Repolode
Submit
fosrl

fosrl/pangolin

Open-source, self-hostable SASE platform built on WireGuard that combines zero-trust VPN, reverse proxy, privileged access and an AI gateway.

Open-source alternative to:Cloudflare Zero TrustZscaler

View on GitHubWebsite
Stars
23,200
Forks
807
Open issues
116
Last commit
yesterday

What is it?

Pangolin is an open-source secure access platform that brings networking and security into one system. It combines a zero-trust VPN, a zero-trust reverse proxy, privileged access management (PAM) and an identity-aware AI gateway, all sharing a single identity and policy model. It is positioned as a self-hostable alternative to commercial SASE products.

Sites connect private networks through outbound tunnels and NAT traversal, so resources behind firewalls can be reached without public IPs or open ports. Users reach web applications, VNC, RDP and SSH directly in the browser through authenticated reverse proxies, or connect with the Pangolin client for private resources such as databases and network ranges. Access is granted per resource rather than per network, with identity provider integration, role-based access control and audit logs.

The AI gateway places one Pangolin URL in front of cloud model providers such as OpenAI and Anthropic and self-hosted servers such as Ollama and vLLM. It supports personal API keys or keyless access through the desktop client, along with budgets and usage analytics. A Community Edition is licensed under AGPL-3, and an Enterprise Edition is available under a commercial license.

Key features

  • 01Site connectors create outbound tunnels that reach private networks without public IPs or open ports.
  • 02Browser-based reverse proxy access to HTTPS apps, VNC, RDP and SSH with single sign-on.
  • 03Client-based access to private hosts, port ranges, CIDRs and DNS aliases.
  • 04Privileged access management for SSH resources.
  • 05Identity-aware AI gateway for cloud and self-hosted models with budgets and session logs.
  • 06Role-based access control with identity provider sync and audit logs.

Use cases

  • Giving staff secure access to internal web panels and SSH servers without a public IP or open firewall ports.
  • Replacing a traditional VPN with per-resource access control for remote employees.
  • Providing a single gateway for coding agents and AI clients to reach multiple model providers with usage budgets.
  • Reaching databases and private network ranges from laptops through the Pangolin client.

Quick start

  1. 1

    Sign up for Pangolin Cloud (no installation needed)

  2. 2

    Or self-host by following the quick install guide in the docs

Things to know

  • Self-hosting requires setting up your own server and infrastructure.
  • Enterprise Edition uses a commercial license that is not fully open source.

In collections

Self-hosted apps

Topics

#zero-trust#vpn#reverse-proxy#wireguard#remote-access#sso#ai-gateway#self-hosted#gateway#nat-traversal

FAQ

What is pangolin?
Open-source, self-hostable SASE platform built on WireGuard that combines zero-trust VPN, reverse proxy, privileged access and an AI gateway. Pangolin is an open-source secure access platform that brings networking and security into one system. It combines a zero-trust VPN, a zero-trust reverse proxy, privileged access management (PAM) and an identity-aware AI gateway, all sharing a single identity and policy model. It is positioned as a self-hostable alternative to commercial SASE products.
Is pangolin free to use? What license does it have?
pangolin is open source under the Other license. Check the license terms before using it in commercial products.
Is pangolin still maintained?
Actively maintained. The last commit to pangolin was on Oct 23, 2026.
What can I use pangolin for?
Giving staff secure access to internal web panels and SSH servers without a public IP or open firewall ports. Replacing a traditional VPN with per-resource access control for remote employees. Providing a single gateway for coding agents and AI clients to reach multiple model providers with usage budgets. Reaching databases and private network ranges from laptops through the Pangolin client.
How do I install pangolin?
Sign up for Pangolin Cloud (no installation needed) Or self-host by following the quick install guide in the docs
Where can I get pangolin?
The source code and installation instructions are on GitHub: https://github.com/fosrl/pangolin

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects