pangolin README

The project's README from github.com/fosrl/pangolin. As one markdown file: README.md.

Pangolin Logo

Website | Documentation | Contact Us

Discord Slack Docker Stars YouTube

Get started with Pangolin Cloud at app.pangolin.net

Pangolin is an open-source SASE platform, built on WireGuard®, with a simple mission: connect and protect your users, wherever they are. It brings networking and security together as one system including a zero-trust VPN, zero-trust reverse proxy, privileged access management, and an identity-aware AI gateway, all sharing one identity and policy model. It's the same idea behind platforms like Cloudflare One, Zscaler, and Prisma but open, self-hostable, and built to stay light and easy to deploy.

Networking and security that's unified, open, and simple

Legacy SASE platforms got the idea right: connectivity and security belong together. But they delivered it as a heavyweight, closed, cloud-locked stack assembled from years of patchwork. Pangolin exists to do that unification differently, in the open, self-hostable, and simple enough that administrators actually enjoy running it.

Installation

Pangolin

Deployment Options

Key Features

Connect remote networks with sites and NAT traversal

Pangolin's site connectors provide gateways into networks so you can access any networked resources. Sites use outbound tunnels and intelligent NAT traversal to make networks behind restrictive firewalls available for authorized access without public IPs or open ports. Easily deploy a site as a binary or container on any platform.

Sites

Browser-based reverse proxy access

Expose HTTPS web applications and connect to VNC, RDP, and SSH entirely in the browser through identity and context-aware tunneled reverse proxies. Users access resources with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.

Reverse proxy access

Client-based private resource access

Access private resources like SSH servers, databases, RDP, and entire network ranges through Pangolin clients. Intelligent NAT traversal enables connections even through restrictive firewalls, while DNS aliases provide friendly names and fast connections to resources across all your sites. Add redundancy by routing traffic through multiple connectors in your network.

Private resources

Identity-aware AI gateway

Put an identity-aware proxy in front of public cloud (OpenAI, Anthropic, Gemini, etc.) and self-hosted model servers (Ollama, vLLM, Mistral, etc.) so coding agents and AI clients call a single Pangolin URL. Publish it as a public resource with personal API keys, or keep it private on a client tunnel where the connected client is the credential for keyless access. Budgets, session history, and usage analytics sit in front of every call.

AI Session Logs

Give users and roles access to resources

Use Pangolin's built-in users or bring your own identity provider and set up role-based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.

Users from identity provider with roles

Find and launch resources from a personalized home page

Give users a landing page to quickly find and open the resources they can access. Resources are grouped by site or label, searchable, and filterable, with grid or list views. Saved views capture filters, grouping, and layout as personal or organization-wide defaults.

Resource Launcher

Download Clients

Download the Pangolin client for your platform:

Get Started

Sign up now

Create a free account at app.pangolin.net to get started with Pangolin Cloud.

Check out the docs

We encourage everyone to read the full documentation first, which is available at docs.pangolin.net. This README provides only a very brief subset of the docs to illustrate some basic ideas.

Licensing

Pangolin is dual licensed under the AGPL-3 and the Fossorial Commercial License. For inquiries about commercial licensing, please contact us at [email protected].

Contributions

Please see CONTRIBUTING in the repository for guidelines and best practices.

pangolin (fosrl/pangolin)

sso
Searching Database…

23.1K ·GitHub
Pangolin
What is this?Pangolin is an open-source SASE (Secure Access Service Edge) platform built on WireGuard that unifies a zero-trust VPN, reverse proxy, privileged access management, and an identity-aware AI gateway under one identity and policy model.
Is this just a VPN client, or something bigger?It is a full networking-and-security platform, not a single-purpose VPN: it combines a zero-trust VPN, browser-based reverse proxy, RBAC, PAM, and an AI gateway into one self-hosted system.
How do I get Pangolin running?Self-host the free Community Edition using the quick install guide, use the one-click DigitalOcean marketplace installer, or sign up for the fully managed Pangolin Cloud instead of running your own infrastructure.
Do I need my own server, or can I skip infrastructure entirely?Self-hosting the Community or Enterprise Edition requires your own server (Docker-based), while Pangolin Cloud needs no infrastructure at all.
Are all features free, or is something paywalled?The Community Edition is free and AGPL-3 licensed, but the Enterprise Edition's advanced features require the commercial license and are only free for personal use or businesses under $100K revenue.
Which platforms can run the Pangolin client?Dedicated desktop and mobile clients are available for Mac, Windows, Linux, iOS, and Android.
Can I see how my traffic and access decisions are handled?Yes, the code is fully open and auditable, so you can inspect exactly how traffic is routed and how access decisions are made instead of trusting a closed cloud control plane.
What does the AI gateway feature actually do?It is an identity-aware proxy that lets AI clients and coding agents like Claude Code, Codex, and OpenCode call a single Pangolin URL to reach both cloud models (OpenAI, Anthropic, Gemini) and self-hosted models (Ollama, vLLM, Mistral), with budgets, keyless client auth, and usage analytics.
Can users reach private apps without installing a VPN client?Yes, the browser-based reverse proxy lets users open HTTPS apps, VNC, RDP, and SSH sessions directly in a browser with single sign-on, no client install required.
How does Pangolin reach devices behind restrictive firewalls?Site connectors establish outbound WireGuard tunnels with intelligent NAT traversal, so networks behind firewalls are reachable without open ports or a public IP.
How granular is access control?Access is granted per resource rather than per network, using RBAC and identity provider integration, so users only reach the specific apps and routes you define instead of the whole network.
What are similar projects?netbird, casdoor, authentik, bifrost, cloudflared, jumpserver, infisical, os
Which topics is it in?pam, wireguard-vpn, nat-traversal, zero-trust, gateway, ai-gateway, wireguard, oidc, remote-access, sso, rbac, reverse-proxy
Creator
fosrl
Size
91.2 MB
Stars
23.1K
Updated
CommitOct 16Release1.24.0Sep 30
Age
2y
Commits · 90 Days