The Open-Source ngrok Alternative Devs Are Switching To (Zrok)

Highlights

• zrock is an open-source tunneling tool built on OpenZiti that provides end-to-end encrypted sharing for local services.

• The tool supports HTTP, TCP, and UDP protocols, making it compatible with game servers, VOIP, and IoT devices.

• Users can share entire directories as browsable drives using the backend mode drive command.

• Private sharing mode generates a unique token rather than a public URL, requiring the receiver to run zrock access private with that token.

• Self-hosting zrock gives developers full control over their traffic and eliminates the limits found in proprietary free tiers.

• The platform bypasses firewall configurations and NAT issues without requiring port forwarding or a public IP address.

Timeline

1. 00:00 - 01:03

   The Problems with Traditional Tunneling

   Sharing localhosts often involves hitting usage limits or dealing with broken configurations. zrock addresses these friction points by removing the need for public IPs or router adjustments. It utilizes the OpenZiti framework to create secure connections that only expose necessary data.

   • Traditional tools like ngrok often impose strict limits and generate random, public URLs that expose local environments to the internet.
   • zrock functions as an open-source alternative built on a zero-trust mesh to ensure traffic remains off the public internet by default.
   • End-to-end encryption protects local apps, files, and services during the sharing process.
2. 01:04 - 02:05

   Public Sharing and Instant Deployment

   A demonstration using a default Next.js app shows how quickly a local environment becomes live. The process eliminates manual configuration steps typically required for web deployments. While effective for speed, this public method makes the endpoint visible to any internet user.

   • A one-time setup using the zrock enable command prepares the environment for sharing.
   • Running a single command instantly generates a public HTTPS URL for a local application.
   • This method requires no port forwarding or changes to existing firewall settings.
3. 02:06 - 03:06

   Private Sharing and Token-Based Access

   Controlled access is the primary differentiator for developers who need to share work with specific individuals. Instead of opening a hole in the network, the user selectively allows access based on trust. This mechanism ensures that no random traffic can hit the application endpoint.

   • Private sharing replaces public URLs with unique access tokens to prevent bot scanning and unauthorized traffic.
   • Recipients must run a specific access command with the provided token to view the shared content.
   • The backend mode drive feature allows developers to share entire local directories as interactive drives.
4. 03:07 - 04:21

   Comparison with ngrok and Cloudflare Tunnels

   Developers often choose between speed, privacy, and control when selecting a tunnel tool. zrock targets the middle ground by being faster than Cloudflare to set up while offering more privacy than ngrok's basic tier. Its open-source nature allows for self-hosting, which provides a sense of ownership over the tool.

   • ngrok offers a polished experience but limits users within its proprietary free tier.
   • Cloudflare tunnels and Tailscale provide security but often involve more complex setup steps or feel like overkill for quick tasks.
   • zrock includes native UDP support, which is often missing or limited in competing tunneling products.
5. 04:22 - 05:22

   Technical Trade-offs and Final Verdict

   While zrock excels in privacy and protocol support, it is not a perfect substitute for every workflow. Users who rely heavily on inspecting HTTP requests might still prefer ngrok for debugging. However, for those prioritizing security and open-source flexibility, the tool solves the core pain of sharing local work without compromising data safety.

   • zrock lacks the built-in request replay and inspection features found in ngrok.
   • Self-hosting the platform introduces a steeper learning curve for users unfamiliar with zero-trust networking.
   • Certain configurations may result in minor latency compared to direct proprietary connections.