In short: Pangolin, an open-source remote access platform built on WireGuard, has had a desktop client for Linux with a tray icon and a settings window since 5 November. Until now, Linux users had to use the command line. The interesting part for you: you can run the Pangolin server itself on a small V-Server – your own alternative to cloud services such as Cloudflare One.
What is Pangolin?
Pangolin connects users to applications and servers without exposing them to the open internet. Small connectors (called “sites” in Pangolin) open an outbound tunnel to the Pangolin server. According to the project, the network behind them therefore needs no open ports and no public IP – handy for a home server behind a router, for example.
There are two ways in:
- In the browser: Pangolin acts as a reverse proxy with login and handles SSL certificates. Web apps, but also SSH, RDP and VNC, can be opened in the browser without installing a client.
- With a client: to reach whole networks or services like SSH directly, you use the Pangolin client as a VPN. So far it had a GUI on Windows and Apple devices; on Linux it was command-line only.
The Community Edition is free and licensed under AGPL-3. There is also an Enterprise Edition, which Pangolin says is free for personal use and for businesses with less than USD 100,000 in annual revenue, plus a hosted cloud service.
What the new Linux client does
- Tray menu: log in, connect and disconnect, switch accounts and organizations, pick an exit node and see which sites are connected.
- Settings window with status, accounts, logs and version info. Updates can be installed straight from the tray; the package is checked against a signed update manifest first.
- Same as on Windows: both clients are built from the same code. Admins can set defaults for all users in
/etc/pangolin-client/pangolin.json. - Command line in “companion mode”: with the app installed, the Pangolin CLI uses its login and tunnel, so a command like
pangolin sshworks without a separate login.
Packages are available for Ubuntu 22.04+, Debian 12+, Fedora, openSUSE and Arch, for amd64 and arm64. Since version 0.1.1 (9 November) there is also a .tar.gz for other distributions. RHEL 9 and rebuilds such as AlmaLinux 9 or Rocky 9 are not supported because they lack WebKitGTK 4.1. On KDE Plasma, XFCE, Cinnamon and Budgie the tray icon appears right away; GNOME has no tray and gets a Shell extension you need to enable once (gnome-extensions enable pangolin@pangolin.net, after logging out and back in).
Good to know: the package installs a system service, pangolin-client, that runs as root and manages the tunnel, routes and DNS. The app itself runs as your normal user. Pangolin offers an install script via curl … | sh – if you'd rather not pipe scripts from the web into a shell, download the right package from the downloads page or the GitHub releases and install it with apt, dnf, zypper or pacman.
Running your own Pangolin server
The desktop client is for your own machines. The other side – the Pangolin server with its dashboard – you can host yourself. According to Pangolin you need:
- a Linux server with root access and a public IP (Ubuntu or Debian recommended)
- a domain pointing to the server, e.g.
pangolin.example.com - open ports: 80 and 443 (TCP) plus 51820 and 21820 (UDP) for the WireGuard tunnels
- very little power: the docs say 1 vCPU, 2 GB RAM and 8 GB SSD is enough for most setups, with 2 vCPU, 2 GB RAM and 20 GB SSD recommended.
The installer sets up Pangolin, the tunnel service Gerbil and the Traefik reverse proxy as Docker containers; the docs say this takes two to three minutes. You then create the first admin account in the browser.
What we at NexoraHost say
Pangolin is a good fit for a V-Server: a public IP, root access and Docker are standard there, and the requirements are small. You stay in control of where your logins and your traffic go – on a server in Germany instead of with a big cloud provider. Typical uses: reaching your home server or NAS on the go, putting internal tools online behind a login, or letting admins SSH into servers without leaving SSH open to the internet.
The Linux client is still very new (version 0.1.x). It is already worth using on your laptop, and the command line remains as a fallback. Questions about setting it up on your server? Open a ticket.
V-Server → · Set up WireGuard · Set up Cloudflare Tunnel · Nginx Proxy Manager · Source: Pangolin · heise
More blog articles
Short version: On V-Servers and root servers, traffic is not “unlimited until something happens”. You get an included allowance, you can add extra TB – and anything above that is billed. Current prices live in checkout and the customer area, not locked into the GTC. Here is...
Quick reality check: On Monday the clans come back. Not ten people one after another — twenty at once, Discord open, view-distance on 32 because “you can see further”. The server that held 20 TPS at 03:00 in the holidays with four players sits at 8 TPS at 18:00. Not because...
Quick reality check: A ticket bot and a Paper server with twelve friends on the same VPS is often fine. That same bot plus Lavalink plus Rust on a force wipe is not. Linux will not kill the bot first. Linux kills the process that wants the most RAM in that minute — and durin...