Network Security - ngrok documentation

ngrok provides multiple layers of network security that you can apply to your endpoints using Traffic Policy. These controls let you restrict who can reach your local application at the network level.

IP restrictions

Limit access to your endpoint to specific IP addresses or CIDR ranges:

ngrok.yml

endpoints:
  - name: my-app
    url: $YOUR_DOMAIN
    traffic_policy:
      on_http_request:
        - actions:
          - type: restrict-ips
            config:
              enforce: true
              allow:
                - "203.0.113.0/24"
                - "198.51.100.42"
    upstream:
      url: 8080
      protocol: http1

Mutual TLS (mTLS)

For environments that require client certificate verification, ngrok supports mutual TLS. This ensures that only clients presenting a valid certificate can connect to your endpoint. See the Agent TLS Termination documentation for configuration details.

Combining security controls

You can layer multiple security controls on a single endpoint. For example, combine IP restrictions with OAuth authentication:

ngrok.yml

endpoints:
  - name: my-app
    url: $YOUR_DOMAIN
    traffic_policy:
      on_http_request:
        - actions:
          - type: restrict-ips
            config:
              enforce: true
              allow:
                - "203.0.113.0/24"
          - type: oauth
            config:
              provider: google
    upstream:
      url: 8080
      protocol: http1

Next steps

IP Restrictions action reference: full configuration options for IP restrictions
Authentication: add user-level authentication to your endpoints
Traffic Policy: explore all available security and traffic management actions

​IP restrictions

​Mutual TLS (mTLS)

​Combining security controls

​Next steps

IP restrictions

Mutual TLS (mTLS)

Combining security controls

Next steps