> ## Documentation Index
> Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# How does ngrok's Gateway work?

> Learn how ngrok's global cloud service and agent software work together to provide secure ingress to your applications.

ngrok operates a global network of servers called the *ngrok cloud service* where it accepts traffic to your upstream services from clients on the internet.
The URLs that it receives traffic on are your *endpoints*.
You configure *modules* that ngrok uses to authenticate, transform, and accelerate that traffic as it's sent to your upstream service.

Unlike traditional reverse proxies, ngrok's Gateway doesn't transmit traffic to your upstream services by forwarding to IP addresses.
Instead, you run a small piece of software alongside your service called an *agent* which connects to ngrok's global service via secure, outbound persistent TLS connections.
When traffic is received on your endpoints at ngrok's cloud service, it's transmitted to the agent via those TLS connections and finally from the agent to your upstream service.

You can choose how to run the agent software in different form factors—it's lightweight and easy to install:

1. **As a service:** Run a small side process called the [ngrok agent](/docs/agent/) as a background OS service.
2. **As an interactive CLI:** Run the [ngrok agent](/docs/agent/) interactively from the command line while developing and testing.
3. **As an SDK embedded in your app:** Include a small [Agent SDK](/docs/agent-sdks) library directly into your application software that returns a socket-like object.
4. **As a Kubernetes Controller:** Run the [ngrok Kubernetes Operator](/docs/k8s/) in a Kubernetes environment.

## Gateway versus traditional reverse proxies

ngrok's Gateway doesn't forward to IP addresses like traditional reverse proxies; instead, it sends connections to your upstream service via a lightweight piece of agent software running alongside or within your application.

This unique architecture confers several important benefits over the traditional model:

First, it means you can run your services *anywhere*—any cloud such as AWS or Azure, any application platform like Heroku, an on-prem data center, a Raspberry Pi in your home, or even on your laptop.

Second, it allows ngrok to provide ingress with zero networking configuration.
You don't need to work with arcane networking primitives like DNS, IPs, certificates, or ports—that configuration is pushed to ngrok's cloud service and it's all handled automatically for you.

Third, ngrok can protect you from attacks and enforce authentication without the concern that someone could "go around" ngrok by discovering your upstream IP addresses.