Pangolin 1.24 adds two distinct routing capabilities: Exit Nodes send a Pangolin client’s internet traffic out through a selected site, while Linux subnet-router mode lets devices without Pangolin clients reach private Pangolin resources through a Linux machine. One changes a client’s egress path; the other connects a LAN to resources on the Pangolin network.
Exit Nodes: client egress
Pangolin normally uses split tunnelling: traffic to Pangolin sites and resources uses the tunnel, while other internet traffic follows the client device’s usual connection. An Exit Node is a private resource with the Exit Node type and one or more attached sites. Roles, users, and machine clients control access. When a client selects it, internet traffic exits through one of those sites. The 1.24 announcement says clients choose among attached sites using latency, throughput, and availability. An Exit Node has no destination of its own and permits TCP, UDP, and ICMP.
There is an IPv6 discrepancy to resolve before relying on this as a full-tunnel control. The 1.24 announcement lists the default routes 0.0.0.0/0 and ::/0, test IPv6 separately and do not assume it is covered by the exit path.
Other Pangolin resources remain reachable while an Exit Node is active. A precedence setting can send all routes through the Exit Node, but Pangolin warns that other resources, DNS aliases, and subnets may stop working while it is enabled.
Linux subnet router: LAN access to Pangolin resources
A Linux machine running the Pangolin CLI can start with --subnet-router. Pangolin says this enables IPv4 forwarding and installs nftables rules. Devices behind that router can reach Pangolin resources without installing the client themselves; their ordinary internet routing stays unchanged.
The route still needs to be in place. If the Linux client is not the LAN’s default gateway, configure the gateway with routes for the Pangolin resource CIDRs via the Linux router, and check host and network firewall rules. Pangolin says its access-control policies continue to apply to subnet-router traffic.
Threat-model considerations
An Exit Node moves the client’s internet egress to the selected site. External services see that site’s public IP, and the site’s network is in the traffic path. Treat the site and its operator as part of the trust model; the extent to which application data is readable still depends on its encryption.
A subnet router broadens which devices can reach Pangolin resources. The effective scope depends on the routes, firewall rules, and Pangolin access policies. It does not automatically make every device on the LAN reachable, and it does not send those devices’ general internet traffic through the Exit Node.
Deployment checks
- Upgrade the site connector before creating Exit Node resources. Pangolin lists CLI v0.18.0+ or Newt v1.18.0+ as the requirement.
- Use supported client releases. The announcement lists Windows 0.15.0, macOS 0.12.0, iOS 0.11.0, Android 0.8.0, and CLI 0.18.0; the release notes say exit-node support shipped in client releases after 29 September 2026.
- Back up Pangolin’s config app-data before updating. The release notes warn that downgrading without a backup may be difficult.
- Test the expected resource access and egress IP, and verify IPv4 and IPv6 behaviour separately.
Exit Nodes and subnet routers solve different routing problems. Review both the egress site and the LAN routes when deciding where trust and access boundaries should sit.