--- title: Pangolin lets me reach my own apps from anywhere, and I... description: A homelab owner behind CGNAT on two rural ISPs describes using Pangolin to expose self-hosted apps like Immich, Jellyfin, and Nextcloud to the internet without... canonical: https://daily.dev/posts/pangolin-lets-me-reach-my-own-apps-from-anywhere-and-i-didn-t-have-to-open-a-single-port-bibaxjtci twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Pangolin lets me reach my own apps from anywhere, and I didn't have to open a single port | daily.dev og:description: A homelab owner behind CGNAT on two rural ISPs describes using Pangolin to expose self-hosted apps like Immich, Jellyfin, and Nextcloud to the internet without... og:url: https://daily.dev/posts/pangolin-lets-me-reach-my-own-apps-from-anywhere-and-i-didn-t-have-to-open-a-single-port-bibaxjtci og:image: https://api.daily.dev/og/posts/bIbAxjTCi.png og:image:alt: Pangolin lets me reach my own apps from anywhere, and I didn't have to open a single port og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Pangolin lets me reach my own apps from anywhere, and I didn't have to open a single port **[XDA Developers](https://daily.dev/sources/xda-developers)** · 5 min read · 0 upvotes · 0 comments ## Summary A homelab owner behind CGNAT on two rural ISPs describes using Pangolin to expose self-hosted apps like Immich, Jellyfin, and Nextcloud to the internet without port forwarding. Pangolin combines Newt (runs on the home server for outbound connection), Gerbil (WireGuard tunnel), and Traefik (routing), all coordinated through a control plane hosted on a VPS with a public IP. Private-only services stay behind mesh VPNs like NetBird and Tailscale instead. Downsides include the recurring VPS cost, added dependency on a third-party host, and the need for extra security layers like Pocket ID for SSO and CrowdSec for edge protection. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I expose self-hosted services like Immich or Nextcloud to the internet if my ISP has me behind CGNAT? Pangolin lets you expose self-hosted services without port forwarding by establishing an outbound connection from your home server, so CGNAT never blocks anything since traffic never hits your router directly. It uses three components: Newt (runs on the home server to connect to the control plane), Gerbil (builds a WireGuard tunnel), and Traefik (routes traffic to the right app). Pangolin itself runs on a VPS with a public IP. _For anyone piecing together CGNAT workarounds, daily.dev surfaces homelab networking approaches like this as they emerge._ ### What are the downsides of using Pangolin for remote access to a homelab? Pangolin itself is free and open-source, but it requires a VPS with a public IP to run the control plane, which adds a recurring cost and a third-party dependency—if the VPS host has an outage or a bill is missed, remote access breaks. Also, since services become publicly reachable, extra security steps like SSO (Pocket ID) and edge protection (CrowdSec) are recommended. _Weighing self-hosted networking trade-offs like this is easier when daily.dev keeps homelab security practices in view._ ## Similar posts on daily.dev - [I replaced Cloudflare Tunnel with Pangolin, and finally own my whole ingress path](https://daily.dev/posts/i-replaced-cloudflare-tunnel-with-pangolin-and-finally-own-my-whole-ingress-path-h4z6wg0nm) · XDA Developers · 2 upvotes · 0 comments - [I replaced Tailscale with Pangolin for remote access, and it was much easier than I expected](https://daily.dev/posts/i-replaced-tailscale-with-pangolin-for-remote-access-and-it-was-much-easier-than-i-expected-zhudbuvn4) · XDA Developers · 1 upvotes · 0 comments - [I don't use Tailscale or Nginx to access my home lab remotely, here's what I use instead](https://daily.dev/posts/i-don-t-use-tailscale-or-nginx-to-access-my-home-lab-remotely-here-s-what-i-use-instead-kysdzy8la) · XDA Developers · 0 upvotes · 0 comments - [I replaced a VPN with my own VPS, and it works perfectly with some added benefits](https://daily.dev/posts/i-replaced-a-vpn-with-my-own-vps-and-it-works-perfectly-with-some-added-benefits-sm1kxpptf) · XDA Developers · 0 upvotes · 0 comments --- Tags: [#self-hosting](https://daily.dev/tags/self-hosting) [View this post on daily.dev](https://daily.dev/posts/pangolin-lets-me-reach-my-own-apps-from-anywhere-and-i-didn-t-have-to-open-a-single-port-bibaxjtci) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Pangolin lets me reach my own apps from anywhere, and I didn't have to open a single port","url":"https://daily.dev/posts/pangolin-lets-me-reach-my-own-apps-from-anywhere-and-i-didn-t-have-to-open-a-single-port-bibaxjtci","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pangolin-lets-me-reach-my-own-apps-from-anywhere-and-i-didn-t-have-to-open-a-single-port-bibaxjtci"},"datePublished":"2026-09-29T21:04:49.035Z","dateModified":"2026-09-29T21:25:19.804Z","description":"A homelab owner behind CGNAT on two rural ISPs describes using Pangolin to expose self-hosted apps like Immich, Jellyfin, and Nextcloud to the internet without...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5e1e461a34f5380984591bec4a57f6f7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5e1e461a34f5380984591bec4a57f6f7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"XDA Developers","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"XDA Developers","logo":"https://media.daily.dev/image/upload/s--kCg6yyAP--/f_auto,q_auto/v1774964407/logos/xda-developers?_a=BAMAMiWQ0","url":"https://daily.dev/sources/xda-developers"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pangolin-lets-me-reach-my-own-apps-from-anywhere-and-i-didn-t-have-to-open-a-single-port-bibaxjtci","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"self-hosting","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"XDA Developers","item":"https://daily.dev/sources/xda-developers"},{"@type":"ListItem","position":3,"name":"Pangolin lets me reach my own apps from anywhere, and I didn't have to open a single port"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pangolin-lets-me-reach-my-own-apps-from-anywhere-and-i-didn-t-have-to-open-a-single-port-bibaxjtci#faq","mainEntity":[{"@type":"Question","name":"How can I expose self-hosted services like Immich or Nextcloud to the internet if my ISP has me behind CGNAT?","acceptedAnswer":{"@type":"Answer","text":"Pangolin lets you expose self-hosted services without port forwarding by establishing an outbound connection from your home server, so CGNAT never blocks anything since traffic never hits your router directly. It uses three components: Newt (runs on the home server to connect to the control plane), Gerbil (builds a WireGuard tunnel), and Traefik (routes traffic to the right app). Pangolin itself runs on a VPS with a public IP. For anyone piecing together CGNAT workarounds, daily.dev surfaces homelab networking approaches like this as they emerge."}},{"@type":"Question","name":"What are the downsides of using Pangolin for remote access to a homelab?","acceptedAnswer":{"@type":"Answer","text":"Pangolin itself is free and open-source, but it requires a VPS with a public IP to run the control plane, which adds a recurring cost and a third-party dependency—if the VPS host has an outage or a bill is missed, remote access breaks. Also, since services become publicly reachable, extra security steps like SSO (Pocket ID) and edge protection (CrowdSec) are recommended. Weighing self-hosted networking trade-offs like this is easier when daily.dev keeps homelab security practices in view."}}]} ```