github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-07-16 06:08:33 -05:00
Code Issues 1.6k Packages Projects Releases 79 Wiki Activity

[GH-ISSUE #3222] Licensing error when UFW enabled #32404

New Issue
Open
opened 2026-06-15 09:53:21 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-06-15 09:53:21 -05:00
Owner
Copy Link

Originally created by @c-dethys on GitHub (Jun 4, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3222

Describe the Bug

Hello,
On a brand new VPS, I enabled UFW as a security default. I added the rules required in the documentation.
UFW status:

To                         Action      From
--                         ------      ----               
80/tcp                     ALLOW       Anywhere                  
443/tcp                    ALLOW       Anywhere                  
51820/udp                  ALLOW       Anywhere                  
21820/udp                  ALLOW       Anywhere                  
80/tcp (v6)                ALLOW       Anywhere (v6)             
443/tcp (v6)               ALLOW       Anywhere (v6)             
51820/udp (v6)             ALLOW       Anywhere (v6)             
21820/udp (v6)             ALLOW       Anywhere (v6)

First error: unable to install Pangolin, with the installer, when UFW is enabled. It works when I disable it.

Second error: Unable to add a licence key with UFW enabled. It works when I disable it. Once the licence key is valid, I can re-enable UFW and it works like a charm.
But in the case of a restart of the container, the licence is lost and I have to disable UFW, reload the licence key, re-enble UFW.

Logs from Pangolin container:

2026-06-04T22:28:30+00:00 [error]: Error activating license key: TypeError: fetch failed
Stack: Error: Error activating license key: TypeError: fetch failed
    at License.activateLicenseKey (file:///app/dist/server.mjs:4346:13)
    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
    at async activateLicense (file:///app/dist/server.mjs:32033:22)
Error while flushing PostHog [Error [PostHogFetchNetworkError]: Network error while fetching PostHog] {
  error: [Error [TimeoutError]: The operation was aborted due to timeout] {
    code: 23,
    INDEX_SIZE_ERR: 1,
    DOMSTRING_SIZE_ERR: 2,
    HIERARCHY_REQUEST_ERR: 3,
    WRONG_DOCUMENT_ERR: 4,
    INVALID_CHARACTER_ERR: 5,
    NO_DATA_ALLOWED_ERR: 6,
    NO_MODIFICATION_ALLOWED_ERR: 7,
    NOT_FOUND_ERR: 8,
    NOT_SUPPORTED_ERR: 9,
    INUSE_ATTRIBUTE_ERR: 10,
    INVALID_STATE_ERR: 11,
    SYNTAX_ERR: 12,
    INVALID_MODIFICATION_ERR: 13,
    NAMESPACE_ERR: 14,
    INVALID_ACCESS_ERR: 15,
    VALIDATION_ERR: 16,
    TYPE_MISMATCH_ERR: 17,
    SECURITY_ERR: 18,
    NETWORK_ERR: 19,
    ABORT_ERR: 20,
    URL_MISMATCH_ERR: 21,
    QUOTA_EXCEEDED_ERR: 22,
    TIMEOUT_ERR: 23,
    INVALID_NODE_TYPE_ERR: 24,
    DATA_CLONE_ERR: 25
  },
  [cause]: [Error [TimeoutError]: The operation was aborted due to timeout] {
    code: 23,
    INDEX_SIZE_ERR: 1,
    DOMSTRING_SIZE_ERR: 2,
    HIERARCHY_REQUEST_ERR: 3,
    WRONG_DOCUMENT_ERR: 4,
    INVALID_CHARACTER_ERR: 5,
    NO_DATA_ALLOWED_ERR: 6,
    NO_MODIFICATION_ALLOWED_ERR: 7,
    NOT_FOUND_ERR: 8,
    NOT_SUPPORTED_ERR: 9,
    INUSE_ATTRIBUTE_ERR: 10,
    INVALID_STATE_ERR: 11,
    SYNTAX_ERR: 12,
    INVALID_MODIFICATION_ERR: 13,
    NAMESPACE_ERR: 14,
    INVALID_ACCESS_ERR: 15,
    VALIDATION_ERR: 16,
    TYPE_MISMATCH_ERR: 17,
    SECURITY_ERR: 18,
    NETWORK_ERR: 19,
    ABORT_ERR: 20,
    URL_MISMATCH_ERR: 21,
    QUOTA_EXCEEDED_ERR: 22,
    TIMEOUT_ERR: 23,
    INVALID_NODE_TYPE_ERR: 24,
    DATA_CLONE_ERR: 25
  }
}

Environment

  • OS Type & Version: Debian 13
  • Pangolin Version: 1.18.4
  • Edition (Community or Enterprise): EE
  • Gerbil Version: 1.4.0
  • Traefik Version: v3.6
  • Newt Version: /
  • Client Version: /

To Reproduce

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 51820/udp
sudo ufw allow 21820/udp
sudo ufw enable

sudo ./installer > follow the installation

Expected Behavior

The installation of Pangolin

Originally created by @c-dethys on GitHub (Jun 4, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/3222 ### Describe the Bug Hello, On a brand new VPS, I enabled UFW as a security default. I added the rules required in the documentation. UFW status: ``` To Action From -- ------ ---- 80/tcp ALLOW Anywhere 443/tcp ALLOW Anywhere 51820/udp ALLOW Anywhere 21820/udp ALLOW Anywhere 80/tcp (v6) ALLOW Anywhere (v6) 443/tcp (v6) ALLOW Anywhere (v6) 51820/udp (v6) ALLOW Anywhere (v6) 21820/udp (v6) ALLOW Anywhere (v6) ``` First error: unable to install Pangolin, with the installer, when UFW is enabled. It works when I disable it. Second error: Unable to add a licence key with UFW enabled. It works when I disable it. Once the licence key is valid, I can re-enable UFW and it works like a charm. But in the case of a restart of the container, the licence is lost and I have to disable UFW, reload the licence key, re-enble UFW. Logs from Pangolin container: ``` 2026-06-04T22:28:30+00:00 [error]: Error activating license key: TypeError: fetch failed Stack: Error: Error activating license key: TypeError: fetch failed at License.activateLicenseKey (file:///app/dist/server.mjs:4346:13) at process.processTicksAndRejections (node:internal/process/task_queues:104:5) at async activateLicense (file:///app/dist/server.mjs:32033:22) Error while flushing PostHog [Error [PostHogFetchNetworkError]: Network error while fetching PostHog] { error: [Error [TimeoutError]: The operation was aborted due to timeout] { code: 23, INDEX_SIZE_ERR: 1, DOMSTRING_SIZE_ERR: 2, HIERARCHY_REQUEST_ERR: 3, WRONG_DOCUMENT_ERR: 4, INVALID_CHARACTER_ERR: 5, NO_DATA_ALLOWED_ERR: 6, NO_MODIFICATION_ALLOWED_ERR: 7, NOT_FOUND_ERR: 8, NOT_SUPPORTED_ERR: 9, INUSE_ATTRIBUTE_ERR: 10, INVALID_STATE_ERR: 11, SYNTAX_ERR: 12, INVALID_MODIFICATION_ERR: 13, NAMESPACE_ERR: 14, INVALID_ACCESS_ERR: 15, VALIDATION_ERR: 16, TYPE_MISMATCH_ERR: 17, SECURITY_ERR: 18, NETWORK_ERR: 19, ABORT_ERR: 20, URL_MISMATCH_ERR: 21, QUOTA_EXCEEDED_ERR: 22, TIMEOUT_ERR: 23, INVALID_NODE_TYPE_ERR: 24, DATA_CLONE_ERR: 25 }, [cause]: [Error [TimeoutError]: The operation was aborted due to timeout] { code: 23, INDEX_SIZE_ERR: 1, DOMSTRING_SIZE_ERR: 2, HIERARCHY_REQUEST_ERR: 3, WRONG_DOCUMENT_ERR: 4, INVALID_CHARACTER_ERR: 5, NO_DATA_ALLOWED_ERR: 6, NO_MODIFICATION_ALLOWED_ERR: 7, NOT_FOUND_ERR: 8, NOT_SUPPORTED_ERR: 9, INUSE_ATTRIBUTE_ERR: 10, INVALID_STATE_ERR: 11, SYNTAX_ERR: 12, INVALID_MODIFICATION_ERR: 13, NAMESPACE_ERR: 14, INVALID_ACCESS_ERR: 15, VALIDATION_ERR: 16, TYPE_MISMATCH_ERR: 17, SECURITY_ERR: 18, NETWORK_ERR: 19, ABORT_ERR: 20, URL_MISMATCH_ERR: 21, QUOTA_EXCEEDED_ERR: 22, TIMEOUT_ERR: 23, INVALID_NODE_TYPE_ERR: 24, DATA_CLONE_ERR: 25 } } ``` ### Environment - OS Type & Version: Debian 13 - Pangolin Version: 1.18.4 - Edition (Community or Enterprise): EE - Gerbil Version: 1.4.0 - Traefik Version: v3.6 - Newt Version: / - Client Version: / ### To Reproduce sudo ufw allow 80/tcp sudo ufw allow 443/tcp sudo ufw allow 51820/udp sudo ufw allow 21820/udp sudo ufw enable sudo ./installer > follow the installation ### Expected Behavior The installation of Pangolin
GiteaMirror commented 2026-06-15 09:53:23 -05:00
Author
Owner
Copy Link

@AstralDestiny commented on GitHub (Jun 4, 2026):

Curious why you have ufw? It's not like it can stop docker traffic as it operates late in the iptables, At most it can tamper with outbound or docker isolation chains. Ufw for additional context inserts it's rule way too late in iptables to be really effective you want your iptables to be early and if you want to filter a container host you insert it into the docker-user chain or just don't ask docker to open ports if you don't ask it won't write iptable entries.

<!-- gh-comment-id:4626727479 --> @AstralDestiny commented on GitHub (Jun 4, 2026): Curious why you have ufw? It's not like it can stop docker traffic as it operates late in the iptables, At most it can tamper with outbound or docker isolation chains. Ufw for additional context inserts it's rule way too late in iptables to be really effective you want your iptables to be early and if you want to filter a container host you insert it into the docker-user chain or just don't ask docker to open ports if you don't ask it won't write iptable entries.
GiteaMirror commented 2026-06-15 09:53:24 -05:00
Author
Owner
Copy Link

@AstralDestiny commented on GitHub (Jun 4, 2026):

Like docker will never open a port unless you explicitly ask docker to do so, Docs in ufw saying docker bypasses ufw is not correct it's just a lazy documentation, Think of the host like a nightclub, docker's rules sit infront of the nightclub(host) and ufw inserts it's rules lower down say near the bar area, Well people are already in the nightclub even if ufw is screaming no, I wouldn't really view ufw as a security thing it's a conveince script that will bite you for heavy traffic.

Say you have postgres, It's within a container don't add ports, It's still reachable by other containers but docker hasn't been told "Hey make an iptable entry for me that opens 0.0.0.0:5432 on the host's firewall and route this down to the container for me"

<!-- gh-comment-id:4626753608 --> @AstralDestiny commented on GitHub (Jun 4, 2026): Like docker will never open a port unless you explicitly ask docker to do so, Docs in ufw saying docker bypasses ufw is not correct it's just a lazy documentation, Think of the host like a nightclub, docker's rules sit infront of the nightclub(host) and ufw inserts it's rules lower down say near the bar area, Well people are already in the nightclub even if ufw is screaming no, I wouldn't really view ufw as a security thing it's a conveince script that will bite you for heavy traffic. Say you have postgres, It's within a container don't add ports, It's still reachable by other containers but docker hasn't been told "Hey make an iptable entry for me that opens 0.0.0.0:5432 on the host's firewall and route this down to the container for me"
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#32404
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?