Pangolin insists on binding to ipv6 even though specifically told not to #620

New Issue

MrUnknownDE · 2026-04-05T17:28:04+02:00

MrUnknownDE commented

2026-04-05 17:28:04 +02:00

Originally created by @realrolfje on 11/18/2025

Describe the Bug

Pangolin 1.10 works nicely on ipv4. I upgraded to a new Debian Trixie machine and Pangolin 1.12.1, and there Pangolin insists on binding to ipv6, even though the machine is specifically configured not to. This in turn results in none of the traffic going to the correct host on the newt tunnel.

On pangolin 1.10, when running netstat in the container I see:

sudo docker exec -it pangolin netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
tcp        0      0 127.0.0.11:42971        0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:3002            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:3001            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:3000            0.0.0.0:*               LISTEN      
tcp        0      0 172.19.0.2:3001         172.19.0.4:38762        ESTABLISHED 
tcp        0      0 127.0.0.1:60292         127.0.0.1:3001          TIME_WAIT   
tcp        0      0 172.19.0.2:3001         172.19.0.4:38772        ESTABLISHED 
tcp        0      0 172.19.0.2:58094        104.16.2.35:443         ESTABLISHED

But with the new pangolin I see:

$ sudo docker exec -it pangolin netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 127.0.0.11:39269        0.0.0.0:*               LISTEN
tcp        0      0 172.18.0.2:52208        104.16.1.35:443         ESTABLISHED
tcp        0      0 :::3002                 :::*                    LISTEN
tcp        0      0 :::3001                 :::*                    LISTEN
tcp        0      0 :::3000                 :::*                    LISTEN
tcp        0      0 ::1:53976               ::1:3001                TIME_WAIT
tcp        0      0 ::1:54902               ::1:3001                TIME_WAIT
tcp        0      0 ::1:59404               ::1:3001                TIME_WAIT
tcp        0      0 ::1:55394               ::1:3001                TIME_WAIT
tcp        0      0 ::1:53194               ::1:3001                TIME_WAIT
tcp        0      0 ::1:53968               ::1:3001                TIME_WAIT
tcp        0      0 ::ffff:172.18.0.2:3001  ::ffff:172.18.0.4:59312 ESTABLISHED

I tried adding

   sysctls:
      net.ipv6.conf.all.disable_ipv6: "1"
      net.ipv6.conf.default.disable_ipv6: "1"

To all services in the compose file, rebuilding all containers, nothing helps. Both the host and docker are configured to NOT support ipv6, even blacklisted all ipv6 modules. I specifically told the installer that the system does NOT support ipv6.

These troubles are exactly why I always disable ipv6, because it almost always creates frustrating problems like this (sorry for the rant). Please do not bind to "::" if the installer said that the machine does not support ipv6

Environment

OS Type & Version: Debian 13 Trixie
Pangolin Version: 1.12.1
Gerbil Version: image: docker.io/fosrl/gerbil:1.2.2
Traefik Version: image: docker.io/traefik:v3.5
Newt Version: 1.6.0
Olm Version: (if applicable)

Crowdsec:
image: docker.io/crowdsecurity/crowdsec:latest

docker --version
Docker version 29.0.1, build eedd969

To Reproduce

sudo docker compose down --volumes --remove-orphans
sudo docker rm -f $(sudo docker ps -aq)         # Remove all containers
sudo docker volume rm $(sudo docker volume ls -q)  # Optional: wipe volumes if safe
sudo docker network rm $(sudo docker network ls -q)  # Remove all networks
sudo docker rmi -f $(sudo docker images -aq)
sudo docker system prune -a --volumes -f
sudo nano /etc/sysctl.d/99-disable-ipv6.conf
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
echo "blacklist ipv6" | sudo tee /etc/modprobe.d/disable-ipv6.conf
sudo update-initramfs -u
sudo reboot
cd /opt/pangolin

vim docker-compose.yaml and add
   sysctls:
      net.ipv6.conf.all.disable_ipv6: "1"
      net.ipv6.conf.default.disable_ipv6: "1"
to all services

sudo systemctl restart docker
sudo docker compose build --no-cache
sudo docker compose up -d --build

Then:

$ sudo docker exec -it pangolin netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 127.0.0.11:33045        0.0.0.0:*               LISTEN
tcp        0      0 172.18.0.2:46960        216.150.1.1:443         TIME_WAIT
tcp        0      0 127.0.0.1:55106         127.0.0.1:3001          TIME_WAIT
tcp        0      0 127.0.0.1:51306         127.0.0.1:3001          TIME_WAIT
tcp        0      0 127.0.0.1:46726         127.0.0.1:3001          TIME_WAIT
tcp        0      0 127.0.0.1:57296         127.0.0.1:3001          TIME_WAIT
tcp        0      0 :::3002                 :::*                    LISTEN
tcp        0      0 :::3000                 :::*                    LISTEN
tcp        0      0 :::3001                 :::*                    LISTEN
tcp        0      0 ::ffff:172.18.0.2:3001  ::ffff:172.18.0.4:58814 TIME_WAIT
tcp        0      0 ::ffff:172.18.0.2:3001  ::ffff:172.18.0.4:46994 ESTABLISHED

There should be NO ipv6 addresses.

Expected Behavior

sudo docker exec -it pangolin netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
tcp        0      0 127.0.0.11:42971        0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:3002            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:3001            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:3000            0.0.0.0:*               LISTEN      
tcp        0      0 172.19.0.2:3001         172.19.0.4:38762        ESTABLISHED 
tcp        0      0 127.0.0.1:60292         127.0.0.1:3001          TIME_WAIT   
tcp        0      0 172.19.0.2:3001         172.19.0.4:38772        ESTABLISHED 
tcp        0      0 172.19.0.2:58094        104.16.2.35:443         ESTABLISHED

*Originally created by @realrolfje on 11/18/2025* ### Describe the Bug Pangolin 1.10 works nicely on ipv4. I upgraded to a new Debian Trixie machine and Pangolin 1.12.1, and there Pangolin insists on binding to ipv6, even though the machine is specifically configured not to. This in turn results in none of the traffic going to the correct host on the newt tunnel. On pangolin 1.10, when running netstat in the container I see: ``` sudo docker exec -it pangolin netstat -ant Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.11:42971 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:3002 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:3001 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:3000 0.0.0.0:* LISTEN tcp 0 0 172.19.0.2:3001 172.19.0.4:38762 ESTABLISHED tcp 0 0 127.0.0.1:60292 127.0.0.1:3001 TIME_WAIT tcp 0 0 172.19.0.2:3001 172.19.0.4:38772 ESTABLISHED tcp 0 0 172.19.0.2:58094 104.16.2.35:443 ESTABLISHED ``` But with the new pangolin I see: ``` $ sudo docker exec -it pangolin netstat -ant Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.11:39269 0.0.0.0:* LISTEN tcp 0 0 172.18.0.2:52208 104.16.1.35:443 ESTABLISHED tcp 0 0 :::3002 :::* LISTEN tcp 0 0 :::3001 :::* LISTEN tcp 0 0 :::3000 :::* LISTEN tcp 0 0 ::1:53976 ::1:3001 TIME_WAIT tcp 0 0 ::1:54902 ::1:3001 TIME_WAIT tcp 0 0 ::1:59404 ::1:3001 TIME_WAIT tcp 0 0 ::1:55394 ::1:3001 TIME_WAIT tcp 0 0 ::1:53194 ::1:3001 TIME_WAIT tcp 0 0 ::1:53968 ::1:3001 TIME_WAIT tcp 0 0 ::ffff:172.18.0.2:3001 ::ffff:172.18.0.4:59312 ESTABLISHED ``` I tried adding ``` sysctls: net.ipv6.conf.all.disable_ipv6: "1" net.ipv6.conf.default.disable_ipv6: "1" ``` To all services in the compose file, rebuilding all containers, nothing helps. Both the host and docker are configured to NOT support ipv6, even blacklisted all ipv6 modules. I specifically told the installer that the system does NOT support ipv6. These troubles are exactly why I always disable ipv6, because it almost always creates frustrating problems like this (sorry for the rant). Please do not bind to "::" if the installer said that the machine does not support ipv6 ### Environment - OS Type & Version: Debian 13 Trixie - Pangolin Version: 1.12.1 - Gerbil Version: image: docker.io/fosrl/gerbil:1.2.2 - Traefik Version: image: docker.io/traefik:v3.5 - Newt Version: 1.6.0 - Olm Version: (if applicable) Crowdsec: image: docker.io/crowdsecurity/crowdsec:latest docker --version Docker version 29.0.1, build eedd969 ### To Reproduce ``` sudo docker compose down --volumes --remove-orphans sudo docker rm -f $(sudo docker ps -aq) # Remove all containers sudo docker volume rm $(sudo docker volume ls -q) # Optional: wipe volumes if safe sudo docker network rm $(sudo docker network ls -q) # Remove all networks sudo docker rmi -f $(sudo docker images -aq) sudo docker system prune -a --volumes -f sudo nano /etc/sysctl.d/99-disable-ipv6.conf net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 echo "blacklist ipv6" | sudo tee /etc/modprobe.d/disable-ipv6.conf sudo update-initramfs -u sudo reboot cd /opt/pangolin vim docker-compose.yaml and add sysctls: net.ipv6.conf.all.disable_ipv6: "1" net.ipv6.conf.default.disable_ipv6: "1" to all services sudo systemctl restart docker sudo docker compose build --no-cache sudo docker compose up -d --build ``` Then: ``` $ sudo docker exec -it pangolin netstat -ant Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.11:33045 0.0.0.0:* LISTEN tcp 0 0 172.18.0.2:46960 216.150.1.1:443 TIME_WAIT tcp 0 0 127.0.0.1:55106 127.0.0.1:3001 TIME_WAIT tcp 0 0 127.0.0.1:51306 127.0.0.1:3001 TIME_WAIT tcp 0 0 127.0.0.1:46726 127.0.0.1:3001 TIME_WAIT tcp 0 0 127.0.0.1:57296 127.0.0.1:3001 TIME_WAIT tcp 0 0 :::3002 :::* LISTEN tcp 0 0 :::3000 :::* LISTEN tcp 0 0 :::3001 :::* LISTEN tcp 0 0 ::ffff:172.18.0.2:3001 ::ffff:172.18.0.4:58814 TIME_WAIT tcp 0 0 ::ffff:172.18.0.2:3001 ::ffff:172.18.0.4:46994 ESTABLISHED ``` There should be NO ipv6 addresses. ### Expected Behavior ``` sudo docker exec -it pangolin netstat -ant Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.11:42971 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:3002 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:3001 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:3000 0.0.0.0:* LISTEN tcp 0 0 172.19.0.2:3001 172.19.0.4:38762 ESTABLISHED tcp 0 0 127.0.0.1:60292 127.0.0.1:3001 TIME_WAIT tcp 0 0 172.19.0.2:3001 172.19.0.4:38772 ESTABLISHED tcp 0 0 172.19.0.2:58094 104.16.2.35:443 ESTABLISHED ```

MrUnknownDE closed this issue

2026-04-05 17:28:04 +02:00

MrUnknownDE added the stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale labels 2026-04-05 17:28:05 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#620