Connection stuck in "Registering" state

[alimbada]

Describe the Bug

I've updated my iOS client to the latest version from the App Store and when attempting to connect it stays stuck in the Registering state. Switching to the State tab shows the Status as Connected. Newt version is 1.9.0. Cloud dashboard shows the site is Online but iOS client as Disconnected.

I have attempted to logout from the app and login again to no avail.

Environment

• OS Type & Version: iOS 18.7.1
• Pangolin Version: Cloud
• Newt Version: 1.9.0
• Client Version: 0.6.1 (13)

To Reproduce

• Create site and connect with Newt 1.9.0
• Install Pangolin client on iOS 18.7.1
• Login to iOS client
• Connect

Expected Behavior

Connection should be established.

[oschwartz10612]

Could you try again now and let me know if its the same? Also, make sure your vpn extension is still installed.

[alimbada]

Yes, it is still the same. The VPN extension is installed and shows as connected in iOS settings yet I cannot connect to any of my internal resources. I am using both DNS Override and DNS Over Tunnel in the client settings. Primary upstream DNS server is set to the IPv4 address of a private host resource and the remote network is also defined as a private CIDR resource.

This setup worked prior to the latest iOS update. The Sites tab in the cloud dashboard tells me there is an update for Newt which I wasn't able to update as I couldn't login remotely during the day. I will be away for an extended period of time in a few days with only my phone and don't want to be stuck without access.

[alimbada]

I've now updated Newt to 1.10 and attempted to connect from iOS again but failed again. I also turned off both the DNS settings and tried with the same outcome.

[alimbada]

I had a look at the client details in the dashboard and noticed the Last Seen field is up to date with my recent connection attempts. However, the Status field shows as Offline

[hargeys]

Issue:
The Pangolin iOS app connects successfully on iPhone over Cellular (5G), but fails to complete the handshake on iPad over the exact same Cellular network (Three UK 5G). Both devices work perfectly on Wi-Fi.
Environment: Server: Pangolin v1.16.0 (Self-hosted), Device A (Works): iPhone (iOS 26.3) - Three UK 5G physical SIM, Device B (Fails): iPad (iPadOS 26.3) - Three UK 5G (eSIM)

[eiacub]

I have the same issue since updating to the latest version (0.6.2 (14)). last night it miraculously connected for a short time. Now when trying to connect the client is stuck in the registering state and on the server I see these in the logs:
Establishing websocket connection Client added to tracking - OLM ID: xxxxxxxxxx6l2c5, Connection ID: xxxxxxxxxx, Total connections: 1, Config version: 22 WebSocket connection fully established and ready - OLM ID: xxxxxxxxxx6l2c5 Handling register olm message! Public key mismatch. Updating public key and clearing session info... Client last hole punch is too old and we have sites to send; skipping this register Handling register olm message! Client last hole punch is too old and we have sites to send; skipping this register ................................... All connections removed for OLM ID: xxxxxxxxxx6l2c5 Client disconnected - OLM ID: xxxxxxxxxx6l2c5

on the server side, I have restarted, updated traefik to v3.6.11, badger to v1.4.0, newt at v1.10.3, everything else is at the latest version.
ports UDP 51820, 21820 and TCP 80, 443 opened and accessible

[eiacub]

This is quite strange, when connected to home WiFi, it connects. When on connected to cell phone data, it does not.

It does not work also when connected to office WiFi network.

I have tried with 2 different cell service providers.

I have not setup anything special with regulars to pangolin in my home network.

So I suspect last knight connection working is due to me being connected to home WiFi.

[LaurenceJJones]

This is quite strange, when connected to home WiFi, it connects. When on connected to cell phone data, it does not.

It does not work also when connected to office WiFi network.

I have tried with 2 different cell service providers.

I have not setup anything special with regulars to pangolin in my home network.

So I suspect last knight connection working is due to me being connected to home WiFi.

Yeah being stuck at registering is typically because its attempting to hole punch through to the site but there an issue.

Some people have found that celluar networks are using primarily ipv6 NAT so this will impact you if your server doesnt have ipv6 address, also on your office wifi they may have restrictions on which ports can be sent outbound. (we cant hole punch or relay if the firewall you are behind is dropping everything that not 53, 80 or 443 which on corporate environments is very common)

I have brought this up to Owen which we will investigate the being stuck, but it will not fix the issue I presented above.

[devdracon]

Laurence, thank you for looking into this issue.

To add to your post, I’d like to mention that my server has both a v4 and a v6 address, and all my clients (Windows/iOS) are experiencing the problem as described. (This was already the case with Newt 1.10.1; I’m currently running 1.10.3)

The issue first became apparent with the update from Pangolin to 1.16.2.

Please let me know if I (we) can assist you further with logs, etc.

[eiacub]

This is quite strange, when connected to home WiFi, it connects. When on connected to cell phone data, it does not.

It does not work also when connected to office WiFi network.

I have tried with 2 different cell service providers.

I have not setup anything special with regulars to pangolin in my home network.

So I suspect last knight connection working is due to me being connected to home WiFi.

Yeah being stuck at registering is typically because its attempting to hole punch through to the site but there an issue.

Some people have found that celluar networks are using primarily ipv6 NAT so this will impact you if your server doesnt have ipv6 address, also on your office wifi they may have restrictions on which ports can be sent outbound. (we cant hole punch or relay if the firewall you are behind is dropping everything that not 53, 80 or 443 which on corporate environments is very common)

I have brought this up to Owen which we will investigate the being stuck, but it will not fix the issue I presented above.

Hi Laurence, thanks for looking at this. Both cell providers use ipv4 only and the VPS where pangolin is tuning is dual stack. For my office network, it is unmanaged still and nothing is being filtered, absolutely sure about it because I am the only one that is pushing installing a managed network :)

Also, I din not update my windows client and it is connescting perfectly.

[SloudPL]

i have a theory, some low quality isp's and mobile networks use 100.x.x.x ip addreses and from what i know pangolin by first setup gives 100.90.0.0/24 subnet maybe the routes are breaking because there is some type of conflict because it works perfectly on some isp's and it doesn't work on some. Just a theory im not sure about it.

[eiacub]

i have a theory, some low quality isp's and mobile networks use 100.x.x.x ip addreses and from what i know pangolin by first setup gives 100.90.0.0/24 subnet maybe the routes are breaking because there is some type of conflict because it works perfectly on some isp's and it doesn't work on some. Just a theory im not sure about it.

In both cases I get a white, external IP address

[devdracon]

...there may be an coherence? [BUG] DNS over tunel on iOS app does not work. #28

[SloudPL]

I noticed that some VPS provider(hosting) have anti ddos protection and on some you can turn it off and on some you can't i noticed that when i turned off the ddos protection i was able to register and connect so i think it's because of how some ddos protections work on some Hosting Companies, because i buyed 3 vpses and on 2 of them it couldn't register but on the third vps i could connect without problems, and on one of the vpses that it was broken when i turned antiddos protection it started working, i think some ddos protections sees pangolin client traffic as bad traffic and block it.