Pangolin
lastmod 2025-07-12created 2025-07-121 edits
Tunneled Reverse Proxy Server with Identity and Access Control and Dashboard UI
An open-source alternative to Cloudflare Tunnels
About
- A self-hosted tunneling reverse proxy management server with features similar to Cloudflare Tunnels
- Through WireGuard-based encrypted tunnels, private network resources can be safely exposed to the outside without port forwarding
- Provides a range of authentication and security features, including reverse proxy, reverse authentication and access control, and OAuth2/OIDC support, plus an intuitive web dashboard
- Easy installation and operation through Docker Compose-based deployment, with automation and extensibility through API and plugin integration
- Lets you bypass network restrictions and safely manage resources in a variety of environments such as IoT, homelabs, multi-cloud, and business services
Pangolin overview
- Pangolin is a self-hostable, tunneling-based reverse proxy server that provides centrally managed authentication and access control
- Integrates with the WireGuard userspace client (Newt) and various WireGuard clients, so it can connect securely even in environments restricted by firewalls and NAT
- Internal resources can be exposed to the outside without port forwarding, hiding the public IP and protecting the network
- Sites, users, roles, and resources are easy to manage from the dashboard, with a UI that supports dark mode and mobile
Key features
Reverse proxy over WireGuard tunnels
- Expose network resources without punching holes in the firewall (no open ports needed)
- Integrates with its own WireGuard client (Newt), supports all WireGuard clients
- Automatic SSL certificate (Let's Encrypt) issuance, and support for HTTP/HTTPS and TCP/UDP services
- Built-in load balancing
Authentication and access control
- Centralized authentication system (platform SSO, OAuth2/OIDC, external IdP integration)
- Role-based access control (RBAC), per-resource IP/URL/range settings
- Various additional authentication options such as email OTP, TOTP, PIN codes, and temporary share links
- Systematic management through organization/site/user/role configuration
Intuitive dashboard
- A clean UI for managing sites/resources/users/roles at a glance
- Real-time monitoring of usage and connection status
- Light/dark mode, mobile support
Easy deployment and scalability
- Docker Compose-based installation, supports both cloud and on-premises
- Provides an API and Swagger documentation, can integrate with automation and custom scripts
- Applies WAF and geoblocking through integration with Traefik plugins (CrowdSec, Geoblock) and others
- Unified management of multiple sites from a single central server
Typical use cases
- Exposing web services in environments where port forwarding is restricted (homelab/ISP restrictions)
- Safely serving internal/on-premises and cloud applications to the outside
- Unified IoT network management: securely connecting to and accessing distributed IoT sites from a central server
- Use as a unified reverse proxy/load balancer for multi-cloud and hybrid networks
Differences from similar projects
- Cloudflare Tunnels: similar to a SaaS-based reverse proxy service, but Pangolin is self-hosted, giving full control over the infrastructure
- Authelia: inspired its central authentication and role management
Deployment and license
- Step-by-step guide covering central server deployment with Docker Compose, domain integration, site connection, and resource exposure
- Dual-licensed under AGPL-3 and the Fossorial commercial license