Clients Error #1133

New Issue

MrUnknownDE · 2026-04-05T18:19:32+02:00

MrUnknownDE commented

2026-04-05 18:19:32 +02:00

Originally created by @Lokowitz on 8/1/2025

I am not able to ping the network through olm.

I am running olm in a LXC on my Proxmox server.
/dev/net/tun is added as device.

olm log

It is different from the logs in your demo video:

INFO: 2025/08/01 08:40:50 Websocket Connected
INFO: 2025/08/01 08:40:50 Sent registration message
INFO: 2025/08/01 08:40:50 Sent initial ping message
INFO: 2025/08/01 08:40:51 Stopping UDP holepunch
INFO: 2025/08/01 08:40:51 UDP hole punch goroutine ended
INFO: 2025/08/01 08:40:51 UAPI listener started
INFO: 2025/08/01 08:40:51 WireGuard device created.

In Pangolin UI the client is shown as connected/online. But after the connection of the client i am getting an error by pressing the save settings button in edit client. "Faild to update client. An error occurred."

gerbil logs

ERROR: 2025/08/01 10:34:11 Destination port must be a positive integer for destination 0
ERROR: 2025/08/01 10:34:21 Destination port must be a positive integer for destination 0
ERROR: 2025/08/01 10:35:44 Destination port must be a positive integer for destination 0
ERROR: 2025/08/01 10:42:48 Destination port must be a positive integer for destination 0

pangolin log

2025-08-01T08:22:38.570Z [info]: Client added to tracking - OLM ID: 6ykr######fvtw, Connection ID: 61#######da, Total connections: 1
2025-08-01T08:22:38.570Z [info]: WebSocket connection established - OLM ID: 6y######tw
2025-08-01T08:22:38.602Z [info]: Handling register olm message!
2025-08-01T08:22:38.603Z [warn]: Client last hole punch is too old, skipping all sites
2025-08-01T08:22:39.598Z [info]: Handling register olm message!
2025-08-01T08:22:39.600Z [info]: Public key mismatch. Updating public key and clearing session info...
2025-08-01T08:22:39.607Z [warn]: Site 5 has no endpoint, skipping
2025-08-01T08:24:12.835Z [info]: Adding 0 new sites to client 3
2025-08-01T08:24:12.836Z [info]: Removing 0 sites from client 3
2025-08-01T08:24:12.840Z [info]: Updating destinations for exit node at http://gerbil:3003
2025-08-01T08:24:12.840Z [info]: Payload for update-destinations: {
  "sourceIp": "9#######1",
  "sourcePort": 43995,
  "destinations": [
    {
      "destinationIP": "100.89.128.8",
      "destinationPort": 0
    }
  ]
}
2025-08-01T08:24:12.848Z [error]: Error communicating with Gerbil. Make sure Pangolin can reach the Gerbil HTTP API: 400
Stack: Error: Error communicating with Gerbil. Make sure Pangolin can reach the Gerbil HTTP API: 400
    at Function.<anonymous> (file:///app/dist/server.mjs:32:38339)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Ny (file:///app/dist/server.mjs:32:37013)

docker-compose.yml

services:
  crowdsec:
    container_name: crowdsec
    image: crowdsecurity/crowdsec:v1.6.11-debian
    restart: unless-stopped
    depends_on:
      - gerbil
    environment:
      COLLECTIONS: crowdsecurity/traefik crowdsecurity/appsec-virtual-patching
        crowdsecurity/appsec-generic-rules crowdsecurity/linux
        crowdsecurity/iptables
      ENROLL_INSTANCE_NAME: pangolin-crowdsec
      ENROLL_TAGS: docker
      GID: "1000"
      PARSERS: crowdsecurity/whitelists
    healthcheck:
      test:
        - CMD
        - cscli
        - capi
        - status
    labels:
      - traefik.enable=false
    ports:
      - 6060:6060
      - 8080:8080
    volumes:
      - ./config/crowdsec:/etc/crowdsec
      - ./config/crowdsec/db:/var/lib/crowdsec/data
      - ./config/traefik/logs:/var/log/traefik:ro
      - /var/log/journal:/var/log/host:ro
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
  gerbil:
    container_name: gerbil
    image: fosrl/gerbil:1.1.0
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    command:
      - --reachableAt=http://gerbil:3003
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config
      - --reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth
    ports:
      - 21820:21820/udp
      - 44400:44400/udp
      - 443:443
      - 80:80
      - 10021:10021
      - 10090:10090/udp
      - 10091:10091/udp
      - 20090:20090/udp
      - 27015:27015/udp
      - 27031:27031/udp
      - 27015:27015
      - 27036:27036
      - 30090:30090/udp
      - 8082:8082
    volumes:
      - ./config/:/var/config
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
  pangolin:
    container_name: pangolin
    image: fosrl/pangolin:1.8.0
    restart: unless-stopped
    healthcheck:
      interval: 10s
      retries: 15
      test:
        - CMD
        - curl
        - -f
        - http://localhost:3001/api/v1/
      timeout: 10s
    volumes:
      - ./config:/app/config
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
  traefik:
    container_name: traefik
    image: traefik:v3.5
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    environment:
      - IPV64_API_KEY=${API_KEY}
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    network_mode: service:gerbil
    volumes:
      - ./config/traefik:/etc/traefik:ro
      - ./config/letsencrypt:/letsencrypt
      - ./config/traefik/logs:/var/log/traefik
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro

config.yml

app:
  dashboard_url: <my.domain>
  log_level: info
  save_logs: true
  log_failed_attempts: true
domains:
  domain1:
    base_domain: <my.domain>
    cert_resolver: letsencrypt
    prefer_wildcard_cert: true
server:
  cors:
    origins:
      - <my.domain>
    methods:
      - GET
      - POST
      - PUT
      - DELETE
      - PATCH
    headers:
      - X-CSRF-Token
      - Content-Type
    credentials: false
  secret: <my.secret>
gerbil:
  start_port: 44400
  base_endpoint: <my.domain>
orgs:
  block_size: 24
  subnet_group: 100.89.138.0/20
flags:
  require_email_verification: false
  disable_signup_without_invite: true
  disable_user_create_org: true
  allow_raw_resources: true
  allow_base_domain_resources: true

*Originally created by @Lokowitz on 8/1/2025* I am not able to ping the network through olm. I am running olm in a LXC on my Proxmox server. `/dev/net/tun` is added as device. ## olm log It is different from the logs in your demo video: ``` INFO: 2025/08/01 08:40:50 Websocket Connected INFO: 2025/08/01 08:40:50 Sent registration message INFO: 2025/08/01 08:40:50 Sent initial ping message INFO: 2025/08/01 08:40:51 Stopping UDP holepunch INFO: 2025/08/01 08:40:51 UDP hole punch goroutine ended INFO: 2025/08/01 08:40:51 UAPI listener started INFO: 2025/08/01 08:40:51 WireGuard device created. ``` In Pangolin UI the client is shown as connected/online. But after the connection of the client i am getting an error by pressing the `save settings` button in edit client. "Faild to update client. An error occurred." ## gerbil logs ``` ERROR: 2025/08/01 10:34:11 Destination port must be a positive integer for destination 0 ERROR: 2025/08/01 10:34:21 Destination port must be a positive integer for destination 0 ERROR: 2025/08/01 10:35:44 Destination port must be a positive integer for destination 0 ERROR: 2025/08/01 10:42:48 Destination port must be a positive integer for destination 0 ``` ## pangolin log ``` 2025-08-01T08:22:38.570Z [info]: Client added to tracking - OLM ID: 6ykr######fvtw, Connection ID: 61#######da, Total connections: 1 2025-08-01T08:22:38.570Z [info]: WebSocket connection established - OLM ID: 6y######tw 2025-08-01T08:22:38.602Z [info]: Handling register olm message! 2025-08-01T08:22:38.603Z [warn]: Client last hole punch is too old, skipping all sites 2025-08-01T08:22:39.598Z [info]: Handling register olm message! 2025-08-01T08:22:39.600Z [info]: Public key mismatch. Updating public key and clearing session info... 2025-08-01T08:22:39.607Z [warn]: Site 5 has no endpoint, skipping 2025-08-01T08:24:12.835Z [info]: Adding 0 new sites to client 3 2025-08-01T08:24:12.836Z [info]: Removing 0 sites from client 3 2025-08-01T08:24:12.840Z [info]: Updating destinations for exit node at http://gerbil:3003 2025-08-01T08:24:12.840Z [info]: Payload for update-destinations: { "sourceIp": "9#######1", "sourcePort": 43995, "destinations": [ { "destinationIP": "100.89.128.8", "destinationPort": 0 } ] } 2025-08-01T08:24:12.848Z [error]: Error communicating with Gerbil. Make sure Pangolin can reach the Gerbil HTTP API: 400 Stack: Error: Error communicating with Gerbil. Make sure Pangolin can reach the Gerbil HTTP API: 400 at Function.<anonymous> (file:///app/dist/server.mjs:32:38339) at process.processTicksAndRejections (node:internal/process/task_queues:95:5) at async Ny (file:///app/dist/server.mjs:32:37013) ``` ## docker-compose.yml ``` services: crowdsec: container_name: crowdsec image: crowdsecurity/crowdsec:v1.6.11-debian restart: unless-stopped depends_on: - gerbil environment: COLLECTIONS: crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules crowdsecurity/linux crowdsecurity/iptables ENROLL_INSTANCE_NAME: pangolin-crowdsec ENROLL_TAGS: docker GID: "1000" PARSERS: crowdsecurity/whitelists healthcheck: test: - CMD - cscli - capi - status labels: - traefik.enable=false ports: - 6060:6060 - 8080:8080 volumes: - ./config/crowdsec:/etc/crowdsec - ./config/crowdsec/db:/var/lib/crowdsec/data - ./config/traefik/logs:/var/log/traefik:ro - /var/log/journal:/var/log/host:ro - /etc/timezone:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro gerbil: container_name: gerbil image: fosrl/gerbil:1.1.0 restart: unless-stopped depends_on: pangolin: condition: service_healthy cap_add: - NET_ADMIN - SYS_MODULE command: - --reachableAt=http://gerbil:3003 - --generateAndSaveKeyTo=/var/config/key - --remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config - --reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth ports: - 21820:21820/udp - 44400:44400/udp - 443:443 - 80:80 - 10021:10021 - 10090:10090/udp - 10091:10091/udp - 20090:20090/udp - 27015:27015/udp - 27031:27031/udp - 27015:27015 - 27036:27036 - 30090:30090/udp - 8082:8082 volumes: - ./config/:/var/config - /etc/timezone:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro pangolin: container_name: pangolin image: fosrl/pangolin:1.8.0 restart: unless-stopped healthcheck: interval: 10s retries: 15 test: - CMD - curl - -f - http://localhost:3001/api/v1/ timeout: 10s volumes: - ./config:/app/config - /etc/timezone:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro traefik: container_name: traefik image: traefik:v3.5 restart: unless-stopped depends_on: pangolin: condition: service_healthy environment: - IPV64_API_KEY=${API_KEY} command: - --configFile=/etc/traefik/traefik_config.yml network_mode: service:gerbil volumes: - ./config/traefik:/etc/traefik:ro - ./config/letsencrypt:/letsencrypt - ./config/traefik/logs:/var/log/traefik - /etc/timezone:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro ``` ## config.yml ``` app: dashboard_url: <my.domain> log_level: info save_logs: true log_failed_attempts: true domains: domain1: base_domain: <my.domain> cert_resolver: letsencrypt prefer_wildcard_cert: true server: cors: origins: - <my.domain> methods: - GET - POST - PUT - DELETE - PATCH headers: - X-CSRF-Token - Content-Type credentials: false secret: <my.secret> gerbil: start_port: 44400 base_endpoint: <my.domain> orgs: block_size: 24 subnet_group: 100.89.138.0/20 flags: require_email_verification: false disable_signup_without_invite: true disable_user_create_org: true allow_raw_resources: true allow_base_domain_resources: true ```

MrUnknownDE closed this issue

2026-04-05 18:19:32 +02:00

MrUnknownDE referenced this issue

2026-04-05 18:21:29 +02:00

Portbinding fixes #1146

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1133