[GH-ISSUE #1616] Possible Bug - Pangolin blocks access when resource is accessed using a VPN. #23255

New Issue

GiteaMirror · 2026-06-05T06:00:05-05:00

GiteaMirror commented

2026-06-05 06:00:05 -05:00

Originally created by @keonramses on GitHub (Oct 5, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1616

Describe the Bug

I am not sure if this is intended, a bug or a misconfiguration on my part. But when I try to access a resource using a VPN (Windscribe), the connection gets refused by Pangolin. I do not have any GeoIP middleware configured or rules restricting the connecting IP address.

Environment

OS Type & Version: Rocky OS 10
Pangolin Version: 1.10.3
Gerbil Version: 1.2.1
Traefik Version: 3.5
Newt Version: 1.51
Olm Version: N/A

To Reproduce

Set up Pangolin on local machine
Create resource
Access resource with VPN connected on mobile device (wifi or mobile data)
Resource fails to load.

Expected Behavior

The resource should be accessible even if the client is connecting using a VPN.

Originally created by @keonramses on GitHub (Oct 5, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/1616 ### Describe the Bug I am not sure if this is intended, a bug or a misconfiguration on my part. But when I try to access a resource using a VPN (Windscribe), the connection gets refused by Pangolin. I do not have any GeoIP middleware configured or rules restricting the connecting IP address. ### Environment - OS Type & Version: Rocky OS 10 - Pangolin Version: 1.10.3 - Gerbil Version: 1.2.1 - Traefik Version: 3.5 - Newt Version: 1.51 - Olm Version: N/A ### To Reproduce - Set up Pangolin on local machine - Create resource - Access resource with VPN connected on mobile device (wifi or mobile data) - Resource fails to load. <img width="1440" height="2955" alt="Image" src="https://github.com/user-attachments/assets/4d181674-77c8-43a8-8147-176d6727e21e" /> <img width="1440" height="2954" alt="Image" src="https://github.com/user-attachments/assets/b1b4e269-4bde-4587-83b8-633a7f780287" /> ### Expected Behavior The resource should be accessible even if the client is connecting using a VPN.

GiteaMirror closed this issue

2026-06-05 06:00:07 -05:00

GiteaMirror commented

2026-06-05 06:00:09 -05:00

@hhftechnology commented on GitHub (Oct 5, 2025):

Set up Pangolin on local machine

you dont need gerbil on local machine. UDP port is causing the issue with the vps.
Just use Pangolin Version: 1.10.3 and Traefik Version: 3.5 for local deployment.

Or manage your clashing UDP ports if you intend to use gerbil anyways.

@hhftechnology commented on GitHub (Oct 5, 2025): > * Set up Pangolin on local machine you dont need gerbil on local machine. UDP port is causing the issue with the vps. Just use Pangolin Version: 1.10.3 and Traefik Version: 3.5 for local deployment. Or manage your clashing UDP ports if you intend to use gerbil anyways.

GiteaMirror commented

2026-06-05 06:00:09 -05:00

@keonramses commented on GitHub (Oct 5, 2025):

I just set this up per the guide. I know they mention VPS in it, and not a local machine. But I will remove gerbil from the stack and see if the resource is still reachable and get back to you, thank you.

@keonramses commented on GitHub (Oct 5, 2025): I just set this up per the guide. I know they mention VPS in it, and not a local machine. But I will remove gerbil from the stack and see if the resource is still reachable and get back to you, thank you.

GiteaMirror commented

2026-06-05 06:00:10 -05:00

@keonramses commented on GitHub (Oct 5, 2025):

So taking gerbil out is a no-go because I do not have the ability to port forward on my network.

@keonramses commented on GitHub (Oct 5, 2025): So taking gerbil out is a no-go because I do not have the ability to port forward on my network.

GiteaMirror commented

2026-06-05 06:00:12 -05:00

@keonramses commented on GitHub (Oct 5, 2025):

I corrected my opening - the error message from Traefik was not related to my issue. (This was because I had restarted Pangolin and tried to connect.), Once I am connected to the VPN, the connection request does not complete, and there are no errors in Pangolin. newt, gerbil or traefik access logs.

@keonramses commented on GitHub (Oct 5, 2025): I corrected my opening - the error message from Traefik was not related to my issue. (This was because I had restarted Pangolin and tried to connect.), Once I am connected to the VPN, the connection request does not complete, and there are no errors in Pangolin. newt, gerbil or traefik access logs.

GiteaMirror commented

2026-06-05 06:00:12 -05:00

@l3pr-org commented on GitHub (Oct 6, 2025):

So taking gerbil out is a no-go because I do not have the ability to port forward on my network.

If you can't port forward, you're going to need a VPS or a network that does allow you to port forward. If you have DMZ configured you could also put your machine in this zone and open firewall ports for Pangolin resources. This is not recommended from a security standpoint but it should work (until you get pwned ;))

You might be better off hosting local-only, however accessing from public networks will be impossible with this method. Even if you wanted to setup a simple Wireguard server, you'd need to port forward.

@l3pr-org commented on GitHub (Oct 6, 2025): > So taking gerbil out is a no-go because I do not have the ability to port forward on my network. If you can't port forward, you're going to need a VPS or a network that does allow you to port forward. If you have DMZ configured you could also put your machine in this zone and open firewall ports for Pangolin resources. This is not recommended from a security standpoint but it should work (until you get pwned ;)) You might be better off hosting local-only, however accessing from public networks will be impossible with this method. Even if you wanted to setup a simple Wireguard server, you'd need to port forward.

GiteaMirror commented

2026-06-05 06:00:12 -05:00

@keonramses commented on GitHub (Oct 6, 2025):

I have no issues connecting with pangolin instance on my local server, or hosted resources, the issue is that when I connect a VPN, I am not able to access the resources.

@keonramses commented on GitHub (Oct 6, 2025): I have no issues connecting with pangolin instance on my local server, or hosted resources, the issue is that when I connect a VPN, I am not able to access the resources.

GiteaMirror commented

2026-06-05 06:00:14 -05:00

@keonramses commented on GitHub (Oct 6, 2025):

I get the error below in the headers tab.

407 Proxy Authentication Required

@keonramses commented on GitHub (Oct 6, 2025): I get the error below in the headers tab. ``` 407 Proxy Authentication Required ``` <img width="426" height="170" alt="Image" src="https://github.com/user-attachments/assets/9e88f67d-7938-48f3-bcd2-49dbe5f4edbe" />

GiteaMirror commented

2026-06-05 06:00:14 -05:00

@keonramses commented on GitHub (Oct 11, 2025):

Hi @miloschwartz, this is the issue I mentioned. Please let me know what information, I can provide to help troubleshoot this. Thanks.

@keonramses commented on GitHub (Oct 11, 2025): Hi @miloschwartz, this is the issue I mentioned. Please let me know what information, I can provide to help troubleshoot this. Thanks.

GiteaMirror commented

2026-06-05 06:00:15 -05:00

@miloschwartz commented on GitHub (Oct 12, 2025):

@keonramses I'm struggling to think of causes- only two things I can think of now are:

Do you have Crowdsec installed? Maybe the IP of the VPN client is blocked.
Maybe the VPN server's DNS is not resolving your domain.

@miloschwartz commented on GitHub (Oct 12, 2025): @keonramses I'm struggling to think of causes- only two things I can think of now are: - Do you have Crowdsec installed? Maybe the IP of the VPN client is blocked. - Maybe the VPN server's DNS is not resolving your domain.

GiteaMirror commented

2026-06-05 06:00:15 -05:00

@keonramses commented on GitHub (Oct 12, 2025):

I do not have Crowdsec installed. I am not certain why it does not work with Windscribe, but does with two other vpn's i tried (adguard and bitdefender).

@keonramses commented on GitHub (Oct 12, 2025): I do not have Crowdsec installed. I am not certain why it does not work with Windscribe, but does with two other vpn's i tried (adguard and bitdefender).

GiteaMirror commented

2026-06-05 06:00:16 -05:00

@miloschwartz commented on GitHub (Oct 13, 2025):

This makes me think it's DNS related for some reason if it works for some VPNs and not the others. Your VPS provider may be also blocking IPs from this one provider.

Try to ping the server when connected to the VPN and/or do an ns lookup when connected.

@miloschwartz commented on GitHub (Oct 13, 2025): This makes me think it's DNS related for some reason if it works for some VPNs and not the others. Your VPS provider may be also blocking IPs from this one provider. Try to ping the server when connected to the VPN and/or do an ns lookup when connected.

GiteaMirror commented

2026-06-05 06:00:17 -05:00

@keonramses commented on GitHub (Oct 14, 2025):

I am not using a VPS. I am using pangolin on a local machine.

Also pings to any of the domains exposed using pangolin fail the moment the VPN is turned on. However the NS lookup succeeds.

@keonramses commented on GitHub (Oct 14, 2025): I am not using a VPS. I am using pangolin on a local machine. Also pings to any of the domains exposed using pangolin fail the moment the VPN is turned on. However the NS lookup succeeds.

GiteaMirror commented

2026-06-05 06:00:17 -05:00

@keonramses commented on GitHub (Oct 16, 2025):

Just an update on this. The issue was indeed from Windscribe; they do not support IPV6 traffic tunnelling. Which the VPN's I mentioned above do. I confirmed this by trying it out with NordVPN, which has a toggle to enable IPV6 connections. Since my A DNS record does not have a publicly routable IPV4 address, the routing is being resolved solely using the IPV6 address of the AAAA DNS record.

Thank you for your help on this, guys. I do not know why it took me this long to figure it out. Headed to the tea shop.

@keonramses commented on GitHub (Oct 16, 2025): Just an update on this. The issue was indeed from Windscribe; they do not support IPV6 traffic tunnelling. Which the VPN's I mentioned above do. I confirmed this by trying it out with NordVPN, which has a toggle to enable IPV6 connections. Since my A DNS record does not have a publicly routable IPV4 address, the routing is being resolved solely using the IPV6 address of the AAAA DNS record. Thank you for your help on this, guys. I do not know why it took me this long to figure it out. Headed to the tea shop.

GiteaMirror commented

2026-06-05 06:00:18 -05:00

@miloschwartz commented on GitHub (Oct 17, 2025):

Ah good to know!

@miloschwartz commented on GitHub (Oct 17, 2025): Ah good to know!

Sign in to join this conversation.

Branches Tags

main

local-connection

crowdin_dev

dev

dependabot/npm_and_yarn/npm-dependencies-338850a190

dependabot/go_modules/install/go-install-dependencies-3804ca7238

dependabot/docker/docker-dependencies-4faa477378

dependabot/github_actions/github-actions-dependencies-6d79802a48

api-improvements

feat/remember-last-idp-on-smart-login-form

refactor/batch-status-requests

dependabot/npm_and_yarn/multi-5f1280885e

fix/non-semver-version-error

private-resource-page

resource-launcher

backhaul

exit-node-reconnect

feat/command-palette

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/pangolin#23255