What are Pangolin and Zorven?
Pangolin describes itself as "an open-source SASE platform": it combines identity, sites, access control, privileged access and an identity-aware AI gateway under one policy model, built on WireGuard. The connector you install in private networks, Newt, is a user-space WireGuard client and TCP/UDP proxy; its README says Newt is being phased out in favor of the Pangolin CLI. A self-hosted install brings Pangolin, Gerbil and Traefik. A managed Pangolin Cloud is also available.
Zorven is a tunneling platform that publishes a service on your computer or server at a secure HTTPS address with one command (zorven 3000). The client (CLI, or a desktop app for Windows, macOS and Linux) opens one outbound encrypted connection to the server. On top of tunnels it adds a per-tunnel security layer (visitor login, IP lists, policy engine, WAF, Geo, bot protection, CAPTCHA, mTLS), a WireGuard-based private network, browser terminal and screen access, and MCP integration. The hosted service runs on servers in Istanbul; the core is AGPLv3.
How do the licenses and pricing models differ?
Both are AGPL, with different details. Pangolin is dual-licensed: the community edition is AGPL-3, and the enterprise edition uses the Fossorial Commercial License, which is free for personal and hobbyist use and for businesses under $100K USD gross annual revenue. Zorven's core is AGPLv3; some commercial features (for example Zorven Apps) are not part of the open core.
On the managed side, Pangolin prices per user and Zorven per plan. Pangolin Cloud: Basic free (5 users, 5 sites, 5 domains, 15 public resources), Team $4 per user per month, Business $9, Enterprise custom. Zorven: Free $0, Hobby $5, Pro $12, Team $29 per month, and Enterprise. Example: a five-person team pays $20 a month on Pangolin Team and gets SSO; on Zorven, five members means the Team plan ($29), and enterprise OIDC/SAML SSO is Enterprise only. So for small identity-focused teams Pangolin can be cheaper; for one person or a handful of devices, Zorven's flat plan price is more predictable.
How do Zorven and Pangolin compare feature by feature?
Summary: Pangolin leads on identity and access management (SSO, RBAC, multiple organizations) and community size; Zorven stands out with raw TCP/UDP on the hosted service, a per-tunnel WAF, bot protection and CAPTCHA, and an ngrok-style developer workflow.
| Feature | Zorven | Pangolin |
|---|---|---|
| License | AGPLv3 open core; some commercial features outside the core | AGPL-3 community edition + Fossorial Commercial License (enterprise edition) |
| Managed service | zorven.app (Istanbul, single location) | Pangolin Cloud; optional self-hosted node |
| Free plan | 2 clients, 2 tunnels, 5 GB/month, 1 member | 5 users, 5 sites, 5 domains, 15 public resources |
| Entry price | Hobby $5/month (per plan) | Team $4/user/month |
| Connector | zorven CLI and desktop app | Newt (user-space WireGuard; moving to the Pangolin CLI) |
| Self-host requirements | Server component on your own infrastructure (instructions on GitHub) | Linux server with a public IP; ports 80/443 TCP, 51820 and 21820 UDP |
| HTTP(S) publishing | Yes (including WebSocket, SSE, gRPC) | Yes (HTTPS resources) |
| Raw TCP | All plans, on the hosted service too | Self-hosted only (remote node on Cloud); needs a config flag, a Traefik entry point and a restart |
| UDP | Pro and up | Same conditions as raw TCP |
| Access control on raw TCP/UDP | IP allowlist, Geo rules and web door (Pro and up) | Per the docs, no authentication or access rules on raw resources |
| Identity and SSO | Basic Auth, Google/GitHub on all plans; enterprise OIDC/SAML on Enterprise | SSO and RBAC on Team and up; PIN, email OTP |
| Device posture | Pro and up | Team and up |
| WAF, bot protection, CAPTCHA | WAF log mode, bot protection and CAPTCHA on all plans; WAF blocking on Pro | Geoblocking and allow-lists; no WAF or CAPTCHA on the official pages |
| Remote access in the browser | Terminal, screen sharing and file transfer (all plans) | SSH, RDP and VNC in the browser |
| AI | MCP server (zorven mcp, Pro and up) and publishing your own MCP server through a tunnel | Identity-aware AI Gateway |
| Developer tools | Request inspector with replay, self-deleting tunnels | Not verified in this comparison |
| Community | New; very few GitHub stars | More than 23,000 GitHub stars |
"Not verified" and "not on the official pages" mean we found no clear statement on Pangolin's official pages; they do not prove the feature is missing.
When should you choose Pangolin?
- Maturity and community matter. With more than 23,000 GitHub stars, Pangolin leads the self-hosting category, so someone has likely already solved your problem. Zorven's community is still very small.
- You want identity-first access. SSO, multiple roles per user (RBAC), audit logging and device posture come with the Team plan at $4 per user; SSO auto-provisioning is on Business.
- A small team needs SSO. Zorven puts enterprise SSO on Enterprise; Pangolin offers it from Team.
- You need Business features such as multiple organizations, device approvals and custom branding.
- You need assurance documents. Pangolin's site has a Trust Center; if procurement asks for security documentation, start there.
When should you choose Zorven?
- You want TCP/UDP without running your own VPS. Raw TCP is on every plan and UDP on Pro, on the hosted service, for Minecraft, SSH, databases or game servers; visitors connect to
zorven.app:PORT. See personal. - You need to protect a public site. Per-tunnel WAF, bot protection and cookie-free Zorven CAPTCHA for your forms (all plans); WAF blocking mode and rate limiting on Pro.
- You want an ngrok-style developer workflow. One command, request inspector and replay, self-deleting tunnels, webhook signature verification (Pro). See developers.
- You do remote support. Browser terminal, screen sharing and file transfer from the dashboard.
- A Turkish interface and hosting in Türkiye matter. The dashboard and client support Turkish, English, Japanese and Chinese, and the hosted service runs in Istanbul. For teams and private networking see business.
What should you check when evaluating both?
Start with the kind of traffic: if you mainly give identity-based access to internal apps, Pangolin's model fits naturally; if public services, game servers and webhooks dominate, Zorven's tunnel-first model needs fewer moving parts. Then decide on hosting: both can be self-hosted, but Pangolin needs self-hosting or a remote node for raw TCP/UDP. Finally, turn team size into a price: work out whether per-user or per-plan pricing suits you. For broader roundups see ngrok alternative and Cloudflare Tunnel alternative; to get started see the docs and download page.
Frequently asked questions
Sources
- Pangolin pricing (accessed: 2026-11-08)
- Pangolin on GitHub (license, features) (accessed: 2026-11-08)
- Pangolin docs (accessed: 2026-11-08)
- Pangolin raw TCP/UDP resources (accessed: 2026-11-08)
- Pangolin quick install (accessed: 2026-11-08)
- Newt on GitHub (accessed: 2026-11-08)
- Zorven pricing (accessed: 2026-11-08)
- Zorven docs (accessed: 2026-11-08)
- Zorven FAQ (accessed: 2026-11-08)
- About Zorven (accessed: 2026-11-08)
- Zorven on GitHub (accessed: 2026-11-08)