[GH-ISSUE #1439] Can I enable a reverse proxy for LAN only on server side? #1133

New issue

Closed

opened 2026-05-05 12:43:39 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 12:43:39 -06:00

Owner

Originally created by @Doc-Saintly on GitHub (Sep 16, 2019).
Original GitHub issue: https://github.com/fatedier/frp/issues/1439

Is it possible to open a reverse proxy connection from the client without automatically exposing it on the server? I want to use FRP to allow multiple clients to connect to my central patch management server from behind a firewall, but I do not want to have this port be opened to the WAN for the server.

I know that I could utilize a firewall to block all except specifically allowed ports, but then this would make the feature of automatically opening ports with FRP useless. I would have to pre-define which ports to allow to be opened in the firewall in order to block the others.

Originally created by @Doc-Saintly on GitHub (Sep 16, 2019). Original GitHub issue: https://github.com/fatedier/frp/issues/1439 Is it possible to open a reverse proxy connection from the client without automatically exposing it on the server? I want to use FRP to allow multiple clients to connect to my central patch management server from behind a firewall, but I do not want to have this port be opened to the WAN for the server. I know that I could utilize a firewall to block all except specifically allowed ports, but then this would make the feature of automatically opening ports with FRP useless. I would have to pre-define which ports to allow to be opened in the firewall in order to block the others.

gitea-mirror closed this issue

2026-05-05 12:43:40 -06:00

gitea-mirror commented

2026-05-05 12:43:42 -06:00

Author

Owner

@fatedier commented on GitHub (Sep 28, 2019):

proxy_bind_addr = 127.0.0.1 in frps.ini will help you.

It will only let frps bind ports on localhost that only this server can connect.

@fatedier commented on GitHub (Sep 28, 2019): `proxy_bind_addr = 127.0.0.1` in frps.ini will help you. It will only let frps bind ports on localhost that only this server can connect.

gitea-mirror commented

2026-05-05 12:43:43 -06:00

Author

Owner

@Doc-Saintly commented on GitHub (Sep 28, 2019):

Thanks for the reminder about that configuration option. But doesn't mean that all connections will be unavailable? I want to proxy ~10 ports to a server and have 8 available locally and 2 available externally. So it seems I either have to use a firewall to block the 8 I only want locally, or use two instances of frps (one binding to localhost, one binding externally) and then pick which one to have the client bind to.

Is it possible to add as a feature so the client can determine if the server should use the configured bind address, or local only for each port?

@Doc-Saintly commented on GitHub (Sep 28, 2019): Thanks for the reminder about that configuration option. But doesn't mean that all connections will be unavailable? I want to proxy ~10 ports to a server and have 8 available locally and 2 available externally. So it seems I either have to use a firewall to block the 8 I only want locally, or use two instances of frps (one binding to localhost, one binding externally) and then pick which one to have the client bind to. Is it possible to add as a feature so the client can determine if the server should use the configured bind address, or local only for each port?

gitea-mirror commented

2026-05-05 12:43:44 -06:00

Author

Owner

@fatedier commented on GitHub (Sep 29, 2019):

Try stcp https://github.com/fatedier/frp#expose-your-service-in-security . But it requires you deploy frpc on each client who wants to connect.

@fatedier commented on GitHub (Sep 29, 2019): Try stcp https://github.com/fatedier/frp#expose-your-service-in-security . But it requires you deploy frpc on each client who wants to connect.