---
title: "Endpoints & Relays"
icon: "network-wired"
description: "Pangolin Cloud hostnames for firewall allowlists and network whitelisting"
---

<Note>
    This page applies to [Pangolin Cloud](https://app.pangolin.net/auth/signup)
    only. If you self-host Pangolin, see [DNS &
    Networking](/self-host/dns-and-networking) for the hostnames and ports on
    your own deployment.
</Note>

Use this page when you need to allowlist Pangolin in a corporate firewall, proxy, or egress policy. Sites, clients, and browsers connect to two classes of infrastructure on Pangolin Cloud: the **control plane** and **points of presence** (also called relays).

## Control Plane

The control plane is the central Pangolin service that runs the dashboard, REST API, authentication, and configuration orchestration.

| Hostname           | Purpose                                                                           |
| ------------------ | --------------------------------------------------------------------------------- |
| `app.pangolin.net` | Dashboard, API, authentication, and WebSocket configuration for sites and clients |

Sites and clients use this hostname as their **endpoint**. For example, Sites connect here to register, receive policy, and maintain their control channel.

## Points of Presence

Points of presence (PoPs), also called relays, are the networking edge where sites and clients connect for data traffic.

| Hostname                   | Location |
| -------------------------- | -------- |
| `jupiter.pop.pangolin.net` | US West  |
| `saturn.pop.pangolin.net`  | US West  |
| `neptune.pop.pangolin.net` | US West  |
| `earth.pop.pangolin.net`   | US East  |
| `mars.pop.pangolin.net`    | US East  |
| `erid.pop.pangolin.net`    | US East  |
| `pluto.pop.pangolin.net`   | US East  |
| `uranus.pop.pangolin.net`  | Europe   |
| `venus.pop.pangolin.net`   | Europe   |
| `mercury.pop.pangolin.net` | Europe   |

### What PoPs Do

- **Public resources** send all traffic through a PoP.
- **Private resources** use PoPs to coordinate [NAT traversal](/manage/clients/nat-traversal) between a client and a site. If hole punching fails, traffic relays through the PoP instead.

Pangolin sites and clients automatically select the most optimal PoP to connect to. You do not choose a PoP manually during normal operation.

## Remote Nodes

If you use [remote nodes](/manage/remote-node/understanding-nodes), the point of presence (relay) for your traffic is your self-hosted node, not the cloud PoPs listed above.

The control plane endpoint for dashboard access, API calls, and authentication remains `app.pangolin.net`.

## Whitelisting Checklist

To allow Pangolin Cloud on an outbound firewall or proxy, permit traffic to:

1. `app.pangolin.net` for the control plane
2. All `*.pop.pangolin.net` hostnames listed above for site and client data traffic

If you use remote nodes, also allow traffic to your remote node's public hostname or IP address.