In Pangolin UI the client is shown as connected/online. But after the connection of the client i am getting an error by pressing the save settings button in edit client. "Faild to update client. An error occurred."
gerbil logs
ERROR: 2025/08/01 10:34:11 Destination port must be a positive integer for destination 0
ERROR: 2025/08/01 10:34:21 Destination port must be a positive integer for destination 0
ERROR: 2025/08/01 10:35:44 Destination port must be a positive integer for destination 0
ERROR: 2025/08/01 10:42:48 Destination port must be a positive integer for destination 0
pangolin log
2025-08-01T08:22:38.570Z [info]: Client added to tracking - OLM ID: 6ykr######fvtw, Connection ID: 61#######da, Total connections: 1
2025-08-01T08:22:38.570Z [info]: WebSocket connection established - OLM ID: 6y######tw
2025-08-01T08:22:38.602Z [info]: Handling register olm message!
2025-08-01T08:22:38.603Z [warn]: Client last hole punch is too old, skipping all sites
2025-08-01T08:22:39.598Z [info]: Handling register olm message!
2025-08-01T08:22:39.600Z [info]: Public key mismatch. Updating public key and clearing session info...
2025-08-01T08:22:39.607Z [warn]: Site 5 has no endpoint, skipping
2025-08-01T08:24:12.835Z [info]: Adding 0 new sites to client 3
2025-08-01T08:24:12.836Z [info]: Removing 0 sites from client 3
2025-08-01T08:24:12.840Z [info]: Updating destinations for exit node at http://gerbil:3003
2025-08-01T08:24:12.840Z [info]: Payload for update-destinations: {
"sourceIp": "9#######1",
"sourcePort": 43995,
"destinations": [
{
"destinationIP": "100.89.128.8",
"destinationPort": 0
}
]
}
2025-08-01T08:24:12.848Z [error]: Error communicating with Gerbil. Make sure Pangolin can reach the Gerbil HTTP API: 400
Stack: Error: Error communicating with Gerbil. Make sure Pangolin can reach the Gerbil HTTP API: 400
at Function.<anonymous> (file:///app/dist/server.mjs:32:38339)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async Ny (file:///app/dist/server.mjs:32:37013)
Tried a complete fresh installation (with current installer) on a different VPS. Same errors in pangolin and gerbil (no crowdsec installed).
<!-- gh-comment-id:3143900333 -->
@Lokowitz commented on GitHub (Aug 1, 2025):
FYI
Tried a complete fresh installation (with current installer) on a different VPS. Same errors in pangolin and gerbil (no crowdsec installed).
@oschwartz10612 commented on GitHub (Aug 6, 2025):
Hum. Feels to me like newt is not running with the --accept-clients flag. If not could you try with it?
I need to make the error more clear when this is the case I think.
<!-- gh-comment-id:3161750358 -->
@oschwartz10612 commented on GitHub (Aug 6, 2025):
Hum. Feels to me like newt is not running with the `--accept-clients` flag. If not could you try with it?
I need to make the error more clear when this is the case I think.
Alas I did some more exploring since my previous post. I was able to chunk through a couple errors seemingly related to docker dns not resolving. I believe I changed everything in my config from Docker DNS resolved names to hardcoded IP's withing my docker network. I got to a point were it seemed "gerbil" may have been still using the domain "gerbil" instead of being able to take an ip from my pangolin config files. I was able to establish a connection but seemingly was being held up somewhere cloud-side around pangolin and olm resource allocation/authorization. Ill try to reproduce and screenshot next time
<!-- gh-comment-id:3162484938 -->
@YNYXYNY commented on GitHub (Aug 7, 2025):
Alas I did some more exploring since my previous post. I was able to chunk through a couple errors seemingly related to docker dns not resolving. I believe I changed everything in my config from Docker DNS resolved names to hardcoded IP's withing my docker network. I got to a point were it seemed "gerbil" may have been still using the domain "gerbil" instead of being able to take an ip from my pangolin config files. I was able to establish a connection but seemingly was being held up somewhere cloud-side around pangolin and olm resource allocation/authorization. Ill try to reproduce and screenshot next time
@oschwartz10612 commented on GitHub (Aug 8, 2025):
Okay definitely post that screenshot and I could try to help!
The gerbil not reachable error is actually a HTTP 400 error which is a bad request. My hypothesis is because the source port is zero. Gerbil is rejecting it as a bad request, but there is not actually reachability issues between gerbil and pangolin. I think that error needs to be adjusted.
If you're getting a source port of zero, that's why I would suspect that maybe newt or olm is not hole punching correctly or newt doesn't have that accept client's flag on. Does that help at all?
<!-- gh-comment-id:3166199361 -->
@oschwartz10612 commented on GitHub (Aug 8, 2025):
Okay definitely post that screenshot and I could try to help!
The gerbil not reachable error is actually a HTTP 400 error which is a bad request. My hypothesis is because the source port is zero. Gerbil is rejecting it as a bad request, but there is not actually reachability issues between gerbil and pangolin. I think that error needs to be adjusted.
If you're getting a source port of zero, that's why I would suspect that maybe newt or olm is not hole punching correctly or newt doesn't have that accept client's flag on. Does that help at all?
Could be the problem, that my Newt instance and the Olm client are behind a CGNAT?
I tried the Olm commant with and without '--holepunch' command.
Could understand if holepunch is not working with direct connection to newt because of CGNAT.
But without it should use the VPS as relay and uses the existing WG tunnel between newt and VPS, or i am wrong?
newt | INFO: 2025/08/08 04:52:25 Newt version 1.4.0
newt | INFO: 2025/08/08 04:52:26 Websocket connected
newt | INFO: 2025/08/08 04:52:26 Requesting exit nodes from server
newt | INFO: 2025/08/08 04:52:26 Received ping message
newt | INFO: 2025/08/08 04:52:26 Received registration message
newt | INFO: 2025/08/08 04:52:26 Connecting to endpoint: #####.de
newt | INFO: 2025/08/08 04:52:26 Initial connection test successful!
newt | INFO: 2025/08/08 04:52:26 Tunnel connection to server established successfully!
newt | INFO: 2025/08/08 04:52:26 Started tcp proxy to 192.168.178.211:8006
Pangoling is showing the client as connected but the client logs are still ending with "WireGuard device created" and i am not able to ping another devicide in the 100.90.128.0/24 network.
<!-- gh-comment-id:3166586227 -->
@Lokowitz commented on GitHub (Aug 8, 2025):
Could be the problem, that my Newt instance and the Olm client are behind a CGNAT?
I tried the Olm commant with and without '--holepunch' command.
Could understand if holepunch is not working with direct connection to newt because of CGNAT.
But without it should use the VPS as relay and uses the existing WG tunnel between newt and VPS, or i am wrong?
## Newt compose
```
services:
newt:
image: fosrl/newt
container_name: newt
restart: unless-stopped
environment:
- PANGOLIN_ENDPOINT=https://#######.de
- NEWT_ID=4v########o2
- NEWT_SECRET=2u#######hz
- ACCEPT_CLIENTS=true
```
## Newt log
```
newt | INFO: 2025/08/08 04:52:25 Newt version 1.4.0
newt | INFO: 2025/08/08 04:52:26 Websocket connected
newt | INFO: 2025/08/08 04:52:26 Requesting exit nodes from server
newt | INFO: 2025/08/08 04:52:26 Received ping message
newt | INFO: 2025/08/08 04:52:26 Received registration message
newt | INFO: 2025/08/08 04:52:26 Connecting to endpoint: #####.de
newt | INFO: 2025/08/08 04:52:26 Initial connection test successful!
newt | INFO: 2025/08/08 04:52:26 Tunnel connection to server established successfully!
newt | INFO: 2025/08/08 04:52:26 Started tcp proxy to 192.168.178.211:8006
```
Pangoling is showing the client as connected but the client logs are still ending with "WireGuard device created" and i am not able to ping another devicide in the 100.90.128.0/24 network.
Running newt with docker run command instead of docker compose was the trick.
Saw your Issue.
<!-- gh-comment-id:3166854146 -->
@Lokowitz commented on GitHub (Aug 8, 2025):
Running newt with docker run command instead of docker compose was the trick.
Saw your [Issue.](https://github.com/fosrl/newt/issues/101)
So thanks to yalls help I got both newt and olm working with docker run, being sure to use --privileged as opposed to --cap-add's. I may be able fool around with doing both in compose sometime but thanks for the help regardless!
<!-- gh-comment-id:3172844216 -->
@YNYXYNY commented on GitHub (Aug 10, 2025):
So thanks to yalls help I got both newt and olm working with docker run, being sure to use --privileged as opposed to --cap-add's. I may be able fool around with doing both in compose sometime but thanks for the help regardless!
I also had fun with getting this to work with self-hosted. The two key things that needed changing were:
in the docker compose, use command to pass through arguments instead of as env vars. (so --accept-clients true would be honoured)
in your self hosted pangolin, you also need to open 21820/udp in addition to the ones mentioned in the doc (51820/udp, 443/tcp, 80/tcp)
<!-- gh-comment-id:3177294038 -->
@davewasthere commented on GitHub (Aug 12, 2025):
I also had fun with getting this to work with self-hosted. The two key things that needed changing were:
- in the docker compose, use command to pass through arguments instead of as env vars. (so `--accept-clients true` would be honoured)
- in your self hosted pangolin, you also need to open 21820/udp in addition to the ones mentioned in the doc (51820/udp, 443/tcp, 80/tcp)
<!-- gh-comment-id:3193392949 -->
@oschwartz10612 commented on GitHub (Aug 16, 2025):
The ENV var thing should be fixed in 1.4.1 of newt.
For the versions and the port we highlighted in the docs here: https://docs.digpangolin.com/manage/clients/add-client#prerequisites
Thanks for testing everyone!
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @Lokowitz on GitHub (Aug 1, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1195
I am not able to ping the network through olm.
I am running olm in a LXC on my Proxmox server.
/dev/net/tunis added as device.olm log
It is different from the logs in your demo video:
In Pangolin UI the client is shown as connected/online. But after the connection of the client i am getting an error by pressing the
save settingsbutton in edit client. "Faild to update client. An error occurred."gerbil logs
pangolin log
docker-compose.yml
config.yml
@Lokowitz commented on GitHub (Aug 1, 2025):
FYI
Tried a complete fresh installation (with current installer) on a different VPS. Same errors in pangolin and gerbil (no crowdsec installed).
@YNYXYNY commented on GitHub (Aug 3, 2025):
Stuck here as well!
@oschwartz10612 commented on GitHub (Aug 6, 2025):
Hum. Feels to me like newt is not running with the
--accept-clientsflag. If not could you try with it?I need to make the error more clear when this is the case I think.
@YNYXYNY commented on GitHub (Aug 7, 2025):
Alas I did some more exploring since my previous post. I was able to chunk through a couple errors seemingly related to docker dns not resolving. I believe I changed everything in my config from Docker DNS resolved names to hardcoded IP's withing my docker network. I got to a point were it seemed "gerbil" may have been still using the domain "gerbil" instead of being able to take an ip from my pangolin config files. I was able to establish a connection but seemingly was being held up somewhere cloud-side around pangolin and olm resource allocation/authorization. Ill try to reproduce and screenshot next time
@oschwartz10612 commented on GitHub (Aug 8, 2025):
Okay definitely post that screenshot and I could try to help!
The gerbil not reachable error is actually a HTTP 400 error which is a bad request. My hypothesis is because the source port is zero. Gerbil is rejecting it as a bad request, but there is not actually reachability issues between gerbil and pangolin. I think that error needs to be adjusted.
If you're getting a source port of zero, that's why I would suspect that maybe newt or olm is not hole punching correctly or newt doesn't have that accept client's flag on. Does that help at all?
@Lokowitz commented on GitHub (Aug 8, 2025):
Could be the problem, that my Newt instance and the Olm client are behind a CGNAT?
I tried the Olm commant with and without '--holepunch' command.
Could understand if holepunch is not working with direct connection to newt because of CGNAT.
But without it should use the VPS as relay and uses the existing WG tunnel between newt and VPS, or i am wrong?
Newt compose
Newt log
Pangoling is showing the client as connected but the client logs are still ending with "WireGuard device created" and i am not able to ping another devicide in the 100.90.128.0/24 network.
@Lokowitz commented on GitHub (Aug 8, 2025):
Running newt with docker run command instead of docker compose was the trick.
Saw your Issue.
@YNYXYNY commented on GitHub (Aug 10, 2025):
So thanks to yalls help I got both newt and olm working with docker run, being sure to use --privileged as opposed to --cap-add's. I may be able fool around with doing both in compose sometime but thanks for the help regardless!
@davewasthere commented on GitHub (Aug 12, 2025):
I also had fun with getting this to work with self-hosted. The two key things that needed changing were:
--accept-clients truewould be honoured)@oschwartz10612 commented on GitHub (Aug 16, 2025):
The ENV var thing should be fixed in 1.4.1 of newt.
For the versions and the port we highlighted in the docs here: https://docs.digpangolin.com/manage/clients/add-client#prerequisites
Thanks for testing everyone!