github-starred/frp
2
0
Fork 0
mirror of https://github.com/fatedier/frp.git synced 2026-05-15 08:05:49 -06:00
Code Issues 40 Projects Packages Wiki Activity Actions 1

[GH-ISSUE #3444] Trying to setup nginx ingress with FRPS server and connect from FRPC client outside of k8s cluster #2759

New issue
Closed
opened 2026-05-05 13:46:43 -06:00 by gitea-mirror · 9 comments
gitea-mirror commented 2026-05-05 13:46:43 -06:00
Owner
Copy link

Originally created by @Emon46 on GitHub (May 15, 2023).
Original GitHub issue: https://github.com/fatedier/frp/issues/3444

Bug Description

First of all thanks for building this cool tool!
I am trying to set up the FRPS server with the nginx ingress controller inside eks cluster.
I have deployed an ingress controller which created an NLB for me. and I can expose services in port 80 and 443.
Now I want to set up my FRPS server on top of it.
I have deployed the FRPS server and created a service and created an ingress for FRPS server port.
here is my ingress and service yaml

apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: tunnel-server
    app.kubernetes.io/name: tunnel-server
  name: tunnel-server
  namespace: tunnel-proxy
spec:
  ports:
  - name: bind
    port: 7000
    protocol: TCP
    targetPort: bind
  selector:
    app.kubernetes.io/instance: tunnel-server
    app.kubernetes.io/name: tunnel-server
  type: ClusterIP

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  labels:
    app.kubernetes.io/instance: tunnel-server
    app.kubernetes.io/name: tunnel-server
  name: tunnel-server
  namespace: tunnel-proxy
spec:
  ingressClassName: nginx
  rules:
  - host: p01-proxy.mydomain.com
    http:
      paths:
      - backend:
          service:
            name: tunnel-server
            port:
              number: 7000
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - p01-proxy.mydomain.com
    secretName: tunnel-tls-cert

frpc Version

0.48.0

frps Version

0.48.0

System Architecture

linux/amd64

Configurations

frps.ini

[common]
bind_port = 7000
log_level = trace

frpc.ini

[common]
server_addr = p01-proxy.mydomain.com
server_port = 443
tls_enable = true
log_level = trace
tls_server_name = p01-proxy.mydomain.com
disable_custom_tls_first_byte = true
type = tcp

Logs

I didn't get any error message in frps server.
In client i can only see it's tried to login but failed.
client logs:

2023/05/16 00:28:47 [T] [root.go:212] start frpc service for config file [frpc_test.ini]
2023/05/16 00:28:48 [W] [service.go:134] login to server failed: EOF
2023/05/16 00:28:48 [T] [root.go:232] frpc service for config file [frpc_test.ini] stopped
EOF

Is the configuration correct? If not is there any work around we can make it to support with nginx controller in EKS cluster

Steps to reproduce

...

Affected area

  • Docs
  • Installation
  • Performance and Scalability
  • Security
  • User Experience
  • Test and Release
  • Developer Infrastructure
  • Client Plugin
  • Server Plugin
  • Extensions
  • Others
Originally created by @Emon46 on GitHub (May 15, 2023). Original GitHub issue: https://github.com/fatedier/frp/issues/3444 ### Bug Description First of all thanks for building this cool tool! I am trying to set up the FRPS server with the nginx ingress controller inside eks cluster. I have deployed an ingress controller which created an NLB for me. and I can expose services in port 80 and 443. Now I want to set up my FRPS server on top of it. I have deployed the FRPS server and created a service and created an ingress for FRPS server port. here is my ingress and service yaml ``` apiVersion: v1 kind: Service metadata: labels: app.kubernetes.io/instance: tunnel-server app.kubernetes.io/name: tunnel-server name: tunnel-server namespace: tunnel-proxy spec: ports: - name: bind port: 7000 protocol: TCP targetPort: bind selector: app.kubernetes.io/instance: tunnel-server app.kubernetes.io/name: tunnel-server type: ClusterIP ``` ``` apiVersion: networking.k8s.io/v1 kind: Ingress metadata: labels: app.kubernetes.io/instance: tunnel-server app.kubernetes.io/name: tunnel-server name: tunnel-server namespace: tunnel-proxy spec: ingressClassName: nginx rules: - host: p01-proxy.mydomain.com http: paths: - backend: service: name: tunnel-server port: number: 7000 path: / pathType: Prefix tls: - hosts: - p01-proxy.mydomain.com secretName: tunnel-tls-cert ``` ### frpc Version 0.48.0 ### frps Version 0.48.0 ### System Architecture linux/amd64 ### Configurations `frps.ini` ``` [common] bind_port = 7000 log_level = trace ``` `frpc.ini` ``` [common] server_addr = p01-proxy.mydomain.com server_port = 443 tls_enable = true log_level = trace tls_server_name = p01-proxy.mydomain.com disable_custom_tls_first_byte = true type = tcp ``` ### Logs I didn't get any error message in frps server. In client i can only see it's tried to login but failed. client logs: ``` 2023/05/16 00:28:47 [T] [root.go:212] start frpc service for config file [frpc_test.ini] 2023/05/16 00:28:48 [W] [service.go:134] login to server failed: EOF 2023/05/16 00:28:48 [T] [root.go:232] frpc service for config file [frpc_test.ini] stopped EOF ``` Is the configuration correct? If not is there any work around we can make it to support with nginx controller in EKS cluster ### Steps to reproduce 1. 2. 3. ... ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [ ] Security - [ ] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others
gitea-mirror commented 2026-05-05 13:46:47 -06:00
Author
Owner
Copy link

@fatedier commented on GitHub (May 16, 2023):

Ingress is only for the HTTP protocol. You should expose port 7000 as a TCP port.

<!-- gh-comment-id:1548911770 --> @fatedier commented on GitHub (May 16, 2023): Ingress is only for the HTTP protocol. You should expose port 7000 as a TCP port.
gitea-mirror commented 2026-05-05 13:46:47 -06:00
Author
Owner
Copy link

@aleksandr-orca commented on GitHub (May 17, 2023):

@Emon46 by any chance did you resolve this issue?

<!-- gh-comment-id:1551141534 --> @aleksandr-orca commented on GitHub (May 17, 2023): @Emon46 by any chance did you resolve this issue?
gitea-mirror commented 2026-05-05 13:46:49 -06:00
Author
Owner
Copy link

@svyatoslavd-orca commented on GitHub (May 17, 2023):

Hi @fatedier. Thanks for your awesome work and efforts!
Could you please elaborate on 2 things:

  1. What is the correct way to expose FRPS in K8S cluster using Nginx Ingress? Is there an example of a working configuration? I guess it's not the first time people are asking for this. Probably this deserves to be added to documentation.
  2. What is the best practice for secure connections between FRPC and FRPS when using K8S Ingress? Is it possible to use TLS connection while exposing FRPS with Nginx Ingress?
<!-- gh-comment-id:1551278502 --> @svyatoslavd-orca commented on GitHub (May 17, 2023): Hi @fatedier. Thanks for your awesome work and efforts! Could you please elaborate on 2 things: 1. What is the correct way to expose FRPS in K8S cluster using Nginx Ingress? Is there an example of a working configuration? I guess it's not the first time people are asking for this. Probably this deserves to be added to documentation. 2. What is the best practice for secure connections between FRPC and FRPS when using K8S Ingress? Is it possible to use TLS connection while exposing FRPS with Nginx Ingress?
gitea-mirror commented 2026-05-05 13:46:49 -06:00
Author
Owner
Copy link

@andrey-bondar commented on GitHub (May 18, 2023):

@Emon46 Hi! I use ktunnel for this purpose in K8S. Please take a look

<!-- gh-comment-id:1552738274 --> @andrey-bondar commented on GitHub (May 18, 2023): @Emon46 Hi! I use [ktunnel](https://github.com/omrikiei/ktunnel) for this purpose in K8S. Please take a look
gitea-mirror commented 2026-05-05 13:46:50 -06:00
Author
Owner
Copy link

@julianbalog commented on GitHub (May 22, 2023):

I got the frps working behind the nginx ingress controller in Kubernetes. To @fatedier's point, I could only make it work by exposing frps as a TCP service endpoint. (See the related concept here.) Here are the relevant configuration stubs to set up an frps/frpc tunnel secured with mTLS (client certificate authentication) in Kubernetes.

Disclaimer
Some of the configuration below has been re-edited for brevity and it's possible I may have missed something. But, at a high level, it reflects closely the environment that works for me.

frps.ini:

[common]
bind_port = 7443
vhost_https_port = 7443
tls_only = false
tls_enable = true
tls_cert_file = /etc/frp/certs/server.crt
tls_key_file = /etc/frp/certs/server.key
tls_trusted_ca_file = /etc/frp/certs/ca.crt
log_level = trace

Create the kube secret required to mount the certificates into the frps pod. (You'll need to generate these certs first, following the procedure described here.)

kubectl create secret generic frps_certs \
    --from-file=ca.crt=certs/ca.crt \
    --from-file=server.crt=certs/server.crt \
    --from-file=server.key=certs/server.key

frps.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: frps
  name: frps
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: frps
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: frps
    spec:
      containers:
        - image: snowdreamtech/frps
          name: frps
          ports:
            - containerPort: 7443
          volumeMounts:
            - mountPath: /etc/frp/frps.ini
              name: frps-ini
            - mountPath: /etc/frp/certs
              name: frps-certs
      restartPolicy: Always
      volumes:
        - name: frps-ini
          hostPath:
            path: /etc/frp/frps.ini
            type: FileOrCreate
        - name: frps-certs
          secret:
            secretName: frps-certs
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/name: frps
  name: frps
spec:
  ports:
    - name: "https"
      port: 7443
      targetPort: 7443
  selector:
    app.kubernetes.io/name: frps
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx-controller
spec:
  ports:
  - name: frps
    port: 7443
    protocol: TCP
    targetPort: 7443
  selector:
    app.kubernetes.io/name: frps
  type: LoadBalancer
---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: frps
  name: frps
data:
  7443: "default/frps:7443"

Note the ConfigMap configuration above. We need to add it to the ingress-nginx-controller's --tcp-services-configmap argument.

kubectl edit deployment ingress-nginx-controller

Add the --tcp-services-configmap argument, as follows:

spec:
  containers:
  - args:
    - /nginx-ingress-controller
    - --tcp-services-configmap=default/frps

frpc.ini

[common]
server_addr = example.com
server_port = 7443
tls_enable = true
tls_cert_file = /etc/frp/certs/client.crt
tls_key_file = /etc/frp/certs/client.key
tls_trusted_ca_file = /etc/frp/certs/ca.crt
tls_server_name = example.com
log_level = trace

[ws-https]
type = https
custom_domains = ws.example.com
local_ip = ws-https
local_port = 5443

I hope this helps.

<!-- gh-comment-id:1557631880 --> @julianbalog commented on GitHub (May 22, 2023): I got the `frps` working behind the nginx ingress controller in Kubernetes. To @fatedier's point, I could only make it work by exposing `frps` as a TCP service endpoint. (See the related concept [here](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/).) Here are the relevant configuration stubs to set up an `frps/frpc` tunnel secured with mTLS (client certificate authentication) in Kubernetes. >**Disclaimer** > Some of the configuration below has been re-edited for brevity and it's possible I may have missed something. But, at a high level, it reflects closely the environment that works for me. **frps.ini**: ``` [common] bind_port = 7443 vhost_https_port = 7443 tls_only = false tls_enable = true tls_cert_file = /etc/frp/certs/server.crt tls_key_file = /etc/frp/certs/server.key tls_trusted_ca_file = /etc/frp/certs/ca.crt log_level = trace ``` Create the kube secret required to mount the certificates into the `frps` pod. (You'll need to generate these certs first, following the procedure described [here](https://github.com/fatedier/frp#tls).) ``` kubectl create secret generic frps_certs \ --from-file=ca.crt=certs/ca.crt \ --from-file=server.crt=certs/server.crt \ --from-file=server.key=certs/server.key ``` **frps.yaml** ``` apiVersion: apps/v1 kind: Deployment metadata: labels: app.kubernetes.io/name: frps name: frps spec: replicas: 1 selector: matchLabels: app.kubernetes.io/name: frps strategy: type: Recreate template: metadata: labels: app.kubernetes.io/name: frps spec: containers: - image: snowdreamtech/frps name: frps ports: - containerPort: 7443 volumeMounts: - mountPath: /etc/frp/frps.ini name: frps-ini - mountPath: /etc/frp/certs name: frps-certs restartPolicy: Always volumes: - name: frps-ini hostPath: path: /etc/frp/frps.ini type: FileOrCreate - name: frps-certs secret: secretName: frps-certs --- apiVersion: v1 kind: Service metadata: labels: app.kubernetes.io/name: frps name: frps spec: ports: - name: "https" port: 7443 targetPort: 7443 selector: app.kubernetes.io/name: frps --- apiVersion: v1 kind: Service metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: ingress-nginx name: ingress-nginx-controller spec: ports: - name: frps port: 7443 protocol: TCP targetPort: 7443 selector: app.kubernetes.io/name: frps type: LoadBalancer --- apiVersion: v1 kind: ConfigMap metadata: labels: app.kubernetes.io/name: frps name: frps data: 7443: "default/frps:7443" ``` Note the `ConfigMap` configuration above. We need to add it to the `ingress-nginx-controller`'s `--tcp-services-configmap` argument. ``` kubectl edit deployment ingress-nginx-controller ``` Add the `--tcp-services-configmap` argument, as follows: ``` spec: containers: - args: - /nginx-ingress-controller - --tcp-services-configmap=default/frps ``` **frpc.ini** ``` [common] server_addr = example.com server_port = 7443 tls_enable = true tls_cert_file = /etc/frp/certs/client.crt tls_key_file = /etc/frp/certs/client.key tls_trusted_ca_file = /etc/frp/certs/ca.crt tls_server_name = example.com log_level = trace [ws-https] type = https custom_domains = ws.example.com local_ip = ws-https local_port = 5443 ``` I hope this helps.
gitea-mirror commented 2026-05-05 13:46:50 -06:00
Author
Owner
Copy link

@github-actions[bot] commented on GitHub (Jun 22, 2023):

Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

<!-- gh-comment-id:1601858094 --> @github-actions[bot] commented on GitHub (Jun 22, 2023): Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.
gitea-mirror commented 2026-05-05 13:46:51 -06:00
Author
Owner
Copy link

@fatedier commented on GitHub (Jun 28, 2023):

The next version will support websocket over TLS, which will help expose frps in the K8s cluster through TLS + HTTP routing rules.

I have tested it successfully in istio-gateway.

<!-- gh-comment-id:1611481081 --> @fatedier commented on GitHub (Jun 28, 2023): The next version will support websocket over TLS, which will help expose frps in the K8s cluster through TLS + HTTP routing rules. I have tested it successfully in istio-gateway.
gitea-mirror commented 2026-05-05 13:46:51 -06:00
Author
Owner
Copy link

@ajavalekar commented on GitHub (Nov 23, 2023):

Hi @fatedier
Thanks for this great tool! As per your above comment where we can expose through http on using wss, can you provide what should be the frps and frpc configuration to use?

<!-- gh-comment-id:1823944929 --> @ajavalekar commented on GitHub (Nov 23, 2023): Hi @fatedier Thanks for this great tool! As per your above comment where we can expose through http on using wss, can you provide what should be the frps and frpc configuration to use?
gitea-mirror commented 2026-05-05 13:46:51 -06:00
Author
Owner
Copy link

@ajavalekar commented on GitHub (Dec 4, 2023):

Hi @fatedier

Can you please help me with what configuration you used to expose frps in the K8s cluster through TLS + HTTP routing rules? I need to open ssh channels to multiple servers on demand behind an ingress controller and want to do it over http routing instead of tcp. Please can you help on this?

<!-- gh-comment-id:1838781170 --> @ajavalekar commented on GitHub (Dec 4, 2023): Hi @fatedier Can you please help me with what configuration you used to expose frps in the K8s cluster through TLS + HTTP routing rules? I need to open ssh channels to multiple servers on demand behind an ingress controller and want to do it over http routing instead of tcp. Please can you help on this?
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
dev
new
master
copilot/review-pull-request-5198
v0.68.1
v0.68.0
v0.67.0
v0.66.0
v0.65.0
v0.64.0
v0.63.0
v0.62.1
v0.62.0
v0.61.2
v0.61.1
v0.61.0
v0.60.0
v0.59.0
v0.58.1
v0.58.0
v0.57.0
v0.56.0
v0.55.1
v0.55.0
v0.54.0
v0.53.2
v0.53.1
v0.53.0
v0.52.3
v0.52.2
v0.52.1
v0.52.0
v0.51.3
v0.51.2
v0.51.1
v0.51.0
v0.50.0
v0.49.0
v0.48.0
v0.47.0
v0.46.1
v0.46.0
v0.45.0
v0.44.0
v0.43.0
v0.42.0
v0.41.0
v0.40.0
v0.39.1
v0.39.0
v0.38.0
v0.37.1
v0.37.0
v0.36.2
v0.36.1
v0.36.0
v0.35.1
v0.35.0
v0.34.3
v0.34.2
v0.34.1
v0.34.0
v0.33.0
v0.32.1
v0.32.0
v0.31.2
v0.31.1
v0.31.0
v0.30.0
v0.29.1
v0.29.0
v0.28.2
v0.28.1
v0.28.0
v0.27.1
v0.27.0
v0.26.0
v0.25.3
v0.25.2
v0.25.1
v0.25.0
v0.24.1
v0.24.0
v0.23.3
v0.23.2
v0.23.1
v0.23.0
v0.22.0
v0.21.0
v0.20.0
v0.19.1
v0.19.0
v0.18.0
v0.17.0
v0.16.1
v0.16.0
v0.15.1
v0.15.0
v0.14.1
v0.14.0
v0.13.0
v0.12.0
v0.11.0
v0.10.0
v0.9.3
v0.9.2
v0.9.1
v0.9.0
v0.8.1
v0.8.0
v0.7.0
v0.6.0
v0.5.0
v0.3.0
v0.2.0
v0.1.0
Labels
Clear labels   
In Progress

   
WIP

   
WaitingForInfo

   
bug

   
doc

   
duplicate

   
easy

   
enhancement

   
future

   
help wanted

   
invalid

   
lifecycle/stale

   
need-issue-template

   
need-usage-help

   
no plan

   
proposal

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
todo
No labels
In Progress
WIP
WaitingForInfo
bug
doc
duplicate
easy
enhancement
future
help wanted
invalid
lifecycle/stale
need-issue-template
need-usage-help
no plan
proposal
pull-request
question
todo
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/frp#2759
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?