Control MZAP from Anywhere with Cloudflare Tunnel or ngrok

Need to change the music at a site you’re not at, fix a schedule from home, or check what’s playing in another building? A tunnel gives Multi Zone Audio Player (MZAP 7) a secure public web address, so you can open its full web interface from any browser, anywhere.

There’s nothing to change on your router: no port forwarding, no firewall rules, no static IP. The tunnel app runs on the MZAP computer and makes an outgoing connection to the tunnel service, which passes your browser’s requests back to MZAP.

Everything works through the tunnel, including live level meters, play status, track progress, volume and routing.

This guide covers two options:

	Cloudflare Tunnel	ngrok
Best for	Permanent remote access	Trying it out, short sessions
You need	A domain managed by Cloudflare	Just a free account
Address	Your own, e.g. `mzap.yourdomain.com`	An `ngrok-free.app` address
Runs	As a Windows service, survives reboots	While the ngrok window is open
Cost	Free	Free plan available

Note: This guide is about browser access. Connecting the MZAP Remote mobile app or an AI assistant through a tunnel will be covered in a separate article.

Do not skip this step. Sign-in is off by default in MZAP, because on a closed local network it isn’t always needed. A tunnel puts MZAP on the internet: without sign-in, anyone who finds the address gets full control of your audio system.

In MZAP, open the Users tab.
Click Create, enter a username and a strong password, and set the role to Admin.
Click Enable Authentication and confirm.
For people who will connect remotely, create separate accounts with the Operator role (can control playback and volume) or the Viewer role (can only watch). You can also limit each account to specific players and zones.

Reload MZAP: a login dialog should now appear. See Users & Access in the documentation for details on roles and assignments.

MZAP’s port: both tunnels point at port 5000, which serves the MZAP web interface. If you changed the API port in MZAP’s settings, use your port instead.

Option A: Cloudflare Tunnel (Recommended)

Use this for permanent remote access. You get a stable address on your own domain, HTTPS is handled for you, and the tunnel starts automatically with Windows.

You need: a free Cloudflare account and a domain whose DNS is managed by Cloudflare. If your domain is with another registrar, you can add it to Cloudflare for free and switch its nameservers. Cloudflare walks you through this when you add a domain.

1. Create the tunnel

Log in to the Cloudflare dashboard.
Go to Networking → Tunnels and click Create a tunnel.
Give it a name you’ll recognise, for example mzap-lobby, and click Create Tunnel.

2. Install the connector on the MZAP computer

When asked for your operating system, choose Windows.
Download and install cloudflared using the link the dashboard shows.
Copy the install command from the dashboard. It looks like this, with your own long token at the end:
```
cloudflared.exe service install eyJhIjoi...
```
On the MZAP computer, open Command Prompt as administrator (right-click → Run as administrator), paste the command and press Enter.
Back in the dashboard, wait until the tunnel shows as connected, then click Continue.

The connector now runs as a Windows service. It starts with Windows and reconnects by itself after a network drop.

3. Give MZAP a public address

On the tunnel’s Routes tab, click Add route → Published application.
Hostname: enter a subdomain, for example mzap, and pick your domain from the list.
Service URL: enter http://localhost:5000
Click Save.

Within a minute, open https://mzap.yourdomain.com in any browser, sign in, and you’re in.

Avoid “Quick Tunnels” for MZAP. Cloudflare also offers instant tunnels on random trycloudflare.com addresses with no account. They open the page, but they don’t support the live updates MZAP uses: meters and play status freeze. Use a named tunnel as described above.

Option B: ngrok (Quickest to Try)

ngrok is the fastest way to test remote access. You don’t need a domain, and it takes about five minutes.

1. Create a free account

Sign up at ngrok.com.
In the ngrok dashboard, open Your Authtoken and copy the token.

2. Install ngrok on the MZAP computer

Open Command Prompt or PowerShell and run:

winget install ngrok.ngrok

Or download ngrok for Windows from ngrok.com/download and unzip it. If you use the zip, run the commands below from the folder that contains ngrok.exe.

3. Connect ngrok to your account

You only need to do this once:

ngrok config add-authtoken YOUR_TOKEN

4. Start the tunnel

ngrok http 5000

ngrok shows a Forwarding line with an address like https://xxxx.ngrok-free.app. Open that address in any browser, sign in, and you’re in.

The tunnel stays open while this window is open. Press Ctrl+C to close it, and the address stops working immediately.

Tips:

Keep the same address: on the free plan, the address may change each time you start ngrok. In the ngrok dashboard, under Domains, you can claim a fixed address and then start the tunnel with ngrok http 5000 --url=https://your-name.ngrok-free.app.
See what’s happening: while ngrok runs, open http://127.0.0.1:4040 on the MZAP computer to watch requests going through the tunnel.
“ERR_NGROK_121” / “agent version is too old”: your ngrok is outdated. Run ngrok update, or winget upgrade ngrok.ngrok if you installed it with winget, then try again.
For always-on access, use Cloudflare Tunnel instead. ngrok is best for sessions where someone is watching.

Security Checklist

✅ Sign-in is enabled in MZAP, and the Admin password is strong and unique.
✅ Remote people use Operator or Viewer accounts, not the Admin account.
✅ Each person has their own account, so you can remove one without affecting the others.
✅ Close tunnels you don’t need. Stop ngrok with Ctrl+C; pause or delete a Cloudflare tunnel in the dashboard.
✅ Share the address only with people who need it.

For extra protection with Cloudflare, you can add Cloudflare Access in front of MZAP, so visitors must also confirm their email before they reach the MZAP login page. See Cloudflare’s documentation for setup.

Troubleshooting

The page doesn’t load: check that MZAP is running and that http://localhost:5000 opens on the MZAP computer itself.
Cloudflare shows error 502 or 1033: the connector can’t reach MZAP or isn’t running. Check that the Cloudflared service is running in Windows Services and that the Service URL is http://localhost:5000.
Meters and status don’t move: you’re probably on a Cloudflare Quick Tunnel (trycloudflare.com). Switch to a named tunnel.
No login dialog appears: sign-in isn’t enabled yet. Go back to Before You Start.

Questions or a setup that doesn’t fit this guide? Contact us. We’re happy to help.

Before You Start: Turn On Sign-In