Connection recurrently drops after some seconds (Periodic ping failed) #954

New Issue

MrUnknownDE · 2026-04-05T18:02:59+02:00

MrUnknownDE commented

2026-04-05 18:02:59 +02:00

Originally created by @DenkingOfficial on 9/7/2025

Bug Description

Impossible to connect to tunnel, newt can't establish stable connection.

Steps to Reproduce

Run fresh pangolin (latest) with the following docker compose and configs:

services:
  pangolin:
    image: fosrl/pangolin:latest
    container_name: pangolin
    restart: unless-stopped
    volumes:
      - ./config:/app/config
      - pangolin-data:/var/certificates
      - pangolin-data:/var/dynamic
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
      interval: "3s"
      timeout: "3s"
      retries: 15

  gerbil:
    image: fosrl/gerbil:latest
    container_name: gerbil
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --reachableAt=http://gerbil:3003
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://pangolin:3001/api/v1/
    volumes:
      - ./config/:/var/config
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    ports:
      - 51820:51820/udp
      - 21820:21820/udp
      - 443:443
      - 80:80

  traefik:
    image: traefik:v3.4.0
    container_name: traefik
    restart: unless-stopped
    network_mode: service:gerbil
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    volumes:
      - ./config/traefik:/etc/traefik:ro
      - ./config/letsencrypt:/letsencrypt
      - pangolin-data:/var/certificates:ro
      - pangolin-data:/var/dynamic:ro

networks:
  default:
    driver: bridge
    name: pangolin

volumes:
  pangolin-data:

config.yml:

app:
  dashboard_url: "http://some.domain.com"

domains:
  domain1:
    base_domain: "domain.com"
    cert_resolver: "letsencrypt"

server:
  secret: "strong-secret"

gerbil:
  base_endpoint: "some.domain.com"

flags:
  require_email_verification: false
  disable_signup_without_invite: true
  disable_user_create_org: true

traefik-config.yml:

api:
  insecure: true
  dashboard: true

providers:
  http:
    endpoint: "http://pangolin:3001/api/v1/traefik-config"
    pollInterval: "5s"
  file:
    filename: "/etc/traefik/dynamic_config.yml"

experimental:
  plugins:
    badger:
      moduleName: "github.com/fosrl/badger"
      version: "v1.2.0"

log:
  level: "INFO"
  format: "common"

certificatesResolvers:
  letsencrypt:
    acme:
      httpChallenge:
        entryPoint: web
      email: my.email@gmail.com
      storage: "/letsencrypt/acme.json"
      caServer: "https://acme-v02.api.letsencrypt.org/directory"

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
    transport:
      respondingTimeouts:
        readTimeout: "30m"
    http:
      tls:
        certResolver: "letsencrypt"

serversTransport:
  insecureSkipVerify: true

ping:
    entryPoint: "web"

dynamic-config.yml

http:
  middlewares:
    redirect-to-https:
      redirectScheme:
        scheme: https

  routers:
    main-app-router-redirect:
      rule: "Host(`some.domain.com`)"
      service: next-service
      entryPoints:
        - web
      middlewares:
        - redirect-to-https

    next-router:
      rule: "Host(`some.domain.com`) && !PathPrefix(`/api/v1`)"
      service: next-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt

    api-router:
      rule: "Host(`some.domain.com`) && PathPrefix(`/api/v1`)"
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt

    ws-router:
      rule: "Host(`some.domain.com`)"
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt

  services:
    next-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3002"

    api-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3000"

Open Dashboard
Create a site with address from 100.90.128.0/24 subnet
Connect to site via newt

./newt.exe --id {ID} --secret {SECRET} --endpoint https://some.domain.com

Create a resource (for example http://127.0.0.1:3004 -> https://website.domain.com)
See periodic connections and failures:

INFO: 2025/09/07 06:53:24 Newt version 1.4.4
INFO: 2025/09/07 06:53:24 Creating new health check monitor with certificate enforcement: false
INFO: 2025/09/07 06:53:25 Websocket connected
INFO: 2025/09/07 06:53:25 Requesting exit nodes from server
INFO: 2025/09/07 06:53:25 Received ping message
INFO: 2025/09/07 06:53:25 Received registration message
INFO: 2025/09/07 06:53:25 Connecting to endpoint: some.domain.com
INFO: 2025/09/07 06:53:25 Initial connection test successful
INFO: 2025/09/07 06:53:25 Tunnel connection to server established successfully!
INFO: 2025/09/07 06:53:25 Successfully added 0 health check targets
INFO: 2025/09/07 06:53:47 Started tcp proxy to 127.0.0.1:3004
WARN: 2025/09/07 06:53:59 Periodic ping failed (2 consecutive failures): all 2 ping attempts failed, last error: failed to read ICMP packet: i/o timeout
WARN: 2025/09/07 06:54:12 Periodic ping failed (3 consecutive failures): all 2 ping attempts failed, last error: failed to read ICMP packet: i/o timeout
WARN: 2025/09/07 06:54:29 Periodic ping failed (4 consecutive failures): all 2 ping attempts failed, last error: failed to read ICMP packet: i/o timeout
WARN: 2025/09/07 06:54:29 Connection to server lost after 4 failures. Continuous reconnection attempts will be made.
INFO: 2025/09/07 06:54:29 Received ping message
INFO: 2025/09/07 06:54:29 Received registration message
INFO: 2025/09/07 06:54:29 Stopping ping check
INFO: 2025/09/07 06:54:29 Connecting to endpoint: some.domain.com
INFO: 2025/09/07 06:54:29 Initial connection test successful
INFO: 2025/09/07 06:54:29 Tunnel connection to server established successfully!
INFO: 2025/09/07 06:54:29 Successfully added 0 health check targets
INFO: 2025/09/07 06:54:29 Started tcp proxy to 127.0.0.1:3004
...

Expected Behavior

Connection should not be canceled randomly and https://website.domain.com should be accessible

Actual Behavior

Connection always drops, all I could sometimes get is the title of website on https://website.domain.com and then nothing

Environment

Pangolin Version: latest (1.9.4), also tried 1.8.0
Newt Version: 1.4.4
Deployment: Docker Compose on VPS (fosrl/pangolin)
OS: Debian 12.2.0-14+deb12u1

Additional Context

Ports 80, 443, 51820 and 21820 are open and available on VPS. One of my friends has the exact same problem.

Thank you very much in advance for your help!

*Originally created by @DenkingOfficial on 9/7/2025* # Bug Description Impossible to connect to tunnel, newt can't establish stable connection. # Steps to Reproduce 1. Run fresh pangolin (latest) with the following docker compose and configs: ```docker-compose.yaml services: pangolin: image: fosrl/pangolin:latest container_name: pangolin restart: unless-stopped volumes: - ./config:/app/config - pangolin-data:/var/certificates - pangolin-data:/var/dynamic healthcheck: test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"] interval: "3s" timeout: "3s" retries: 15 gerbil: image: fosrl/gerbil:latest container_name: gerbil restart: unless-stopped depends_on: pangolin: condition: service_healthy command: - --reachableAt=http://gerbil:3003 - --generateAndSaveKeyTo=/var/config/key - --remoteConfig=http://pangolin:3001/api/v1/ volumes: - ./config/:/var/config cap_add: - NET_ADMIN - SYS_MODULE ports: - 51820:51820/udp - 21820:21820/udp - 443:443 - 80:80 traefik: image: traefik:v3.4.0 container_name: traefik restart: unless-stopped network_mode: service:gerbil depends_on: pangolin: condition: service_healthy command: - --configFile=/etc/traefik/traefik_config.yml volumes: - ./config/traefik:/etc/traefik:ro - ./config/letsencrypt:/letsencrypt - pangolin-data:/var/certificates:ro - pangolin-data:/var/dynamic:ro networks: default: driver: bridge name: pangolin volumes: pangolin-data: ``` config.yml: ```config.yml app: dashboard_url: "http://some.domain.com" domains: domain1: base_domain: "domain.com" cert_resolver: "letsencrypt" server: secret: "strong-secret" gerbil: base_endpoint: "some.domain.com" flags: require_email_verification: false disable_signup_without_invite: true disable_user_create_org: true ``` traefik-config.yml: ```traefik-config.yml api: insecure: true dashboard: true providers: http: endpoint: "http://pangolin:3001/api/v1/traefik-config" pollInterval: "5s" file: filename: "/etc/traefik/dynamic_config.yml" experimental: plugins: badger: moduleName: "github.com/fosrl/badger" version: "v1.2.0" log: level: "INFO" format: "common" certificatesResolvers: letsencrypt: acme: httpChallenge: entryPoint: web email: my.email@gmail.com storage: "/letsencrypt/acme.json" caServer: "https://acme-v02.api.letsencrypt.org/directory" entryPoints: web: address: ":80" websecure: address: ":443" transport: respondingTimeouts: readTimeout: "30m" http: tls: certResolver: "letsencrypt" serversTransport: insecureSkipVerify: true ping: entryPoint: "web" ``` dynamic-config.yml ```dynamic-config.yml http: middlewares: redirect-to-https: redirectScheme: scheme: https routers: main-app-router-redirect: rule: "Host(`some.domain.com`)" service: next-service entryPoints: - web middlewares: - redirect-to-https next-router: rule: "Host(`some.domain.com`) && !PathPrefix(`/api/v1`)" service: next-service entryPoints: - websecure tls: certResolver: letsencrypt api-router: rule: "Host(`some.domain.com`) && PathPrefix(`/api/v1`)" service: api-service entryPoints: - websecure tls: certResolver: letsencrypt ws-router: rule: "Host(`some.domain.com`)" service: api-service entryPoints: - websecure tls: certResolver: letsencrypt services: next-service: loadBalancer: servers: - url: "http://pangolin:3002" api-service: loadBalancer: servers: - url: "http://pangolin:3000" ``` 2. Open Dashboard 3. Create a site with address from 100.90.128.0/24 subnet 4. Connect to site via newt ```powershell ./newt.exe --id {ID} --secret {SECRET} --endpoint https://some.domain.com ``` 5. Create a resource (for example http://127.0.0.1:3004 -> https://website.domain.com) 6. See periodic connections and failures: ``` INFO: 2025/09/07 06:53:24 Newt version 1.4.4 INFO: 2025/09/07 06:53:24 Creating new health check monitor with certificate enforcement: false INFO: 2025/09/07 06:53:25 Websocket connected INFO: 2025/09/07 06:53:25 Requesting exit nodes from server INFO: 2025/09/07 06:53:25 Received ping message INFO: 2025/09/07 06:53:25 Received registration message INFO: 2025/09/07 06:53:25 Connecting to endpoint: some.domain.com INFO: 2025/09/07 06:53:25 Initial connection test successful INFO: 2025/09/07 06:53:25 Tunnel connection to server established successfully! INFO: 2025/09/07 06:53:25 Successfully added 0 health check targets INFO: 2025/09/07 06:53:47 Started tcp proxy to 127.0.0.1:3004 WARN: 2025/09/07 06:53:59 Periodic ping failed (2 consecutive failures): all 2 ping attempts failed, last error: failed to read ICMP packet: i/o timeout WARN: 2025/09/07 06:54:12 Periodic ping failed (3 consecutive failures): all 2 ping attempts failed, last error: failed to read ICMP packet: i/o timeout WARN: 2025/09/07 06:54:29 Periodic ping failed (4 consecutive failures): all 2 ping attempts failed, last error: failed to read ICMP packet: i/o timeout WARN: 2025/09/07 06:54:29 Connection to server lost after 4 failures. Continuous reconnection attempts will be made. INFO: 2025/09/07 06:54:29 Received ping message INFO: 2025/09/07 06:54:29 Received registration message INFO: 2025/09/07 06:54:29 Stopping ping check INFO: 2025/09/07 06:54:29 Connecting to endpoint: some.domain.com INFO: 2025/09/07 06:54:29 Initial connection test successful INFO: 2025/09/07 06:54:29 Tunnel connection to server established successfully! INFO: 2025/09/07 06:54:29 Successfully added 0 health check targets INFO: 2025/09/07 06:54:29 Started tcp proxy to 127.0.0.1:3004 ... ``` # Expected Behavior Connection should not be canceled randomly and https://website.domain.com should be accessible # Actual Behavior Connection always drops, all I could sometimes get is the title of website on https://website.domain.com and then nothing # Environment Pangolin Version: latest (1.9.4), also tried 1.8.0 Newt Version: 1.4.4 Deployment: Docker Compose on VPS (fosrl/pangolin) OS: Debian 12.2.0-14+deb12u1 # Additional Context Ports 80, 443, 51820 and 21820 are open and available on VPS. One of my friends has the exact same problem. Thank you very much in advance for your help!

MrUnknownDE closed this issue

2026-04-05 18:02:59 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#954