What Pangolin is and why it needs a VPS at all

Pangolin is an open source, self-hosted reverse proxy built on WireGuard. People usually pick it up as a replacement for Cloudflare Tunnel, since it removes the upload size limit, the terms of service worries around streaming video, and the fact that a third party sits in the middle of every request. You run it yourself, on infrastructure you own.

Once you see the shape of it, the whole thing is actually pretty simple. The Pangolin application, along with a small WireGuard component called Gerbil and a reverse proxy called Traefik, runs on a public server. Your actual services, whatever they are, stay on your home network or private server, with a lightweight client called Newt making an outbound connection to that public server. Nothing on your private network ever has to accept an inbound connection. This is exactly why a VPS is the piece you cannot skip. Something has to sit on the public internet with a real IP address, and that something is not going to be your home router.

The specs a Pangolin VPS actually needs

This is the part most guides get vague about, so here are the numbers as Pangolin's own documentation states them.

In practice this means Pangolin does not need a large server. A 1 GB plan will run it, and even the recommended 2 GB tier is inexpensive by most providers' pricing. What tends to catch people out is not CPU or RAM. It is the three requirements below, which have nothing to do with server size.

A quick checklist before you buy

A budget VPS that satisfies every item below will outperform an expensive one that fails on any single one of them. This is the single biggest mistake people make when shopping for Pangolin hosting. They compare CPU cores and forget to check whether the provider actually hands out a real IP with open ports.

• The provider assigns a dedicated public IPv4 address, confirmed before you commit to a plan.
• UDP traffic is allowed on the network, not just TCP. Some low cost providers quietly filter UDP.
• You get root SSH access from the first minute, with no approval process for opening ports.
• The plan includes at least 2 GB of RAM if you plan to expose more than one or two services.
• Storage is SSD, since Docker images and logs add up faster than the 8 GB minimum suggests.

For background on how a VPS differs from shared hosting in the first place, our hosting guides cover the basics if you are choosing your first server.

So what is actually the best VPS for Pangolin

Once a provider clears the checklist above, picking a plan just comes down to how much you plan to run through the tunnel. Eldernode VPS plans ship with a dedicated public IPv4 address and full root access by default, so opening 80, 443, 51820, and 21820 is something you do yourself in a couple of minutes rather than something you wait on support for.

You can always resize upward later if you add more sites or heavier traffic, so there is no need to overbuy on day one. Check current plan pricing and specs before deciding, since exact tiers change from time to time.

Setting up Pangolin once the server is ready

With a VPS that meets the checklist above, the setup itself is short.

1. Point a domain name at your VPS's IP address, since Pangolin needs one for its dashboard and for issuing SSL certificates.
2. Install Docker on the server, if it is not already there.
3. Open the four required ports on your firewall: TCP 80, TCP 443, UDP 51820, and UDP 21820.
4. Download the official Pangolin installer over SSH and run it, following the prompts for your domain and admin email.
5. Start the stack with docker compose up -d and let Let's Encrypt issue your certificate automatically.
6. Install Newt on the private machine or network you want to expose, and it will dial out to your VPS to complete the tunnel.

From there, everything else, adding sites, setting up single sign on, configuring access rules, happens through Pangolin's own dashboard.

One VPS, two ways to run Pangolin

Pangolin can run in more than one mode, and it is worth knowing the difference before you commit to a server.

The tunneled mode is the one most people mean when they talk about Pangolin. Gerbil and Traefik run on the VPS, Newt runs wherever your actual services live, and traffic is tunneled between them over WireGuard. This is the setup that gets you past CGNAT and lets you keep services at home without opening a single port on your home router.

The second mode drops the tunnel entirely. Pangolin runs as a plain reverse proxy with identity aware access control in front of services that are already reachable from the VPS itself. If everything you want to protect is already running on the same server, or on servers with their own public IPs, this simpler mode may be all you need.

Securing the server after setup

A Pangolin box is a public facing server, so it is worth spending ten minutes on basic hardening once the tunnel is running. Switch SSH to key based login and turn off password authentication entirely. Keep the firewall scoped to exactly the four ports Pangolin needs plus SSH on its own port, nothing broader. If you want an extra layer, a tool like fail2ban will quietly block repeated login attempts without any ongoing effort on your part. None of this is specific to Pangolin, it is just good practice for any server that talks to the open internet, but it is easy to skip when you are focused on getting the tunnel working.

Common problems and what usually causes them

Most Pangolin setup issues trace back to one of three things. If the dashboard will not load over HTTPS, check that your domain is actually pointing at the VPS before the installer runs, since Let's Encrypt cannot issue a certificate for a domain that resolves nowhere. If Newt connects but no traffic gets through, check that UDP, not just TCP, is genuinely open on both the server's firewall and the provider's network level filtering, since some providers block UDP by default even when the operating system firewall allows it. If you cannot reach the server at all from outside, confirm you were given a real public IPv4 address and not one behind carrier grade NAT, which some cheaper VPS tiers use without saying so upfront.

Frequently asked questions

The short version

Pangolin is light on hardware and heavy on a few specific network requirements. Get a dedicated public IPv4 address, full root access, and open UDP ports, and a modest 2 GB plan will carry you comfortably. Skip any of those three and no amount of extra CPU will save you.