github-starred/frp

Fork 0

mirror of https://github.com/fatedier/frp.git synced 2026-05-15 16:15:49 -06:00

[GH-ISSUE #2009] TLS when TLS is terminated before reaching server #1596

New issue

Closed

opened 2026-05-05 13:01:02 -06:00 by gitea-mirror · 8 comments

gitea-mirror commented

2026-05-05 13:01:02 -06:00

Owner

Originally created by @levavakian on GitHub (Sep 24, 2020).
Original GitHub issue: https://github.com/fatedier/frp/issues/2009

I might be trying to do something not supported, so feel free to close issue. I am trying to run the frp server in an aws ec2 instance with a network balancer handling the TLS termination and then forward to the frp server. If I set tls_enable on the frp client I get [W] [service.go:102] login to server failed hello: connection write timeout and if I don't set it I get [W] [service.go:102] login to server failed hello: i/o deadline reached

What version of frp are you using (./frpc -v or ./frps -v)?
0.34.0

What operating system and processor architecture are you using (go env)?
linux/amd64

Configures you used:

frpc.ini
[common]
server_addr = xxx
server_port = 443
tls_enable = {true|false}

[web]
type = http
local_port = 8443
custom_domains = xxx

./frps --bind_port 443 --vhost_http_port 443

Steps to reproduce the issue:

Run frp server in ec2 with a network balancer handling tls termination
Run frp client with settings to connect to that frp server

Describe the results you received:
Connections through the tls terminated url do not succeed, but if I remove the tls termination everythign works fine.

Describe the results you expected:
TLS to be terminated at the network balancer and for the client and server to connect as if no tls was in place.

Originally created by @levavakian on GitHub (Sep 24, 2020). Original GitHub issue: https://github.com/fatedier/frp/issues/2009 I might be trying to do something not supported, so feel free to close issue. I am trying to run the frp server in an aws ec2 instance with a network balancer handling the TLS termination and then forward to the frp server. If I set `tls_enable` on the frp client I get `[W] [service.go:102] login to server failed hello: connection write timeout` and if I don't set it I get `[W] [service.go:102] login to server failed hello: i/o deadline reached` **What version of frp are you using (./frpc -v or ./frps -v)?** 0.34.0 **What operating system and processor architecture are you using (`go env`)?** linux/amd64 **Configures you used:** ``` frpc.ini [common] server_addr = xxx server_port = 443 tls_enable = {true|false} [web] type = http local_port = 8443 custom_domains = xxx ``` ./frps --bind_port 443 --vhost_http_port 443 **Steps to reproduce the issue:** 1. Run frp server in ec2 with a network balancer handling tls termination 2. Run frp client with settings to connect to that frp server **Describe the results you received:** Connections through the tls terminated url do not succeed, but if I remove the tls termination everythign works fine. **Describe the results you expected:** TLS to be terminated at the network balancer and for the client and server to connect as if no tls was in place.

gitea-mirror closed this issue

2026-05-05 13:01:03 -06:00

gitea-mirror commented

2026-05-05 13:01:05 -06:00

Author

Owner

@limaofu commented on GitHub (Sep 25, 2020):

awsのLoad Balancing→Load Balances→choose target Load balnacer→Listeners→add listener and config ssl cert

@limaofu commented on GitHub (Sep 25, 2020): awsのLoad Balancing→Load Balances→choose target Load balnacer→Listeners→add listener and config ssl cert

gitea-mirror commented

2026-05-05 13:01:06 -06:00

Author

Owner

@levavakian commented on GitHub (Sep 25, 2020):

@limaofu the aws load balancer already has an ssl cert, and I can visit the frps web page fine on the ssl secured page, it is the frp client that fails, presumably because the ssl is terminated at the load balancer and continues on as a non-ssl connection to the server.

@levavakian commented on GitHub (Sep 25, 2020): @limaofu the aws load balancer already has an ssl cert, and I can visit the frps web page fine on the ssl secured page, it is the frp client that fails, presumably because the ssl is terminated at the load balancer and continues on as a non-ssl connection to the server.

gitea-mirror commented

2026-05-05 13:01:07 -06:00

Author

Owner

@limaofu commented on GitHub (Sep 25, 2020):

I see, because the requested data was not HTTP protocol, so aws filtered it.，frpc only use tls

@limaofu commented on GitHub (Sep 25, 2020): I see, because the requested data was not HTTP protocol, so aws filtered it.，frpc only use tls

gitea-mirror commented

2026-05-05 13:01:09 -06:00

Author

Owner

@limaofu commented on GitHub (Sep 25, 2020):

you may change the HTTPS:443 's Listener to N/A security policy,
just bypass through 443 port

@limaofu commented on GitHub (Sep 25, 2020): you may change the HTTPS:443 's Listener to N/A security policy, just bypass through 443 port

gitea-mirror commented

2026-05-05 13:01:09 -06:00

Author

Owner

@levavakian commented on GitHub (Sep 25, 2020):

The network balancer is set to be a tcp port. Here is the configuration for it in terraform:

resource "aws_lb_target_group" "target2" {
  name     = "httpstarget"
  port     = var.server_port_https
  protocol = "TCP"
  vpc_id   = aws_vpc.default.id
  target_type = "ip"
  stickiness {
    enabled = false
    type = "lb_cookie"
  }
}

resource "aws_lb_target_group_attachment" "attachment2" {
  target_group_arn = aws_lb_target_group.target2.arn
  target_id        = aws_instance.web.private_ip
  port             = var.server_port_https
}

resource "aws_lb_listener" "listener2" {
  load_balancer_arn = aws_lb.web.arn
  port           = var.public_port_https
  protocol       = "TLS"
  certificate_arn = aws_acm_certificate_validation.cert.certificate_arn

  default_action {
    target_group_arn = aws_lb_target_group.target2.id
    type = "forward"
  }
}

The TCP only (non-TLS) alternative to this works great, so it is just the TLS termination that is causing issues as far as I can tell.

@levavakian commented on GitHub (Sep 25, 2020): The network balancer is set to be a tcp port. Here is the configuration for it in terraform: ``` resource "aws_lb_target_group" "target2" { name = "httpstarget" port = var.server_port_https protocol = "TCP" vpc_id = aws_vpc.default.id target_type = "ip" stickiness { enabled = false type = "lb_cookie" } } resource "aws_lb_target_group_attachment" "attachment2" { target_group_arn = aws_lb_target_group.target2.arn target_id = aws_instance.web.private_ip port = var.server_port_https } resource "aws_lb_listener" "listener2" { load_balancer_arn = aws_lb.web.arn port = var.public_port_https protocol = "TLS" certificate_arn = aws_acm_certificate_validation.cert.certificate_arn default_action { target_group_arn = aws_lb_target_group.target2.id type = "forward" } } ``` The TCP only (non-TLS) alternative to this works great, so it is just the TLS termination that is causing issues as far as I can tell.

gitea-mirror commented

2026-05-05 13:01:10 -06:00

Author

Owner

@levavakian commented on GitHub (Sep 25, 2020):

It looked like it was getting hung up on the yamux session open, so I tried setting tcp_mux = false on both server and client and now I get this error: login to server failed: EOF

It looks like it might be related to this issue https://github.com/fatedier/frp/issues/810 but I can't read the comments unfortunately.

@levavakian commented on GitHub (Sep 25, 2020): It looked like it was getting hung up on the yamux session open, so I tried setting `tcp_mux = false` on both server and client and now I get this error: `login to server failed: EOF` It looks like it might be related to this issue https://github.com/fatedier/frp/issues/810 but I can't read the comments unfortunately.

gitea-mirror commented

2026-05-05 13:01:10 -06:00

Author

Owner

@fatedier commented on GitHub (Sep 26, 2020):

@levavakian You can't do that now since frp use a wrapped TLS connection with custom first byte. AWS won't dectect it.

You can only use 4 layers load balancer.

@fatedier commented on GitHub (Sep 26, 2020): @levavakian You can't do that now since frp use a wrapped TLS connection with custom first byte. AWS won't dectect it. You can only use 4 layers load balancer.

gitea-mirror commented

2026-05-05 13:01:10 -06:00

Author

Owner

@levavakian commented on GitHub (Sep 26, 2020):

@fatedier thank you for letting me know. I will try letting frp handle the ssl termination instead.

@levavakian commented on GitHub (Sep 26, 2020): @fatedier thank you for letting me know. I will try letting frp handle the ssl termination instead.

Rows
Columns