Pangolin is an open-source SASE platform, built on WireGuard®, with a simple mission: connect and protect your users, wherever they are. It brings networking and security together as one system including a zero-trust VPN, zero-trust reverse proxy, privileged access management, and an identity-aware AI gateway, all sharing one identity and policy model. It's the same idea behind platforms like Cloudflare One, Zscaler, and Prisma but open, self-hostable, and built to stay light and easy to deploy.
Networking and security that's unified, open, and simple
Legacy SASE platforms got the idea right: connectivity and security belong together. But they delivered it as a heavyweight, closed, cloud-locked stack assembled from years of patchwork. Pangolin exists to do that unification differently, in the open, self-hostable, and simple enough that administrators actually enjoy running it.
- Open source, not a black box: the code is open and auditable, so you can see exactly how your traffic is handled and how access decisions get made, instead of trusting a closed cloud control plane.
- Networking and security as one platform: sites, reverse proxy, client access, RBAC, and the AI gateway share one identity and policy model, so protecting users and connecting them are executed together.
- Lightweight by design: the whole platform is built to stay small and fast: easy to self-host on a small server, with a lightweight, user-space connector that goes in your private networks.
- Enjoyable to use: a clean, modern interface and a setup flow that gets out of your way, so managing access feels simple instead of like fighting a legacy admin console.
- Zero trust from day one: access is granted per resource, not per network, with identity provider integration, role-based access control, and full audit logging.
- Run it your way: self-host the Community Edition for free, step up to the Enterprise Edition for advanced features, or use Pangolin Cloud if you'd rather not manage infrastructure at all.
Installation
- Get started for free with Pangolin Cloud.
- Or, check out the quick install guide for how to self-host Pangolin.
- Or, deploy in minutes from a prebuilt image on AWS or DigitalOcean:
- AWS: Community and Enterprise AMIs for x86 and Graviton. Configure at launch with user-data or CloudFormation.
- DigitalOcean: install from the DigitalOcean marketplace for a one-click pre-configured installer.
Deployment Options
- Pangolin Cloud - Fully managed service with no infrastructure required.
- Self-Host: Community Edition - Free, open-source, and licensed under AGPL-3.
- Self-Host: Enterprise Edition - Open-core, and licensed under Fossorial Commercial License. Free for personal and hobbyist use, and for businesses making less than $100K USD gross annual revenue.
Key Features
Connect remote networks with sites and NAT traversal
Pangolin's site connectors provide gateways into networks so you can access any networked resources. Sites use outbound tunnels and intelligent NAT traversal to make networks behind restrictive firewalls available for authorized access without public IPs or open ports. Easily deploy a site as a binary or container on any platform.
- Lightweight user-space connector runs anywhere
- Punches through any firewall
- Doesn't require open ports or a public IP
- Strict network segmentation
- WireGuard-based
- Get alerts when a device or network resource goes down
Browser-based reverse proxy access
Expose HTTPS web applications and connect to VNC, RDP, and SSH entirely in the browser through identity and context-aware tunneled reverse proxies. Users access resources with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.
- Expose a web panel anywhere
- Access via any web browser
- Single sign-on across all resources
- HTTPS resources
- Remote desktop in the browser with VNC and RDP
- In-browser SSH terminal with privileged access management (PAM)
- PIN codes, passcodes, email OTP, geoblocking, allow-lists, and more
Client-based private resource access
Access private resources like SSH servers, databases, RDP, and entire network ranges through Pangolin clients. Intelligent NAT traversal enables connections even through restrictive firewalls, while DNS aliases provide friendly names and fast connections to resources across all your sites. Add redundancy by routing traffic through multiple connectors in your network.
- Peer-to-peer with intelligent NAT traversal
- Hosts/IPs and port ranges
- Network ranges/CIDRs
- Friendly DNS aliases for network addresses
- Privileged access management (PAM) with SSH resources
- Private HTTPS resources only accessible on the private network
This is the beginning of the README. Read the rest at the original. Read the full README ↗
