--- title: How to write policies with patterns that scale | daily.dev description: A guide to writing scalable ngrok Traffic Policy configurations, covering three core patterns: understanding how rules chain and terminate within request... canonical: https://daily.dev/posts/how-to-write-policies-with-patterns-that-scale-rqxzsr9bc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to write policies with patterns that scale | daily.dev og:description: A guide to writing scalable ngrok Traffic Policy configurations, covering three core patterns: understanding how rules chain and terminate within request... og:url: https://daily.dev/posts/how-to-write-policies-with-patterns-that-scale-rqxzsr9bc og:image: https://api.daily.dev/og/posts/rQxzSR9BC.png og:image:alt: How to write policies with patterns that scale og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to write policies with patterns that scale **[ngrok Blog](https://daily.dev/sources/ngrok)** · 7 min read · 0 upvotes · 0 comments ## Summary A guide to writing scalable ngrok Traffic Policy configurations, covering three core patterns: understanding how rules chain and terminate within request lifecycle phases, grouping related actions and expressions for readability, and adding failovers plus catch-all rules for robustness. Also includes bonus tips like using on_tcp_connect for blocking bots, mocking API keys with header expressions, and using set-vars for readability. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What actions in ngrok Traffic Policy short-circuit the execution of other rules? Four actions terminate execution of remaining rules in a phase: deny, restrict-ips, forward-internal, and custom-response. Placing these in the wrong order, or without an expression limiting when they run, will immediately stop other rules from executing, so they should be ordered carefully or guarded with conditional expressions. _daily.dev surfaces gateway configuration patterns for teams debugging unexpected traffic policy behavior._ ### How do I set up a failover for the forward-internal action in ngrok Traffic Policy? Use the on_error: continue configuration on forward-internal to define a fallback action if forwarding fails. Common failover chains include falling back to custom-response for a friendly error page, to a log action for observability, or to a second forward-internal targeting a backup internal agent. _Engineers building resilient ingress routing can track gateway configuration patterns on daily.dev._ ### How can I block unwanted bot traffic as early as possible with ngrok? Apply the deny action during the on_tcp_connect phase rather than on_http_request, since blocking at that phase rejects the request before the TCP handshake even completes. This is recommended specifically for mass blocking scenarios like AI bots or IP blocklists. _daily.dev helps developers stay current on gateway and ingress traffic-filtering techniques._ --- Tags: [#devtools](https://daily.dev/tags/devtools), [#authentication](https://daily.dev/tags/authentication), [#api-gateway](https://daily.dev/tags/api-gateway) [View this post on daily.dev](https://daily.dev/posts/how-to-write-policies-with-patterns-that-scale-rqxzsr9bc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to write policies with patterns that scale","url":"https://daily.dev/posts/how-to-write-policies-with-patterns-that-scale-rqxzsr9bc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-write-policies-with-patterns-that-scale-rqxzsr9bc"},"datePublished":"2026-08-23T07:21:15.625Z","dateModified":"2026-08-23T07:29:50.506Z","description":"A guide to writing scalable ngrok Traffic Policy configurations, covering three core patterns: understanding how rules chain and terminate within request...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0437904a21162da5f13df7153430489d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0437904a21162da5f13df7153430489d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-write-policies-with-patterns-that-scale-rqxzsr9bc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools,authentication,api-gateway","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"How to write policies with patterns that scale"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-write-policies-with-patterns-that-scale-rqxzsr9bc#faq","mainEntity":[{"@type":"Question","name":"What actions in ngrok Traffic Policy short-circuit the execution of other rules?","acceptedAnswer":{"@type":"Answer","text":"Four actions terminate execution of remaining rules in a phase: deny, restrict-ips, forward-internal, and custom-response. Placing these in the wrong order, or without an expression limiting when they run, will immediately stop other rules from executing, so they should be ordered carefully or guarded with conditional expressions. daily.dev surfaces gateway configuration patterns for teams debugging unexpected traffic policy behavior."}},{"@type":"Question","name":"How do I set up a failover for the forward-internal action in ngrok Traffic Policy?","acceptedAnswer":{"@type":"Answer","text":"Use the on_error: continue configuration on forward-internal to define a fallback action if forwarding fails. Common failover chains include falling back to custom-response for a friendly error page, to a log action for observability, or to a second forward-internal targeting a backup internal agent. Engineers building resilient ingress routing can track gateway configuration patterns on daily.dev."}},{"@type":"Question","name":"How can I block unwanted bot traffic as early as possible with ngrok?","acceptedAnswer":{"@type":"Answer","text":"Apply the deny action during the on_tcp_connect phase rather than on_http_request, since blocking at that phase rejects the request before the TCP handshake even completes. This is recommended specifically for mass blocking scenarios like AI bots or IP blocklists. daily.dev helps developers stay current on gateway and ingress traffic-filtering techniques."}}]} ```