Ngrok alternative
Both products expose public endpoints and connect private services through outbound tunnels. ngrok is built around a programmable gateway. rstream uses a broader multi-protocol runtime for public and private connectivity, remote operations, AI tooling, and customer-controlled deployments.
Command line
The syntax differs, but public HTTPS, custom-domain, and TCP workflows remain familiar.
ngrok
rstream
ngrok
›ngrok http 8080rstream
›rstream forward 8080ngrok
›ngrok http 8080 --url https://api.example.comrstream
›rstream forward 8080 --host api.example.comngrok
›ngrok tcp 22rstream
›rstream forward 22 --tcpCustom domains and reserved TCP addresses must be configured before the corresponding command is run.
Comparison
Both products cover the expected tunnel baseline. rstream also supports public and private datagrams, plus browser terminal sessions through WebTTY.
ngrok
rstream
| Capability | ngrok | rstream |
|---|---|---|
| HTTPS and WebSocket | ||
| Custom domains and managed certificates | ||
| Public TCP and TLS | ||
| Private HTTP and TCP connectivity | ||
| Kubernetes Operator | ||
| Global managed service | ||
| Public QUIC and DTLS | Not documented | |
| Private datagram tunnels | Not documented | |
| Browser terminal sessions with WebTTY | Not documented |
Not documented means the capability was not found in the official public product documentation reviewed for this comparison. It does not claim technical impossibility.
Connectivity
Both products keep the private side behind outbound connections. Their private access models are not identical.
A gateway-centered model for published and private endpoints.
Public access
Endpoints route through the ngrok gateway
HTTP, TCP, and TLS endpoints can apply gateway policy before traffic reaches the agent.
Private access
Bindings and ngrokd reach Private Agent Endpoints
Private HTTP and TCP services remain behind outbound agent connections.
One runtime for published endpoints and private dialing.
Public access
Published tunnels route through the rstream edge
HTTP, TCP, TLS, QUIC, and DTLS endpoints use the same tunnel runtime.
Private access
CLI and SDKs dial named private tunnels
Applications open bytestream or datagram connections without publishing the service.
Product differences
ngrok emphasizes gateway policy and traffic inspection. rstream extends the tunnel runtime into remote operations, product-native MCP tools, and customer-controlled deployments.
How traffic is shaped, protected, and observed at the edge.
ngrok
Traffic Policy and Traffic Inspector
Shape and authenticate traffic, inspect and replay HTTP requests, and distribute traffic with endpoint pooling.
rstream
Protocol-aware routing and access controls
Apply protocol-specific routing, JWT authentication, token and IP policies, and inspect connection logs. rstream has no equivalent to Traffic Inspector or endpoint pooling.
What each product can operate beyond forwarding traffic.
ngrok
Remote agent management and an MCP gateway
Stop, restart, or update agents remotely. Traffic Policy can protect and observe an external MCP server.
rstream
WebTTY and product-native MCP operations
Operate remote terminals, tunnels, projects, and live runtime state through the CLI, local MCP, or hosted MCP.
Where the service and control plane can run.
ngrok
Managed cloud and Private Edition
The standard service is multi-tenant. A dedicated Private Edition is available through sales.
rstream
Hosted, dedicated, and on-premises
Use the global managed service, dedicated Enterprise capacity, an optional on-premises control plane, or the free self-hosted Engine CE runtime.
Pricing
rstream Pro is $49 per project with up to 50 simultaneous tunnels and 200 GB. ngrok Pay-as-you-go starts at $20 with included usage credit, then meters active endpoint-hours and other usage dimensions.
For production endpoints active in every hour of the month, rstream Pro costs less from the fourth endpoint in this model. ngrok can cost less when endpoints are used intermittently.
Production endpoints active in every clock hour over 30 days
1 endpoint
$20
ngrok
$49
rstream
4 endpoints
$57.60
ngrok
$49
rstream
10 endpoints
$144
ngrok
$49
rstream
Traffic, domains, requests, policies, users, and log exports are outside this endpoint-hour comparison. Actual invoices depend on usage.
Perspective
ngrok starts from the gateway. Traffic Policy, endpoint pooling, and Traffic Inspector make it a strong choice when the central problem is to shape, route, inspect, and replay HTTP traffic at the edge. Its Kubernetes Operator and enterprise ecosystem are also more mature.
rstream starts from the network path between a user, an application, an AI tool, and a private system. Public HTTP is one path among others. The same runtime carries HTTP, TCP, TLS, QUIC, and DTLS endpoints, together with private bytestream and datagram tunnels. It also connects that runtime to WebTTY, live client and tunnel state, and separate local and hosted MCP surfaces. That wider transport model supports private AI meshes, real-time media pipelines, and remote terminal access without requiring every workload to become a public HTTP endpoint.
ngrok provides a global managed service and a dedicated Private Edition through sales. rstream is developed in Europe and offers global hosted, dedicated, and on-premises paths, while Engine CE provides a free self-hosted core runtime. ngrok remains the clearer fit for sophisticated HTTP gateway policy and inspection. rstream is a stronger fit when the system spans more protocols, private clients, remote operations, AI tooling, or customer-operated infrastructure.
Evaluate rstream on a real service
Sources and methodology
Product claims were checked against official ngrok documentation for the CLI, gateway, private connectivity, Kubernetes, MCP, and pricing, together with the current rstream documentation, guides, and pricing.
The price chart uses 720 hours, ngrok's $20 monthly usage credit, its $0.02 production endpoint-hour rate, and the $49 rstream Pro price. No performance, uptime, security, or migration benchmark is claimed. Engine CE is free and self-hosted, not open source.
Verified August 6, 2026