Repository navigation
Site connector (CLI/Newt 1.26) fails registration with “Site last hole punch is too old” while older Newt works on same network #178
Description
Describe the Bug
I am migrating from the Newt site connector to the now recommended Pangolin CLI site connector. The old Newt site works reliably. A newly created site using the current CLI binary on a Proxmox LXC container consistently fails to register.
Environment
- OS Type & Version: Ubuntu 26.04 LTS (Pangolin server VPS) Debian 13 (Pangolin CLI LXC)
- Pangolin Version: 1.26.0
- Gerbil Version: 1.8.0
- Traefik Version: 3.7.17
- Newt Version: 1.20.0
- Client Version: 0.21.0
To Reproduce
Creating a new CLI binary install on a Proxmox LXC container and attempting to connect to my self-hosted Pangolin server fails. Proxmox is on the latest 9.2 version, with tun access given to the LXC.
Inspecting server-side logs, I see:
Site last hole punch is too old; skipping this register.
The site is failing to hole punch and identify its network address with the server.
Can the site reach the server on its Relay UDP port?
From the client side, I see the following logs:
Websocket connected
Connecting to endpoint: pangolin.labnest.net
SendMessageInterval timed out after 16 attempts for message type: newt/wg/get-config
Initial reliable ping failed... failed to read ICMP packet: i/o timeout
(repeated ping timeouts)
UDP packets from the LXC reach my VPS on both ports 51820 and 21820 (confirmed with tcpdump and nc -u). I verified no firewall is blocking the ports.
When started with -native flag, the site does create a WireGuard interface and receives a tunnel IP, but never completes registration and never receives a working peer config.
I have tried fully deleting and recreating the site and get the same error. Setting a static port also doesn't help.
I compared ip addr and wg show between the working Newt and failing CLI sites. Both create an interface and get a tunnel IP.
AI Disclosure
Utilized Grok to troubleshoot error logs and attempt to get the connection working. Also used it to help me write this issue.
Expected Behavior
The CLI site should complete hole-punch (or fall back to relay) and receive a WireGuard configuration.
Activity
AstralDestiny commentedon Nov 9, 2026
The instance doesn't have any existing newt running alongside right? does it work on any other host?
ThiccChimichanga commentedon Nov 9, 2026
The Newt site is running in a separate LXC from the testing I'm doing on the Pangolin CLI site.
I just tried running on a separate host (CachyOS desktop) and getting the same error.
AstralDestiny commentedon Nov 9, 2026
Mmm mind bugging me and throwing me a machine client on pangolin slack or discord? can find either on the pangolin.net docs.