Client - Issues, Questions, Feature Requests

[Lokowitz]

Hi @oschwartz10612 @miloschwartz ,

the last days i did a lot of testing with the new clients feature and i want to summarize my experience, issues, questions and feature requests.
Very like your project and i hope it is getting big ❤️

Setups

Setup 1

Newt (192.168.178.164) running native with --accept-client
Olm (192.168.10.7) running native
Raw Resource 8807:192.168.178.218:8007

root@deb-olm:~# curl 100.90.128.5:8807 -v
*   Trying 100.90.128.5:8807...
* Connected to 100.90.128.5 (100.90.128.5) port 8807 (#0)
> GET / HTTP/1.1
> Host: 100.90.128.5:8807
> User-Agent: curl/7.88.1
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< location: https://100.90.128.5:8807
< content-length: 0
< date: Sun, 17 Aug 2025 15:08:48 GMT
< 
* Connection #0 to host 100.90.128.5 left intact

--> working

Setup 2

Newt (192.168.178.164) running native with --accept-client --native
Olm (192.168.10.7) running native
Raw Resource 8807:192.168.178.218:8007

Try to connect via pangolin network ip:

root@deb-olm:~# curl 100.90.128.5:8807 -v
*   Trying 100.90.128.5:8807...
* connect to 100.90.128.5 port 8807 failed: Connection refused
* Failed to connect to 100.90.128.5 port 8807 after 54 ms: Couldn't connect to server
* Closing connection 0
curl: (7) Failed to connect to 100.90.128.5 port 8807 after 54 ms: Couldn't connect to server

Added subnet 192.168.178.0/24 to site:

Aug 17 15:10:12 deb-olm olm[1642]: WARN: 2025/08/17 15:10:12 Peer 11 is disconnected
Aug 17 15:10:17 deb-olm olm[1642]: INFO: 2025/08/17 15:10:17 Started monitoring for site 11 at 100.90.128.5:63854
Aug 17 15:10:17 deb-olm olm[1642]: INFO: 2025/08/17 15:10:17 Successfully updated peer for site 11
Aug 17 15:10:19 deb-olm olm[1642]: INFO: 2025/08/17 15:10:19 Peer 11 is now connected (RTT: 63.619417ms)
Aug 17 15:14:34 deb-olm olm[1642]: WARN: 2025/08/17 15:14:34 Peer 11 is disconnected
Aug 17 15:14:42 deb-olm olm[1642]: INFO: 2025/08/17 15:14:42 Started monitoring for site 11 at 100.90.128.5:63242
Aug 17 15:14:42 deb-olm olm[1642]: INFO: 2025/08/17 15:14:42 Running command: /usr/sbin/ip route add 192.168.178.0/24 dev olm
Aug 17 15:14:42 deb-olm olm[1642]: INFO: 2025/08/17 15:14:42 Added route for remote subnet: 192.168.178.0/24
Aug 17 15:14:42 deb-olm olm[1642]: INFO: 2025/08/17 15:14:42 Successfully updated peer for site 11
Aug 17 15:14:43 deb-olm olm[1642]: INFO: 2025/08/17 15:14:43 Peer 11 is now connected (RTT: 64.41911ms)

run sysctl -w net.ipv4.ip_forward=1

Try to connect via remote network ip:

root@deb-olm:~# curl 192.168.178.218:8007 -v
*   Trying 192.168.178.218:8007...

--> not working
I don't know why but native mode is not working for me.

use case for clients

1. mobile devices like smart phone or laptop -> they don't need authentification regarding pangoling resources since they are connected via secure wg/olm tunnel.
2. I want to install the clinet on my friends and families proxmox server, so that they can backup there system to my proxmox backup server. But i dont want, that they can acces any other resource on my network. So limiting the access to resources for each client would be necessary

feature requests

1. native wireguard client instead of olm for mobile devices -> would be nice to use the basic wireguard app and access all resources without authentification
2. access control for clients, currently they have no limitations, just the site they can reach. Maybe assign them to a user and/or group.
3. site2site connection for newt -> since newt is now wg server and client it should be nice to set up a site2site connection so that i can set a ip route of the remote network in my router to the ip adress of newt. Currently i am running a separat wg server and client connection between my newt sites. but i think some more natting would be required like

PostUp = iptables -A FORWARD -i newt -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i newt -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Thnaks for all of your hard work, appreciated!!
Marvin

[YNYXYNY]

Me and @Lokowitz seem to be on a similar schedule. i'm having alot of fun putting caddy reverse proxies on the ends of newts and all the possibilities that creates. Here here thank you everyone for this wonderful piece of software.

[oschwartz10612]

Hi! Thanks so much for testing out the clients! Sorry for the delay here! So this probably needs to be documented better, but in Setup 2 the reason it is not working is because the raw proxy does not apply in native mode. In native mode a interface is created on the host so there is nothing that needs to be proxied out of user space to another machine. The idea here was to return control to the OS to handle routing however you want. So in this case the way to make this work would be to configure a remote subnet https://docs.digpangolin.com/manage/clients/add-client#remote-subnets. This adds a route to the olm to send a /24 or whatever network over the tunnel. THEN on the newt side you would enable forwarding and then set up NAT or routing on the network so when a packet reaches the destination it either has the source of the newt host or knows how to route back over the tunnel. For these reasons I think the non-native mode is probably easier unless you want to build a routed tunnel. Love the feature requests. Want to get to these at some point. Would you be able to break them out into separate features in the discussions so people could upvote? I think we already have one for the mobile app :} I think you could do the buddy backup already maybe with the raw resources and --holepunch but let me know.

[Lokowitz]

Ok with the new documentation i got it now working.
With net.ipv4.ip_forward = 1 and iptables -t nat -A POSTROUTING -j MASQUERADE i can reach all ip's behind newt.

I was also able to use olm as an entry point for site2site connection so i can now connect from
192.168.10.0/24 -> olm -> newt -> 192.168.178.0/24
and
192.168.178.0/24 -> olm -> newt -> 192.168.10.0/24
Static route for subnet of other site is set to the olm ip in the router.

By running newt with docker the folling changes needs to be made:

services:
  newt:
    image: fosrl/newt
    container_name: newt
    restart: unless-stopped
    environment:
      ...
      - USE_NATIVE_INTERFACE=true
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    network_mode: host

[oschwartz10612]

Are you interested in a quick PR to the docs-v2 to add this? Glad you got it working! :}