Endpoints & Relays

Use this page when you need to allowlist Pangolin in a corporate firewall, proxy, or egress policy. Sites, clients, and browsers connect to two classes of infrastructure on Pangolin Cloud: the control plane and points of presence (also called relays).

Control PlaneCopy Anchor Link

The control plane is the central Pangolin service that runs the dashboard, REST API, authentication, and configuration orchestration.

Sites and clients use this hostname as their endpoint. For example, Sites connect here to register, receive policy, and maintain their control channel.

Points of PresenceCopy Anchor Link

Points of presence (PoPs), also called relays, are the networking edge where sites and clients connect for data traffic.

What PoPs DoCopy Anchor Link

• Public resources send all traffic through a PoP.
• Private resources use PoPs to coordinate NAT traversal between a client and a site. If hole punching fails, traffic relays through the PoP instead.

Pangolin sites and clients automatically select the most optimal PoP to connect to. You do not choose a PoP manually during normal operation.

Remote NodesCopy Anchor Link

If you use remote nodes, the point of presence (relay) for your traffic is your self-hosted node, not the cloud PoPs listed above.

The control plane endpoint for dashboard access, API calls, and authentication remains app.pangolin.net.

Whitelisting ChecklistCopy Anchor Link

To allow Pangolin Cloud on an outbound firewall or proxy, permit traffic to:

1. app.pangolin.net for the control plane
2. All *.pop.pangolin.net hostnames listed above for site and client data traffic

If you use remote nodes, also allow traffic to your remote node's public hostname or IP address.