Pangolin
Self-hosted identity-aware reverse proxy that securely exposes private services via encrypted tunnels without opening inbound ports.
Pangolin is an open-source zero-trust remote access platform that provides secure, identity-centric access to applications and infrastructure without opening firewall ports or deploying traditional VPNs. Built on WireGuard®, it unifies clientless web application access and client-based private network access under a single policy model. With over 1 million deployments worldwide, Pangolin is available as a managed cloud service or fully self-hosted.
Architecture
Pangolin separates the control plane (Pangolin server) from the data plane (sites and clients). The server handles authentication, stores access policies, and coordinates authorization without sitting in the path of traffic. The data plane consists of sites — lightweight connectors deployed in your networks via the Newt agent — and clients on user devices. Sites establish secure, outbound-only tunnels, eliminating the need for public IPs or inbound firewall rules. Clients connect directly peer-to-peer to sites for authorized resources.
Resource Types
Public Resources — Clientless Application Access
Public resources provide identity-aware reverse proxy access to internal web applications. Users access a URL in their browser, authenticate via SSO or MFA, and are routed to the backend through an encrypted tunnel. No client installation is required. Features include:
- TLS termination and automatic certificate management
- Path-based routing and URL rewriting
- Health checks with per-target status monitoring
- Load balancing across multiple backends
Private Resources — Least-Privilege Infrastructure Access
Private resources provide ZTNA-style access to specific hosts, databases, SSH servers, or entire network segments (via CIDR ranges). Access is scoped to explicitly authorized resources only — never the full network. The Pangolin client (available for macOS, Windows, Linux, iOS, and Android) handles tunnel establishment and routing automatically.