It is correct that pangolin is something like pinggy.io or cf tunnels as you mention. But those do not give such fine grained access control it seems - like a firewall checking identity and all.

But definitely it is not a vpn or mesh network it seems.