Share a Local TCP Service Temporarily with ngrok

The problem: your local service is stuck behind your laptop

You need a teammate to test a local API, or you want to connect to a database running on your laptop from a different network. Setting up a VPN or opening router ports takes time and introduces permanent network changes. You need something temporary, reproducible, and quick to tear down.

Ngrok's TCP tunneling forwards a local port to a public address without changing your firewall. It works on Windows, macOS, and Linux, and the basic feature is available on the free plan.

What ngrok TCP mode actually does

In TCP mode, ngrok forwards raw TCP streams unchanged. That means the original protocol—SSH, PostgreSQL, or a custom game server—passes through intact. Ngrok does not terminate TLS, so if your service expects encrypted traffic, the client must handle encryption end to end.

A tunnel is a temporary mapping between a public ngrok address and a local port. An edge is the public entry point ngrok provides.

Worked example: expose a local PostgreSQL port

Run this in a terminal on the machine hosting the database:

ngrok tcp 5432

Where to run: the local machine where PostgreSQL listens on port 5432. Permissions: none beyond running ngrok; ensure PostgreSQL itself accepts connections. Placeholder: replace 5432 with your service's local port.

Ngrok prints a public forwarding address such as tcp://0.tcp.ngrok.io:12345. The exact address and port are assigned by ngrok and change on each free-tier session. From another device, attempt a connection:

psql -h 0.tcp.ngrok.io -p 12345 -U your_user -d your_db

Expected check: the remote client reaches PostgreSQL and prompts for a password or completes authentication. Risk: the database is now reachable from the public internet, so verify that PostgreSQL authentication is required and strong before exposing it.

Verify the tunnel and inspect traffic

Open the local ngrok inspector at http://127.0.0.1:4040 to confirm the tunnel status and view connection attempts. The free tier allows one concurrent tunnel; starting a second TCP tunnel typically disconnects the first. Check ngrok's current pricing page, because free-tier limits can change.

Trade-offs and limits

• One concurrent tunnel on free: you cannot run multiple public TCP tunnels simultaneously without a paid plan.
• Random addresses: free tunnels use ngrok-assigned hostnames and ports, so the address is not stable across restarts.
• No TLS termination: ngrok passes bytes through; your application must manage encryption and certificates.
• Latency: traffic routes through ngrok edge nodes, which can add noticeable delay for latency-sensitive workloads.
• Public exposure: any service you tunnel is reachable from the internet. Rely on the service's own authentication, not network obscurity.

Check the result before you rely on it

After starting the tunnel, confirm three things: the ngrok terminal shows an active forwarding address, the inspector at http://127.0.0.1:4040 lists the tunnel, and a remote client can complete authentication against the exposed service. If any step fails, stop ngrok with Ctrl+C and check that the local service is listening on the expected port.

Closing

Use ngrok TCP mode for short-lived debugging, demos, or temporary remote access—not as a permanent replacement for a VPN or private network. For stable addresses, custom domains, or multiple simultaneous tunnels, evaluate a paid plan. Always confirm the exposed service requires authentication before you share the public address.