Intranet Proxy Tools Overview: nps, frp, EW, and ngrok – Features, Installation, and Usage

0x00 Introduction – The article summarizes commonly used intranet penetration and proxy tools from a security perspective, explaining their basic principles and practical usage.

0x01 nps‑npc

1.1 Overview – nps is a lightweight, high‑performance proxy server supporting TCP/UDP forwarding, HTTP/SOCKS5 proxy, P2P, and a web management UI.

Features

Written in Go, cross‑platform

Supports multiple protocols

Web management console

1.3 Installation & Configuration

cd ~
wget https://github.com/cnlh/nps/releases/download/v0.23.2/linux_amd64_server.tar.gz
xzvf linux_amd64_server.tar.gz
cd ~/nps

Edit conf/nps.conf to set web host, username, password, and bridge settings, then start the server:

#Mac/Linux
./nps test|start|stop|restart|status
#Windows
nps.exe test|start|stop|restart|status

Client side uses ./npc -server=YOUR_IP:8024 -vkey=YOUR_KEY -type=tcp .

0x02 frp

2.1 Overview – frp is a high‑performance reverse proxy supporting TCP, UDP, HTTP, HTTPS, and more, allowing internal services to be exposed via a public node.

2.2 Features

Supports TCP, KCP, WebSocket

Port multiplexing

Plugins for extra functionality

2.3 Usage

Configure frps.ini (server) and frpc.ini (client). Example for RDP tunneling:

# frps.ini
[common]
bind_port = 7000
token = abcdefgh

# frpc.ini
[common]
server_addr = x.x.x.x
server_port = 7000
token = abcdefgh
[rdp]
type = tcp
local_ip = 127.0.0.1
local_port = 3389
remote_port = 6000

Start with ./frps -c ./frps.ini and ./frpc -c ./frpc.ini . Similar configurations are shown for SSH, custom domains, static file service, dashboard, TLS, bandwidth limiting, and range port mapping.

0x03 EW

EW is a lightweight C‑written SOCKS5 proxy tool supporting multi‑level proxy chains. Example commands:

$ ./ew -s ssocksd -l 1080
$ ./ew -s rcsocks -l 1080 -e 8888
$ ./ew -s rssocks -d 1.1.1.1 -e 8888

Various chaining commands ( lcx_listen , lcx_slave , lcx_tran ) enable complex forwarding scenarios.

0x04 ngrok

ngrok provides secure reverse proxy tunnels with traffic inspection. After registering and downloading, authorize with:

./ngrok authtoken YOUR_TOKEN

Expose a local HTTP service:

./ngrok http 80

Additional examples show file sharing, TCP port exposure, and authentication‑protected tunnels.

References

Intranet penetration article: https://xz.aliyun.com/t/7701

frp tutorial: https://segmentfault.com/a/1190000021876836

EW usage: http://rootkiter.com/EarthWorm/

ngrok docs: https://ngrok.com/docs