RamNode logo
    Sign UpLogin
    Tunneled Reverse Proxy

    Deploy Pangolin on RamNode VPS

    Self-hosted tunneled reverse proxy with identity-aware access control. A powerful alternative to Cloudflare Tunnels with encrypted WireGuard tunnels.

    Ubuntu 22.04+
    Docker + WireGuard
    ⏱️ 15-20 minutes

    Key Features

    • • Encrypted WireGuard tunnels through NAT/firewalls
    • • Identity-aware access control (SSO, OIDC, 2FA)
    • • Automatic SSL via Let's Encrypt
    • • Centralized dashboard for multiple sites
    • • Built on Traefik for robust reverse proxy
    • • No port forwarding required on client networks

    Prerequisites

    Before starting, ensure you have:

    VPS Requirements

    • • Ubuntu 22.04/24.04 or Debian 11/12
    • • 1GB RAM minimum (2GB recommended)
    • • 20GB+ SSD storage
    • • Public IPv4 address
    → View Recommended VPS Plans

    Additional Requirements

    • • Domain with DNS management access
    • • Email for SSL certificates
    • • SSH root/sudo access
    • • Basic Linux knowledge
    PortProtocolPurpose
    80TCPHTTP & Let's Encrypt challenges
    443TCPHTTPS traffic
    51820UDPWireGuard tunnel (Gerbil)
    21820UDPClient connections
    2

    Configure DNS Records

    Before installing Pangolin, configure your domain's DNS records:

    TypeNameValuePurpose
    ApangolinYour VPS IPDashboard
    A*Your VPS IPWildcard for apps

    Example Configuration:

    pangolin.example.com → A → 192.0.2.100
    *.example.com → A → 192.0.2.100

    ⚠️ Cloudflare Users: Set proxy status to "DNS only" (gray cloud) to allow Let's Encrypt to issue certificates.

    3

    Install Pangolin

    Connect to your VPS and run the installation:

    Update System
    sudo apt update && sudo apt upgrade -y
    Open Firewall Ports
    sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 51820/udp
sudo ufw allow 21820/udp
sudo ufw reload
    Run Quick Installer
    curl -fsSL https://pangolin.net/get-installer.sh | bash
sudo ./installer

    Installation Prompts:

    1. Base Domain: Your root domain (e.g., example.com)
    2. Dashboard Domain: Subdomain for dashboard (e.g., pangolin.example.com)
    3. Email Address: For Let's Encrypt SSL certificates
    4. Admin Email: Login credentials for the dashboard
    5. Admin Password: Min 8 chars with mixed case, numbers, symbols
    6. Tunneling (Gerbil): Select Yes to enable WireGuard
    7. CrowdSec: Optional intrusion detection
    8. SMTP Settings: Optional email functionality

    ✅ Installation typically takes 2-3 minutes. You'll see a success message with the dashboard URL.

    4

    Complete Initial Setup

    Access and configure your Pangolin dashboard:

    Dashboard URL:

    https://pangolin.yourdomain.com
    1. Open your browser and navigate to your dashboard URL
    2. If you see an SSL warning, wait a few minutes for Let's Encrypt
    3. Complete the setup wizard to create your admin account
    4. Create your first Organization (e.g., "Home", "Lab", company name)

    💡 The dashboard provides centralized management for Sites, Resources, Users & Roles, and Analytics.

    5

    Create a Site

    A Site represents a location where your services run (home server, office, cloud VM):

    1. Click "Sites" in the left navigation
    2. Click "Add Site +" button
    3. Enter a descriptive name (e.g., "Home Server", "Office Network")
    4. Select "Newt Tunnel" as the connection method
    5. Copy and securely save the generated credentials:
      • Newt Endpoint
      • Newt ID
      • Newt Secret Key
    6. Check the confirmation box and click "Create Site"

    ⚠️ Note: The site will show as "Offline" until you install the Newt client on your local server.

    6

    Install the Newt Client

    The Newt client runs on your local server and creates a secure WireGuard tunnel to Pangolin:

    Option A: Docker Installation (Recommended)

    Create Newt Directory
    mkdir -p ~/newt && cd ~/newt
    docker-compose.yml
    services:
  newt:
    image: fosrl/newt
    container_name: newt
    restart: unless-stopped
    environment:
      - PANGOLIN_ENDPOINT=https://pangolin.example.com
      - NEWT_ID=your_newt_id
      - NEWT_SECRET=your_newt_secret
    Start Container
    docker compose up -d

    Option B: Binary Installation

    Install Newt Binary
    curl -fsSL https://pangolin.net/install-newt.sh | bash
    Run Newt
    newt --id YOUR_ID --secret YOUR_SECRET --endpoint https://pangolin.example.com

    ✅ Once Newt connects, your site status will change from "Offline" to "Online" (green).

    7

    Add Resources

    Resources are the individual applications you want to expose through Pangolin:

    1. Click "Resources" in the left navigation
    2. Click "Add Resource +" button
    3. Enter a name (e.g., "Jellyfin", "Nextcloud")
    4. Select the Site where this service runs
    5. Choose "HTTP Resource" for web applications
    6. Enter the subdomain (e.g., "jellyfin" creates jellyfin.example.com)
    7. Click "Create Resource"

    Configure Target:

    • Click "Edit" on your resource
    • Scroll to "Target Configuration"
    • IP Address: Local IP of your service (use localhost if on same machine as Newt)
    • Port: The port your service listens on
    • SSL: Enable if backend uses HTTPS
    ServiceSubdomainTarget IPPort
    Jellyfinjellyfin192.168.1.1008096
    Nextcloudcloud192.168.1.101443
    Home Assistanthome192.168.1.508123
    8

    Configure Authentication

    Pangolin provides multiple authentication methods to secure your resources:

    Available Methods:

    • Platform SSO (default)
    • Username/Password
    • Single Password
    • 6-Digit PIN
    • Two-Factor Authentication
    • Temporary Share Links

    Disable Auth (Public Resources):

    1. Edit the resource
    2. Go to "Authentication" tab
    3. Toggle "Use Platform SSO" off
    4. Click "Save Users & Roles"
    9

    Troubleshooting

    Site Shows "Offline"

    • Verify Newt is running: docker ps | grep newt
    • Check Newt logs: docker logs newt
    • Ensure UDP ports 51820 and 21820 are open on VPS
    • Verify endpoint URL and credentials are correct

    SSL Certificate Issues

    • Ensure DNS records point to your VPS IP
    • If using Cloudflare, disable proxy (use DNS only)
    • Wait a few minutes for Let's Encrypt to issue certificates
    • Check Traefik logs: docker logs traefik

    Cannot Access Resources

    • Verify target IP and port are correct
    • Ensure the service is running on the local network
    • Check Newt can reach target: ping <target-ip>
    • Review firewall rules on the local server

    Updating Pangolin:

    Update to Latest Version
    cd /path/to/pangolin
docker compose pull
docker compose up -d

    🎉 Deployment Complete!

    You now have a fully functional Pangolin deployment on your RamNode VPS. Your self-hosted tunneled reverse proxy provides secure access to your applications without exposing your home network or dealing with port forwarding.

    Official Documentation →More Deployment GuidesView Cloud VPS Plans