VPS

Where Should You Self-host Pangolin?

Ashton Momot

— 6 min read

I see a lot of people looking at ways to safely start their self-hosting journey (or make improvements to an already existing installation). A common question is where should you have your Pangolin host?

Do you purchase a VPS at a monthly or yearly cost?

Do you run it on a homelab server running at your house?

What is Pangolin?

Pangolin is an open-source tunneled reverse proxy that provides identity and access control. If you ever want to access things you have on your server from anywhere in the world, this is a tool to get that done!

It handles everything, and I love it. You want certificates to authenticate your web-facing assets? It does it automatically. You want to limit access to resources by requiring folks to login to access something? It has that too. You want to only allow logins based on Country origin? Done.

There's really two main parts to Pangolin. There's the central server bit that acts as the public-facing portion. This part handles authentication, provides the dashboard, and does the behind-the-scenes routing. The second part is a site connector (called Newt), which runs inside the private network and "phone home" to the central server.

The central server is internet-facing, and in my experience, is the piece of the puzzle that causes the most pause when deciding which route to go.

Introduction to Pangolin | Pangolin Docs
Connect and protect your users with an open-source networking and security platform
Pangolin Docs

Option 1 - Self-host on your own server

There are obvious monetary benefits of hosting a server that you already own. No monthly or annual payments, but there's some other benefits as well.

  • Pros
    • Total control - you own the hardware. The drives, the network, physical access control is all up to you.
    • No recurring bills - Maybe an increased electricity bill, but nothing being paid to a provider
    • Doesn't require a lot of resources - A used mini PC or a laptop will often be enough to host Pangolin, and for a lot less than the cost of a VPS.
    • Bandwidth - Many VPS providers throttle your bandwidth. For a central server that could process something like Plex streaming, you don't want to run up against bandwidth limitations.
    • Data stays local - Harping on the data sovereignty piece. This is typically pretty huge for self-hosters who want the data privacy and security that comes with self-hosting applications.
  • Cons
    • Publicly accessible - This is the one that causes the most pause, I think. Since the central server of Pangolin needs to be publicly reachable, so is your home router. If your ISP has you on CGNAT or a DHCP WAN IP, things get more complicated for you to manage.
    • Home IP becomes public - DNS records that you need to input when setting up Pangolin will point to your home IP address.
    • Residential upload speeds are often poor - This one is huge for me. I have one option for Internet service at my home; Xfinity Cable. While my download speeds are adequate, upload speeds are horrible.
    • Reliability is on you - You are responsible for uptime of the central server. Power outages, ISP IP changes, unplugging cables, whatever it is, it's on you.
    • Terms of service - Some ISPs prohibit running public-facing servers as part of the service.
    • Network Segmentation - Having the ability to segment your network becomes more important. This means more time drafting up your network diagram to ensure things are protected across vlans.

Option 2 - Use a Public VPS

You can easily host your Pangolin central server on a cloud VPS. You connect your sites (like your home network) through newt site connectors hosted on your equipment.

Pros

  • A clean Public IP - Most plans come with a static IP, solid uptime, and fancy things like symmetrical bandwidth.
  • Sidestep ISP restrictions - I am all for sticking it to the ISP where I can. Because you run the newt site at home, you don't have to open ports to your home network.
  • Home IP stays hidden - When configuring Pangolin, you point the dns records to your public VPS, not at your home. This is also most of the time static, so you aren't changing records every time your ISP changes your IP address.
  • Isolation - Harping again on the security aspects. If the VPS is ever compromised, it's completely separate from your home network. You can easily shut down a tunnel and leave your resources unaffected.
  • Relatively Cheap - Many providers have special deals on their lower-end VPS's, which are more than enough to run Pangolin. I typically use Racknerd at $3/mo for a basic VPS and it is more than enough to host it.
  • Easy to rebuild or move - Depending on the provider, some have snapshots, backups, or other options for quicker redeployments than what you may expect running the central server at home.

Cons

  • Costs - It can be small (I've seen as low as $3/mo), but it's an additional cost.
  • Bandwidth can cost you - VPS providers can limit your bandwidth. All proxied traffic goes against your allotment of data through that VPS. If you're pushing 4K plex data or a ton of pictures through the VPS, you can run through your data transfer quota each month.
  • Extra hops add latency - Your traffic has an extra hop as it goes user -> tunnel -> your server. This can be limited by choosing a datacenter that is close to your house when you configure your VPS.
  • You're trusting the provider - You may rent the VM from them, but they own the hypervisor that the VM sits within, the network, etc. Pangolin terminates TLS at your central server. If it's hosted on a VPS, the machine that holds the certificates you don't actually own.
    • To me, this is still better than trusting your data with some product like Cloudflare Zero Trust, where Cloudflare can read all data within the tunnels.
  • Provider variability - Cheap VPS hosts differ in their support, uptime, and other reliability metrics that are important to self-hosters.
  • Another piece of equipment to update - OS updates, firewall rules, backups, and monitoring are all needed on a VPS. Plus it's exposed to the internet!

Which Should You Choose?

Go with a VPS if you're stuck behind a crappy ISP CGNAT or DHCP Public IP address that can change at any moment, need reliable uptime, want to protect your home IP from potential compromise, or just want the fastest route to spooling up your own Pangolin instance. For most homelabbers, this is the default route, and a scenario that Pangolin docs explain in detail very well.

Go with your own server if you have a static IP and a symmetrical Fiber connection, move a lot of data, and have a strong reason to keep everything on hardware that you own.

Consider a hybrid. Some people may opt to run the central server on a small VPS and host their heavy services at home to save money on the VPS cost. This is the route I went personally. While I have some services running on the Pangolin host (Crowdsec Dashboard, etc), I have all of my services either hosted at home or hosted on another VPS location, connected through newt site connectors. This approach gives you the reliability of the primary central server being in a datacenter, and maintaining storage and compute on your own hardware. Just remember that all of that traffic still passes through the VPS.

A few things to consider before committing:

  • Licensing - Pangolin community edition is free for use. The Enterprise edition uses a commercial license that is free for personal use and for businesses under $100k USD in annual revenue. The enterprise option provides way more features and is commonly suggested for homelab use, depending on your circumstances. Be sure to read the licensing terms before choosing your option.
  • Managed option - Pangolin also offers a fully managed cloud service. Something to look into.
  • Project maturity - Even since I started hosting Pangolin myself, the project has seen a TON of improvements and added features. Be sure to read up on the release notes before adding critical resources to your stack.
  • Ports and firewall - Confirm the current port requirements in the official docs, since you'll need certain TCP and UDP ports publicly accessible on whatever hosts your Pangolin central server.

Final Thoughts

Self-hosting Pangolin always brings up the inner struggle of keeping all of your data on equipment you own versus buying some peace of mind. At least it did for me. It's less about "own hardware good, VPS bad" and more about designing the workflow that works for your situation. If your home network can serve a public-facing server, then Pangolin provides for an easy way to get safe external access control to those resources. If you have a crappy ISP and like the idea of data center infrastructure powering your Pangolin "hub", then maybe doing the hybrid approach is worth the additional investment. At the end of the day, you'll end up with something that Cloudflare Tunnels can't offer: a gateway you actually own.

Read more