Intro
In Part 1, we explored what zrok is, its key features, and how it compares conceptually to ngrok as a self-hostable alternative. Now, it’s time to put the spotlight on Ngrok . In this post, we’ll walk through Ngrok installation, setup, and real-world usage—starting by a head-to-head feature comparison to see how these two stack up in terms FREE tier plan.
Zrok vs Ngrok (FREE plan)
| Resource | ngrok (Free) | zrok (Free) |
|---|---|---|
| Data Transfer Out | 1 GB /Month | 5 GB daily |
| Free Endpoints (Static Domain) | 1 | Up to 5 Share Backends (2 reserved) |
| Reserved Endpoints | 0 | 2 |
| Requests | 20,000 | Unlimited |
| TCP Connections | 5,000 | Not specified |
| TLS Connections | 5,000 | Not specified |
| Private Access | No | 5 Private Access Frontends |
| Interstitial Ads | Yes | One-Time Interstitials |
| Support | Limited | Community Support |
In a nutshell
- zrok’s free tier is much more generous, offering 5 GB of data per day vs. ngrok’s 1 GB total.
- zrok allows up to 5 shareable endpoints, whereas ngrok only allows 1.
- Zrok offers 2 Reserved Endpoints (persistant URL) and not Ngrok.
- zrok has a one-time interstitial ad, while ngrok’s free tier has persistent ads.
Ngrok
As Zrok, Ngrok is a reverse proxy that creates a secure tunnel from a public endpoint to a locally running web service. ngrok consolidates together your reverse proxy, load balancer, API gateway, firewall, delivery network, DDoS protection and more. The supported protocols are HTTP, HTTPS, TCP,TLS.
ngrok supports many authentications including: OAuth, IP Restrictions , OpenID Connect, SAML, and more.
Use cases
Among the scenarios where ngrok can be used beyond localhost exposure is
- Webhook Testing | Mobile Backend Testing
- Ingress to external networks
- Kubernetes Ingress: using ngrok Kubernetes Operator
- APIs in customer networks |APIs on devices: Run ngrok as a service
- API Gateway | Load Balancer
- Remote Access: SSH | RDP access to remote machines.
Installation
- Windows
- Mac :
brew install ngrok
Linux: You can install Ngrok from a package repository as shown below.
curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \
| sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \
&& echo "deb https://ngrok-agent.s3.amazonaws.com buster main" \
| sudo tee /etc/apt/sources.list.d/ngrok.list \
&& sudo apt update \
&& sudo apt install ngrokEnable
In order to authenticate ngrok agent you will need to fetch the authtoken. On the ngrok dashboard left panel, select <Your Authtoken> to generate the token.
Copy the token and run the below command on your terminal:
$ ngrok config add-authtoken <TOKEN>
⢿Enable command completion
. <(ngrok completion)Ngrok Agent Endpoints
Ngrok Endpoint is a URL that exposes local services online thanks to Agent Endpoints, installed locally.
I often used it to expose Kubernetes (APIs/services), a docker container or even gateways like hashicorp Vault .
Public Endpoints
A public endpoint has a publicly addressable URL that receives traffic from the internet via the ngrok cloud
# Example with zrokn
# create screen session to run ngrok the Backgroundn
screen -S ngork_sessionn
# expose local akeyless gateway API
ngrok http https://127.0.0.1:8080
ngrok (Ctrl+C to quit)
Session Status online
Account inconshreveable (Plan: Free)
Version 3.0.0
Region United States (us)
Latency 78ms
Web Interface http://127.0.0.1:4040
Forwarding https://84c5df474.ngrok-free.dev -> http://localhost:8080
Connections ttl opn rt1 rt5 p50 p90
0 0 0.00 0.00 0.00 0.00
# check the genrated URL in another session
curl -s http://127.0.0.1:4040/api/tunnels | jq -r '.tunnels[] | .public_url,.config.addr'
https://1a38-2607-fea8-700-2070-dda8-4913-67d3-3a0d.ngrok-free.app -> http://localhost:8080
Static Endpoint
If you want to keep the same URL each time you use ngrok, create a static domain on your dashboard and then use the --url flag to ask the ngrok agent to use it.
ngrok http 8080 --url https://jumpy-red-mollusk.ngrok-free.appInternal Endpoints
Internal endpoints can only receive incoming traffic from other Endpoints in your ngrok account via the forward-internal Traffic Policy action. Use the --binding internal flag.
ngrok http 8080 --url "https://example.internal" --binding internal
# with policies
$ ngrok http 80 --url "https://example.internal" --binding internal --traffic-policy-file policy.ymlNgrok Configuration File
ngrok agent supports an optional, YAML configuration file that allows to tweak some of its more advanced settings. the default location is ~/.config/ngrok/ngrok.yml . The --config flag can also explicitly target a config file.
ngrok http --config config1.yml 80Auth based endpoints
You may not want everyone to be able to access your application. ngrok can quickly add authentication to your app like OAuth, IP Restrictions, user/password without any changes. See google auth example below
ngrok http http://localhost:8080 --oauth google --oauth-allow-email alan@example.comCloud Endpoints
Cloud endpoints are persistent, centrally managed endpoints hosted in the cloud, offering more control and features compared to a standard endpoint created by the local Ngrok agent (temporary & less customizable). They aren’t tied to the lifetime of an agent process.
Cloud vs Agent Endpoints
| Property | Cloud Endpoints | Agent Endpoints |
|---|---|---|
| Lifetime | Always-on. Must be manually terminated. | Live as long as the agent process that started them. |
| Connection Handling | Configured with Traffic Policy. | Configured with Traffic Policy. |
| Configuration | Via the API or dashboard. | Managed by the running agent. |
| Dashboard accessibility | Created/configured from the dashboard. | Read-only in the dashboard. |
| Use ephemeral domains? | No. Must be a FQ URL on creation. | Yes. Ngrok can generate random URLs. |
| Traffic Policy required? | Yes. | No, but you can provide one if you’d like. |
After creating a trafic policy, you can create your Cloud Endpoint by running the following command, replacing your API key and desired URL:
ngrok api endpoints create --api-key {YOUR_API_KEY} \
--description "Cloud endpoint for my API" \
--type cloud \
--bindings public --url https://my-example-app.ngrok.dev \
--traffic-policy-file policy.yml this is similar to Zrok frontdoor mentioned previously. More about Cloud endpoints
User interface
The Ngrok’s Free tier portal doesn’t provide much considering the feature limitations. The usage page is pretty basic and asks you to upgrade. No traffic charts available neither, just the number of services used and the static domain detail after creation.
🚀BONUS: The new Endpoint Pools
This was just released before this post was published so we added it ;).
You can now have two or more endpoints share a URL, ngrok will load-balance between them whether they’re running on different machines, environments, networks, or even in different clouds.
1. Let’s try it! First, fire up one endpoint.
ngrok http 8080 --url https://api.example.com --pooling-enabled2. Then, run the same command again in a separate machine
ngrok http 8080 --url https://api.example.com --pooling-enabledThat’s it! your Traffic to https://api.example.com will now be load balanced between the two.
Final thoughts
Both Ngrok and Zrok both excellent options to expose local services online but cater to different needs. Ngrok offers cloud features, while Zrok shines with its open-source model and simplicity. Zrok’s free tier is little more generous—5 GB, 5 endpoints, file-sharing, and 2 reserved domains vs. Ngrok’s 1 GB and 1 endpoint.
Ultimately, the best choice depends on your workflow. Or just use both if you have multiple endpoints to expose.
🔥 Next, we have a nice new article about a hot new feature from Ngrok (Ngrok.ai) . Stay Tuned!
This blog series sets the stage for upcoming HashiCorp Vault labs. Stay tuned! 🚀
🙋🏻♀️If you like this content please subscribe to our blog newsletter ❤️.