github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-08 05:39:49 -05:00
Code Issues 564 Packages Projects Releases 72 Wiki Activity

[GH-ISSUE #2349] Feature Request: Native/Kernel WireGuard support for Newt with full site-to-site networking #4089

New Issue
Closed
opened 2026-04-20 08:31:56 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-20 08:31:56 -05:00
Owner
Copy Link

Originally created by @fampla on GitHub (Jan 27, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2349

Feature Request

Problem

I want to use Pangolin/Newt as my single networking solution to replace Tailscale, connecting multiple servers (homelab, remote Proxmox hosts) with full site-to-site connectivity for services like NFS shares.

Currently I face two limitations:

  1. Performance: Newt's userspace WireGuard implementation is significantly slower than kernel WireGuard. As discussed in #512, users report ~1-10 MB/s with Newt vs 22+ MB/s with native WireGuard for the same connection.

  2. Site-to-Site networking: Private resources and subnet routing only work with Newt, but the performance penalty makes it unsuitable for bandwidth-intensive use cases (NFS, media streaming, backups).

Current Workaround

I'm forced to run a hybrid setup:

  • Native WireGuard (wg0) for bandwidth-intensive services (Emby, etc.)
  • Tailscale for site-to-site connectivity (NFS between servers)

This defeats the purpose of having a unified self-hosted solution.

Proposed Solution

Add native/kernel WireGuard support to Newt, similar to how Tailscale offers both userspace and kernel modes:

  1. --native or --kernel flag that uses the system's WireGuard kernel module instead of userspace netstack
  2. Maintain Pangolin integration - keep the control plane communication, automatic peer configuration, and private resource management
  3. Site-to-site routing through kernel networking stack for proper subnet gateway functionality (related to #1370)

Benefits

  • Near line-speed performance for all traffic
  • True Tailscale replacement with full site-to-site networking
  • Single service to manage instead of multiple VPN solution

Environment

  • Multiple Proxmox hosts
  • Docker containers (Emby, NFS, etc.)
  • Currently using: Pangolin + native WireGuard + Tailscale (want to consolidate)

I noticed there's a --native / USE_NATIVE_INTERFACE flag in the code - is this intended for this purpose? If so, documentation would be helpful.

Thank you for this great project!

Originally created by @fampla on GitHub (Jan 27, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/2349 ## Feature Request ### Problem I want to use Pangolin/Newt as my **single networking solution** to replace Tailscale, connecting multiple servers (homelab, remote Proxmox hosts) with full site-to-site connectivity for services like NFS shares. Currently I face two limitations: 1. **Performance**: Newt's userspace WireGuard implementation is significantly slower than kernel WireGuard. As discussed in #512, users report ~1-10 MB/s with Newt vs 22+ MB/s with native WireGuard for the same connection. 2. **Site-to-Site networking**: Private resources and subnet routing only work with Newt, but the performance penalty makes it unsuitable for bandwidth-intensive use cases (NFS, media streaming, backups). ### Current Workaround I'm forced to run a hybrid setup: - **Native WireGuard (wg0)** for bandwidth-intensive services (Emby, etc.) - **Tailscale** for site-to-site connectivity (NFS between servers) This defeats the purpose of having a unified self-hosted solution. ### Proposed Solution Add native/kernel WireGuard support to Newt, similar to how Tailscale offers both userspace and kernel modes: 1. **`--native` or `--kernel` flag** that uses the system's WireGuard kernel module instead of userspace netstack 2. **Maintain Pangolin integration** - keep the control plane communication, automatic peer configuration, and private resource management 3. **Site-to-site routing** through kernel networking stack for proper subnet gateway functionality (related to #1370) ### Benefits - Near line-speed performance for all traffic - True Tailscale replacement with full site-to-site networking - Single service to manage instead of multiple VPN solution ### Environment - Multiple Proxmox hosts - Docker containers (Emby, NFS, etc.) - Currently using: Pangolin + native WireGuard + Tailscale (want to consolidate) I noticed there's a `--native` / `USE_NATIVE_INTERFACE` flag in the code - is this intended for this purpose? If so, documentation would be helpful. Thank you for this great project!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#4089
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?