Show HN: Pangolin – Open source alternative to Cloudflare Tunnels • Hacker News Board

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#81

Post by fossorialowen » Fri, Jul 11, 2025, 4:46 PM UTC

meteyor wrote: post #72

Let’s say my server is running on a VPN and gets new IP once in a while. Would Pangolin be an option to publicly expose my services? Because I have this challenge now where I am currently ”forced” to expose my public IP to share some services. I use firewall rules to allow incoming traffic to my server and Traefik to route the user to the right service. I just don’t like the feeling of being exposed publicly like thi…

Yes! Most people I think rent a VPS (some can be had for like $1 a month) and install this. Because it tunnels back to your network your network can be anywhere behind anything and it should hole punch to it. And because the public is visiting the public address of the VPS your network is hidden behind that!

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#82

Post by fossorialowen » Fri, Jul 11, 2025, 4:52 PM UTC

djlameche wrote: post #29

Sorry if this is a noobish question, but would this allow me to access services on a VPS, that I do not want publicly accessible on the internet? In other words: Let's say I have a VPS with eg. Keycloak running on it. I want to be able to access it for management purposes but don't want it exposed to other people on the internet. Would Pangolin be a way for me to do this?

Good advice in this thread. If its just you then ssh tunnels or tailscale or netbird or pure wireguard are all fine. You could use Pangolin for this and put auth in front of the web page of Keycloak using a local Pangolin site and that would be fine too. It depends on how important the security is to you and who else might want access.

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#83

Post by fossorialowen » Fri, Jul 11, 2025, 4:55 PM UTC

paffdragon wrote: post #75

paffdragon wrote: post #57

This looks really nice. I have set up something similar just recently with an OPNSense box running DNS, the WireGuard instance and getting a wildcard Let's Encrypt cert that it pushes to my Synology reverse proxy (Nginx). So from my clients I can enable the WG tunnel only on my internal IP range, setting the internal DNS, so I don't have to have my public cert pointing to my IP. It works once setup for my home net. B…

EDIT: Sorry, I misread, Newt is the WireGuard client and is based on wireguard-go if I'm correct.

Yep thats correct. All based on wireguard-go. It is growing in what it can do now but at its core its just a Wireguard wrapper that coordinates with Pangolin to get the tunnel up. It also runs in netstack user space so it does not need kernel permissions to open a port and it's only egress is proxied out with TCP/UDP reverse proxies built in to access what is needed on the network.

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#84

Post by oschwartz10612 » Fri, Jul 11, 2025, 4:55 PM UTC

Dowwie wrote: post #76

Cloudflare tunnels is such a poorly built product. The bar for quality is very low in this category. I struggled to make it work on an dell laptop running ubuntu, over wifi. It worked when I set it up at my home and then failed when it was deployed in the field. I literally had the experience of "well, it worked at my home, let's ship it!". I couldn't recover from the errors, either. So, if you built something that i…

We are coming for them!

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#85

Post by fossorialowen » Fri, Jul 11, 2025, 4:55 PM UTC

nicolas_ wrote: post #12

Everyone on /r/homelab has been talking about it over the last few months. I bought a VPS and later realized a cheap tiny PC would be better for my use case combined with Proxmox. The next step is configuring a few more services and installing Pangolin on the VPS for easy reverse proxy management. I haven’t used it yet but all in all it looks awesome and the reviews I’ve seen are overwhelmingly positive. Thank you fo…

Thanks!

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#86

Post by jonotime » Fri, Jul 11, 2025, 4:57 PM UTC

noduerme wrote: post #43

jonotime wrote: post #20

Earlier quoted context omitted.

Out of curiosity why not give your sister restricted access to your tailnet instead? Then nothing is public.

Tailscale and Plex do not play nicely, particularly since Plex implemented a bunch of shit to try to charge users for accessing their own files outside what it considers a local network. Switching to Jellyfin is on my maintenance list. It's very understandable that if you had given a family member access to your Plex server before this year and it "just worked" you might look now at Tailscale as a way to put them on…

Ah ok. Admittedly I dont host a media server so it sounds like Plex brings new challenges.

I would just prefer to not have to public expose a service for a single user. In my case when sharing an image server to family it has been easy enough to walk them through installing tailscale on their windows desktop that they use. I love adding friends and fam to my tailnet. It then also makes it easier to log in and troubleshoot their issues later too.

It looks like CFs solution for restricted public access is CF access controll, but thats still publicly exposed. Their non-public option is WARP, but that requires installation on the client machine. At that point your user setup is even harder then tailscale.

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#87

Post by fossorialowen » Fri, Jul 11, 2025, 4:57 PM UTC

lucyv wrote: post #77

Is it called Pangolin because pangolin's have scale-y tails?

Yes and they are a "Fossorial" animal. A fossorial animal is one that is adapted to digging and which lives primarily (but not solely) underground. It was kind of a fun name to call out the tunneling. Fossorial is our company name.

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#88

Post by fossorialowen » Fri, Jul 11, 2025, 4:57 PM UTC

PoKeRGT wrote: post #23

I have been using pangolin for a few months already and it's awesome. Installed in a small VPS (static IP) as an entry point for all the services I want to expose to friends and family from my homelab (dynamic IP), completely secure and very easy to manage.

Great good to hear!

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#89

Post by fossorialowen » Fri, Jul 11, 2025, 4:59 PM UTC

raphinou wrote: post #32

Did you get outside contributions yet? I'm asking because it is dual licensed agpl and commercial (just like a recent project I'm working on), and am wondering how contributors react to the cla. Btw I like your short and clear CLA! Did you check the wording of the cla with a lawyer? In my project I wanted to replace the perpetual license granted by contributors by 'a license granted as long as the software is also pr…

Yes we have had some PR and some active ones that we need to merge soon haha.

We have not had any concern about the CLA that we are aware of. It was important that we found a way to allow businesses to pay for something to fund the project while keeping it free for individual homelabbers so this was one effort in that regard.

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#90

Post by fossorialowen » Fri, Jul 11, 2025, 5:08 PM UTC

oulipo wrote: post #30

"Easily expose services on IoT and edge devices for field monitoring" can you give more details, would this be adapted to IoT devices running on MCUs like ESP32 etc?

It might be a bit too heavy for a MCU like ESPs. IoT we are thinking more like cellular modems, UPSs, cameras - devices that need remote access in the field at remote places that you typically would need a more convoluted VPN setup for.