Ngrok: Add UDP Tunneling

Created on 5 Sep 2013 · 40Comments · Source: inconshreveable/ngrok

On the features page it is said that _"ngrok supports tunnelling at the TCP and UDP layer so you can expose any type of networked service to the internet"_.
However -proto="udp" is not supported and trying to send UDP messages to a TCP tunnel fails with _"Failed to open private leg 127.0.0.1:6002: dial tcp 127.0.0.1:6002: connection refused"_ while having a server listening for incoming UDP packets.

Source

zepinto

👍11

Most helpful comment

UDP is much needed :(

nvkv on 11 Dec 2018

👍21

All 40 comments

Yeah, this was a feature I intended for launch, and forgot to remove the copy on the website when I never finished fully implementing it.

When I was sketching out an implementation of this, I remember confronting two interesting implementation choices. Can you give me your feedback on what would be valuable to you based on your use case?

Do you need ngrok to handle proxying UDP packets back out to the world? Would your UDP server want to send messages directly back to the client or to try to send them to ngrok and then have ngrokd send them out from its public IP address?
Do you need ngrok to spoof the incoming IP address of the UDP packets? When your server receives the UDP packet, should the source IP address in the IP packet header look like it came from the outside world or from the local ngrok client?
Do you need introspection of the UDP packets? I aim to provide introspection for all protocols that ngrok tunnels, but I've been willing to just implement tunneling to start with and add introspection later to minimize the scope of the work.

inconshreveable on 5 Sep 2013

Yes, in my use case the communication is in both directions. The second option seems to be more robust to firewalls (and thus preferable).
It would be nice to keep the same source IP address from the connecting peer but that would make it more difficult to implement 1 I guess... so will leave this up to you.
I'm not sure I understand what you mean by introspection. Is it analysis of incoming / outgoing messages at localhost:4040? If so, I just need basic analysis like source IP and message size.

Thanks and congratulation for the useful, awesome tool you're developing.

zepinto on 6 Sep 2013

👍1

Awesome, that's very helpful. I'll ping you when I have a prototype of this available.

inconshreveable on 6 Sep 2013

👍2

I would second this, with the answers of:
1) yes
2) no
3) no

Thanks!

esromneb on 11 Sep 2013

@inconshreveable Here's a use case I want really badly -- UDP tunneling so that any two computers in the world, even those behind firewalls, can connect ("peer") over cjdns :-D.

If ngrok/go-tunnel/whatever can make it so one node can see 1 UDP port of another node, cjdns will take care of the rest. IPv6 support may also be needed; I'm not sure.

elimisteve on 25 May 2014

I wrote this issue a long time ago before I understood a lot more about networking protocols and NAT traversal. What you want is a STUN and/or TURN server (together called ICE). ngrok may eventually support this. This is how most all of the public VoIP world works.

inconshreveable on 25 May 2014

One use case is when you need use 'Mosh' to connect to a host over nat/firewall. Having udp tunnel would be a great feature.

code-guru on 5 Jan 2015

@code-guru what about STUN or TURN servers make them unsuitable for that purpose?

inconshreveable on 12 Jan 2015

@inconshreveable TURN/STUN is the defacto technique for NAT traversal.

The main purpose of ngrok is NAT traversal as well. However ngrok offer
more for http tunnel(subdomain and ssl for http tunnels).

NAT traversal for UDP packets is much easier than TCP, it can be easily
achieved using 'hole punching' or 'UPnP IGD'. However hole punching
technique and/or UPnP may not allowed on corprate routers such as mobile
internet where tel client are connecting to Internet over a NAT.
On Jan 12, 2015 4:42 AM, "Alan Shreve" [email protected] wrote:

@code-guru https://github.com/code-guru what about STUN or TURN servers
make them unsuitable for that purpose?

—
Reply to this email directly or view it on GitHub
https://github.com/inconshreveable/ngrok/issues/26#issuecomment-69527376
.

code-guru on 12 Jan 2015

@code-guru you're saying there are a number of corporate networks where even TURN doesn't work? because network policy blocks UDP packets? it appears there's a specification for using TURN with TCP as the transport. i'm not very familiar with why existing solutions are poor

inconshreveable on 12 Jan 2015

@inconshreveable TURN(tunneling via a relay server) always works, what I
said was using NAT traversal techniques which two hosts connect directly
without using a proxy/relay.

What I said was corprate nat is restricted to a sense that users are not
allowed to change the router behaviour based on their need, since the nat
network is shared with a lot of users and it should be secure.

UPnP IGD is a protocol to add port forwarding config to a router via a
webservice, it is obvious that public network dont want user to modify
routers config, the same goes to hole punching which is more of a trick.
On Jan 12, 2015 10:07 AM, "Alan Shreve" [email protected] wrote:

@code-guru https://github.com/code-guru you're saying there are a
number of corporate networks where even TURN doesn't work? because network
policy blocks UDP packets? it appears there's a specification for using
TURN with TCP as the transport. i'm not very familiar with why existing
solutions are poor

—
Reply to this email directly or view it on GitHub
https://github.com/inconshreveable/ngrok/issues/26#issuecomment-69543098
.

code-guru on 12 Jan 2015

Is this planned for any future release? I'd quite like it :)

Yes
2/3 Not so important

JD-Billingham on 23 Jun 2015

@ool0n this won't be supported for a long time . . . if ever

inconshreveable on 24 Jun 2015

Could you clarify what the alternative is?

I see the phrases "always works", "much easier", and "de facto technique" - but I'm not clear how to actually get this running in a manner similar to ngrok.

From my limited understanding, STUN/TURN requires implementation on both ends - whereas ngrok is a one-sided setup resulting in a new point of entry, for that machine only.

So how does one go about something like ngrok tcp, for UDP?

OJFord on 20 Aug 2015

I am also second for the udp support and my user case here is also mosh.

Wakeupbuddy on 12 Feb 2016

👍9

closing, this is never happening in 1.X. ngrok 2.x may eventually support ICE/STUN/TURN in 2.x or something else. more investigation is needed as my knowledge isn't deep enough here

inconshreveable on 12 Mar 2016

😕3

You should check out PJSIP: http://www.pjsip.org/ TURN+STUN=ICE is a specialty, DRY.

loslosbaby on 11 Apr 2016

Can anyone provide any alternatives? If ngrok isn't going to support it, what are my other options?

mhsjlw on 12 Dec 2016

didn't know any alternatives. I still hope UDP feature will be on ngrok's roadmap.

Wakeupbuddy on 12 Dec 2016

@mhsjlw check out this https://github.com/astroza/udptunnel

code-guru on 14 Dec 2016

Why not try https://github.com/fatedier/frp ,it's a reverse proxy that supports UDP. And I think it's easier to use

LakeYang on 13 Jan 2017

@LakeYang

How can I configure frp similar to NGROK, so that it generates a public address for you to use? For example, with NGROK you can do this:
ngrok.exe tcp 8080

NGROK then generates a public URL for you to use, e.g.:
http://0.tcp.ngrok.io:41184

So you can simply type in the above URL from an external host, and it will connect to port 8080 on your localhost. Easy.

I'm looking for something similar here with FRP. I don't have a public IP for my server. I would have to ask our company's network team to give me one (they will most definitely not give me one for testing). The server is behind a router and firewall and port forwarding can't be setup.

NGROK works, but it only tunnels TCP ports and not UDP. How can I get this to work on FRP?

chaoscreater on 14 Jun 2017

@chaoscreater
No, if you don't have a server with a public IP address, you can't generates a public address for you to use. You may consider buying a server and setup FRP on it.

LakeYang on 14 Jun 2017

Why not use C/C++ to write ngrok?