Pangolin

Pangolin is an open-source, identity-aware remote access platform built on WireGuard — a single self-hostable app that combines a tunneled reverse proxy, a full VPN, intelligent NAT traversal and zero-trust RBAC in one place. We rate it 83/100 — the cleanest open-source alternative to Cloudflare Tunnels and Tailscale in 2026, provided you are comfortable running a VPS and can live with the userspace WireGuard client being a touch slower than a kernel one.

What is Pangolin?

Pangolin is built by Fossorial, Inc., the team behind the fosrl GitHub org. The first public commits landed in September 2024, and the project has since grown to 20.4k+ GitHub stars, 1,000,000+ deployments worldwide and a $4.7M seed round raised in 2025 to take the team full-time. The latest release at the time of writing is v1.17.1, published on April 14, 2026.

The pitch is simple. If you self-host anything — a home lab, a handful of internal web apps, an SSH jumpbox, a production database behind NAT — getting tunneled, authenticated access has historically meant wiring together at least three tools: a reverse proxy (Traefik, Caddy), a tunnel provider (Cloudflare Tunnel, Tailscale Funnel, ngrok), and an identity layer (Authelia, Authentik, Keycloak). Pangolin rolls all of that into one app with a clean web UI, automatic TLS, OIDC and built-in RBAC — and lets you keep the whole thing on your own infrastructure under an AGPLv3 license.

Key Features of Pangolin

• Site connectors with NAT traversal: Drop a lightweight binary or Docker container (called a "site") on any network — Raspberry Pi, home lab, office server, cloud VPC — and it opens an outbound WireGuard tunnel back to your Pangolin hub. No open ports, no public IPs required. Peer-to-peer connections between clients and sites are established automatically when the network allows it.
• Browser-based reverse proxy: Expose web apps through identity- and context-aware tunneled reverse proxies. Users hit the app through any browser, get OIDC or password/pin authentication, and Pangolin handles routing, load balancing, health checks and automatic TLS certificates with no exposed origin.
• Client-based private resource access: Native Pangolin clients for macOS, Windows, Linux, iOS and Android give VPN-style access to SSH, RDP, databases and whole network ranges — with friendly DNS aliases and automatic NAT traversal through restrictive firewalls.
• Zero-trust RBAC out of the box: Use Pangolin's built-in users or bring your own OIDC identity provider (Google, Microsoft, Authentik, Keycloak, Okta). Grant users access to specific resources — not entire networks — and enforce roles, device posture and audit logging.
• Built on WireGuard: Every tunnel is WireGuard under the hood, so the cryptography is modern, fast and audited. The userspace implementation makes cross-platform clients easy but is slightly slower than the kernel driver on Linux.
• Self-hostable under AGPLv3: The Community Edition is fully open source. Deploy with Docker Compose in under 15 minutes on a $5 VPS, or one-click install from the DigitalOcean marketplace.
• Enterprise controls when you need them: Audit logging, SCIM user provisioning, SSH management, SIEM log streaming, high availability and device approvals are unlocked in the Enterprise Edition.

What Users Say About Pangolin

Sentiment across r/selfhosted, the GitHub issue tracker and independent blog reviews is overwhelmingly positive. Writers at noted.lol and Mikael's BrainDump highlight that Pangolin "fills a genuine gap" — previously you had to stitch Traefik, Authelia and Cloudflare Tunnel together; Pangolin folds all three jobs into one product with a coherent web UI. DB Tech and Pi My Life Up call the setup "seamless" and the dashboard "intuitive".

The honest complaints are worth knowing. Real-world reviewers on leewc.com note that the userspace WireGuard client is less performant than the kernel driver on Linux (though that is mitigable), and that the resource-creation flow initially reads like it has validation errors because of an unclear UX pattern. Multiple GitHub issues flag rough edges around firewall/DNS setup on fresh installs, and the free self-hosted tier is limited to 3 users / 1 site / 25 GB of bandwidth — enough for a homelab, tight for a small business.

Pangolin Pricing

Pangolin has two pricing surfaces: a Pangolin Cloud tier (fully managed) and a self-hosted tier (BYO VPS). Both start free.

Plan	Price	Key Limits
Cloud — Basic	$0 forever	Up to 5 users, 5 sites, 5 domains, custom domains, peer-to-peer, no credit card
Cloud — Team	$4 / user / month	External IDPs, multi-role RBAC, audit logging, device posture, policy enforcement
Cloud — Business	$9 / user / month	Multiple orgs, IDP auto-provisioning, SSH management, device approvals, custom branding
Cloud — Enterprise	Custom	SCIM, SIEM streaming, premium relay nodes, priority SLA
Self-host — Community	$0 (AGPLv3)	Open source, community support, 3 users / 1 site / 25 GB free
Self-host — Starter	$449 / year ($37/mo)	Up to 25 users and sites, all Enterprise features unlocked
Self-host — Scale	$1,249 / year ($104/mo)	Up to 50 users, 100 sites, ticket-based support

For a direct comparison: Tailscale's paid plan starts at $6/user/month, Cloudflare Zero Trust is $7/user/month, and Twingate is $10/user/month — all cloud-only. Pangolin's $4/user/month Cloud Team tier undercuts the category on pricing, and the AGPLv3 self-host path costs $0 forever for any homelabber who can run a VPS.

Who Should Use Pangolin?

Best for: Self-hosters, homelabbers, DevOps engineers and small IT teams who want to replace a messy stack of Cloudflare Tunnel + Authelia + Traefik (or Tailscale + nginx + Keycloak) with one coherent app; MSPs who manage distributed client networks and want zero-trust RBAC they can actually self-host; and any organisation that genuinely prefers AGPLv3 on its own infrastructure over renting from Cloudflare or Tailscale.

Not ideal for: Teams that are already deep into Tailscale's ACL model or Cloudflare Zero Trust's global edge — Pangolin runs on your hub, not a 300-POP CDN, so latency for far-flung users depends on where you place your server. Regulated enterprises that need SOC 2 / ISO certifications, SCIM and signed SLAs should plan on the Enterprise tier or the Business Cloud plan rather than the free self-host.

Pros and Cons

Pros:

• Genuinely open source under AGPLv3 — no fake "open core" with the important bits locked away.
• Collapses reverse proxy + tunnel + VPN + identity into one UI, which is unique in the self-hosted space.
• Built on WireGuard with intelligent NAT traversal — peer-to-peer connections work through restrictive firewalls without opening ports.
• Cloud tier starts free for up to 5 users and undercuts Tailscale, Cloudflare and Twingate on paid pricing.
• 20.4k+ GitHub stars, 1M+ deployments and a full-time team backed by a $4.7M seed — the project is not going anywhere.
• Native clients for macOS, Windows, Linux, iOS and Android.

Cons:

• Userspace WireGuard client is noticeably slower than the kernel driver on Linux.
• Initial firewall and DNS setup on a fresh VPS can trip up first-time self-hosters (the docs are good, but you need to read them).
• The free self-host tier caps at 3 users, 1 site and 25 GB of bandwidth — pushy for small teams.
• No built-in global edge: unlike Cloudflare Tunnels, latency depends on where you deploy your hub.
• Some resource-creation UX is unintuitive and can initially look like a validation error.

Alternatives to Pangolin

Cloudflare Tunnel is the closest hosted equivalent — free and globally edge-distributed, but closed source and requires you to live inside Cloudflare's ecosystem. Tailscale is the polished mesh-VPN king with an excellent ACL model, but its free plan tops out at 3 users and the core control plane is proprietary. Self-hosted open-source peers include Headscale (a community Tailscale control plane, VPN only — no reverse proxy), NetBird (similar mesh VPN, partly open source) and traditional stacks like Traefik plus Authelia — which do the job but require glue work Pangolin eliminates.

Verdict: Is Pangolin Worth It?

Yes. For anyone who self-hosts and has ever duct-taped Cloudflare Tunnel + Traefik + Authelia together to expose a web app with login, Pangolin is the single biggest quality-of-life upgrade of 2026. It is not quite a complete Tailscale replacement — Tailscale's ACLs and the global edge still win for some workloads — but as a unified, AGPLv3, identity-aware remote access hub with a clean web UI, nothing else in the open-source world comes close. We rate it 83/100: a few points shy of outstanding because of the userspace-WireGuard performance gap and some UX rough edges. Start on Pangolin Cloud's free Basic plan or docker compose up the Community Edition this afternoon.

Frequently Asked Questions

Is Pangolin free?

Yes. Pangolin has an AGPLv3-licensed Community Edition you can self-host forever for free, and Pangolin Cloud starts at $0 for up to 5 users and 5 sites with no credit card required. Paid Cloud starts at $4/user/month; paid self-host starts at $449/year.

Is Pangolin open source?

Yes. The Community Edition is AGPLv3 on GitHub at github.com/fosrl/pangolin with 20.4k+ stars. Enterprise features (SCIM, SIEM streaming, HA, device approvals) are under a separate Fossorial Commercial License — free for personal use and for businesses making under $100K USD annual revenue.

How does Pangolin compare to Cloudflare Tunnel?

Cloudflare Tunnel is free, globally edge-distributed and zero-config, but closed-source and tightly coupled to Cloudflare's DNS, auth and edge. Pangolin runs on your own VPS, bundles identity and RBAC, and supports VPN-style private resource access (SSH, RDP, databases) that Cloudflare Tunnel does not — at the cost of slightly more operational work and no global POP network.

How does Pangolin compare to Tailscale?

Tailscale is a polished mesh VPN with excellent ACLs and best-in-class UX, but the control plane is proprietary and the free tier caps at 3 users. Pangolin is fully open-source, adds a first-class reverse proxy and identity layer, undercuts Tailscale on paid pricing at $4/user/month, and can be self-hosted for free — in exchange for more setup work and slightly lower raw throughput on Linux.

Can I self-host Pangolin?

Yes. Self-hosting is the intended default. Run docker compose up -d on any Linux VPS, or one-click install from the DigitalOcean marketplace. The Community Edition is AGPLv3 and free, with paid self-host tiers at $449/year (Starter) and $1,249/year (Scale) unlocking Enterprise features.

Is Pangolin built on WireGuard?

Yes. All tunnels between sites, clients and the hub use WireGuard. The client is a userspace implementation (for cross-platform reach), which is slightly slower than the kernel driver on Linux but still very fast in practice.