Pangolin

Overview

Pangolin combines a WireGuard-based VPN, reverse proxy, privileged access management, and identity-aware AI Gateway. Administrators grant users access to specific apps, hosts, and network ranges through identity and resource-level policies, rather than giving them blanket network access. That makes it a better fit for environments with differentiated access needs than for users who simply want a general-purpose VPN.

WireGuard tunnels and NAT traversal let sites keep inbound firewall ports closed. This is useful for branch connectivity when opening inbound ports is undesirable. Pangolin is a hybrid product, with self-hosted and cloud options, so teams can choose their deployment approach rather than treating the service as cloud-only.

Key features

Resource-scoped network access

Access can be limited to selected apps, hosts, or network ranges. This reduces the need to expose whole networks to every user and suits teams that need policy-based access across sites. The product's strength is control, not simplicity: a buyer who needs only basic VPN connectivity may be paying in complexity for capabilities they will not use.

AI Gateway

The gateway routes provider-native API requests to cloud and self-hosted models, with identity controls, budgets, session history, and usage analytics. Supported providers and endpoints include OpenAI, Anthropic, Google Gemini, Amazon Bedrock, Vertex AI, Microsoft Foundry, OpenRouter, Vercel AI Gateway, Ollama, and vLLM. This breadth is relevant to teams that want to govern model access and usage across providers; it is less compelling if AI API oversight is not a requirement.

Identity and security

Pangolin supports OAuth2/OIDC providers including Authentik and Keycloak. Google and Microsoft Entra ID integrations are available on Cloud and Enterprise Edition, which is an important edition distinction for organizations standardizing on those identity systems. Pangolin says it maintains ISO 27001 and SOC 2 Type II certifications, a relevant assurance for buyers with security requirements.

Pricing

Pangolin is freemium, with a 10-day trial. Basic is free and allows up to 5 users, 5 sites, 5 domains, 15 public resources, 15 private resources, and 5 machine clients. Those caps suit a small deployment or evaluation, but leave limited room for a growing team.

Community Edition is also free and self-hosted, with sites, resources, users, community support, and AGPLv3 licensing. It is the clearest fit for technically capable users who want the self-hosted core and can rely on community help. The FAQ says self-hosted Enterprise Edition is free for personal non-commercial use and for small-scale commercial use below $100,000 USD in annual gross revenue; that eligibility is distinct from the Community Edition terms.

Team costs 4.00 USD per month, billed $4/user/mo, and raises the limits to 50 users, 50 sites, 50 domains, 150 public resources, 150 private resources, and 25 machine clients. It suits smaller organizations that need more capacity than Basic without custom terms. Business costs 9.00 USD per month, billed $9/user/mo, and allows up to 250 users, 250 sites, 100 domains, 750 public resources, 750 private resources, and 100 machine clients. The higher caps fit larger deployments, though teams should compare the extra capacity against the per-user price.

Enterprise has custom pricing and custom limits. It adds log streaming for SIEM, premium relay nodes, priority support, and an SLA, making it the tier for organizations that need those operational features and support commitments. Paid Cloud and Enterprise plans include vendor support; community users can seek help in Slack or Discord. Community Edition uses AGPLv3, while Enterprise Edition uses the Fossorial Commercial License; both can be self-hosted, so licensing should be part of the deployment decision.

Platforms

Clients are listed for macOS, Windows, Linux, iOS, and Android. Minimum versions are macOS Sonoma 14.0+, Windows 10+, iOS 17.0+, and Android 7.0+. Pangolin also lists API, web, and self-hosted platforms, giving it a broader deployment footprint than its desktop and mobile clients alone suggest.

Who it's for

Pangolin is a sensible choice for small and midsize teams that want resource-level network access, branch connectivity, and optional AI API governance in one platform. Its free tiers allow limited deployments to start without subscription cost, while Team and Business establish clear per-user expansion points. It is less suited to buyers who need only a conventional VPN, or to organizations whose expected scale exceeds the published paid-tier caps and who do not want custom pricing.

Pros and cons

• Pros: Resource-level policies and WireGuard/NAT traversal support controlled site access without inbound firewall ports.
• Pros: The AI Gateway combines identity controls with budgets, session history, and usage analytics across cloud and self-hosted model endpoints.
• Pros: Free self-hosted Community Edition and free Basic tier give small deployments two different ways to begin.
• Cons: Basic and the fixed Team and Business tiers impose user, site, domain, resource, and machine-client caps.
• Cons: Google and Microsoft Entra ID integrations are limited to Cloud and Enterprise Edition.
• Cons: Enterprise pricing is custom, and Enterprise licensing differs from the AGPLv3 Community Edition.

Alternatives

Secure Access Service Edge Software is the broader category to browse when comparing products across this type of access platform.

Choose Cloudflare One if its free plan's 50-user limit and community forums and Discord support better match your needs; it includes up to 24 hours of standard log retention. Choose Check Point Harmony SASE if you want a paid product with a 30-day trial, rather than Pangolin's 10-day trial.

Sangfor EasyConnect is another paid alternative, with pricing available by contacting Sangfor. WatchGuard FireCloud is worth comparing if a one-year license is preferable: its 1–50 license tier costs 97.75 USD per year per user license.

Consider Zscaler Private Access if its Essentials Platform's limited private access for 5% of users fits the intended deployment. Fortinet Unified SASE, Broadcom Symantec SASE, and Cato SASE Platform are also alternatives, with pricing available by request or not published.

Verdict

Choose Pangolin if you need tightly scoped access across sites and want an AI Gateway in the same platform, particularly if self-hosting or a free starting tier matters. Its combination of network controls and model-use governance is the reason to choose it; look elsewhere if you only need a basic VPN, need Google or Entra integration outside Cloud or Enterprise, or expect to outgrow the fixed paid-tier limits without accepting custom Enterprise pricing.