Recommended Free Tools
To self-host Pangolin, run the coordination server on a public Linux host, point a domain at it, open the required firewall ports, and complete the installer. Then create one site in the Pangolin dashboard for each remote network, install Newt at that site, and start it with the generated site ID, secret, and Pangolin endpoint. Newt keeps an outbound tunnel, handles NAT traversal and routing, and lets you publish only the resources and users you explicitly authorize.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The important distinction is that Pangolin is the control plane; Newt is the connector. A site showing as online does not by itself expose the site network. You must define resources and grant access before traffic is allowed.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat Pangolin and Newt do
Pangolin is the central coordination server. It stores configuration and access policies, authenticates users, and coordinates clients and sites. Newt is the lightweight connector installed in each remote network. It creates the secure tunnel, performs NAT traversal, and routes approved traffic back to that network.
Pangolin’s documentation describes the deployment choice this way: “You can use Pangolin Cloud, which is fully managed, or you can self-host your own Pangolin server for complete control over your infrastructure and data.” Self-hosting therefore puts the server, data, upgrades, backups, and availability decisions in your hands.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
What a connected site can and cannot do
- A Newt site normally makes an outbound connection to Pangolin, so the remote location can remain behind its existing firewall.
- Creating a site does not publish the whole LAN. Administrators must define individual resources and assign access policies.
- Private resources require a Pangolin client connection. Public resources can be reached through a browser when you deliberately configure them that way.
- Clients on the same network as Newt can use the local site address, while remote clients may connect directly peer-to-peer when NAT traversal succeeds.
Prerequisites for a self-hosted server
Prepare these items before running the installer. The quick-install guide recommends Ubuntu 20.04 or newer, or Debian 11 or newer, for compatibility and performance.
| Requirement | What to prepare | Why it matters |
|---|---|---|
| Linux host | A server with root access and a public IP address | Runs Pangolin and accepts client and site connections. |
| DNS | A domain name with an A/AAAA record pointing to the server’s public address | Provides a stable endpoint and lets certificates be issued for the hostname. |
| An address for Let’s Encrypt certificate registration and administrator login | Used during initial setup and certificate operations. | |
| Firewall | Allow 80/TCP, 443/TCP, 51820/UDP, and 21820/UDP | HTTP/HTTPS serve the control plane; the UDP ports are used by clients and tunnel traffic. |
The guide estimates that installation takes “2–3 minutes depending on your internet connection” after these prerequisites are ready. Treat that as an operational estimate, not a measured performance guarantee.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →DNS and firewall checklist
- Create the DNS record before installation and wait until it resolves publicly to the server’s address.
- Permit the four required ports in both the hosting provider’s network firewall and the operating system firewall. Opening a port in only one layer is not sufficient.
- Keep SSH restricted to your administration source addresses where practical; SSH is needed to install Pangolin but is not one of Pangolin’s published service ports.
- Confirm that another service is not already bound to ports 80 or 443. A reverse proxy can be used only when its routing and certificate responsibilities are compatible with the Pangolin installation guide.
Install Pangolin on the public Linux host
Use the current official quick-install guide for the installer command, because the project can change its download URL and container layout. Do not substitute an old command copied from an earlier tutorial.
- Connect to the prepared host over SSH with an account that can become root.
- Download and run the official Pangolin installer exactly as shown in the guide. Supply the domain name, email address, and any prompts for the administrator account.
- Allow the installer to create or configure the Pangolin containers and supporting configuration.
- Start the Pangolin stack. If you chose to defer startup, start it before opening the dashboard.
- When the containers first start, inspect the Pangolin container logs if the initial enrollment token is requested. Copy the token without adding spaces or exposing it in a public ticket.
- Open the HTTPS hostname in a browser, complete the initial administrator login, and change any temporary credential immediately.
If the dashboard does not load, check DNS resolution, the 80/TCP and 443/TCP rules, container status, and logs before changing application settings. A certificate cannot be issued until the hostname resolves to the host and the certificate authority can reach the HTTP/HTTPS service.
Create a site in the Pangolin dashboard
Newt credentials are generated per site, so create the site before installing the connector.
- Sign in to the Pangolin dashboard as an administrator.
- Open the sites section and choose the action to create a new site.
- Give the site a name that identifies its location or function, such as a branch, home lab, or game-server LAN.
- Save the site and copy the generated site ID and secret. Copy the Pangolin endpoint exactly as the dashboard displays it, including
https://and the correct hostname. - Store the secret in a password manager or a protected deployment secret. Do not commit it to a public Git repository or paste it into a screenshot.
Repeat this process for every remote network. One Newt process represents one site; a second location should have its own site record and its own secret.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Install and run Newt at the remote site
Newt is available as a standalone binary or a Docker container. The official documentation also covers systemd, Docker Compose, Compose secrets, Kubernetes, Windows services, Unraid, graphical container managers, and a supported router application. Pick the deployment that matches the device you can maintain at the site.
Generic command pattern
The command pattern is:
newt --id <site-id> --secret <site-secret> --endpoint https://<pangolin-endpoint>Replace all three placeholders with values from the site record. The endpoint is the Pangolin server, not the local router address. Run the command on a host that can reach the local resources you intend to publish.
Standalone binary
- Download the Newt binary for the remote host’s operating system and CPU architecture from the current Newt documentation.
- Place it in a protected executable directory and restrict write access to administrators.
- Run the command above interactively once. Confirm that Newt authenticates and that the site changes to online in the Pangolin dashboard.
- After validation, convert the process to a service so it starts after a reboot and restarts after a failure.
A binary is the smallest operational footprint, but you must handle architecture selection, upgrades, logging, and service supervision yourself.
Linux systemd service
The documented systemd approach keeps credentials in an environment file with restrictive permissions and configures automatic restart. A practical sequence is:
- Create a dedicated directory for Newt’s configuration and logs.
- Create an environment file containing the site ID, secret, and endpoint. Set the file owner to the service account and use permissions that prevent other users from reading it.
- Create a systemd unit that loads the environment file, starts Newt with the documented arguments, and includes a restart policy.
- Reload systemd, enable the unit at boot, and start it.
- Use the service status and journal output to verify authentication and reconnect behavior.
sudo systemctl daemon-reload
sudo systemctl enable --now newt
sudo systemctl status newt
sudo journalctl -u newt -fThe unit name and paths must match the files you create. Keep the secret out of the unit file itself when the host is managed by more than one administrator.
Docker Compose
Compose is useful when the remote host already runs containers and you want Newt’s lifecycle managed with the same tooling. Pass the ID, secret, and endpoint through environment variables or a Compose secret rather than hard-coding them in a public YAML file.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
services:
newt:
image: <current-newt-image>
restart: unless-stopped
environment:
NEWT_ID: ${NEWT_ID}
NEWT_SECRET: ${NEWT_SECRET}
NEWT_ENDPOINT: https://<pangolin-endpoint>The image name and variable names must follow the current Newt documentation; the snippet shows the credential-handling pattern, not a version-pinned manifest. Put the values in a protected environment file or use the documented Compose secret mechanism. A healthcheck can monitor the file Newt writes for health status, allowing Compose to report a failed connector separately from a running container.
Windows service
On Windows, install Newt as a service using the current Windows instructions, then configure automatic start and restart. The client configuration is stored under %PROGRAMDATA%newtnewt-clientconfig.json. Restrict that path to administrators because it contains the site credentials. Verify the service account can reach the Pangolin hostname and any local resources that the site will publish.
Kubernetes
Use the dedicated Helm or Kustomize guidance rather than adapting a plain Docker command. The Kubernetes configuration page is aligned with Newt Helm chart 1.4.0, app version 1.12.3, Kubernetes >=1.30.14-0, and default image docker.io/fosrl/newt:1.12.3. These are the versions documented for that page, not permanent compatibility guarantees; check the chart and image tags immediately before a production rollout.
Store the site secret in a Kubernetes Secret, mount or inject it according to the chart’s values, and use the chart’s probes and restart behavior. A declarative manifest makes it easier to reproduce many sites, but it adds cluster operations, image updates, and secret-management work.
Define resources and grant access
After Newt is online, configure what users may actually reach. A safe order is:
- Confirm the site is online in the dashboard.
- Create the smallest resource definition needed: a single host, service, subnet, or public endpoint rather than an entire LAN.
- Choose whether the resource is private or public. Private resources require the Pangolin client; public resources are browser-accessible only when intentionally published.
- Grant the resource to the required users or roles.
- Test from an account that should have access and, separately, from one that should not.
A deployed site blocks traffic until resources and permissions exist. This default prevents an accidentally connected Newt host from exposing every route behind it.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
How routing and NAT traversal behave
Newt maintains an outbound connection to Pangolin, which is why a remote site can usually remain behind a firewall without a public IP. Pangolin coordinates the session; Newt handles tunnel creation and routing to the local network.
Private clients may establish a direct peer-to-peer path when NAT traversal succeeds. If a direct path is not possible, the connection behavior follows the Pangolin deployment’s available relay and coordination path. Clients already on the Newt site’s LAN can use the local site address, avoiding an unnecessary hairpin through the public endpoint.
Do not assume that “online” means every route works. Routing still depends on the resource definition, destination address, local firewall rules, return routes, and the user’s policy assignment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choosing a Newt deployment model
| Model | Best fit | Credential handling | Updates and trade-offs |
|---|---|---|---|
| Standalone binary | One small Linux host or appliance | Protected service environment or config file | Small footprint; architecture, service setup, and upgrades are manual. |
| systemd | Linux host that should recover automatically | Root-readable environment file with restrictive permissions | Automatic start/restart and familiar logs; unit maintenance is yours. |
| Docker Compose | Containerized edge host | Environment variables or Compose secrets | Repeatable deployment; image pulls and secret files must be controlled. |
| Windows service | Windows-based site host | %PROGRAMDATA%newtnewt-clientconfig.json |
Integrates with Windows service management; protect the program-data path. |
| Kubernetes Helm/Kustomize | Many sites managed declaratively | Kubernetes Secret and chart values | Repeatable at scale; requires a supported cluster and version discipline. |
| Supported router application | Gateway that can run Newt directly | Router’s protected configuration store | Fewer extra hosts; availability and upgrade behavior depend on the router platform. |
For a single branch, systemd or a standalone binary is usually easiest to audit. Choose Compose when the site already has container operations. Use Kubernetes when repeatability across many sites justifies cluster overhead. Running Newt on a nearby gateway is useful when that gateway can route to all intended resources; running it on a single server limits what the connector can reach to that host’s network paths.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Validation and troubleshooting
Dashboard remains offline
- Check that the Newt process is running and has the exact site ID, secret, and HTTPS endpoint.
- Resolve the Pangolin hostname from the remote network and verify outbound HTTPS and the required UDP traffic are not blocked.
- Read systemd, container, or Windows service logs for authentication and TLS errors.
- Confirm the site secret was not copied with a trailing space or replaced by a different site’s credential.
Dashboard is online but a resource fails
- Verify the resource address and port are reachable from the Newt host itself.
- Check the remote host or LAN firewall and ensure return traffic follows the expected route.
- Confirm the user is assigned the resource’s policy and is using the correct Pangolin client for a private resource.
- Test from the local LAN using the local site address, then from a remote client; the two paths can expose different routing or NAT problems.
Certificate or browser errors
- Make sure DNS points to the Pangolin server rather than the remote site.
- Ensure port 80/TCP and 443/TCP reach the Pangolin service without another application intercepting them.
- Use the fully qualified HTTPS endpoint shown in the dashboard; do not substitute an IP address for the certificate hostname.
Connections drop after reboot
- Enable the Newt service or container restart policy.
- Confirm the service starts only after networking is available.
- Inspect logs after reboot and verify that the connector re-authenticates without manual input.
Updates, secrets, and ongoing operations
Treat Pangolin and every Newt site as production infrastructure. Back up Pangolin’s persistent data and configuration before upgrades, document which site ID belongs to each location, and rotate a site’s secret if it is exposed. Removing a site from the dashboard or replacing its credentials should be part of your off-boarding procedure.
The update action depends on the deployment model: rerun the current Pangolin installer as directed by its documentation, pull and recreate a newer Newt image for containers, replace the standalone binary, or update the Helm chart and image tags. Read release notes and check compatibility before changing the Kubernetes versions listed above.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Monitor at least three signals: Pangolin server health, Newt site online status, and a real resource check from an authorized client. A green connector with an expired certificate, a stopped backend service, or a revoked policy can still produce an outage.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCurrent terminology: Newt and newer CLI workflows
Newt remains the connector name used throughout existing deployment guides. Newer Pangolin CLI workflows may also provide the site-connector function, so check the dashboard’s current preferred installation method before copying commands. The site ID, secret, endpoint, resource, and policy concepts remain the items you must map correctly even when the installation interface changes.
Recommended rollout sequence
- Provision the public Linux host, DNS, email, and all four firewall rules.
- Install Pangolin and complete the administrator enrollment.
- Create one dashboard site for the first remote network.
- Install Newt using the deployment model you can update and monitor.
- Wait for the site to show online, then define one narrowly scoped resource.
- Grant that resource to a test user or role and verify allowed and denied access.
- Only after the first path works, add additional resources, users, and sites.
- Record the deployment method, secret location, backup procedure, and update owner for each site.
Frequently Asked Questions
Does a Newt site expose the entire remote network as soon as it connects?
No. Pangolin requires resource definitions and access policies before traffic is permitted. Start with the smallest resource you need.
Can Newt run without a public IP at the remote location?
Usually, yes. Newt maintains an outbound connection and handles NAT traversal, so the remote network can normally remain behind its firewall. The Pangolin server still needs a public IP for self-hosting.
Which Newt installation method should a small site use?
Use a standalone binary or systemd on a small Linux host, Docker Compose on an existing container host, Windows service on a Windows machine, or the documented Helm/Kustomize method for Kubernetes. Choose the option you can secure, monitor, and update.
Free tools Windows power users keep installed
One-click scans. No signup required.
What should I do if Pangolin is online but private access fails?
Check the resource address, the backend’s local firewall and return route, the user’s policy assignment, and the Pangolin client connection. Test locally from the Newt LAN and remotely to separate routing from policy problems.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
