mirror of
https://github.com/fosrl/docs-v2.git
synced 2026-10-22 20:49:15 +02:00
56 lines
3.9 KiB
Plaintext
56 lines
3.9 KiB
Plaintext
---
|
|
title: "Host"
|
|
description: "Route client traffic to a single IP address or FQDN on the remote network"
|
|
---
|
|
|
|
A host private resource exposes a single machine on your remote network to connected Pangolin clients. When a user connects with the Pangolin client and has access to the resource, traffic destined for that host is carried over the tunnel to the site, which delivers it on the remote network.
|
|
|
|
Host resources are the most common private resource type. They do not render in a browser—you use native applications (a database client, `curl`, an RDP client, etc.) against the destination address while the Pangolin client is connected.
|
|
|
|
## Benefits
|
|
|
|
- Nothing is exposed to the public internet. The host is only reachable by clients that are connected and granted access.
|
|
- Access is scoped to a single machine, not the whole network behind the site, so users only reach what they need.
|
|
- Any TCP or UDP protocol works, and you can narrow it to specific ports with port restrictions.
|
|
- An alias gives users a stable, memorable name for the host without any external DNS records.
|
|
- Attaching several sites gives the host redundant paths with automatic failover.
|
|
|
|
## Use Cases
|
|
|
|
- Connect to a database such as PostgreSQL or MySQL with your usual client, without opening its port to the internet.
|
|
- Reach an internal API, admin panel, or dashboard from a laptop on any network.
|
|
- Use a native RDP, SSH, or VNC client against a single server.
|
|
- Reach a service that only listens on the site host's loopback interface, through an alias.
|
|
- Give a machine client, such as a CI runner, access to one build server or artifact store.
|
|
|
|
## How Host Resources Work
|
|
|
|
When a user with access connects, the Pangolin client starts routing traffic for the host over the encrypted tunnel. That covers the destination address and, if the resource has one, its alias, which the client resolves through Pangolin. A site attached to the resource receives the traffic and sends it to the destination on its local network. Responses come back the same way.
|
|
|
|
The site resolves the destination, so an FQDN only needs to resolve from the site's network, not from the user's device. Traffic to any other address stays on the user's normal network path, since the client only routes resources the user has access to.
|
|
|
|
## Destination
|
|
|
|
Every host resource has a [destination](/manage/resources/private/destinations): a single IP address or fully qualified domain name (FQDN).
|
|
|
|
| Destination type | Example | When to use |
|
|
|------------------|---------|-------------|
|
|
| IP address | `10.1.0.35` | A host with a stable IP on the remote network |
|
|
| FQDN | `db.autoco.internal` | A host identified by DNS that may change IP |
|
|
| Loopback | `127.0.0.1` | A service running on the site connector host itself |
|
|
|
|
### Loopback on the Site Host
|
|
|
|
If the service runs on the same machine as the site connector, set the destination to `127.0.0.1` or `localhost`. On the user's machine, `localhost` always refers to their own computer—not the remote site. You must add an [alias](/manage/resources/private/alias) (for example `metrics.site-internal.example`) so users connect to a name that Pangolin resolves over the tunnel.
|
|
|
|
## Port Restrictions
|
|
|
|
By default, all TCP and UDP ports on the destination are reachable. Tighten access with [port restrictions](/manage/resources/private/port-restrictions) to allow only the ports your application needs.
|
|
|
|
## Multi-Site Routing
|
|
|
|
Attach multiple sites to a host resource when the same destination is reachable from more than one connector. Pangolin [routes traffic through the best available site](/manage/resources/private/multi-site-routing) and fails over automatically when a site goes offline.
|
|
|
|
## Aliases
|
|
|
|
Optionally assign an [alias](/manage/resources/private/alias) so users connect with a memorable hostname instead of a raw IP. Aliases are required for loopback destinations and recommended when the same IP exists on overlapping networks across sites. |