Feature Request: Native/Kernel WireGuard support for Newt with full site-to-site networking #314

New Issue

MrUnknownDE · 2026-04-05T17:05:49+02:00

MrUnknownDE commented

2026-04-05 17:05:49 +02:00

Originally created by @fampla on 1/27/2026

Feature Request

Problem

I want to use Pangolin/Newt as my single networking solution to replace Tailscale, connecting multiple servers (homelab, remote Proxmox hosts) with full site-to-site connectivity for services like NFS shares.

Currently I face two limitations:

Performance: Newt's userspace WireGuard implementation is significantly slower than kernel WireGuard. As discussed in #512, users report ~1-10 MB/s with Newt vs 22+ MB/s with native WireGuard for the same connection.
Site-to-Site networking: Private resources and subnet routing only work with Newt, but the performance penalty makes it unsuitable for bandwidth-intensive use cases (NFS, media streaming, backups).

Current Workaround

I'm forced to run a hybrid setup:

Native WireGuard (wg0) for bandwidth-intensive services (Emby, etc.)
Tailscale for site-to-site connectivity (NFS between servers)

This defeats the purpose of having a unified self-hosted solution.

Proposed Solution

Add native/kernel WireGuard support to Newt, similar to how Tailscale offers both userspace and kernel modes:

--native or --kernel flag that uses the system's WireGuard kernel module instead of userspace netstack
Maintain Pangolin integration - keep the control plane communication, automatic peer configuration, and private resource management
Site-to-site routing through kernel networking stack for proper subnet gateway functionality (related to #1370)

Benefits

Near line-speed performance for all traffic
True Tailscale replacement with full site-to-site networking
Single service to manage instead of multiple VPN solution

Environment

Multiple Proxmox hosts
Docker containers (Emby, NFS, etc.)
Currently using: Pangolin + native WireGuard + Tailscale (want to consolidate)

I noticed there's a --native / USE_NATIVE_INTERFACE flag in the code - is this intended for this purpose? If so, documentation would be helpful.

Thank you for this great project!

*Originally created by @fampla on 1/27/2026* ## Feature Request ### Problem I want to use Pangolin/Newt as my **single networking solution** to replace Tailscale, connecting multiple servers (homelab, remote Proxmox hosts) with full site-to-site connectivity for services like NFS shares. Currently I face two limitations: 1. **Performance**: Newt's userspace WireGuard implementation is significantly slower than kernel WireGuard. As discussed in #512, users report ~1-10 MB/s with Newt vs 22+ MB/s with native WireGuard for the same connection. 2. **Site-to-Site networking**: Private resources and subnet routing only work with Newt, but the performance penalty makes it unsuitable for bandwidth-intensive use cases (NFS, media streaming, backups). ### Current Workaround I'm forced to run a hybrid setup: - **Native WireGuard (wg0)** for bandwidth-intensive services (Emby, etc.) - **Tailscale** for site-to-site connectivity (NFS between servers) This defeats the purpose of having a unified self-hosted solution. ### Proposed Solution Add native/kernel WireGuard support to Newt, similar to how Tailscale offers both userspace and kernel modes: 1. **`--native` or `--kernel` flag** that uses the system's WireGuard kernel module instead of userspace netstack 2. **Maintain Pangolin integration** - keep the control plane communication, automatic peer configuration, and private resource management 3. **Site-to-site routing** through kernel networking stack for proper subnet gateway functionality (related to #1370) ### Benefits - Near line-speed performance for all traffic - True Tailscale replacement with full site-to-site networking - Single service to manage instead of multiple VPN solution ### Environment - Multiple Proxmox hosts - Docker containers (Emby, NFS, etc.) - Currently using: Pangolin + native WireGuard + Tailscale (want to consolidate) I noticed there's a `--native` / `USE_NATIVE_INTERFACE` flag in the code - is this intended for this purpose? If so, documentation would be helpful. Thank you for this great project!

MrUnknownDE closed this issue

2026-04-05 17:05:49 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#314