Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To self-host Pangolin and connect a remote network, run the Pangolin coordination server on a public Linux host, point a domain at it, open the required firewall ports, create a site in the Pangolin dashboard, and run one Newt connector at that site. Newt maintains the outbound tunnel, handles NAT traversal and routing, and keeps the remote network connected without requiring a public IP at every location.
The important operational detail is that a connected site is not automatically exposed. You must define resources and grant access in Pangolin before users can reach anything. Private resources require a Pangolin client; public resources can be opened in a browser.
What Pangolin and Newt do
Pangolin is the central coordination server. It stores configuration and access policies, authenticates users, and coordinates clients and sites. Newt is the lightweight connector installed at each remote network. It creates the secure tunnel to Pangolin, performs NAT traversal, and routes traffic between approved resources and authorized users.
Pangolin can be consumed as a managed cloud service or operated on your own infrastructure. The official documentation describes the self-hosted option this way: “You can use Pangolin Cloud, which is fully managed, or you can self-host your own Pangolin server for complete control over your infrastructure and data.”
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
What happens when a site connects
- You create a site in the Pangolin dashboard.
- Pangolin generates a site ID and secret.
- You start Newt inside the remote network with those credentials and your Pangolin endpoint.
- Newt opens and maintains an outbound connection to Pangolin, even when the site is behind a firewall or carrier-grade NAT.
- You define resources, attach the appropriate site, and grant access to users or roles.
- Authorized users connect through the Pangolin client for private resources, or use a browser for resources you deliberately publish publicly.
Deploying Newt alone does not create an unrestricted bridge into the remote LAN. Pangolin blocks traffic until a resource definition and an access policy allow it.
Prerequisites for a self-hosted server
Prepare all of the following before running the installer. Doing this first avoids certificate, login, and connectivity failures during setup.
- Linux server: a machine with root access and a public IP address.
- Operating system: the quick-install guide recommends Ubuntu 20.04 or newer, or Debian 11 or newer.
- Domain name: a DNS record that points the Pangolin hostname to the server’s public IP.
- Email address: used for Let’s Encrypt certificates and the administrator login.
- Firewall access: TCP ports 80 and 443, plus UDP ports 51820 and 21820, must be reachable as required by the installation guide.
- SSH access: you need a way to log in to the server as root or as a user that can elevate to root.
The guide estimates that the installation itself takes “2–3 minutes depending on your internet connection” once these prerequisites are ready. Treat that as an operational estimate, not a guaranteed benchmark; DNS propagation, package downloads, certificate issuance, and container startup can take longer.
Choose the server placement
Place Pangolin on a public VPS or another Internet-reachable Linux host. The server does not need to sit inside any of the private networks you intend to connect. Each site can remain behind its own firewall while Newt maintains the outbound relationship with Pangolin.
Plan names before you install
Choose a stable hostname such as pangolin.example.net, decide which email address will receive certificate and administrator messages, and create a naming convention for sites such as office, lab, or warehouse. Consistent names make the dashboard and future automation easier to manage.
Prepare DNS and the firewall
Point the hostname at the server
- Create an A record for the Pangolin hostname pointing to the server’s public IPv4 address.
- If you will use IPv6, create an AAAA record only when the server is correctly configured for IPv6 and the firewall permits the same service.
- Allow time for the record to resolve before requesting certificates or opening the dashboard.
Use the exact hostname you intend to enter as the Pangolin endpoint. A certificate issued for one name will not automatically cover a different name or a raw IP address.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Allow the documented ports
| Port | Protocol | Requirement |
|---|---|---|
| 80 | TCP | Allow inbound access as required by the quick-install guide. |
| 443 | TCP | Allow inbound access as required by the quick-install guide. |
| 51820 | UDP | Allow inbound access for clients as required by the quick-install guide. |
| 21820 | UDP | Allow inbound access for clients as required by the quick-install guide. |
Apply the rules both in the server’s host firewall and, where applicable, in the VPS provider’s security group. A rule in only one of those layers is insufficient. Keep all other inbound ports closed unless another service on the host genuinely needs them.
Install Pangolin on the Linux host
1. Connect over SSH
Log in to the prepared server and switch to a root shell, or use a privileged account for every installation command. Confirm that the hostname resolves to this machine and that the required ports are allowed before continuing.
2. Download and run the official installer
Use the installer from the official Pangolin quick-install documentation rather than copying a command from an old tutorial. The installer creates the Pangolin containers and prepares the self-hosted stack. Follow its prompts for the domain, email address, and administrator details.
Do not modify generated configuration files until the initial stack has started successfully. If your organization requires a change-controlled deployment, save the installer output and the generated configuration as protected administrative records.
3. Start the containers
Start the Pangolin containers when the installer finishes. If you choose to defer startup, start them before opening the dashboard. On the first startup, retrieve the initial token from the Pangolin container logs if the installer instructs you to do so. Treat that token like a password: copy it through a secure channel, avoid pasting it into tickets or public chat, and rotate or replace it according to your administrative procedure.
4. Open the dashboard
Browse to the HTTPS hostname you configured. Complete the administrator login with the email address prepared earlier, confirm that the certificate is valid for the hostname, and verify that the dashboard loads without mixed-content or certificate warnings.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
5. Check the server before adding sites
- Confirm every Pangolin container is running.
- Confirm the dashboard is reachable from a network outside the VPS.
- Confirm the configured hostname resolves consistently from the locations where users and Newt connectors will run.
- Review container logs for certificate, port-binding, or startup errors.
Create a site in Pangolin
Create one Pangolin site for each remote network you want to attach. A site represents a Newt connector and the resources reachable through it; it is not simply a user account.
- Open the Pangolin dashboard’s site-management area.
- Create a site and give it a descriptive name that identifies the physical or logical network.
- Save the site and copy the generated site ID and secret.
- Store the secret in a password manager or another restricted secret store. Do not put it in a public repository, an unprotected Compose file, or a screenshot.
- Record the Pangolin HTTPS endpoint that Newt must use.
Create the site before installing Newt. The connector credentials are generated by the site record; inventing an ID or reusing credentials from another site will not establish the intended connection.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Install and run Newt at the remote site
Newt is available as a standalone binary or as a Docker container. The generic command pattern is:
newt --id <site-id> --secret <site-secret> --endpoint https://<pangolin-endpoint>Replace each angle-bracketed value with the site ID, site secret, and complete HTTPS endpoint copied from the dashboard. Run Newt on a host that can reach the resources you intend to publish. That host can be the target server itself, a nearby gateway, or supported edge hardware.
Standalone binary
A standalone binary is the smallest operational footprint. Download the build that matches the remote host’s operating system and CPU architecture, place it in a protected executable directory, and run the command above. Ensure the process starts after a reboot and that its logs are retained long enough to diagnose disconnects.
systemd on Linux
For a Linux host that uses systemd, the documented pattern is to keep the ID, secret, and endpoint in a dedicated environment file with restrictive permissions, then configure a service to launch Newt and restart it automatically if it exits.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
- Create a directory readable only by the service administrator, such as
/etc/newt. - Put the site credentials and endpoint in an environment file there, and set permissions so ordinary users cannot read the secret.
- Create a systemd unit whose start command invokes Newt with the three required values.
- Enable the unit at boot and start it.
- Use the service status and journal output to confirm that the connector remains running.
Do not put the secret directly in a world-readable unit file. If you change the site credentials, update the protected environment file and restart the service.
Docker and Compose
Run Newt as a container when the remote site already uses Docker. Pass the site ID, secret, and endpoint through environment variables or a Compose secret. Keep the Compose project private, restrict access to the host’s configuration directory, and add a health check when you need an orchestrator to detect a stalled connector. The official guidance also describes a health check that watches a file written by Newt.
Pin an image tag appropriate for your environment instead of silently tracking an untested floating tag. During updates, pull the new image, recreate the container, and verify that the site returns online before removing the previous image.
Windows service
On Windows, install Newt as a service rather than relying on an interactive console session. The documented configuration location is %PROGRAMDATA%newtnewt-clientconfig.json. Restrict permissions on that file because it contains the connector credentials, configure the service to start automatically, and inspect the Windows service and application logs after installation.
Kubernetes
Use the dedicated Helm or Kustomize guidance for Kubernetes instead of adapting a plain Docker command. The documented configuration is aligned with Newt Helm chart 1.4.0, app version 1.12.3, Kubernetes >=1.30.14-0, and default image docker.io/fosrl/newt:1.12.3.
Those values describe the documentation’s current version context, not a permanent compatibility promise. Check the chart, app, image, and cluster requirements immediately before a production rollout. Put the site secret in a Kubernetes Secret, not directly in a checked-in manifest, and use the chart’s supported readiness and restart settings.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Router and appliance deployments
The Newt documentation also covers Windows services, Unraid, Portainer-like interfaces, and an Advantech router application. Choose a router or appliance deployment when the connector should sit at the network edge and route to several internal resources. Verify that the device can resolve the Pangolin hostname, make outbound connections, and reach each internal subnet you plan to expose.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Define resources and grant access
After Newt reports the site as online, define the smallest resource needed for the first test. A resource should identify the destination and the site through which it is reachable. Avoid publishing an entire subnet when a single service, host, or port is sufficient.
- Create a resource attached to the newly online site.
- Specify the internal destination and any required protocol or port details.
- Choose whether the resource is private or public.
- Grant the resource to the intended users or roles.
- Save the policy and test from an authorized client.
Private resources require a Pangolin client connection. Public resources can be reached through a browser, so use that mode only for services that are intentionally Internet-facing and independently secured. A site can appear healthy while traffic still fails if no resource or permission exists.
How routing and NAT traversal affect the design
Remote sites normally remain behind their existing firewalls. Newt maintains an outbound connection to Pangolin, which reduces the need for complex inbound rules or a public IP at each branch. When NAT traversal succeeds, private clients may connect directly peer-to-peer; clients on the same network can use the local site address.
Direct peer-to-peer behavior is an optimization, not a prerequisite for the access model. Keep the Pangolin endpoint reachable and do not assume that every network will permit the same NAT behavior. Corporate firewalls, symmetric NAT, and restricted UDP policies can change the path used for a particular connection.
Verify a new site safely
- Check connector state: confirm Newt is running and the Pangolin dashboard shows the site online.
- Check name resolution: resolve the Pangolin hostname from the remote host and from a client network.
- Check the destination: from the Newt host, verify that the internal resource itself responds on the intended address and port.
- Check policy: confirm the resource is attached to the correct site and assigned to the test user or role.
- Test privately first: use an authenticated Pangolin client before making any resource public.
- Test from the correct network: test once from inside the remote LAN and once from an external client so local routing and remote access are not confused.
- Review logs: inspect Newt, Pangolin, and the destination service logs at the same time to identify where a request stops.
Troubleshooting by symptom
The dashboard cannot be opened
- Confirm the DNS record points to the current public IP.
- Check both the VPS security group and the host firewall for TCP 80 and 443.
- Confirm the Pangolin containers are running and that no other service occupies the required ports.
- Check certificate and container logs for a hostname mismatch or failed certificate request.
Newt never appears online
- Verify the endpoint includes
https://and uses the same hostname covered by the server certificate. - Re-copy the site ID and secret from the correct Pangolin site.
- Check outbound DNS and HTTPS access from the Newt host.
- Inspect the Newt process logs for authentication errors, malformed arguments, or repeated reconnects.
- Confirm the remote host’s clock is accurate enough for TLS validation.
The site is online but the resource fails
- Confirm the destination is reachable from the Newt host on the configured address and port.
- Check that the resource points to this site, not another site with a similar name.
- Confirm the test user or role has an explicit grant.
- For private access, verify that the client is connected and using the expected identity.
- Check local firewall rules on the destination server; a healthy tunnel does not bypass the destination’s own access controls.
A public resource loads for some users but not others
Separate browser reachability from private-client reachability. Confirm that the resource is intentionally public, test the public hostname from an unrelated network, and inspect the destination service’s host-based restrictions. If the resource should be private, remove public exposure and test through the Pangolin client instead.
Choose an operating model
| Deployment approach | Operational footprint | Credential handling | Update approach | Best fit |
|---|---|---|---|---|
| Standalone binary | Smallest; one managed process | Protected service environment file or equivalent | Replace the binary and restart the service | A single Linux host with minimal dependencies |
| Docker or Compose | Container runtime and project configuration | Environment variables or Compose secrets | Pull the selected image and recreate the container | Sites already operated with Docker |
| Kubernetes | Cluster, chart, secrets, and rollout controls | Kubernetes Secret and chart values | Update the chart or image through a controlled rollout | Repeatable, multi-site or platform-managed deployments |
| Router or appliance | Connector runs at the network edge | Device configuration store | Use the appliance’s supported package or application update path | Branch networks where the gateway can reach all required resources |
Choose the placement that gives Newt reliable access to the resources, not merely the machine that is easiest to install on. A connector on a server in one VLAN may not be able to route to services in another VLAN unless the local network permits it.
Updates, secrets, and ongoing maintenance
- Keep Pangolin and Newt on supported versions and read the current installation guidance before changing tags or binaries.
- Back up Pangolin configuration and document which sites, resources, and roles depend on each connector.
- Rotate a site secret immediately if it appears in a public repository, log export, screenshot, or support ticket.
- After every update, verify container or service health, site presence, one private resource, and any deliberately public resource.
- Monitor reconnects and failed authentication rather than checking only whether the process exists.
- Use separate site records for separate networks so a credential or routing mistake at one location does not silently affect another.
Terminology to watch as the project evolves
Newt remains the connector name used in existing deployment guides. Newer Pangolin CLI workflows may also provide the site connector, so the dashboard’s currently preferred installation method can change over time. When a new site is created, follow the method shown by the current dashboard or documentation, while recognizing that “Newt” is the term used for the connector in established instructions.
Quick Recap
A repeatable rollout checklist
- Provision a supported Linux host with root access and a public IP.
- Point the chosen domain name at that IP and prepare the administrator email address.
- Allow TCP 80 and 443 plus UDP 51820 and 21820 as required by the quick-install guide.
- Install Pangolin, start its containers, and retrieve the initial token from logs if startup was deferred.
- Log in to the HTTPS dashboard and verify the server is healthy.
- Create a named site for the remote network and copy its generated ID and secret.
- Install Newt on a host or edge device that can reach the target resources.
- Run Newt with the site ID, secret, and Pangolin HTTPS endpoint.
- Confirm the site is online before defining traffic.
- Create the smallest resource definition, grant it to a test identity, and test privately.
- Publish a resource publicly only when browser access is intentional and the destination is secured for public exposure.
- Record the deployment method, version context, secret location, and verification results for future maintenance.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
