By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
What does this PR do?
You can read about the discussion related to this topic here: Transport flexiblity
As discussed, in more restrictive networks UDP connections may be completely blocked and clients are unable to connect to resources. To get around this we use a commonly allowed protocol: HTTPS, or more specifically websockets.
Description
OLM will try its normal direct UDP/hole punch and UDP relay. If OLM receives a relayEndpointWss (sent with relay info) it starts an 8s timer. Once that timer is up it switches from the shared UDP bind to a websocket bind. Traffic then flows OLM-(wss)->Pangolin-(tcp relay port)->Gerbil->Newt. Now since we are using a websocket the RTT is more than just raw wireguard, and it might be something to look into.
Note: the only thing changed is olm's connection to the gerbil relay, to newt nothing changes.
How to test?
Setup Pangolin, Gerbil, and Olm from companion PRs mentioned below and regular newt. Have to spin up pangolin, gerbil, newt, and olm to test this. Ideally checking, regular connections, restricted networks, and the force relay flag
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/2831
**Author:** [@nicholasliverett](https://github.com/nicholasliverett)
**Created:** 4/11/2026
**Status:** 🔄 Open
**Base:** `dev` ← **Head:** `feature-websocket-relay`
---
### 📝 Commits (4)
- [`58a1564`](https://github.com/fosrl/pangolin/commit/58a1564f067a6792b3b12720481170df846f4462) Add WebSocket relay tunnel bridge and config
- [`5d1a234`](https://github.com/fosrl/pangolin/commit/5d1a234e25c491c9b117e8dbc08a75bd7b94f581) dont show wildcard in domain picker
- [`1f57ff7`](https://github.com/fosrl/pangolin/commit/1f57ff7d840eef0e580551669afac267c6f29168) Update WebSocket relay configuration and fix port assignment
- [`09e1346`](https://github.com/fosrl/pangolin/commit/09e134617c80bcacd56017781d8a030030ddb5f7) fix: wss_relay_port
### 📊 Changes
**7 files changed** (+373 additions, -11 deletions)
<details>
<summary>View changed files</summary>
📝 `messages/en-US.json` (+1 -0)
📝 `server/lib/readConfigFile.ts` (+9 -0)
📝 `server/routers/olm/getOlmToken.ts` (+15 -1)
📝 `server/routers/olm/handleOlmRelayMessage.ts` (+9 -1)
➕ `server/routers/ws/relayTunnelBridge.ts` (+314 -0)
📝 `server/routers/ws/ws.ts` (+5 -0)
📝 `src/components/DomainPicker.tsx` (+20 -9)
</details>
### 📄 Description
## Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
## What does this PR do?
You can read about the discussion related to this topic here: [Transport flexiblity](https://github.com/orgs/fosrl/discussions/2076)
As discussed, in more restrictive networks UDP connections may be completely blocked and clients are unable to connect to resources. To get around this we use a commonly allowed protocol: HTTPS, or more specifically websockets.
## Description
OLM will try its normal direct UDP/hole punch and UDP relay. If OLM receives a relayEndpointWss (sent with relay info) it starts an 8s timer. Once that timer is up it switches from the shared UDP bind to a websocket bind. Traffic then flows OLM-(wss)->Pangolin-(tcp relay port)->Gerbil->Newt. Now since we are using a websocket the RTT is more than just raw wireguard, and it might be something to look into.
Note: the only thing changed is olm's connection to the gerbil relay, to newt nothing changes.
## How to test?
Setup Pangolin, Gerbil, and Olm from companion PRs mentioned below and regular newt. Have to spin up pangolin, gerbil, newt, and olm to test this. Ideally checking, regular connections, restricted networks, and the force relay flag
## Companion PRs
**Gerbil**: [fosrl/gerbil#77](https://github.com/fosrl/gerbil/pull/77)
**Olm**: [fosrl/olm#112](https://github.com/fosrl/olm/pull/112)
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/2831
Author: @nicholasliverett
Created: 4/11/2026
Status: 🔄 Open
Base:
dev← Head:feature-websocket-relay📝 Commits (4)
58a1564Add WebSocket relay tunnel bridge and config5d1a234dont show wildcard in domain picker1f57ff7Update WebSocket relay configuration and fix port assignment09e1346fix: wss_relay_port📊 Changes
7 files changed (+373 additions, -11 deletions)
View changed files
📝
messages/en-US.json(+1 -0)📝
server/lib/readConfigFile.ts(+9 -0)📝
server/routers/olm/getOlmToken.ts(+15 -1)📝
server/routers/olm/handleOlmRelayMessage.ts(+9 -1)➕
server/routers/ws/relayTunnelBridge.ts(+314 -0)📝
server/routers/ws/ws.ts(+5 -0)📝
src/components/DomainPicker.tsx(+20 -9)📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
What does this PR do?
You can read about the discussion related to this topic here: Transport flexiblity
As discussed, in more restrictive networks UDP connections may be completely blocked and clients are unable to connect to resources. To get around this we use a commonly allowed protocol: HTTPS, or more specifically websockets.
Description
OLM will try its normal direct UDP/hole punch and UDP relay. If OLM receives a relayEndpointWss (sent with relay info) it starts an 8s timer. Once that timer is up it switches from the shared UDP bind to a websocket bind. Traffic then flows OLM-(wss)->Pangolin-(tcp relay port)->Gerbil->Newt. Now since we are using a websocket the RTT is more than just raw wireguard, and it might be something to look into.
Note: the only thing changed is olm's connection to the gerbil relay, to newt nothing changes.
How to test?
Setup Pangolin, Gerbil, and Olm from companion PRs mentioned below and regular newt. Have to spin up pangolin, gerbil, newt, and olm to test this. Ideally checking, regular connections, restricted networks, and the force relay flag
Companion PRs
Gerbil: fosrl/gerbil#77
Olm: fosrl/olm#112
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.