8000 Unable to connect private resource using alias via Pangolin Client · Issue #50 · fosrl/cli · GitHub
[go: up one dir, main page]

Skip to content

Unable to connect private resource using alias via Pangolin Client #50

Open

Description

@3gmgithub

Describe the Bug

When using DNS alias I cannot connect/ping remote resource.
When I use the remote IP it works just fine.
Is there something that can be done to fix the remote alias?

Environment

  • OS Type & Version: Linux Mint 22.3
  • Pangolin Version: 1.15.4
  • Gerbil Version: 1.30
  • Traefik Version: 3.6
  • Newt Version: 1.9.1
  • Olm Version: (if applicable) Pangolin client 0.3.3

To Reproduce

ping REMOTERESOURCE.lan

-Nothing happens and eventually fails

Expected Behavior

ping works...

Activity

  1. Tanki90 commented on Feb 25, 2026

    @Tanki90

    same problem :-(

  2. kreativekrise commented on Feb 25, 2026

    @kreativekrise

    The documentation says:

    Aliases do not currently support ICMP ping requests. If you attempt to ping an alias, it will not respond, even if the underlying Resource is reachable. This is because the Pangolin client does not intercept ICMP packets for alias resolution.

    Source: https://docs.pangolin.net/manage/resources/private/alias#icmp-ping

  3. miloschwartz commented on Feb 25, 2026

    @miloschwartz
    Member

    @kreativekrise is correct and aliases not supporting icmp ping is currently a small quirk.

    More importantly, are you able to access the resource with the alias regardless of the ping status?

  4. 3gmgithub commented on Feb 25, 2026

    @3gmgithub
    Author
    Image

    When using the local IP of the remote device I can connect no problem.

  5. Tanki90 commented on Feb 25, 2026

    @Tanki90

    it works. i'm am idiot... need to add the port after the alias.
    is there a way in private resources to select the port in the destination like in open resources?
    192.168.x.x:port was not acceepted.

  6. 3gmgithub commented on Feb 26, 2026

    @3gmgithub
    Author

    I ran ssh root@alias -p 22 and it does not work.

  7. LaurenceJJones commented on Feb 27, 2026

    @LaurenceJJones
    Contributor

    it works. i'm am idiot... need to add the port after the alias. is there a way in private resources to select the port in the destination like in open resources? 192.168.x.x:port was not acceepted.

    No, as the private resources are just an alias DNS lookup for convenience it doesnt act as a proxy to know if you go to "host.internal" you want to speak to a specific port.

  8. LaurenceJJones commented on Feb 27, 2026

    @LaurenceJJones
    Contributor

    I ran ssh root@alias -p 22 and it does not work.

    Okay, can you provide these details:

    • You are connected to sites via pangolin status (you should see your sites and relay information)
    • Check your resolver is set to olm itself cat /etc/resolv.conf (should be nameserver 100.X)
  9. 3gmgithub commented on Mar 2, 2026

    @3gmgithub
    Author

    I am using Linux mint, and that uses systemd-resolved...
    So I added a file like this:

    /etc/systemd/resolved.conf.d/my-dns.conf
    
    [Resolve]
    DNS=100.96.128.1
    Domains=~myalias
    
    

    This seems to at least help, but does not solve the problem.
    I will try adding directly to /etc/resolv.conf to see if this helps.

  10. 3gmgithub commented on Mar 2, 2026

    @3gmgithub
    Author

    No luck still having issues... Any suggestions?

  11. 3gmgithub commented on Mar 3, 2026

    @3gmgithub
    Author

    Here are some photos of the problem...

    Image Image
  12. LaurenceJJones commented on Mar 4, 2026

    @LaurenceJJones
    Contributor

    So from the images, it seems the background process that handles DNS requests is being rejected. Do you have any filtering or firewall rules that could block requests to port 53 if its not localhost?

  13. 3gmgithub commented on Mar 4, 2026

    @3gmgithub
    Author

    No I did not setup anything like that. This would have to be default for Linux Mint 22.3

    Are there any ideas on what to check on the backend? I will test on Windows to see if I have the same problems.

  14. github-actions commented on Mar 19, 2026

    @github-actions

    This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

  15. 3gmgithub commented on Mar 19, 2026

    @3gmgithub
    Author

    After further testing it does work with Windows, so something on the default install with Linux Mint 22.3 causes DNS issues.

  16. 3gmgithub commented on Mar 19, 2026

    @3gmgithub
    Author

    Looks like a compatibility issue with systemd-resolved and Pangolin as I am just using a default setup.
    If there is any guidance someone can provide that would be fantastic.

  17. LaurenceJJones commented on Mar 20, 2026

    @LaurenceJJones
    Contributor

    Transfered to cli repo so we can continue in the right repo.

    Can you please test out version 0.5.3 of the cli and see if its still an issue we done some work on olm the underlying sdk.

    also if you run with --attach and --log-level debug so we can see what is happening inside olm, could help us further debug.

    I have spin up a test mint box, and everything is working as expected.

  18. 3gmgithub commented on Mar 20, 2026

    @3gmgithub
    Author

    Thank you so much! Running the test now with the options you suggested.
    Here is a log for your review:

    DEBUG: 2026/03/20 09:39:40 Checking permissions for native interface
    DEBUG: 2026/03/20 09:39:40 Checking native interface permissions on Linux
    DEBUG: 2026/03/20 09:39:40 Running as root, sufficient permissions for native TUN interface
    DEBUG: 2026/03/20 09:39:40 Created Unix socket at /var/run/olm.sock
    INFO: 2026/03/20 09:39:40 Starting HTTP server on socket /var/run/olm.sock
    DEBUG: 2026/03/20 09:39:40 Starting tunnel with config: REMOVED
    INFO: 2026/03/20 09:39:40 Created shared UDP socket on port 64597 (refcount: 2)
    DEBUG: 2026/03/20 09:39:40 websocket: Requesting token from REMOVED
    DEBUG: 2026/03/20 09:39:40 websocket: Received token: REMOVED
    DEBUG: 2026/03/20 09:39:40 Got exit nodes for hole punching: REMOVED
    DEBUG: 2026/03/20 09:39:40 Updated hole punch exit nodes: REMOVED
    INFO: 2026/03/20 09:39:40 Starting hole punch for 1 exit nodes
    DEBUG: 2026/03/20 09:39:40 Starting UDP hole punch to 1 exit nodes with shared bind
    DEBUG: 2026/03/20 09:39:41 Resolved exit node: REMOVED
    DEBUG: 2026/03/20 09:39:41 Sent UDP hole punch to REMOVED
    INFO: 2026/03/20 09:39:41 Websocket Connected
    DEBUG: 2026/03/20 09:39:41 Sending registration message to server with public key: REMOVED
    DEBUG: 2026/03/20 09:39:41 websocket: Sending message: olm/wg/register, data: map[fingerprint:map[arch:x86_64 deviceModel:REMOVED hostname:REMOVED kernelVersion:6.17.0-19-generic osVersion:Linux Mint 22.3 platform:linux platformFingerprint:REMOVED serialNumber:REMOVED username:REMOVED] olmAgent:Pangolin CLI olmVersion:0.5.3 orgId:REMOVED postures:map[autoUpdatesEnabled:false biometricsEnabled:false diskEncrypted:true firewallEnabled:true linuxAppArmorEnabled:true linuxSELinuxEnabled:false macosFirewallStealthMode:false macosGatekeeperEnabled:false macosSipEnabled:false tpmAvailable:false windowsDefenderEnabled:false] publicKey:REMOVED relay:false userToken:REMOVED]
    DEBUG: 2026/03/20 09:39:42 Sent UDP hole punch to REMOVED
    DEBUG: 2026/03/20 09:39:42 Increased hole punch interval to 2s
    DEBUG: 2026/03/20 09:39:42 websocket: setting config version to 24
    DEBUG: 2026/03/20 09:39:42 Received message: map[sites:[map[aliases:[map[alias:REMOVED aliasAddress:100.96.128.8]] endpoint:REMOVED name:REMOVED publicKey:REMOVED remoteSubnets:[] serverIP:100.90.128.2/24 serverPort:54279 siteId:2]] tunnelIP:100.90.128.1/24 utilitySubnet:100.96.128.0/24]
    DEBUG: 2026/03/20 09:39:42 MiddleDevice: pump started for device
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 5 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 1 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: UDP bind has been updated
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 1 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: receive incoming makeReceiveNetstack - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 2 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 14 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Interface state was Down, requested Up, now Up
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 9 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 1 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 14 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 15 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 6 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 14 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 6 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 6 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 7 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 7 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 2 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 7 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 8 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 20 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 9 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 20 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 8 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 13 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 15 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 2 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 8 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 18 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 13 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 3 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 10 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 10 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 3 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 19 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 10 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 20 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 11 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 16 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 17 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 12 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 9 - started
    INFO: 2026/03/20 09:39:42 The tunnel IP is: 100.90.128.1/24
    DEBUG: 2026/03/20 09:39:42 The destination address is: 100.90.128.1
    INFO: 2026/03/20 09:39:42 Set IPv4 addresses: [100.90.128.1], subnet masks: [255.255.255.0]
    INFO: 2026/03/20 09:39:42 Set MTU: 1280
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 18 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 17 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 4 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 4 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 5 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 15 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 4 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 19 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 19 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 5 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 11 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 18 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 16 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 13 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 17 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 12 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 16 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: decryption worker 11 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: encryption worker 12 - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: receive incoming makeReceiveSocket - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: TUN reader - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: event worker - started
    DEBUG: 2026/03/20 09:39:42 wireguard: Interface up requested
    DEBUG: 2026/03/20 09:39:42 wireguard: Routine: handshake worker 3 - started
    INFO: 2026/03/20 09:39:42 Added IPv4 included route: {DestinationAddress:100.96.128.0 SubnetMask:255.255.255.0 GatewayAddress: IsDefault:false}
    DEBUG: 2026/03/20 09:39:42 wireguard: Interface up requested
    INFO: 2026/03/20 09:39:42 Adding route to 100.96.128.0/24 via interface pangolin
    INFO: 2026/03/20 09:39:42 Added route for remote subnet: 100.96.128.0/24
    DEBUG: 2026/03/20 09:39:42 Adding dns record for domain REMOVED with IP 100.96.128.8 (siteId=2)
    DEBUG: 2026/03/20 09:39:42 Configuring peer with config: private_key=REMOVED
    public_key=REMOVED
    allowed_ip=100.90.128.2/32
    allowed_ip=100.96.128.8/32
    endpoint=REMOVED:45013
    persistent_keepalive_interval=0
    
    DEBUG: 2026/03/20 09:39:42 wireguard: UAPI: Updating private key
    DEBUG: 2026/03/20 09:39:42 PeerMonitor: Packet sender goroutine started
    DEBUG: 2026/03/20 09:39:42 wireguard: REMOVED - UAPI: Created
    DEBUG: 2026/03/20 09:39:42 wireguard: REMOVED - UAPI: Adding allowedip
    DEBUG: 2026/03/20 09:39:42 wireguard: REMOVED - UAPI: Adding allowedip
    DEBUG: 2026/03/20 09:39:42 wireguard: REMOVED - UAPI: Updating endpoint
    DEBUG: 2026/03/20 09:39:42 wireguard: REMOVED - UAPI: Updating persistent keepalive interval
    DEBUG: 2026/03/20 09:39:42 wireguard: REMOVED - Starting
    INFO: 2026/03/20 09:39:42 Started monitoring for site 2 at 100.90.128.2:54280
    INFO: 2026/03/20 09:39:42 Configured peer REMOVED
    DEBUG: 2026/03/20 09:39:42 wireguard: REMOVED - Routine: sequential sender - started
    DEBUG: 2026/03/20 09:39:42 wireguard: REMOVED - Routine: sequential receiver - started
    INFO: 2026/03/20 09:39:42 Started monitoring peer 2
    
    DEBUG: 2026/03/20 09:39:42 HolepunchTester started
    INFO: 2026/03/20 09:39:42 Started holepunch connection monitor
    INFO: 2026/03/20 09:39:42 DNS proxy started on 100.96.128.1:53 (tunnelDNS=false)
    INFO: 2026/03/20 09:39:42 Starting rapid holepunch test for site 2 at REMOVED (max 5 attempts, 400ms timeout each)
    DEBUG: 2026/03/20 09:39:42 DNS proxy listening on netstack
    INFO: 2026/03/20 09:39:42 Detected DNS manager: systemd-resolved
    INFO: 2026/03/20 09:39:42 Using systemd-resolved DNS configurator
    INFO: 2026/03/20 09:39:42 Current DNS servers: []
    INFO: 2026/03/20 09:39:42 Setting DNS servers to: [100.96.128.1]
    INFO: 2026/03/20 09:39:42 Original DNS servers backed up: []
    INFO: 2026/03/20 09:39:42 Set DNS servers: [100.96.128.1]
    INFO: 2026/03/20 09:39:42 WireGuard device created.
    DEBUG: 2026/03/20 09:39:42 websocket: Sending ping: {Type:olm/ping Data:map[fingerprint:map[arch:x86_64 deviceModel:REMOVED hostname:REMOVED kernelVersion:6.17.0-19-generic osVersion:Linux Mint 22.3 platform:linux platformFingerprint:REMOVED serialNumber:REMOVED username:REMOVED] postures:map[autoUpdatesEnabled:false biometricsEnabled:false diskEncrypted:true firewallEnabled:true linuxAppArmorEnabled:true linuxSELinuxEnabled:false macosFirewallStealthMode:false macosGatekeeperEnabled:false macosSipEnabled:false tpmAvailable:false windowsDefenderEnabled:false] timestamp:1774017582 userToken:REMOVED] ConfigVersion:24}
    DEBUG: 2026/03/20 09:39:42 DNS query for connectivity-check.ubuntu.com. (type A)
    DEBUG: 2026/03/20 09:39:42 No local record for connectivity-check.ubuntu.com., forwarding upstream to [1.1.1.1:53]
    DEBUG: 2026/03/20 09:39:42 websocket: setting config version to 24
    DEBUG: 2026/03/20 09:39:44 Sent UDP hole punch to REMOVED:21820: {"ephemeralPublicKey":"REMOVED","nonce":"REMOVED","ciphertext":"REMOVED"}
    DEBUG: 2026/03/20 09:39:44 Increased hole punch interval to 4s
    DEBUG: 2026/03/20 09:39:44 wireguard: REMOVED - Sending handshake initiation
    WARN: 2026/03/20 09:39:44 WireGuard connection to site 2 is DISCONNECTED
    WARN: 2026/03/20 09:39:44 Rapid test: site 2 holepunch FAILED after 5 attempts, will relay
    INFO: 2026/03/20 09:39:44 Rapid test failed for site 2, requesting relay
    INFO: 2026/03/20 
    AFC8
    09:39:44 Sent relay message for site 2 (chain REMOVED)
    DEBUG: 2026/03/20 09:39:44 websocket: Sending message: olm/wg/relay, data: map[chainId:REMOVED siteId:2]
    DEBUG: 2026/03/20 09:39:45 websocket: setting config version to 24
    DEBUG: 2026/03/20 09:39:45 Received relay-peer message: map[relayEndpoint:REMOVED relayPort:21820 siteId:2]
    INFO: 2026/03/20 09:39:45 Cancelled all relay senders
    DEBUG: 2026/03/20 09:39:45 wireguard: REMOVED - UAPI: Updating endpoint
    INFO: 2026/03/20 09:39:45 Adjusted peer 2 to point to relay!
    
    DEBUG: 2026/03/20 09:39:48 Sent UDP hole punch to REMOVED:21820: {"ephemeralPublicKey":"REMOVED","nonce":"REMOVED","ciphertext":"REMOVED"}
    DEBUG: 2026/03/20 09:39:48 Increased hole punch interval to 8s
    DEBUG: 2026/03/20 09:39:49 wireguard: REMOVED - Sending handshake initiation
    DEBUG: 2026/03/20 09:39:49 wireguard: REMOVED - Received handshake response
    DEBUG: 2026/03/20 09:39:49 wireguard: REMOVED - Receiving keepalive packet
    INFO: 2026/03/20 09:39:51 WireGuard connection to site 2 is CONNECTED (RTT: 5.202921786s)
    DEBUG: 2026/03/20 09:39:56 Sent UDP hole punch to REMOVED:21820: {"ephemeralPublicKey":"REMOVED","nonce":"REMOVED","ciphertext":"REMOVED"}
    DEBUG: 2026/03/20 09:39:56 Increased hole punch interval to 16s
    DEBUG: 2026/03/20 09:40:12 Sent UDP hole punch to REMOVED:21820: {"ephemeralPublicKey":"REMOVED","nonce":"REMOVED","ciphertext":"REMOVED"}
    DEBUG: 2026/03/20 09:40:12 Increased hole punch interval to 32s
    DEBUG: 2026/03/20 09:40:12 websocket: Sending ping: {Type:olm/ping Data:map[fingerprint:map[arch:x86_64 deviceModel:REMOVED hostname:REMOVED kernelVersion:6.17.0-19-generic osVersion:Linux Mint 22.3 platform:linux platformFingerprint:REMOVED serialNumber:REMOVED username:REMOVED] postures:map[autoUpdatesEnabled:false biometricsEnabled:false diskEncrypted:true firewallEnabled:true linuxAppArmorEnabled:true linuxSELinuxEnabled:false macosFirewallStealthMode:false macosGatekeeperEnabled:false macosSipEnabled:false tpmAvailable:false windowsDefenderEnabled:false] timestamp:1774017612 userToken:REMOVED] ConfigVersion:24}
    DEBUG: 2026/03/20 09:40:12 websocket: setting config version to 24
    DEBUG: 2026/03/20 09:40:42 websocket: Sending ping: {Type:olm/ping Data:map[fingerprint:map[arch:x86_64 deviceModel:REMOVED hostname:REMOVED kernelVersion:6.17.0-19-generic osVersion:Linux Mint 22.3 platform:linux platformFingerprint:REMOVED serialNumber:REMOVED username:REMOVED] postures:map[autoUpdatesEnabled:false biometricsEnabled:false diskEncrypted:true firewallEnabled:true linuxAppArmorEnabled:true linuxSELinuxEnabled:false macosFirewallStealthMode:false macosGatekeeperEnabled:false macosSipEnabled:false tpmAvailable:false windowsDefenderEnabled:false] timestamp:1774017642 userToken:REMOVED] ConfigVersion:24}
    DEBUG: 2026/03/20 09:40:42 websocket: setting config version to 24
    DEBUG: 2026/03/20 09:40:44 Sent UDP hole punch to REMOVED:21820: {"ephemeralPublicKey":"REMOVED","nonce":"REMOVED","ciphertext":"REMOVED"}
    DEBUG: 2026/03/20 09:40:44 Increased hole punch interval to 1m0s
    INFO: 2026/03/20 09:40:58 Tunnel process context cancelled, cleaning up
    Received shutdown signal, stopping tunnel
    DEBUG: 2026/03/20 09:40:58 websocket: Sending message: olm/disconnecting, data: map[]
    INFO: 2026/03/20 09:40:58 Restoring original DNS configuration
    DEBUG: 2026/03/20 09:40:58 websocket: connection closed during shutdown
    ERROR: 2026/03/20 09:40:58 Failed to restore DNS: failed to restore DNS: revert DNS settings: Link pangolin is managed.
    INFO: 2026/03/20 09:40:58 Hole punch manager stopped
    DEBUG: 2026/03/20 09:40:58 HolepunchTester stopped
    INFO: 2026/03/20 09:40:58 Stopped holepunch connection monitor
    DEBUG: 2026/03/20 09:40:58 PeerMonitor: Starting cleanup
    DEBUG: 2026/03/20 09:40:58 PeerMonitor: Stopping client for site 2
    DEBUG: 2026/03/20 09:40:58 PeerMonitor: Cancelling netstack context
    DEBUG: 2026/03/20 09:40:58 PeerMonitor: Closing endpoint
    DEBUG: 2026/03/20 09:40:58 PeerMonitor: Waiting for goroutines to finish
    DEBUG: 2026/03/20 09:40:58 PeerMonitor: Packet sender context cancelled, draining packets
    DEBUG: 2026/03/20 09:40:58 PeerMonitor: Packet sender goroutine exiting
    DEBUG: 2026/03/20 09:40:58 PeerMonitor: Goroutines finished cleanly
    DEBUG: 2026/03/20 09:40:58 PeerMonitor: Destroying stack
    DEBUG: 2026/03/20 09:40:58 Hole punch stopped by signal
    DEBUG: 2026/03/20 09:40:58 PeerMonitor: Cleanup complete
    INFO: 2026/03/20 09:40:58 UDP hole punch goroutine ended for all exit nodes
    DEBUG: 2026/03/20 09:40:58 Stopping DNS proxy
    INFO: 2026/03/20 09:40:59 DNS proxy stopped
    DEBUG: 2026/03/20 09:40:59 Closing MiddleDevice
    DEBUG: 2026/03/20 09:40:59 MiddleDevice: Closing 1 devices
    DEBUG: 2026/03/20 09:40:59 Closing WireGuard device
    DEBUG: 2026/03/20 09:40:59 wireguard: Device closing
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: event worker - stopped
    DEBUG: 2026/03/20 09:40:59 MiddleDevice: pump exiting, device closed during read
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: receive incoming makeReceiveSocket - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: receive incoming makeReceiveNetstack - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: REMOVED - Stopping
    DEBUG: 2026/03/20 09:40:59 wireguard: REMOVED - Routine: sequential sender - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: TUN reader - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: REMOVED - Routine: sequential receiver - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Device closed
    DEBUG: 2026/03/20 09:40:59 Releasing shared bind (refcount before release: 0)
    INFO: 2026/03/20 09:40:59 Released shared UDP bind
    INFO: 2026/03/20 09:40:59 Olm service stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: handshake worker 1 - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: handshake worker 17 - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: decryption worker 3 - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: handshake worker 18 - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: handshake worker 10 - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: handshake worker 5 - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: handshake worker 19 - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: handshake worker 4 - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: handshake worker 12 - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: handshake worker 6 - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: handshake worker 20 - stopped
    DEBUG: 2026/03/20 09:40:59 wireguard: Routine: handshake worker 7 - stopped
    
    
  19. gcebollero commented on Apr 16, 2026

    @gcebollero

    @3gmgithub
    In my case, /etc/resolv.conf was being managed by dhcpd, and pangolin changes made by systemd-resolv did not work.
    Linking systemd-resolv generated config to /etc/resolv.conf solved the issue.

    Run as root

    ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
    
  20. iWangJiaxiang commented on Apr 22, 2026

    @iWangJiaxiang

    I run into same issue and I have a fix.

    In my case, I used machine id to connect to pangolin and can not connect to any private resource.

    pangolin up --id xxxxx
    

    What I did is using user login to pangolin. Everything works!

    pangolin login
    pangolin select
    pangolin up
    
  21. psrb commented on May 19, 2026

    @psrb

    I ran into the same issue and have observed, that while connectivity works when using the destination IP addresses directly, connectivity did not work through the IPs returned by Olm/pangolin-cli DNS.

    My Setup

    • Running Olm/pangolin-cli on a Debian 13 (trixie) VPS in a Docker container (with network_mode: host)
    • Pangolin instance has been running since Pangolin version 1.9.4 and has been upgrade (release by release) to 1.18.3
    • Started to use private resources with Pangolin version 1.14.1 and with Olm 1.3.0 as a machine client
    • Now switched to pangolin-cli (0.8.2) instead of Olm (1.5.0), but problem occured with both

    I have two private resources configured:

    • foo.test (10.0.0.21)
      • Port restriction
        • TCP: 443
      • Access control
        • Machine Client: My Olm/pangolin-cli client
    • bar.test (10.0.0.42)
      • Port restriction
        • TCP: 443
      • Access control
        • Machine Client: My Olm/pangolin-cli client

    Debugging steps

    Olm/pangolin-cli has properly configured the network routes:

    $ ip route
    ...
    10.0.0.21 dev pangolin
    10.0.0.42 dev pangolin
    100.90.128.0/24 dev pangolin proto kernel scope link src 100.90.128.2
    100.96.128.0/24 dev pangolin
    ...
    

    DNS resolution is working as well:

    $ dig @100.96.128.1 foo.test
    100.96.128.8
    $ dig @100.96.128.1 bar.test
    100.96.128.9
    

    However, when testing connectivity with telnet it was not possible to establish a connection through the IP returned by the Olm/pangolin-cli:

    $ telnet 100.96.128.8 443
    Trying 100.96.128.8...
    telnet: Unable to connect to remote host: Connection timed out
    
    $ telnet 100.96.128.9 443
    Trying 100.96.128.9...
    telnet: Unable to connect to remote host: Connection timed out
    

    But it was possible to establish a connection through the destination IP addresses configured for the private resources:

    $ telnet 10.0.0.21 443
    Trying 10.0.0.21...
    Connected to 10.0.0.21.
    
    $ telnet 10.0.0.42 443
    Trying 10.0.0.42...
    Connected to 10.0.0.42.
    

    The Workaround

    I was able to restore connectivity by removing the machine client from the private resources access control and re-adding it. Maybe it was a display bug in Pangolin where the machine client was listed as having access, but this was not propagated to Olm/pangolin-cli? Maybe due to the incremental upgrades of the Pangolin instance?

    Interestingly, I only manually updated one of the two private resources (intending to keep the second one available for debugging). However, after a few days the connectivity for the second private resource has also been restored without my intervention.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      0