Same network detection VLAN config

[txwgnd]

Hello everybody,

with Pangolin's newest release a feature was brought to us that enables direct traffic between clients and sites if they are on the same network. I was wondering how this is going to be monitored/initiated by the application. In my case I have a site one one VLAN and all my clients on another. Does anybody know what is needed in terms of configuration, so that Pangolin and the clients are able to initiate a local/direct connection?

Cheers

[spaceXrace]

Would also be interested in this. This always worked automatically for me with Tailscale and Netbird, would be awesome if Pangolin supported this too.

Currently I get no direct connection with site / clients in different VLANs (the site is locally reachable from the clients):

INFO: 2026/07/21 13:31:25 WireGuard device created.
INFO: 2026/07/21 13:31:25 Rapid test: site 1 holepunch SUCCEEDED on attempt 1 (RTT: 48.958473ms)
INFO: 2026/07/21 13:31:26 Rapid test: no local endpoint reachable for site 1

[oschwartz10612]

When establishing local connections at work, the following information may help you determine the necessary adjustments to allow a VLAN connection: Newt collects a set of IP addresses from the interfaces of the host on which it is running. If it is running within a Docker container, it will only detect the container's internal network; therefore, it is recommended to run it on the local host to ensure it can identify the host's actual IP addresses. Using these addresses, the client attempts to send UDP test packets to Newt's listening port. If any of these packets complete a round trip, it can be confirmed that a local connection is possible and establishes the link. Even if devices are on different VLANs, the connection should be successful provided that the routing is correctly configured.

[spaceXrace]

Thanks for the additional information!

I set network_mode: host for the Newt container.

EDIT: The issue below is fixed! Working perfectly across VLANs. No additional configuration required.

I had a private resource on my Newt site (which is on 192.168.1.2), with the destination also being 192.168.1.2. This caused a collision:

INFO: 2026/07/23 09:38:55 Adding route to 192.168.1.2/32 via interface pangolin

causing Pangolin Client to either fall back to the external route, or use the external IPv6 as local endpoint:

WARN: 2026/07/23 09:39:06 Local endpoint 192.168.1.2:60581 for site 1 failed 3 times, falling back to public/relay logic

---

Original Post:

Now I’m getting a “local” connection with any external IPv6 being the endpoint. The WireGuard connection always disconnects after a few seconds, on the second attempt it remains connected.

INFO: 2026/07/21 13:13:29 Rapid test passed for site 1, using direct connection
INFO: 2026/07/21 13:13:29 Local endpoint [2a0d:…]:53223 for site 1 is reachable (RTT: 2.287284ms), switching to local connection
INFO: 2026/07/21 13:13:29 Switched peer 1 to local connection at [2a0d:…]:53223
INFO: 2026/07/21 13:13:29 Sent local-connection message for site 1 ([2a0d:…]:53223, chain 180a455ade880f4d)
INFO: 2026/07/21 13:13:29 Cancelled local-connection sender for chain 180a455ade880f4d
INFO: 2026/07/21 13:13:31 WireGuard connection to site 1 is CONNECTED (RTT: 443.331925ms)
WARN: 2026/07/21 13:13:53 WireGuard connection to site 1 is DISCONNECTED
INFO: 2026/07/21 13:13:55 WireGuard connection to site 1 is CONNECTED (RTT: 2.602451344s)

The connection is very slow. Without Pangolin Client I get over 600 Mbit/s in iperf3. With Pangolin Client’s supposedly local connection to my IPv6 I’m below 20 Mbit/s.