Pangolin 1.23 Released: Open-Source VPN and Reverse Proxy Gets High-Availability Clustering

Pangolin 1.23 finally delivers true high-availability for self-hosters — multi-node clustering. This update means building a highly available VPN and reverse proxy no longer depends on external proprietary components, consolidating the entire capability into a single streamlined deployment package.

What Is Pangolin

Pangolin is an open-source, identity-aware remote access platform. Its core goal is to let users securely connect to and authenticate access for applications, infrastructure, and AI workloads in a simple way. It sits between a traditional VPN and a modern zero-trust reverse proxy — handling both network tunneling and identity verification with access control.

For those running self-hosted setups in a homelab or small-to-medium team environment, Pangolin offers a path to secure, controllable remote access without relying on major cloud providers. That's the main reason it's gained traction in the Reddit self-hosting community.

Zero Trust is the key context for understanding where Pangolin fits. Traditional VPN security models are built on the assumption of a "network perimeter": once a user connects via VPN, they're implicitly granted broad access to internal resources. The Zero Trust model flips this assumption — it treats no zone of the network as inherently trustworthy, requiring every access request to be authenticated and authorized with minimal privilege granted. Pangolin's "Identity-Aware" feature is a direct expression of this philosophy: rather than simply establishing a network tunnel, it verifies the requester's identity at the traffic level and makes policy-based decisions on whether to allow access. This aligns with the design philosophy behind commercial zero-trust products like Google BeyondCorp and Cloudflare Access — the difference is that Pangolin is a self-hostable open-source implementation.

High Availability and Clustering: The Core of This Release

High availability (HA) is the most significant change in version 1.23. Pangolin has actually supported grouping multiple server instances into a unified system for some time, with shared state, failover, and geographic distribution. The problem was that this mechanism previously relied on external proprietary components — a custom DNS server and a certificate manager — making deployment quite cumbersome unless you were using Remote Nodes on Pangolin Cloud.

The key improvement in 1.23 addresses exactly this pain point: the team has moved DNS resolution and certificate management directly into Pangolin itself, eliminating the external tools. This means self-hosters can now achieve multi-node clustering — something that previously required stitching together multiple components — with a single, integrated deployment package.

The Practical Value of Clustering

For production environments or any setup with stability requirements, single points of failure have always been the Achilles' heel of self-hosted solutions. Multi-node clustering gives the VPN and reverse proxy fault tolerance: when one node goes down, others can take over traffic, preventing the entire remote access chain from going offline. Geographic distribution also helps optimize latency for cross-region access.

One thing to note: high availability is an Enterprise Edition feature. However, the licensing terms are fairly accessible — individuals can obtain a license key for free, and there's a self-serve Scale tier as well as custom enterprise contracts.

Failover at the implementation level relies on two core mechanisms: shared state (all nodes in the cluster must maintain a consistent view of sessions, routes, certificates, and other data — typically achieved through a distributed database or a consensus protocol like Raft) and health checking (the system continuously probes each node's liveness and can redirect traffic to healthy nodes within seconds to minutes if a node goes offline). Internalizing DNS resolution serves exactly this goal — by controlling the DNS layer, Pangolin can rapidly update resolution records when a node fails, pointing the domain to a live node and achieving transparent failover without depending on an external DNS provider's API or manual intervention.

Newt Tunnel Connector Merged into the Pangolin CLI

Another notable change is the unification of site management. Newt is the tunnel connector that runs on remote private networks, and it previously existed as a standalone component. In 1.23, Newt has been integrated directly into the Pangolin CLI.

The immediate benefit is a consolidated toolchain — users can now handle SSH, client connections, and site startup all from the same CLI. The command to bring up a site looks like this:

pangolin up site --id <id> --secret <secret> --endpoint https://app.pangolin.net

The team has been clear about compatibility: existing Newt deployments will continue to work, and they'll keep supporting Newt binaries and container images. But the overall direction is to migrate functionality to the Pangolin CLI as much as possible, progressively unifying the user experience.

It's worth explaining the role a tunnel connector plays in a reverse proxy architecture. In a typical self-hosted scenario, services on a user's internal network (such as an app running on a home server) usually don't have a public IP and can't be accessed directly from outside. The tunnel connector (Newt) is deployed inside that private network and proactively establishes an outbound connection to the public-facing Pangolin server node, forming a persistent encrypted tunnel. Incoming access requests that arrive at the Pangolin node are then reverse-forwarded through this tunnel to the internal service. This "internal-initiated outbound" design bypasses NAT and firewall restrictions — the same approach used by tools like Cloudflare Tunnel and frp. Merging Newt into a unified CLI further reduces the operational complexity of establishing and managing these tunnels.

Deployment Options and Licensing

Pangolin 1.23 offers flexible ways to get started:

• Community Edition: Open-source version for self-hosters
• Enterprise Edition: Includes advanced capabilities like high availability; free for personal use
• Pangolin Cloud: Managed service; Enterprise Edition is also free for personal use

This tiered strategy is fairly common among open-source self-hosted projects — attract core users with the open-source community edition, address higher-stability and larger-scale needs with enterprise features (like the HA clustering in this release), while keeping a free entry point for individual users to maintain community activity.

Wrapping Up

Internalizing DNS resolution and certificate management, and merging Newt into a unified CLI — both changes share the same underlying philosophy: reducing the deployment and maintenance complexity of self-hosting. For users already running Pangolin, 1.23 transforms high availability from "something requiring extra external components" into an out-of-the-box capability. For self-hosters evaluating remote access solutions, this is a good time to take another look at Pangolin. The full release notes are available on the official news page, and technical details on clustering are covered in the clustering section of the official documentation.