mirror of
https://github.com/fosrl/pangolin.git
synced 2026-07-16 14:47:04 -05:00
[GH-ISSUE #1616] Possible Bug - Pangolin blocks access when resource is accessed using a VPN. #16943
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/pangolin#16943
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @keonramses on GitHub (Oct 5, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1616
Describe the Bug
I am not sure if this is intended, a bug or a misconfiguration on my part. But when I try to access a resource using a VPN (Windscribe), the connection gets refused by Pangolin. I do not have any GeoIP middleware configured or rules restricting the connecting IP address.
Environment
To Reproduce
Expected Behavior
The resource should be accessible even if the client is connecting using a VPN.
@hhftechnology commented on GitHub (Oct 5, 2025):
you dont need gerbil on local machine. UDP port is causing the issue with the vps.
Just use Pangolin Version: 1.10.3 and Traefik Version: 3.5 for local deployment.
Or manage your clashing UDP ports if you intend to use gerbil anyways.
@keonramses commented on GitHub (Oct 5, 2025):
I just set this up per the guide. I know they mention VPS in it, and not a local machine. But I will remove gerbil from the stack and see if the resource is still reachable and get back to you, thank you.
@keonramses commented on GitHub (Oct 5, 2025):
So taking gerbil out is a no-go because I do not have the ability to port forward on my network.
@keonramses commented on GitHub (Oct 5, 2025):
I corrected my opening - the error message from Traefik was not related to my issue. (This was because I had restarted Pangolin and tried to connect.), Once I am connected to the VPN, the connection request does not complete, and there are no errors in Pangolin. newt, gerbil or traefik access logs.
@l3pr-org commented on GitHub (Oct 6, 2025):
If you can't port forward, you're going to need a VPS or a network that does allow you to port forward. If you have DMZ configured you could also put your machine in this zone and open firewall ports for Pangolin resources. This is not recommended from a security standpoint but it should work (until you get pwned ;))
You might be better off hosting local-only, however accessing from public networks will be impossible with this method. Even if you wanted to setup a simple Wireguard server, you'd need to port forward.
@keonramses commented on GitHub (Oct 6, 2025):
I have no issues connecting with pangolin instance on my local server, or hosted resources, the issue is that when I connect a VPN, I am not able to access the resources.
@keonramses commented on GitHub (Oct 6, 2025):
I get the error below in the headers tab.
@keonramses commented on GitHub (Oct 11, 2025):
Hi @miloschwartz, this is the issue I mentioned. Please let me know what information, I can provide to help troubleshoot this. Thanks.
@miloschwartz commented on GitHub (Oct 12, 2025):
@keonramses I'm struggling to think of causes- only two things I can think of now are:
@keonramses commented on GitHub (Oct 12, 2025):
I do not have Crowdsec installed. I am not certain why it does not work with Windscribe, but does with two other vpn's i tried (adguard and bitdefender).
@miloschwartz commented on GitHub (Oct 13, 2025):
This makes me think it's DNS related for some reason if it works for some VPNs and not the others. Your VPS provider may be also blocking IPs from this one provider.
Try to ping the server when connected to the VPN and/or do an ns lookup when connected.
@keonramses commented on GitHub (Oct 14, 2025):
I am not using a VPS. I am using pangolin on a local machine.
Also pings to any of the domains exposed using pangolin fail the moment the VPN is turned on. However the NS lookup succeeds.
@keonramses commented on GitHub (Oct 16, 2025):
Just an update on this. The issue was indeed from Windscribe; they do not support IPV6 traffic tunnelling. Which the VPN's I mentioned above do. I confirmed this by trying it out with NordVPN, which has a toggle to enable IPV6 connections. Since my A DNS record does not have a publicly routable IPV4 address, the routing is being resolved solely using the IPV6 address of the AAAA DNS record.
Thank you for your help on this, guys. I do not know why it took me this long to figure it out. Headed to the tea shop.
@miloschwartz commented on GitHub (Oct 17, 2025):
Ah good to know!