I need some help understanding the security implications of using a service like ngrok to setup an ssh connection.

I've got two computers without public IP addresses (both using mobile internet connections) so I can't ssh directly from computer A to computer B. I've created an account with ngrok to create a tunnel between my two computers. On computer A I reverse SSH into ngrok's service as described on page https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent/, ie

  • I generated an ssh key pair on computer A,
  • uploaded the public key to ngrok, and
  • ran ssh -R 0:localhost:22 [email protected] tcp 22 (I'm not actually using port 22).

My understanding is that this is a one-way connection, ie ngrok's service has no access to computer A, is that correct? (if it can, computer A only permits login via ssh keys, which should make it hard to get access)

On computer B I ssh into the port and server given to me on ngrok's dashboard. Again, my understanding is that ngrok does not have access to computer B, is that correct?

ngrok then (somehow) bridges the connection between the two ssh connections, such that computer B gets to talk directly to computer A. (Is there a security risk?)

Since I have ssh keys set up computer B gets directly connected to computer A without any password request (I explicitly disabled ssh password logins on computer A).

Based on my (very rough) understanding of ssh, I wouldn't think that ngrok (or somebody potentially compromising ngrok) could gain access to either of my computers, is that correct? Is there any way the connection between computers A and B can be compromised (apart from brute-forcing the keys)?

1 Answer 1


ngrok's service has no access to computer A, is that correct?

ngrok's service has access to the forwarded port, i.e. if you do as in the example given by ngrok:

ssh -R 0:localhost:22 [email protected] tcp 22

then ngrok's service will have access to localhost:22 on your machine - but nothing else, assuming there is no exploitable vulnerability in your local ssh client.

  • thanks for your fast answer! so ngrok can access the port, ie ping it / try to log in, but without the ssh-keys that should not (easily) be possible, correct? (and assuming no vulnerability in the ssh client)
    – mpr
    Commented May 28, 2023 at 19:29
  • @mpr: yes, this is correct Commented May 28, 2023 at 19:45
  • thanks for your help!
    – mpr
    Commented May 28, 2023 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .