Pangolin — an Easy Way to Expose Access to Your Homelab

If you enjoyed this article, you can support the author by becoming a sponsor on Boosty.

If you thought this article would be about the amusing mammal, the pangolin, you were mistaken.

Preface

#

There’s one huge pain point in homelabbing that almost everyone who sets up a home server runs into. At first, everything works “locally”: services run, web interfaces open up, everything looks great, and you’re happy with it. Or so it seems. Then you want to reach your setup from outside — and the circus begins, with port forwarding, NAT, static IPs, dynamic DNS, domain names, and the constant nagging feeling that you’ve left a door ajar somewhere that the entire internet is about to rush through (by the way, if you’re paranoid, that doesn’t mean the entire internet won’t rush through).

That’s where Pangolin comes on stage.

Essentially, it’s a tool that removes the most unpleasant part of the equation — open ports. You don’t have to dig into your router settings, poke around in the firewall, or keep wondering: which port did I forget to close; which one to open; did I disable SSH access; what to do if your services get compromised or your IP address gets exposed, and so on. Pangolin simply sets up a secure tunnel outward and gives you access to your services as if they were already “outside”, while physically everything stays at home.

And that’s its main appeal — it removes the cognitive load: you don’t need to keep the network topology in your head; you don’t need to remember the difference between DNAT and SNAT; you don’t need to worry that yet another service is exposed to the internet without authentication, or with weak authentication (or maybe it’s not weak, but you don’t know, and there’s no one to ask — or if there is, maybe they politely brushed you off, meaning they just stayed silent); that you skimped on your router or fell for an ad, and so on. With Pangolin, you describe exactly what you want to expose — or rather, which service or server — and Pangolin does it carefully and securely.

I also want to point out that finally none of this looks like a pile of hacks crammed into something shapeless and therefore off-putting. There’s a proper interface, understandable logic, and a sense that this isn’t “yet another GitHub project by an enthusiast for enthusiasts”, but a cohesive and, most importantly, stable tool. It doesn’t try to be everything at once — it just solves one specific problem: giving you access to your services without unnecessary hassle (pardon my French).

In effect, Pangolin is a replacement for Cloudflare Tunnels, just without Cloudflare. It’s your own personal app. After all, that’s the whole point of self-hosting, isn’t it?

But of course, you pay for that comfort. And here everyone decides for themselves: either you spend time and nerves manually configuring the network and security — spending time studying the subject and learning the hard way (there’s no way around it) — or you pay for a tool that has already done it for you. Pangolin is exactly the second option.

Ultimately, this is a story less about technology and more about convenience. About that moment when you want everything to just work, without dancing around with a tambourine and constantly checking “did I really close everything,” whether only ports 80 and 443 are open (though depending on your software, there could be more — for example, if we’re talking about SIP). And if you’re already tired of that accompanying nerve-wracking hassle — you’ll probably understand why Pangolin exists at all.

App features

#

If you dig even deeper, what makes Pangolin interesting isn’t that it “works out of the box”, but exactly how it does it. Under the hood is a clear stack of modern networking approaches, neatly assembled into a single whole.

At its core is the idea of tunneling. Instead of accepting incoming connections, your server itself establishes an outgoing connection to an external endpoint. This is an important point: outgoing connections are almost always allowed by ordinary firewalls, so you don’t need to open ports on your router. From there, all traffic to your services is simply forwarded back inward through this tunnel.

On top of that, encryption is used — typically TLS-based. That means the traffic isn’t just “going through some channel” — it’s protected from interception. Essentially, this resembles how VPNs or solutions like Cloudflare Tunnel work: you have a trusted channel, and inside it live your HTTP, SSH, or any other services.

Then proxying kicks in. Pangolin acts as a reverse proxy: it accepts requests from outside and routes them to the right service inside your network. That means you can hang multiple services off a single external entry point, sort out domains, paths, and everything else without touching the network itself.

Of course, there’s a proper authentication system. Instead of hoping that “nobody will find my port” (when it’s, say, 2222), Pangolin bets on access control: who can connect, to exactly what, and under what conditions. This is a popular zero-trust approach.

On top of all that, solutions like this are usually built around an agent model. You have a client (agent) that runs alongside your services, and a controlling part that knows how to publish those services. This allows for centralized access management without configuring each container or server individually.

In the end, Pangolin is an app that simultaneously integrates the Traefik reverse proxy, the WireGuard protocol, CrowdSec, plus the ability to integrate with any well-known IdP and IAM provider. And as the cherry on top — convenient Geo-Blocking, which lets us block incoming connections from places we’re not expecting them from (which is basically everywhere except your country of residence, and maybe one more, possibly, you know what I mean, right?).

I’ve already talked about each of these apps individually, more than once, both in articles and in videos on the channel. But the value of Pangolin is that you don’t need to assemble this construction kit yourself out of Traefik, WireGuard, Crowdsec, Authelia/Authentik, and a couple more components. Everything is already put together and works as a single system.

The cost of deploying the service

#

There’s one nuance with Pangolin that many people miss at the start: it looks “simple” until you start deploying it properly. Because on its own it works out of the box, but for it to work stably, securely, and without surprises, you need to meet a few basic conditions.

1. First, you need a server that’s constantly reachable from the internet. This can be a VPS or any external host with a static IP. That’s where Pangolin will set up its tunnels, and that point will become the “entrance” into your homelab. Without this, none of the magic will come together. Ideally — rent a VPS.

2. Next — a domain. You can technically live without one, but proper HTTPS support, convenient service addresses, and a generally decent UX all start with a domain. Plus you’ll need to configure DNS so it points to your external server.

3. The next point — certificates. Pangolin operates over secure connections, so TLS here isn’t optional, it’s a required element. The good news is that this is usually automated via Let’s Encrypt, and you barely need to do anything by hand — the main thing is that DNS is configured correctly.

4. On your home server side, things are much simpler. All you need to do is run the Pangolin agent, which will establish an outgoing connection. And here’s the key benefit: no open ports, no router changes. The only requirement is that the server can reach the internet.

5. A less obvious part — the network and DNS inside your own infrastructure. If you want everything to look clean and work without hacks, it’s worth thinking through how services will resolve, how you’ll separate internal and external access, and whether there will be any conflicts between them.

6. And of course, basic security. Even if Pangolin itself closes a lot of holes, that’s no reason to run everything with default settings. Passwords, access, restrictions — all of this still matters. Zero trust isn’t just about the tool, it’s also about how you use it.

In the end, deploying Pangolin correctly isn’t about “spin up a container, use it, and forget about the settings.” It’s about the combination of an external server, a domain, proper TLS, and careful, targeted access configuration. If you have all of that, it really does start to feel like a super-app that removes a lot of the usual headaches.

How Pangolin works

#

Main steps

#

Key concepts

#

Pangolin uses several components that work together to provide secure remote access. Each component plays its own role so that only authorized users can access permitted resources.

Pangolin Server

#

The Pangolin Server is the central coordination component of your network. It stores the configuration, manages access policies, and coordinates connections between clients and sites.

Sites

#

Sites connect remote networks to the Pangolin Server via secure tunnels.

Resources

#

Resources are applications, hosts, or network ranges made available to users.

Clients

#

Clients let users connect to resources through a secure tunnel.

Remote Nodes

#

Remote Nodes are your own Pangolin servers, with full manageability and control over the data.

Pangolin system architecture

#

Pangolin consists of several key components that interact with each other to provide secure remote access to services without needing to open ports.

Control Plane

#

The Control Plane is the brain of the system, managing all the components.

Gerbil

#

Gerbil handles the WireGuard tunnels.

Newt

#

Newt is a lightweight client for connecting remote nodes.

Traefik — reverse proxy

#

Routes incoming requests.

Badger

#

Handles authentication and access control.

Installation requirements and installing Pangolin

#

Prerequisites

#

• A Linux server with root access and a public IP
• A domain
• An email for SSL
• Open ports: 80, 443, 51820, 21820

VPS preparation process

#

Basic VPS security setup

#

After getting your VPS, the first step is to do basic security hardening to minimize the risk of unauthorized access. First, you should stop working as the root user and create a separate user with sudo privileges.

Working as root is unsafe, so first we’ll create a new user and add them to the sudo group:

adduser youruser  
usermod -aG sudo youruser

Let’s check that everything works:

su - youruser  
sudo whoami

Configuring SSH (changing the port and disabling root)

#

Open the SSH configuration file:

sudo nano /etc/ssh/sshd_config

Find and change the following parameters:

Port 2222  (ставить такой порт это большая ошибка)
PermitRootLogin no

This will:

• change the default SSH port (22 → any free non-standard port)
• completely disable root login

Disabling password login (highly recommended)

#

For extra protection, it’s recommended to allow only SSH-key-based login:

PasswordAuthentication no

Configuring the firewall (UFW)

#

Install and enable UFW:

sudo apt update  
sudo apt install -y ufw

Allow only the ports Pangolin needs to work:

sudo ufw allow номерпортадляssh,еслитыневключилдоступтолькопоключам/tcp  
sudo ufw allow 80/tcp  
sudo ufw allow 443/tcp  
sudo ufw allow 51820/udp  
sudo ufw allow 21820/udp

Enable the firewall:

sudo ufw enable  
sudo ufw status

Applying SSH changes

#

After making the changes, restart the SSH service:

sudo systemctl restart ssh

Mandatory connection check

#

Before closing your current SSH session, open a new connection and make sure everything works:

ssh youruser@your_ip -p номерпортадляssh,еслитыневключилдоступтолькопоключам

Only close the old session after a successful connection.

DNS configuration

#

Basic DNS records

You’ll need to create A records (or AAAA for IPv6) pointing to your VPS’s IP address.

#

1. Creating a wildcard record

#

Create a wildcard subdomain record for your domain:

• Type: A
• Name: *
• Value: your VPS’s IP address
• TTL: 300 (or default)

This will let any subdomain (for example, app.example.com, api.example.com) point to your VPS.

#

2. Creating a record for the root domain (optional)

#

If you plan to use the root domain as a resource:

• Type: A
• Name: @ (or leave blank)
• Value: your VPS’s IP address
• TTL: 300 (or default)

This record is only needed if you want to use example.com (and not just subdomains).

#

3. Waiting for DNS propagation

#

DNS changes can take anywhere from 5 minutes to 48 hours to propagate worldwide.

Installation process

#

Installing Pangolin using the official script

#

1. Download the installer. This is the simplest procedure. Yes, you can do it all yourself, but that ends up being a lot of manual work with an unclear result, and requires much deeper involvement in the problem.
2. Connect to the server via SSH and run the command:

 curl -fsSL https://static.pangolin.net/get-installer.sh | bash

3. Run the installer

Run the installation with root privileges:

sudo ./installer

The installer places all files in the current directory. You can move it to your desired install folder before running it.

Configuring basic parameters

#

1. The installer will ask for key settings:

• Edition: choose Community Edition or Enterprise Edition
• Base Domain: specify the root domain without subdomains (for example, example.com)
• Dashboard Domain: press Enter for the default value pangolin.example.com, or specify your own domain
• Let’s Encrypt Email: the address for SSL and admin login
• Tunneling: install Gerbil for tunnels (default: yes). You can operate without tunnels, as a standard reverse proxy

2. Email setup (optional) Email functionality can be added later. Default: No (recommended for initial installation) If enabled: specify an SMTP server (host, port, username, password)

3. Starting the installation Confirm the start of installation:

• The installer will download the Docker images (pangolin, gerbil, traefik)
• Containers will start automatically
• The process takes 2–3 minutes depending on your internet speed

4. Installing CrowdSec (optional) The installer will offer to add CrowdSec for extra protection:

• Default: No (recommended for the initial installation)
• If enabled: you’ll need to manage the CrowdSec configuration manually

CrowdSec can be installed later. The basic install already provides a sufficient level of security.

Post-installation configuration

#

After a successful installation, you’ll see a message:

Installation complete!

To finish the initial setup, go to:

`https://pangolin.твойдомен.com/auth/initial-setup`

1. Accessing the dashboard

   Go to the URL shown in the installer output: https://pangolin.твойдомен.com/auth/initial-setup

   The SSL certificate will be configured automatically. The initial validation may take a few minutes, so you may see security warnings in your browser.

2. Creating the administrator account

   Enter the administrator’s email address Set a strong password Confirm the email (if configured)

   Use a unique and complex password — this account has full access to the system.

3. Creating your first organization

   After logging in: Enter the organization’s name and description Click “Create Organization”

You’re now ready to add applications and configure the reverse proxy.

You can see this app being installed in more detail in my video, and this is one of those cases where it’s better to watch once than to read a hundred descriptions.