github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-07-16 06:08:33 -05:00
Code Issues 1.6k Packages Projects Releases 79 Wiki Activity

[GH-ISSUE #2901] Adding a private resource breaks hole-punch for already-connected clients; cache never repopulates #23555

New Issue
Closed
opened 2026-06-05 06:25:32 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-06-05 06:25:32 -05:00
Owner
Copy Link

Originally created by @andrewixl on GitHub (Apr 24, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2901

Describe the Bug

Creating any private resource (siteResources) and once created, if an Olm client is registered (connected) puts the client into a permanent "last hole punch is too old" loop. The client never reaches connected state, and no amount of reconnecting, restarting, or deleting/recreating the resource restores it.

Environment

  • Ubuntu 24.04
  • Pangolin: ee-1.17.1
  • Gerbil: 1.31
  • Traefik: 3.6
  • Newt: 1.11.0
  • Olm Windows: 0.9.0

To Reproduce

Reproduction:

  1. No private resources.
  2. Create a new client. Pair it with a Windows Pangolin client. Confirm connected.
  3. Add ONE private resource pointing at any LAN IP.
  4. Immediately: logs show "handleOlmServerPeerAddMessage: No endpoint found for client N"
  5. Client enters permanent "Client last hole punch is too old" loop
  6. clientSitesAssociationsCache rows for that client have endpoint=NULL, publicKey=NULL
  7. clients.lastHolePunch remains NULL
  8. Deleting the resource restored the client to connectivity.

Expected Behavior

Expected behavior should allow the client to register and connect to the private resources.

Originally created by @andrewixl on GitHub (Apr 24, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/2901 ### Describe the Bug Creating any private resource (siteResources) and once created, if an Olm client is registered (connected) puts the client into a permanent "last hole punch is too old" loop. The client never reaches connected state, and no amount of reconnecting, restarting, or deleting/recreating the resource restores it. ### Environment - Ubuntu 24.04 - Pangolin: ee-1.17.1 - Gerbil: 1.31 - Traefik: 3.6 - Newt: 1.11.0 - Olm Windows: 0.9.0 ### To Reproduce Reproduction: 1. No private resources. 2. Create a new client. Pair it with a Windows Pangolin client. Confirm connected. 3. Add ONE private resource pointing at any LAN IP. 4. Immediately: logs show "handleOlmServerPeerAddMessage: No endpoint found for client N" 5. Client enters permanent "Client last hole punch is too old" loop 6. clientSitesAssociationsCache rows for that client have endpoint=NULL, publicKey=NULL 7. clients.lastHolePunch remains NULL 8. Deleting the resource restored the client to connectivity. ### Expected Behavior Expected behavior should allow the client to register and connect to the private resources.
GiteaMirror added the stale label 2026-06-05 06:25:32 -05:00
GiteaMirror commented 2026-06-05 06:25:33 -05:00
Author
Owner
Copy Link

@Byolock commented on GitHub (May 2, 2026):

From my personal experience and some other comments here, that could be a DNS Issue. It looks like you are using windows as a client? Try adding

192.168.1.10 pangolin.yourdomain.com

to C:\Windows\System32\drivers\etc\hosts for a quick and easy test. Replace the IP and domain to match your setup.

If it works after this you have a DNS issue. I've read reports that blocking outbound DNS for clients in your firewall does this. I just experienced it also happens when you rely on your local DNS Server in a Split DNS Setup. Every device in my lan uses an adguard dns server and resolves my "pangolin.mydomain.com" record correctly to my lan address of the pangolin installation. But using public DNS "pangolin.mydomain.com" resolves to a different address. I needed to put a A-record for "pangolin.mydomain.com" to my local address in the public DNS and then it worked, even though I was only testing everything inside my lan.

<!-- gh-comment-id:4363217046 --> @Byolock commented on GitHub (May 2, 2026): From my personal experience and some other comments here, that could be a DNS Issue. It looks like you are using windows as a client? Try adding `192.168.1.10 pangolin.yourdomain.com` to C:\Windows\System32\drivers\etc\hosts for a quick and easy test. Replace the IP and domain to match your setup. If it works after this you have a DNS issue. I've read reports that blocking outbound DNS for clients in your firewall does this. I just experienced it also happens when you rely on your local DNS Server in a Split DNS Setup. Every device in my lan uses an adguard dns server and resolves my "pangolin.mydomain.com" record correctly to my lan address of the pangolin installation. But using public DNS "pangolin.mydomain.com" resolves to a different address. I needed to put a A-record for "pangolin.mydomain.com" to my local address in the public DNS and then it worked, even though I was only testing everything inside my lan.
GiteaMirror commented 2026-06-05 06:25:33 -05:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (May 17, 2026):

This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

<!-- gh-comment-id:4468697266 --> @github-actions[bot] commented on GitHub (May 17, 2026): This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
GiteaMirror commented 2026-06-05 06:25:34 -05:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (May 31, 2026):

This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.

<!-- gh-comment-id:4585324002 --> @github-actions[bot] commented on GitHub (May 31, 2026): This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#23555
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?