Tollan vs ngrok for IoT devices
Both give a private service a public address without touching the router. The difference is what they are built to look after: one laptop during development, or a fleet of devices you have to support for years.
ngrok is a good tool for a different job
ngrok grew up around local development: expose the app on your laptop, share it, take it down again. Tollan grew up around hardware you ship to a site and then have to reach for years. If you are demoing a web app from your machine, reach for a developer tunnel. If you are supporting a gateway in someone else's plant, keep reading.
| What you are deciding | Tollan | A developer tunnel |
|---|---|---|
| Who the identity belongs to | The device. Every agent holds its own certificate. | Usually the account or an auth token on the machine running the client. |
| How long the address lives | A named route you keep, tied to the device. | Built around sessions; a stable name is usually a paid add-on. |
| Fleet management | A console with per-device routes, groups, and revocation. | Designed for a developer's own tunnels, not a device inventory. |
| Revoking one device | Revoke its certificate and it stops connecting. | Rotate the shared token, and update every machine that used it. |
| Microcontrollers | An ESP32 and Arduino library speaks the same protocol as the agent. | Aimed at desktop and server operating systems. |
| Reading your traffic | Passthrough traffic is never decrypted at the relay. We route by TLS SNI without reading a single byte of your payload. | Terminating the connection is the normal mode, since inspection is a feature. |
Tools change. Check ngrok's current documentation for their side before you decide.
Three things that matter once hardware leaves the building
Per-device certificates
Every device holds its own CA-issued certificate. The private key is generated on the device and never leaves it.
One route, not the network
Many devices share one address, demultiplexed by hostname — no port-per-device sprawl.
Revocation you can prove
Revoke a device and its live tunnels drop in seconds — the relay re-checks certificate status continuously.
When a developer tunnel is the better answer
- You are exposing an app on your own laptop for an afternoon.
- You want request inspection and replay while debugging a webhook.
- The address only has to live as long as the session does.
When Tollan fits better
- The thing you are reaching is a device in a network you do not control.
- You need each unit to have its own identity, so one can be revoked alone.
- The same access model has to cover an ESP32, a Raspberry Pi, and a PLC gateway.
- Someone will eventually audit how remote access works.
Choosing between the two
Can I not just run a developer tunnel on the device?
You can, and for a bench prototype it is often the quickest thing. The difference shows up at the second and twentieth device: each one needs its own identity, its own route, and a way to cut it off. Every device holds its own CA-issued certificate. The private key is generated on the device and never leaves it.
What happens when someone leaves the project?
Revoke a device and its live tunnels drop in seconds — the relay re-checks certificate status continuously. You are revoking one device certificate rather than rotating a shared token that other devices also use.
Does the address survive a reboot?
Yes. The hostname belongs to the route you configured, not to the session, so the device redials and answers at the same address.
Can I reach several services behind one device?
One agent can expose anything on the device network — cameras, PLCs, gateways — each service behind its own route.
Do you read the traffic?
Passthrough traffic is never decrypted at the relay. We route by TLS SNI without reading a single byte of your payload. The security model sets out exactly what the relay does and does not see.
Try it with one device
Free tier, no card required. Compare it with what you run today.