Pangolin vs NetBird

Pangolin and NetBird both use WireGuard, and both come up constantly in "self-host your own networking" threads, so it is easy to assume they compete. They do not. They solve opposite problems — one is about letting the public reach your services, the other is about letting you reach your machines — and the useful question is not "which is better" but "which job am I doing." Quite often the answer is both.

Publishing services vs. private access

Pangolin is about the public front door. It is a tunneled reverse proxy: you run it on a public VPS, point a wildcard domain at it, and it publishes your self-hosted apps to the open internet over an outbound WireGuard tunnel, with built-in identity/SSO and automatic SSL sitting in front. Nothing on your home or lab network needs an inbound port open; the public VPS terminates traffic and forwards it down the tunnel. In other words, Pangolin is a self-hosted alternative to Cloudflare Tunnel — a way to expose services to anyone, safely, on hardware you control.

NetBird is about the private network. It is a mesh VPN that connects your devices and servers into a single encrypted overlay with peer-to-peer links and SSO-gated access — a self-hosted alternative to Tailscale or Twingate. Nothing it does is meant to be public. It is how you reach your own machines from anywhere: SSH to a server, open an internal dashboard, administer a box that should never be exposed to the internet at all.

What they share

It is worth being clear about the common ground, because it is what makes the two so easy to confuse. Both are built on WireGuard, both are self-hosted alternatives to a commercial networking product, and both spare you from opening inbound ports on your home or lab network — the connection is always established outbound, from your network to a server you run. That shared shape is real. The divergence is purely in direction: Pangolin uses the tunnel to carry the public's traffic in to a chosen service, while NetBird uses it to carry your traffic privately between your own devices. Same primitive, opposite purpose.

Why the distinction matters

The two tools imply different threat models and different traffic. Pangolin deliberately puts a service in front of the whole internet, so its job includes authentication, TLS, and acting as a careful reverse proxy — you are inviting strangers in and controlling what they can do. NetBird deliberately keeps traffic private and peer-to-peer, so its job is identity, encryption, and access policy among trusted devices — you are keeping strangers out entirely. Confusing the two leads to real mistakes: exposing an admin panel through a public tunnel when it should have stayed on the private mesh, or trying to share a public status page over a VPN only you can join.

Footprint

Both are modest and both need a public VPS, but they use it differently. Pangolin runs a lightweight dashboard (TypeScript) and a Go data-plane, comfortable on about 1 GB. NetBird runs its management, signal, and relay services and wants roughly 2 GB. Neither is heavy, and in a setup that uses both they can share a single small server or run on separate ones, depending on how you like to isolate things.

Using them together

Because they address different halves of the problem, the most common "advanced" self-hosting setup runs both. NetBird provides private, encrypted access to everything you administer — servers, databases, internal tools — so none of it is ever exposed. Pangolin then publishes the small handful of services that genuinely need to face the public: a blog, a shared app, a status page. The mental model is simple: if a human who is not you needs to open it in a browser, that is a Pangolin job; if it is infrastructure only you and your team should touch, that is a NetBird job.

Which to choose

Reach for Pangolin when the goal is "make this reachable at a public URL." Reach for NetBird when the goal is "let me and my team securely reach our own infrastructure." If you are not sure which you need, start from what you are trying to share and with whom — the public internet, or just yourself. And if the honest answer is "some of each," run both; they compose cleanly, and using the right tool for each service is far safer than bending one of them to do the other's job. Either way, budget for a routable public VPS — the tunnel endpoint for Pangolin, the control and relay servers for NetBird — because both need a box the outside world can reach.