Understanding Resources
Resources are any network address you want to make available to users
Resources represent the applications, hosts, or ranges you make available for remote access to users. Resources exist on the remote networks of your sites. Users only ever think about connecting to resources and not specific sites. They find and open what they can access from the Resource Launcher.
By default, no resources are made available on sites. Admins must define resources with backend targets, and assign specific access policies before any users can gain access.
Resource Types
There are two categories of resources: public resources and private resources. Each category supports different protocol types suited to how users connect.
Public Resources
- Protocol-aware reverse proxies on the public internet
- Browser-based access for most types (no client required)
- Authentication and access rules on protocol-aware types
Private Resources
- Zero-trust VPN access over the Pangolin client
- Every resource requires authentication
- Not browser-rendered; requires a connected client
Public Resource Types
Public resources create a public proxy on the Pangolin server. The protocol changes per type, but the overall model is the same: traffic enters through Pangolin and is forwarded to your backend on a remote site.
HTTP/HTTPS, SSH, RDP, and VNC are all browser-based. You assign a fully qualified domain name (FQDN) to each resource and users open it in a web browser—no client-side software is required. Pangolin authentication and access rules protect all of these types the same way. You can configure those rules inline on each resource or share them through a resource policy.
AI Gateway also gets a public FQDN, but coding agents call it as an API. Visiting the URL in a browser is how users retrieve a virtual API key, not how they run the workload.
SSH, RDP, and VNC require a Pangolin Site. HTTP/HTTPS, AI Gateway, and TCP/UDP resources can also run on local and basic WireGuard sites.
TCP and UDP are the exception. They do not receive a FQDN. Instead, they bind to a port on the Pangolin server host and act as simple protocol-agnostic pipes to the downstream resource. Because they are not protocol-aware, they do not enforce Pangolin authentication or access rules.
Site Compatibility
Private Resource Types
Private resources require users to connect with the Pangolin client before any traffic can flow. Nothing is exposed on the public internet. Users gain access to all resources their account is permitted to use once connected.
Private resources can only be created on Pangolin Sites.
Private resources function like a zero-trust virtual private network (VPN). Explicit access to resources must be granted for users and roles to be able to access them. For raw TCP/UDP traffic that does not need a public proxy, prefer a private host or CIDR resource over public TCP/UDP resources.
Private resources support aliases for human-readable internal hostnames. When multiple sites can reach the same destination, Pangolin intelligently routes traffic through the healthiest path.
Site Compatibility
Was this page helpful?