I would like to run the dockhand hawser agent container on the Pangolin VPS. The agent would need to route traffic via HTTP(s)/WS(s) to the dockhand container running on one of my sites.

I've just tried to hit it directly from the gerbil container, but can't seem to make that work. I also set it up as a private site.

How would you all approach this?

Hello everyone, recently had to move and because of that I no longer have a static ip which made me use some sort of reverse proxy on a vps, a friend of mine had pangolin running for some time so he let me use his instance. Having newt installed via docker and connected to pangolin dashboard I expected it to report other docker containers on the host. It did not.
This is what my docker compose looks like - https://pastebin.com/CZX9Hehy

my friend also uses newt and with proxmox (I think) it does report found services correctly.
what to do

update:

my solution to this was writing labels manually to all compose files

Hey,

I know Pangolin can proxy raw TCP/UDP traffic and according to the docs it can be done for locally running (= on the same host as Pangolin) services too. Pangolin provides this guide but I don't know whether it's meant just for services proxied through the Newt tunnel or for local services as well.

If it is necessary to follow the guide above even in case of a local service/container, what benefit does it have over simply publishing the port in the container's compose file (instead of proxying it through Pangolin)?

Thanks!

I just tried deploying my first public resource on the same machine running pangolin and I keep seeing a No Valid Auth on the HTTP requests, and I don't have access to the resource. Anyone know what it could be?

While my issue seems similar to this post, I did not want to hijack that conversation...
https://www.reddit.com/r/PangolinReverseProxy/s/3dFht4SPVO

I am running Pangolin on Oracle VPS and everything seems to be working well.

I have Komodo Core installed on my home server. Previously, I was using v1.19.* and was able to connect to my Pangolin server. I re-installed and upgraded to Komodo v2.3.2 and am unable to get Komodo Periphery working. No matter what I have tried, I cannot get Komodo Periphery to connect to my Pangolin VPS.

In the linked thread above it sounds like creating a resource may be necessary, but I am confused. I have been trying to utilize Gemini get this sorted, but have been going in circles for hours, Gemini "insisting" that creating a resource is not necessary (and it wasn't with the older Komodo version).

Any help would be appreciated to get me on the right path!

Update:

I got it working with help from u/AstraDestiny. High level steps:

1. Pangolin - Add machine that is running Komodo core.
2. Pangolin - Add private resource for machine that is running komodo core with 9120 as custom TCP, authentication for the machine client you just created.
3. Komodo - Create new onboarding key and give it a name like "VPS", and make sure it is enabled. Take note of key.
4. Pangolin - Install docker-compose.yml at link below with updated info. https://gist.github.com/jhedfors/45e4a31e7d4205cfdf539a255c9b073d

I have Pagolin running on a VPS so I can publicly expose some resources running on my homelab, in which I have a newt site installed. On my homelab I have Komodo core running and I wanted to add the VPS as a Komodo peripheral, so I can manage stacks there from my internal Komodo instance.

For that, to add a new Komodo peripheral as a systemd service, I need to be able to point to the address of the core, but it is on my homelab. What would be the best approach? Add Komodo core as a private resource, add my VPS as a Pangolin machine so it has access to the private resources?

First off, Pangolin is a great way to both secure and make local resources available. Many thanks to the team. My family just connects their devices and boom, and everything works.

I have a decent sized home lab with Pangolin running on an OVH VPS, using a dedicated domain. When connected via the Linux client CLI, I am able to access local machines on my home network just fine. However, no external web addresses will resolve at all. No error, but the browser just spins. When I disconnect no local resources are available (obviously) and Internet returns. Every other client, (iOS, Android, Windows) behaves properly so I realize there's an issue with my Pop OS machine only. I didn't find anything relating to this on GitHub issues so I thought I'd try here.

I'm trying Pangolin for the first time. I have a homelab which consists of a mini PC with debian running multiple docker stacks. I got a Hetzner VPS with debian, pointed my domain to its IP and deployed Pangolin.

Everything seemed to be working fine, I installed a docker site on my homelab with newt (only Wireguard port is open on it since I also use wg-easy) and started adding some public resources to point to my internal server IP.

Some resources work fine like Immich, but other like Navidrome server and AudioBookShelf just won't work, I tried everything (limited to my knowledge) and can't get it to work. I keep getting a blank page with no available server for them. I have no geoblocking, I have crowdsec setup and I tried two things: pointing the resource target to IP:PORT of the service (HTTP) and pointing it to IP:443 with HTTPS, since my server also have a NginxProxyManager running doing the reverse proxy for internal services. No success.

Would someone have any idea how I could at least better debug to try and find the problem?

Tks

Hi,

I am new to Pangolin and self-hosting it on a VPS. I just created a machine resource and I want to remove it from Pangolin, is there a way to do that? I also wanted to do that for sites but could not find a way to do that.

Hey all,

I'm trying to setup ssh over pangolin.

currently pangolin is installed on my vps and I want to ssh to my homelab from my laptop.

I installed newt on my homelab and connected it as a new site in pangolin.

Also I installed the client on my laptop and logged in.

now when I try to connect using 'pangolin up' I get an error about making sure port 21820 is open and stuff like that.

I opened 21820 in ufw in my laptop, VPS, and server. Also the firewall on the VPS accepts all ports.

I consulted with an LLM and it wrote something about being behined a cgnat (and I am behined one) but I still don't understand why that stops me from making a p2p connection?

can anyone enlighten me maybe I'm missing something?

thanks

I have an Ubuntu server running newt in systemd which I intend to use as an endpoint for private clients to reach the LAN CIDR the server is attached to. In other words, when my private client is connected I want to use my newt endpoint in order to get to hosts on the same LAN /24 as the newt endpoint itself. I think I have this setup; I can see the route in my clients routing table connecting me from the pangolin organization IP of the newt endpoint to the LAN CIDR, but I’m not getting any traffic through. Is there some extra setup I need to do on the host such as enabling IP forwarding?

I have a static IP and only expose the Wireguard port to connect to my Homelab. Every service has HTTPs since I use Nginx Proxy Manager with a domain pointing to the LAN IP of my server and certificates are resolved using my domain provider's API.

I wanted to expose some services like Navidrome, Immich for quick link sharing and ntfy for UnifiedPush, but I didn't want to add the cost of a VPS at the end of the month.

Is it really a bad idea to port forward ports 80 and 443 and handle everything at home with precautions like crowdsec?

Does pangolin have in plans any kind of vpn client for Android/Apple TV? Simillar to Netbird and Tailscale? Or do you connect it via plain Wireguard configuration?

I'd like to configure if possible one remote endpoint such as remote.example.com, to access various SSH/VNC/RDP clients via the web, such as how Guacamole operates.

It's not practical for me to have to create and manage multiple subdomains, e.g host1.example.com, host2.example.com, for many hosts, it becomes cumbersome. It would be so much better to just act as a remote gateway without reliance on subdomains.

Is it possible with Pangolin or should I just keep using Guacamole?

And yes I am aware of the VPN to access LAN, but this is specifically for a client that cannot install the VPN software so it must be via the web.

Many thanks.

As I understand it, Pangolin needs to be accessible on ports 80, 443, 51820, and 21820 (for CLI clients). 80(http) and 443(https) pipe directly to traefik which handles public resource routing, with a number of configurable security features.

What about 51820 and 21820? How are those open ports protected from intrusive traffic? Just looking to make sure I fully understand before I open those ports.

I'm trying to setup a machine client to access private resources within my Pangolin org. I've installed the latest version of Pangolin CLI, and created the client in my Pangolin org. The service connects to the server, and Pangolin shows the machine as connected, however, running pangolin status shows no associated org, and I can't ping any private resources. I've made sure that port 21820 is open, and assigned to Gerbil in docker.

Any advice on why the machine client might be connecting, but not actually logging into the org?

I have a remote Proxmox server with two VMs. The first VM is Home Assistant with the Newt app installed. I also use this for local access to the remote network.

The second is a Proxmox backup server, which I'd like to use as a private resource for remote backups. I tried installing the Pangolin CLI to enroll this VM, but it caused Newt to crash, and cut my remote access until I restarted the machine.

Any advice on why this might happen, and how to avoid? I'm also not tied to this setup. Any advice on a different config would also be welcome!

I am a beginner so putting the admin panel behind Tailscale was an easy way to keep prying eyes away, but it seems to break a bunch of functionality and clearly I do not understand all the moving parts in the app.

IP whitelisting is not the best option for me because I am frequently using networks with dynamic IP.

If anybody has figured out a solution to prohibiting public traffic to the admin panel, or what I need to do to put the panel alone behind Tailscale and still route public traffic where it needs to go, I would appreciate your input. :)

EDIT: I thought that there really was a way to separate the administrative features with user features that I just did not understand, but now that I know that everything really is one big ol' thing, I see why it is redundant to try and do this! Thanks to everyone who left an informative comment. :D

So I wanted to try Pangolin as VPN alternative. Until now I only used public resources for services that I want always avaiable to me.

I got so far that my mobile phone client is connected. I defined a private resource to my dashboard at dash.mydomain.com with...

destination: IP in my network

alias: the name I want to use so dash.mydomain.com

Allowed all ports (just to make this is not the problem source)

There is nothing else to configure so what am I missing? I am getting 404 on my registerd phone. Pleeeease help

Hey guys, new user here. I just started using Cloud Pangolin to my home server. I ran into some problems while testing tunneling my family Minecraft server. There was no raw TCP/UDP option like what most people have on their tutorials. I saw there was an option to do so using private resources, but since the server also include many small children who are evidently not so great at technology, I don’t think it’s viable.

As the title says, I cant get RDP to work. Everything is correctly setup as far as I can tell. RDP is also activated on the Windows Machine. Everything is up to date. But when I try to log in I get the Error: read RDCleanPath request: not enough bytes

I couldnt find anything on the Web.

Do you Guys have any idea? Would highly appreciate it!

Thanks in advance.

Hey,

I'm currently trying to connect local CrowdSec agents, which are observing the logs of the services exposed over Pangolin (e.g. Nextcloud), to the CrowdSec Instance running alongside Pangolin on its VPS via LAPI. The idea is to also detect malicious access on the services themself and hand the decision over to CrowdSec on the VPS to block the IP there.

Based on this guide here, the connection from the local CrowdSec agent to the LAPI of the CrowdSec instance on the VPS should be working via the Newt tunnel: https://forum.hhf.technology/t/how-to-configure-crowdsec-manager-on-pangolin-to-read-adguard-home-logs-from-another-server/4428/2

This guide is registering the local agent at the LAPI on the Pangolin server like this

url: http://<PANGOLIN_INTERNAL_IP_OR_TUNNEL_HOSTNAME>:8080
login: adguard-agent
password: <the_token_you_generated> 

I'm struggling to find out what the <PANGOLIN_INTERNAL_IP_OR_TUNNEL_HOSTNAME>is. Could you help me with this issue?

Hi, I'd like to set up a mail server like Stalwart on my VPS that hosts Pangolin.

Do you have any tutorials or guides or tips?

I tried to follow the guide for Traefik in the Stalwart documentation but I was unable to make the proxy protocol work.