> ## Documentation Index > Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # ngrok CLI and SDK Connectivity > Find the addresses the ngrok CLI and SDKs connect to, see how they keep a session alive, and troubleshoot a session that won't start. When the ngrok CLI and SDKs start, they establish long-lived TLS connections to the ngrok service through which they create new endpoints and receive connections from ngrok's cloud service that are intended for your upstream services. ## Address By default, the latest ngrok CLI dials the following Connect URL when it connects to the ngrok service. This address resolves to a [dynamic set of IP Addresses](https://ngrok.com/docs/gateway/domains/ip-addresses.md). ``` connect.ngrok-agent.com:443 ``` > [!NOTE] > > All connections to ngrok servers are made on port 443. You can [customize the Connect URL](https://ngrok.com/docs/gateway/agent/connect-url.md) to brand it with your own domain. By default, the agent connects to one region. It can also connect to several at once and load balance traffic across them. [Contact Sales](https://ngrok.com/enterprise/contact) to turn this on. You can find the complete list of addresses and IP addresses available for the agent to connect to ngrok in the [ngrok DNS tunnel.json file](https://s3.amazonaws.com/dns.ngrok.com/tunnel.json). > [!NOTE] > > Prior to ngrok agent version 3.3.0, the ngrok agent connected to `tunnel.*.ngrok.com` domains. > The latest agent uses `connect.*.ngrok-agent.com` domains. ## Additional URLs In addition to the addresses used for connecting to the ngrok server, the ngrok agent may reach out to the following URLs. ### Certificate revocation list (CRL) check The ngrok agent reaches out to the following domains to check for revoked certificates. You can disable this check by adding `crl_noverify: true` to your ngrok agent config. * Prior to ngrok agent version 3.10.0: `http://crl.ngrok.com/ngrok.crl` * Latest versions: `http://crl.ngrok-agent.com/ngrok.crl` > [!NOTE] > > These connections use HTTP and port 80. > If your network blocks port 80, set [`crl_url`](https://ngrok.com/docs/gateway/agent/config/v3#crl-url) to `https://crl.ngrok-agent.com/ngrok.crl` to fetch the CRL over HTTPS instead. You can download and decode the CRL using OpenSSL: `openssl crl -inform PEM -text -noout -in ngrok.crl` ### ngrok agent update check The ngrok agent automatically looks for updates when it starts up. You can disable this check by adding `update_check: false` to your ngrok agent config. * `https://update.equinox.io` > [!NOTE] > > Equinox is fully owned by ngrok and used exclusively for building and distributing ngrok binaries. > See [the FAQ page](https://ngrok.com/docs/faq.md#does-ngrok-own-bin-equinox-io) for more details. ## DNS resolution When the ngrok agent dials the ngrok service to establish its TLS connections, it resolves DNS for the [connection address](https://ngrok.com/docs/gateway/agent/connect-url.md), which the [`connect_url`](https://ngrok.com/docs/gateway/agent/config/v3/#connect-url) configuration property defines. ngrok attempts to resolve DNS using multiple mechanisms so that it can establish connectivity even in network environments where DNS service is failing. ngrok attempts to resolve the IPs of its service using the following mechanisms: * Via the system's default DNS resolvers * Via Google's DNS servers (`8.8.8.8` and `8.8.4.4`) * Via Google's DNS-over-HTTPS service ([https://developers.google.com/speed/public-dns/docs/doh](https://developers.google.com/speed/public-dns/docs/doh)) * Via a [file hosted on an ngrok-controlled S3 bucket](https://s3.amazonaws.com/dns.ngrok.com/tunnel.json) Instead of using the system's default DNS resolvers, you can configure the DNS servers the ngrok agent uses for resolution with the [`dns_resolver_ips`](https://ngrok.com/docs/gateway/agent/config/v3/#dns-resolver-ips) configuration option. ## TLS verification The ngrok agent connects to the ngrok service over TLS connections. The agent verifies the TLS certificate returned by the ngrok service. ngrok's own root certificate authority signs the certificates returned by the ngrok service. The ngrok agent verifies the returned certificate against certificate authorities bundled into the agent itself. Lastly, the ngrok agent makes a request to `crl.ngrok-agent.com` to verify that the certificate returned by the ngrok service hasn't been revoked. You can skip this step by setting `crl_noverify: true` in your configuration file. ## Heartbeats Once the ngrok agent has established connectivity to the ngrok service, it periodically sends application-level heartbeat messages to validate the liveness of the connection. You can customize this behavior with the [`heartbeat_interval`](https://ngrok.com/docs/gateway/agent/config/v3/#heartbeat-interval) and [`heartbeat_tolerance`](https://ngrok.com/docs/gateway/agent/config/v3/#heartbeat-tolerance) configuration parameters. If the ngrok agent doesn't receive a response to its heartbeat within the tolerance window, it terminates the connection and begins reconnecting. ngrok's heartbeat mechanism allows it to recover from any type of network outage, even those caused by packet loss, dynamic IP changes, interface changes (for example, Wi-Fi to LTE), or complete network outages. The ngrok service also sends its own heartbeats to the agent, which it uses to detect liveness and terminate dead connections. ## Reconnection If the ngrok agent disconnects for any reason, it will automatically begin reconnecting. Reconnecting begins the entire connection process over again, beginning with DNS resolution. The ngrok agent attempts to recover quickly and slowly backs off its reconnection attempts but always attempts to re-establish connectivity unless the ngrok service explicitly instructs it to stop reconnecting. ## Troubleshooting If the agent can't reach ngrok, it's often hard to tell why, because any of the steps above could be the one that failed. The `ngrok diagnose` command works through them in order and reports which one broke. ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} ngrok diagnose ``` The `ngrok diagnose` command runs a series of tests to diagnose potential connectivity issues between the ngrok agent and the remote ngrok service. See available flags [here](https://ngrok.com/docs/gateway/agent/cli.md#ngrok-diagnose). ### Diagnostics The diagnose command gathers your environment information, including your sanitized configuration file. It then tests: * proxy connectivity, if `proxy_url` is configured * name resolution * general internet connectivity By default, `ngrok diagnose` tests IPv4 connectivity between the ngrok agent and the closest ngrok point of presence. To test IPv6 connectivity, add `--ipv6 true` to the command. To test connectivity between the ngrok agent and all ngrok points of presence, add `--region all`. #### Basic output The diagnose command prints a connectivity summary in your terminal. If you have full connectivity, your report will look like this: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} Testing ngrok connectivity... Internet Connectivity Name Resolution [ OK ] TCP [ OK ] TLS [ OK ] Localhost Connectivity Name Resolution [ OK ] ngrok Connectivity - Region: Auto (lowest latency) Name Resolution [ OK ] TCP [ OK ] TLS [ OK ] Tunnel Protocol [ OK ] Successfully established ngrok connection! (region: 'auto', latency: 54.895145ms) ``` If there's a connectivity problem, your report will show warnings and errors that you need to resolve before ngrok can work correctly: ``` Testing ngrok connectivity... Internet Connectivity Name Resolution [ WARN ] TCP [ OK ] TLS [ OK ] Errors and warnings encountered during diagnostics: * Diagnostics * Name Resolution * Resolver: system * Hostname: google.com - Err: Failed to resolve host google.com: lookup google.com on [::1]:53: read udp [::1]:48848->[::1]:53: read: connection refused (NGROK_ERR_8000) Error establishing ngrok connection: Failed to establish internet connectivity: resolver returned no IPs. ``` #### Verbose output For more detailed output, you can use the `--write-report`/`-w` flag to generate a verbose report: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} ngrok diagnose -w out.txt ``` By default, `ngrok diagnose --region all` generates a report. The `diagnose` output prints the report location: ``` Report written to /var/folders/yg/yzt44t813/T/ngrok-diagnose1080549118/diagnose.json ``` #### Kubernetes You can run `ngrok diagnose` within your Kubernetes cluster to troubleshoot network connectivity issues. See [Testing in a Kubernetes cluster](https://ngrok.com/docs/gateway/running-behind-firewalls.md#testing-in-a-kubernetes-cluster). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.