Skip to content
SPECIFICTION
Get listed

Pangolin

pangolin.net

From $4/mo Free plan Open source WebWindowsmacOSLinuxiOSAndroid
Visit pangolin.net
Spec score 8.9 #1 of 24 in Secure Access Service Edge Software

What it is

Pangolin combines a WireGuard-based VPN, reverse proxy, privileged access management, and identity-aware AI Gateway in an open-source security and networking platform. Administrators use identity and resource-level policies to grant users access to specified apps, hosts, and network ranges. WireGuard tunnels and NAT traversal let connected sites keep inbound firewall ports closed. The AI Gateway routes provider-native API requests to cloud and self-hosted models, with identity controls, budgets, session history, and usage analytics. Listed integrations include OpenAI, Anthropic, Google Gemini, Amazon Bedrock, Vertex AI, Microsoft Foundry, OpenRouter, Vercel AI Gateway, Ollama, and vLLM. Pangolin offers Cloud and self-hosted options, with clients for macOS, Windows, Linux, iOS, and Android. The free Basic plan supports up to 5 users, 5 sites, 5 domains, 15 public resources, 15 private resources, and 5 machine clients. Team costs $4/user/mo; Business costs $9/user/mo. A 10-day trial is listed.

Spec sheet

What it does
Pangolin combines a WireGuard VPN, reverse proxy, privileged-access management and identity-aware AI gateway under one identity and policy model.Read 15 Oct 2026 · pangolin.net
Product
Pangolin describes itself as an open-source security and networking platform combining a WireGuard-based VPN, reverse proxy, privileged access management, and identity-aware AI Gateway.Read 4 Oct 2026 · pangolin.net
Integrations
Documented integrations include identity providers, SIEM log streaming, Slack or Teams channels, alert notifications and AI model providers.Read 15 Oct 2026 · pangolin.net
Support
The FAQ says community users can ask for help in Slack or Discord, paid Cloud and Enterprise plans include vendor support, and Enterprise includes priority support and an SLA.Read 4 Oct 2026 · pangolin.net
License
Community Edition is AGPLv3, while Enterprise Edition uses the Fossorial Commercial License; both codebases are published on GitHub.Read 15 Oct 2026 · pangolin.net
Access model
Users access only the apps, hosts, and network ranges administrators grant them, using identity and resource-level policies.Read 4 Oct 2026 · pangolin.net
AI Gateway
The AI Gateway routes provider-native API requests to cloud and self-hosted models, with identity controls, budgets, session history, and usage analytics.Read 4 Oct 2026 · pangolin.net
AI gateway controls
AI gateway functions include keyless desktop-client access, personal API keys, model routing, budgets, session history and usage analytics.Read 15 Oct 2026 · docs.pangolin.net
AI integrations
The maker lists OpenAI, Anthropic, Google Gemini, Amazon Bedrock, Vertex AI, Microsoft Foundry, OpenRouter, Vercel AI Gateway, Ollama, and vLLM among supported providers or model endpoints.Read 4 Oct 2026 · pangolin.net
AI providers
The AI gateway supports cloud providers such as OpenAI, Anthropic and Gemini and self-hosted servers including Ollama, vLLM and Mistral.Read 15 Oct 2026 · github.com
API documentation depth
The common-routes guide is explicitly a minimal walkthrough and directs developers to Swagger for complete get, update, delete and list endpoint coverage.Read 15 Oct 2026 · docs.pangolin.net
Browser resources
The platform can publish HTTPS applications and browser-based VNC, RDP and SSH resources with authentication and granular access controls.Read 15 Oct 2026 · github.com
Client platforms
Pangolin lists clients for macOS, Windows, Linux, iOS, and Android; the downloads page specifies macOS Sonoma 14.0+, Windows 10+, iOS 17.0+, and Android 7.0+.Read 4 Oct 2026 · pangolin.net
Client system requirements
Official downloads list macOS Sonoma 14.0 or newer, Windows 10 or newer, most Linux distributions, iOS 17 or newer and Android 7.0 or newer.Read 15 Oct 2026 · pangolin.net
Cloud deployment
Pangolin Cloud runs the dashboard, database, certificates and globally distributed tunnel nodes while customers install sites and clients.Read 15 Oct 2026 · docs.pangolin.net
Company founding
LinkedIn lists Pangolin as founded in 2025.Read 15 Oct 2026 · linkedin.com
Company headquarters
LinkedIn lists New York, New York as Pangolin's headquarters.Read 15 Oct 2026 · linkedin.com
Company legal name
Crunchbase identifies the legal entity as Fossorial, Inc.Read 15 Oct 2026 · crunchbase.com
Company size
LinkedIn lists the company size as 51–200 employees, while Wellfound lists 1–10 people.Read 15 Oct 2026 · linkedin.com
Declarative automation
Blueprints provide declarative configuration for resources and access, suitable for GitOps workflows and CI/CD automation.Read 15 Oct 2026 · pangolin.net
Documentation coverage
The documentation site includes architecture, installation, cloud versus self-hosted guidance, clients, identity providers, logging, alerting, blueprints, clustering and API material.Read 15 Oct 2026 · docs.pangolin.net
Free Enterprise eligibility
Self-hosted Enterprise Edition is free for personal non-commercial use and for small-scale commercial use when annual gross revenue is under $100,000 USD.Read 4 Oct 2026 · pangolin.net
Funding
Wellfound reports a $4.8 million seed round raised on October 1, 2025, with Y Combinator listed as investor.Read 15 Oct 2026 · wellfound.com
Identity integrations
Pangolin supports OAuth2/OIDC providers such as Authentik and Keycloak, plus Google and Microsoft Entra ID integrations on Cloud and Enterprise Edition.Read 4 Oct 2026 · docs.pangolin.net
Identity providers
Pangolin supports built-in identities or external identity providers, with synchronization of users and roles and role-based access control.Read 15 Oct 2026 · github.com
Limit: exit-node control
A Reddit discussion says administrators could not yet force exit-node use on clients without user interaction, with server-side enforcement described as roadmap work.Read 15 Oct 2026 · reddit.com
Limit: infrastructure requirement
The independent tester said Pangolin worked best with a VPS or cloud server having a public IPv4 or IPv6 address, plus a domain and DNS records.Read 15 Oct 2026 · technat.ch
Limit: not a full mesh
Reddit commenters describe Pangolin as hub-and-spoke, with spokes not directly communicating with each other, unlike mesh-oriented alternatives.Read 15 Oct 2026 · reddit.com
Limit: operational burden
Reddit users note that Pangolin and NetBird require an externally reachable VPS or similar setup, which adds technical maintenance and hosting cost.Read 15 Oct 2026 · reddit.com
Network
Pangolin uses WireGuard tunnels and NAT traversal so inbound firewall ports at sites can remain closed.Read 4 Oct 2026 · pangolin.net
Notable release
Pangolin 1.21, dated July 20, 2026, added same-network peer-to-peer detection, pending-site provisioning improvements and identity-aware share-token sessions.Read 15 Oct 2026 · pangolin.net
Open-source licensing
The FAQ says Community Edition uses AGPLv3 and Enterprise Edition uses the Fossorial Commercial License; both are self-hostable.Read 4 Oct 2026 · pangolin.net
Praise: deployment
Y Combinator describes Pangolin as a streamlined alternative to Cloudflare Tunnels, Zscaler ZPA and Ngrok with simple secure exposure of private applications.Read 15 Oct 2026 · ycombinator.com
Praise: self-hosting
Y Combinator's company profile highlights full self-hosting, hybrid deployment and cloud deployment options, including customer-operated Pangolin nodes.Read 15 Oct 2026 · ycombinator.com
Praise: usability
An independent tester reported that Pangolin solved the difficult homelab problem of exposing services securely and could run on a small VPS.Read 15 Oct 2026 · technat.ch
Private resources
Clients can reach SSH servers, databases, RDP services, hosts, ports and CIDR ranges through private resources and DNS aliases.Read 15 Oct 2026 · github.com
Public API
The integration API uses API keys supplied as Bearer tokens and supports creating and managing sites, resources and targets.Read 15 Oct 2026 · docs.pangolin.net
Security certifications
The company says it maintains ISO 27001 and SOC 2 Type II certifications.Read 15 Oct 2026 · pangolin.net
Self-hosting
Self-hosted deployments require an operator-supplied public IP, domain and listener ports, with the operator responsible for updates, backups, certificates and uptime.Read 15 Oct 2026 · docs.pangolin.net
Site connectors
Lightweight site connectors use outbound tunnels and NAT traversal to expose networks behind restrictive firewalls without public IPs or inbound ports.Read 15 Oct 2026 · github.com
Support channels
The plan comparison lists community support for lower tiers, ticket support, email support, tailored priority support, signed SLAs and Slack or Teams channels for higher tiers.Read 15 Oct 2026 · pangolin.net
Zero-trust access
Access is granted per resource rather than to an entire network, with users reaching only applications, hosts or ranges explicitly allowed by policy.Read 15 Oct 2026 · pangolin.net

Plans and prices

Basic Free 5 users · 5 sites · 5 domains · 1 organization · 15 public resources · 15 private resources · 5 machine clients Read 15 Oct 2026 · pangolin.net
Community Edition Free Free self-hosted core · Sites, resources, users · Community support · AGPLv3 Read 4 Oct 2026 · pangolin.net
Team $4 a month per user per month 50 users · 50 sites · 50 domains · 1 organization · 150 public resources · 150 private resources · 25 machine clients · SSO · RBAC · audit logging · device posture Read 15 Oct 2026 · pangolin.net
Business $9 a month per user per month 250 users · 250 sites · 100 domains · 5 organizations · 750 public resources · 750 private resources · 100 machine clients · SSO auto provisioning · device approvals · advanced SSH · custom branding Read 15 Oct 2026 · pangolin.net
Enterprise Priced on request custom limits · SIEM log streaming · premium relay nodes · priority support and SLA Read 15 Oct 2026 · pangolin.net

Every Pangolin plan and price →

Strong points and limits

Strong points

  • WireGuard tunnels and NAT traversal can keep site firewall ports closed.
  • AI Gateway includes budgets, session history, and usage analytics.
  • Clients are listed for desktop and mobile platforms.
  • Free Basic plan includes up to 5 users and 5 sites.

Limits

  • Team is limited to 50 users and 50 sites.
  • Business costs $9/user/mo.
  • Enterprise pricing is custom and not listed.

Who it suits

Pangolin suits teams that need policy-controlled access to apps, hosts, or networks, including access to cloud or self-hosted AI models. It also offers self-hosting for people or organizations that need it.

Pangolin in depth

Read the full write-up

Pangolin is a network-access and security platform for teams that need to govern who can reach particular resources, with an AI Gateway for controlling model API use. It is strongest for organizations that want those controls alongside self-hosting or cloud deployment; teams seeking only a basic VPN may find its broader scope unnecessary.

Its free entry points and per-user paid tiers make it possible to start small, but user and resource caps matter as deployments grow.

Overview

Pangolin combines a WireGuard-based VPN, reverse proxy, privileged access management, and identity-aware AI Gateway. Administrators grant users access to specific apps, hosts, and network ranges through identity and resource-level policies, rather than giving them blanket network access. That makes it a better fit for environments with differentiated access needs than for users who simply want a general-purpose VPN.

WireGuard tunnels and NAT traversal let sites keep inbound firewall ports closed. This is useful for branch connectivity when opening inbound ports is undesirable. Pangolin is a hybrid product, with self-hosted and cloud options, so teams can choose their deployment approach rather than treating the service as cloud-only.

Key features

Resource-scoped network access

Access can be limited to selected apps, hosts, or network ranges. This reduces the need to expose whole networks to every user and suits teams that need policy-based access across sites. The product's strength is control, not simplicity: a buyer who needs only basic VPN connectivity may be paying in complexity for capabilities they will not use.

AI Gateway

The gateway routes provider-native API requests to cloud and self-hosted models, with identity controls, budgets, session history, and usage analytics. Supported providers and endpoints include OpenAI, Anthropic, Google Gemini, Amazon Bedrock, Vertex AI, Microsoft Foundry, OpenRouter, Vercel AI Gateway, Ollama, and vLLM. This breadth is relevant to teams that want to govern model access and usage across providers; it is less compelling if AI API oversight is not a requirement.

Identity and security

Pangolin supports OAuth2/OIDC providers including Authentik and Keycloak. Google and Microsoft Entra ID integrations are available on Cloud and Enterprise Edition, which is an important edition distinction for organizations standardizing on those identity systems. Pangolin says it maintains ISO 27001 and SOC 2 Type II certifications, a relevant assurance for buyers with security requirements.

Pricing

Pangolin is freemium, with a 10-day trial. Basic is free and allows up to 5 users, 5 sites, 5 domains, 15 public resources, 15 private resources, and 5 machine clients. Those caps suit a small deployment or evaluation, but leave limited room for a growing team.

Community Edition is also free and self-hosted, with sites, resources, users, community support, and AGPLv3 licensing. It is the clearest fit for technically capable users who want the self-hosted core and can rely on community help. The FAQ says self-hosted Enterprise Edition is free for personal non-commercial use and for small-scale commercial use below $100,000 USD in annual gross revenue; that eligibility is distinct from the Community Edition terms.

Team costs $4 a month, billed $4/user/mo, and raises the limits to 50 users, 50 sites, 50 domains, 150 public resources, 150 private resources, and 25 machine clients. It suits smaller organizations that need more capacity than Basic without custom terms. Business costs $9 a month, billed $9/user/mo, and allows up to 250 users, 250 sites, 100 domains, 750 public resources, 750 private resources, and 100 machine clients. The higher caps fit larger deployments, though teams should compare the extra capacity against the per-user price.

Enterprise has custom pricing and custom limits. It adds log streaming for SIEM, premium relay nodes, priority support, and an SLA, making it the tier for organizations that need those operational features and support commitments. Paid Cloud and Enterprise plans include vendor support; community users can seek help in Slack or Discord. Community Edition uses AGPLv3, while Enterprise Edition uses the Fossorial Commercial License; both can be self-hosted, so licensing should be part of the deployment decision.

Platforms

Clients are listed for macOS, Windows, Linux, iOS, and Android. Minimum versions are macOS Sonoma 14.0+, Windows 10+, iOS 17.0+, and Android 7.0+. Pangolin also lists API, web, and self-hosted platforms, giving it a broader deployment footprint than its desktop and mobile clients alone suggest.

Who it's for

Pangolin is a sensible choice for small and midsize teams that want resource-level network access, branch connectivity, and optional AI API governance in one platform. Its free tiers allow limited deployments to start without subscription cost, while Team and Business establish clear per-user expansion points. It is less suited to buyers who need only a conventional VPN, or to organizations whose expected scale exceeds the published paid-tier caps and who do not want custom pricing.

Pros and cons

Pros: Resource-level policies and WireGuard/NAT traversal support controlled site access without inbound firewall ports.

Pros: The AI Gateway combines identity controls with budgets, session history, and usage analytics across cloud and self-hosted model endpoints.

Pros: Free self-hosted Community Edition and free Basic tier give small deployments two different ways to begin.

Cons: Basic and the fixed Team and Business tiers impose user, site, domain, resource, and machine-client caps.

Cons: Google and Microsoft Entra ID integrations are limited to Cloud and Enterprise Edition.

Cons: Enterprise pricing is custom, and Enterprise licensing differs from the AGPLv3 Community Edition.

Alternatives

Secure Access Service Edge Software is the broader category to browse when comparing products across this type of access platform.

Choose Cloudflare One if its free plan's 50-user limit and community forums and Discord support better match your needs; it includes up to 24 hours of standard log retention. Choose Check Point Harmony SASE if you want a paid product with a 30-day trial, rather than Pangolin's 10-day trial.

Sangfor EasyConnect is another paid alternative, with pricing available by contacting Sangfor. WatchGuard FireCloud is worth comparing if a one-year license is preferable: its 1–50 license tier costs $97.75 a year per user license.

Consider Zscaler Private Access if its Essentials Platform's limited private access for 5% of users fits the intended deployment. Fortinet Unified SASE, Broadcom Symantec SASE, and Cato SASE Platform are also alternatives, with pricing available by request or not published.

Verdict

Choose Pangolin if you need tightly scoped access across sites and want an AI Gateway in the same platform, particularly if self-hosting or a free starting tier matters. Its combination of network controls and model-use governance is the reason to choose it; look elsewhere if you only need a basic VPN, need Google or Entra integration outside Cloud or Enterprise, or expect to outgrow the fixed paid-tier limits without accepting custom Enterprise pricing.

Verdict

Pangolin combines network access controls with an AI Gateway and supports both cloud and self-hosted deployment. Check the plan limits and licensing terms against your intended use.

Where Specifiction places it

Alternatives to PangolinAll alternatives →