What it is
A tool for forwarding ports through an intermediate server โ it lets you reach a device behind NAT or a home router without opening dangerous "holes" to the internet directly.
How we apply it
For a permanent tunnel between a node in Russia and a standalone server abroad โ traffic exits through a trusted point instead of being exposed on every node separately.
Where it helps a business
- New connections from Russia to a foreign server get lost, while VPN customers need a stable connection.
- A website in Russia must send requests to a bot that lives abroad.
- A service behind NAT or without an open port must be reachable from another server.
How we use it
- A VPN route. On the Russia โ Europe route, instead of a new connection per client, one persistent frp tunnel to the exit server carries all clients inside it. The filter that fires at connection setup no longer sees new connections.
- Websites and services abroad. On the websites server ten independent frp clients in one balancing group carry the sites' requests to a service abroad: if one session drops, new connections go through the other nine.
- A bot without an open port. The Peregovorka login bot lives abroad, while the service in Russia opens an outbound connection itself and exposes its internal API over TLS. The control port on the bot's side is open only to the service server's address.
Common problems
- Drops with no error in the log. The analysis in version 3.0.0 found 46 tunnel drops a day. In tcpMux mode frp turns off its own heartbeat, the multiplexer has a fixed 10-second write timeout, and on a lossy link one missed ping killed a healthy session. The keepalive interval was raised from 30 to 120 seconds.
- A single point of failure. The first tunnel was the only one; a second independent tunnel was added, and with the first taken down the subscription answered 10 requests out of 10.
When you do not need it
If the servers are in the same country and nobody cuts the connection between them, a direct connection or a private WireGuard network is enough.