Ask HN: Integrating with External Systems Without Ngrok: What Are My Options?
3 comments
I feel like this isn't really a software question about ngrok vs Docker vs any other proxy / network app, but a question of your business's underlying network architecture decisions made by the business. Presumably some things are on the LAN and not online on purpose...? Or are these just a bunch of legacy systems that just haven't made it online yet?
In other words, is IT just concerned about you opening up your LAN to external incoming traffic, or is there some underlying data security concern too?
If it's just that IT doesn't want you to be running servers, can you make the webhooks point the other way instead (outgoing from your LAN to the public internet, not the other way around). If you can't do that, you can still write messages to an external queue and have your LAN poll it every few seconds, maybe? Or if your IT allows this (doubtful but maybe worth asking) you can maybe establish a long-lived tunnel via SSH or a Cloudflare Tunnel, etc., that establishes a single connection to a single outside server (which then receives all the public traffic). That is somewhat safer than opening up a port to public traffic directly.
But when you say "highly secure", that makes me wonder if some of this data was never meant to leave the LAN (like are there compliance & privacy issues to consider?). You might want to double-check that with them before making any sort of public-interfacing integration, because you'd be risking a lot more than a complaint from IT if you inadvertently exposed all this private stuff to the internet.
Otherwise, for webhook testing, can't you just point the payload at some local proxy or recipient? Postman's is pretty easy to use: https://learning.postman.com/docs/sending-requests/capturing... and there are others. You don't actually have to send the webhook outside the LAN just for development.
In other words, is IT just concerned about you opening up your LAN to external incoming traffic, or is there some underlying data security concern too?
If it's just that IT doesn't want you to be running servers, can you make the webhooks point the other way instead (outgoing from your LAN to the public internet, not the other way around). If you can't do that, you can still write messages to an external queue and have your LAN poll it every few seconds, maybe? Or if your IT allows this (doubtful but maybe worth asking) you can maybe establish a long-lived tunnel via SSH or a Cloudflare Tunnel, etc., that establishes a single connection to a single outside server (which then receives all the public traffic). That is somewhat safer than opening up a port to public traffic directly.
But when you say "highly secure", that makes me wonder if some of this data was never meant to leave the LAN (like are there compliance & privacy issues to consider?). You might want to double-check that with them before making any sort of public-interfacing integration, because you'd be risking a lot more than a complaint from IT if you inadvertently exposed all this private stuff to the internet.
Otherwise, for webhook testing, can't you just point the payload at some local proxy or recipient? Postman's is pretty easy to use: https://learning.postman.com/docs/sending-requests/capturing... and there are others. You don't actually have to send the webhook outside the LAN just for development.
Thanks for the detailed response—lots of good points here.
IT's main concern is blocking any external traffic from hitting local machines, even if tunneled or encrypted. Outbound traffic is generally fine, but many external platforms require direct URLs for real-time webhooks, which makes solutions like ngrok hard to replace.
Polling an external queue from the LAN is an interesting idea—I’ll check if IT might allow that. Long-lived tunnels like SSH or Cloudflare are probably a no-go given their restrictions.
So far, no comments regarding compliance or privacy.
Thanks again for the input!
IT's main concern is blocking any external traffic from hitting local machines, even if tunneled or encrypted. Outbound traffic is generally fine, but many external platforms require direct URLs for real-time webhooks, which makes solutions like ngrok hard to replace.
Polling an external queue from the LAN is an interesting idea—I’ll check if IT might allow that. Long-lived tunnels like SSH or Cloudflare are probably a no-go given their restrictions.
So far, no comments regarding compliance or privacy.
Thanks again for the input!
I don't think anything is more secure as such than ngrok. You can use TLS tunnels to end-to-end encrypt the requests. But I do not think your organization's IT will allow that either. You can still check out https://pinggy.io for that.
My suggestion is to host it in cloud and do your development there.
My suggestion is to host it in cloud and do your development there.
Interesting, but sounds very similar to the ngroks ssh-option?
Would the internal endpoints solve this for you? https://ngrok.com/docs/network-edge/internal-endpoints/
Happy to help with a solution. Sam at ngrok.com is my email
Happy to help with a solution. Sam at ngrok.com is my email
Cool, dropped an email.
I'm working on integration projects that require communication between our internal systems and external platforms. I’ve been using ngrok to expose local servers, but my organization’s IT security team has denied its usage with the reason:
> "We will not allow any kind of services that will allow external traffic to hit local machines."
Without ngrok, the integration process has become time-consuming and error-prone due to the guesswork needed to understand external systems.
Current Development Cycle:
Currently, I point the webhooks to a site like webhook.site and manually copy the payload from there. While this works, it's extremely inefficient and increases the potential for errors during integration.
Potential Workaround:
I'm considering using a Docker container running in the cloud that allows me to live change the code as needed. This setup would operate behind our IT security measures, potentially bypassing the restrictions on direct external traffic to local machines.
What I'm Looking For:
- Alternative Tools: Secure alternatives to ngrok for exposing local or cloud-based services.
- Cloud-Based Solutions: Insights on using Docker containers in the cloud for integrations, including best practices for live code updates.
- Best Practices: Strategies for integrating with external systems in highly secure environments.
- Community Insights: How others have navigated similar restrictions and any successful solutions they've implemented.
Any recommendations, experiences, or advice on this approach would be greatly appreciated!
Thanks!