Unable to connect to resource #1582

New Issue

MrUnknownDE · 2026-04-05T19:36:06+02:00

MrUnknownDE commented

2026-04-05 19:36:06 +02:00

Originally created by @aatumaykin on 4/23/2025

There is a vps server on which pangolin is installed. There is an lxc container in proxmox in which newt is installed. I can't access the resource. I tried different ip addresses: port for resources, but it doesn't work.

Newt has tried to run both as docker and binary.

The port for wireguard is available. Here are my logs (newt as docker run).

adding a resource

INFO: 2025/04/23 12:43:39 Pinging 100.89.128.1
DEBUG: wireguard: 2025/04/23 12:43:44 peer(TAc1…mXH4) - Sending handshake initiation
DEBUG: wireguard: 2025/04/23 12:43:49 peer(TAc1…mXH4) - Sending handshake initiation
INFO: 2025/04/23 12:43:52 Received: {Type:newt/tcp/add Data:map[targets:[55939:192.168.35.114:3000]]}
INFO: 2025/04/23 12:43:52 Started tcp proxy from 100.89.128.4:55939 to 192.168.35.114:3000
DEBUG: wireguard: 2025/04/23 12:43:54 peer(TAc1…mXH4) - Sending handshake initiation
DEBUG: wireguard: 2025/04/23 12:43:59 peer(TAc1…mXH4) - Sending handshake initiation
DEBUG: wireguard: 2025/04/23 12:44:04 peer(TAc1…mXH4) - Sending handshake initiation

traefik   | 2025-04-23T12:43:52Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={"http":{"middlewares":{"badger":{"plugin":{"badger":{"accessTokenQueryParam":"p_token","apiBaseUrl":"http://pangolin:3001/api/v1","resourceSessionRequestParam":"p_session_request","userSessionCookieName":"p_session_token"}}},"redirect-to-https":{"redirectScheme":{"scheme":"https"}}},"routers":{"2-router":{"entryPoints":["websecure"],"middlewares":["badger"],"rule":"Host(`ha-test.****`)","service":"2-service","tls":{"certResolver":"letsencrypt"}},"2-router-redirect":{"entryPoints":["web"],"middlewares":["redirect-to-https"],"rule":"Host(`ha-test.****`)","service":"2-service"}},"services":{"2-service":{"loadBalancer":{"passHostHeader":true,"responseForwarding":{"flushInterval":"100ms"},"servers":[{"url":"http://100.89.128.4:55939"}]}}}},"tcp":{},"tls":{},"udp":{}} providerName=http

resource request

pangolin  | 2025-04-23T12:48:57.144Z [debug]: Verify session: Badger sent {"sessions":{},"originalRequestURL":"https://ha-test.****/","scheme":"","host":"ha-test.****","path":"/","method":"GET","tls":true,"requestIp":"5.16.132.198:60150","headers":{"Accept":"*/*","User-Agent":"curl/8.7.1","X-Forwarded-Host":"ha-test.****","X-Forwarded-Port":"443","X-Forwarded-Proto":"https","X-Forwarded-Server":"4dc970577df3","X-Real-Ip":"5.16.132.198"}}
pangolin  | 2025-04-23T12:48:57.146Z [debug]: Resource allowed by rule
pangolin  | 2025-04-23T12:48:57.146Z [debug]: {"data":{"valid":true},"success":true,"error":false,"message":"Access allowed","status":200}
traefik   | 2025-04-23T12:48:57Z DBG fmt/print.go:305 > Badger: Valid session module=github.com/fosrl/badger plugin=plugin-badger runtime=
traefik   | 2025-04-23T12:48:57Z DBG github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:213 > Service selected by WRR: http://100.89.128.4:55939
traefik   | 2025-04-23T12:49:27Z DBG github.com/traefik/traefik/v3/pkg/proxy/httputil/proxy.go:121 > 504 Gateway Timeout error="dial tcp 100.89.128.4:55939: i/o timeout"

curl -v https://ha-test.****
* Host ha-test.****:443 was resolved.
* IPv6: (none)
* IPv4: 51.68.171.68
*   Trying 51.68.171.68:443...
* Connected to ha-test.**** (51.68.171.68) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=ha-test.****
*  start date: Apr 23 11:21:26 2025 GMT
*  expire date: Jul 22 11:21:25 2025 GMT
*  subjectAltName: host "ha-test.****" matched cert's "ha-test.****"
*  issuer: C=US; O=Let's Encrypt; CN=R11
*  SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://ha-test.****/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: ha-test.****]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: ha-test.****
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/2 504 
< content-length: 15
< date: Wed, 23 Apr 2025 12:49:27 GMT
< 
* Connection #0 to host ha-test.**** left intact
Gateway Timeout

tcpdump -i any -n udp port 51820
tcpdump: data link type LINUX_SLL2
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
15:51:57.004748 ens3  In  IP 5.16.132.198.59701 > 51.68.171.68.51820: UDP, length 5
15:51:57.004790 br-f7084cb23465 Out IP 5.16.132.198.59701 > 172.18.0.3.51820: UDP, length 5
15:51:57.004796 vethb3eacbb Out IP 5.16.132.198.59701 > 172.18.0.3.51820: UDP, length 5
15:51:58.138331 ens3  In  IP 5.16.132.198.59701 > 51.68.171.68.51820: UDP, length 6
15:51:58.138359 br-f7084cb23465 Out IP 5.16.132.198.59701 > 172.18.0.3.51820: UDP, length 6
15:51:58.138364 vethb3eacbb Out IP 5.16.132.198.59701 > 172.18.0.3.51820: UDP, length 6

*Originally created by @aatumaykin on 4/23/2025* There is a vps server on which pangolin is installed. There is an lxc container in proxmox in which newt is installed. I can't access the resource. I tried different ip addresses: port for resources, but it doesn't work. Newt has tried to run both as docker and binary. The port for wireguard is available. Here are my logs (newt as docker run). **adding a resource** ``` INFO: 2025/04/23 12:43:39 Pinging 100.89.128.1 DEBUG: wireguard: 2025/04/23 12:43:44 peer(TAc1…mXH4) - Sending handshake initiation DEBUG: wireguard: 2025/04/23 12:43:49 peer(TAc1…mXH4) - Sending handshake initiation INFO: 2025/04/23 12:43:52 Received: {Type:newt/tcp/add Data:map[targets:[55939:192.168.35.114:3000]]} INFO: 2025/04/23 12:43:52 Started tcp proxy from 100.89.128.4:55939 to 192.168.35.114:3000 DEBUG: wireguard: 2025/04/23 12:43:54 peer(TAc1…mXH4) - Sending handshake initiation DEBUG: wireguard: 2025/04/23 12:43:59 peer(TAc1…mXH4) - Sending handshake initiation DEBUG: wireguard: 2025/04/23 12:44:04 peer(TAc1…mXH4) - Sending handshake initiation ``` ``` traefik | 2025-04-23T12:43:52Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={"http":{"middlewares":{"badger":{"plugin":{"badger":{"accessTokenQueryParam":"p_token","apiBaseUrl":"http://pangolin:3001/api/v1","resourceSessionRequestParam":"p_session_request","userSessionCookieName":"p_session_token"}}},"redirect-to-https":{"redirectScheme":{"scheme":"https"}}},"routers":{"2-router":{"entryPoints":["websecure"],"middlewares":["badger"],"rule":"Host(`ha-test.****`)","service":"2-service","tls":{"certResolver":"letsencrypt"}},"2-router-redirect":{"entryPoints":["web"],"middlewares":["redirect-to-https"],"rule":"Host(`ha-test.****`)","service":"2-service"}},"services":{"2-service":{"loadBalancer":{"passHostHeader":true,"responseForwarding":{"flushInterval":"100ms"},"servers":[{"url":"http://100.89.128.4:55939"}]}}}},"tcp":{},"tls":{},"udp":{}} providerName=http ``` **resource request** ``` pangolin | 2025-04-23T12:48:57.144Z [debug]: Verify session: Badger sent {"sessions":{},"originalRequestURL":"https://ha-test.****/","scheme":"","host":"ha-test.****","path":"/","method":"GET","tls":true,"requestIp":"5.16.132.198:60150","headers":{"Accept":"*/*","User-Agent":"curl/8.7.1","X-Forwarded-Host":"ha-test.****","X-Forwarded-Port":"443","X-Forwarded-Proto":"https","X-Forwarded-Server":"4dc970577df3","X-Real-Ip":"5.16.132.198"}} pangolin | 2025-04-23T12:48:57.146Z [debug]: Resource allowed by rule pangolin | 2025-04-23T12:48:57.146Z [debug]: {"data":{"valid":true},"success":true,"error":false,"message":"Access allowed","status":200} traefik | 2025-04-23T12:48:57Z DBG fmt/print.go:305 > Badger: Valid session module=github.com/fosrl/badger plugin=plugin-badger runtime= traefik | 2025-04-23T12:48:57Z DBG github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:213 > Service selected by WRR: http://100.89.128.4:55939 traefik | 2025-04-23T12:49:27Z DBG github.com/traefik/traefik/v3/pkg/proxy/httputil/proxy.go:121 > 504 Gateway Timeout error="dial tcp 100.89.128.4:55939: i/o timeout" ``` ``` curl -v https://ha-test.**** * Host ha-test.****:443 was resolved. * IPv6: (none) * IPv4: 51.68.171.68 * Trying 51.68.171.68:443... * Connected to ha-test.**** (51.68.171.68) port 443 * ALPN: curl offers h2,http/1.1 * (304) (OUT), TLS handshake, Client hello (1): * CAfile: /etc/ssl/cert.pem * CApath: none * (304) (IN), TLS handshake, Server hello (2): * (304) (IN), TLS handshake, Unknown (8): * (304) (IN), TLS handshake, Certificate (11): * (304) (IN), TLS handshake, CERT verify (15): * (304) (IN), TLS handshake, Finished (20): * (304) (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF * ALPN: server accepted h2 * Server certificate: * subject: CN=ha-test.**** * start date: Apr 23 11:21:26 2025 GMT * expire date: Jul 22 11:21:25 2025 GMT * subjectAltName: host "ha-test.****" matched cert's "ha-test.****" * issuer: C=US; O=Let's Encrypt; CN=R11 * SSL certificate verify ok. * using HTTP/2 * [HTTP/2] [1] OPENED stream for https://ha-test.****/ * [HTTP/2] [1] [:method: GET] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: ha-test.****] * [HTTP/2] [1] [:path: /] * [HTTP/2] [1] [user-agent: curl/8.7.1] * [HTTP/2] [1] [accept: */*] > GET / HTTP/2 > Host: ha-test.**** > User-Agent: curl/8.7.1 > Accept: */* > * Request completely sent off < HTTP/2 504 < content-length: 15 < date: Wed, 23 Apr 2025 12:49:27 GMT < * Connection #0 to host ha-test.**** left intact Gateway Timeout ``` ``` tcpdump -i any -n udp port 51820 tcpdump: data link type LINUX_SLL2 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes 15:51:57.004748 ens3 In IP 5.16.132.198.59701 > 51.68.171.68.51820: UDP, length 5 15:51:57.004790 br-f7084cb23465 Out IP 5.16.132.198.59701 > 172.18.0.3.51820: UDP, length 5 15:51:57.004796 vethb3eacbb Out IP 5.16.132.198.59701 > 172.18.0.3.51820: UDP, length 5 15:51:58.138331 ens3 In IP 5.16.132.198.59701 > 51.68.171.68.51820: UDP, length 6 15:51:58.138359 br-f7084cb23465 Out IP 5.16.132.198.59701 > 172.18.0.3.51820: UDP, length 6 15:51:58.138364 vethb3eacbb Out IP 5.16.132.198.59701 > 172.18.0.3.51820: UDP, length 6 ```

MrUnknownDE closed this issue

2026-04-05 19:36:06 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1582