Pangolin 1.25 adds HTTP redirects, mutual TLS, and load balancing

Pangolin 1.25 expands the open-source tunneled reverse proxy with HTTP redirect support configurable through its dashboard, eliminating the need for a separate reverse proxy for simple redirects. The release adds mutual TLS authentication requiring clients to present valid certificates signed by administrator-uploaded CAs. Machine clients now support role-based access management, and four load balancing strategies are available for HTTP/HTTPS resources with multiple targets.

What's new in Pangolin 1.25

• HTTP redirects: Configurable in Settings > Redirects; supports hostname/path matching, URL rewriting, and 301/302 redirects attached to domains or public resources
• Mutual TLS: Administrators upload trusted CA certificates; clients must present valid certificates during TLS handshake to access protected services
• Machine client roles: Extends RBAC to non-human clients with combined effective permissions from roles and direct assignments
• Load balancing: Four strategies (Round Robin, Power of Two Choices, Client IP Hash, Least Response Time) for HTTP/HTTPS resources; requires Traefik 3.6+
• Identity forwarding: Private HTTP resources can pass authenticated user details via Remote-User, Remote-Email, Remote-Name, and Remote-Role headers
• YAML blueprint export: Resources exportable for reuse via dashboard, API, CLI, or site blueprints
• Credential regeneration: Two modes available—replace credentials while keeping connection active, or regenerate and disconnect immediately

Why it matters

The HTTP redirect and mTLS additions reduce infrastructure complexity for self-hosters who previously needed separate tools. Load balancing and machine roles strengthen Pangolin's position among alternatives like Cloudflare Tunnel and Tailscale Funnel for organizations running private services.