Connect Services the Internet Can't Reach

The services you need to reach are not always reachable. They sit behind a corporate firewall, on a device you shipped to a customer, inside a private cluster, or on a laptop that joins a different network twice a day. None of them can accept an inbound connection, and giving them one usually means a VPN, a port forward, or a public IP address you would rather not hand out. The ngrok agent reverses the direction instead. You run it next to your service, it dials out to ngrok’s network over TLS, and traffic addressed to your endpoint travels back down that same connection. Your service stays exactly where it is, and nothing about its network has to change.

​

When you need an agent

Run an agent whenever the thing receiving traffic cannot be reached from ngrok’s network on its own:

• Behind NAT or a firewall. Home networks, guest Wi-Fi, corporate networks, and double NAT all work, because the connection is outbound on port 443.
• On hardware in the field. Devices with no fixed address, no inbound ports, and no one on site to configure a router.
• Inside a private network. A VPC, a Kubernetes cluster, or a customer’s datacenter that you reach without peering or a VPN.
• On a developer machine. A laptop that moves between networks and still needs a stable public URL.

You may not need an agent at all. If what you are routing to is already reachable at a stable address, a Cloud Endpoint can route to it directly and stays up whether or not any process of yours is running. Endpoints an agent creates are Agent Endpoints, and they exist only while that agent does.

​

What you get once it’s connected

• Any protocol your service speaks. HTTP, HTTPS, TCP, and TLS, so databases, SSH, and RDP work the same way web apps do.
• Many services from one agent. Run several endpoints at once and define them all in a configuration file instead of a shell command.
• Something that stays running. Install it as a native OS service for automatic startup and crash recovery, then stop, restart, or upgrade it remotely from the API or dashboard.
• No runtime dependencies. A single standalone executable on every major operating system.

​

Working with the agent

​

What people build with it

​

What’s next?

• Install the agent and connect your first service.
• Configure multiple endpoints and run the agent as a service.