# Pangolin 1.25 adds HTTP redirects, mutual TLS, and load balancing

> **Key takeaway:** Pangolin 1.25 introduces HTTP redirects, mutual TLS authentication for client verification, machine client roles, and four load balancing strategies for its WireGuard-based tunneled reverse proxy.

**Published:** 2026-10-22T10:10:30+00:00 
**Source:** Linuxiac 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/pangolin-125-adds-http-redirects-mutual-tls-and-load-balanci.html 

## Summary
Pangolin 1.25 expands the open-source tunneled reverse proxy with HTTP redirect support configurable through its dashboard, eliminating the need for a separate reverse proxy for simple redirects. The release adds mutual TLS authentication requiring clients to present valid certificates signed by administrator-uploaded CAs. Machine clients now support role-based access management, and four load balancing strategies are available for HTTP/HTTPS resources with multiple targets.

## What's new in Pangolin 1.25
- **HTTP redirects**: Configurable in Settings > Redirects; supports hostname/path matching, URL rewriting, and 301/302 redirects attached to domains or public resources
- **Mutual TLS**: Administrators upload trusted CA certificates; clients must present valid certificates during TLS handshake to access protected services
- **Machine client roles**: Extends RBAC to non-human clients with combined effective permissions from roles and direct assignments
- **Load balancing**: Four strategies (Round Robin, Power of Two Choices, Client IP Hash, Least Response Time) for HTTP/HTTPS resources; requires Traefik 3.6+
- **Identity forwarding**: Private HTTP resources can pass authenticated user details via Remote-User, Remote-Email, Remote-Name, and Remote-Role headers
- **YAML blueprint export**: Resources exportable for reuse via dashboard, API, CLI, or site blueprints
- **Credential regeneration**: Two modes available—replace credentials while keeping connection active, or regenerate and disconnect immediately

## Why it matters
The HTTP redirect and mTLS additions reduce infrastructure complexity for self-hosters who previously needed separate tools. Load balancing and machine roles strengthen Pangolin's position among alternatives like Cloudflare Tunnel and Tailscale Funnel for organizations running private services.