\n\n reveals almost nothing about what it controls.<\/p>\n\n\n\n By contrast:<\/p>\n\n\n\n is immediately recognizable.<\/p>\n\n\n\n A raw FRPC package normally requires the user to open a terminal and run something like:<\/p>\n\n\n\n That is acceptable for administrators, but inconvenient for casual recipients.<\/p>\n\n\n\n A portable distribution benefits from three simple operations:<\/p>\n\n\n\n The package then behaves almost like a small application without requiring installation.<\/p>\n\n\n\n The Windows start script should:<\/p>\n\n\n\n A hidden runtime directory can store temporary state:<\/p>\n\n\n\n The user-facing directory remains clean.<\/p>\n\n\n\n A dangerous stop implementation would be:<\/p>\n\n\n\n This kills every FRPC process<\/strong> on the machine.<\/p>\n\n\n\n That becomes a serious problem if a Windows host happens to run several independent FRPC instances.<\/p>\n\n\n\n A safer design identifies the intended process using a combination of:<\/p>\n\n\n\n For example, a process should only be considered part of package The stop script can then terminate only that exact process.<\/p>\n\n\n\n A PID file is useful:<\/p>\n\n\n\n but operating systems eventually reuse process IDs.<\/p>\n\n\n\n Therefore a robust status or stop script should not simply read:<\/p>\n\n\n\n and kill PID 12345.<\/p>\n\n\n\n It should verify that the PID still belongs to:<\/p>\n\n\n\n If not, the PID file is stale and should be removed.<\/p>\n\n\n\n The status script should answer one simple question:<\/p>\n\n\n\n On Windows, a popup is convenient:<\/p>\n\n\n\n or:<\/p>\n\n\n\n A popup avoids the awkward behavior of a command window appearing briefly and immediately disappearing.<\/p>\n\n\n\n For terminal-only environments, a status script can instead print the result and optionally wait for:<\/p>\n\n\n\n Linux packages can use the same conceptual Start \/ Status \/ Stop interface.<\/p>\n\n\n\n A startup script can launch FRPC with:<\/p>\n\n\n\n and record:<\/p>\n\n\n\n as the PID.<\/p>\n\n\n\n On desktop Linux, scripts can display graphical dialogs when available:<\/p>\n\n\n\n and fall back to terminal output otherwise.<\/p>\n\n\n\n This makes the same package usable both from:<\/p>\n\n\n\n and:<\/p>\n\n\n\n Linux provides an especially reliable way to verify process identity through For a stored PID:<\/p>\n\n\n\n can be inspected.<\/p>\n\n\n\n A valid package FRPC process should satisfy both conditions:<\/p>\n\n\n\n and its command line should contain:<\/p>\n\n\n\n This prevents a stop script from terminating another FRPC process merely because the process name happens to be the same.<\/p>\n\n\n\n If a package targets x86-64 systems, it can contain:<\/p>\n\n\n\n The configuration file is shared between operating systems.<\/p>\n\n\n\n For ARM64 Linux machines, the Linux executable must instead be replaced with the ARM64 build:<\/p>\n\n\n\n The scripts and TOML configuration generally do not need to change.<\/p>\n\n\n\n For controlled deployments, using the same FRP release on client and server simplifies compatibility testing.<\/p>\n\n\n\n For example:<\/p>\n\n\n\n A portable package should ideally be assembled from one explicitly selected FRP release rather than mixing binaries downloaded at different times.<\/p>\n\n\n\n Each recipient should receive a separate archive:<\/p>\n\n\n\n rather than one archive containing both configurations.<\/p>\n\n\n\n The separation is important because the TOML contains credentials.<\/p>\n\n\n\n Conceptually:<\/p>\n\n\n\n No recipient needs to know another package exists.<\/p>\n\n\n\n A professional-looking portable package should include an external checksum file.<\/p>\n\n\n\n Generate it with:<\/p>\n\n\n\n The result contains:<\/p>\n\n\n\n The recipient can verify it with:<\/p>\n\n\n\n Expected result:<\/p>\n\n\n\n The Otherwise it cannot independently validate the archive.<\/p>\n\n\n\n A project distributing many public release artifacts often uses:<\/p>\n\n\n\n containing all package hashes.<\/p>\n\n\n\n For private recipient-specific packages, individual files are cleaner:<\/p>\n\n\n\n Each recipient only receives information about their own package.<\/p>\n\n\n\n One of the easiest packaging mistakes is validating only the source directory.<\/p>\n\n\n\n A more reliable release procedure is:<\/p>\n\n\n\n This simulates what the recipient will actually experience.<\/p>\n\n\n\n It catches problems such as:<\/p>\n\n\n\n A clean Linux validation sequence is:<\/p>\n\n\n\n then:<\/p>\n\n\n\n verify the binary:<\/p>\n\n\n\n verify configuration syntax:<\/p>\n\n\n\n start through the distributed script:<\/p>\n\n\n\n check status:<\/p>\n\n\n\n and verify the remote SSH path:<\/p>\n\n\n\n Finally:<\/p>\n\n\n\n and confirm no FRPC process remains.<\/p>\n\n\n\n A valid TOML file only proves syntax.<\/p>\n\n\n\n A complete test should verify the entire path:<\/p>\n\n\n\n A command such as:<\/p>\n\n\n\n is useful because it confirms that an actual SSH server is reachable through the complete chain without requiring an interactive login.<\/p>\n\n\n\n A successful result resembles:<\/p>\n\n\n\n followed by host keys.<\/p>\n\n\n\n At that point the forwarding path is operational.<\/p>\n\n\n\n The FRPS host needs two different categories of firewall rules.<\/p>\n\n\n\n For the FRPC-to-FRPS transport:<\/p>\n\n\n\n For a TCP SSH proxy:<\/p>\n\n\n\n Therefore:<\/p>\n\n\n\n The same distinction should also be reflected in the edge router’s NAT rules.<\/p>\n\n\n\n Each package has an independent revocation path.<\/p>\n\n\n\n If package A should no longer work, the administrator can remove or disable:<\/p>\n\n\n\n without touching package B.<\/p>\n\n\n\n This is much cleaner than several recipients sharing:<\/p>\n\n\n\n The resulting architecture resembles:<\/p>\n\n\n\n The two paths share physical infrastructure but not FRPS processes, credentials, control ports, or published SSH ports.<\/p>\n\n\n\n A polished distribution can ultimately look like:<\/p>\n\n\n\n distributed as:<\/p>\n\n\n\n Internally, runtime files are created only after execution:<\/p>\n\n\n\n A portable FRPC package can be much more than an executable and a TOML file.<\/p>\n\n\n\n With a small amount of structure, it becomes a controlled, cross-platform remote-access component with:<\/p>\n\n\n\n The most important design principle is isolation.<\/p>\n\n\n\n Each recipient should be treated as a separate security boundary rather than merely another configuration pointing at the same FRPS instance.<\/p>\n\n\n\n Once that principle is combined with strict port whitelisting, precise process management, reproducible packaging, and end-to-end testing of the actual archive, FRPC becomes suitable for temporary, portable deployment without sacrificing operational clarity.<\/p>\n","protected":false},"excerpt":{"rendered":" A small FRP client package can be more useful than a full installer when the goal is temporary remote access, rapid deployment, or distribution to a limited number of trusted users. The key is not simply to copy frpc.exe together with a configuration file. A good portable package should be: …<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[120],"tags":[335],"class_list":["post-6188","post","type-post","status-publish","format-standard","hentry","category-1s3b6h7r2zay02x","tag-tunneling"],"_links":{"self":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/comments?post=6188"}],"version-history":[{"count":1,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6188\/revisions"}],"predecessor-version":[{"id":6189,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6188\/revisions\/6189"}],"wp:attachment":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/media?parent=6188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/categories?post=6188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/tags?post=6188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}frpc.exe<\/code> together with a configuration file. A good portable package should be:<\/p>\n\n\n\n\n
\n\n\n\n1. The Core Design Goal<\/h2>\n\n\n\n
Shared FRPS\n \/ | \\\n User A User B User C<\/code><\/pre>\n\n\n\nFRPC-A \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25ba FRPS-A\nFRPC-B \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25ba FRPS-B\nFRPC-C \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25ba FRPS-C<\/code><\/pre>\n\n\n\nFRPS process\nFRPS configuration\ncontrol port\nauthentication token\nremote-port whitelist\nFRPC configuration<\/code><\/pre>\n\n\n\nFRPC-A\n \u2193 QUIC\/TLS\n<FRPS_DOMAIN_A>:<FRPS_PORT_A>\n \u2193\nFRPS-A\n \u2193\n<REMOTE_SSH_PORT_A>\n \u2193\nFRPC-A host:22<\/code><\/pre>\n\n\n\nFRPC-B\n \u2193 QUIC\/TLS\n<FRPS_DOMAIN_B>:<FRPS_PORT_B>\n \u2193\nFRPS-B\n \u2193\n<REMOTE_SSH_PORT_B>\n \u2193\nFRPC-B host:22<\/code><\/pre>\n\n\n\n
\n\n\n\n2. Server-Side Multi-Instance Layout<\/h1>\n\n\n\n
<FRPS_DIRECTORY>\/\n\u251c\u2500\u2500 frps\n\u251c\u2500\u2500 frps1.toml\n\u251c\u2500\u2500 frps2.toml\n\u2514\u2500\u2500 frps3.toml<\/code><\/pre>\n\n\n\nfrps1.service \u2192 frps1.toml\nfrps2.service \u2192 frps2.toml\nfrps3.service \u2192 frps3.toml<\/code><\/pre>\n\n\n\n[Unit]\nDescription=frps<N>-server\n\n[Service]\nUser=<SERVICE_USER>\nWorkingDirectory=<FRPS_DIRECTORY>\nExecStart=<FRPS_DIRECTORY>\/frps -c <FRPS_DIRECTORY>\/frps<N>.toml\nRestart=always\n\n[Install]\nWantedBy=multi-user.target<\/code><\/pre>\n\n\n\nsystemctl restart frps2.service<\/code><\/pre>\n\n\n\nfrps1.service\nfrps3.service<\/code><\/pre>\n\n\n\n
\n\n\n\n3. Minimal FRPS Configuration for Portable Clients<\/h1>\n\n\n\n
#################################### Communication ###############################\n\nbindPort = <FRPS_TCP_PORT>\nquicBindPort = <FRPS_UDP_PORT>\nuserConnTimeout = 30\n\n#################################### Authentication ##############################\n\nauth.method = \"token\"\nauth.token = \"<UNIQUE_AUTH_TOKEN>\"\nauth.additionalScopes = [\"HeartBeats\", \"NewWorkConns\"]\n\n#################################### Allowed Remote Ports ########################\n\nallowPorts = [\n { single = <REMOTE_SSH_PORT> }\n]\n\n#################################### Transport ###################################\n\ntransport.tls.force = true<\/code><\/pre>\n\n\n\nbindPort = <FRPS_PORT>\nquicBindPort = <FRPS_PORT><\/code><\/pre>\n\n\n\n<FRPS_PORT>\/tcp\n<FRPS_PORT>\/udp<\/code><\/pre>\n\n\n\n<REMOTE_SSH_PORT>\/tcp<\/code><\/pre>\n\n\n\n
\n\n\n\n4. Why
allowPorts<\/code> Matters<\/h1>\n\n\n\nallowPorts = [\n { single = <REMOTE_SSH_PORT> }\n]<\/code><\/pre>\n\n\n\nAuthentication token\n +\nRemote-port whitelist\n +\nIndependent FRPS process<\/code><\/pre>\n\n\n\n
\n\n\n\n5. Client Configuration<\/h1>\n\n\n\n
#################################### Server ######################################\n\nserverAddr = \"<FRPS_DOMAIN>\"\nserverPort = <FRPS_PORT>\n\n#################################### Transport ###################################\n\ntransport.protocol = \"quic\"\ntransport.tls.enable = true\n\n#################################### Authentication ##############################\n\nauth.method = \"token\"\nauth.token = \"<UNIQUE_AUTH_TOKEN>\"\nauth.additionalScopes = [\"HeartBeats\", \"NewWorkConns\"]\n\n#################################### Proxy ########################################\n\n[[proxies]]\nname = \"<PACKAGE_NAME> SSH\"\ntype = \"tcp\"\nlocalIP = \"127.0.0.1\"\nlocalPort = 22\nremotePort = <REMOTE_SSH_PORT><\/code><\/pre>\n\n\n\nlocalIP = \"127.0.0.1\"<\/code><\/pre>\n\n\n\nlocalIP = \"localhost\"<\/code><\/pre>\n\n\n\n
\n\n\n\n6. Portable Package Structure<\/h1>\n\n\n\n
frpc<N>\/\n\u251c\u2500\u2500 frpc\n\u251c\u2500\u2500 frpc.exe\n\u251c\u2500\u2500 frpc<N>.toml\n\u251c\u2500\u2500 FRPC-Start.bat\n\u251c\u2500\u2500 FRPC-Status.bat\n\u251c\u2500\u2500 FRPC-Stop.bat\n\u251c\u2500\u2500 FRPC-Start.sh\n\u251c\u2500\u2500 FRPC-Status.sh\n\u2514\u2500\u2500 FRPC-Stop.sh<\/code><\/pre>\n\n\n\nfrpc2\/\nfrpc3\/<\/code><\/pre>\n\n\n\nFRPC<\/code> prefix:<\/p>\n\n\n\nFRPC-Start\nFRPC-Status\nFRPC-Stop<\/code><\/pre>\n\n\n\nStart.bat<\/code><\/pre>\n\n\n\nFRPC-Start.bat<\/code><\/pre>\n\n\n\n
\n\n\n\n7. Why Start, Status, and Stop Scripts Are Worth Adding<\/h1>\n\n\n\n
frpc -c frpc<N>.toml<\/code><\/pre>\n\n\n\nFRPC-Start\nFRPC-Status\nFRPC-Stop<\/code><\/pre>\n\n\n\n
\n\n\n\n8. Windows Start Behavior<\/h1>\n\n\n\n
\n
frpc.exe<\/code> in the background;<\/li>\n\n\n\n.runtime\\\n\u251c\u2500\u2500 frpc.pid\n\u251c\u2500\u2500 frpc.log\n\u2514\u2500\u2500 frpc-error.log<\/code><\/pre>\n\n\n\n
\n\n\n\n9. Do Not Kill FRPC by Process Name<\/h1>\n\n\n\n
taskkill \/IM frpc.exe \/F<\/code><\/pre>\n\n\n\nexecutable path\nconfiguration filename\nPID\ncommand line<\/code><\/pre>\n\n\n\nfrpc2<\/code> if it matches something equivalent to:<\/p>\n\n\n\n<PACKAGE_DIRECTORY>\\frpc.exe\n-c <PACKAGE_DIRECTORY>\\frpc2.toml<\/code><\/pre>\n\n\n\n
\n\n\n\n10. PID Files Should Not Be Trusted Blindly<\/h1>\n\n\n\n
.runtime\/frpc.pid<\/code><\/pre>\n\n\n\n12345<\/code><\/pre>\n\n\n\nthe expected FRPC executable\n+\nthe expected configuration<\/code><\/pre>\n\n\n\n
\n\n\n\n11. Status Script Design<\/h1>\n\n\n\n
Is this package's FRPC process running?<\/code><\/pre>\n\n\n\nFRPC is running.\nPID: <PID><\/code><\/pre>\n\n\n\nFRPC is not running.<\/code><\/pre>\n\n\n\nPress any key to exit...<\/code><\/pre>\n\n\n\n
\n\n\n\n12. Linux Script Behavior<\/h1>\n\n\n\n
nohup .\/frpc -c .\/frpc<N>.toml > .runtime\/frpc.log 2>&1 <\/dev\/null &<\/code><\/pre>\n\n\n\n$!<\/code><\/pre>\n\n\n\nKDE \u2192 kdialog\nGNOME\/etc \u2192 zenity<\/code><\/pre>\n\n\n\ndesktop file manager<\/code><\/pre>\n\n\n\nSSH \/ terminal<\/code><\/pre>\n\n\n\n
\n\n\n\n13. Linux Process Validation<\/h1>\n\n\n\n
\/proc<\/code>.<\/p>\n\n\n\n\/proc\/<PID>\/exe\n\/proc\/<PID>\/cmdline<\/code><\/pre>\n\n\n\n\/proc\/<PID>\/exe\n =\n<PACKAGE_DIRECTORY>\/frpc<\/code><\/pre>\n\n\n\nfrpc<N>.toml<\/code><\/pre>\n\n\n\n
\n\n\n\n14. Cross-Platform Binary Packaging<\/h1>\n\n\n\n
frpc \u2192 Linux x86-64 ELF\nfrpc.exe \u2192 Windows x86-64 PE<\/code><\/pre>\n\n\n\nfrpc \u2192 Linux ARM64<\/code><\/pre>\n\n\n\n
\n\n\n\n15. Matching Client and Server Versions<\/h1>\n\n\n\n
FRPS: <FRP_VERSION>\nFRPC Linux: <FRP_VERSION>\nFRPC Windows: <FRP_VERSION><\/code><\/pre>\n\n\n\n
\n\n\n\n16. Distribution Archive<\/h1>\n\n\n\n
frpc2.zip\nfrpc3.zip<\/code><\/pre>\n\n\n\nRecipient A\n\u251c\u2500\u2500 frpc2.zip\n\u2514\u2500\u2500 frpc2.zip.sha256\n\nRecipient B\n\u251c\u2500\u2500 frpc3.zip\n\u2514\u2500\u2500 frpc3.zip.sha256<\/code><\/pre>\n\n\n\n
\n\n\n\n17. SHA-256 Verification<\/h1>\n\n\n\n
sha256sum frpc<N>.zip > frpc<N>.zip.sha256<\/code><\/pre>\n\n\n\n<SHA256_HASH> frpc<N>.zip<\/code><\/pre>\n\n\n\nsha256sum -c frpc<N>.zip.sha256<\/code><\/pre>\n\n\n\nfrpc<N>.zip: OK<\/code><\/pre>\n\n\n\n.sha256<\/code> file should remain outside<\/strong> the ZIP it verifies.<\/p>\n\n\n\n
\n\n\n\n18. Why Separate Checksum Files Are Better Here<\/h1>\n\n\n\n
SHA256SUMS<\/code><\/pre>\n\n\n\nfrpc2.zip.sha256\nfrpc3.zip.sha256<\/code><\/pre>\n\n\n\n
\n\n\n\n19. Test the Actual Archive, Not Just the Development Directory<\/h1>\n\n\n\n
build package\n \u2193\ncreate ZIP\n \u2193\ngenerate SHA-256\n \u2193\ncopy ZIP elsewhere\n \u2193\nverify SHA-256\n \u2193\nextract into a new directory\n \u2193\ntest extracted package<\/code><\/pre>\n\n\n\nmissing files\nwrong directory names\nlost executable permissions\nstale configuration\nincorrect archive contents\nbroken scripts<\/code><\/pre>\n\n\n\n
\n\n\n\n20. Recommended Linux Validation Procedure<\/h1>\n\n\n\n
sha256sum -c frpc<N>.zip.sha256<\/code><\/pre>\n\n\n\nunzip frpc<N>.zip<\/code><\/pre>\n\n\n\n.\/frpc --version<\/code><\/pre>\n\n\n\n.\/frpc verify -c .\/frpc<N>.toml<\/code><\/pre>\n\n\n\n.\/FRPC-Start.sh<\/code><\/pre>\n\n\n\n.\/FRPC-Status.sh<\/code><\/pre>\n\n\n\nssh-keyscan -p <REMOTE_SSH_PORT> <PUBLIC_DOMAIN><\/code><\/pre>\n\n\n\n.\/FRPC-Stop.sh<\/code><\/pre>\n\n\n\n
\n\n\n\n21. End-to-End Validation Is More Important Than Config Validation<\/h1>\n\n\n\n
Local SSH :22\n \u2191\nPortable FRPC\n \u2191\nQUIC + TLS\n \u2191\nIndependent FRPS\n \u2191\nServer firewall\n \u2191\nRouter\/NAT\n \u2191\nPublic remote SSH port<\/code><\/pre>\n\n\n\nssh-keyscan -p <REMOTE_SSH_PORT> <PUBLIC_DOMAIN><\/code><\/pre>\n\n\n\n# <PUBLIC_DOMAIN>:<REMOTE_SSH_PORT> SSH-2.0-OpenSSH_<VERSION><\/code><\/pre>\n\n\n\n
\n\n\n\n22. Firewall Design<\/h1>\n\n\n\n
<FRPS_PORT>\/tcp\n<FRPS_PORT>\/udp<\/code><\/pre>\n\n\n\n<REMOTE_SSH_PORT>\/tcp<\/code><\/pre>\n\n\n\nFRPS control transport:\nTCP + UDP\n\nPublished SSH proxy:\nTCP only<\/code><\/pre>\n\n\n\n
\n\n\n\n23. A Useful Security Property of This Design<\/h1>\n\n\n\n
FRPS-A service\nFRPS-A firewall rule\nrouter forwarding rule\nFRPS-A token<\/code><\/pre>\n\n\n\none FRPS instance\none token\none control port\none policy set<\/code><\/pre>\n\n\n\n
\n\n\n\n24. Final Architecture<\/h1>\n\n\n\n
Internet\n \u2502\n <EDGE_ROUTER>\n \u2502\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 \u2502\n <FRPS_PORT_A> <FRPS_PORT_B>\n TCP + UDP TCP + UDP\n \u2502 \u2502\n \u25bc \u25bc\n FRPS-A FRPS-B\n \u2502 \u2502\n <REMOTE_SSH_A>\/TCP <REMOTE_SSH_B>\/TCP\n \u2502 \u2502\n \u25bc \u25bc\n FRPC-A FRPC-B\n \u2502 \u2502\n localhost:22 localhost:22<\/code><\/pre>\n\n\n\n
\n\n\n\n25. Final Package Layout<\/h1>\n\n\n\n
frpc<N>\/\n\u251c\u2500\u2500 frpc\n\u251c\u2500\u2500 frpc.exe\n\u251c\u2500\u2500 frpc<N>.toml\n\u2502\n\u251c\u2500\u2500 FRPC-Start.bat\n\u251c\u2500\u2500 FRPC-Status.bat\n\u251c\u2500\u2500 FRPC-Stop.bat\n\u2502\n\u251c\u2500\u2500 FRPC-Start.sh\n\u251c\u2500\u2500 FRPC-Status.sh\n\u2514\u2500\u2500 FRPC-Stop.sh<\/code><\/pre>\n\n\n\nfrpc<N>.zip\nfrpc<N>.zip.sha256<\/code><\/pre>\n\n\n\n.runtime\/\n\u251c\u2500\u2500 frpc.pid\n\u251c\u2500\u2500 frpc.log\n\u2514\u2500\u2500 frpc-error.log<\/code><\/pre>\n\n\n\n
\n\n\n\nConclusion<\/h1>\n\n\n\n
independent authentication\nindependent FRPS processes\nrestricted remote ports\nQUIC\/TLS transport\nWindows and Linux binaries\nStart \/ Status \/ Stop controls\nprecise process identification\nruntime logging\nSHA-256 verification\nrecipient-level isolation<\/code><\/pre>\n\n\n\n