| .github | ||
| .vscode | ||
| bruno | ||
| cli | ||
| config | ||
| install | ||
| messages | ||
| public | ||
| server | ||
| src | ||
| test | ||
| .dockerignore | ||
| .editorconfig | ||
| .eslintrc.json | ||
| .gitignore | ||
| .nvmrc | ||
| .prettierignore | ||
| .prettierrc | ||
| blueprint.py | ||
| blueprint.yaml | ||
| components.json | ||
| CONTRIBUTING.md | ||
| crowdin.yml | ||
| docker-compose.drizzle.yml | ||
| docker-compose.example.yml | ||
| docker-compose.pgr.yml | ||
| docker-compose.yml | ||
| Dockerfile | ||
| Dockerfile.dev | ||
| drizzle.pg.config.ts | ||
| drizzle.sqlite.config.ts | ||
| esbuild.mjs | ||
| eslint.config.js | ||
| LICENSE | ||
| Makefile | ||
| next.config.ts | ||
| package-lock.json | ||
| package.json | ||
| postcss.config.mjs | ||
| README.md | ||
| SECURITY.md | ||
| tsconfig.enterprise.json | ||
| tsconfig.oss.json | ||
| tsconfig.saas.json | ||
Start testing Pangolin at app.pangolin.net
Pangolin is an open-source, identity-based remote access platform built on WireGuard that enables secure, seamless connectivity to private and public resources. Pangolin combines reverse proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to private resources like databases and SSH servers, all with zero-trust security and granular access control.
Installation
- Check out the quick install guide for how to install and set up Pangolin.
- Install from the DigitalOcean marketplace for a one-click pre-configured installer.
Deployment Options
| Description | |
|---|---|
| Self-Host: Community Edition | Free, open source, and licensed under AGPL-3. |
| Self-Host: Enterprise Edition | Licensed under Fossorial Commercial License. Free for personal and hobbyist use, and for businesses earning under $100K USD annually. |
| Pangolin Cloud | Fully managed service with instant setup and pay-as-you-go pricing — no infrastructure required. Or, self-host your own remote node and connect to our control plane. |
Key Features
| Connect remote networks with sites Pangolin's lightweight site connectors create secure tunnels from remote networks without requiring public IP addresses or open ports. Sites make any network anywhere available for authorized access. |
 |
| Browser-based reverse proxy access Expose web applications through identity and context-aware tunneled reverse proxies. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet. Users access applications through any web browser with authentication and granular access control. |
 |
| Client-based private resource access Access private resources like SSH servers, databases, RDP, and entire network ranges through Pangolin clients. Intelligent NAT traversal enables connections even through restrictive firewalls, while DNS aliases provide friendly names and fast connections to resources across all your sites. |
 |
| Zero-trust granular access Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications and services you explicitly define, reducing security risk and attack surface. |
 |
Download Clients
Download the Pangolin client for your platform:
Get Started
Check out the docs
We encourage everyone to read the full documentation first, which is available at docs.pangolin.net. This README provides only a very brief subset of the docs to illustrate some basic ideas.
Sign up and try now
For Pangolin's managed service, you will first need to create an account at app.pangolin.net. We have a generous free tier to get started.
Licensing
Pangolin is dual licensed under the AGPL-3 and the Fossorial Commercial License. For inquiries about commercial licensing, please contact us at contact@pangolin.net.
Contributions
Please see CONTRIBUTING in the repository for guidelines and best practices.
WireGuard® is a registered trademark of Jason A. Donenfeld.