--- title: Modernize and secure how you access remote devices description: A customer engineer at ngrok walks through replacing multi-hop VPN, PAM, and jump-box RDP/SSH chains with ngrok's Cloud Endpoints, Internal Endpoints, and the... canonical: https://daily.dev/posts/modernize-and-secure-how-you-access-remote-devices-pku6gk0jz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Modernize and secure how you access remote devices | daily.dev og:description: A customer engineer at ngrok walks through replacing multi-hop VPN, PAM, and jump-box RDP/SSH chains with ngrok's Cloud Endpoints, Internal Endpoints, and the... og:url: https://daily.dev/posts/modernize-and-secure-how-you-access-remote-devices-pku6gk0jz og:image: https://api.daily.dev/og/posts/PkU6gk0JZ.png og:image:alt: Modernize and secure how you access remote devices og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Modernize and secure how you access remote devices **[ngrok Blog](https://daily.dev/sources/ngrok)** · 5 min read · 0 upvotes · 0 comments ## Summary A customer engineer at ngrok walks through replacing multi-hop VPN, PAM, and jump-box RDP/SSH chains with ngrok's Cloud Endpoints, Internal Endpoints, and the agent API. The setup uses a single ngrok agent per network to route traffic to internal services, with IP-restriction traffic policies for access control, aiming to cut latency, reduce attack surface, and simplify managing access to remote servers, databases, and applications across multiple sites. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I access remote servers without chaining multiple SSH or RDP sessions through a VPN and jump box? Instead of connecting through a VPN, requesting PAM access, and hopping through a jump box, you can deploy a single ngrok agent on the network that routes traffic internally to services or devices. Combined with ngrok Cloud Endpoints and Internal Endpoints, this creates a single-step secure connection, removing nested SSH/RDP sessions and reducing latency and exposed access points. _daily.dev surfaces practical approaches like this for engineers rethinking remote access architecture._ ### What is the difference between an ngrok internal endpoint and a cloud endpoint? An internal endpoint makes a service reachable only within ngrok's private network, accessible solely by cloud endpoints or other internal services, and cannot be reached directly from the internet - useful for telemetry APIs, databases, and dashboards. A cloud endpoint is a permanent, externally accessible entry point managed via the ngrok API or dashboard, and must be explicitly configured to route traffic to internal endpoints. _engineers weighing endpoint architectures can track tools like ngrok on daily.dev while designing access._ ### How do I restrict SSH or RDP access to only trusted IPs when exposing services through ngrok? You can enable the ip-restrictions traffic policy action on a TCP cloud endpoint that routes to your SSH or RDP service, ensuring only specified trusted IPs can connect. This is set up alongside creating a TCP cloud endpoint pointing to an internal address like tcp://ssh.internal:22, keeping the service off the public internet while still enforcing access control. _those hardening remote access setups can follow tool-specific guidance like this via daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#vpn](https://daily.dev/tags/vpn), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/modernize-and-secure-how-you-access-remote-devices-pku6gk0jz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Modernize and secure how you access remote devices","url":"https://daily.dev/posts/modernize-and-secure-how-you-access-remote-devices-pku6gk0jz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/modernize-and-secure-how-you-access-remote-devices-pku6gk0jz"},"datePublished":"2026-08-23T07:21:10.592Z","dateModified":"2026-08-23T07:27:46.731Z","description":"A customer engineer at ngrok walks through replacing multi-hop VPN, PAM, and jump-box RDP/SSH chains with ngrok's Cloud Endpoints, Internal Endpoints, and the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7ce0186afdc2be54f234e73f2f9fda42?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7ce0186afdc2be54f234e73f2f9fda42?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/modernize-and-secure-how-you-access-remote-devices-pku6gk0jz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,vpn,ssh","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Modernize and secure how you access remote devices"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/modernize-and-secure-how-you-access-remote-devices-pku6gk0jz#faq","mainEntity":[{"@type":"Question","name":"How can I access remote servers without chaining multiple SSH or RDP sessions through a VPN and jump box?","acceptedAnswer":{"@type":"Answer","text":"Instead of connecting through a VPN, requesting PAM access, and hopping through a jump box, you can deploy a single ngrok agent on the network that routes traffic internally to services or devices. Combined with ngrok Cloud Endpoints and Internal Endpoints, this creates a single-step secure connection, removing nested SSH/RDP sessions and reducing latency and exposed access points. daily.dev surfaces practical approaches like this for engineers rethinking remote access architecture."}},{"@type":"Question","name":"What is the difference between an ngrok internal endpoint and a cloud endpoint?","acceptedAnswer":{"@type":"Answer","text":"An internal endpoint makes a service reachable only within ngrok's private network, accessible solely by cloud endpoints or other internal services, and cannot be reached directly from the internet - useful for telemetry APIs, databases, and dashboards. A cloud endpoint is a permanent, externally accessible entry point managed via the ngrok API or dashboard, and must be explicitly configured to route traffic to internal endpoints. engineers weighing endpoint architectures can track tools like ngrok on daily.dev while designing access."}},{"@type":"Question","name":"How do I restrict SSH or RDP access to only trusted IPs when exposing services through ngrok?","acceptedAnswer":{"@type":"Answer","text":"You can enable the ip-restrictions traffic policy action on a TCP cloud endpoint that routes to your SSH or RDP service, ensuring only specified trusted IPs can connect. This is set up alongside creating a TCP cloud endpoint pointing to an internal address like tcp://ssh.internal:22, keeping the service off the public internet while still enforcing access control. those hardening remote access setups can follow tool-specific guidance like this via daily.dev."}}]} ```