Skip to main content
This guide walks you through recommendations to ensure you’re using ngrok securely.

Agent tips

  • Don’t run ngrok as root, as it shouldn’t be necessary.
  • Don’t open any additional incoming ports in your firewall. ngrok only makes an outbound connection upon start.
  • Consider restricting the IPs that are able to start ngrok agent sessions.

Authtokens

Encryption

  • If you’re running the latest ngrok agent, your tunnels use scheme https so that it only opens HTTPS endpoints and not HTTP endpoints. If you’re running an older version that doesn’t do this, be sure to configure this behavior yourself.
  • If your local service isn’t running on the same machine as the ngrok agent, set up TLS encryption for the ngrok agent to the upstream service leg of the tunnel using the local HTTPS feature.
  • For custom domains, use ngrok’s Automated TLS certificates to have ngrok automatically provision a TLS certificate for your endpoint from Let’s Encrypt.
Certificates automatically provisioned from Let’s Encrypt are securely managed, and their private keys aren’t accessible to the requester. This ensures the security and integrity of the certificate by preventing key exposure.

Using a custom connect URL

If your organization uses a custom Connect URL, your default ngrok configuration won’t work. Edit your ngrok agent configuration to add a connect_url parameter to use the custom Connect URL of your organization.

Tunnel configuration

TLS termination

TLS encryption is terminated at different locations depending on the ngrok endpoint type and configuration. See Terminating TLS Connections for more details.

Minimum TLS version

You can specify the minimum TLS version that clients are required to use to talk to the ngrok cloud service for your endpoint. See the terminate-tls Traffic Policy action for more details.

Observability

ngrok provides functionality for consuming logs for events in the system. For more information, check out the Log Exporting documentation.

Blocking non-corporate accounts

For a tighter security policy, most administrators want to block ngrok accounts that aren’t a part of their organization. The fastest approach is to block DNS lookups to the URLs the agent uses to connect to the ngrok cloud. These are the DNS lookups to block:
  • connect.ngrok-agent.com
  • connect.us.ngrok-agent.com
  • connect.eu.ngrok-agent.com
  • connect.ap.ngrok-agent.com
  • connect.au.ngrok-agent.com
  • connect.sa.ngrok-agent.com
  • connect.jp.ngrok-agent.com
  • connect.in.ngrok-agent.com
  • tunnel.ngrok.com
  • tunnel.us.ngrok.com
  • tunnel.eu.ngrok.com
  • tunnel.ap.ngrok.com
  • tunnel.au.ngrok.com
  • tunnel.sa.ngrok.com
  • tunnel.jp.ngrok.com
  • tunnel.in.ngrok.com

API configuration

You need an API key to authenticate with the ngrok REST API. API keys are Base64 encoded strings that you can find in the dashboard or from an API endpoint, which makes it easy to rotate your API keys. Consider restricting the IPs permitted to access the API. You can do so in the ngrok dashboard.

Dashboard configuration

Dashboard authentication

  • For authenticating access to the dashboard, ngrok has features for role-based access control (RBAC), IP policies, and single sign-on.
    • With RBAC, you can configure permissions for groups of users within your team (for example, admins and developers).
  • Consider restricting the IPs permitted to access the dashboard.