Show HN: Pangolin: Open-source identity-based VPN (Twingate/Zscaler alternative)

18•miloschwartz•12h ago

Pangolin (https://github.com/fosrl/pangolin) is an open-source tool for identity-based remote access to internal resources - an alternative to Cloudflare ZTNA, Zscaler, and Twingate.

It’s different than existing approaches: mesh VPNs (Tailscale, ZeroTier, etc.) create flat overlay networks where ACL and IP space management becomes complex at scale and every device can talk to every other device, while corporate ZTNA solutions (Zscaler, Cato, Netskope etc.) are closed-source and add latency by forcing traffic through a central server.

Pangolin takes a resource-centric approach. You deploy lightweight connectors that bridge to specific resources (private web apps, SSH, databases, CIDR ranges). Admins delegate resource-access to specific users and roles. It uses WireGuard with NAT hole-punching for peer-to-peer connections and traffic goes directly between the user and connector instead of through a central server. It supports native clients (Mac/Windows/Linux/iOS/Android) plus identity-aware, browser-based access when a client isn’t required.

Pangolin has a cloud and is optionally self-hosted. The Community Edition is AGPLv3. The Enterprise Edition is also open-source under the commercial license which enables free personal/small business use.

Everything, from the server to the clients, is fully open-source and you can even self-host the whole stack. We’d love to hear what you think and I'm happy to answer any questions!

Comments

oschwartz10612•5h ago

Co-maintainer here: we also did this cool thing where we reused the same go codebase across our clients. We have a go package called olm (on our Github and following our animal theme) that implements all of the VPN capabilities. It creates the tunnel, monitors the peers, syncs with the Pangolin server. This itself is a binary that can run on its own as like our own little VPN kernel module - then in the different applications we use olm to trigger the tunnel. This is easy on Windows as the whole app is go based, but on Android, Mac, and iOS we use C bindings to compile it as a shared library into the application. Then the native application imports parts of the module to initiate the tunnel and handle the tunneling. On iOS and Macos this is handled in a "Network Extension" which is a secure environment Apple runs tunneling applications in, so we use a unix socket to communicate with the olm tunneling kernel to show status to the user and handle commands.

maxibenner•1h ago

Thank you, great product, can only recommend it! I've been self-hosting it since last year to access my jellyfin home-server from the web. Set up was easy and I never had any issues.

jackhalford•1h ago

What are the advantages of this setup rather than reverse proxying right where your jellyfin is?

jackhalford•1h ago

I was thinking of using this to tunnel all of my public sites, do hide my home ip. But in the end whats the issue of showing my home ip? The attack surface stays the same. I just reverse proxy everything through Caddy.

Also weren’t some feature gated behind the cloud version? An appeal for this to replace cloudflare tunnels and tailscale funnel is the _fully_ opensource aspect

mrsssnake•1h ago

> The Enterprise Edition is also open-source under the commercial license which enables free personal/small business use.

Open Source can be pair or commercial. But the license of these software Enterprise Edition, called "Fossorial Commercial License", is not Open Source. You tell who and how can use the software after the share/sell and call it Open Source.

The main site also advertises "Self Host: Enterprise Edition" as being "100% Open Source" which is simply not true and false advertising.

Ms-J•8m ago

It's how commercial software tries to get big and a lot of undeserved, free goodwill these days.

LtdJorge•1h ago

I replaced CF tunnels, which kept disconnecting every few minutes with it, and happy.

vasilzhigilei•10m ago

Really cool product, impressive how much you've built and the usage you've attained in a short period of time