frp内网穿透

# 解压并进入目录
tar -zxvf frp_*.tar.gz
rm -f frp_*.tar.gz
cd frp_*

# 创建配置文件
mkdir -p /etc/frp
cp frps /usr/local/bin/
ln -s /usr/local/bin/frps /usr/bin/frps
cp frps.ini /etc/frp/frps.ini
sed -i 's/nobody/root/' systemd/frps.service
cp systemd/frps.service /usr/lib/systemd/system/

# 开启服务
systemctl enable frps
systemctl start frps

# 以下命令在root下执行
mkdir -p /etc/frp
cp frpc.ini /etc/frp/
cp frpc /usr/local/bin/
ln -s /usr/local/bin/frpc /usr/bin/frpc
# 替换nobody为root, 或者删掉
sed -i 's/nobody/root/' systemd/frpc.service
cp systemd/frpc.service /usr/lib/systemd/system/

# 开启服务
systemctl enable frpc
systemctl start frpc

tls_enable = true
tls_cert_file = server.crt
tls_key_file = server.key
tls_trusted_ca_file = ca.crt

tls_only = true
tls_enable = true
tls_cert_file = client.crt
tls_key_file = client.key
tls_trusted_ca_file = ca.crt

cat > my-openssl.cnf << EOF
[ ca ]
default_ca = CA_default
[ CA_default ]
x509_extensions = usr_cert
[ req ]
default_bits        = 2048
default_md          = sha256
default_keyfile     = privkey.pem
distinguished_name  = req_distinguished_name
attributes          = req_attributes
x509_extensions     = v3_ca
string_mask         = utf8only
[ req_distinguished_name ]
[ req_attributes ]
[ usr_cert ]
basicConstraints       = CA:FALSE
nsComment              = "OpenSSL Generated Certificate"
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid,issuer
[ v3_ca ]
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints       = CA:true
EOF

openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -key ca.key -subj "/CN=example.ca.com" -days 5000 -out ca.crt

openssl genrsa -out server.key 2048

openssl req -new -sha256 -key server.key \
    -subj "/C=XX/ST=DEFAULT/L=DEFAULT/O=DEFAULT/CN=server.com" \
    -reqexts SAN \
    -config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:localhost,IP:127.0.0.1,DNS:example.server.com")) \
    -out server.csr

openssl x509 -req -days 365 \
    -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
    -extfile <(printf "subjectAltName=DNS:localhost,IP:127.0.0.1,DNS:example.server.com") \
    -out server.crt

openssl genrsa -out client.key 2048
openssl req -new -sha256 -key client.key \
    -subj "/C=XX/ST=DEFAULT/L=DEFAULT/O=DEFAULT/CN=client.com" \
    -reqexts SAN \
    -config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:client.com,DNS:example.client.com")) \
    -out client.csr

openssl x509 -req -days 365 \
    -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
    -extfile <(printf "subjectAltName=DNS:client.com,DNS:example.client.com") \
    -out client.crt

# frpc.ini
[web]
type = https
local_port = 443
custom_domains = test.example.com

# now v1 and v2 are supported
proxy_protocol_version = v2

server {
  listen 443 ssl http2 proxy_protocol;
  real_ip_header proxy_protocol;
  real_ip_recursive on;
  set_real_ip_from 127.0.0.1;
  ……
}