When self-hosting n8n behind a NAT or firewall, external services cannot reach your webhook URLs.
When self-hosting n8n behind a NAT or firewall, external services cannot reach your webhook URLs. Use a tunneling tool to expose your local n8n instance to the internet during development. This lets you receive real webhook events from services like GitHub, Stripe, or Shopify without deploying to a public server.
Real-world example: You run n8n locally on localhost:5678 and need to test a GitHub webhook that fires on pull request events.
Using ngrok:
# Install ngrok (macOS)
brew install ngrok
# Start a tunnel to your local n8n
ngrok http 5678
# Output:
# Forwarding https://a1b2c3d4.ngrok-free.app -> http://localhost:5678
```text
Then set your webhook path in n8n and configure GitHub:
```yaml
# n8n Webhook node path
webhook/github/pull-requests
# Full URL to give GitHub (use the ngrok URL + production webhook path)
https://a1b2c3d4.ngrok-free.app/webhook/github/pull-requests
# Important: Use /webhook/ (production), not /webhook-test/
# and make sure the workflow is activated
```text
Using **Cloudflare Tunnel** (more stable for longer sessions):
```bash
# Install cloudflared
brew install cloudflared
# Start a quick tunnel (no account needed)
cloudflared tunnel --url http://localhost:5678
# Output:
# Your quick Tunnel has been created!
# https://random-words-here.trycloudflare.com
```text
```yaml
# Environment variable alternative (set in .env or docker-compose)
# Tell n8n its public URL so it generates correct webhook URLs:
WEBHOOK_URL=https://a1b2c3d4.ngrok-free.app/
```text
> **Note: Set WEBHOOK_URL for correct URL display**
>
> Without setting `WEBHOOK_URL`, the n8n editor will still show `http://localhost:5678/webhook/...` as the production URL. Setting this environment variable makes n8n display the tunnel URL directly in the editor, reducing copy-paste errors.
This lets you develop and debug with real webhook traffic without deploying anything.
**Related:** [Set a Unique Encryption Key and Back It Up](../security-best-practices/01-set-a-unique-encryption-key-and-back-it-up.md) | [Use the HTTP Request Node as a Universal Connector](../integration-patterns/01-use-the-http-request-node-as-a-universal-connector.md)
I build production n8n and Cloudflare automation for teams — the same engineering behind HarperFlow. Fixed-price, escrow-protected, US-based.