Self-hosting Pangolin gives you a coordination server you control, while Newt connects each remote network to it through an outbound encrypted tunnel. The working sequence is: prepare a public Linux host and DNS, install Pangolin, create a site in its dashboard, run Newt at that site, then define resources and permissions before testing access.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What Pangolin and Newt do
Pangolin is the central coordination server. It stores configuration and access policies, authenticates users, and coordinates clients and remote sites. Newt is the lightweight connector installed at each remote network. It creates the tunnel, handles NAT traversal and routing, and keeps an outbound connection to Pangolin.
As an Amazon Associate I earn from qualifying purchases.
A site can be a branch office, home lab, cloud network, or a gateway serving several devices. Newt does not automatically publish every subnet behind that site. In Pangolin, you define a resource and then grant access to users or roles. Private resources require a Pangolin client connection; public resources can be reached in a browser.
“You can use Pangolin Cloud, which is fully managed, or you can self-host your own Pangolin server for complete control over your infrastructure and data.” — Pangolin Docs, “How Pangolin Works.”
#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The traffic flow
- A user authenticates with Pangolin or its client, depending on the resource type.
- Newt maintains an outbound session from the remote network to the Pangolin server.
- Pangolin applies the resource and access policy.
- Traffic is routed through the Newt-connected site. When NAT traversal permits it, private client traffic may become a direct peer-to-peer connection; otherwise, the coordination and tunnel path remains in use.
Clients located on the same network as Newt can use the local site address where that routing option is available. A deployed site with no resources or permissions is intentionally non-functional: Pangolin blocks traffic until you define what should be reachable and who may reach it.
Prerequisites for a self-hosted server
Prepare these items before running the installer:
- A Linux server with root access and a public IP address.
- A domain name whose DNS points to that server’s IP address.
- An email address for Let’s Encrypt certificate issuance and the administrator login.
- Firewall access for 80/TCP, 443/TCP, 51820/UDP, and 21820/UDP.
The quick-install documentation recommends Ubuntu 20.04 or later, or Debian 11 or later, for compatibility and performance. Its estimate of “2–3 minutes depending on your internet connection” applies to the installation after the prerequisites are ready; it is an operational estimate, not an independently measured benchmark.
Free tools Windows power users keep installed
One-click scans. No signup required.
Required ports
| Port | Protocol | Purpose in the documented setup |
|---|---|---|
| 80 | TCP | HTTP access used during the web and certificate setup flow. |
| 443 | TCP | HTTPS access to the Pangolin endpoint. |
| 51820 | UDP | Client and tunnel connectivity. |
| 21820 | UDP | Additional client connectivity required by the quick-install guide. |
Open these ports on the host firewall and any upstream security group or provider firewall. The remote networks do not normally need equivalent inbound exposure because Newt initiates and maintains an outbound connection.
DNS and certificate preparation
Create the DNS record for the Pangolin hostname before installation and allow it to resolve to the server’s public IP. Use the exact hostname you intend to enter as the Pangolin endpoint. The Let’s Encrypt email address should be monitored: it is used for certificate administration and is also associated with the administrator setup.
Install Pangolin on the public Linux host
- Connect to the prepared server over SSH with an account that has root privileges.
- Download and run the official Pangolin quick installer from the Pangolin documentation. Use the installer’s current command rather than copying an old command from an unrelated guide, because install scripts and container tags change.
- Start the Pangolin containers when prompted. If you defer startup, start them before opening the dashboard.
- If startup was deferred, retrieve the initial token from the Pangolin container logs when it first starts. Keep this token private and use it only for the initial administrator setup.
- Open the Pangolin dashboard through the DNS name you prepared, complete the administrator login, and verify that the HTTPS certificate is valid.
The installer creates a containerized Pangolin deployment. Record the server hostname, administrator email, and the location of the deployment files in your operations notes. Do not publish the initial token, site secrets, or other credentials in a public issue, screenshot, or shared Compose file.
What to verify before adding a site
- The domain resolves to the correct public IP address.
- HTTPS loads without a certificate warning.
- The Pangolin containers are running and remain running after a reboot if your deployment procedure enables that behavior.
- The host and provider firewalls allow all four documented ports.
- You can sign in as the administrator and reach the site-management area.
Create a site and obtain Newt credentials
Create one Pangolin site for every remote network you intend to connect. In the dashboard, open the site-management view, create a site, and copy the generated Newt configuration. The important values are the site ID, site secret, and Pangolin endpoint.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
- Choose a name that identifies the physical or logical network, such as a branch, lab, or warehouse.
- Save the site and copy its generated ID and secret immediately.
- Use the exact HTTPS endpoint of your Pangolin server, including the hostname that has the valid certificate.
- Store the secret in a password manager or protected deployment secret. Treat it like a password: anyone holding it can attempt to connect as that site.
Create the site before installing Newt. A connector cannot register correctly without the site ID and secret issued by Pangolin.
Run Newt at the remote network
Newt is available as a standalone binary or Docker container. The same site credentials are used regardless of packaging. The generic command pattern documented for the connector is:
newt --id <site-id> --secret <site-secret> --endpoint https://<pangolin-endpoint>Replace the three angle-bracket values with the values generated for that site. Do not add credentials to shell history, a public repository, or an image layer that other users can pull.
Standalone binary
A standalone binary is the smallest operational footprint. Download the Newt binary appropriate for the remote operating system, place it under a controlled system directory, and run the command with the site ID, secret, and endpoint. This approach is practical for a single gateway when you already have a service supervisor, but you must define your own update and restart procedure.
Linux systemd service
The Newt documentation shows a systemd deployment that keeps credentials in a separate environment file with restrictive permissions and configures the service to restart automatically. Use that pattern rather than embedding the secret directly in the unit file:
- Create an environment file readable only by the service account or root.
- Put the site ID, secret, and endpoint in that file.
- Reference the environment file from the Newt service unit.
- Enable the service and start it.
- Check the service status and logs, then confirm that the site appears online in Pangolin.
The exact unit syntax can vary with the Newt release and Linux distribution, so use the current systemd example in the Newt documentation when creating the file. The security requirement does not change: protect the environment file and limit its permissions.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Docker or Compose
Docker is useful when the remote gateway already runs container workloads. Pass the credentials as environment variables or, preferably, as a Compose secret. Keep the secret out of a public Compose file and out of version control. A healthcheck can monitor the file written by Newt, allowing the container runtime to report an unhealthy connector instead of silently leaving a stopped tunnel.
For repeatable deployments, keep the Compose definition declarative and inject the site-specific secret at deployment time. Use a separate Compose project or secret for each site so that replacing one connector does not expose credentials for another network.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Windows service
On Windows, Newt can be installed and managed as a service. The documented configuration location is:
%PROGRAMDATA%newtnewt-clientconfig.jsonRestrict access to that file, install the service under an account with only the permissions it needs, and verify the service starts automatically. After starting it, check the Windows service status and the Pangolin dashboard for an online site.
Kubernetes
Use the dedicated Helm or Kustomize guidance for Kubernetes rather than translating the Docker command into an ad-hoc Pod. The documented configuration page is aligned with these version values:
| Component | Documented version context |
|---|---|
| Newt Helm chart | 1.4.0 |
| Newt application | 1.12.3 |
| Kubernetes | >=1.30.14-0 |
| Default image | docker.io/fosrl/newt:1.12.3 |
These values describe the version context of that configuration page, not a permanent compatibility guarantee. Check the current chart, application, Kubernetes requirement, and image tag before a production rollout. Use a Kubernetes Secret for the site secret, apply the chart or Kustomize resources, and inspect the resulting Pod logs and readiness state.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Router and appliance deployments
The official Newt page also documents Windows services, Docker Compose, Compose secrets, Kubernetes, Unraid, Portainer-like interfaces, and an Advantech router application. A supported router or edge appliance can be a good placement when it is the device already routing the target subnet. Confirm that the appliance can run the current Newt release and that its management interface provides a secure secret store before choosing it for a long-lived deployment.
Confirm that the connector is online
- Start Newt using the site ID, secret, and HTTPS Pangolin endpoint.
- Watch the local process, service, container, or Pod logs for a successful connection and any certificate or authentication error.
- Refresh the Pangolin dashboard and verify that the newly created site is online.
- Check that the connector is running from the network where the target resources actually reside.
- Only after the site is online, create a resource and access rule.
An online status proves that the connector can reach Pangolin; it does not prove that a particular host, subnet, port, or application is reachable. Resource definitions and permissions still control traffic.
Define resources and grant access
After Newt is online, define the smallest resource that answers the user’s need. A resource can represent an internal service, host, subnet, or other destination supported by the current Pangolin release. Specify the destination and any required port or protocol in the dashboard, then grant access to the intended users or roles.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Private resources
Private resources require the Pangolin client. Users authenticate through the client and receive access only when their account or role matches the resource policy. This is the appropriate model for internal administration interfaces, file services, databases, and other destinations that should not be browser-public.
Public resources
Public resources can be reached through a browser. Treat that option as an explicit exposure decision: define only the intended application, use the narrowest destination, and grant or publish it only after confirming the resource’s authentication and application-layer protections.
Safe activation order
- Deploy Newt and confirm the site is online.
- Create the smallest resource definition needed for the first test.
- Grant access to a single test user or role.
- Test from the correct network path: Pangolin client for private access or a browser for a public resource.
- Expand destinations and permissions only after the first test succeeds.
Because a new site blocks traffic until resources and permissions exist, an idle site immediately after connector installation is expected behavior, not evidence that the tunnel is broken.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How NAT traversal and firewalls affect the design
Remote sites normally sit behind firewalls and maintain outbound connections to Pangolin. Newt creates the tunnel, performs NAT traversal, and routes traffic, reducing the need for complex inbound firewall rules or a public IP at every branch. The self-hosted Pangolin server still needs its own public IP and the documented inbound ports.
Private client connections may become peer-to-peer when NAT traversal succeeds. If direct traversal cannot be established, the connection uses the available Pangolin tunnel path. This behavior can vary with carrier-grade NAT, symmetric NAT, restrictive enterprise firewalls, and router policies, so test from the actual client network rather than assuming that two sites have identical paths.
Choosing where to install Newt
- Target host: simplest when one server owns the resource and can run the connector safely.
- Nearby gateway: useful when one connector should route an entire subnet and the gateway has the required routes and firewall permissions.
- Supported router or edge appliance: convenient when the router already controls the site’s traffic and supports secure Newt installation.
- Kubernetes cluster: suitable for declarative, repeatable operations when the cluster version and chart requirements are satisfied.
Whichever placement you choose, Newt must be able to reach the local destination and the local routing policy must permit forwarding to it. Pangolin cannot repair a missing route or a host firewall that rejects the resource’s traffic.
Troubleshoot common failures
The dashboard or certificate does not load
- Confirm that the DNS record resolves to the Pangolin server’s public IP.
- Check that 80/TCP and 443/TCP are open in both the host firewall and any provider security group.
- Verify that another web server is not occupying the required ports.
- Confirm that the hostname used during setup matches the hostname in the browser.
Newt cannot authenticate
- Copy the site ID and secret again from the correct Pangolin site.
- Check for extra spaces, line breaks, or shell quoting errors.
- Use the HTTPS Pangolin endpoint with the valid DNS name, not an unrelated IP or an old hostname.
- If the site was deleted and recreated, replace the old credentials with the newly generated pair.
The site remains offline
- Confirm that the Newt process, service, container, or Pod is running.
- Check outbound connectivity from the remote network to the Pangolin endpoint.
- Review the local logs for certificate validation, DNS, or firewall errors.
- Check that UDP 51820 and 21820 are permitted where the installation requires them.
- For Kubernetes, compare the deployed chart and image with the current compatibility guidance instead of assuming that the documented version context is unchanged.
The site is online but the resource fails
- Verify that a resource definition exists; an online site alone does not publish a network.
- Confirm that the test account or role has been granted access.
- Check the destination address, port, and protocol in the resource.
- Test reachability from the Newt host or gateway to the destination locally.
- Inspect the destination host firewall and any subnet route between Newt and the resource.
- For private access, confirm that the client is connected to Pangolin. For a public resource, test the browser URL and the application’s own authentication.
Direct peer-to-peer access does not occur
Direct peer-to-peer connectivity depends on NAT traversal. Carrier-grade or symmetric NAT can prevent it even when both endpoints are configured correctly. Treat the connection as functional if the permitted tunnel path works, and investigate router NAT behavior only when direct-path performance or policy requires it.
Choose an operating model
| Deployment approach | Operational footprint | Credential handling | Update approach | Best fit |
|---|---|---|---|---|
| Standalone binary | Smallest; one process on the target host or gateway. | Service configuration or protected environment file. | Replace the binary and restart according to your service procedure. | A single uncomplicated remote site. |
| systemd | Native Linux service with restart supervision. | Restricted environment file, separate from the unit. | Install the new binary, then restart the service. | Linux gateways that need automatic restart behavior. |
| Docker or Compose | Container runtime and project definition. | Environment variables or Compose secret. | Pull the approved image and recreate the container. | Hosts already operated with containers. |
| Kubernetes | Cluster resources managed declaratively. | Kubernetes Secret and chart or Kustomize configuration. | Update the chart and image through the cluster’s deployment process. | Repeatable multi-site or platform-managed rollouts. |
| Windows service | Service installed on a Windows host. | Protected configuration under the documented ProgramData path. | Install the updated service binary using the Windows procedure. | Remote networks whose gateway host is Windows. |
| Supported router application | Connector runs on the edge appliance. | Router-managed configuration, subject to its security model. | Use the appliance’s Newt application update process. | Sites where the router already owns subnet routing. |
For one or two sites, a protected binary or systemd service is usually easier to reason about. For many similar sites, Compose templates or Kubernetes declarations make site-specific IDs and secrets repeatable while keeping the rollout auditable. Keep each site’s secret separate even when the deployment method is identical.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchNewt terminology and newer CLI workflows
Newt remains the connector name used in existing installation guides and deployments. The current Newt documentation also notes that newer Pangolin CLI workflows can provide the site connector. Before a new rollout, check the dashboard’s preferred installation method and the current connector documentation. Existing Newt deployments do not need to be renamed merely because a newer CLI workflow is available; the practical requirement is a supported connector with the correct site credentials and endpoint.
Production checklist
- Public Linux host has root access, a public IP, and a supported Ubuntu or Debian release.
- DNS points the Pangolin hostname to the correct server IP.
- Let’s Encrypt email and administrator details are controlled by the operating team.
- 80/TCP, 443/TCP, 51820/UDP, and 21820/UDP are allowed where required.
- Pangolin containers start successfully and the dashboard uses HTTPS.
- Every remote network has its own Pangolin site and Newt credentials.
- Secrets are stored in protected files, Compose secrets, Kubernetes Secrets, or an equivalent secure store.
- Newt starts automatically through the chosen service, container, cluster, or router mechanism.
- Each site is online before resources are created.
- Resources are narrowly defined and access is granted to the intended users or roles.
- Private resources are tested with the Pangolin client; public resources are tested in a browser.
- Destination host firewalls and local routes permit the traffic Newt is expected to carry.
- Version-specific Kubernetes chart, image, and cluster requirements are checked again before production deployment.
Keeping the deployment maintainable
Document the Pangolin hostname, site names, connector placement, resource destinations, responsible owners, and update method. A site ID identifies the Pangolin object, while the secret authenticates its connector; record them separately and never place secrets in documentation intended for broad distribution.
When updating, use the mechanism that matches the deployment: rerun the Pangolin installer or its documented upgrade process for the server, replace the standalone Newt binary, pull and recreate a Compose image, update the Kubernetes chart and image, or use the supported router application’s update path. After every update, confirm that the connector is online and test one representative private or public resource before expanding access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
