Pangolin Self Hosted: A Cloudflare Tunnel Alternative on a 1 GB VPS, Installed and Measured

Pangolin self hosted means running the open-source Pangolin server on a VPS you control, in place of Cloudflare Tunnel. A small agent called Newt on your home server dials out to that VPS over WireGuard, and visitors reach your apps through the VPS with no port forwarding on your home router. You need one Linux VPS with a public IP address, a domain, and three open ports: TCP 80 and 443 plus UDP 51820, with UDP 21820 added only if you use Pangolin's client apps.

In our lab test in October 2026, Pangolin 1.24.0 used 485 MiB of RAM at idle, peaked at 520 MiB on a 1 GB server under load, added about 2.5 ms per request and accepted a 700 MiB upload in one request, about seven times the 100 MB that Cloudflare's Free plan allows. Any of our KVM VPS hosting plans can run it: the 2 vCPU, 2 GB VPS Micro is the comfortable size for most homes, and the 1 vCPU, 1 GB VPS Nano is enough for a few family apps.

Key facts, checked on 17 October 2026:

• The current release is Pangolin 1.24.0 from 30 September 2026 (Pangolin releases), with Newt 1.18.1 from 2 October 2026 (Newt releases) and Gerbil 1.5.2 (Gerbil releases). Its installer pins Traefik v3.7 and the Badger plugin v1.7.0.
• Pangolin is "dual licensed under the AGPL-3 and the Fossorial Commercial License" (fosrl/pangolin). The Enterprise Edition is free for personal use and for organisations under 100,000 USD of yearly revenue, with a licence key (Pangolin docs).
• Pangolin's sizing page calls 1 vCPU, 2 GB of RAM and 8 GB of SSD enough for most deployments, recommends 2 vCPU and 2 GB, and says 1 GB may need swap (Choosing a VPS).
• Cloudflare's maximum upload size is 100 MB per request on the Free and Pro plans, 200 MB on Business and up to 5 GB on Enterprise (Cloudflare error 413 page).
• Cloudflare's Tunnel docs say public hostnames send traffic through Cloudflare's proxy, and that on Free, Pro and Business plans its terms require a paid service for video and other large files (Cloudflare Tunnel routing).

Pangolin vs Cloudflare Tunnel: why people switch, and who should stay

Cloudflare Tunnel is free and clever: its agent, cloudflared, connects out to Cloudflare, which then publishes your home service under your domain. Pangolin works the same way, except that the middle point is a VPS you rent instead of Cloudflare's network. Most of the differences follow from that.

Three of these rows push people to switch:

1. The upload limit. Cloudflare's advice for files over 100 MB is to split them, switch the DNS record to DNS-only (taking Cloudflare out of the path) or upgrade. A photo app like the one in our Immich setup guide hits this with the first long phone video.
2. The media terms. Cloudflare's service-specific terms, last updated 28 September 2026, let it limit the CDN when it serves video or a disproportionate share of large files without its paid media services.
3. Who holds the keys. Cloudflare describes two separate connections, visitor to Cloudflare and Cloudflare to your server, and shows visitors its own edge certificate, so your HTTPS traffic is decrypted on its network.

What you give up is real. Pangolin's self-hosting page puts updates, certificates and uptime on you, and the VPS becomes the front door to your home apps, so you patch it. For a public blog that needs a CDN, Cloudflare is the better tool. For private apps, big uploads and media, a VPS you own fits better.

How Pangolin works, from visitor to home server

Pangolin is a tunneled reverse proxy, also called a self-hosted reverse tunnel: the public entry point runs on your VPS, and the path to your apps runs through a tunnel that your home side opens. Two words from its dashboard come up often. A site is a network you connect, such as your home with Newt running in it. A resource is one app or port on that site that you publish.

This is what happens when someone opens https://photos.example.com:

1. A wildcard DNS record (*.example.com) sends the visitor to your VPS.
2. Traefik answers on port 443 with a Let's Encrypt certificate. It is a reverse proxy: a server that takes requests from the internet and passes each one to the right app.
3. Badger, a Traefik plugin, asks Pangolin whether this visitor may pass. New resources require a login by default: in our test a script without credentials got 401 Unauthorized, and a browser was redirected to the Pangolin login page.
4. Gerbil keeps a WireGuard tunnel to each site. WireGuard is a fast, encrypted tunnel protocol built into the Linux kernel.
5. Newt, on your home server, takes the request out of the tunnel and hands it to the app, for example on 127.0.0.1:8080.

Newt only connects outward, so it works behind CGNAT (carrier-grade NAT, where your provider shares one public IPv4 address between many customers). In our lab the home server dropped every inbound connection, and its app was still reachable. Pangolin's docs now call the connector a "Pangolin Site" and recommend the Pangolin CLI for new sites, but Newt stays supported as the lighter option, and Newt is what we tested.

What a Pangolin self hosted setup needs

One VPS, one domain and one Linux machine at home. Nothing has to be opened on the home router.

• A VPS with a public IPv4 address, running Debian 13 or Ubuntu 24.04. Pangolin recommends 2 vCPU and 2 GB of RAM. Our test stack also kept running at 1 GB, as the numbers below show, but we installed it at 2 GB first; on 1 GB, Pangolin's docs suggest a swap file for installs and updates.
• Disk space for the Docker images: 1.94 GB in our install, 1.64 GB of it for the Pangolin image. The docs call 8 GB of SSD enough for most setups.
• A domain where you can add a wildcard DNS record.
• A home server running Debian or Ubuntu with ordinary outbound internet. It needs no public IP address and no open port.

Pangolin performance: RAM, latency and throughput we measured

In October 2026 we built three Debian 13 containers on our Amsterdam test server: a "VPS" with Pangolin 1.24.0 (2 vCPU and 2 GB, later 1 vCPU and 1 GB, the VPS Nano size), a "home server" with Newt 1.18.1 and nginx, and a "visitor". We used the name lab.test and our own certificate authority instead of a real domain. All three shared one host with other labs, so the numbers show what Pangolin adds on top of your internet path, with some variation.

Memory and disk

A self-hosted Pangolin 1.24.0 stack (Pangolin, Traefik and Gerbil) used 485 MiB of RAM at idle on a 2 GB server in our October 2026 test. After we shrank the same server to 1 GB, it peaked at 520 MiB during the load tests and every test completed. We pulled the images and started the stack on the 2 GB size, though, so on a VPS Nano follow Pangolin's advice and add a swap file before the install and each update. Newt kept the memory from bulk transfers until we restarted it (240 MB after the tests), which matters on a 1 GB Raspberry Pi or a small NAS.

Added latency and request rate

Measured with hey, a small HTTP load tool, over connections kept open. "Login check" means a Pangolin access token sent in request headers, the way scripts pass the login.

Pangolin added about 2.5 ms per request in our test (2.7 ms against 0.2 ms direct), and about 4 ms with the login check. A fresh connection, TLS handshake included, got its first byte after 10.5 to 11.9 ms through the tunnel, against 6.8 to 7.9 ms for Pangolin's own API, which skips the tunnel.

The busiest part was Pangolin's Node.js process, which checks every request: 91% of one core at 645 requests per second, while Gerbil stayed near 0%. Home use rarely comes near the 380 requests per second we got from 1 vCPU, so the smallest size still has headroom.

Throughput through the tunnel

Without the tunnel the same containers moved 26 to 30 Gbit/s. The 1 vCPU VPS was as fast as the 2 vCPU one, because the limit sat at home: Newt runs WireGuard in user space by default (site connector options) and used 1 to 1.5 CPU cores of the home server when sending. Traffic into the home ran at about 1 Gbit/s. On a real line, your home upload speed is usually the tighter limit, well below the 1 Gb/s port on our VPS plans.

Which VPS for Pangolin: plan and city

The size follows your load, and the city follows your home server. Every request makes a detour, visitor to VPS and then VPS to your home, so put the VPS near the home server or near most visitors.

Mix the rows as you need: a family in Germany with three apps is a VPS Nano in Amsterdam. VPS plans have shared vCPUs and VDS plans dedicated ones, and every plan has NVMe storage, unmetered traffic and its own IPv4 and IPv6.

The latency figures are our own ping.pe measurements of 6 October 2026. Probes in Frankfurt and London reached our Amsterdam server in 6.6 and 6.7 ms, a probe in Vienna reached our Prishtina server in 18.6 ms, and a probe in Prishtina needed 36.9 ms to Amsterdam. Skopje is about 3 ms from Prishtina on our own network.

One honest note on media: if the films live at home, your home upload speed caps every stream. For a big library, move the files onto a VDS and run the media server there, as our Jellyfin and Plex streaming guide shows. Availability by city is on the VPS plans page.

How to install Pangolin on a VPS

Start with a fresh Debian 13 or Ubuntu 24.04 VPS. Harden SSH first with our Debian 13 security guide, because this server becomes the front door to your home network.

Step 1: DNS records

At your DNS provider, create an A record for * pointing to the VPS IPv4 address, plus one for the bare domain if you want to use it, as Pangolin's DNS and networking page describes. The dashboard will live at pangolin.example.com.

Step 2: firewall

# as root on the VPS: allow SSH first, or enabling UFW locks you out
apt install -y ufw
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 51820/udp
ufw allow 21820/udp
ufw enable

ufw status should list the five rules for IPv4 and IPv6. A warning we confirmed in the lab: ports published by Docker bypass UFW. Our iperf3 test reached port 5201, which had no UFW rule at all. The ports: list in docker-compose.yml is your real firewall. The installer's file publishes 80, 443, 443/udp (for HTTP/3), 51820/udp and 21820/udp, so delete lines you don't use and check from outside with a port scanner such as nmap. The installer does not publish Traefik's API port 8080, and it was closed from outside in our test.

Step 3: run the official installer

# as root on the VPS
cd /root
curl -fsSL https://static.pangolin.net/get-installer.sh | bash
./installer

The script prints [INFO] Latest version: v1.24.0. The installer then asks these questions, in this order:

If Docker is missing, the installer offers to add it from Docker's own repository. We ran those same commands by hand and got Docker 29.9.1 with Compose v5.6.0. Traefik then fetches certificates over port 80, as our reverse proxy and free SSL guide explains. In the lab we answered No to the last question, swapped Let's Encrypt for our test certificate authority and ran docker compose up -d.

Step 4: first admin and usage statistics

# as root, in /opt/pangolin
docker compose ps
docker compose logs pangolin | grep -A1 "SETUP TOKEN"

The pangolin, gerbil and traefik containers should show Up, pangolin with (healthy); in our lab that took about 11 seconds. The setup token follows Token: in the log. Open https://pangolin.example.com/auth/initial-setup, paste the token, set the admin email and a strong password, and create your organisation.

Telemetry, meaning anonymous usage counts sent to the Pangolin project, was on in the config our installer generated (anonymous_usage: true). The telemetry page lists what it sends: counts of sites, users and resources, traffic volumes and the app version, with identifiers hashed. To switch it off:

# as root, in /opt/pangolin
sed -i 's/anonymous_usage: true/anonymous_usage: false/' config/config.yml
grep anonymous_usage config/config.yml
docker compose restart pangolin

The grep line should now print anonymous_usage: false. We made this edit before the first start; the restart is what applies it on a running stack.

How to expose a home server without port forwarding

In the dashboard, add a site of the Newt type and copy the ID, secret and endpoint it shows. Then, on the home server (Debian or Ubuntu):

# as root on the home server
curl -fsSL https://static.pangolin.net/get-newt.sh | bash

It installs Newt in /usr/local/bin and ends by printing Newt version 1.18.1. Save the three values in a file only root can read, replacing the placeholders and the domain:

# as root on the home server
install -d -m 0755 /etc/newt
cat > /etc/newt/newt.env <<'EOF'
NEWT_ID=your-site-id
NEWT_SECRET=your-site-secret
PANGOLIN_ENDPOINT=https://pangolin.example.com
EOF
chmod 600 /etc/newt/newt.env

Then add the systemd service from the Newt install page, which we used unchanged, and start it:

# as root on the home server
cat > /etc/systemd/system/newt.service <<'EOF'
[Unit]
Description=Newt
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=root
Group=root
EnvironmentFile=/etc/newt/newt.env
ExecStart=/usr/local/bin/newt
Restart=always
RestartSec=2
UMask=0077
PrivateTmp=true

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now newt
journalctl -u newt -n 20 --no-pager

Within a second the log shows Websocket connected and Tunnel connection to server established successfully!, and the site appears online in the dashboard. When we restarted the whole Pangolin stack, Newt reconnected by itself about one second after Traefik came back.

How to publish an app, and a game port if you need one

In the dashboard, add a public HTTP resource, choose a subdomain such as photos, pick your site and set the target as the home server sees the app, for example 127.0.0.1 port 8080. The Newt log then reports Started tcp proxy to 127.0.0.1:8080. The login stays on unless you switch it off. Pangolin also accepts OIDC identity providers; our Authentik vs Keycloak comparison helps if you want to run your own.

For a game server or anything that isn't HTTP, Pangolin has raw TCP and UDP resources. They have no login layer, so the game or service must handle its own security. The docs list an allow_raw_resources: true flag in config/config.yml as the first step, and the installer already sets it, so on a self-hosted server they need two edits and a restart. We tested port 5201 with iperf3; here is the same for Minecraft's port 25565:

# as root, add to /opt/pangolin/docker-compose.yml under the gerbil service's ports:
      - 25565:25565

# as root, add to /opt/pangolin/config/traefik/traefik_config.yml under entryPoints:
  tcp-25565:
    address: ":25565/tcp"

# as root, in /opt/pangolin
docker compose down
docker compose up -d

Then create a TCP resource with public port 25565 and a target on your site. The entry point must be named tcp-PORT (or udp-PORT), as the TCP and UDP resource docs explain. The docs also say to open the port in the VPS firewall; Docker would let it through anyway, but ufw allow 25565/tcp keeps ufw status honest.

Troubleshooting and limits before you rely on it

The site stays offline

Read the Newt log with journalctl -u newt -n 20 --no-pager. A working site shows Websocket connected and Tunnel connection to server established successfully!. While our Pangolin stack was stopped, Newt logged failed to get token and reconnected on its own once the stack was back. If you see that line while the stack is running, check PANGOLIN_ENDPOINT in /etc/newt/newt.env, the DNS record for the dashboard, and that UDP 51820 is open on the VPS.

Scripts get 401, browsers get a login page

That is the default login doing its job. For scripts, create an access token for the resource in the dashboard and send it in the P-Access-Token-Id and P-Access-Token request headers; with them our test requests got HTTP 200.

The dashboard has no valid certificate

Our lab used its own certificate authority, so we did not hit this case. Check the two things it depends on: DNS records that point at the VPS, and an open TCP port 80, which Traefik uses to fetch certificates.

Limits worth knowing

• The installer's traefik_config.yml sets readTimeout: "30m" on port 443, so one upload that takes longer than 30 minutes is cut. At 100 Mbit/s that is roughly 22 GB.
• Pangolin migrates its database on start, and its update guide warns that downgrading is sometimes impossible and not recommended. Copy the config folder before every update.
• If the VPS is down, every published app is down. Our SLA for VPS plans is 99% monthly uptime, so keep a second way in for anything critical.

If you only need private access for yourself, with no public URL, a mesh VPN is simpler: see our Headscale vs NetBird comparison or a plain WireGuard VPN server.

Frequently asked questions

Is Pangolin a good alternative to Cloudflare Tunnel?

Yes, for private apps, large uploads and media. Self-hosted Pangolin runs on your own VPS, so Cloudflare's 100 MB request limit on the Free plan does not apply and HTTPS ends on a server you control; in our October 2026 test a 700 MiB upload passed in one request. Cloudflare is still the better choice for public sites that need a CDN and protection from large DDoS attacks.

What VPS do I need to self-host Pangolin?

Pangolin's docs recommend 2 vCPU and 2 GB of RAM. In our October 2026 test, Pangolin 1.24.0 with Traefik and Gerbil used 485 MiB at idle on a 2 GB server. After we shrank it to 1 vCPU and 1 GB, it peaked at 520 MiB under load, and its Docker images took 1.94 GB of disk. At RS Computers that makes VPS Micro (2 vCPU, 2 GB) the default and VPS Nano (1 vCPU, 1 GB) enough for a few personal apps, with a swap file for installs and updates.

Which ports does Pangolin need?

On the VPS: TCP 80 and 443 for certificates and HTTPS, UDP 51820 for the WireGuard tunnels from your sites, and UDP 21820 only if you use Pangolin clients, plus SSH for yourself. The home server needs no open ports at all, because Newt only connects outward.

Can I expose a home server without port forwarding?

Yes. Newt, Pangolin's site connector, only makes outbound connections to the VPS, so it works behind CGNAT and closed routers. In our lab the home server dropped all inbound traffic with nftables, and its web app stayed reachable through Pangolin.

Is self-hosted Pangolin free?

The Community Edition is open source under the AGPL-3 and costs nothing. The Enterprise Edition is free for personal use and organisations under 100,000 USD of gross yearly revenue, but it still needs a licence key. You still pay for the VPS and the domain.

How much latency does Pangolin add?

About 2.5 ms per request in our October 2026 lab test with connections kept open, and about 4 ms with the login check on. On the internet, the detour from visitor to VPS to home matters more, so choose a VPS city near your home server or your visitors.

Put your first app behind it tonight

Start with one app and the default login, check the Newt log, then add the rest. VPS Micro runs Pangolin with room to spare, and VPS Nano is enough for a small home setup. RS Computers runs KVM VPS and VDS servers in Amsterdam, Dublin and Prishtina with NVMe storage, unmetered traffic and their own IPv4 and IPv6, and you can upgrade later from the client area with a short reboot. Pick a size and city on the VPS hosting plans page, or ask us on Telegram if you want help planning the setup. If you would rather have us install it, setup work is quoted per job on request.

← All articles