fosrl/pangolin: Identity-Aware VPN and Reverse Proxy for Remote Access

fosrl/pangolin: Identity-Aware VPN and Reverse Proxy for Remote Access

Remote access infrastructure has long forced teams into uncomfortable trade-offs. Traditional VPNs grant excessive network access, violate least-privilege principles, and struggle with modern NAT and firewall constraints. Standalone reverse proxies lack identity awareness and can't handle non-HTTP protocols. Developers managing distributed infrastructure need a unified approach that combines granular access control with flexible connectivity—without forcing users through multiple tools or exposing entire networks.

fosrl/pangolin addresses this gap directly. Built on WireGuard®, it merges VPN tunneling with tunneled reverse proxy capabilities into a single identity-aware platform. With 21,733 GitHub stars and active development (last commit July 16, 2026), Pangolin has gained substantial traction among teams seeking zero-trust remote access without the complexity of stitching together separate VPN and proxy solutions.

What is fosrl/pangolin?

fosrl/pangolin is an open-source, identity-based remote access platform written primarily in TypeScript and licensed under AGPL-3 (with a commercial license available). The project is maintained by Fossorial, with the repository hosted at github.com/fosrl/pangolin.

The tool occupies a distinct technical category: it is simultaneously a VPN solution and a reverse proxy, but neither description alone captures its design. Pangolin uses WireGuard as its underlying transport, then layers identity management, granular access control, and protocol-specific handling on top. This architecture enables two primary access modes: browser-based connections to web applications, VNC, RDP, and SSH (no client installation required); and client-based access to private resources like databases, SSH servers, and entire network ranges through native applications.

The project's relevance stems from a specific operational reality: modern infrastructure is distributed across cloud providers, on-premises data centers, edge locations, and developer home networks. Each environment presents different network constraints—CGNAT, restrictive egress firewalls, dynamic IPs. Pangolin's site connectors use outbound tunnels and NAT traversal to establish connectivity without requiring public IPs or open inbound ports, solving a problem that breaks traditional VPN deployments.

The dual licensing model (AGPL-3 for community use, Fossorial Commercial License for enterprise) reflects the project's maturity. The commercial license is free for personal/hobbyist use and businesses under $100K USD gross annual revenue, lowering friction for adoption while enabling sustainable development.

Key Features

Site Connectors with NAT Traversal

Pangolin's site connectors function as lightweight gateways into remote networks. Deployed as binaries or containers, they establish outbound WireGuard tunnels that punch through restrictive firewalls without requiring public IPs or open ports. The user-space implementation keeps the footprint minimal. Network segmentation is strict—connectors only expose explicitly authorized resources. Monitoring includes alerts when devices or network resources become unreachable.

Browser-Based Reverse Proxy Access

For web applications and interactive protocols, Pangolin operates as an identity-aware reverse proxy. Users authenticate through a web panel, then access HTTPS resources, VNC and RDP desktops, and SSH terminals entirely within the browser. The platform handles routing, load balancing, health checking, and automatic SSL certificate provisioning. Access controls include PIN codes, passcodes, email OTP, geoblocking, and allow-lists. Single sign-on applies across all resources.

Client-Based Private Resource Access

Native clients for Mac, Windows, Linux, iOS, and Android provide access to private resources that don't fit browser-based interaction: SSH servers, databases, RDP sessions, and entire CIDR ranges. Intelligent NAT traversal maintains connectivity through challenging network conditions. DNS aliases replace IP addresses with friendly names. Multiple connectors can provide path redundancy.

Identity and Access Management

Pangolin integrates with existing identity providers or uses built-in user management. Role-based access control (RBAC) grants resource-level permissions rather than network-wide access. This zero-trust model contrasts with traditional VPNs that expose full subnets. Full audit logging captures access events for compliance and security review.

Resource Discovery Interface

A personalized home page presents users with searchable, filterable views of their accessible resources. Grouping by site or label, saved views for personal or organizational defaults, and grid/list layouts reduce friction for teams managing many resources.

Use Cases

Multi-Cloud Infrastructure Access

A platform engineering team manages resources across AWS^{↗ Bright Coding Blog}, GCP, and an on-premises Kubernetes cluster. Rather than maintaining separate VPN concentrators per environment or exposing management APIs publicly, they deploy Pangolin site connectors in each network. Engineers access the Kubernetes dashboard, cloud consoles (via browser proxy), and internal APIs through a single identity provider, with RBAC ensuring developers only reach staging environments while SREs retain production access.

Remote Development Environments

A distributed development team needs access to internal services: a self-hosted GitLab instance, internal npm registries, staging databases, and remote Docker^{↗ Bright Coding Blog} hosts. Pangolin's client applications provide DNS-aliased access to these resources without requiring each developer to configure split DNS or maintain multiple VPN connections. The browser-based SSH terminal enables quick debugging sessions from any device without installing tools.

Vendor and Contractor Access

A healthcare technology company must grant limited access to external auditors and integration partners. Traditional VPNs violate their compliance posture by exposing entire networks. Pangolin's resource-level RBAC allows precise grants: the auditor's identity can access only the specific database and log aggregation endpoints required for their review, with full session logging. Time-bound access and MFA requirements enforce additional controls.

IoT and Edge Device Management

Devices deployed behind cellular NAT or corporate firewalls present classic remote access challenges. Pangolin's outbound tunneling and NAT traversal enable connectivity without requiring static IPs or port forwarding at deployment sites. Technicians access device web UIs through the browser proxy, while SSH access for debugging flows through the client application. Alerts on connector health provide early warning of connectivity issues.

Homelab and Personal Infrastructure

The commercial license's free tier for sub-$100K revenue makes Pangolin viable for personal use. A homelab operator can expose internal services (Home Assistant, media servers, development VMs) without dynamic DNS or manual certificate management, with geoblocking and MFA protecting against unauthorized access.

Installation & Setup

Pangolin offers two primary deployment paths: managed cloud service or self-hosted Community/Enterprise Edition.

Pangolin Cloud (Fastest Start)

Create a free account at app.pangolin.net. No infrastructure provisioning required.

Self-Hosted Quick Install

For self-hosting, the project provides a quick install guide. The DigitalOcean Marketplace offers a one-click pre-configured installer:

# Deploy via DigitalOcean Marketplace
# https://marketplace.digitalocean.com/apps/pangolin-ce-1?refcode=edf0480eeb81
# Follow the web-based configuration wizard post-deployment

For manual installation, consult the full documentation at docs.pangolin.net. The README emphasizes reading complete documentation before production deployment, as the README provides only a subset of operational guidance.

Client Installation

Download platform-specific clients from the project's distribution site:

# macOS
https://pangolin.net/downloads/mac

# Windows
https://pangolin.net/downloads/windows

# Linux
https://pangolin.net/downloads/linux

# Mobile
https://pangolin.net/downloads/ios
https://pangolin.net/downloads/android

Post-installation configuration involves authenticating against your Pangolin instance (cloud or self-hosted), at which point accessible resources populate based on your identity and role assignments.

Real Code Examples

The README does not contain extensive configuration code blocks; the following examples reflect the documented installation and deployment patterns. Where the documentation provides URLs and commands, they are reproduced exactly.

Docker Deployment Reference

The project maintains official Docker images with substantial pull volume:

# Pull the official image
# https://hub.docker.com/r/fosrl/pangolin
docker pull fosrl/pangolin

This image serves as the foundation for container-based site connector deployments and self-hosted control plane installation. The Docker Hub page referenced in the README provides additional configuration parameters not detailed in the repository documentation.

DigitalOcean One-Click Deploy

# Marketplace URL for pre-configured deployment
# https://marketplace.digitalocean.com/apps/pangolin-ce-1?refcode=edf0480eeb81

This deployment path automates server provisioning, Pangolin installation, and initial security configuration. The referral code in the URL supports project development. Post-deployment, administrators complete setup through a web wizard rather than manual configuration files.

Client Download and Installation

# Linux client download (pattern for other platforms)
wget https://pangolin.net/downloads/linux
# Follow platform-specific installation procedures

The README does not provide detailed client configuration examples, directing users instead to the full documentation at docs.pangolin.net. This reflects the project's maturity—comprehensive documentation lives outside the repository rather than in abbreviated README form.

Advanced Usage & Best Practices

Connector Redundancy Planning

For production environments, deploy multiple site connectors per network segment. Pangolin supports routing traffic through alternative connectors when primary paths fail. This requires planning connector placement to avoid shared failure domains—don't deploy redundant connectors on the same physical host or network uplink.

Identity Provider Integration

While Pangolin's built-in identity management suffices for small deployments, production use benefits from IdP integration (the README notes support for external identity providers without specifying protocols—likely SAML/OIDC based on common patterns). Syncing users and roles from corporate directories reduces administrative overhead and ensures access revocation follows standard offboarding workflows.

Network Segmentation Strategy

Resist the temptation to deploy a single connector with broad network access. Instead, align connector deployment with security zones: one connector for production databases, another for monitoring infrastructure, a third for development environments. This limits blast radius if credentials are compromised and enables more granular audit trails.

Resource Labeling and Views

Invest time in consistent resource labeling during initial setup. The personalized home page's filtering and saved views become significantly more valuable with structured metadata. Consider organizational default views for common access patterns (e.g., "On-Call Resources" aggregating production monitoring and paging interfaces).

Monitoring Integration

The README mentions alerts for device and resource unavailability. Integrate these with existing paging systems (PagerDuty, Opsgenie) rather than relying on email alone. Connector health metrics should feed into infrastructure monitoring dashboards alongside application metrics.

Comparison with Alternatives

Key Trade-offs: Pangolin's unified VPN-plus-proxy architecture reduces tool sprawl compared to combining Tailscale with a separate reverse proxy. However, Tailscale's mesh networking excels for peer-to-peer device connectivity without a central resource catalog. Cloudflare Tunnel offers simpler deployment for pure web applications but lacks Pangolin's client-based private resource access and cannot be self-hosted. Pangolin's AGPL-3 licensing requires careful compliance review for commercial derivative works, whereas Tailscale's open components carry more permissive terms.

FAQ

What license applies to fosrl/pangolin?

Dual-licensed under AGPL-3 (Community Edition) and Fossorial Commercial License. Commercial license is free for personal use and businesses under $100K gross annual revenue.

Can I self-host without using Pangolin Cloud?

Yes. The Community Edition is fully self-hostable with documentation at docs.pangolin.net.

What protocols does browser-based access support?

HTTPS web applications, VNC, RDP, and SSH terminals directly in the browser.

Does the client support Linux headless servers?

Client downloads are available for Linux; check documentation for headless/automated deployment specifics.

Is WireGuard required on client devices?

Pangolin handles WireGuard internally; users interact through Pangolin clients or browsers, not raw WireGuard configuration.

How does NAT traversal work without open ports?

Site connectors establish outbound tunnels. The control plane coordinates connections without requiring inbound firewall rules.

Where is the full documentation?

Comprehensive documentation lives at docs.pangolin.net, beyond the README summary.

Conclusion

fosrl/pangolin solves a genuinely painful infrastructure problem: providing secure, identity-aware remote access without forcing teams to maintain separate VPN and reverse proxy stacks. Its WireGuard foundation, combined with browser-based and client-based access modes, covers the full spectrum of remote connectivity needs—from web application dashboards to database CLI sessions.

The project is best suited for teams managing distributed infrastructure across multiple networks, organizations with strict zero-trust requirements, and anyone frustrated by the coarse access controls of traditional VPNs. The 21,733 GitHub stars and active 2026 development indicate healthy community interest and ongoing investment.

Self-hosting appeals to privacy-conscious teams and those with compliance requirements preventing third-party cloud services. The managed cloud option removes operational burden for smaller teams or rapid evaluation.

Evaluate Pangolin against your specific access patterns: if your needs are purely web-application focused, simpler alternatives may suffice. If you need unified handling of web UIs, remote desktops, SSH, and database access across fragmented networks, Pangolin's integrated approach warrants serious consideration.

Get started at app.pangolin.net or explore the source at github.com/fosrl/pangolin.