TCP Variables

Action Result Variables

The following variables are available under the actions.ngrok namespace:

`Log`

Name	Type	Description
`actions.ngrok.log.metadata`	map[string]string	The key value map of the metadata values.

`Restrict IPs`

Name	Type	Description
`actions.ngrok.restrict_ips.action`	string	The resulting action for this action execution. Supported values are either `allow` or `deny`.
`actions.ngrok.restrict_ips.matched_cidr`	string	The CIDR that matched for the incoming client ip. This may be empty.
`actions.ngrok.restrict_ips.error.code`	string	Code for an error that occurred during the invocation of an action.
`actions.ngrok.restrict_ips.error.message`	string	Message for an error that occurred during the invocation of an action.

Connection Variables

The following variables are available under the conn namespace:

Name	Type	Description
`conn.client_ip`	string	Source IP of the connection to the ngrok endpoint.
`conn.client_port`	int32	Source port of the connection to the ngrok endpoint.
`conn.server_ip`	string	The IP that this connection was established on.
`conn.server_port`	int32	The port that this connection was established on.
`conn.ts.start`	timestamp	Timestamp when the connection to ngrok was started.

`conn.client_ip`

Source IP of the connection to the ngrok endpoint.

YAML
JSON

# snippet
---
expressions:
  - "conn.client_ip in ['::1', '127.0.0.1']"

// snippet
{
  "expressions": [
    "conn.client_ip in ['::1', '127.0.0.1']"
  ]
}

`conn.client_port`

Source port of the connection to the ngrok endpoint.

YAML
JSON

# snippet
---
expressions:
  - "conn.client_port == 80"

// snippet
{
  "expressions": [
    "conn.client_port == 80"
  ]
}

`conn.server_ip`

The IP that this connection was established on.

YAML
JSON

# snippet
---
expressions:
  - "conn.server_ip == '192.168.1.1'"

// snippet
{
  "expressions": [
    "conn.server_ip == '192.168.1.1'"
  ]
}

`conn.server_port`

The port that this connection was established on.

YAML
JSON

# snippet
---
expressions:
  - "conn.server_port == 80"

// snippet
{
  "expressions": [
    "conn.server_port == 80"
  ]
}

`conn.ts.start`

Timestamp when the connection to ngrok was started.

YAML
JSON

# snippet
---
expressions:
  - "conn.ts.start > timestamp('2023-12-31T00:00:00Z')"

// snippet
{
  "expressions": [
    "conn.ts.start > timestamp('2023-12-31T00:00:00Z')"
  ]
}

Connection Geo Variables

The following variables are available under the conn.geo namespace:

Name	Type	Description
`conn.geo.city`	string	The name of the city, in EN, where the `conn.client_ip` is likely to originate.
`conn.geo.country`	string	The name of the country, in EN, where the `conn.client_ip` is likely to originate.
`conn.geo.country_code`	string	The two-letter ISO country code where the `conn.client_ip` is likely to originate.
`conn.geo.latitude`	string	The approximate latitude where the `conn.client_ip` is likely to originate.
`conn.geo.longitude`	string	The approximate longitude where the `conn.client_ip` is likely to originate.
`conn.geo.radius`	string	The radius in kilometers around the latitude and longitude where the `conn.client_ip` is likely to originate.
`conn.geo.subdivision`	string	The name of the subdivision, in EN, where the `conn.client_ip` is likely to originate.

`conn.geo.city`

The name of the city, in EN, where the conn.client_ip is likely to originate.

YAML
JSON

# snippet
---
expressions:
  - "conn.geo.city == 'Strongsville'"

// snippet
{
  "expressions": [
    "conn.geo.city == 'Strongsville'"
  ]
}

`conn.geo.country`

The name of the country, in EN, where the conn.client_ip is likely to originate.

YAML
JSON

# snippet
---
expressions:
  - "conn.geo.country == 'United States'"

// snippet
{
  "expressions": [
    "conn.geo.country == 'United States'"
  ]
}

`conn.geo.country_code`

The two-letter ISO country code where the conn.client_ip is likely to originate.

YAML
JSON

# snippet
---
expressions:
  - "conn.geo.country_code != 'US'"

// snippet
{
  "expressions": [
    "conn.geo.country_code != 'US'"
  ]
}

`conn.geo.latitude`

The approximate latitude where the conn.client_ip is likely to originate.

YAML
JSON

# snippet
---
expressions:
  - "double(conn.geo.latitude) >= 45.0"

// snippet
{
  "expressions": [
    "double(conn.geo.latitude) >= 45.0"
  ]
}

`conn.geo.longitude`

The approximate longitude where the conn.client_ip is likely to originate.

YAML
JSON

# snippet
---
expressions:
  - "double(conn.geo.longitude) <= -93.0"

// snippet
{
  "expressions": [
    "double(conn.geo.longitude) <= -93.0"
  ]
}

`conn.geo.radius`

The radius in kilometers around the latitude and longitude where the conn.client_ip is likely to originate.

YAML
JSON

# snippet
---
expressions:
  - "conn.geo.radius <= '5'"

// snippet
{
  "expressions": [
    "conn.geo.radius <= '5'"
  ]
}

`conn.geo.subdivision`

The name of the subdivision, in EN, where the conn.client_ip is likely to originate.

YAML
JSON

# snippet
---
expressions:
  - "conn.geo.subdivision == 'California'"

// snippet
{
  "expressions": [
    "conn.geo.subdivision == 'California'"
  ]
}

Endpoint Variables

The following variables are available under the endpoint namespace:

Name	Type	Description
`endpoint.addr`	string	The address for this endpoint.
`endpoint.host`	string	The hostname for this endpoint.
`endpoint.id`	string	The endpoint that serviced this connection.
`endpoint.port`	int32	The port for this endpoint.
`endpoint.protocol`	string	The protocol for this endpoint. Current supported values are `http`, `https`, `tcp`, and `tls`.
`endpoint.url`	string	The url for this endpoint.

`endpoint.addr`

The address for this endpoint.

YAML
JSON

# snippet
---
expressions:
  - "endpoint.addr == 'my-subdomain.ngrok.app:443'"

// snippet
{
  "expressions": [
    "endpoint.addr == 'my-subdomain.ngrok.app:443'"
  ]
}

`endpoint.host`

The hostname for this endpoint.

YAML
JSON

# snippet
---
expressions:
  - "endpoint.host == 'my-subdomain.ngrok.app'"

// snippet
{
  "expressions": [
    "endpoint.host == 'my-subdomain.ngrok.app'"
  ]
}

`endpoint.id`

The id for this endpoint.

YAML
JSON

# snippet
---
expressions:
  - "endpoint.id == 'ep_2iL8LRbQilSCKYjaslRoqBwJcfT'"

// snippet
{
  "expressions": [
    "endpoint.id == 'ep_2iL8LRbQilSCKYjaslRoqBwJcfT'"
  ]
}

`endpoint.port`

The port for this endpoint.

YAML
JSON

# snippet
---
expressions:
  - "endpoint.port == 443"

// snippet
{
  "expressions": [
    "endpoint.port == 443"
  ]
}

`endpoint.protocol`

The protocol for this endpoint. Current supported values are http, https, tcp, and tls.

YAML
JSON

# snippet
---
expressions:
  - "endpoint.protocol == 'https'"

// snippet
{
  "expressions": [
    "endpoint.protocol == 'https'"
  ]
}

`endpoint.url`

The url for this endpoint.

YAML
JSON

# snippet
---
expressions:
  - "endpoint.url == 'https://my-subdomain.ngrok.app'"

// snippet
{
  "expressions": [
    "endpoint.url == 'https://my-subdomain.ngrok.app'"
  ]
}

Time variables

The following variables are available under the time namespace:

Name	Type	Description
`time.now`	string	The current UTC time in RFC3339 format.

`time.now`

The current UTC time in RFC3339 format.

YAML
JSON

# snippet
---
expressions:
  - "conn.ts.end < timestamp(time.now)"

// snippet
{
  "expressions": [
    "conn.ts.end < timestamp(time.now)"
  ]
}

TCP Variables

Action Result Variables​

Log​

Restrict IPs​

Connection Variables​

conn.client_ip​

conn.client_port​

conn.server_ip​

conn.server_port​

conn.ts.start​

Connection Geo Variables​

conn.geo.city​

conn.geo.country​

conn.geo.country_code​

conn.geo.latitude​

conn.geo.longitude​

conn.geo.radius​

conn.geo.subdivision​

Endpoint Variables​

endpoint.addr​

endpoint.host​

endpoint.id​

endpoint.port​

endpoint.protocol​

endpoint.url​

Time variables​

time.now​