fshy

Home / Egress and tunnels

Pangolin

pangolin.net/pricingZero trust overlay with public TCP/UDP ingressegress/pangolinJSONcomparereport an errorprovider JSON

Free allowance
Basic Free: 'Up to 5 users', 'Custom domains', 'All resource types', 'No credit card required.' The limits row reads Users 5, Sites 5, Domains 5, Organizations 1, Public resources 15, Private resources 15, Machine clients 5.
Verdict
paidno free allowance; listed for its price
Cost
no price statedsee Price below
Identity
emailno card, no phone
Binding limit
volume-quotathe software imposes no byte meter; what runs out is the monthly allowance of the host it runs on, and that host is a separate provider
Evidence
documented3 sources; a first-party page was read and the sentence quoted
Freshness
stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
Free tierBasic Free: 'Up to 5 users', 'Custom domains', 'All resource types', 'No credit card required.' The limits row reads Users 5, Sites 5, Domains 5, Organizations 1, Public resources 15, Private resources 15, Machine clients 5.
unit users; metered on identity-count
PriceUSD 0
Limits
  • volume-quota (binding) the software imposes no byte meter; what runs out is the monthly allowance of the host it runs on, and that host is a separate provider source
Identityemail 'No credit card required.' The Cloud account is an email signup; the self-hosted Community Edition needs no vendor account at all.
EgressNo byte allowance is published on any plan. The free tier is metered on users, sites, resources and machine clients, not bytes.; ingress: tcp+udp
free allowance: none published
Interfacecli the dashboard creates the resource and the newt connector joins the site to it
Toolingnewt site connector, browser dashboard, Docker
Composes withThe VPS egress allowance then binds.
ReliabilityTCP and UDP resources 'do not enforce Pangolin authentication or access rules', so the listener is unauthenticated at the proxy layer.
NotesThe count caps have no kind in the seven-value vocabulary, so limits[] is empty and the numbers are in free_stated: 15 public resources is what a reader hits first if they need many services. Three candidate readings of the Cloud/free conflict were tested: (1) the free tier ships raw resources, (2) raw resources are self-hosted only, (3) the docs are stale. The raw-resources page and the Cloud-vs-self-hosted page agree with each other and are dated after the pricing page, so (2) holds and 'All resource types' on the pricing page means the HTTP, SSH, RDP, VNC and AI Gateway families on Cloud.
Evidence notedocumented A live 1 GiB UDP transfer through a raw resource would raise this to measured. No host was stood up.
Parsed numbers
  • has-free-tier 0
  • price USD 0
Evidence 3
datesourcewhat it proved
2026-10-23pangolin.net/pricing'Basic' is 'Free' with 'Up to 5 users', 'All resource types' and 'No credit card required.'; the limits table gives Public resources 15
2026-10-23docs.pangolin.net/manage/resources/public/raw-resources.md'TCP and UDP public resources are protocol-agnostic proxies'; 'each resource binds to a port on the Pangolin server host'; 'This feature is only available in self-hosted Pangolin instances. If you're using Pangolin Cloud, you will need to deploy a remote node.'
2026-10-23docs.pangolin.net/about/pangolin-cloud-vs-self-hosted.md'Public TCP/UDP listeners that bind a port on the Pangolin host are a self-hosted-server feature. On Cloud, deploy a remote node for that.'
More fields 6
wg pathnone
wg detailThe site connector (newt) holds the WireGuard tunnel and no page read documents a .conf export, so only the vendor connector joins. The public listener is a port bound on the server host: 'Clients connect to <pangolin-server>:<port> and traffic is forwarded to the downstream service through a site connector.'
ingresstcp+udp
volume statedNo byte allowance is published on any plan. The free tier is metered on users, sites, resources and machine clients, not bytes.
bytes transityes
transit notetraffic enters the Pangolin server's public port, crosses the WireGuard tunnel to the site, and leaves from the site's own NIC
Unknown values 2
  • per object cap stated: the field does not apply to this kind of offer
  • retention stated: the field does not apply to this kind of offer