github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-07-16 06:08:33 -05:00
Code Issues 1.6k Packages Projects Releases 79 Wiki Activity

[GH-ISSUE #1526] Hole punch process failing - prevents tunnel establishment and all connectivity #12745

New Issue
Closed
opened 2026-05-13 18:08:01 -05:00 by GiteaMirror · 11 comments
GiteaMirror commented 2026-05-13 18:08:01 -05:00
Owner
Copy Link

Originally created by @devarmada on GitHub (Sep 23, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1526

Problem

Newt client connects via WebSocket but tunnel never establishes because hole punch process fails, leaving site.endpoint null and blocking WireGuard configuration delivery.

Environment

• Pangolin Server: 1.10.2 in Podman on Debian VPS
• Gerbil: 1.2.1 in Podman on Debian VPS
• Newt Client: 1.5.0 on Raspberry Pi 4, Raspbian Bullseye (ARM64)
• Network: Newt on local network 172.19.1.0/24, Pangolin on public VPS

Root Cause

Hole punch process fails → site.endpoint remains null → WireGuard config blocked → no tunnel

Flow:

  1. Newt connects via WebSocket
  2. Newt requests newt/wg/get-config
  3. Pangolin checks site.endpoint - it's null
  4. Returns early, no WireGuard config sent
  5. No tunnel established

Evidence

Pangolin logs - can't find endpoint

2025-09-23T10:05:32.524Z [warn]: Site 2 has no endpoint, skipping

Newt logs - can't get WireGuard config

Sep 23 12:05:50 dente newt[408]: INFO: SendMessageInterval timed out after 10 attempts for message type: newt/wg/get-config

Impact

• HTTP resources: 504 Gateway Timeout
• TCP resources: Non-functional
• All tunnel-dependent features broken
• Core Pangolin functionality unusable

Versions Tested

• Pangolin 1.10.2 + gerbil 1.2.1 + newt 1.5.0

The hole punch endpoint /api/v1/gerbil/update-hole-punch is never successfully called, preventing the site.endpoint field from being set, which blocks all tunnel functionality.

Originally created by @devarmada on GitHub (Sep 23, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/1526 ## Problem Newt client connects via WebSocket but tunnel never establishes because hole punch process fails, leaving site.endpoint null and blocking WireGuard configuration delivery. ## Environment • **Pangolin Server:** 1.10.2 in Podman on Debian VPS • **Gerbil:** 1.2.1 in Podman on Debian VPS • **Newt Client:** 1.5.0 on Raspberry Pi 4, Raspbian Bullseye (ARM64) • **Network:** Newt on local network 172.19.1.0/24, Pangolin on public VPS ## Root Cause Hole punch process fails → site.endpoint remains null → WireGuard config blocked → no tunnel Flow: 1. Newt connects via WebSocket 2. Newt requests newt/wg/get-config 3. Pangolin checks site.endpoint - it's null 4. Returns early, no WireGuard config sent 5. No tunnel established ## Evidence # Pangolin logs - can't find endpoint `2025-09-23T10:05:32.524Z [warn]: Site 2 has no endpoint, skipping` # Newt logs - can't get WireGuard config `Sep 23 12:05:50 dente newt[408]: INFO: SendMessageInterval timed out after 10 attempts for message type: newt/wg/get-config` ## Impact • HTTP resources: 504 Gateway Timeout • TCP resources: Non-functional • All tunnel-dependent features broken • Core Pangolin functionality unusable ## Versions Tested • Pangolin 1.10.2 + gerbil 1.2.1 + newt 1.5.0 The hole punch endpoint `/api/v1/gerbil/update-hole-punch` is never successfully called, preventing the site.endpoint field from being set, which blocks all tunnel functionality.
GiteaMirror added the stale label 2026-05-13 18:08:01 -05:00
GiteaMirror commented 2026-05-13 18:08:02 -05:00
Author
Owner
Copy Link

@AstralDestiny commented on GitHub (Sep 23, 2025):

You have wireguard port open? and does your newt succeed even getting to icmp ping tests?

<!-- gh-comment-id:3323980360 --> @AstralDestiny commented on GitHub (Sep 23, 2025): You have wireguard port open? and does your newt succeed even getting to icmp ping tests?
GiteaMirror commented 2026-05-13 18:08:03 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (Sep 23, 2025):

^^ port 51820 and port 21820 https://docs.digpangolin.com/manage/clients/add-client#prerequisites

<!-- gh-comment-id:3324039745 --> @oschwartz10612 commented on GitHub (Sep 23, 2025): ^^ port 51820 and port 21820 https://docs.digpangolin.com/manage/clients/add-client#prerequisites
GiteaMirror commented 2026-05-13 18:08:03 -05:00
Author
Owner
Copy Link

@devarmada commented on GitHub (Sep 23, 2025):

I have missed that resource, sorry.
Port 51820 was already there, I've added port 21820
The VPS has no firewall, BTW

These are the logs from the newt client

-- Journal begins at Mon 2025-09-22 13:12:38 CEST. --
Sep 23 15:42:23 dente systemd[1]: newt.service: Succeeded.
Sep 23 15:42:23 dente systemd[1]: Stopped Newt Pangolin Client.
Sep 23 15:42:23 dente systemd[1]: newt.service: Consumed 28.037s CPU time.
Sep 23 15:42:23 dente systemd[1]: Started Newt Pangolin Client.
Sep 23 15:42:23 dente newt[8471]: INFO: 2025/09/23 15:42:23 Newt version 1.5.0
Sep 23 15:42:24 dente newt[8471]: INFO: 2025/09/23 15:42:24 Setting up clients with netstack...
Sep 23 15:42:24 dente newt[8471]: INFO: 2025/09/23 15:42:24 Websocket connected
Sep 23 15:42:24 dente newt[8471]: INFO: 2025/09/23 15:42:24 Requesting WireGuard configuration from remote server
Sep 23 15:42:25 dente newt[8471]: INFO: 2025/09/23 15:42:25 Connecting to endpoint: pangolin.derinaldis.com
Sep 23 15:42:25 dente newt[8471]: INFO: 2025/09/23 15:42:25 Starting UDP hole punch routine to 66.63.168.184:21820
Sep 23 15:42:25 dente newt[8471]: INFO: 2025/09/23 15:42:25 Tunnel connection to server established successfully!
Sep 23 15:42:25 dente newt[8471]: INFO: 2025/09/23 15:42:25 Started tcp proxy to 172.19.1.34:2234
Sep 23 15:42:25 dente newt[8471]: INFO: 2025/09/23 15:42:25 Started udp proxy to 127.0.0.1:57367
Sep 23 15:42:44 dente newt[8471]: INFO: 2025/09/23 15:42:44 SendMessageInterval timed out after 10 attempts for message type: newt/wg/get-config
<!-- gh-comment-id:3324085079 --> @devarmada commented on GitHub (Sep 23, 2025): I have missed that resource, sorry. Port 51820 was already there, I've added port 21820 The VPS has no firewall, BTW These are the logs from the newt client ``` -- Journal begins at Mon 2025-09-22 13:12:38 CEST. -- Sep 23 15:42:23 dente systemd[1]: newt.service: Succeeded. Sep 23 15:42:23 dente systemd[1]: Stopped Newt Pangolin Client. Sep 23 15:42:23 dente systemd[1]: newt.service: Consumed 28.037s CPU time. Sep 23 15:42:23 dente systemd[1]: Started Newt Pangolin Client. Sep 23 15:42:23 dente newt[8471]: INFO: 2025/09/23 15:42:23 Newt version 1.5.0 Sep 23 15:42:24 dente newt[8471]: INFO: 2025/09/23 15:42:24 Setting up clients with netstack... Sep 23 15:42:24 dente newt[8471]: INFO: 2025/09/23 15:42:24 Websocket connected Sep 23 15:42:24 dente newt[8471]: INFO: 2025/09/23 15:42:24 Requesting WireGuard configuration from remote server Sep 23 15:42:25 dente newt[8471]: INFO: 2025/09/23 15:42:25 Connecting to endpoint: pangolin.derinaldis.com Sep 23 15:42:25 dente newt[8471]: INFO: 2025/09/23 15:42:25 Starting UDP hole punch routine to 66.63.168.184:21820 Sep 23 15:42:25 dente newt[8471]: INFO: 2025/09/23 15:42:25 Tunnel connection to server established successfully! Sep 23 15:42:25 dente newt[8471]: INFO: 2025/09/23 15:42:25 Started tcp proxy to 172.19.1.34:2234 Sep 23 15:42:25 dente newt[8471]: INFO: 2025/09/23 15:42:25 Started udp proxy to 127.0.0.1:57367 Sep 23 15:42:44 dente newt[8471]: INFO: 2025/09/23 15:42:44 SendMessageInterval timed out after 10 attempts for message type: newt/wg/get-config ```
GiteaMirror commented 2026-05-13 18:08:03 -05:00
Author
Owner
Copy Link

@miloschwartz commented on GitHub (Sep 27, 2025):

Seems like it's working now?

<!-- gh-comment-id:3342098769 --> @miloschwartz commented on GitHub (Sep 27, 2025): Seems like it's working now?
GiteaMirror commented 2026-05-13 18:08:04 -05:00
Author
Owner
Copy Link

@devarmada commented on GitHub (Sep 28, 2025):

It isn't working 😭
I still have the same issue and I made no progress at all.
Thanks for checking, anyway!

<!-- gh-comment-id:3343351858 --> @devarmada commented on GitHub (Sep 28, 2025): It isn't working 😭 I still have the same issue and I made no progress at all. Thanks for checking, anyway!
GiteaMirror commented 2026-05-13 18:08:04 -05:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Oct 13, 2025):

This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

<!-- gh-comment-id:3395517365 --> @github-actions[bot] commented on GitHub (Oct 13, 2025): This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
GiteaMirror commented 2026-05-13 18:08:05 -05:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Oct 27, 2025):

This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.

<!-- gh-comment-id:3449076855 --> @github-actions[bot] commented on GitHub (Oct 27, 2025): This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.
GiteaMirror commented 2026-05-13 18:08:05 -05:00
Author
Owner
Copy Link

@LunkSnee commented on GitHub (Dec 27, 2025):

also experiencing this. using Oracle Cloud and have all ports open. I can ping it directly, but the newt can't ping.

<!-- gh-comment-id:3693561810 --> @LunkSnee commented on GitHub (Dec 27, 2025): also experiencing this. using Oracle Cloud and have all ports open. I can ping it directly, but the newt can't ping.
GiteaMirror commented 2026-05-13 18:08:05 -05:00
Author
Owner
Copy Link

@AstralDestiny commented on GitHub (Dec 27, 2025):

You added it to both the pangolin instance and the oracle web ui for ports for UDP 21820 / 51820 ? @LunkSnee ?

<!-- gh-comment-id:3693959520 --> @AstralDestiny commented on GitHub (Dec 27, 2025): You added it to both the pangolin instance and the oracle web ui for ports for UDP 21820 / 51820 ? @LunkSnee ?
GiteaMirror commented 2026-05-13 18:08:06 -05:00
Author
Owner
Copy Link

@zelo66 commented on GitHub (Dec 29, 2025):

Same for me, firewall disabled

<!-- gh-comment-id:3696377888 --> @zelo66 commented on GitHub (Dec 29, 2025): Same for me, firewall disabled
GiteaMirror commented 2026-05-13 18:08:06 -05:00
Author
Owner
Copy Link

@LunkSnee commented on GitHub (Dec 29, 2025):

You added it to both the pangolin instance and the oracle web ui for ports for UDP 21820 / 51820 ? @LunkSnee ?

Yes, I did. Not sure what was causing the issue, but I shutdown the containers, erased the database, and started back up fresh, and I was able to get things to connect. Just destroying the containers without erasing the database didn't fix it. I had to start fresh. Its up and running now.

<!-- gh-comment-id:3697102545 --> @LunkSnee commented on GitHub (Dec 29, 2025): > You added it to both the pangolin instance and the oracle web ui for ports for UDP 21820 / 51820 ? [@LunkSnee](https://github.com/LunkSnee) ? Yes, I did. Not sure what was causing the issue, but I shutdown the containers, erased the database, and started back up fresh, and I was able to get things to connect. Just destroying the containers without erasing the database didn't fix it. I had to start fresh. Its up and running now.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#12745
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?