---
title: "Webhooks to Internal Servers | WebhookRelay"
meta:
  "og:description": "Forward public webhooks to internal servers behind a firewall or NAT with Webhook Relay — no public IP, port forwarding or router changes required."
  "og:title": "Webhooks to Internal Servers"
  description: "Forward public webhooks to internal servers behind a firewall or NAT with Webhook Relay — no public IP, port forwarding or router changes required."
---

![Stripes](https://webhookrelay.com/images/stripes.svg)

FEATURES

# **Webhooks to Internal Servers**

Forward public webhooks to internal servers behind a firewall or NAT with Webhook Relay — no public IP, port forwarding or router changes required.

**Webhook Relay forwards webhooks from any public provider to servers on a private network or localhost.** A lightweight agent on your side opens an outbound connection, so Stripe, GitHub, Shopify or any other service posts to a stable public Webhook Relay URL and the request is delivered to an internal HTTP endpoint that has no public IP, no open inbound ports and no port forwarding.

## [How it works](#how-it-works)

1. Create a bucket and give its public URL (`https://<bucket>.hooks.webhookrelay.com`) to the provider.
2. Install the `relay` agent on the target machine — laptop, on-prem server, VM or Kubernetes cluster — and start it: `relay forward -b example http://localhost:4500/webhooks`
3. Every webhook is stored, forwarded to the internal URL over the agent's outbound connection, and logged together with the response your server returned.

## [When to use it](#when-to-use-it)

- **Local development:** test Stripe, GitHub or Shopify webhooks on [localhost](https://webhookrelay.com/webhooks/) with a URL that never changes.
- **On-prem integration:** deliver SaaS webhooks to internal systems — ERPs, [Jenkins](https://webhookrelay.com/docs/tutorials/cicd/jenkins-plugin/), ticketing tools, internal APIs — behind a corporate firewall.
- **Private clusters:** receive webhooks in a [Kubernetes](https://webhookrelay.com/features/webhook-kubernetes-integration/) or Docker network without a public ingress.
- **Team broadcast:** share one endpoint with a whole team; every connected agent receives the same events.

## [Forwarding vs. a tunnel vs. polling](#forwarding-vs-a-tunnel-vs-polling)

|  | Webhook Relay forwarding | ngrok-style tunnel | Polling the provider's API |
| --- | --- | --- | --- |
| Public IP or open inbound ports | Not required | Not required | Not required |
| Public URL stays the same | Yes — permanent per bucket | Often changes per session | n/a |
| Works while your server is offline | Yes — stored and retried for up to 30 days | No — requests fail | Yes, with delay |
| Several receivers for one endpoint | Yes | No | Manual |
| Filter or transform before delivery | Yes — [rules](https://webhookrelay.com/features/forwarding-rules/) and [functions](https://webhookrelay.com/features/transform-webhooks/) | No | In your own code |
| Exposes your whole service | No — webhooks only | Yes | No |

## [Key Benefits](#key-benefits)

- **Bypass Firewalls and NATs:** Receive webhooks without needing public IP addresses or opening firewall ports. Webhook Relay establishes an outbound connection from your network, which is typically allowed.
- **Enhanced Security:** Your internal endpoints remain hidden and protected from direct internet exposure. Communication happens over a secure, encrypted tunnel.
- **Simplified Development & Testing:** Easily test webhook integrations during development by pointing webhooks directly to your local development environment.
- **Connect On-Prem Systems:** Integrate cloud services with internal applications running on private networks seamlessly.
- **Reliability:** The agent ensures persistent connectivity and reliable delivery of webhooks.

Delivering to private endpoints is what sets Webhook Relay apart as a [webhook gateway](https://webhookrelay.com/webhook-gateway/) — the same platform adds [durable retries](https://webhookrelay.com/features/durable-retries/), [throttling](https://webhookrelay.com/features/throttling/), [fan-out](https://webhookrelay.com/features/webhook-multiple-destinations/) and [delivery logs](https://webhookrelay.com/features/webhook-logs/) on top of the tunnel.

## **Frequently asked questions**

### **How do I receive webhooks on a server that has no public IP?**

Run the Webhook Relay agent on, or next to, that server and point it at the internal URL — for example relay forward -b my-bucket http://10.0.0.5:8080/webhooks. The agent opens an outbound connection to Webhook Relay, so the provider posts to a public Webhook Relay URL and each request is streamed to your private endpoint. No inbound ports, port forwarding or public IP address is needed.

### **Is Webhook Relay a tunnel like ngrok?**

Not quite. An ngrok-style tunnel exposes your whole service on the internet under a temporary hostname. Webhook Relay forwarding only delivers webhooks: the public URL is permanent, requests are stored and retried while the agent is offline, several agents can subscribe to the same bucket, and payloads can be filtered or transformed before delivery. Webhook Relay also offers tunnels for the cases where you need to expose a complete service.

### **What happens to webhooks if my internal server or the agent is down?**

Webhook Relay accepts and stores the webhook, so the provider sees a successful response and does not give up. With durable retries enabled, delivery is retried with backoff for up to 30 days, and any request can be replayed from the logs once the destination is back.

### **Can I forward the same webhook to several internal destinations?**

Yes. A bucket can have multiple outputs, and several agents — one per developer, environment or data centre — can subscribe to the same bucket and each receive every webhook.

### **Which providers can send webhooks to an internal server this way?**

Any service that can POST to an HTTPS URL: Stripe, GitHub, GitLab, Bitbucket, Shopify, Twilio, Slack, Jira, TradingView, your own applications and more. The provider only ever sees the public Webhook Relay endpoint.

### **Can I run this inside Kubernetes, Docker or Jenkins?**

Yes. The agent ships as a single binary, a Docker image and a Kubernetes operator, so private services in a cluster receive webhooks without a public ingress. Jenkins users can install the native Webhook Relay Jenkins plugin instead of running a separate agent.

![Stripes](https://webhookrelay.com/images/stripes-dark.svg)

## **Start forwarding webhooks in minutes **

Connect a source, pick a destination, and Webhook Relay handles delivery, retries and transforms. Set up your first webhook in under five minutes.

[Start for free ->](https://my.webhookrelay.com/register)

Free plan · No credit card required · 7-day money-back guarantee on paid plans