First error: unable to install Pangolin, with the installer, when UFW is enabled. It works when I disable it.
Second error: Unable to add a licence key with UFW enabled. It works when I disable it. Once the licence key is valid, I can re-enable UFW and it works like a charm.
But in the case of a restart of the container, the licence is lost and I have to disable UFW, reload the licence key, re-enble UFW.
Originally created by @c-dethys on GitHub (Jun 4, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3222
### Describe the Bug
Hello,
On a brand new VPS, I enabled UFW as a security default. I added the rules required in the documentation.
UFW status:
```
To Action From
-- ------ ----
80/tcp ALLOW Anywhere
443/tcp ALLOW Anywhere
51820/udp ALLOW Anywhere
21820/udp ALLOW Anywhere
80/tcp (v6) ALLOW Anywhere (v6)
443/tcp (v6) ALLOW Anywhere (v6)
51820/udp (v6) ALLOW Anywhere (v6)
21820/udp (v6) ALLOW Anywhere (v6)
```
First error: unable to install Pangolin, with the installer, when UFW is enabled. It works when I disable it.
Second error: Unable to add a licence key with UFW enabled. It works when I disable it. Once the licence key is valid, I can re-enable UFW and it works like a charm.
But in the case of a restart of the container, the licence is lost and I have to disable UFW, reload the licence key, re-enble UFW.
Logs from Pangolin container:
```
2026-06-04T22:28:30+00:00 [error]: Error activating license key: TypeError: fetch failed
Stack: Error: Error activating license key: TypeError: fetch failed
at License.activateLicenseKey (file:///app/dist/server.mjs:4346:13)
at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
at async activateLicense (file:///app/dist/server.mjs:32033:22)
Error while flushing PostHog [Error [PostHogFetchNetworkError]: Network error while fetching PostHog] {
error: [Error [TimeoutError]: The operation was aborted due to timeout] {
code: 23,
INDEX_SIZE_ERR: 1,
DOMSTRING_SIZE_ERR: 2,
HIERARCHY_REQUEST_ERR: 3,
WRONG_DOCUMENT_ERR: 4,
INVALID_CHARACTER_ERR: 5,
NO_DATA_ALLOWED_ERR: 6,
NO_MODIFICATION_ALLOWED_ERR: 7,
NOT_FOUND_ERR: 8,
NOT_SUPPORTED_ERR: 9,
INUSE_ATTRIBUTE_ERR: 10,
INVALID_STATE_ERR: 11,
SYNTAX_ERR: 12,
INVALID_MODIFICATION_ERR: 13,
NAMESPACE_ERR: 14,
INVALID_ACCESS_ERR: 15,
VALIDATION_ERR: 16,
TYPE_MISMATCH_ERR: 17,
SECURITY_ERR: 18,
NETWORK_ERR: 19,
ABORT_ERR: 20,
URL_MISMATCH_ERR: 21,
QUOTA_EXCEEDED_ERR: 22,
TIMEOUT_ERR: 23,
INVALID_NODE_TYPE_ERR: 24,
DATA_CLONE_ERR: 25
},
[cause]: [Error [TimeoutError]: The operation was aborted due to timeout] {
code: 23,
INDEX_SIZE_ERR: 1,
DOMSTRING_SIZE_ERR: 2,
HIERARCHY_REQUEST_ERR: 3,
WRONG_DOCUMENT_ERR: 4,
INVALID_CHARACTER_ERR: 5,
NO_DATA_ALLOWED_ERR: 6,
NO_MODIFICATION_ALLOWED_ERR: 7,
NOT_FOUND_ERR: 8,
NOT_SUPPORTED_ERR: 9,
INUSE_ATTRIBUTE_ERR: 10,
INVALID_STATE_ERR: 11,
SYNTAX_ERR: 12,
INVALID_MODIFICATION_ERR: 13,
NAMESPACE_ERR: 14,
INVALID_ACCESS_ERR: 15,
VALIDATION_ERR: 16,
TYPE_MISMATCH_ERR: 17,
SECURITY_ERR: 18,
NETWORK_ERR: 19,
ABORT_ERR: 20,
URL_MISMATCH_ERR: 21,
QUOTA_EXCEEDED_ERR: 22,
TIMEOUT_ERR: 23,
INVALID_NODE_TYPE_ERR: 24,
DATA_CLONE_ERR: 25
}
}
```
### Environment
- OS Type & Version: Debian 13
- Pangolin Version: 1.18.4
- Edition (Community or Enterprise): EE
- Gerbil Version: 1.4.0
- Traefik Version: v3.6
- Newt Version: /
- Client Version: /
### To Reproduce
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 51820/udp
sudo ufw allow 21820/udp
sudo ufw enable
sudo ./installer > follow the installation
### Expected Behavior
The installation of Pangolin
Curious why you have ufw? It's not like it can stop docker traffic as it operates late in the iptables, At most it can tamper with outbound or docker isolation chains. Ufw for additional context inserts it's rule way too late in iptables to be really effective you want your iptables to be early and if you want to filter a container host you insert it into the docker-user chain or just don't ask docker to open ports if you don't ask it won't write iptable entries.
<!-- gh-comment-id:4626727479 -->
@AstralDestiny commented on GitHub (Jun 4, 2026):
Curious why you have ufw? It's not like it can stop docker traffic as it operates late in the iptables, At most it can tamper with outbound or docker isolation chains. Ufw for additional context inserts it's rule way too late in iptables to be really effective you want your iptables to be early and if you want to filter a container host you insert it into the docker-user chain or just don't ask docker to open ports if you don't ask it won't write iptable entries.
Like docker will never open a port unless you explicitly ask docker to do so, Docs in ufw saying docker bypasses ufw is not correct it's just a lazy documentation, Think of the host like a nightclub, docker's rules sit infront of the nightclub(host) and ufw inserts it's rules lower down say near the bar area, Well people are already in the nightclub even if ufw is screaming no, I wouldn't really view ufw as a security thing it's a conveince script that will bite you for heavy traffic.
Say you have postgres, It's within a container don't add ports, It's still reachable by other containers but docker hasn't been told "Hey make an iptable entry for me that opens 0.0.0.0:5432 on the host's firewall and route this down to the container for me"
<!-- gh-comment-id:4626753608 -->
@AstralDestiny commented on GitHub (Jun 4, 2026):
Like docker will never open a port unless you explicitly ask docker to do so, Docs in ufw saying docker bypasses ufw is not correct it's just a lazy documentation, Think of the host like a nightclub, docker's rules sit infront of the nightclub(host) and ufw inserts it's rules lower down say near the bar area, Well people are already in the nightclub even if ufw is screaming no, I wouldn't really view ufw as a security thing it's a conveince script that will bite you for heavy traffic.
Say you have postgres, It's within a container don't add ports, It's still reachable by other containers but docker hasn't been told "Hey make an iptable entry for me that opens 0.0.0.0:5432 on the host's firewall and route this down to the container for me"
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @c-dethys on GitHub (Jun 4, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3222
Describe the Bug
Hello,
On a brand new VPS, I enabled UFW as a security default. I added the rules required in the documentation.
UFW status:
First error: unable to install Pangolin, with the installer, when UFW is enabled. It works when I disable it.
Second error: Unable to add a licence key with UFW enabled. It works when I disable it. Once the licence key is valid, I can re-enable UFW and it works like a charm.
But in the case of a restart of the container, the licence is lost and I have to disable UFW, reload the licence key, re-enble UFW.
Logs from Pangolin container:
Environment
To Reproduce
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 51820/udp
sudo ufw allow 21820/udp
sudo ufw enable
sudo ./installer > follow the installation
Expected Behavior
The installation of Pangolin
@AstralDestiny commented on GitHub (Jun 4, 2026):
Curious why you have ufw? It's not like it can stop docker traffic as it operates late in the iptables, At most it can tamper with outbound or docker isolation chains. Ufw for additional context inserts it's rule way too late in iptables to be really effective you want your iptables to be early and if you want to filter a container host you insert it into the docker-user chain or just don't ask docker to open ports if you don't ask it won't write iptable entries.
@AstralDestiny commented on GitHub (Jun 4, 2026):
Like docker will never open a port unless you explicitly ask docker to do so, Docs in ufw saying docker bypasses ufw is not correct it's just a lazy documentation, Think of the host like a nightclub, docker's rules sit infront of the nightclub(host) and ufw inserts it's rules lower down say near the bar area, Well people are already in the nightclub even if ufw is screaming no, I wouldn't really view ufw as a security thing it's a conveince script that will bite you for heavy traffic.
Say you have postgres, It's within a container don't add ports, It's still reachable by other containers but docker hasn't been told "Hey make an iptable entry for me that opens 0.0.0.0:5432 on the host's firewall and route this down to the container for me"