r/PangolinReverseProxy

First off, Pangolin is a great way to both secure and make local resources available. Many thanks to the team. My family just connects their devices and boom, and everything works.

I have a decent sized home lab with Pangolin running on an OVH VPS, using a dedicated domain. When connected via the Linux client CLI, I am able to access local machines on my home network just fine. However, no external web addresses will resolve at all. No error, but the browser just spins. When I disconnect no local resources are available (obviously) and Internet returns. Every other client, (iOS, Android, Windows) behaves properly so I realize there's an issue with my Pop OS machine only. I didn't find anything relating to this on GitHub issues so I thought I'd try here.

I'm trying Pangolin for the first time. I have a homelab which consists of a mini PC with debian running multiple docker stacks. I got a Hetzner VPS with debian, pointed my domain to its IP and deployed Pangolin.

Everything seemed to be working fine, I installed a docker site on my homelab with newt (only Wireguard port is open on it since I also use wg-easy) and started adding some public resources to point to my internal server IP.

Some resources work fine like Immich, but other like Navidrome server and AudioBookShelf just won't work, I tried everything (limited to my knowledge) and can't get it to work. I keep getting a blank page with no available server for them. I have no geoblocking, I have crowdsec setup and I tried two things: pointing the resource target to IP:PORT of the service (HTTP) and pointing it to IP:443 with HTTPS, since my server also have a NginxProxyManager running doing the reverse proxy for internal services. No success.

Would someone have any idea how I could at least better debug to try and find the problem?

Tks

I have a static IP and only expose the Wireguard port to connect to my Homelab. Every service has HTTPs since I use Nginx Proxy Manager with a domain pointing to the LAN IP of my server and certificates are resolved using my domain provider's API.

I wanted to expose some services like Navidrome, Immich for quick link sharing and ntfy for UnifiedPush, but I didn't want to add the cost of a VPS at the end of the month.

Is it really a bad idea to port forward ports 80 and 443 and handle everything at home with precautions like crowdsec?

Hey all,

I'm trying to setup ssh over pangolin.

currently pangolin is installed on my vps and I want to ssh to my homelab from my laptop.

I installed newt on my homelab and connected it as a new site in pangolin.

Also I installed the client on my laptop and logged in.

now when I try to connect using 'pangolin up' I get an error about making sure port 21820 is open and stuff like that.

I opened 21820 in ufw in my laptop, VPS, and server. Also the firewall on the VPS accepts all ports.

I consulted with an LLM and it wrote something about being behined a cgnat (and I am behined one) but I still don't understand why that stops me from making a p2p connection?

can anyone enlighten me maybe I'm missing something?

thanks

Does pangolin have in plans any kind of vpn client for Android/Apple TV? Simillar to Netbird and Tailscale? Or do you connect it via plain Wireguard configuration?

I'd like to configure if possible one remote endpoint such as remote.example.com, to access various SSH/VNC/RDP clients via the web, such as how Guacamole operates.

It's not practical for me to have to create and manage multiple subdomains, e.g host1.example.com, host2.example.com, for many hosts, it becomes cumbersome. It would be so much better to just act as a remote gateway without reliance on subdomains.

Is it possible with Pangolin or should I just keep using Guacamole?

And yes I am aware of the VPN to access LAN, but this is specifically for a client that cannot install the VPN software so it must be via the web.

Many thanks.

As I understand it, Pangolin needs to be accessible on ports 80, 443, 51820, and 21820 (for CLI clients). 80(http) and 443(https) pipe directly to traefik which handles public resource routing, with a number of configurable security features.

What about 51820 and 21820? How are those open ports protected from intrusive traffic? Just looking to make sure I fully understand before I open those ports.

I am a beginner so putting the admin panel behind Tailscale was an easy way to keep prying eyes away, but it seems to break a bunch of functionality and clearly I do not understand all the moving parts in the app.

IP whitelisting is not the best option for me because I am frequently using networks with dynamic IP.

If anybody has figured out a solution to prohibiting public traffic to the admin panel, or what I need to do to put the panel alone behind Tailscale and still route public traffic where it needs to go, I would appreciate your input. :)

EDIT: I thought that there really was a way to separate the administrative features with user features that I just did not understand, but now that I know that everything really is one big ol' thing, I see why it is redundant to try and do this! Thanks to everyone who left an informative comment. :D