Failed to connect newt, Oracle VPS setup #426

New Issue

Closed

opened 2025-11-13 12:00:02 -06:00 by GiteaMirror · 9 comments

GiteaMirror commented 2025-11-13 12:00:02 -06:00

Owner

Copy Link

Originally created by @KostyalBalint on GitHub (Jun 11, 2025).

Hi Pangolin Team!

First of all, awesome project, I really love the whole app, and the documentation :)

I'm currently trying to set up Pangolin to expose my self-hosted services, but really struggling, and don't know what I'm doing wrong :(

I successfully installed Pangolin on an Oracle Free Tier VPS server running Ubuntu. I opened all the required ports 80/TCP, 443/TCP, 51820/UDP, and Pangolin seems to be running correctly.

To confirm this, here is a netcat result from my remote site:

balint@truenas:~$ nc -vzu pangolin.mydomain.com 51820
Connection to pangolin.mydomain.com (xxx.xxx.xxx.xxx) 51820 port [udp/*] succeeded!
balint@truenas:~$ nc -vz pangolin.mydomain.com 80
Connection to pangolin.mydomain.com (xxx.xxx.xxx.xxx) 80 port [tcp/http] succeeded!
balint@truenas:~$ nc -vz pangolin.mydomain.com 443
Connection to pangolin.mydomain.com (xxx.xxx.xxx.xxx) 443 port [tcp/https] succeeded! 

Also, I enabled ICMP on Oracle's Firewall, as I remember correctly that it is also needed for Pangolin to work. So I can also ping the Oracle VPS as expected.

But when I try to run newt on my remote site (truenas), I get this error:

INFO: 2025/06/11 14:04:30 Received: {Type:newt/wg/connect Data:map[endpoint:pangolin.mydomain.com:51820 publicKey:<pub_key> serverIP:100.89.128.1 targets:map[tcp:[] udp:[]] tunnelIP:100.89.128.4]}
INFO: 2025/06/11 14:04:30 WireGuard device created. Lets ping the server now...
INFO: 2025/06/11 14:04:30 Ping attempt 1
INFO: 2025/06/11 14:04:30 Pinging 100.89.128.1
WARN: 2025/06/11 14:04:40 Ping attempt 1 failed: failed to read ICMP packet: i/o timeout
INFO: 2025/06/11 14:04:40 Starting ping check
INFO: 2025/06/11 14:04:40 Ping attempt 2
INFO: 2025/06/11 14:04:40 Pinging 100.89.128.1
[...]

Also, I'm running Tailscale alongside on this setup, but I don't think that should interfere.

Thanks in advance for any guidance or directions I could take to resolve this issue

Originally created by @KostyalBalint on GitHub (Jun 11, 2025). Hi Pangolin Team! First of all, awesome project, I really love the whole app, and the documentation :) I'm currently trying to set up Pangolin to expose my self-hosted services, but really struggling, and don't know what I'm doing wrong :( I successfully installed Pangolin on an Oracle Free Tier VPS server running Ubuntu. I opened all the required ports `80/TCP, 443/TCP, 51820/UDP`, and Pangolin seems to be running correctly. To confirm this, here is a `netcat` result from my remote site: ```bash balint@truenas:~$ nc -vzu pangolin.mydomain.com 51820 Connection to pangolin.mydomain.com (xxx.xxx.xxx.xxx) 51820 port [udp/*] succeeded! balint@truenas:~$ nc -vz pangolin.mydomain.com 80 Connection to pangolin.mydomain.com (xxx.xxx.xxx.xxx) 80 port [tcp/http] succeeded! balint@truenas:~$ nc -vz pangolin.mydomain.com 443 Connection to pangolin.mydomain.com (xxx.xxx.xxx.xxx) 443 port [tcp/https] succeeded! ``` Also, I enabled ICMP on Oracle's Firewall, as I remember correctly that it is also needed for Pangolin to work. So I can also ping the Oracle VPS as expected. But when I try to run `newt` on my remote site (truenas), I get this error: ``` INFO: 2025/06/11 14:04:30 Received: {Type:newt/wg/connect Data:map[endpoint:pangolin.mydomain.com:51820 publicKey:<pub_key> serverIP:100.89.128.1 targets:map[tcp:[] udp:[]] tunnelIP:100.89.128.4]} INFO: 2025/06/11 14:04:30 WireGuard device created. Lets ping the server now... INFO: 2025/06/11 14:04:30 Ping attempt 1 INFO: 2025/06/11 14:04:30 Pinging 100.89.128.1 WARN: 2025/06/11 14:04:40 Ping attempt 1 failed: failed to read ICMP packet: i/o timeout INFO: 2025/06/11 14:04:40 Starting ping check INFO: 2025/06/11 14:04:40 Ping attempt 2 INFO: 2025/06/11 14:04:40 Pinging 100.89.128.1 [...] ``` Also, I'm running Tailscale alongside on this setup, but I don't think that should interfere. Thanks in advance for any guidance or directions I could take to resolve this issue

GiteaMirror closed this issue 2025-11-13 12:00:02 -06:00

GiteaMirror commented 2025-11-13 12:00:03 -06:00

Author

Owner

Copy Link

@KostyalBalint commented on GitHub (Jun 11, 2025):

Update

I found this discussion on DC: https://discord.com/channels/1325658630518865980/1373689106432917584
According to this, it's an issue with SQLite, so I changed the database to a full-fat PostgreSQL, but the issue is still present.

@KostyalBalint commented on GitHub (Jun 11, 2025): **Update** I found this discussion on DC: https://discord.com/channels/1325658630518865980/1373689106432917584 According to this, it's an issue with SQLite, so I changed the database to a full-fat PostgreSQL, but the issue is still present.

GiteaMirror commented 2025-11-13 12:00:03 -06:00

Author

Owner

Copy Link

@wuyifannppp commented on GitHub (Jun 11, 2025):

ME TO
100.89.128.1 ping error

@wuyifannppp commented on GitHub (Jun 11, 2025): ME TO 100.89.128.1 ping error

GiteaMirror commented 2025-11-13 12:00:03 -06:00

Author

Owner

Copy Link

@AstralDestiny commented on GitHub (Jun 11, 2025):

The ping happens before the connection even is established, Honestly newt should just ping and ask what the host ip of the gerbil.. As wireguard is mostly a silent protocol and won't even tell you of connection was successful or not,

It gets the data from pangolin during it's initial callback with it's ID and Secret and starts to ICMP ping ahead of time.. Also do not enable ICMP on the vps the ICMP is purely in tunnel and it doesn't matter if both hosts reject ICMP.

You need to verify firewall rules and if you are using something like Oracle you need to add the ports on the oracle web UI as ports alone on the host doesn't mean the ports are open to the internet.

@AstralDestiny commented on GitHub (Jun 11, 2025): The ping happens before the connection even is established, Honestly newt should just ping and ask what the host ip of the gerbil.. As wireguard is mostly a silent protocol and won't even tell you of connection was successful or not, It gets the data from pangolin during it's initial callback with it's ID and Secret and starts to ICMP ping ahead of time.. Also do not enable ICMP on the vps the ICMP is purely in tunnel and it doesn't matter if both hosts reject ICMP. You need to verify firewall rules and if you are using something like Oracle you need to add the ports on the oracle web UI as ports alone on the host doesn't mean the ports are open to the internet.

GiteaMirror commented 2025-11-13 12:00:04 -06:00

Author

Owner

Copy Link

@KostyalBalint commented on GitHub (Jun 11, 2025):

Thanks for the reply, I'll disable ICMP. TBH, it was just a last effort idea...

Also, I enabled the ports on Oracle's web GUI as well. (Otherwise, netcat wouldn't connect, from the host I'm running newt on)

@KostyalBalint commented on GitHub (Jun 11, 2025): Thanks for the reply, I'll disable ICMP. TBH, it was just a last effort idea... Also, I enabled the ports on Oracle's web GUI as well. (Otherwise, netcat wouldn't connect, from the host I'm running newt on)

GiteaMirror commented 2025-11-13 12:00:04 -06:00

Author

Owner

Copy Link

@Blucose commented on GitHub (Jun 12, 2025):

I'm having the same issue. If there's any logs I can post that would help resolve this let me know.

@Blucose commented on GitHub (Jun 12, 2025): I'm having the same issue. If there's any logs I can post that would help resolve this let me know.

GiteaMirror commented 2025-11-13 12:00:04 -06:00

Author

Owner

Copy Link

@KostyalBalint commented on GitHub (Jun 13, 2025):

A diagnosis that you can run:

1. Stop all the Docker containers related to Pangolin

List running containers:

docker ps -a

Stop them:

docker stop <cointainer_id> <container_2_id> <ect..>

2. Start a netcat listener on the VPS for port 51820 for UDP

sudo nc -u -l -p 51820

Try sending a UDP packet to your server from a different machine, which in theory should access your VPS

echo "test" | nc -u yourdomain.com 51820

If you see "test" printed on your VPS's console, your port is definitely open.
If you don't see anything, try to resend the packet a few times, as UDP is stateless, the packet might just lost in the transmission. (Also, this is why simply trying to connect nc -vzu yourdomain.com 51820 to that "port" with netcat might show success, but actually it lies)

But if even after a few tries it doesn't go through, it is highly likely that some firewall might block the request.

I'm currently rowing in the same boat, aka the UDP request doesn't go through. Sometimes it's not the waters fault if you can't swim xD

Note:
If you try with a known open port, like 80/TCP (HTTP), you should see it working.

sudo nc -l -p 80 #Server side

echo "test" | nc yourdomain.com 80 #Client side

@KostyalBalint commented on GitHub (Jun 13, 2025): A diagnosis that you can run: **1. Stop all the Docker containers related to Pangolin** List running containers: ``` docker ps -a ``` Stop them: ``` docker stop <cointainer_id> <container_2_id> <ect..> ``` **2. Start a netcat listener on the VPS for port 51820 for UDP** ``` sudo nc -u -l -p 51820 ``` Try sending a UDP packet to your server from a different machine, which in theory should access your VPS ``` echo "test" | nc -u yourdomain.com 51820 ``` If you see "test" printed on your VPS's console, your port is definitely open. If you don't see anything, try to resend the packet a few times, as UDP is stateless, the packet might just lost in the transmission. (Also, this is why simply trying to connect `nc -vzu yourdomain.com 51820` to that "port" with netcat might show success, but actually it lies) But if even after a few tries it doesn't go through, it is highly likely that some firewall might block the request. I'm currently rowing in the same boat, aka the UDP request doesn't go through. Sometimes it's not the waters fault if you can't swim xD _Note:_ If you try with a known open port, like 80/TCP (HTTP), you should see it working. ```bash sudo nc -l -p 80 #Server side ``` ```bash echo "test" | nc yourdomain.com 80 #Client side ```

GiteaMirror commented 2025-11-13 12:00:04 -06:00

Author

Owner

Copy Link

@Blucose commented on GitHub (Jun 13, 2025):

A diagnosis that you can run:

1. Stop all the Docker containers related to Pangolin

List running containers:

docker ps -a

Stop them:

docker stop <cointainer_id> <container_2_id> <ect..>

2. Start a netcat listener on the VPS for port 51820 for UDP

sudo nc -u -l -p 51820

Try sending a UDP packet to your server from a different machine, which in theory should access your VPS

echo "test" | nc -u yourdomain.com 51820

If you see "test" printed on your VPS's console, your port is definitely open.
If you don't see anything, try to resend the packet a few times, as UDP is stateless, the packet might just lost in the transmission. (Also, this is why simply trying to connect nc -vzu yourdomain.com 51820 to that "port" with netcat might show success, but actually it lies)

But if even after a few tries it doesn't go through, it is highly likely that some firewall might block the request.

I'm currently rowing in the same boat, aka the UDP request doesn't go through. Sometimes it's not the waters fault if you can't swim xD

Note:
If you try with a known open port, like 80/TCP (HTTP), you should see it working.

sudo nc -l -p 80 #Server side

echo "test" | nc yourdomain.com 80 #Client side

Yeah I got as far as this. This is all working, and some more AI assisted troubleshooting seems to imply there's some mixup with the keys that pangolin is handing out. I tried a fresh install so the problem must be in the config somewhere, I'll try going for the automated installation rather than rolling my own docker compose...

@Blucose commented on GitHub (Jun 13, 2025): > A diagnosis that you can run: > > **1. Stop all the Docker containers related to Pangolin** > > List running containers: > ``` > docker ps -a > ``` > > Stop them: > ``` > docker stop <cointainer_id> <container_2_id> <ect..> > ``` > > **2. Start a netcat listener on the VPS for port 51820 for UDP** > > ``` > sudo nc -u -l -p 51820 > ``` > > Try sending a UDP packet to your server from a different machine, which in theory should access your VPS > > ``` > echo "test" | nc -u yourdomain.com 51820 > ``` > > If you see "test" printed on your VPS's console, your port is definitely open. > If you don't see anything, try to resend the packet a few times, as UDP is stateless, the packet might just lost in the transmission. (Also, this is why simply trying to connect `nc -vzu yourdomain.com 51820` to that "port" with netcat might show success, but actually it lies) > > But if even after a few tries it doesn't go through, it is highly likely that some firewall might block the request. > > I'm currently rowing in the same boat, aka the UDP request doesn't go through. Sometimes it's not the waters fault if you can't swim xD > > _Note:_ > If you try with a known open port, like 80/TCP (HTTP), you should see it working. > > ```bash > sudo nc -l -p 80 #Server side > ``` > ```bash > echo "test" | nc yourdomain.com 80 #Client side > ``` Yeah I got as far as this. This is all working, and some more AI assisted troubleshooting seems to imply there's some mixup with the keys that pangolin is handing out. I tried a fresh install so the problem must be in the config somewhere, I'll try going for the automated installation rather than rolling my own docker compose...

GiteaMirror commented 2025-11-13 12:00:05 -06:00

Author

Owner

Copy Link

@KostyalBalint commented on GitHub (Jun 13, 2025):

🎉 I finally got it working

The problem actually was that port 51820 was NOT open... (As I said, "sometimes it's not the waters fault if you can't swim")

Steps that worked for me, on Oracle Free Tier cloud with Ubuntu installed.

1.st step

Enable Forwarding of IP

sudo nano /etc/sysctl.conf

Remove the # for the entries:

net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1

CTRL + X and then Y for save

sudo sysctl -p

2.nd step

Go to Oracle's web interface and search for Virtual Cloud Networks, find the one that you are using for this VM (Most likely you only have one)
Go to Default Security List for vcn-20250205-2310 or something named similarly, and set Ingress rules as follows:

The most important one for Wireguard is:

Steteless: Yes
Source CIDR: 0.0.0.0/0
IP Protocol: UDP
Destination Port range: 51820

For TCP, ports 80 and 443 are needed for the web UI. But if I remember correctly, there is a default rule for all TCP traffic, so if that is present, you don't need to explicitly add these again.

3.rd step

Installed everything (including Docker) with Pangolin's install script

https://docs.fossorial.io/Getting%20Started/quick-install

4.th step

Setup Pangolin, and Newt as you'd like and be happy that it (hopefully) works as expected

Notes

I guess if you have it installed you only need to do the firewall rules

Do NOT use ufw firewall on Oracle's VPS: https://community.oracle.com/customerconnect/discussion/684399/oci-ufw-was-enabled-on-ubuntu-and-ssh-connections-started-to-fail-with-connection-refused-error

The final info that helped me to put together this puzzle was from this Redit post

@KostyalBalint commented on GitHub (Jun 13, 2025): # 🎉 I finally got it working The problem actually was that port `51820` was NOT open... _(As I said, "sometimes it's not the waters fault if you can't swim")_ ## Steps that worked for me, on Oracle Free Tier cloud with Ubuntu installed. ### 1.st step Enable Forwarding of IP ```bash sudo nano /etc/sysctl.conf ``` Remove the # for the entries: ``` net.ipv4.ip_forward = 1 net.ipv6.conf.all.forwarding = 1 ``` CTRL + X and then Y for save ```bash sudo sysctl -p ``` ### 2.nd step Go to Oracle's web interface and search for `Virtual Cloud Networks`, find the one that you are using for this VM (Most likely you only have one) Go to `Default Security List for vcn-20250205-2310` or something named similarly, and set Ingress rules as follows: <img width="1122" alt="Image" src="https://github.com/user-attachments/assets/bad49182-1cd0-44a0-9884-ef1c31a402af" /> The most important one for Wireguard is: Steteless: `Yes` Source CIDR: `0.0.0.0/0` IP Protocol: `UDP` Destination Port range: `51820` For TCP, ports 80 and 443 are needed for the web UI. But if I remember correctly, there is a default rule for all TCP traffic, so if that is present, you don't need to explicitly add these again. ### 3.rd step Installed everything (including Docker) with Pangolin's install script https://docs.fossorial.io/Getting%20Started/quick-install ### 4.th step Setup Pangolin, and Newt as you'd like and be happy that it _(hopefully)_ works as expected ### Notes _I guess if you have it installed you only need to do the firewall rules_ _Do NOT use `ufw` firewall on Oracle's VPS:_ https://community.oracle.com/customerconnect/discussion/684399/oci-ufw-was-enabled-on-ubuntu-and-ssh-connections-started-to-fail-with-connection-refused-error The final info that helped me to put together this puzzle was from this [Redit post](https://www.reddit.com/r/WireGuard/comments/1baeuyx/wireguard_oracle_cloud_step_by_step/)

GiteaMirror commented 2025-11-13 12:00:05 -06:00

Author

Owner

Copy Link

@krod1408 commented on GitHub (Sep 30, 2025):

I had a similar issue and I followed this and it seems to have fixed the issue for me I will have to check the logs again to see if that was the problem.

How to resolve the warning
Here are the general steps to fix a Docker socket access issue. The best solution depends on your specific setup.
For a Newt service running on the host system
Add the user to the docker group: Run the following command to add the user running Newt to the docker group:
sudo usermod -aG docker $USER
Apply group changes: Log out and log back in, or run newgrp docker to apply the new group membership.
Restart the Docker daemon: Sometimes, a restart is necessary to refresh the permissions.
sudo systemctl restart docker
For Newt running as a Docker container
Correctly mount the socket: Ensure the host's Docker socket is correctly mounted into the Newt container. For example, your docker run command should include the following flag:
-v /var/run/docker.sock:/var/run/docker.sock

@krod1408 commented on GitHub (Sep 30, 2025): I had a similar issue and I followed this and it seems to have fixed the issue for me I will have to check the logs again to see if that was the problem. How to resolve the warning Here are the general steps to fix a Docker socket access issue. The best solution depends on your specific setup. For a Newt service running on the host system Add the user to the docker group: Run the following command to add the user running Newt to the docker group: sudo usermod -aG docker $USER Apply group changes: Log out and log back in, or run newgrp docker to apply the new group membership. Restart the Docker daemon: Sometimes, a restart is necessary to refresh the permissions. sudo systemctl restart docker For Newt running as a Docker container Correctly mount the socket: Ensure the host's Docker socket is correctly mounted into the Newt container. For example, your docker run command should include the following flag: -v /var/run/docker.sock:/var/run/docker.sock

GiteaMirror referenced this issue 2026-04-16 08:04:56 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #1445

GiteaMirror referenced this issue 2026-04-20 07:19:26 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #3387

GiteaMirror referenced this issue 2026-04-25 15:05:14 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #6241

GiteaMirror referenced this issue 2026-04-30 03:38:28 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #8209

GiteaMirror referenced this issue 2026-05-06 13:19:38 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #10206

GiteaMirror referenced this issue 2026-05-13 17:25:46 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #12250

GiteaMirror referenced this issue 2026-05-16 02:06:14 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #14330

GiteaMirror referenced this issue 2026-05-18 16:26:41 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #16425

GiteaMirror referenced this issue 2026-05-21 17:59:30 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #18532

GiteaMirror referenced this issue 2026-06-05 04:54:02 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #22737

GiteaMirror referenced this issue 2026-06-10 21:54:20 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #27063

GiteaMirror referenced this issue 2026-06-13 09:00:43 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #29276

GiteaMirror referenced this issue 2026-06-15 08:17:59 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #31511

GiteaMirror referenced this issue 2026-06-18 19:33:17 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #34866

GiteaMirror referenced this issue 2026-06-22 01:09:57 -05:00

[GH-ISSUE #426] [Feature Request] Better bandwidth in Pangolin UI #38239

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

dev

dependabot/npm_and_yarn/npm-dependencies-8b2d4a9f3a

local-connection

dependabot/go_modules/install/go-install-dependencies-3804ca7238

dependabot/docker/docker-dependencies-4faa477378

dependabot/github_actions/github-actions-dependencies-6d79802a48

api-improvements

feat/remember-last-idp-on-smart-login-form

refactor/batch-status-requests

dependabot/npm_and_yarn/multi-5f1280885e

fix/non-semver-version-error

private-resource-page

resource-launcher

backhaul

exit-node-reconnect

feat/command-palette

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

1.20.0

1.20.0-rc.0

1.19.4

1.19.3

1.19.2

1.19.1

1.19.0

1.19.0-rc.1

1.19.0-rc.0

1.18.4

1.18.3

1.18.2

1.18.1

1.18.0

1.18.0-rc.0

1.17.1

1.17.0

1.17.0-rc.0

1.16.2

1.16.1

1.16.0

1.16.0-rc.0

1.15.4

1.15.3

1.15.2

1.15.1

1.15.0

1.15.0-rc.0

1.14.1

1.14.0

1.14.0-rc.0

1.13.1

1.13.0

1.13.0-rc.0

1.12.3

1.12.2

1.12.1

1.12.0

1.12.0-rc.0

1.11.1

1.11.0

1.10.3

1.10.2

1.10.1

1.10.0

1.9.4

1.9.3

1.9.2

1.9.1

1.9.0

1.8.0

1.7.3

1.7.2

1.7.1

1.7.0

1.6.2

1.6.1

1.6.0

1.5.1

1.5.0

1.4.0

1.3.2

1.3.1

1.3.0

1.2.0

1.1.0

1.0.1

1.0.0

1.0.0-beta.15

1.0.0-beta.14

1.0.0-beta.13

1.0.0-beta.12

1.0.0-beta.11

1.0.0-beta.10

1.0.0-beta.9

1.0.0-beta.8

1.0.0-beta.7

1.0.0-beta.6

1.0.0-beta.5

1.0.0-beta.4

1.0.0-beta.3

1.0.0-beta.2

1.0.0-beta.1

Labels

Clear labels

api

authentication

bug

config

dependencies

docker

documentation

enhancement

good first issue

help wanted

Improvement

Look Into

needs investigating

networking

new feature

non-critical bug

potential bug

pull-request

Mirrored from GitHub Pull Request

question

reverse proxy

Security

stale

ui

wontfix

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

GiteaMirror ninjasurge

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/pangolin#426