Tollan vs frp for IoT devices
Both put a client on the device that dials out to a server, so the device needs no open port. With frp you run that server yourself. With Tollan the relay, the certificates and the console are run for you.
frp is a good tool for a different job
frp is an open-source reverse proxy. You run the server part, frps, on a machine with a public address, and the client part, frpc, on each machine behind NAT. It is flexible and free to use, and the server, its certificates, its patching and who may connect are yours to look after. Tollan is for teams who would rather spend that time on the devices.
| What you are deciding | Tollan | frp |
|---|---|---|
| Who runs the server | Tollan runs the relay and the console. | You do: a public machine, its patching, monitoring and certificates. |
| Who the identity belongs to | The device. Every agent holds its own CA-issued certificate. | Often a token set on the server and shared by its clients. Client certificates are possible if you run a CA for them. |
| Revoking one device | Revoke its certificate and its live tunnels drop. | Depends on your setup. With a shared token, rotate it and update every client. |
| Fleet management | A console with per-device routes, groups, and revocation. | A configuration file per client, plus a status dashboard on the server. |
| Microcontrollers | An ESP32 and Arduino library speaks the same protocol as the agent. | frpc runs on a full operating system or router; a board sits behind one. |
| Reading your traffic | Passthrough traffic is never decrypted at the relay. We route by TLS SNI without reading a single byte of your payload. | The server is yours, so what it sees depends on how you configure it. |
Tools change. Check frp's current documentation for their side before you decide.
Three things you do not have to run yourself
Per-device certificates
Every device holds its own CA-issued certificate. The private key is generated on the device and never leaves it.
Revocation you can prove
Revoke a device and its live tunnels drop in seconds — the relay re-checks certificate status continuously.
Accounts, roles and an audit trail
Console accounts get role-based access, optional TOTP two-factor, and an append-only audit trail.
When frp is the better answer
- You want to run every part yourself, and someone on the team will patch and watch a public server.
- Your traffic must never pass through infrastructure you do not operate.
- Your traffic is not TCP, so a per-service TCP route cannot carry it.
- You want to read, change and build the whole stack from source.
When Tollan fits better
- You would rather not own a public server, its certificates and its patching.
- You need each unit to have its own identity from enrollment, so one can be revoked alone.
- The same access model has to cover an ESP32, a Raspberry Pi, and a PLC gateway.
- Several people need access, with roles and an audit trail someone can review.
Choosing between the two
Is frp not the cheaper option?
The software is free, and for a few machines of your own it can be. The cost is time: the server, its certificates, patching and monitoring are yours. Tollan is free forever for one device, so you can compare both on real hardware.
Can I give each device its own identity with frp?
You can configure client certificates if you run your own certificate authority and keep it safe. Tollan does this at enrollment: Every device holds its own CA-issued certificate. The private key is generated on the device and never leaves it.
What happens when a device is lost?
Revoke a device and its live tunnels drop in seconds — the relay re-checks certificate status continuously. Only that device is cut off; the rest of the fleet keeps its certificates.
Can I reach several services behind one device?
One agent can expose anything on the device network — cameras, PLCs, gateways — each service behind its own route.
Do you read the traffic?
Passthrough traffic is never decrypted at the relay. We route by TLS SNI without reading a single byte of your payload. The security model sets out exactly what the relay does and does not see.
Try it with one device
Free forever for one device, no card required. Run it next to your frp setup and compare.