Pangolin
Identity-aware VPN and proxy for remote access
Install with Homebrew
brew install --cask pangolinQuick Take: Pangolin
Pangolin (fosrl/pangolin) is a strong identity-aware WireGuard proxy for people who outgrew disposable ngrok URLs but do not want to surrender every origin to Cloudflare. Cloud Basic makes experimentation cheap; AGPL CE and generously licensed EE make serious self-hosting viable for hobbyists and smaller businesses. Browser remoting and SSO put it closer to zero-trust access gateways than dumb tunnels. Ops complexity remains real for self-hosters, and large enterprises may still prefer Twingate or Cloudflare Zero Trust—but for homelabs and indie teams, Pangolin is one of the best open options in 2026.
Best For
- •Homelab operators exposing apps without port forwarding
- •Developers who want self-hosted or Fossorial-cloud alternatives to ngrok
- •Small teams needing SSO-protected internal tools and browser remoting
What is Pangolin?
Pangolin is an identity-aware VPN and tunneled reverse proxy built on WireGuard by Fossorial Inc. The open-source project lives at github.com/fosrl/pangolin (roughly 22,000 GitHub stars) with current software around version 1.21.1 on pangolin.net. It lets you publish internal apps—homelab dashboards, staging APIs, admin UIs—through encrypted tunnels with HTTPS, SSO, and fine-grained access control instead of opening router ports or handing everyone a full VPN profile. In practice you run Pangolin either as managed cloud at app.pangolin.net or as self-hosted infrastructure. Clients such as Newt connect private sites; Gerbil handles tunneling; Traefik terminates HTTP with Let's Encrypt certificates. Users reach apps through a browser-based HTTPS proxy and can also open VNC, RDP, or SSH sessions inside the browser when remote desktop or shell access is required. Peer-to-peer paths and paid device posture checks extend the zero-trust story beyond simple password gates. Compared with ngrok, Cloudflare Tunnel, Tailscale Funnel/Zero Trust, or Twingate, Pangolin emphasizes an identity-aware proxy plus WireGuard transport you can fully self-host under AGPL-3 Community Edition, or run on Fossorial's cloud with freemium seats. Self-hosted Enterprise Edition uses the Fossorial Commercial License and stays free for personal/hobby use and for businesses under $100K revenue. Cloud Basic is free for 5 users, 5 sites, and 5 domains; Team is $4 per user per month; Business is $9 per user per month; Enterprise is custom. Pangolin targets developers, homelab operators, and small teams who want Cloudflare-Zero-Trust-like access without surrendering all traffic to a third-party edge—or who want a managed option without building Traefik and WireGuard plumbing from scratch. Documentation at docs.pangolin.net covers Docker Compose installs, cloud onboarding, and Enterprise Edition licensing so you can pick the deployment model that matches compliance and ops capacity.
Deep Dive: Identity-Aware Tunnels Without Surrendering the Edge
Pangolin sits at the intersection of reverse proxies, WireGuard VPNs, and zero-trust access gateways.
History & Background
Developer tunnels began as quick ngrok-style demos, then matured into always-on access layers for homelabs and startups. Pangolin (fosrl/pangolin by Fossorial Inc.) grew as an open-source answer that pairs WireGuard transport with an identity-aware application proxy, browser remote access, and both cloud and self-host SKUs. Star count around 22k reflects strong interest from the self-hosted crowd that rejects nicknamed lookalikes and wants the Fossorial project specifically.
How It Works
Sites run Newt to join the fabric; Gerbil contributes tunnel machinery; Traefik handles HTTP entry and Let's Encrypt certificates; Pangolin's control plane maps users, domains, and policies onto backends reachable only through the tunnel. Optional peer-to-peer paths shorten routes. Browser VNC/RDP/SSH piggybacks the same authZ model so remote administration is another resource type rather than a side-channel VPN.
Ecosystem & Integrations
Operators compare Pangolin with ngrok for DX, Cloudflare Tunnel for free custom domains, Tailscale Funnel/Zero Trust for mesh-centric teams, and Twingate for polished ZTNA. Pangolin's differentiators are AGPL CE self-hosting, clear EE hobby/SMB free terms, cloud seat pricing, and first-class browser remoting. Integrations revolve around OIDC IdPs, Docker hosts, and standard DNS providers.
Future Development
Active 1.21.x releases continue hardening cloud and self-host parity—posture, P2P, and proxy features evolve on the Fossorial roadmap. Teams should track GitHub releases and docs.pangolin.net rather than third-party mirrors, and ignore outdated references to unrelated repositories that reused the Pangolin name.
Key Features
WireGuard Identity-Aware Tunneling
Pangolin uses WireGuard as the encrypted transport between private sites and the Pangolin control/data plane. Sites connect outbound through Newt and related tunnel components, so home NATs and CGNAT links work without inbound port forwards. The identity-aware proxy then decides who may reach each resource after authentication rather than exposing raw services to the open internet.
Browser-Based HTTPS Proxy
Publish web apps with automatic HTTPS via Traefik and Let's Encrypt. Custom domains map to internal services; Pangolin proxies authenticated browser traffic to the correct backend through the tunnel. This is the primary path for dashboards, admin panels, and internal SaaS replacements that already speak HTTP.
VNC, RDP, and SSH in the Browser
Beyond HTTP apps, Pangolin can present VNC, RDP, and SSH sessions inside the browser so support staff or admins reach desktops and shells without installing a separate VPN client on every device. Access still flows through the same identity policies as web resources, which keeps remote administration inside the zero-trust boundary.
Newt Client and Gerbil Tunnel
Newt is the site/client agent that attaches private networks to Pangolin. Gerbil provides tunnel plumbing so traffic rides WireGuard efficiently between edges. Together they replace ad-hoc SSH reverse tunnels with a managed control plane for multiple sites, domains, and services.
SSO, OIDC, and Access Policies
Integrate OIDC/SSO providers so teammates sign in with existing IdPs instead of sharing long-lived passwords per app. Define per-resource policies for public links, authenticated users, or narrower groups. Paid tiers add device posture checks so access can require healthy, managed endpoints—not only a valid login.
Peer-to-Peer Connectivity
Pangolin supports peer-to-peer paths that keep traffic between participants more direct when network conditions allow, reducing unnecessary hairpinning through a central relay. For latency-sensitive internal tools, P2P complements the reverse-proxy model without abandoning identity controls.
Cloud and Self-Hosted Deployment Choices
Use Fossorial cloud at app.pangolin.net for managed control, or self-host Community Edition (AGPL-3) with Docker Compose from the official docs. Enterprise Edition under the Fossorial Commercial License unlocks commercial terms while remaining free for personal/hobby use and organizations under $100K revenue. Choose cloud for speed, self-host for data-plane sovereignty.
Who Should Use Pangolin?
1Homelab Operator
A homelabber runs Plex, Home Assistant, Nextcloud, and Grafana behind CGNAT. They either join Pangolin cloud on the free Basic tier or self-host CE on a small VPS, connect the home site with Newt, and publish each app on its own domain with different policies—Plex shared carefully, Home Assistant behind SSO, Grafana limited to their account. No router port forwards, and browser SSH/VNC covers the rare times they need shell or desktop access.
2Developer Sharing Local Work
A developer needs a client to review a staging UI without deploying to a public PaaS. They attach the laptop site through Pangolin, map a hostname to localhost, and require the client's email via OIDC. HTTPS terminates at Pangolin; the tunnel carries traffic to the laptop. When the review ends, they remove the resource. Compared with ngrok, they keep identity policy and can reuse the same Pangolin org for permanent internal tools.
3Small Team with Internal Tools
An eight-person startup hosts admin dashboards and a wiki on private infrastructure. Business or Team cloud seats—or self-hosted EE if revenue qualifies—front those apps with GitHub or Google OIDC. New hires inherit access through the IdP; departures lose it when IdP membership ends. Device posture on paid plans blocks unmanaged laptops from sensitive admin routes. Twingate or Tailscale remain options, but Pangolin's browser proxy reduces VPN client sprawl for web-only tools.
How to Install Pangolin (Cloud or Self-Hosted)
Pick managed cloud for the fastest path, or self-host Community Edition with Docker Compose when you want the data plane on your VPS.
Choose Cloud or Self-Host
For cloud, create an account at app.pangolin.net and start on Basic (5 users / 5 sites / 5 domains). For self-host, provision a Linux VPS with a public IP and follow docs.pangolin.net Docker Compose guidance to bring up the stack.
Deploy or Configure the Control Plane
Self-hosters run the official compose stack so Traefik, Pangolin services, and tunnel components start together. Point DNS for your domains at the VPS or follow cloud DNS instructions. Confirm Let's Encrypt issuance for HTTPS.
Connect Sites with Newt
Install and authenticate the Newt client on each private site (home server, laptop, office network). Newt establishes the WireGuard-backed tunnel so Pangolin can reach internal listeners without inbound NAT holes.
Publish Resources and Policies
In the dashboard, add HTTPS resources, optional VNC/RDP/SSH targets, domains, and SSO/OIDC providers. Attach access policies per resource. Upgrade to Team, Business, or Enterprise if you need more seats, posture, or commercial terms.
Pro Tips
- • Start on cloud Basic to learn concepts, then migrate to self-hosted CE/EE if you need traffic to stay on your VPS
- • Use wildcard DNS where supported so new subdomains do not require a DNS ticket each time
- • Test with a trivial local HTTP server before exposing production admin panels
- • Read Enterprise Edition docs before assuming AGPL CE covers your commercial redistribution needs
Configuration Tips
Wire OIDC Before Opening Broad Access
Connect Google, GitHub, or another OIDC IdP and require authentication on every sensitive resource before sharing URLs widely. Identity-aware defaults matter more than fancy domains; public resources should be explicit exceptions.
Separate Domains by Sensitivity
Put customer-facing demos, internal admin, and remote desktop on different hostnames with distinct policies. Browser VNC/RDP/SSH endpoints deserve stricter SSO and, on paid plans, device posture compared with a read-only status page.
Prefer Official Compose Over Ad-Hoc Containers
Self-host using Fossorial's documented Docker Compose layout so Traefik, Gerbil, and Pangolin services stay version-aligned. Divergent homemade stacks are the usual source of certificate and tunnel failures after upgrades to the 1.21.x line.
Alternatives to Pangolin
Identity-aware tunnels span managed SaaS and self-hosted WireGuard meshes. Pangolin overlaps several categories depending on cloud versus CE/EE.
ngrok
ngrok is the fastest localhost-to-URL tool with a polished inspector. Traffic traverses ngrok infrastructure and paid plans meter endpoints. Choose ngrok for ephemeral webhook debugging; choose Pangolin when you want durable identity-aware publishing with self-host or Fossorial cloud options.
Cloudflare Tunnel
Cloudflare Tunnel is free for many custom-domain origins if you already use Cloudflare DNS, with Zero Trust adding SSO complexity. Traffic stays in Cloudflare's edge. Pangolin wins when you refuse that dependency or want browser remote desktop alongside HTTP proxying.
Tailscale Funnel / Zero Trust
Tailscale Funnel exposes services through Tailscale's mesh; broader Zero Trust features fit teams already standardized on Tailscale. Pangolin is stronger when you want a dedicated identity-aware reverse proxy UX, Traefik/Let's Encrypt workflows, and AGPL self-hosting rather than mesh-first networking.
Twingate
Twingate is a commercial zero-trust network access product with polished enterprise controls. Pangolin competes on open-source CE, transparent cloud seat pricing, and browser-based app/remote access without requiring every workflow to install a full ZTNA client.
Pricing
Cloud (app.pangolin.net / pangolin.net/pricing): Basic free with 5 users, 5 sites, and 5 domains; Team at $4 per user per month; Business at $9 per user per month; Enterprise custom. Self-host: Community Edition is free under AGPL-3; Enterprise Edition uses the Fossorial Commercial License and is free for personal/hobby use and for businesses under $100K revenue. Self-hosters still pay for their own VPS and domains. Confirm current seat limits and EE eligibility on official pricing and Enterprise Edition docs.
Pros
- ✓Identity-aware WireGuard reverse proxy with real SSO/OIDC controls
- ✓Browser HTTPS proxy plus in-browser VNC/RDP/SSH for admin workflows
- ✓Choice of Fossorial cloud or AGPL-3 self-hosted Community Edition
- ✓Enterprise Edition free for hobbyists and sub-$100K-revenue businesses under commercial license terms
- ✓Newt/Gerbil/Traefik/Let's Encrypt stack documented for Docker Compose
- ✓Peer-to-peer options and paid device posture for stronger zero trust
- ✓Transparent cloud tiers starting with a usable free Basic plan
Cons
- ✗Self-hosting still requires a public VPS, DNS, and ongoing updates
- ✗More moving parts than one-command ngrok tunnels
- ✗AGPL-3 CE licensing may not fit every company's distribution model without EE
- ✗Device posture and higher seat counts require paid cloud or commercial EE paths
- ✗Smaller ecosystem mindshare than Cloudflare Tunnel or Tailscale
Community & Support
Pangolin's community centers on the fosrl/pangolin GitHub repository—issues, discussions, and release tags for the ~1.21.x line—plus Fossorial docs and the product site. Homelab forums frequently compare Pangolin with Cloudflare Tunnel, Tailscale Funnel, and Twingate when operators want identity-aware publishing without full mesh VPN clients. Cloud users lean on app.pangolin.net dashboards and pricing pages; self-hosters rely on Docker Compose manuals and Enterprise Edition licensing notes. Because the project is AGPL CE with a commercial EE track, contributors and companies should read license docs before embedding Pangolin in distributed products.
Frequently Asked Questions about Pangolin
About the Author
Expert Tips for Pangolin
Homelab operators increasingly treat Pangolin as 'Cloudflare Zero Trust you can self-host,' especially when they need browser RDP/SSH plus HTTP apps under one SSO policy.
Official EE docs matter: many teams assume AGPL CE is their only path, but Fossorial's commercial license already grants $0 EE for hobby use and sub-$100K-revenue businesses.
Cloud Basic's 5/5/5 free limits are enough to validate Newt site connectivity before committing to a VPS; migrating later is mostly DNS and policy replay rather than a conceptual rewrite.
Related Technologies & Concepts
Related Topics
Networking & Tunneling
WireGuard tunnels, reverse proxies, and secure remote access tools
Self-Hosted Infrastructure
Self-hosted zero-trust access, Docker Compose stacks, and homelab publishing
Sources & References
Fact-CheckedLast verified: Aug 9, 2026
Key Verified Facts
- Pangolin is developed by Fossorial Inc. as fosrl/pangolin on GitHub with on the order of 22,000 stars.[cite-3, cite-1]
- Cloud pricing includes Basic free (5 users/5 sites/5 domains), Team at $4/user/month, Business at $9/user/month, and Enterprise custom.[cite-2]
- Self-hosted Community Edition is AGPL-3; Enterprise Edition under the Fossorial Commercial License is free for personal/hobby use and businesses under $100K revenue.[cite-6, cite-2]
- Pangolin provides identity-aware WireGuard tunneling with browser HTTPS proxying, Newt/Gerbil components, Traefik/Let's Encrypt, and SSO/OIDC.[cite-1, cite-4]
- Official docs include Docker Compose self-host instructions and cloud signup via app.pangolin.net.[cite-5, cite-7]
- 1Pangolin Official Website
Accessed Aug 9, 2026
- 2Pangolin Pricing
Accessed Aug 9, 2026
- 3fosrl/pangolin on GitHub
Accessed Aug 9, 2026
- 4Pangolin Documentation
Accessed Aug 9, 2026
- 5Pangolin Docker Compose Self-Host Manual
Accessed Aug 9, 2026
- 6Pangolin Enterprise Edition
Accessed Aug 9, 2026
- 7Pangolin Cloud Signup
Accessed Aug 9, 2026
Research queries: fosrl pangolin 1.21 WireGuard identity-aware proxy; pangolin.net pricing Team Business Basic; pangolin enterprise edition AGPL Fossorial