github-starred/frp

Fork 0

mirror of https://github.com/fatedier/frp.git synced 2026-05-15 16:15:49 -06:00

[GH-ISSUE #4717] 转发 HTTPS 连接时出现握手中断（RST），导致 curl 获取失败 #3725

New issue

Closed

opened 2026-05-05 14:23:17 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 14:23:17 -06:00

Owner

Originally created by @Fadouse on GitHub (Mar 16, 2025).
Original GitHub issue: https://github.com/fatedier/frp/issues/4717

Bug Description

描述

在使用 FRP 将内网 Caddy 服务器的 TLS 服务（监听端口 443）映射到阿里云服务器公网 (监听端口 4433) 后，通过 curl 进行连接时，发现握手过程中连接被对端复位（RST），提示“Recv failure: Connection was reset”。但在浏览器中访问时，握手和连接均能正常完成。

环境信息

Caddy 版本：例如 v2.6.x（已启用 TLS 1.3，证书正常）

预期行为

curl 客户端使用 TLS 1.3 进行连接时，应与浏览器一样，成功完成 TLS 握手并建立加密连接，而不应被中途复位。

实际行为

使用 curl，在发送 Client Hello 后连接被中断，导致握手失败，出现“Connection reset by peer”错误；而浏览器使用相同协议时连接正常。

附加信息

我已经尝试升级 curl，并在命令中加入了浏览器常用的请求头，但问题仍然存在。
使用浏览器直接访问时（同一网络环境下），TLS 握手和连接均正常。

frpc Version

0.61.1

frps Version

0.61.2

System Architecture

frpc: windows/amd64 frps: linux/amd64

Configurations

 ```ini
 [caddy]
 type = tcp
 local_ip = 192.168.195.135
 local_port = 443
 remote_port = 4433
 ```

Logs

curl 命令返回错误：(35) Recv failure: Connection was reset

Caddy 日志中显示 TLS 握手过程中成功匹配了证书，但随即收到 EOF（连接中断），如以下日志摘录：

2025/03/16 14:13:04.826 DEBUG   http.stdlib     http: TLS handshake error from [客户端IP]:57271: EOF
2025/03/16 14:13:06.846 DEBUG   tls.handshake   matched certificate in cache    {"remote_ip": "192.168.195.1", "remote_port": "57274", ...}
2025/03/16 14:13:06.847 DEBUG   http.stdlib     http: TLS handshake error from [客户端IP]:57274: EOF

Steps to reproduce

服务器端配置

Caddy 部署在内网：

{
         auto_https off
         debug
     }


     # ==============================
     # fleet.example.com
     # ==============================
      fleet.example.com:443 {
         tls /home/elastic/cert/example.com/fullchain.pem /home/elastic/cert/example.com/privkey.pem

         reverse_proxy https://localhost:8220 {
             transport http {
                 tls_insecure_skip_verify
             }
         }
     }

     # ==============================
     # es.example.com
     # ==============================
     es.example.com:443 {
         tls /home/elastic/cert/example.com/fullchain.pem /home/elastic/cert/example.com/privkey.pem

         reverse_proxy https://localhost:9200 {
             transport http {
                 tls_insecure_skip_verify
             }
         }
     }

     # ==============================
     # kibana.example.com
     # ==============================
     kibana.example.com:443 {
         tls /home/elastic/cert/example.com/fullchain.pem /home/elastic/cert/example.com/privkey.pem
         reverse_proxy 192.168.195.135:5601
     }

FRP 配置

FRP 配置：

[caddy]
type = tcp
local_ip = 192.168.195.135
local_port = 443
remote_port = 4433

测试请求

使用 curl 添加常用浏览器的请求头：

curl -v --tlsv1.3 \
  -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" \
  -H "Accept-Language: en-US,en;q=0.9" \
  "https://fleet.example.com:4433/"

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @Fadouse on GitHub (Mar 16, 2025). Original GitHub issue: https://github.com/fatedier/frp/issues/4717 ### Bug Description ### 描述在使用 FRP 将内网 Caddy 服务器的 TLS 服务（监听端口 443）映射到阿里云服务器公网 (监听端口 4433) 后，通过 curl 进行连接时，发现握手过程中连接被对端复位（RST），提示“Recv failure: Connection was reset”。但在浏览器中访问时，握手和连接均能正常完成。 ### 环境信息 - **Caddy 版本**：例如 v2.6.x（已启用 TLS 1.3，证书正常） ### 预期行为 curl 客户端使用 TLS 1.3 进行连接时，应与浏览器一样，成功完成 TLS 握手并建立加密连接，而不应被中途复位。 ### 实际行为使用 curl，在发送 Client Hello 后连接被中断，导致握手失败，出现“Connection reset by peer”错误；而浏览器使用相同协议时连接正常。 ### 附加信息 - 我已经尝试升级 curl，并在命令中加入了浏览器常用的请求头，但问题仍然存在。 - 使用浏览器直接访问时（同一网络环境下），TLS 握手和连接均正常。 ### frpc Version 0.61.1 ### frps Version 0.61.2 ### System Architecture frpc: windows/amd64 frps: linux/amd64 ### Configurations ```ini [caddy] type = tcp local_ip = 192.168.195.135 local_port = 443 remote_port = 4433 ``` ### Logs - curl 命令返回错误：`(35) Recv failure: Connection was reset` - Caddy 日志中显示 TLS 握手过程中成功匹配了证书，但随即收到 EOF（连接中断），如以下日志摘录： ``` 2025/03/16 14:13:04.826 DEBUG http.stdlib http: TLS handshake error from [客户端IP]:57271: EOF 2025/03/16 14:13:06.846 DEBUG tls.handshake matched certificate in cache {"remote_ip": "192.168.195.1", "remote_port": "57274", ...} 2025/03/16 14:13:06.847 DEBUG http.stdlib http: TLS handshake error from [客户端IP]:57274: EOF ``` ### Steps to reproduce 1. **服务器端配置** - Caddy 部署在内网： ```caddyfile { auto_https off debug } # ============================== # fleet.example.com # ============================== fleet.example.com:443 { tls /home/elastic/cert/example.com/fullchain.pem /home/elastic/cert/example.com/privkey.pem reverse_proxy https://localhost:8220 { transport http { tls_insecure_skip_verify } } } # ============================== # es.example.com # ============================== es.example.com:443 { tls /home/elastic/cert/example.com/fullchain.pem /home/elastic/cert/example.com/privkey.pem reverse_proxy https://localhost:9200 { transport http { tls_insecure_skip_verify } } } # ============================== # kibana.example.com # ============================== kibana.example.com:443 { tls /home/elastic/cert/example.com/fullchain.pem /home/elastic/cert/example.com/privkey.pem reverse_proxy 192.168.195.135:5601 } ``` 2. **FRP 配置** - FRP 配置： ```ini [caddy] type = tcp local_ip = 192.168.195.135 local_port = 443 remote_port = 4433 ``` 3. **测试请求** - 使用 curl 添加常用浏览器的请求头： ```bash curl -v --tlsv1.3 \ -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" \ -H "Accept-Language: en-US,en;q=0.9" \ "https://fleet.example.com:4433/" ``` ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [ ] Security - [x] User Experience - [x] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror closed this issue

2026-05-05 14:23:18 -06:00

gitea-mirror commented

2026-05-05 14:23:20 -06:00

Author

Owner

@xqzr commented on GitHub (Mar 17, 2025):

域名未备案。
浏览器使用了 X25519MLKEM768 未被阻断

@xqzr commented on GitHub (Mar 17, 2025): 域名未备案。浏览器使用了 `X25519MLKEM768` 未被阻断

gitea-mirror commented

2026-05-05 14:23:21 -06:00

Author

Owner

@Fadouse commented on GitHub (Mar 18, 2025):

感谢！

@Fadouse commented on GitHub (Mar 18, 2025): 感谢！

gitea-mirror commented

2026-05-05 14:23:21 -06:00

Author

Owner

@hbliu1985 commented on GitHub (Jun 3, 2025):

我遇到同样的问题，只发生在某些网络环境中，请问怎么解决的？

2025-06-03 16:23:39.372 [D] [proxy/proxy_wrapper.go:265] [ddbf631394bc0c83] [liudoc.https-doc] start a new work connection, localAddr: 192.168.111.36:45965 remoteAddr: 14.103.140.101:7000
2025-06-03 16:23:39.373 [T] [proxy/proxy.go:151] [ddbf631394bc0c83] [liudoc.https-doc] handle tcp work connection, useEncryption: true, useCompression: true
2025-06-03 16:23:39.373 [D] [proxy/proxy.go:219] [ddbf631394bc0c83] [liudoc.https-doc] join connections, localConn(l[192.168.111.182:49412] r[192.168.111.182:443]) workConn(l[192.168.111.36:45965] r[14.103.140.101:7000])
2025-06-03 16:23:39.378 [D] [proxy/proxy.go:231] [ddbf631394bc0c83] [liudoc.https-doc] join connections closed
2025-06-03 16:23:39.379 [T] [proxy/proxy.go:233] [ddbf631394bc0c83] [liudoc.https-doc] join connections errors: [writeto tcp 192.168.111.182:49412->192.168.111.182:443: read tcp 192.168.111.182:49412->192.168.111.182:443: use of closed network connection]

@hbliu1985 commented on GitHub (Jun 3, 2025): 我遇到同样的问题，只发生在某些网络环境中，请问怎么解决的？ ![Image](https://github.com/user-attachments/assets/4cd1984d-419c-4c09-af39-ec82f708b181) ![Image](https://github.com/user-attachments/assets/cace2fac-e77a-4d0f-8e05-4162a0094340) 2025-06-03 16:23:39.372 [D] [proxy/proxy_wrapper.go:265] [ddbf631394bc0c83] [liudoc.https-doc] start a new work connection, localAddr: 192.168.111.36:45965 remoteAddr: 14.103.140.101:7000 2025-06-03 16:23:39.373 [T] [proxy/proxy.go:151] [ddbf631394bc0c83] [liudoc.https-doc] handle tcp work connection, useEncryption: true, useCompression: true 2025-06-03 16:23:39.373 [D] [proxy/proxy.go:219] [ddbf631394bc0c83] [liudoc.https-doc] join connections, localConn(l[192.168.111.182:49412] r[192.168.111.182:443]) workConn(l[192.168.111.36:45965] r[14.103.140.101:7000]) 2025-06-03 16:23:39.378 [D] [proxy/proxy.go:231] [ddbf631394bc0c83] [liudoc.https-doc] join connections closed 2025-06-03 16:23:39.379 [T] [proxy/proxy.go:233] [ddbf631394bc0c83] [liudoc.https-doc] join connections errors: [writeto tcp 192.168.111.182:49412->192.168.111.182:443: read tcp 192.168.111.182:49412->192.168.111.182:443: use of closed network connection]

gitea-mirror commented

2026-05-05 14:23:23 -06:00

Author

Owner

@xqzr commented on GitHub (Jun 3, 2025):

发生在某些网络环境中，请问怎么解决的？

https://github.com/fatedier/frp/issues/3778#issuecomment-2933491110

@xqzr commented on GitHub (Jun 3, 2025): > 发生在某些网络环境中，请问怎么解决的？ https://github.com/fatedier/frp/issues/3778#issuecomment-2933491110