ngrok Alternatives for MSPs: Reach a Whole Site, Not One Service

ngrok is one of the fastest ways to get a service behind a firewall onto a public URL. Developers use it constantly for webhooks, demos, and testing, and IT people reach for it to poke at an internal web UI from the road. The agent dials out, you get a URL, and you are in. For an MSP managing devices across many client sites, though, ngrok is built for a different job, and the gap shows up fast once you move from "expose one service" to "manage every device on a site."

Where ngrok Works Well

ngrok is excellent at its intended job. The agent opens an outbound TLS connection on port 443 to ngrok's cloud, so it works behind NAT, CGNAT, and corporate firewalls with no port forwarding and no inbound rules. You run a single command, point it at a local service, and ngrok hands back a public endpoint that forwards to it:

• ngrok http 80 exposes a local web app
• ngrok tcp 192.168.1.50:3389 forwards a raw TCP port to a device on the LAN

It supports HTTP, HTTPS, TCP, and TLS, and layers on OAuth, request inspection, and traffic replay. For getting one app online right now, ngrok is hard to beat.

Where It Falls Short for MSP Remote Access

It is one tunnel per service, not one per site. Each ngrok endpoint forwards to a single address and port. A client site with a Windows server, an NVR, a managed switch, and a PBX means four separate tunnels to stand up and track, not one connection that reaches the whole network.

The agent has to run on a host inside the network. A headless NVR, a managed switch, or a PBX appliance cannot run it. To reach those devices you have to stand up a separate always-on computer at each site to run the agent and point a tunnel at each device's IP and port.

Concurrency limits bite at fleet scale. ngrok's Free and Hobbyist plans cap you at three concurrent agents; unlimited concurrent agents start on the higher Pay-as-you-go plan. An MSP running agents across dozens of sites is firmly in paid, usage-metered territory. Check ngrok's current pricing on its own site before comparing, because the tiers change.

Endpoints face the public internet. ngrok's model is to publish a service to a public URL and then bolt authentication on top. For a client's camera system or phone switch, that means relying on getting the access controls right on every endpoint you create, rather than keeping the devices unreachable in the first place.

Traffic runs through a third-party cloud. ngrok is a US company and routes session traffic through its own managed global cloud. For EU MSPs under NIS2 or GDPR, adding a US-headquartered processor to the path is a supply-chain and data-transfer question an auditor will ask about.

The Architectural Difference: One Tunnel Per Site

The alternative is to put the tunnel on the network, not on each service. Instead of an agent per host and an endpoint per port, you run one WireGuard tunnel on the router or firewall that connects the client site. The router dials out, the tunnel comes up, and the server can route to any IP on that LAN, including devices that cannot run any software at all. CGNAT and missing static IPs are irrelevant because the connection is outbound from the router.

This is how ProxyLink works. One WireGuard peer per client site covers the entire LAN and every VLAN you declare, a main network, a camera VLAN, and a PBX VLAN behind a single tunnel. Nothing is installed on the individual devices. From the dashboard, each device gets its own link:

• HTTP and HTTPS proxy links for NVR web UIs, PBX admin panels, switch management, Synology DSM, and UniFi controllers, on any port
• Browser RDP and VNC for Windows and desktop machines, no client software to install
• Browser SSH for Linux servers, MikroTik, and Cisco gear, including enable mode
• TCP and UDP links for raw RTSP camera streams and SIP or RTP voice traffic

The devices stay dark the whole time: no public IP, no open ports, no published endpoints. The server reaches them through the tunnel, and they are visible only through authenticated ProxyLink links.

Security and Isolation

ProxyLink runs on open-protocol WireGuard through a single dedicated server in Germany (Hetzner). Peer isolation is enforced at the firewall with per-user and per-team ipsets: no two client sites can reach each other through the server. Two-factor authentication is required on every account, and paid plans add per-session audit logs and optional session recording, which maps onto the access-control evidence a NIS2 audit asks for.

When to Use Which

If you need to expose one app, catch webhooks, or share a dev build, ngrok is the right tool. If you manage networks of devices across multiple client sites, especially sites with NVRs, PBX systems, switches, or connections behind CGNAT, the one-agent-per-service model turns into a lot of moving parts. One tunnel per site, every device reachable, no per-device software, is built for that job.

Try ProxyLink free during early access, no card and no trial countdown. After early access, the MSP plan is 69 euro per month for 300 tunnels and 1,000 links, locked in for life for anyone who signs up now. Setup guides for MikroTik, pfSense, OPNsense, and OpenWRT are in the docs.