Site-to-Site Connectivity with ngrok

Chapter 1. Securing Ingress

A Note for Early Release Readers

With Early Release ebooks, you get books in their earliest form—the author’s raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the 2nd chapter of the final book.

If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

There’s a long-held misconception that network tunnels are insecure.

Many people think of a tunnel as a direct connection to an upstream service, which might be a scary concept.

With ngrok, tunnels actually protect your upstream service. Traffic destined for your application flows directly to ngrok’s global network—not your upstream service. ngrok receives the request, applies the security policies you specify, and then sends the request to your service only if authorized.

Your service’s ingress rules allow connectivity from the ngrok network, not the outside world. Thus, ngrok becomes your service’s only client, and your production infrastructure remains safe and secluded from outside traffic.

This makes ngrok tunnels secure by design.

Nevertheless, many people utilize tunnels to bypass IT security controls and gain connectivity quickly.

Without a universal ingress platform like ngrok, IT teams must make significant changes to their production infrastructure ...