Pangolin

Pangolin is an open-source, self-hosted web app and server that provides identity-based remote access to private and public resources. It combines the functionality of a reverse proxy and a VPN into a single platform to manage connectivity for infrastructure, self-hosted applications, and SaaS tools. The software is deployed as a server and can be installed via a manual self-hosting process, a managed cloud service, or a one-click installer on the DigitalOcean marketplace.

Users can access resources through a web browser for web applications or via a dedicated client for non-web resources. The system uses outbound tunnels to enable connectivity for networks located behind restrictive firewalls, removing the need for public IP addresses or open ports. It is available as a community edition under the AGPL-3 license or a commercial enterprise edition for businesses and hobbyists.

Key features

• WireGuard based connectivity for secure tunnels
• NAT traversal for accessing networks behind firewalls
• Browser-based reverse proxy for web applications
• Client-based access for SSH, RDP, and databases
• Role-based access control (RBAC) for granular permissions
• Integration with external identity providers
• Automatic SSL certificate management
• DNS aliases for friendly resource naming
• Support for multiple connectors to provide redundancy

The architecture follows a zero-trust model, ensuring that users are granted access to specific applications or services rather than entire network ranges. This approach replaces traditional VPNs by requiring identity and context verification before routing traffic. The platform handles routing, load balancing, and health checking for web applications, while the client-based access allows for the management of entire network ranges or specific private resources. It is designed for administrators who need to manage remote access for teams or IoT devices across multiple distributed sites.

Pangolin is a zero-trust network access solution for those who require a mix of clientless web access and full network tunneling.