# Private Resource Access

SSH, databases, RDP, and full subnet access through Pangolin's client-based private tunnels — zero-trust without a traditional VPN.

30 minutes

**Pangolin client required**

## Browser Access vs. Client Access

### HTTP/S Resources (Part 4)

Web apps via browser. Authentication at the Pangolin gateway. No client software needed.

### Private Resources (this article)

Non-HTTP services via Pangolin client. WireGuard connection to the target. TCP and UDP supported.

## Installing the Pangolin Client

Available for Linux, macOS, Windows, iOS, and Android. Install via the dashboard: **Clients → Add Client**.

### Linux installation

```bash
curl -fsSL https://pangolin.net/downloads/client-linux-amd64 \
  -o /usr/local/bin/pangolin-client
chmod +x /usr/local/bin/pangolin-client
```

## Use Case: SSH Access

Create a private resource: Type → Private, Protocol → TCP, Target Host → `192.168.1.10`, Port → 22, DNS Alias → `homeserver.ssh`

Connect via Pangolin client

```bash
ssh user@homeserver.ssh
```

SSH config integration (~/.ssh/config)

```bash
Host homeserver
  HostName homeserver.ssh
  User vanessa
  IdentityFile ~/.ssh/id_ed25519
  Port 22
```

Then just `ssh homeserver`. No public ports, no jump hosts.

## Use Case: Database Access

Databases stay on private networks. Authorized users connect through Pangolin's encrypted tunnel.

### PostgreSQL

Private resource: TCP, Target `192.168.1.20:5432`, DNS Alias `postgres.home`

Connect

```bash
psql -h postgres.home -U myuser -d mydatabase
# Or connection string:
# postgresql://myuser:mypassword@postgres.home:5432/mydatabase
```

### MySQL / MariaDB

Same pattern with port 3306.

### Redis & MongoDB

```bash
redis-cli -h redis.home -p 6379
# MongoDB:
# mongodb://mongodb.home:27017/mydb
```

Access control applies at the tunnel layer — if a user isn't granted access, they can't even reach the port.

## Use Case: Remote Desktop (RDP)

Private resource: TCP, Target `192.168.1.30:3389`, DNS Alias `windows-desktop.home`

Linux (FreeRDP)

```bash
xfreerdp /v:windows-desktop.home /u:Administrator /p:yourpassword
```

Works with Windows built-in RDP, Microsoft Remote Desktop on macOS, Remmina on Linux.

## Entire Network Range Access

Expose an entire subnet: Private Resource, TCP+UDP, Target `192.168.1.0/24`. Connected users can reach any device on that subnet.

**⚠️ Use judiciously** — network range access is broader than resource-specific access. Per-service resources with specific ports are the more secure default.

## TCP Pass-Through

For services like Gitea SSH that need a TCP port on your VPS's public IP:

Gitea SSH pass-through

```bash
# TCP Resource: Public Port 2222 → Target localhost:22 on Gitea site

# app.ini
[server]
SSH_DOMAIN = git.yourdomain.com
SSH_PORT = 2222
```

Open port on VPS

```bash
ufw allow 2222/tcp
```

## Organizing Access at Scale

Create roles with named resource permissions:

| Role           | Resources                                       |
|----------------|-------------------------------------------------|
| Admin          | All resources, full access                     |
| Family         | Jellyfin, Home Assistant, Nextcloud            |
| Developer      | Gitea, Grafana, Portainer, PostgreSQL, Redis  |
| Remote Support | SSH to specific servers only                    |

[Part 4: Web Apps](/content/guides/series/pangolin/exposing-web-apps/index.html) [Part 6: Production Hardening](/content/guides/series/pangolin/production-hardening/index.html)