General
How does site-to-site connectivity work with ngrok?
Your customer runs a lightweight ngrok agent inside their network that creates a secure, outbound TLS connection to the ngrok cloud service on port 443. You create Cloud Endpoints that route traffic through that connection to the customer’s internal services. No inbound ports need to be opened in the customer’s network.Do I need one agent per service in the customer’s network?
No. A single ngrok agent acts as a central gateway that can reach any service on the local network. You configure multiple Internal Endpoints in the agent’s configuration file, each pointing to a different upstream service.Does the customer need to make firewall changes?
No. The ngrok agent connects outbound over TLS on port 443, which is typically already allowed. No inbound firewall rules or open ports are required.Why use ngrok instead of a VPN or VPC peering?
Running an agent container is often more straightforward than configuring VPC peering. The ngrok agent works the same way in any cloud, and any on-prem environment. You don’t need to reverse-engineer your customer’s network or firewall configuration.Security
How do I authenticate connections to customer services?
You can authorize connections from your cloud to ngrok using Traffic Policy. With Traffic Policy, you can authenticate connections using IP restrictions, JWT validation, OAuth, OpenID Connect, SAML, and more. Apply these as Traffic Policy actions on your Cloud Endpoints.Can I scope access to specific services?
Yes. By default, you access only the specific APIs and databases at the ports associated with your Internal Endpoints.Does installing the agent expose my customer’s whole network?
No. The agent forwards only to the upstream addresses in its endpoint configuration. Scope its authtoken with ACLs so it can’t create other endpoints, and point your customer to the end customer guide for what to agree on before they install.Can my customer revoke access without me?
Yes. They can stop the agent service and block its Connect URL at their firewall. Agree on that procedure before deployment, and revoke the agent’s authtoken on your side when they do. The revocation steps are in the end customer guide.Is traffic end-to-end encrypted?
Yes, if you configure TLS termination at the ngrok agent or at the upstream service. In these models, the ngrok cloud service only sees ciphertext. See TLS termination options for details.Can ngrok see the traffic it forwards?
Only when TLS terminates at ngrok’s network, which is the default for HTTPS endpoints. If you terminate TLS at the agent or at your upstream service, ngrok’s network forwards ciphertext it can’t read. See TLS termination options to choose a model.How do I prevent unauthorized use of ngrok in the customer’s network?
Set up a custom connect URL so the agent connects to your branded domain (for example,connect.acme.com:443) instead of the default connect.ngrok-agent.com.
The customer can then block the default connect URL, preventing any other ngrok usage on their network.