diff --git a/nixos/modules/services/networking/frp.nix b/nixos/modules/services/networking/frp.nix
index f43a102d741d..fa636bbe06fc 100644
--- a/nixos/modules/services/networking/frp.nix
+++ b/nixos/modules/services/networking/frp.nix
@@ -76,6 +76,26 @@ in
                   ];
                 };
               };
+
+              extraConfig = lib.mkOption {
+                type = lib.types.lines;
+                default = "";
+                description = ''
+                  Extra frp TOML configuration included at the end of the generated configuration file.
+                  Especially useful for [port range mapping].
+
+                  [port range mapping]: https://github.com/fatedier/frp#port-range-mapping
+                '';
+                example = ''
+                  {{- range $_, $v := parseNumberRangePair "6000-6006,6007" "6000-6006,6007" }}
+                  [[proxies]]
+                  name = "tcp-{{ $v.First }}"
+                  type = "tcp"
+                  localPort = {{ $v.First }}
+                  remotePort = {{ $v.Second }}
+                  {{- end }}
+                '';
+              };
             };
           }
         );
@@ -94,7 +114,18 @@ in
       instance: options:
       let
         serviceName = "frp" + lib.optionalString (instance != "") ("-" + instance);
-        configFile = settingsFormat.generate "${serviceName}.toml" options.settings;
+        baseConfigFile = settingsFormat.generate "${serviceName}-base.toml" options.settings;
+        configFile =
+          if options.extraConfig == "" then
+            baseConfigFile
+          else
+            pkgs.writeText "${serviceName}.toml" ''
+              # Nixos Module settings
+              ${builtins.readFile baseConfigFile}
+
+              # Nixos Module extraConfig
+              ${options.extraConfig}
+            '';
         isClient = (options.role == "client");
         isServer = (options.role == "server");
         serviceCapability = lib.optionals isServer [ "CAP_NET_BIND_SERVICE" ];
@@ -144,5 +175,8 @@ in
     ) enabledInstances;
   };
 
-  meta.maintainers = with lib.maintainers; [ zaldnoay ];
+  meta.maintainers = with lib.maintainers; [
+    zaldnoay
+    epireyn
+  ];
 }
diff --git a/nixos/tests/frp.nix b/nixos/tests/frp.nix
index 48c4e2bc842c..00982a6e05bf 100644
--- a/nixos/tests/frp.nix
+++ b/nixos/tests/frp.nix
@@ -9,10 +9,14 @@ let
     name = "secrets";
     text = "token=${token}";
   };
+  portRange = 6003;
 in
 {
   name = "frp";
-  meta.maintainers = with lib.maintainers; [ zaldnoay ];
+  meta.maintainers = with lib.maintainers; [
+    zaldnoay
+    epireyn
+  ];
   nodes = {
     frps = {
       networking = {
@@ -56,14 +60,25 @@ in
       services.httpd = {
         enable = true;
         adminAddr = "admin@example.com";
-        virtualHosts."test-appication" =
+        virtualHosts =
           let
             testdir = pkgs.writeTextDir "web/index.php" "<?php phpinfo();";
           in
           {
-            documentRoot = "${testdir}/web";
-            locations."/" = {
-              index = "index.php index.html";
+            "test-appication" = {
+              documentRoot = "${testdir}/web";
+              locations."/" = {
+                index = "index.php index.html";
+              };
+            };
+            "test-range" = {
+              documentRoot = "${testdir}/web";
+              listen = [
+                { port = portRange; }
+              ];
+              locations."/" = {
+                index = "index.php index.html";
+              };
             };
           };
         phpPackage = pkgs.php84;
@@ -87,6 +102,15 @@ in
             }
           ];
         };
+        extraConfig = ''
+          {{- range $_, $v := parseNumberRangePair "6000-6006,6007" "6000-6006,6007" }}
+          [[proxies]]
+          name = "tcp-{{ $v.First }}"
+          type = "tcp"
+          localPort = {{ $v.First }}
+          remotePort = {{ $v.Second }}
+          {{- end }}
+        '';
       };
     };
   };
@@ -96,9 +120,17 @@ in
     frps.wait_for_unit("frp-server.service")
     frps.wait_for_open_port(80)
     frpc.wait_for_unit("frp-client.service")
+
+    # Test config written in Nix
     response = frpc.succeed("curl -fvvv -s http://127.0.0.1/")
     assert "PHP Version ${pkgs.php84.version}" in response, "PHP version not detected"
     response = frpc.succeed("curl -fvvv -s http://10.0.0.1/")
     assert "PHP Version ${pkgs.php84.version}" in response, "PHP version not detected"
+
+    # Test `extraConfig` option with port range
+    response = frpc.succeed("curl -fvvv -s http://127.0.0.1:${toString portRange}/")
+    assert "PHP Version ${pkgs.php84.version}" in response, "PHP version not detected"
+    response = frpc.succeed("curl -fvvv -s http://10.0.0.1:${toString portRange}/")
+    assert "PHP Version ${pkgs.php84.version}" in response, "PHP version not detected"
   '';
 }