Feature Request: Add HostChecker Support for Client Security Validation #886

New Issue

MrUnknownDE · 2026-04-05T17:55:13+02:00

MrUnknownDE commented

2026-04-05 17:55:13 +02:00

Originally created by @lordraiden on 9/20/2025

First of all, thank you for your great work on Pangolin — it's an impressive project and a valuable tool for secure networking.

I'd like to propose a feature enhancement: support for HostChecker capabilities to validate client security posture before granting access.

Motivation

In many enterprise environments, it's critical to ensure that connecting clients meet certain security requirements (e.g., antivirus running, disk encryption enabled, OS version compliant, etc.) before allowing access to internal resources. This is commonly achieved through a host checker mechanism.

Adding host checker support to Pangolin would:

Improve endpoint security posture enforcement
Enable conditional access based on device health
Align Pangolin with enterprise-grade VPN solutions

Suggested Implementation

While implementation details may vary, the general idea would be:

Introduce a pluggable host validation module
Allow administrators to define required checks (e.g., registry keys, running processes, OS version)
Perform validation during client handshake or pre-authentication
Optionally integrate with external tools or scripts for custom checks

Use Cases

Enforcing compliance for BYOD devices
Preventing access from outdated or insecure systems
Integrating with MDM or endpoint protection platforms

Would love to hear your thoughts on this. Happy to help with testing or contributing if this is something you'd consider adding.

*Originally created by @lordraiden on 9/20/2025* First of all, thank you for your great work on Pangolin — it's an impressive project and a valuable tool for secure networking. I'd like to propose a feature enhancement: support for HostChecker capabilities to validate client security posture before granting access. Motivation In many enterprise environments, it's critical to ensure that connecting clients meet certain security requirements (e.g., antivirus running, disk encryption enabled, OS version compliant, etc.) before allowing access to internal resources. This is commonly achieved through a host checker mechanism. Adding host checker support to Pangolin would: - Improve endpoint security posture enforcement - Enable conditional access based on device health - Align Pangolin with enterprise-grade VPN solutions Suggested Implementation While implementation details may vary, the general idea would be: - Introduce a pluggable host validation module - Allow administrators to define required checks (e.g., registry keys, running processes, OS version) - Perform validation during client handshake or pre-authentication - Optionally integrate with external tools or scripts for custom checks Use Cases - Enforcing compliance for BYOD devices - Preventing access from outdated or insecure systems - Integrating with MDM or endpoint protection platforms Would love to hear your thoughts on this. Happy to help with testing or contributing if this is something you'd consider adding.

MrUnknownDE closed this issue

2026-04-05 17:55:13 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#886