[GH-ISSUE #2911] Running VPN Server Behind NAT w/ frp

gitea-mirror commented

2026-05-05 13:29:51 -06:00

Owner

Originally created by @craftcm on GitHub (Apr 25, 2022).
Original GitHub issue: https://github.com/fatedier/frp/issues/2911

Describe the feature request

First, I'd like to thank the developers and the community for the work on this project. I've been searching for an open-source and robust alternative to ngrok and finally stumbled across frp today.

While I know this isn't a place for VPN troubleshooting, I'm hopeful that someone with a more advanced knowledge of tunneling may be able to guide me. Long story short, I live in an apartment building that provides a gigabit wired internet connection to all the residents, but it's behind a NAT and I have no ability to get a public IP or enable port forwarding. I've been running a VPN server on a Raspberry Pi w/ PiVPN (OpenVPN as the VPN service) and have it exposed to the internet w/ ngrok's paid service which supports assigned TCP tunnels. This works, but not great. The speeds I get from a wired 100 Mbps / 100 Mbps connection at another location are about 20 Mbps / 15 Mbps through ngrok. I thought I could do better (and spend less money), so I got a VPS w/ GoDaddy (2 Gbps pipe to the internet) and have been playing around with the ngrok 1.0 self-hosted option. The speeds are better - 70 Mbps down / 50 Mbps up, but still not as great as I'd like and it lacks the ability to assign a static port for TCP connections.

I've been experimenting with frp today by running the client on my Raspberry Pi to expose the VPN port to the internet and the frp server on the VPS. It works, but the speed is terrible - 20 Mbps down / 5 Mbps up. I've tested with both OpenVPN on TCP and UDP traffic as well as with WireGuard which is UDP only. frp has all the features that I'm needing and more, but the speed seems quite low. What am I missing here? Any guidance would be very much appreciated. Thank you.

Describe alternatives you've considered

ngrok self-hosed and paid, ssh reverse tunnels.

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @craftcm on GitHub (Apr 25, 2022). Original GitHub issue: https://github.com/fatedier/frp/issues/2911 ### Describe the feature request First, I'd like to thank the developers and the community for the work on this project. I've been searching for an open-source and robust alternative to ngrok and finally stumbled across frp today. While I know this isn't a place for VPN troubleshooting, I'm hopeful that someone with a more advanced knowledge of tunneling may be able to guide me. Long story short, I live in an apartment building that provides a gigabit wired internet connection to all the residents, but it's behind a NAT and I have no ability to get a public IP or enable port forwarding. I've been running a VPN server on a Raspberry Pi w/ PiVPN (OpenVPN as the VPN service) and have it exposed to the internet w/ ngrok's paid service which supports assigned TCP tunnels. This works, but not great. The speeds I get from a wired 100 Mbps / 100 Mbps connection at another location are about 20 Mbps / 15 Mbps through ngrok. I thought I could do better (and spend less money), so I got a VPS w/ GoDaddy (2 Gbps pipe to the internet) and have been playing around with the ngrok 1.0 self-hosted option. The speeds are better - 70 Mbps down / 50 Mbps up, but still not as great as I'd like and it lacks the ability to assign a static port for TCP connections. I've been experimenting with frp today by running the client on my Raspberry Pi to expose the VPN port to the internet and the frp server on the VPS. It works, but the speed is terrible - 20 Mbps down / 5 Mbps up. I've tested with both OpenVPN on TCP and UDP traffic as well as with WireGuard which is UDP only. frp has all the features that I'm needing and more, but the speed seems quite low. What am I missing here? Any guidance would be very much appreciated. Thank you. ### Describe alternatives you've considered ngrok self-hosed and paid, ssh reverse tunnels. ### Affected area - [ ] Docs - [ ] Installation - [X] Performance and Scalability - [ ] Security - [X] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror

2026-05-05 13:29:51 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 13:29:55 -06:00

Author

Owner

@fatedier commented on GitHub (Apr 26, 2022):

You'd better paste your configures.

@fatedier commented on GitHub (Apr 26, 2022): You'd better paste your configures.

gitea-mirror commented

2026-05-05 13:29:55 -06:00

Author

Owner

@github-actions[bot] commented on GitHub (May 27, 2022):

Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (May 27, 2022): Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

gitea-mirror commented

2026-05-05 13:29:56 -06:00

Author

Owner

@Nexulo commented on GitHub (Jul 11, 2022):

i have the exact same setup and the same speed problem.
did you found a solution, @craftcm ?

@Nexulo commented on GitHub (Jul 11, 2022): i have the exact same setup and the same speed problem. did you found a solution, @craftcm ?

gitea-mirror commented

2026-05-05 13:29:57 -06:00

Author

Owner

@craftcm commented on GitHub (Jul 11, 2022):

I ended up going with another package - rathole - which was worked very well for my use case. I’m behind a NAT which I cannot control (gigabit internet is provided by my apartment complex, but on their own equipment) and I wanted to be able to access my OpenVPN server at home while traveling. I got a $2/month VPS from IONOS and setup rathole per their instructions on GitHub. I’m routinely getting 75/75 speeds now from my iPhone on 5G cell connection. I’ll also say that a potential bottleneck for the issue I encountered while testing frp was that my test OpenVPN server was running inside a VM, though I am not sure if that was the exact cause for the poor throughout. I hope this is helpful.

On Jul 11, 2022, at 10:59 AM, maisen20 @.***> wrote:

i have the exact same setup and the same speed problem.
did you found a solution, @craftcm ?

—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you were mentioned.

@craftcm commented on GitHub (Jul 11, 2022): I ended up going with another package - rathole - which was worked very well for my use case. I’m behind a NAT which I cannot control (gigabit internet is provided by my apartment complex, but on their own equipment) and I wanted to be able to access my OpenVPN server at home while traveling. I got a $2/month VPS from IONOS and setup rathole per their instructions on GitHub. I’m routinely getting 75/75 speeds now from my iPhone on 5G cell connection. I’ll also say that a potential bottleneck for the issue I encountered while testing frp was that my test OpenVPN server was running inside a VM, though I am not sure if that was the exact cause for the poor throughout. I hope this is helpful. > > On Jul 11, 2022, at 10:59 AM, maisen20 ***@***.***> wrote: > > > i have the exact same setup and the same speed problem. > did you found a solution, @craftcm ? > > — > Reply to this email directly, view it on GitHub, or unsubscribe. > You are receiving this because you were mentioned.

gitea-mirror commented

2026-05-05 13:29:57 -06:00

Author

Owner

@samratfkt commented on GitHub (Apr 9, 2023):

Hey, I have tried to install openvpn and wireguard but both are not working with FRP, I know I am doing something wrong. Can you please guide me a little bit? I know this is not appropriate to take help like this :\ but I need the feature :\

@samratfkt commented on GitHub (Apr 9, 2023): Hey, I have tried to install openvpn and wireguard but both are not working with FRP, I know I am doing something wrong. Can you please guide me a little bit? I know this is not appropriate to take help like this :\ but I need the feature :\

gitea-mirror commented

2026-05-05 13:29:58 -06:00

Author

Owner

@fgenoese commented on GitHub (Mar 24, 2024):

@craftcm could you post the frpc config file used for VPN?

@fgenoese commented on GitHub (Mar 24, 2024): @craftcm could you post the frpc config file used for VPN?

gitea-mirror commented

2026-05-05 13:29:59 -06:00

Author

Owner

@craftcm commented on GitHub (Mar 24, 2024):

@craftcm could you post the frpc config file used for VPN?

I ended up going with another project - rathole - to accomplish my goal of accessing my home network via OpenVPN (setup with PiVPN) from behind a NAT that I can't control. It's worked flawlessly for nearly two years now. I described my solution a couple of comments up.

So, I can't help with a config for frp since I didn't end up using it, but I could offer some guidance on rathole if you go with that option.

@craftcm commented on GitHub (Mar 24, 2024): > @craftcm could you post the frpc config file used for VPN? I ended up going with another project - rathole - to accomplish my goal of accessing my home network via OpenVPN (setup with PiVPN) from behind a NAT that I can't control. It's worked flawlessly for nearly two years now. I described my solution a couple of comments up. So, I can't help with a config for frp since I didn't end up using it, but I could offer some guidance on rathole if you go with that option.

gitea-mirror commented

2026-05-05 13:29:59 -06:00

Author

Owner

@fgenoese commented on GitHub (Mar 24, 2024):

@craftcm could you post the frpc config file used for VPN?

I ended up going with another project - rathole - to accomplish my goal of accessing my home network via OpenVPN (setup with PiVPN) from behind a NAT that I can't control. It's worked flawlessly for nearly two years now. I described my solution a couple of comments up.

So, I can't help with a config for frp since I didn't end up using it, but I could offer some guidance on rathole if you go with that option.

Thanks. I'd appreciate if you could share the respective config files in a gist. Not familiar with rathole, but it looks quite similar to frp.

@fgenoese commented on GitHub (Mar 24, 2024): > > @craftcm could you post the frpc config file used for VPN? > > > > I ended up going with another project - rathole - to accomplish my goal of accessing my home network via OpenVPN (setup with PiVPN) from behind a NAT that I can't control. It's worked flawlessly for nearly two years now. I described my solution a couple of comments up. > > > > So, I can't help with a config for frp since I didn't end up using it, but I could offer some guidance on rathole if you go with that option. Thanks. I'd appreciate if you could share the respective config files in a gist. Not familiar with rathole, but it looks quite similar to frp.

gitea-mirror commented

2026-05-05 13:30:00 -06:00

Author

Owner

@craftcm commented on GitHub (Mar 24, 2024):

@craftcm could you post the frpc config file used for VPN?

I ended up going with another project - rathole - to accomplish my goal of accessing my home network via OpenVPN (setup with PiVPN) from behind a NAT that I can't control. It's worked flawlessly for nearly two years now. I described my solution a couple of comments up.
So, I can't help with a config for frp since I didn't end up using it, but I could offer some guidance on rathole if you go with that option.

Thanks. I'd appreciate if you could share the respective config files in a gist. Not familiar with rathole, but it looks quite similar to frp.

Sure thing. I hope this is helpful.

server.toml which runs on my VPS:

[server]
bind_addr = "0.0.0.0:2333"

[server.services.my_vpn]
token = "redacted"
bind_addr = "0.0.0.0:1194"

client.toml which runs on the Pi alongside OpenVPN within my internal network behind the NAT:

[client]
remote_addr = "myvpsFQDN.com:2333"

[client.services.my_vpn]
token = "REDACTED"
local_addr = "127.0.0.1:1194"

Finally, here's the service file on my Pi which keeps rathole running in the background.

Create the file:

sudo nano /etc/systemd/system/rathole.service

Description=Share local port(s) with rathole
After=syslog.target network.target

[Service]
PrivateTmp=true
Type=simple
Restart=always
RestartSec=1min
StandardOutput=null
StandardError=null
ExecStart=/home/pi/rathole /home/pi/client.toml
ExecStop=/usr/bin/killall rathole

Obviously you'll need to update the paths in the next to last line to point to your rathole executable and rathole config file. Then start the service:

sudo systemctl start rathole

@craftcm commented on GitHub (Mar 24, 2024): > > > @craftcm could you post the frpc config file used for VPN? > > > > > > I ended up going with another project - rathole - to accomplish my goal of accessing my home network via OpenVPN (setup with PiVPN) from behind a NAT that I can't control. It's worked flawlessly for nearly two years now. I described my solution a couple of comments up. > > So, I can't help with a config for frp since I didn't end up using it, but I could offer some guidance on rathole if you go with that option. > > Thanks. I'd appreciate if you could share the respective config files in a gist. Not familiar with rathole, but it looks quite similar to frp. Sure thing. I hope this is helpful. server.toml which runs on my VPS: ``` [server] bind_addr = "0.0.0.0:2333" [server.services.my_vpn] token = "redacted" bind_addr = "0.0.0.0:1194" ``` client.toml which runs on the Pi alongside OpenVPN within my internal network behind the NAT: ``` [client] remote_addr = "myvpsFQDN.com:2333" [client.services.my_vpn] token = "REDACTED" local_addr = "127.0.0.1:1194" ``` Finally, here's the service file on my Pi which keeps rathole running in the background. Create the file: `sudo nano /etc/systemd/system/rathole.service` ``` Description=Share local port(s) with rathole After=syslog.target network.target [Service] PrivateTmp=true Type=simple Restart=always RestartSec=1min StandardOutput=null StandardError=null ExecStart=/home/pi/rathole /home/pi/client.toml ExecStop=/usr/bin/killall rathole ``` Obviously you'll need to update the paths in the next to last line to point to your rathole executable and rathole config file. Then start the service: `sudo systemctl start rathole`

gitea-mirror commented

2026-05-05 13:30:00 -06:00

Author

Owner

@diyaps commented on GitHub (Feb 12, 2025):

@craftcm hi, thanks for your sharing. I'm looking into something similar as your case. But why don't you directly run the openVPN server on your VPS which has the public IP? it would be faster.

@diyaps commented on GitHub (Feb 12, 2025): @craftcm hi, thanks for your sharing. I'm looking into something similar as your case. But why don't you directly run the openVPN server on your VPS which has the public IP? it would be faster.

gitea-mirror commented

2026-05-05 13:30:01 -06:00

Author

Owner

@craftcm commented on GitHub (Feb 16, 2025):

@craftcm hi, thanks for your sharing. I'm looking into something similar as your case. But why don't you directly run the openVPN server on your VPS which has the public IP? it would be faster.

I thought about this, but I had trouble figuring out how to set it up in a way that achieved my goals. If I'm understanding your suggestion - the idea would be that an OpenVPN (server?) runs on the VPS which faces the internet. My mobile devices (like iPhone or laptop while traveling) would connect to the VPS when needed. In addition, an OpenVPN (client?) within my home network with have an always-on connection to the OpenVPN server running on the VPS and serve to bridge everything together?

This may be something that I look into in the future. I realize that my way of doing this isn't very efficient, but it works and works pretty well which was my primary goal. I can VPN into my home network and - with the exception of no mDNS or multicast support - it's just like I'm back on my home WIFI. I can directly ping all of my home devices and services by their same IP address I use at home. All internet traffic is pushed through my home WAN connection including some destinations that go through a Private Internet Access VPN pipe that is setup on my home router, and all DNS queries are handled by my home PiHole DNS server. It just works. I'm open to hearing more about your suggestion - particularly if you know a way to achieve this outcome in a more elegant and faster way. Cheers!

@craftcm commented on GitHub (Feb 16, 2025): > [@craftcm](https://github.com/craftcm) hi, thanks for your sharing. I'm looking into something similar as your case. But why don't you directly run the openVPN server on your VPS which has the public IP? it would be faster. I thought about this, but I had trouble figuring out how to set it up in a way that achieved my goals. If I'm understanding your suggestion - the idea would be that an OpenVPN (server?) runs on the VPS which faces the internet. My mobile devices (like iPhone or laptop while traveling) would connect to the VPS when needed. In addition, an OpenVPN (client?) within my home network with have an always-on connection to the OpenVPN server running on the VPS and serve to bridge everything together? This may be something that I look into in the future. I realize that my way of doing this isn't very efficient, but it works and works pretty well which was my primary goal. I can VPN into my home network and - with the exception of no mDNS or multicast support - it's just like I'm back on my home WIFI. I can directly ping all of my home devices and services by their same IP address I use at home. All internet traffic is pushed through my home WAN connection including some destinations that go through a Private Internet Access VPN pipe that is setup on my home router, and all DNS queries are handled by my home PiHole DNS server. It just works. I'm open to hearing more about your suggestion - particularly if you know a way to achieve this outcome in a more elegant and faster way. Cheers!

Rows
Columns

[GH-ISSUE #2911] Running VPN Server Behind NAT w/ frp #2320

Describe the feature request

Describe alternatives you've considered

Affected area