github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-07-16 14:47:04 -05:00
Code Issues 1.6k Packages Projects Releases 79 Wiki Activity

[GH-ISSUE #1424] Connection recurrently drops after some seconds (Periodic ping failed) #10664

New Issue
Closed
opened 2026-05-06 14:26:26 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-05-06 14:26:26 -05:00
Owner
Copy Link

Originally created by @DenkingOfficial on GitHub (Sep 7, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1424

Bug Description

Impossible to connect to tunnel, newt can't establish stable connection.

Steps to Reproduce

  1. Run fresh pangolin (latest) with the following docker compose and configs:
services:
  pangolin:
    image: fosrl/pangolin:latest
    container_name: pangolin
    restart: unless-stopped
    volumes:
      - ./config:/app/config
      - pangolin-data:/var/certificates
      - pangolin-data:/var/dynamic
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
      interval: "3s"
      timeout: "3s"
      retries: 15

  gerbil:
    image: fosrl/gerbil:latest
    container_name: gerbil
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --reachableAt=http://gerbil:3003
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://pangolin:3001/api/v1/
    volumes:
      - ./config/:/var/config
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    ports:
      - 51820:51820/udp
      - 21820:21820/udp
      - 443:443
      - 80:80

  traefik:
    image: traefik:v3.4.0
    container_name: traefik
    restart: unless-stopped
    network_mode: service:gerbil
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    volumes:
      - ./config/traefik:/etc/traefik:ro
      - ./config/letsencrypt:/letsencrypt
      - pangolin-data:/var/certificates:ro
      - pangolin-data:/var/dynamic:ro

networks:
  default:
    driver: bridge
    name: pangolin

volumes:
  pangolin-data:

config.yml:

app:
  dashboard_url: "http://some.domain.com"

domains:
  domain1:
    base_domain: "domain.com"
    cert_resolver: "letsencrypt"

server:
  secret: "strong-secret"

gerbil:
  base_endpoint: "some.domain.com"

flags:
  require_email_verification: false
  disable_signup_without_invite: true
  disable_user_create_org: true

traefik-config.yml:

api:
  insecure: true
  dashboard: true

providers:
  http:
    endpoint: "http://pangolin:3001/api/v1/traefik-config"
    pollInterval: "5s"
  file:
    filename: "/etc/traefik/dynamic_config.yml"

experimental:
  plugins:
    badger:
      moduleName: "github.com/fosrl/badger"
      version: "v1.2.0"

log:
  level: "INFO"
  format: "common"

certificatesResolvers:
  letsencrypt:
    acme:
      httpChallenge:
        entryPoint: web
      email: my.email@gmail.com
      storage: "/letsencrypt/acme.json"
      caServer: "https://acme-v02.api.letsencrypt.org/directory"

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
    transport:
      respondingTimeouts:
        readTimeout: "30m"
    http:
      tls:
        certResolver: "letsencrypt"

serversTransport:
  insecureSkipVerify: true

ping:
    entryPoint: "web"

dynamic-config.yml

http:
  middlewares:
    redirect-to-https:
      redirectScheme:
        scheme: https

  routers:
    main-app-router-redirect:
      rule: "Host(`some.domain.com`)"
      service: next-service
      entryPoints:
        - web
      middlewares:
        - redirect-to-https

    next-router:
      rule: "Host(`some.domain.com`) && !PathPrefix(`/api/v1`)"
      service: next-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt

    api-router:
      rule: "Host(`some.domain.com`) && PathPrefix(`/api/v1`)"
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt

    ws-router:
      rule: "Host(`some.domain.com`)"
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt

  services:
    next-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3002"

    api-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3000"
  1. Open Dashboard
  2. Create a site with address from 100.90.128.0/24 subnet
  3. Connect to site via newt
./newt.exe --id {ID} --secret {SECRET} --endpoint https://some.domain.com
  1. Create a resource (for example http://127.0.0.1:3004 -> https://website.domain.com)
  2. See periodic connections and failures:
INFO: 2025/09/07 06:53:24 Newt version 1.4.4
INFO: 2025/09/07 06:53:24 Creating new health check monitor with certificate enforcement: false
INFO: 2025/09/07 06:53:25 Websocket connected
INFO: 2025/09/07 06:53:25 Requesting exit nodes from server
INFO: 2025/09/07 06:53:25 Received ping message
INFO: 2025/09/07 06:53:25 Received registration message
INFO: 2025/09/07 06:53:25 Connecting to endpoint: some.domain.com
INFO: 2025/09/07 06:53:25 Initial connection test successful
INFO: 2025/09/07 06:53:25 Tunnel connection to server established successfully!
INFO: 2025/09/07 06:53:25 Successfully added 0 health check targets
INFO: 2025/09/07 06:53:47 Started tcp proxy to 127.0.0.1:3004
WARN: 2025/09/07 06:53:59 Periodic ping failed (2 consecutive failures): all 2 ping attempts failed, last error: failed to read ICMP packet: i/o timeout
WARN: 2025/09/07 06:54:12 Periodic ping failed (3 consecutive failures): all 2 ping attempts failed, last error: failed to read ICMP packet: i/o timeout
WARN: 2025/09/07 06:54:29 Periodic ping failed (4 consecutive failures): all 2 ping attempts failed, last error: failed to read ICMP packet: i/o timeout
WARN: 2025/09/07 06:54:29 Connection to server lost after 4 failures. Continuous reconnection attempts will be made.
INFO: 2025/09/07 06:54:29 Received ping message
INFO: 2025/09/07 06:54:29 Received registration message
INFO: 2025/09/07 06:54:29 Stopping ping check
INFO: 2025/09/07 06:54:29 Connecting to endpoint: some.domain.com
INFO: 2025/09/07 06:54:29 Initial connection test successful
INFO: 2025/09/07 06:54:29 Tunnel connection to server established successfully!
INFO: 2025/09/07 06:54:29 Successfully added 0 health check targets
INFO: 2025/09/07 06:54:29 Started tcp proxy to 127.0.0.1:3004
...

Expected Behavior

Connection should not be canceled randomly and https://website.domain.com should be accessible

Actual Behavior

Connection always drops, all I could sometimes get is the title of website on https://website.domain.com and then nothing

Environment

Pangolin Version: latest (1.9.4), also tried 1.8.0
Newt Version: 1.4.4
Deployment: Docker Compose on VPS (fosrl/pangolin)
OS: Debian 12.2.0-14+deb12u1

Additional Context

Ports 80, 443, 51820 and 21820 are open and available on VPS. One of my friends has the exact same problem.

Thank you very much in advance for your help!

Originally created by @DenkingOfficial on GitHub (Sep 7, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/1424 # Bug Description Impossible to connect to tunnel, newt can't establish stable connection. # Steps to Reproduce 1. Run fresh pangolin (latest) with the following docker compose and configs: ```docker-compose.yaml services: pangolin: image: fosrl/pangolin:latest container_name: pangolin restart: unless-stopped volumes: - ./config:/app/config - pangolin-data:/var/certificates - pangolin-data:/var/dynamic healthcheck: test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"] interval: "3s" timeout: "3s" retries: 15 gerbil: image: fosrl/gerbil:latest container_name: gerbil restart: unless-stopped depends_on: pangolin: condition: service_healthy command: - --reachableAt=http://gerbil:3003 - --generateAndSaveKeyTo=/var/config/key - --remoteConfig=http://pangolin:3001/api/v1/ volumes: - ./config/:/var/config cap_add: - NET_ADMIN - SYS_MODULE ports: - 51820:51820/udp - 21820:21820/udp - 443:443 - 80:80 traefik: image: traefik:v3.4.0 container_name: traefik restart: unless-stopped network_mode: service:gerbil depends_on: pangolin: condition: service_healthy command: - --configFile=/etc/traefik/traefik_config.yml volumes: - ./config/traefik:/etc/traefik:ro - ./config/letsencrypt:/letsencrypt - pangolin-data:/var/certificates:ro - pangolin-data:/var/dynamic:ro networks: default: driver: bridge name: pangolin volumes: pangolin-data: ``` config.yml: ```config.yml app: dashboard_url: "http://some.domain.com" domains: domain1: base_domain: "domain.com" cert_resolver: "letsencrypt" server: secret: "strong-secret" gerbil: base_endpoint: "some.domain.com" flags: require_email_verification: false disable_signup_without_invite: true disable_user_create_org: true ``` traefik-config.yml: ```traefik-config.yml api: insecure: true dashboard: true providers: http: endpoint: "http://pangolin:3001/api/v1/traefik-config" pollInterval: "5s" file: filename: "/etc/traefik/dynamic_config.yml" experimental: plugins: badger: moduleName: "github.com/fosrl/badger" version: "v1.2.0" log: level: "INFO" format: "common" certificatesResolvers: letsencrypt: acme: httpChallenge: entryPoint: web email: my.email@gmail.com storage: "/letsencrypt/acme.json" caServer: "https://acme-v02.api.letsencrypt.org/directory" entryPoints: web: address: ":80" websecure: address: ":443" transport: respondingTimeouts: readTimeout: "30m" http: tls: certResolver: "letsencrypt" serversTransport: insecureSkipVerify: true ping: entryPoint: "web" ``` dynamic-config.yml ```dynamic-config.yml http: middlewares: redirect-to-https: redirectScheme: scheme: https routers: main-app-router-redirect: rule: "Host(`some.domain.com`)" service: next-service entryPoints: - web middlewares: - redirect-to-https next-router: rule: "Host(`some.domain.com`) && !PathPrefix(`/api/v1`)" service: next-service entryPoints: - websecure tls: certResolver: letsencrypt api-router: rule: "Host(`some.domain.com`) && PathPrefix(`/api/v1`)" service: api-service entryPoints: - websecure tls: certResolver: letsencrypt ws-router: rule: "Host(`some.domain.com`)" service: api-service entryPoints: - websecure tls: certResolver: letsencrypt services: next-service: loadBalancer: servers: - url: "http://pangolin:3002" api-service: loadBalancer: servers: - url: "http://pangolin:3000" ``` 2. Open Dashboard 3. Create a site with address from 100.90.128.0/24 subnet 4. Connect to site via newt ```powershell ./newt.exe --id {ID} --secret {SECRET} --endpoint https://some.domain.com ``` 5. Create a resource (for example http://127.0.0.1:3004 -> https://website.domain.com) 6. See periodic connections and failures: ``` INFO: 2025/09/07 06:53:24 Newt version 1.4.4 INFO: 2025/09/07 06:53:24 Creating new health check monitor with certificate enforcement: false INFO: 2025/09/07 06:53:25 Websocket connected INFO: 2025/09/07 06:53:25 Requesting exit nodes from server INFO: 2025/09/07 06:53:25 Received ping message INFO: 2025/09/07 06:53:25 Received registration message INFO: 2025/09/07 06:53:25 Connecting to endpoint: some.domain.com INFO: 2025/09/07 06:53:25 Initial connection test successful INFO: 2025/09/07 06:53:25 Tunnel connection to server established successfully! INFO: 2025/09/07 06:53:25 Successfully added 0 health check targets INFO: 2025/09/07 06:53:47 Started tcp proxy to 127.0.0.1:3004 WARN: 2025/09/07 06:53:59 Periodic ping failed (2 consecutive failures): all 2 ping attempts failed, last error: failed to read ICMP packet: i/o timeout WARN: 2025/09/07 06:54:12 Periodic ping failed (3 consecutive failures): all 2 ping attempts failed, last error: failed to read ICMP packet: i/o timeout WARN: 2025/09/07 06:54:29 Periodic ping failed (4 consecutive failures): all 2 ping attempts failed, last error: failed to read ICMP packet: i/o timeout WARN: 2025/09/07 06:54:29 Connection to server lost after 4 failures. Continuous reconnection attempts will be made. INFO: 2025/09/07 06:54:29 Received ping message INFO: 2025/09/07 06:54:29 Received registration message INFO: 2025/09/07 06:54:29 Stopping ping check INFO: 2025/09/07 06:54:29 Connecting to endpoint: some.domain.com INFO: 2025/09/07 06:54:29 Initial connection test successful INFO: 2025/09/07 06:54:29 Tunnel connection to server established successfully! INFO: 2025/09/07 06:54:29 Successfully added 0 health check targets INFO: 2025/09/07 06:54:29 Started tcp proxy to 127.0.0.1:3004 ... ``` # Expected Behavior Connection should not be canceled randomly and https://website.domain.com should be accessible # Actual Behavior Connection always drops, all I could sometimes get is the title of website on https://website.domain.com and then nothing # Environment Pangolin Version: latest (1.9.4), also tried 1.8.0 Newt Version: 1.4.4 Deployment: Docker Compose on VPS (fosrl/pangolin) OS: Debian 12.2.0-14+deb12u1 # Additional Context Ports 80, 443, 51820 and 21820 are open and available on VPS. One of my friends has the exact same problem. Thank you very much in advance for your help!
GiteaMirror commented 2026-05-06 14:26:29 -05:00
Author
Owner
Copy Link

@DenkingOfficial commented on GitHub (Sep 7, 2025):

UPD: Found out that it is my country blocking plain WireGuard protocol

<!-- gh-comment-id:3264161527 --> @DenkingOfficial commented on GitHub (Sep 7, 2025): UPD: Found out that it is my country blocking plain WireGuard protocol
GiteaMirror commented 2026-05-06 14:26:30 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (Sep 24, 2025):

That sucks I am sorry!

<!-- gh-comment-id:3330330702 --> @oschwartz10612 commented on GitHub (Sep 24, 2025): That sucks I am sorry!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#10664
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?