- 144comments
- 199comments
- 36comments
- 231comments
- 7comments
- 62comments
- 11comments
- 46comments
- 250comments
- 72comments
- 42comments
- 36comments
- 238comments
- 10comments
- 51comments
- 17comments
- —discuss
- 168comments
- 13comments
- 152comments
- 3comments
- 25comments
- 89comments
- 16comments
- 176comments
- —discuss
- 74comments
- 149comments
- —discuss
- 283comments
I have to say ngrok was one of the services I've used in life that truly made me go "ohh holy shit." This was several years ago, but it was such a pain point sharing local dev things with other folks, and this made it absolutely so trivial. It felt a bit like when I used prettier for the first time in my code -- instantly I knew I couldn't live without having it in my life. I hope him/they are making good money from the project!
I’m old enough to remember a time where carrier grade NAT wasn’t freaking everywhere and everyone actually had a static dedicated IP address
You could start a multiplayer game of StarCraft just by putting in your friends IP. It was wonderful and how the internet was meant to be
While I agree with the sentiment, there are real issues with a truly p2p internet. Even if we switched to IPv6 overnight, everything would still be locked down with firewalls. And what if someone decides to DDoS your blog or geo-locate your IP to figure out what town you live in?
In order to get to a p2p world, I think maybe the best balance point is for most people to connect to the internet through a local tunneling/VPN company which also provides them with a public inbound IP. This has many benefits including:
* Hides all your behavior from your ISP, turning them into a dumb pipe and encouraging net neutrality.
* Since VPNs don't necessarily require hardware, it's much cheaper for VPN companies to start up and compete with each other. This can also have the effect of decentralizing a lot of power into many small local companies, as opposed to large (inter)national ISPs.
* Allows new protocols like IPv6, HTTP/3, etc to be adopted more quickly because VPN companies can implement them for all their users at once.
Unfortunately this technology might need a rebranding first, as a lot of VPN companies these days feel quite scammy and make some dubious claims about what they accomplish.
We had a truly P2P internet, it was fine. We did get nuked at the start, but then we started using firewalls and all was good.
You really think it would still work today though? I want to believe you.
Yeah, why not? As long as you use a firewall that blocks all incoming ports by default and only opens the ones you want, it would be fine.
A p2p internet with no open ports is pretty pointless. And the average p2p application user isn't likely to understand the ramifications of opening ports, even if good tools are provided to do so (which I'm skeptical). So I don't really see how this improves much on the CGNAT world we're headed into.
I think tunneling is a safer and easier approach for most people. They never have to expose their IP or ports, and the application on the private end of the tunnel can run in a sandbox to protect the rest of the user's stuff.
How will the application in the tunnel open a port? And why would the p2p application not sandbox? Seems like a double standard.
This is how IPv6 works today.
It was also a bit of a nightmare of abuse, and a golden age of worm attacks. If you annoyed the wrong person on IRC suddenly your internet was DOS'ed offline.
Tor/onion hidden services are under-appreciated here and a good fit for potentially replacing ngrok: https://community.torproject.org/onion-services/setup/
You need to run a tor daemon on the server side and then a tor browser or tor on the client side, but other than that there is no other setup or intermediary service/server necessary. This solves a lot of pain that many ngrok alternatives still require you to run (or pay for using) some central hub server, have a public IP & DNS, etc.
I've been meaning to add Tor to the list. PRs welcome.
I made a little write up on how to setup onion services for ssh https://github.com/madacol/knowledge/blob/master/Ssh%20serve...
Just follow the first part, and change the port to whatever you are using
You always need a compatible client on the other side
The client part is exactly why people might use ngrok to get a public hostname - the number 1 priority is access to an internal resource from anywhere in the world with minimal setup, and that ngrok/other mediator means nobody needs any inbound ports open besides via loopback on the host.
Yeah it depends--I use ngrok (or similar services) for access to internal stuff I run. I don't want to pay money to run a VPS in the cloud when I have a NAS, etc. running it at home. But I also don't want to pay a premium for a public IP at home, and deal with the immense security headache of securing such an entrypoint from the public internet. So a tor hidden service works great as a no cost VPN-like alternative.
But yeah if your goal is "expose this thing with a public IP/DNS" then there is no way around using your own server, or buying/leeching off a service like ngrok.
You don't need any incoming ports open for a tor hidden service either though. Both the server and client side connect out to tor, and then get routed to each other over it.
I made a little utility for tunneling with the Tor daemon. Check out https://github.com/cmars/onionpipe.
onionpipe forwards ports on the local host to remote Onion addresses as Tor hidden services and vice-versa.
If things that require client side software other than a standard browser count, then there is the Yagdrasil network and Hamachi.
A simple alternative: I have a new asus router with built in support for their DynDNS clone. I can then buy a cheap domain, cname it to the asus domain and have Caddy proxy forward a subdomain to my laptop.
It will be lots cheaper per month than Ngrok, of course, but it will take more setup.
This will work as long as your laptop stays on that network, and as long as you don't mind your IP address being public.
I really like ngrok, but I keep bumping into a limitation: if I leave a development tunnel open from one machine, there is no way to shut it down remotely and open it elsewhere.
I am hoping this will be added one day, because it blocked me a number of times already.
That would be a handy thing to do. A workaround could be to have a raspberry pi or similar as your ssh access point to a local network via ngrok, with your main ngrok service running on another machine on the local network in screen or tmux. Then just ssh into the raspberry pi, connect to the machine running the main ngrok service, drop into the session and reconfigure as you like?
Maintainer of the list here. Take a look at my boringproxy project. Once you have the clients running on each machine, all the tunnels can be managed through a web UI on the server. With a little elbow grease[0], you can also SSH into any of the clients (as long as they have sshd running).
[0]: https://forum.indiebits.io/t/how-to-forward-ssh-port-example...
There is a beta feature you can enable to shutdown any open tunnel from the dashboard. It’s under tunnel agent, status.
I use this every day because I always forget to shut down the agent on my home computer before going to the office.
I feel like half of Ngrok's value prop is being undervalued here. Namely the fact that it captures requests for inspection and replay. That feature is an absolute game-changer for developing things like Webhooks.
First, it lets you easily see what the Webhooks payload looks like in real life. Second, it lets you hit your endpoint repeatedly with the same payload (while iterating on your code), without having to trigger the 3rd party event again.
That is a great feature, but a dev-centric one. If your focus is instead on self-hosting from behind a NAT, things like end-to-end encryption become more important. There are always tradeoffs.
Ngrok isn't the only one of those that do that though. It's not a unique feature. Hence why there's alternatives listed.
I've more or less stopped using Fiddler and Postman since I started using ngrok.
Fwiw my shell alias looks like this
``` ssh -tR "${HOST_PORT}:localhost:${LOCAL_PORT}" "${USER}@${HOST}" "multitail --basename -mb 2MB --follow-all --mergeall -n 0 -cS apache /srv/mydomain/logs/access.log -n 0 -cS apache_error /srv/mydomain/logs/error.log" ```
Which at least lets me see the nginx request logs as they come in. But no, I can't replay them or anything.
Have anyone run ngrok on ubiquiti routers, how did it go?
Longtime ngrok customer.
It seems like ngrok went from kind of a humble presentation to a more splashy look and maybe larger feature set.
The company is also actively recruiting sr swe’s right now.
Was the product bought or did the company take capital relatively recently?
It was such an understated thing for so long.
Personally I think they might be feeling the heat from Cloudflare Tunnel. To quote myself from a couple weeks ago[0] (note that an ngrok employee responded to some of my concerns):
[0]: https://news.ycombinator.com/item?id=30260530
I'm amazed even to hear the words "an Ngrok employee", like it were Google or something. The last time I remember reading about Ngrok, it was just one guy's repo on GitHub. That doesn't even feel that long ago. I'm stunned and perplexed to hear all of this.
Ngrok is a high-quality, well-engineered, bootstrapped product. Honest question, why be stunned and perplexed that it is successful enough to build a company around? Plenty of software companies start this way. And there's a huge spectrum between "having employees" and "being Google".
Greetings! Director of Eng here at ngrok. Figured I should say something (more of a lurker than I care to admit) since someone mentioned the recruiting side of things ;)
We haven't been bought and haven't taken any capital, but we have made some massive investments into our product: new ways of connecting, new ways of securing, reliability, etc. There are a couple announcements coming soon I don't want to spoil. We've been a quiet crew for a while!
On the recruiting side, we've got tons of openings in product engineering (junior, senior, management, PMs) and across the rest of the company. Please don't hesitate to reach out if you have an interest in working with us.
We use Cloudflare Tunnels. It is the easiest and has an excellent client (open source under Apache license).
Cloudflare Tunnel is what I (maintainer of OP list) currently recommend for most people. It's an excellent free service. Main downsides are:
* You can't do end-to-end encryption, ie Cloudflare terminates TLS for all requests and can see your data.
* Cloudflare's ToS specifically says you can only use the free tier for HTML websites. Anything else (ie video streaming, photo albums, etc) is technically grounds for suspension, although that seems to be rare in practice.
* Not open source. You can't self-host the server. (EDIT: Client is Apache licensed now) Client source code is available but not FOSS.
They recently changed that, may be I am missing something?: https://github.com/cloudflare/cloudflared/blob/master/LICENS...
Ah you're right. I forget they said[0] a couple weeks ago that they would be changing that. Great news!
[0]: https://news.ycombinator.com/item?id=30285051
Ngrok was really cool since I never thought about reverse proxying my localhost before l tried it.
But for the price of ngrok I'm paying for a domain and a 2gb ram/2 CPU VM on hetzner and using SSH tunnels to nginx reverse proxy.
And setting up a shared server for a team with subdomains is just 10 mins of config changes per user - no way they can justify the cost for me.
If it was some symbolic price like 20$/year then I wouldn't bother, otherwise I'll take the VM I can load other random dev crap to when I need it.
And you're using standard web tech to set this up - if you aren't familiar with something required to set this up you will be better off learning it in the long run (if you're the target audience for ngrok) : VM setup, nginx, reverse proxy, SSH tunneling, let's encrypt, domain management/DNS - all valuable fundamental skills to acquire on a small project.
For developers, I largely agree with you, though even in that demographic often it's nice to not have to fiddle with the details yourself, even if you know how.
But I'm interested in a different demographic. Someone who wants to run their own blog, or run a Nextcloud server for their family, or host albums from their photography work shouldn't need to understand DNS, TLS certs, IP addresses, ports, etc. They should be able to install an app on their laptop (or old Android phone, or Raspberry Pi), go through a quick OAuth flow to tunnel out of their home network, and have their content available to the rest of the web.
Obviously there are UX and security concerns, but these are solvable problems.
The issue is that DNS and registrar services are fragmented by design, and there doesn't seem to be a standard DNS API that would make it easy to simply say"select your domain registrar" and use that to start an oauth flow then manage DNS records for a site. Therefore, anyone who does run even a simple service like hosted wordpress (without using the host as their registrar) needs to at least have basic knowledge of what DNS records are and how to put in their registrar without messing up email records or other subdomains they might have.
There's the DomainConnect protocol[0] which has been around for a few years. I didn't find it particularly well matched for open source projects, so I've also done some work on my own protocol[1]. The current draft is implemented by TakingNames.io (as a provider) and boringproxy (as a client). You can read more about it and watch a demo here[2].
That said, I think DNS might not be the right layer of abstraction to simplify this. I think we need an open tunneling protocol[3].
[0]: https://www.domainconnect.org/
[1]: https://github.com/takingnames/namedrop-protocol-spec
[2]: https://takingnames.io/blog/introducing-takingnames-io
[3]: https://forum.indiebits.io/t/toward-an-open-tunneling-protoc...
Servers require maintenance. Time is money
Do you ever run into performance issues with the shared machines at the low end? I've found the shared CPUs can be a little iffy under load but if you're basically running reverse proxying only it must not be an issue
Also do you think you'd pay $40/year? that's less than what you're paying Hetzner for no management.
I've been running stuff like code server [1] for some workshop I held recently and I was building simple .NET projects there without any issues.
I wouldn't pay $40/year because the value of having a random instance up with domain/ssl and nginx running all the time has been handy many times so far - worth way more than what I pay for the machine. At this point ngrok would be a downgrade for my use case, but if it was something like 20$/year when I was looking into it I probably wouldn't have bothered setting it up.
[1] https://github.com/coder/code-server
As a developer and business owner, I literally can't comprehend this response. I can't imagine idea of having to manage yet another server over running
from the root of my application (which is wrapped in a single line shell script). For a business, paying $10/dev/month for ngrok is a rounding error.
I also think one should razor sharp focus on delivering customer value to be successful instead of introducing new tech you need to manage.
You probably don't need to manage another server. ngrok's functonality can easily be containerized for easy self-deployment on infrastructure.
$10 here, $10 there, and next thing you know every unix command line app I'm running is charging $10.
You should start thinking of your own time this way. Everyone has an hourly rate, how much do you spend solving problems like this?
Yes but 1) I enjoy solving problems like this and 2) I’m not working and being paid for all that extra free time I have anyways. There is also a non-zero intangible cost to offloading all tasks. Based on your rationale a highly paid Google engineer would have a maid, chef, and Ikea furniture assembler and the only thing the guy would do is code all day because that’s the maximum value use of his/her time. Obviously most people do not do that. I’d probably pay up to $100 per day to a toilet paper monopoly so that I didn’t have to use my hands everyday. Luckily toilet paper isn’t in a monopoly situation, so I’m not going to hand over $100/day to Charmin even though that’s the value I get from their product.
But I think that point is moot because a service that costs $X in perpetuity must justify its costs with continuous new features and must be compared to alternatives. If I just wanted a basic proxy I’d run one of the open source alternatives in a container. If it required too much work, make a contribution to the project to make it easier for everyone. The value of ngrok is in its extra features, but the bulk of the cost is probably in setting up an actual VM and running it, which isn’t that hard these days and can be automated even in an open source offering. When considering the value of ngrok you can’t simply justify it by saying how much time it saves you. You have to compare it to the market, which includes free open source alternatives. So the real question to ask is whether the added features of ngrok plus the time savings over using some open source alternative is worth the extra cost over the time span I’d be using it. If time span is infinite, then maybe it makes sense to do a one-time extra cost of learning how to setup an open source alternative and paying a bit less for the actual VM costs. Maybe ngrok’s added features are indeed worth paying for. But telling yourself your time is not worth looking into this is a lazy justification for unnecessary subscriptions.
This response only makes sense if you are not into DevOps, which I think you should as a developer. Take a random server exposed to the internet, use caddy or treafik to setup a reverse proxy. It takes like 20 seconds to create a reverse proxy to a random host connected via ssh.
Even easier, create predefined ports in caddy and connect to those via ssh. Assign domains to them like proxy<1-1000>.example.com. Connect to one via ssh that is free. Done. That's 2 seconds once it is setup.
Even easier and cheaper if you do not have a "random server exposed to the internet", take one of the alternatives shown by op which allows to deploy a digital ocean or Hetzner vm automatically. Done, like a few seconds from the command line.
10$ a month for something like this is over priced but I guess you prove that it is a valid business.
What you are describing is “easy” if it’s something you practice regularly. It would easily take me, an advanced SWE an hour to learn the process from scratch or re-learn after not thinking about the system for 18 months. $120/year pays for itself very quickly.
For anyone doing this as a hobby sure, but if this is your business then it’s nuts not to just pay the cheap toll.
But once you set it up - you've set it up for everyone on your team - you just add subdomains and keys to each person - which can be done by a script (depends on your DNS might require 1 manual step but you need this with ngrok anyway).
So it's not 120$/year - it's 120$/year/developer.
And setting it up for yourself - I've found multiple instances where having a configurable nginx reverse proxy on a public server saved me a bunch of time, it's much more flexible than ngrok.
What about something going wrong on ngrok's end and your hands being tied while nothing is working? Some might prefer similar solutions on servers that they control themselves.
Nginx or Caddy aren't all that hard to set up, for example: https://blog.kronis.dev/tutorials/how-to-use-nginx-to-proxy-...
Actually with WireGuard, OpenVPN and the like, you can do some pretty interesting (and sometimes problematic) things as well, so there's definitely a lot of flexibility with a few footguns here and there: https://blog.kronis.dev/tutorials/how-to-publicly-access-you...
Disclaimer: everyone's setup has their own requirements and whatnot. If using external services works for you, that's great! Also, that second article of mine may serve as an example of that NOT to do (you typically would only want to selectively forward ports, rather than forwarding all of the traffic like i did).
If I have 100 devs that's $12,000/year (ignoring any bulk discount), right? Are you saying that in a company with 100 developers they cannot spare enough time to run their own server cheaper than that?
Additionally, while the amount is 'cheap' in the isolated sense, when you start adding all those 'cheap' services together they quickly add up and suddenly your per-dev costs start getting out of control. In all cases you should consider the value of the service being provided. While I love ngrok, the functionality can easily be replaced for most use cases and move you from a per-dev cost to a relatively (yeah, large numbers of users will cause server scaling/cost changes) fixed cost instead.
Edit: Just to add on, $10/month is more than I pay for Gsuite or Jira on a per dev basis. The Ngrok pricing is drastically off base IMHO.
I've set this up for myself 4 years ago and it just works, having a nginx instance online was really useful many times, eg. just recently I had to setup custom routing rules for services configured on AWS load balancer, just setup the same routing rules on my nginx and tunneled my local services - spent 10 minutes to get a working environment for debugging on local machine - with ngrok I would need to setup a local reverse proxy and tunnel that, small time saver but there have been a lot of instances like this, where I'm like - oh let me just throw this on my garbage server to transfer, let's host it there for a demo, let me install code server there for a workshop, etc. It was there, running on my domain, I know how it's setup - much better value proposition than ngrok for the same price.
I also set it up for a team I worked with - took me 2 hours to get it running again and then the rest of the day to document and add keys for people and explain how and why they should use it. This was a team of 9 people - so in one day I did 1080$ - cost of small instance - for the year. That's above my daily rate so worth it for the owner as well.
10$/dev/month is not a lot - but this is such a trivial service that you setup once and forget, also there's a lot of friction in getting things like this approved and pretty much everyone has a some discretionary cloud provider budget.
Yes, but every tool on the wild wants you to pay 10 bucks per user per month. github/gitlab, jira, random CI/CD tool, gitpod, private repo, tailscale/zerotrust, dockerhub, 1password, okta, notion...
Depending on your size, those costs can add up pretty quickly.
ngrok is a very low hanging fruit for keeping expenses at bay, 10 bucks per user is ridiculously expensive for the service they are providing.
This simplifies:
https://boringproxy.io/
Written by the same guy that wrote awesome-proxy list in the original post.
Setup https://github.com/antoniomika/sish and get away from manually setting anything up. Uses SSH, supports HTTP(S)/TCP/Websockets/TLS via SNI and let’s users choose their own tunnel names. Can run it on a free instance from google or oracle.
I'll need to make a PR to add https://playit.gg :). Been working on it for the past two years. Offers UDP support, ability to tunnel a range of ports, and provides a fixed IP and port. I recently purchased a /24 and moved the entire service to an anycast network. An entire datacenter can go down and connections will keep going .
UDP and Anycast are great features. Can you tunnel anything or just game servers?
Also, I would love to hear about your experience buying a /24 if you've written about it somewhere.
i'll need to open a pull request for [tolocal](https://github.com/nelsonenzo/tolocal) :). It's clunky because it requires node and terraform and AWS, but all your stuff is self hosted and can be e2e encrypted, costs almost nothing, can be used with real domain names, etc. I would like to make it all JS at some point (the actual terraform is minimal), but it's hard to see why when Cloudflare Tunnel is a thing now.
ngrok related question.
Since ngrok is written on Go here is some pure C clone: https://github.com/dosgo/ngrok-c
I will appreciate if someone assist how to run it.
Here is issue: https://github.com/dosgo/ngrok-c/issues/84
Nice, I didn't realize there was a C port of the ngrok client. Since this seems intended for embedded devices/routers, you might also be interested in rathole:
https://github.com/rapiz1/rathole
IMHO - for 500k binary much better is userland C++ implementation of WireGuard: https://github.com/TunSafe/TunSafe
hi folks, i’m the founder/creator of ngrok. happy to answer any questions.
we’ve got some exciting improvements we’re looking to share with the community very soon here
<3 to you all
Disclaimer: I'm currently incubating a similar product.
Honestly I would be very interested in hearing what you think the best plan for competing with Cloudflare Tunnel is. I've been keeping a close eye on this space for a couple years now, and Tunnel seems well on its way to dominating the mindshare.
It can be very hard to compete with a bundled loss-leader offering.
happy to chat more about our future plans offline, feel free to send me a note. i’m alan at ngrok dot com. would be curious to see what project you’re incubating!
Fair enough. I'll take you up on that.
Just sending a thank you. I've happily been a customer for years. Love the constant improvements and stable service. Great product.
Hi @inconshreveable, happy user for many years and have done some crazy ngork remote setups to make systems like gitpod / docker work with ngrok.
Question for you - do you have a plan in mind for handling teams?
Right now it seems like the only way to handle it is with a manual naming convention:
https://{my-team-name}-{my-name}-api.ngrok.io
And then every single team member has to copy this convention by hand and you have to register webhooks, etc with these new routes.
It gets tedious fast.
Do you have ideas to work around this or register team members behind the scenes and still route traffic appropriately?
can you tell me a little bit more about what's tedious about it and/or the higher-layer problem you're trying to solve?
edit: feel free to email me as well at alan at ngrok dot com
Absolutely amazing project, happy paying customer.
Love, ngrok, thank you!
The main feature I want out of any of these, and can't seem to find anywhere, is a way to expose private services online hidden behind any sort of social-auth. So think ngrok+oauth2_proxy.
That's actually a pretty good idea. So basically login with Google/GitHub and then have access to anything being tunneled through the server?
You mean doing something like:
ngrok http 80 --oauth=google
That would be pretty cool.
I've been happily using localhost.run for a few years now. It's free if you don't mind randomized subdomains, and I like that I just connect with SSH instead of needing client software.
It's not as convenient out of the box but I use frp. With the deployment and configuration automated it's pretty good.
Last week I tried setting up BoringProxy from this list on a server running NixOS but gave up at the certificates step. I wish there was a simple NixOS module for something like this.
Do you know what issue exactly you were having with the certs? I've been meaning to try NixOS one of these days.
Long time lurker here , here is one i have written in java with netty inspired by ngrok and localtunnel which allows for inspection of requests and provides replay . Its Still in development with a lot of rough edges .
https://github.com/manoj-inukolunu/jtunnel-server
https://github.com/manoj-inukolunu/jtunnel-netty-client
if only ipv6 wasnt designed by network giants gripping their aging boxes built on 1940s concepts, monopoly usurers ISP who literary live by a centralized network and profit from nat, and advertising behemoths who still need to attribute clicks to advertising campaigns... we wouldn't be compiling lists of dozens of reverse proxy solutions that do nothing but work around all these things getting in the way of what what's network should have been already.
Wow - I was amazed at the sheer number of similar projects here, had no idea there was that much active in this space...
https://oss.rport.io
I would like to mention "Loophole Cloud". I'm one of the developers of Loophole and might be a little biased, but they do offer end-to-end encrypted services like custom hostnames and unlimited tunnel active time at no cost. I would be happy if there is any feedback we could learn from :)
If I could only decipher how to make an account in the first place, I'd use it.
Disclaimer: I'm a Cloudflare employee, but not on a team related to Tunnel.
I use Cloudflare Tunnel for all of my self-hosted applications (e.g. https://piperswe.me). Configuring it can be a bit of a pain (generating secrets, setting up systemd service, etc.), but its integration with the rest of the Cloudflare CDN products is worth it IMO.
I like telebit, found via "Look Ma, No Cloud" (https://www.youtube.com/watch?v=E1Q2MWGCADo)