github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-06 12:55:03 -05:00
Code Issues 468 Packages Projects Releases 72 Wiki Activity

[GH-ISSUE #2837] Newt ping failed #7050

New Issue
Open
opened 2026-04-25 16:02:52 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-25 16:02:52 -05:00
Owner
Copy Link

Originally created by @DSYZayn on GitHub (Apr 12, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2837

Describe the Bug

I tested on pangolin cloud without installing any realy server, just installed a Newt and tried to use it as a cloudflare tunnel to expose a private network service to the public, but it failed. The Newt logs show ping failed. Is this the main reason that my Newt instance is in China? I confirmed that there is no firewall on the server where my Newt instance is located, and that tailscale and cloudflare are both running fine on that server

Environment

  • OS Type & Version: Ubuntu 22.04
  • Pangolin Version:
  • Gerbil Version:
  • Traefik Version:
  • Newt Version:
  • Olm Version: (if applicable)

To Reproduce

Image

Expected Behavior

newt ping failed

Originally created by @DSYZayn on GitHub (Apr 12, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/2837 ### Describe the Bug I tested on pangolin cloud without installing any realy server, just installed a Newt and tried to use it as a cloudflare tunnel to expose a private network service to the public, but it failed. The Newt logs show ping failed. Is this the main reason that my Newt instance is in China? I confirmed that there is no firewall on the server where my Newt instance is located, and that tailscale and cloudflare are both running fine on that server ### Environment - OS Type & Version: Ubuntu 22.04 - Pangolin Version: - Gerbil Version: - Traefik Version: - Newt Version: - Olm Version: (if applicable) ### To Reproduce <img width="2061" height="546" alt="Image" src="https://github.com/user-attachments/assets/1959a924-2219-417f-a613-3e7aae9b0fcb" /> ### Expected Behavior newt ping failed
GiteaMirror commented 2026-04-25 16:02:53 -05:00
Author
Owner
Copy Link

@DSYZayn commented on GitHub (Apr 12, 2026):

logs after restart Newt service：

Image
<!-- gh-comment-id:4231274065 --> @DSYZayn commented on GitHub (Apr 12, 2026): logs after restart Newt service： <img width="2070" height="528" alt="Image" src="https://github.com/user-attachments/assets/bc6e0dc9-d285-4c60-89be-e271b6cf5e95" />
GiteaMirror commented 2026-04-25 16:02:53 -05:00
Author
Owner
Copy Link

@AstralDestiny commented on GitHub (Apr 17, 2026):

What's your vps provider? some vps providers might flag 51820 and 21820 as ddos and selectively flag or block connections, The ICMP happens over the tunnel so if the tunnel can't connect (51820) or your defined port it will cause the ping issue. Also would need to know what versions you're running for stuff.

Sorry didn't read that right in my head for some reason,
If you disable tailscale does it load fine? tailscale is aggressive on using the entire cgnat range for connections which can cause hit or miss issues.

<!-- gh-comment-id:4269529636 --> @AstralDestiny commented on GitHub (Apr 17, 2026): What's your vps provider? some vps providers might flag 51820 and 21820 as ddos and selectively flag or block connections, The ICMP happens over the tunnel so if the tunnel can't connect (51820) or your defined port it will cause the ping issue. Also would need to know what versions you're running for stuff. Sorry didn't read that right in my head for some reason, If you disable tailscale does it load fine? tailscale is aggressive on using the entire cgnat range for connections which can cause hit or miss issues.
GiteaMirror commented 2026-04-25 16:02:53 -05:00
Author
Owner
Copy Link

@coradia commented on GitHub (Apr 24, 2026):

This may be a Pangolin/Gerbil Cloudflare proxy configuration edge case rather than a standalone Newt client issue.

I think I’m hitting the same/related issue with Newt ping failure when using the documented Cloudflare proxy setup.

Pangolin is self-hosted behind a Cloudflare proxy. Following the docs, I've:

gerbil:
  base_endpoint: "<PUBLIC_IP>"

Newt connects successfully to Pangolin:

Server version: 1.18.0-rc.0
Websocket connected

But it then fails the exit node ping because it attempts HTTPS against the raw public IP:

Failed to ping exit node 1 (http://<PUBLIC_IP>/ping) attempt 1:
Get "https://<PUBLIC_IP>/ping": tls: failed to verify certificate:
x509: cannot validate certificate for <PUBLIC_IP> because it doesn't contain any IP SANs

I confirmed the network path itself works:

  • WAN 443 forwards to Traefik/Pangolin
  • Traefik /ping on websecure returns HTTP/2 200
  • Traefik is serving my real wildcard certificate rather than TRAEFIK DEFAULT CERT

However, the certificate is valid for my Pangolin hostname/wildcard domain, not the raw IP address, so Newt’s HTTPS ping to the IP address can't be validated.

A hostname/SNI test works correctly:

curl --resolve <PANGOLIN_HOSTNAME>:443:<PUBLIC_IP> https://<PANGOLIN_HOSTNAME>/ping

So this looks like Newt needs to use a hostname for HTTPS ping/SNI while still allowing Gerbil/WireGuard to use the base_endpoint public IP, as required by the Cloudflare proxy docs.

<!-- gh-comment-id:4317050868 --> @coradia commented on GitHub (Apr 24, 2026): This may be a Pangolin/Gerbil Cloudflare proxy configuration edge case rather than a standalone Newt client issue. I think I’m hitting the same/related issue with Newt ping failure when using the [documented Cloudflare proxy setup](https://docs.pangolin.net/self-host/advanced/cloudflare-proxy). Pangolin is self-hosted behind a Cloudflare proxy. Following the docs, I've: ``` gerbil: base_endpoint: "<PUBLIC_IP>" ``` Newt connects successfully to Pangolin: ``` Server version: 1.18.0-rc.0 Websocket connected ``` But it then fails the exit node ping because it attempts HTTPS against the raw public IP: ``` Failed to ping exit node 1 (http://<PUBLIC_IP>/ping) attempt 1: Get "https://<PUBLIC_IP>/ping": tls: failed to verify certificate: x509: cannot validate certificate for <PUBLIC_IP> because it doesn't contain any IP SANs ``` I confirmed the network path itself works: - WAN 443 forwards to Traefik/Pangolin - Traefik /ping on websecure returns HTTP/2 200 - Traefik is serving my real wildcard certificate rather than TRAEFIK DEFAULT CERT However, the certificate is valid for my Pangolin hostname/wildcard domain, not the raw IP address, so Newt’s HTTPS ping to the IP address can't be validated. A hostname/SNI test works correctly: `curl --resolve <PANGOLIN_HOSTNAME>:443:<PUBLIC_IP> https://<PANGOLIN_HOSTNAME>/ping` So this looks like Newt needs to use a hostname for HTTPS ping/SNI while still allowing Gerbil/WireGuard to use the base_endpoint public IP, as required by the Cloudflare proxy docs.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#7050
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?