Skip to main content
Pangolin combines the capabilities of both a reverse proxy and a VPN into a single platform. It provides reverse proxy functionality through public resources and VPN functionality through private resources, all with zero-trust access control and distributed architecture.

​
What Each Solution Provides

Reverse Proxies expose web applications to the internet. They handle SSL termination, load balancing, and basic authentication. Users access applications through web browsers using domain names. They are usually protocol-aware of HTTPS only. VPNs create encrypted tunnels that give users access to entire private networks as if they were on the local network. Users install client software and connect to a VPN server. Once connected, they can access any resource on the network they have network-level access to. Pangolin provides both capabilities, and several things neither traditional tool does on its own. Public resources are publicly served proxies. That is often a website in a browser, but it can also be an API or an AI Gateway. Private resources work like a zero-trust VPN, giving users access to specific hosts or network ranges when connected with a client.

​
What Pangolin Does Differently

​
Reverse Proxy Capabilities

Pangolin’s public resources function as reverse proxies. They are publicly served, not limited to web browsers. A traditional reverse proxy is usually protocol-aware of HTTPS only. Pangolin understands many protocols, including HTTPS, SSH, RDP, VNC, and AI provider APIs, so identity, access rules, and logging apply to each the same way. HTTP/HTTPS resources expose web applications and APIs through domain names with automatic SSL certificates. A browser is the common client; any HTTP client can call the same FQDN. Identity-aware access control supports SSO, MFA, and rules based on user identity, roles, geographic location, IP addresses, and URL paths. AI Gateway resources are public proxies for LLM APIs. Coding agents call the FQDN instead of the upstream provider. Pangolin authenticates the caller and applies identity, model access, and budgets. See AI Gateway. SSH, RDP, and VNC resources render full sessions in the browser. Users get a terminal, Windows desktop, or VNC display without installing SSH clients or remote desktop software—while still passing through Pangolin authentication first. TCP and UDP resources bind to a port on the Pangolin server for raw protocol proxying when you need a public pipe without a domain name or auth layer. Unlike traditional reverse proxies, Pangolin does not require public IP addresses or open ports on your network. Sites create outbound tunnels to Pangolin, so your applications remain behind firewalls.

​
VPN Capabilities

Pangolin’s private resources function like a zero-trust VPN—but with tighter scope than a traditional VPN. Host and CIDR resources route traffic to specific machines or subnets over the tunnel. Users only reach what you explicitly grant them, with optional per-resource port restrictions—not an entire flat network. Private HTTP/HTTPS resources behave like a reverse proxy that only exists on the tunnel. TLS terminates at your site edge over peer-to-peer transport—the application is never reachable from the public internet, only from connected clients with valid access. Private SSH resources provide terminal access via pangolin ssh, with optional automatic user provisioning from Pangolin identity—no manual key distribution required. Clients work transparently with applications. No application configuration is required. Users connect once and can access all their authorized resources. The client handles routing and establishes encrypted tunnels automatically.

​
Why Pangolin Combines Both

Many organizations need both reverse proxy and VPN capabilities. You might want to expose a customer portal through a browser while also giving developers SSH access to internal servers and a private HTTPS dashboard that never touches the public internet. With Pangolin, you use one platform for all of these. Public resources handle publicly served access: websites in a browser, APIs, AI Gateway resources, and SSH, RDP, and VNC sessions. Private resources handle tunnel-only access to hosts, subnets, internal HTTPS apps, and CLI SSH. Both use the same authentication system, access control policies, and infrastructure. This unified approach simplifies management. You configure users, roles, and access policies once. Those policies apply to both public and private resources. You do not need to maintain separate systems for reverse proxy and VPN access.

​
Infrastructure and Availability

Traditional reverse proxies and VPNs typically run on a single server. If that server fails, all access is lost. They also require public IP addresses and open ports, which adds complexity and security concerns. Pangolin uses a distributed architecture with multiple nodes. If one node fails, traffic automatically routes to another node. Sites create outbound tunnels, so your networks do not need public IP addresses or open ports. When a resource is reachable from multiple site connectors, Pangolin selects the healthiest path based on latency and availability—users connect to the resource, not to a specific site. You can deploy multiple remote nodes for high availability. If your nodes become unavailable, traffic can optionally fail over to cloud infrastructure until you restore service.

​
When to Use Each Solution

Use a traditional reverse proxy if you only need to expose web applications over HTTP/HTTPS, you have a public IP address, and you do not need advanced access control or high availability. Use a traditional VPN if you need broad network access, you can accept the security risks of flat network visibility, and you do not need application-specific access control. Use Pangolin if you need both reverse proxy and VPN capabilities, publicly served APIs and AI gateways, browser SSH/RDP/VNC, private HTTPS with edge TLS termination, granular per-resource access control, multi-site routing, high availability, or outbound-only connectivity without open ports on your networks.