Private Resource Access

Browser Access vs. Client Access

Installing the Pangolin Client

Available for Linux, macOS, Windows, iOS, and Android. Install via the dashboard: Clients → Add Client.

curl -fsSL https://pangolin.net/downloads/client-linux-amd64 \
  -o /usr/local/bin/pangolin-client
chmod +x /usr/local/bin/pangolin-client

Use Case: SSH Access

Create a private resource: Type → Private, Protocol → TCP, Target Host → 192.168.1.10, Port → 22, DNS Alias → homeserver.ssh

ssh user@homeserver.ssh

Host homeserver
  HostName homeserver.ssh
  User vanessa
  IdentityFile ~/.ssh/id_ed25519
  Port 22

Then just ssh homeserver. No public ports, no jump hosts.

Use Case: Database Access

Databases stay on private networks. Authorized users connect through Pangolin's encrypted tunnel.

PostgreSQL

Private resource: TCP, Target 192.168.1.20:5432, DNS Alias postgres.home

psql -h postgres.home -U myuser -d mydatabase
# Or connection string:
# postgresql://myuser:mypassword@postgres.home:5432/mydatabase

MySQL / MariaDB

Same pattern with port 3306.

Redis & MongoDB

redis-cli -h redis.home -p 6379
# MongoDB:
# mongodb://mongodb.home:27017/mydb

Access control applies at the tunnel layer — if a user isn't granted access, they can't even reach the port.

Use Case: Remote Desktop (RDP)

Private resource: TCP, Target 192.168.1.30:3389, DNS Alias windows-desktop.home

xfreerdp /v:windows-desktop.home /u:Administrator /p:yourpassword

Works with Windows built-in RDP, Microsoft Remote Desktop on macOS, Remmina on Linux.

Entire Network Range Access

Expose an entire subnet: Private Resource, TCP+UDP, Target 192.168.1.0/24. Connected users can reach any device on that subnet.

TCP Pass-Through

For services like Gitea SSH that need a TCP port on your VPS's public IP:

# TCP Resource: Public Port 2222 → Target localhost:22 on Gitea site

# app.ini
[server]
SSH_DOMAIN = git.yourdomain.com
SSH_PORT = 2222

ufw allow 2222/tcp

Organizing Access at Scale

Create roles with named resource permissions: