ngrok vs. Playit.gg: Bypassing CGNAT for Gaming and Real-Time UDP Traffic in 2026

If you’ve ever tried to host a multiplayer game server, test real-time netcode, or expose a local IoT device to the public internet, you’ve hit the wall of port forwarding. For years, developers reached for tunneling tools to get around router configuration. ngrok has long been the household name in that space.

But in 2026, that name recognition doesn’t automatically make it the right tool. For raw, real-time UDP traffic — the backbone of gaming, VoIP, and IoT telemetry — ngrok still has a structural gap, and Playit.gg has built its entire product around filling it.

This guide covers the architectural differences between the two, why UDP support is the real dividing line, how Carrier-Grade NAT (CGNAT) forces this whole conversation in the first place, and what it actually costs to go fully self-hosted with frp or inlets instead.

1. The UDP Problem: Why ngrok Struggles with Real-Time Traffic

ngrok’s HTTP-first architecture

ngrok was built to solve a specific problem: exposing local web servers so developers could test webhooks, APIs, and web apps. It’s still excellent at that — request inspection, replay, and webhook verification remain some of the best tooling in the category.

What it has never done is support UDP. As of 2026, ngrok’s tunnel types are still limited to HTTP, HTTPS, TCP, and TLS — there is no UDP endpoint type on any plan, free or paid. This isn’t a rumor or an outdated complaint; it’s confirmed directly in ngrok’s own documentation, and developers have been asking about it in ngrok’s GitHub issues since at least 2013 without it landing.

Why games and IoT actually need UDP

In real-time multiplayer gaming, VoIP, and high-frequency IoT telemetry, perfect delivery matters less than speed.

• Multiplayer gaming: Titles like Minecraft Bedrock, Valheim, Rust, and Counter-Strike 2 rely on UDP. If a packet with a player’s position drops, the game doesn’t want it resent a moment later — it wants the next packet with the player’s current position. UDP just keeps firing without waiting for acknowledgment.
• VoIP and video: Voice servers and WebRTC-based tools can’t tolerate the latency spikes that come from TCP retransmission.
• IoT sensors: Devices sending rapid telemetry over CoAP or custom UDP protocols need low-overhead transmission.

Because ngrok doesn’t support UDP on any tier, these use cases are simply off the table for it — you either bolt on an unstable TCP-to-UDP hack or use a different tool entirely.

2. Playit.gg: Built for Raw Sockets and Gaming

Where ngrok stops, Playit.gg picks up. It was built specifically to handle raw TCP and UDP traffic with minimal setup — no router configuration required.

How it differs architecturally

Playit.gg works closer to Layer 4 than ngrok’s largely Layer 7 (HTTP) model. You run the Playit agent locally; it opens an outbound connection to Playit’s network of relay datacenters (19 datacenters as of mid-2026, spanning North America, Europe, Asia, Oceania, and South America), and that relay forwards traffic back down to your machine.

On the free tier, Playit assigns your tunnel a persistent address (something like your-game.at.ply.gg:xxxxx) that doesn’t rotate every time you restart the client, unlike ngrok’s free-tier random URLs. It’s worth being precise here: free tunnels route over Playit’s “Global Anycast” network, meaning the actual datacenter your players connect through can vary and isn’t something you control — that requires Playit Premium’s regional tunnels, which pin routing to a specific datacenter. So “static” describes the address staying the same, not a fixed single IP with fixed routing underneath.

What’s confirmed directly from Playit.gg: - Premium costs $3/month (or roughly $30/year), confirmed on Playit’s own pricing page. - Premium adds regional tunnels, several .playit.plus/custom domains (sources describe anywhere from 3 to 6 depending on the exact plan tier), external domain support, and additional ports/firewalls/agents. - HTTPS tunnels specifically require Playit Premium — this isn’t available on the free plan, which is worth knowing if you assumed Playit was a general-purpose web tunnel too. - The client agent is open source (playit-cloud/playit-agent on GitHub), which is a legitimate transparency advantage over ngrok’s closed-source client.

What’s widely reported but not something Playit’s own marketing page states as a hard number: independent guides published throughout 2026 (Pinggy, Localtonet, and others) consistently describe the free tier as including 4 TCP tunnels and 4 UDP tunnels, though at least one source describes the free allotment as 3 tunnels. Given the inconsistency between third-party sources, treat “4 TCP + 4 UDP” as the commonly cited figure rather than a number verified on Playit’s own site, and check your account dashboard for your actual current limit.

3. Demystifying Carrier-Grade NAT (CGNAT)

To understand why any of this matters, you need to understand CGNAT.

Historically, hosting a Minecraft server meant logging into your router, opening port 25565, and mapping your home’s public IP directly to your machine. That model depends on your home actually having a public IPv4 address.

The problem: IPv4 only has about 4.3 billion possible addresses, and the regional internet registries exhausted their free pools years ago (ARIN, North America’s registry, ran out in September 2015; RIPE NCC, Europe’s, in November 2019). Since IPv6 adoption is still incomplete — global IPv6 capability sits in roughly the mid-40% range as of 2026, and is very unevenly distributed by country — most ISPs still lean on IPv4, and CGNAT is how they stretch a shrinking supply of addresses across a growing customer base.

Under CGNAT, your ISP assigns your router an address from a reserved private range (RFC 6598’s 100.64.0.0/10 block, specifically set aside for this purpose in 2012) instead of a real public IP, and does the actual internet-facing NAT translation on its own equipment. You end up with two layers of translation — your home router’s NAT, plus the ISP’s CGNAT — a setup sometimes called NAT444. The result: port forwarding on your home router does nothing, because you don’t own the public IP it would need to map to.

How Playit.gg (and ngrok, and most tunnels) get around it

Because the Playit or ngrok client initiates an outbound connection from your machine to the provider’s cloud, your ISP’s NAT allows it through — outbound connections are rarely blocked, even under CGNAT. Once that tunnel exists, inbound traffic from your players gets routed back down it. This is why you can host a server from a 5G hotspot or a CGNAT’d home connection without touching a router setting — the mechanism works the same way whether you’re using ngrok, Playit.gg, frp, or inlets; the difference between those tools is what kind of traffic they’ll carry through that tunnel, not whether they can get through CGNAT at all.

4. Best Use Cases: Who Wins Where?

Use ngrok when: - You’re testing local web apps, APIs, or webhook integrations (Stripe, Twilio, etc.) - You want request inspection — pausing, replaying, and analyzing HTTP traffic is still one of ngrok’s strongest features - You need enterprise auth controls — but note this is an Enterprise-tier feature ($39/month as of early 2026 per third-party pricing trackers), not something available on Free or Hobbyist

Use Playit.gg when: - You’re hosting a Minecraft, Valheim, Terraria, or similar game server for friends without renting a VPS - You’re an indie developer testing multiplayer netcode with external testers - You’re tinkering with UDP-based protocols on IoT hardware like a Raspberry Pi

5. Feature Comparison (Verified Against Current Sources)

Feature	ngrok	Playit.gg
Primary focus	HTTP/HTTPS, with TCP/TLS tunnels	TCP/UDP for gaming and raw sockets
UDP support	None, on any tier	Yes, native
Free tier limits	1 active endpoint, up to 3 tunnels per agent, 1 GB/month data out, 20,000 HTTP requests/month, 1 static dev domain	Commonly reported as 4 TCP + 4 UDP tunnels (figure varies by source; not itemized on Playit’s own pricing page)
Cheapest paid tier	Hobbyist: $10/month ($8/month billed annually)	Premium: $3/month (~$30/year)
HTTPS tunnels	Free tier: yes, with an interstitial warning page for browser traffic	Requires Premium
CGNAT bypass	Yes	Yes
Request inspection/replay	Yes — a genuine strength	No — Playit is pure routing, not a debugging tool
Client source	Closed source	Open source

6. Expanding the Scope: Who Owns the Network Boundary?

Both ngrok and Playit.gg route your traffic through a company’s servers. That’s convenient — no VPS to manage, no DDoS protection to configure — but it also means you’re bound by that company’s pricing, terms, and datacenter footprint. Tools like frp and inlets move that boundary onto infrastructure you control, typically a cheap cloud VPS running $4–6/month from a provider like DigitalOcean, Hetzner, or Linode.

frp (Fast Reverse Proxy)

frp is a genuinely free, open-source reverse proxy with a large following on GitHub. You run frps (the server component) on your VPS and frpc (the client) on your home machine, and it supports TCP, UDP, HTTP, and HTTPS.

One correction worth making here: frp’s peer-to-peer feature (called xtcp) does not fully bypass your relay server the way it’s sometimes described. Per frp’s own documentation, frps is still required to coordinate the connection — “P2P” in this context refers only to the actual data transmission attempting to flow directly between clients after the server helps establish it, using STUN-based NAT hole-punching. It also doesn’t work with every type of NAT device; frp’s own docs recommend falling back to its stcp mode if xtcp fails. So frp gives you a real option for lower-latency, more direct connections — just not a way to eliminate your VPS from the picture entirely.

inlets

inlets, created by Alex Ellis, was built to give teams a self-hosted, Kubernetes-friendly tunnel — automating exit-node creation via inletsctl or the inlets-operator, rather than requiring manual .ini/.toml configuration. It operates at Layer 4, so beyond HTTP it can tunnel databases (PostgreSQL, MySQL), SSH, RDP, or a Kubernetes API server.

Here’s an important correction to make clear: inlets Pro is not free software. Unlike frp, it requires a paid license on top of whatever you pay for the VPS itself. Current pricing directly from inlets.dev is a Personal plan at $25/month (5 tunnels), Commercial at $50/month (2 tunnels, +$25/month per additional), and Uplink (aimed at SaaS providers managing customer connectivity) at $250/month per cluster including 10 tunnels. So the realistic cost of a self-hosted inlets setup is your VPS bill plus a license fee — not simply “$5 for a VPS,” as inlets is sometimes casually described.

It’s also worth narrowing an oft-repeated claim: inlets does not offer broad, general-purpose UDP tunneling for things like game servers or VoIP. Its own site currently scopes UDP support specifically to DNS traffic. If your goal is UDP for gaming, frp or Playit.gg are the appropriate tools — not inlets.

Final Verdict

The right tool in 2026 still comes down to what kind of traffic you’re pushing and how much infrastructure you want to own.

If you’re a web developer testing integrations, APIs, or webhooks, ngrok’s request-inspection tooling remains genuinely strong, even with a tighter free tier than it used to have.

If you need to host a game server or push raw UDP traffic without paying enterprise fees, Playit.gg remains a solid, purpose-built option for exactly that gap — just go in aware that “static IP” is really “persistent address over an anycast network,” and that HTTPS tunnels require the paid tier.

For full control over your own network boundary: frp is free and handles UDP well, with the caveat that its peer-to-peer mode still leans on your relay server for signaling. inlets is a more polished, Kubernetes-native option, but budget for its license fee on top of your VPS cost — it isn’t the free alternative it’s sometimes made out to be.

---

Changelog (Fact-Check Corrections)

1. ngrok free-tier limits corrected and detailed. Original draft only vaguely referenced bandwidth limits. Verified directly against ngrok’s own docs (ngrok.com/docs/pricing-limits): free tier is 1 active endpoint, up to 3 tunnels per agent, 1 GB/month data transfer out, 20,000 HTTP requests/month, 1 static dev domain, 5,000 TCP/TLS connections. Removed the unqualified “$10/month” premium price and replaced with the correct current tier structure: Hobbyist $10/month ($8 annual), Pay-as-you-go $20/month base + usage, Enterprise ~$39/month for SSO/mTLS/RBAC (per third-party pricing trackers, since ngrok doesn’t list Enterprise pricing publicly).
2. Playit.gg “static IP” claim softened and corrected. Playit’s own support documentation describes free tunnels as running over a “Global Anycast” network where the datacenter routing your players connect through can vary — a fixed, single-IP guarantee is not accurate for the free tier. Rewrote to describe a “persistent address,” not a static IP, and added that regional (fixed-datacenter) routing is a Premium-only feature.
3. Added a new, verified fact: Playit.gg’s own support docs confirm HTTPS tunnels require Playit Premium — this was missing from the original draft entirely.
4. Playit.gg free-tier tunnel count flagged as unverified on primary source. The “4 TCP + 4 UDP tunnels” figure appears consistently across multiple 2026 third-party guides (Pinggy, Localtonet, DevToolLab) but is not itemized on Playit’s own pricing page, and at least one source cites a different number (3 tunnels). Labeled accordingly rather than stated as confirmed fact.
5. Playit.gg premium pricing confirmed directly on playit.gg/pricing: $3/month. Removed an unverified claim about premium including “basic analytics” — not mentioned anywhere in Playit’s own support documentation.
6. Playit.gg client open-source claim confirmed via the public playit-cloud/playit-agent GitHub repository.
7. frp’s P2P claim corrected. The original draft implied frp’s peer-to-peer mode lets two clients “bypass the server entirely.” frp’s own documentation is explicit that its frps server is still required to coordinate the connection (via STUN-based hole-punching); only the data transmission itself may go direct, and even that doesn’t work with all NAT types.
8. Significant correction to inlets’ cost model. The original draft implied inlets was in the same free/self-hosted cost bracket as frp (just a $4–5/month VPS). In fact, inlets Pro requires a paid software license on top of the VPS cost — confirmed directly against inlets.dev/pricing: Personal $25/month (5 tunnels), Commercial $50/month, Uplink $250/month per cluster. This is now stated explicitly.
9. Narrowed inlets’ UDP claim. Original draft didn’t make a UDP claim for inlets, but for completeness: inlets’ own site currently scopes UDP tunneling specifically to DNS traffic, not general real-time protocols — added as a clarifying note so readers don’t assume broader UDP support.
10. CGNAT section extended with sourced specifics: IPv4 registry exhaustion dates (ARIN, September 2015; RIPE NCC, November 2019), the RFC 6598 100.64.0.0/10 address block reserved for CGNAT in 2012, the NAT444 terminology, and a current (2026) global IPv6 adoption estimate of roughly the mid-40% range, to explain why CGNAT is still widespread rather than a fading edge case.
11. Removed unverifiable superlatives (“the undisputed champion,” “recognized a glaring hole,” etc.) in favor of attributed, sourced comparisons, consistent with keeping vendor claims separable from independently confirmed facts.

Primary sources consulted: ngrok.com/docs/pricing-limits, playit.gg/pricing, playit.gg (homepage), playit.gg/support/playit-premium, github.com/fatedier/frp, github.com/playit-cloud/playit-agent, inlets.dev/pricing, docs.inlets.dev, en.wikipedia.org/wiki/IPv4_address_exhaustion, plus cross-checks against multiple independent 2026 tunneling-tool comparison articles for figures not itemized on vendor sites.