How to Skip Buying a Server: Use Docker + FRP for Seamless Intranet Penetration

Background

Running the 小哈书 demo required 12 micro‑services and heavy middleware (RocketMQ, Cassandra, Elasticsearch), which consumed over 14 GB of RAM on a single cloud VM. Maintaining such a server was expensive, so the author sought a way to host the services locally while still making them reachable from the public internet.

What Is Intranet Penetration?

Intranet penetration (or reverse proxy tunneling) allows external users to access devices inside a private network by routing traffic through a publicly reachable proxy server. The core principle is middle‑server forwarding : the internal client initiates a connection to a public proxy (e.g., FRP or ngrok), and the proxy forwards inbound requests back to the client.

FRP Overview

FRP (Fast Reverse Proxy) is an open‑source tunneling tool that forwards external requests to internal services via TCP, UDP, HTTP, or HTTPS. Its main advantages are:

Open‑source & free : source code on GitHub (fatedier/frp) can be self‑hosted without traffic limits.

Flexible configuration : supports any TCP/UDP port, HTTP/HTTPS domain binding, and load balancing.

Cross‑platform : both server (frps) and client (frpc) run on Windows, Linux, macOS, and even Raspberry Pi.

Self‑hosted security : you control the public server, can enable TLS, and avoid third‑party data leakage.

High performance : low latency suitable for remote desktop or other real‑time scenarios.

Tool Comparison

FRP – open‑source, full protocol support, requires you to maintain a public server.

ngrok – no server setup, quick start, but free tier limits domain randomness and bandwidth.

ZeroTier – P2P direct connection with low latency, but needs client software and network configuration.

花生壳 (Peanut Shell) – simple for beginners, but free tier has low bandwidth and paid version is pricey.

Deployment Process

1. Prepare a lightweight public server

Use a cheap cloud instance (e.g., 2 CPU + 2 GB RAM) and install the FRP server (frps) Docker image. docker pull fatedier/frps:v0.61.2 If the image cannot be pulled directly, download it locally and transfer it: docker save -o frps.tar fatedier/frps:v0.61.2 Upload frps.tar to the server and load it:

docker load -i frps.tar

2. Create FRPS configuration

On the server, create /docker/frps/frps.toml with the following content (comments omitted for brevity):

# FRPS configuration
bindAddr = "0.0.0.0"
bindPort = 7000

webServer.addr = "0.0.0.0"
webServer.port = 7500
webServer.user = "admin"
webServer.password = "123456"

auth.method = "token"
auth.token = "5bk6QH80Annl9U1jdVa9T0RpUkU4bOKOpshZSe1ImuD7V2Jp8k5Dgxf5vFNRAOvuirhjaSnGDLIWWG6M0S5r3A=="

log.level = "warn"
log.to = "/opt/frps/frps.log"

3. Run the FRPS container

docker run --name frps \
  --restart unless-stopped \
  --network host \
  -e TZ=Asia/Shanghai \
  -v /docker/frps:/opt/frps \
  -d fatedier/frps:v0.61.2 -c /opt/frps/frps.toml

Open the management console at http://<public‑ip>:7500 and log in with the credentials from the config file.

4. Open firewall ports

Add inbound rules for ports 7000 (FRP client communication) and 7500 (management UI). For the client‑to‑server tunnel also open 8000 (the local service port) with source 0.0.0.0/0 if the client IP changes frequently.

5. Install FRPC on the local machine

Pull the client image: docker pull fatedier/frpc:v0.61.2 Create a directory (e.g., E:/docker/frpc) and add frpc.toml:

# FRPC client configuration
serverAddr = "116.0.120.57"   # public IP of the FRPS server
serverPort = 7000

auth.method = "token"
auth.token = "5bk6QH80Annl9U1jdVa9T0RpUkU4bOKOpshZSe1ImuD7V2Jp8k5Dgxf5vFNRAOvuirhjaSnGDLIWWG6M0S5r3A=="

log.level = "warn"
log.to = "/opt/frpc/frpc.log"

[[proxies]]
name = "xiaohashu-gateway"
type = "tcp"
localIP = "192.168.0.101"   # IP of the local service
localPort = 8000            # e.g., Spring Boot gateway port
remotePort = 8000           # port exposed on the public server

6. Run the FRPC container

On Windows combine the command into a single line:

docker run --name frpc --restart=unless-stopped -e TZ=Asia/Shanghai -v E:\docker\frpc:/opt/frpc -d fatedier/frpc:v0.61.2 -c /opt/frpc/frpc.toml

Verify the container is running with docker ps. In the FRPS UI, the proxy should appear with status online, confirming a successful tunnel.

Testing the Tunnel

Use a tool such as Apipost to call the original localhost API (e.g., “get note detail”) via the public IP and port 8000. A successful response proves that the internal service is now reachable from the internet.