Self-host Pangolin

VPN & Mesh Networking

deployed & timed by usprices checked · Jul 2026

A self-hosted tunneled reverse proxy that exposes services on your private network to the internet over WireGuard, with built-in identity, access control, and automatic SSL. A self-hostable alternative to Cloudflare Tunnel that keeps the ingress on a server you own.

Tailscale / yr$96

Self-hosted / yr~$55

You keep$41/yr

Pocket the difference — spin it up on a cheap VPS in minutes.Start free on Kamatera →

Key facts

CategoryVPN & Mesh Networking

LicenseAGPL-3.0

StackTypeScript, Go

Min RAM1024 MB

Dockeryes

Difficulty

What you need

Any VPS with at least 1024 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
About an afternoon — budget time for troubleshooting

Install

Run these commands on your server:

# Pangolin — official interactive installer (needs a domain + wildcard DNS)
curl -fsSL https://static.pangolin.net/get-installer.sh | bash
sudo ./installer
# Traefik serves 80/443; WireGuard on 51820/udp and 21820/udp.
# The installer is a full-screen TUI — answer it at a real terminal.

deploy guideHow to Deploy Pangolin on a VPS vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

An alternative to

Cloudflare Tunnel →Tailscale →

Head-to-head

VPNJul 2026

Pangolin

NetBird

Expose services to the world vs. a private mesh.

Read the verdict →

More in VPN & Mesh Networking

VPN & Mesh NetworkingHeadscale

An open-source, self-hosted implementation of the Tailscale control server — run your own coordination plane for a private WireGuard mesh and keep using the official Tailscale clients, without depending on Tailscale's hosted service.

moderateRead guide →

VPN & Mesh NetworkingNetBird

An open-source WireGuard-based mesh VPN that connects your devices, servers, and clouds into a single private network with SSO and access controls — a self-hostable alternative to Tailscale and Twingate. The client is BSD-3-licensed; the self-hosted control-plane components (management, signal, relay) are AGPL-3.0.

hardRead guide →

VPN & Mesh Networkingwg-easy

The easiest way to run your own WireGuard VPN server, with a clean web UI for adding and managing clients — a self-hosted alternative to Tailscale and commercial VPNs for private access to your network from anywhere.

TypeScriptNode.js

easyRead guide →

Common questions

What is Pangolin a good alternative to?

Pangolin is a self-hosted alternative to Cloudflare Tunnel (and Tailscale Funnel) — it publishes services on your private network to the internet over WireGuard, but the ingress runs on a server you control instead of a third party's edge.

Do I need my own server to run Pangolin?

Yes — Pangolin needs a public VPS with a domain and wildcard DNS. That is the whole point: the tunnel endpoint and SSL termination live on hardware you own, so no external provider sits in front of your traffic.

How much RAM does Pangolin need?

It runs comfortably on a small 1 GB VPS — the dashboard is a lightweight Node/TypeScript app and the data plane (Gerbil) is a small Go service.

Is Pangolin open source?

Yes — Pangolin is AGPL-3.0 for self-hosting, with a separate commercial license available from Fossorial for those who need it.