Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Pangolin: Open-source identity-based VPN (Twingate/Zscaler alternative)

github.com

Post reply on HN
Print view View original

21–30 of 30 posts

Re: Show HN: Pangolin: Open-source identity-based VPN (Twingate/Zscaler alternative)

#21

Post by oschwartz10612 »

jauntywundrkind wrote: post #18

Is this there any kubernetes integration? I like the resource based approach; it would be neat to host or consume resources in kubernetes with this.

We have a helm chart for newt (the site connector which goes into K8S) https://artifacthub.io/packages/helm/fosrl/newt! Its pretty basic right now but we have plans to connect RBAC and the API to pull in resources and create secure access for users. Creating resources manually you can use it for remote access to the cluster or for ingress right now though!

Re: Show HN: Pangolin: Open-source identity-based VPN (Twingate/Zscaler alternative)

#22

Post by tamimio »

I never personally tried it but it looks great. My only concern is I have a feeling that in few years it will “discontinue” the open source or community version and now it’s paid only, after it gained all the publicity from free open source users, and there are many cases of this scenario that happened before.

Re: Show HN: Pangolin: Open-source identity-based VPN (Twingate/Zscaler alternative)

#23

Post by mrbluecoat »

oschwartz10612 wrote: post #3

Co-maintainer here: we also did this cool thing where we reused the same go codebase across our clients. We have a go package called olm (on our Github and following our animal theme) that implements all of the VPN capabilities. It creates the tunnel, monitors the peers, syncs with the Pangolin server. This itself is a binary that can run on its own as like our own little VPN kernel module - then in the different app…

Pangolin, Olm, Newt, Gerbil.. I haven't seen that level of animal dedication since the Apple big cats era. Cool tools, though, keep it up!

Re: Show HN: Pangolin: Open-source identity-based VPN (Twingate/Zscaler alternative)

#25

Post by oschwartz10612 »

sureglymop wrote: post #24

So, can I connect an on-prem instance to LDAP for authentication/authorization? I didn't find the word LDAP anywhere when searching the docs.

We do not support LDAP directly right now. We do support any OIDC / OAUTH enabled endpoint though like Entra, Google, Okta. You can use something like Authentik to pull in LDAP users into a OIDC enabled endpoint.

Re: Show HN: Pangolin: Open-source identity-based VPN (Twingate/Zscaler alternative)

#26

Post by ottah »

This is perfect, I've been looking for something like this for my home network. Tailscale requires too much trust and is only partly open-source. Diy wireguard works, but Comcast has starting messing with packets, and our IP changes a lot. A self-hosted vpn to bridge consumer isp and public networks I can put on a vps, is a lot easier to trust.

Re: Show HN: Pangolin: Open-source identity-based VPN (Twingate/Zscaler alternative)

#27

Post by lurking_swe »

maxibenner wrote: post #4

Thank you, great product, can only recommend it! I've been self-hosting it since last year to access my jellyfin home-server from the web. Set up was easy and I never had any issues.

if you don’t mind me asking, any noticeable differences in throughput compared to reverse proxying directly to jellyfin? For example - how well can you stream a 4k video (let’s assume 15mbps bitrate)?

Last time i looked into it i saw zero information in the docs about network performance and what to expect. Which was surprising.

Re: Show HN: Pangolin: Open-source identity-based VPN (Twingate/Zscaler alternative)

#28

Post by RIMR »

Hey, so this pretty much looks like a Tailscale rip-off. Not a competitor, but a straight-up ripoff in the worst possible way.

Tailscale has LONG used Pangolins as a mascot (https://tailscale.com/blog/network-pangolins). They even run a "Pangolin Enthusiast" website (https://tailandscales.com/) that is essentially a demo site for their tutorials. This is an animal with a tail and scales! The branding is very good.

You clearly chose this name to deliberately create brand confusion with Tailscale, and to derail some of their marketing and community branding in your favor. That's scummy behavior by developers who don't have anything to offer but a copy of someone else's work.

If am going to choose between Tailscale, and a project opportunistically attempting to impersonate Tailscale, why would I ever choose the scummy impersonator?

Re: Show HN: Pangolin: Open-source identity-based VPN (Twingate/Zscaler alternative)

#29

Post by Cluelessidoit »

oschwartz10612 wrote: post #3

Co-maintainer here: we also did this cool thing where we reused the same go codebase across our clients. We have a go package called olm (on our Github and following our animal theme) that implements all of the VPN capabilities. It creates the tunnel, monitors the peers, syncs with the Pangolin server. This itself is a binary that can run on its own as like our own little VPN kernel module - then in the different app…

What the hell?! That is AWESOME!!!

Re: Show HN: Pangolin: Open-source identity-based VPN (Twingate/Zscaler alternative)

#30

Post by cranberryturkey »

The resource-centric approach is the right call. I've been running self-hosted infrastructure for my own projects for a while now, and the biggest lesson is that flat networks just don't scale when you start adding services — every new thing you expose becomes another thing to audit.

The NAT hole-punching with WireGuard for P2P connections is interesting. Do you handle cases where both sides are behind symmetric NATs? That's historically been the hardest case for hole-punching, and most solutions end up falling back to relay servers anyway (which defeats the purpose of avoiding centralized traffic).

Also curious about the connector deployment model — is it one connector per resource, or can a single connector bridge multiple resources in the same network segment?

Post reply on HN