> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pangolin.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Endpoints & Relays

> Pangolin Cloud hostnames for firewall allowlists and network whitelisting

<div />

<Note>
  This page applies to [Pangolin Cloud](https://app.pangolin.net/auth/signup) only. If you self-host Pangolin, see [DNS & Networking](/self-host/dns-and-networking) for the hostnames and ports on your own deployment.
</Note>

Use this page when you need to allowlist Pangolin in a corporate firewall, proxy, or egress policy. Sites, clients, and browsers connect to two classes of infrastructure on Pangolin Cloud: the **control plane** and **points of presence** (also called relays).

## Control Plane

The control plane is the central Pangolin service that runs the dashboard, REST API, authentication, and configuration orchestration.

| Hostname           | Purpose                                                                           |
| ------------------ | --------------------------------------------------------------------------------- |
| `app.pangolin.net` | Dashboard, API, authentication, and WebSocket configuration for sites and clients |

Sites and clients use this hostname as their **endpoint**. For example, Sites connect here to register, receive policy, and maintain their control channel.

## Points of Presence

Points of presence (PoPs), also called relays, are the networking edge where sites and clients connect for data traffic.

| Hostname                   |
| -------------------------- |
| `uranus.pop.pangolin.net`  |
| `mars.pop.pangolin.net`    |
| `earth.pop.pangolin.net`   |
| `jupiter.pop.pangolin.net` |
| `saturn.pop.pangolin.net`  |
| `neptune.pop.pangolin.net` |
| `pluto.pop.pangolin.net`   |
| `mercury.pop.pangolin.net` |
| `erid.pop.pangolin.net`    |

### What PoPs Do

* **Public resources** send all traffic through a PoP.
* **Private resources** use PoPs to coordinate [NAT traversal](/manage/clients/nat-traversal) between a client and a site. If hole punching fails, traffic relays through the PoP instead.

Pangolin sites and clients automatically select the most optimal PoP to connect to. You do not choose a PoP manually during normal operation.

## Remote Nodes

If you use [remote nodes](/manage/remote-node/understanding-nodes), the point of presence (relay) for your traffic is your self-hosted node, not the cloud PoPs listed above.

The control plane endpoint for dashboard access, API calls, and authentication remains `app.pangolin.net`.

## Whitelisting Checklist

To allow Pangolin Cloud on an outbound firewall or proxy, permit traffic to:

1. `app.pangolin.net` for the control plane
2. All `*.pop.pangolin.net` hostnames listed above for site and client data traffic

If you use remote nodes, also allow traffic to your remote node's public hostname or IP address.