Guide: Fix Slow or Bursty Speed in Pangolin When Using Newt Tunnels
Many users have problems with slow speeds or “bursty” behavior (fast at first, then stalls or buffering) when using Newt sites in Pangolin. This happens a lot with streaming videos, big file downloads, or long connections. Short connections or low-speed flows are usually fine.
The main reasons from the discussion:
- Newt runs in user space, so it can be slower under heavy load.
- Problems with how packets are split (fragmentation) and MTU settings cause stalls.
- Other things like Docker overhead can make it worse.
The best fix that worked for many users is to switch to a Basic WireGuard Site. This uses the normal kernel WireGuard, which is faster and more stable for big data flows.
Here is a step-by-step guide to set it up. Follow carefully.
Step 1: Create a Basic WireGuard Site in Pangolin
-
Go to your Pangolin dashboard.
-
Create a new Site and choose Basic WireGuard type (not Newt).
-
Pangolin will give you a WireGuard config file (like wg0.conf).
-
On your home network (where your services run), set up WireGuard on a gateway. This can be:
- A Linux host machine
- A VM
- An LXC container
- Or a Docker container (see special notes below if using a container as the peer)
-
Bring up the tunnel:
wg-quick up wg0(or the file name given). -
Check if it connects:
wg show- You should see a handshake and data transfer.
-
Note: On the Pangolin server side, the WireGuard interface (wg0) often runs inside the gerbil Docker container. You can check it with:
docker exec -it gerbil ip -br addr- Look for wg0 with an IP like 100.89.x.x/24.
Step 2: Point Your Resource to the WireGuard Peer IP
- In Pangolin, edit your resource (the service you want to access).
- Set the Target/Upstream to the WireGuard IP of your home gateway peer, not your local LAN IP.
- Example:
https://100.89.x.x:PORT(use the peer IP from your config).
- Example:
- Do NOT use your home LAN IP like 192.168.x.x directly.
Step 3: Set Up Routing and Rules on Your Home WireGuard Peer
- Edit the WireGuard config file on your peer (
/etc/wireguard/wg0.confor wherever you saved it). - Add these lines (replace placeholders):
<WG_PEER_IP_CIDR>: Your WireGuard IP with subnet, like 100.89.x.x/32<TARGET_IP>: The real LAN IP of your service (or Docker host IP if service is in Docker)<PORT>: The port your service useseth0: Your main network interface (change if different; in Docker, it might be different – see below)
[Interface]
Address = <WG_PEER_IP_CIDR>
PrivateKey = your_private_key_here
MTU = 1280 # Important! Keeps it low to avoid problems
PostUp = sysctl -w net.ipv4.ip_forward=1
PostUp = iptables -t nat -A PREROUTING -i %i -p tcp --dport <PORT> -j DNAT --to-destination <TARGET_IP>:<PORT>
PostUp = iptables -t nat -A POSTROUTING -o eth0 -p tcp -d <TARGET_IP> --dport <PORT> -j MASQUERADE
PostUp = iptables -A FORWARD -i %i -o eth0 -p tcp -d <TARGET_IP> --dport <PORT> -j ACCEPT
PostUp = iptables -A FORWARD -i eth0 -o %i -p tcp -s <TARGET_IP> --sport <PORT> -j ACCEPT
# This fixes the stall problem
PostUp = iptables -t mangle -A FORWARD -i %i -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostUp = iptables -t mangle -A FORWARD -o %i -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
# Cleanup when WireGuard stops
PostDown = iptables -t nat -D PREROUTING -i %i -p tcp --dport <PORT> -j DNAT --to-destination <TARGET_IP>:<PORT>
PostDown = iptables -t nat -D POSTROUTING -o eth0 -p tcp -d <TARGET_IP> --dport <PORT> -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -o eth0 -p tcp -d <TARGET_IP> --dport <PORT> -j ACCEPT
PostDown = iptables -D FORWARD -i eth0 -o %i -p tcp -s <TARGET_IP> --sport <PORT> -j ACCEPT
PostDown = iptables -t mangle -D FORWARD -i %i -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostDown = iptables -t mangle -D FORWARD -o %i -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
- Save and restart:
wg-quick down wg0 && wg-quick up wg0
If You Are Using a WireGuard Sidecar Container as the Peer
Some users run the WireGuard peer inside a Docker container (called a “sidecar” setup). This is common if your services are in Docker.
- Run a lightweight WireGuard container with NET_ADMIN capability.
- Example using a popular image like
linuxserver/wireguardor a simple one:docker run -d \ --name=wg-peer \ --cap-add=NET_ADMIN \ --cap-add=NET_RAW \ -v /path/to/wg0.conf:/config/wg0.conf \ -e PUID=1000 -e PGID=1000 \ linuxserver/wireguard - Or use
wg-quickin a custom container. - Important changes:
- The outgoing interface (%o) may not be “eth0”. Check inside the container:
ip link - Replace “eth0” in PostUp/PostDown with the correct one (often “eth0” still works, but test).
- For forwarding to work, the container needs access to the host network or Docker network.
- Best option: Use
--network=hostfor the WireGuard container so it can forward to your services easily. - If services are in other containers, use Docker networks or host networking.
- iptables rules go inside the container (add them to the config as shown).
- The outgoing interface (%o) may not be “eth0”. Check inside the container:
This container setup works like a VM/LXC but inside Docker. Test the rules carefully.
Step 4: Make It Start Automatically
- If on host/VM/LXC:
systemctl enable --now wg-quick@wg0 - If in Docker: Use
--restart unless-stoppedin your docker run/compose.
Step 5: Check Everything Works
- MTU should stay at 1280:
- Run:
ip -d link show wg0 | grep mtu(or inside container: docker exec …) - If it changes to 1420, stalls may come back.
- Run:
- Check rules:
iptables -t nat -S | grep <PORT>iptables -t mangle -S | grep TCPMSS
- Test your service through Pangolin. Speeds should be steady, no bursts or stalls.
Extra Tips
- If you have many services, add more DNAT lines for each port.
- This setup uses kernel WireGuard, so it handles high speeds better than Newt.
- If you still have issues, check your VPS bandwidth, ISP, or try a different VPS location.
- Newt may get better in future updates, but this fix works well now.
This should give you smooth, fast access. The sidecar container option is great if you already use Docker a lot. If you need help with a specific part, ask!