pangolin_mirror/docs-v2
1
0
Fork 0
mirror of https://github.com/fosrl/docs-v2.git synced 2026-10-20 19:49:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

remove some language

Browse Source
This commit is contained in:
Owen
2026-06-26 10:58:38 -04:00
parent 48a360c929
commit 11e92b8bec
4 changed files with 12 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
manage/clients/firewalls/opnsense.mdx
+1 -28
View File
@@ -17,7 +17,7 @@ Use this guide if clients behind OPNsense are frequently relayed instead of conn
- Ability to edit NAT and service settings - Ability to edit NAT and service settings
- A way to verify Pangolin connection mode after changes - A way to verify Pangolin connection mode after changes
## Option 1: Static outbound UDP mapping ## Static outbound UDP mapping
This approach keeps outbound source ports predictable so UDP hole punching succeeds more often. This approach keeps outbound source ports predictable so UDP hole punching succeeds more often.
@@ -28,33 +28,6 @@ This approach keeps outbound source ports predictable so UDP hole punching succe
5. Enable **Static Port** in the translation section. 5. Enable **Static Port** in the translation section.
6. Save and apply changes. 6. Save and apply changes.
<Note>
Image description from the source references: the Outbound NAT page showing a UDP rule with static-port translation enabled, created in hybrid mode and applied at the top of the outbound rules list.
</Note>
## Option 2: NAT-PMP
If your environment allows it, NAT-PMP can let clients request temporary UDP mappings dynamically.
1. Open **Services > Universal Plug and Play**.
2. Enable NAT-PMP support.
3. Keep the scope as narrow as your policy allows.
4. Apply changes.
<Warning>
NAT-PMP can improve connectivity, but may broaden mapping behavior. Use restricted ACLs and network segmentation where possible.
</Warning>
<Note>
Image description from the source references: the UPnP/NAT-PMP settings panel with NAT-PMP allowed, indicating dynamic mapping is enabled for LAN clients.
</Note>
## Optional: Running Tailscale plugin on OPNsense
Source material notes that recent OPNsense releases include an `os-tailscale` community plugin. That workflow is specific to Tailscale installations on the firewall itself and is separate from Pangolin client/site tuning.
For Pangolin, prioritize the NAT behavior changes above.
## Validate the result ## Validate the result
1. Reconnect a Pangolin client. 1. Reconnect a Pangolin client.
manage/clients/firewalls/overview.mdx
+1 -18
View File
@@ -23,12 +23,7 @@ Direct paths usually mean:
- Better throughput - Better throughput
- Less relay traffic on your Pangolin infrastructure - Less relay traffic on your Pangolin infrastructure
## Security and performance trade-off Learn more about how [Pangolin NAT hole punching works](https://pangolin.net/news/nat-holepunching).
Some changes that improve direct connectivity can also widen inbound mapping behavior. Review each setting with your security team before enabling it globally.
- NAT-PMP or UPnP can increase exposure if left broad
- Static or persistent port translation can improve predictability, but should be scoped to known traffic when possible
## Connection behavior quick guide ## Connection behavior quick guide
@@ -43,15 +38,3 @@ Some changes that improve direct connectivity can also widen inbound mapping beh
- [OPNsense guide](/manage/clients/firewalls/opnsense) - [OPNsense guide](/manage/clients/firewalls/opnsense)
- [pfSense guide](/manage/clients/firewalls/pfsense) - [pfSense guide](/manage/clients/firewalls/pfsense)
- [Palo Alto Networks guide](/manage/clients/firewalls/palo-alto) - [Palo Alto Networks guide](/manage/clients/firewalls/palo-alto)
## Verifying impact
After applying changes:
1. Reconnect the client and site.
2. Check connection status in the Pangolin client JSON view or `pangolin status`.
3. Confirm more sessions are direct and fewer are relayed.
<Note>
Image description from the source references: a summary banner showing that direct peer-to-peer is preferred, with relay as fallback when NAT policies prevent direct UDP paths.
</Note>
manage/clients/firewalls/palo-alto.mdx
+4 -15
View File
@@ -28,10 +28,6 @@ Prefer **Persistent Dynamic IP and Port** for NAT policies handling Pangolin tra
This keeps NAT behavior more consistent per client flow and improves direct-connect success. This keeps NAT behavior more consistent per client flow and improves direct-connect success.
<Note>
Image description from the source references: NAT Policy Rule editor on the Translated Packet tab, with Translation Type set to Persistent Dynamic IP and Port.
</Note>
## Selective policy approach ## Selective policy approach
If you cannot apply persistent translation globally, scope it to Pangolin UDP traffic only. If you cannot apply persistent translation globally, scope it to Pangolin UDP traffic only.
@@ -41,10 +37,6 @@ If you cannot apply persistent translation globally, scope it to Pangolin UDP tr
3. Apply persistent translation only for matching traffic. 3. Apply persistent translation only for matching traffic.
4. Commit and test. 4. Commit and test.
<Note>
Image description from the source references: one screen shows a custom UDP service definition with timeout tuning; another shows that service selected in NAT policy match criteria.
</Note>
## Earlier PAN-OS releases ## Earlier PAN-OS releases
If your version does not support persistent dynamic translation, a **Static IP** NAT policy can improve direct connectivity for selected high-value nodes (for example, a frequently used subnet or gateway host). If your version does not support persistent dynamic translation, a **Static IP** NAT policy can improve direct connectivity for selected high-value nodes (for example, a frequently used subnet or gateway host).
@@ -53,12 +45,9 @@ If your version does not support persistent dynamic translation, a **Static IP**
- Set Translation Type to Static IP - Set Translation Type to Static IP
- Scope rules tightly and test - Scope rules tightly and test
<Note>
Image description from the source references: older NAT policy editor where Translation Type is set to Static IP instead of Dynamic IP and Port.
</Note>
## Validate the result ## Validate the result
1. Reconnect Pangolin clients and sites. 1. Reconnect a Pangolin client.
2. Check whether previously relayed sessions now establish direct paths. 2. Check the site entry in client status (`isRelay` in JSON view or `RELAY` column in CLI).
3. Keep monitoring for policy side effects or unintended exposure. 3. Compare before/after to confirm improved direct connectivity.
manage/clients/firewalls/pfsense.mdx
+5 -29
View File
@@ -17,7 +17,7 @@ Use this guide if clients behind pfSense regularly fall back to relay.
- Permission to change outbound NAT and service settings - Permission to change outbound NAT and service settings
- A test client/site pair to validate results - A test client/site pair to validate results
## Option 1: Static outbound UDP mapping ## Static outbound UDP mapping
Static outbound mapping improves source-port consistency, which helps UDP hole punching. Static outbound mapping improves source-port consistency, which helps UDP hole punching.
@@ -28,33 +28,9 @@ Static outbound mapping improves source-port consistency, which helps UDP hole p
5. Enable **Static Port** translation. 5. Enable **Static Port** translation.
6. Save and apply. 6. Save and apply.
<Note>
Image description from the source references: pfSense outbound NAT screen with a UDP rule in hybrid mode and static-port translation enabled.
</Note>
## Option 2: NAT-PMP
For compatible environments, NAT-PMP can allow temporary port mappings for clients.
1. Open **Services > UPnP & NAT-PMP**.
2. Enable NAT-PMP mapping.
3. Limit allowed interfaces and clients where possible.
4. Save and apply changes.
<Warning>
NAT-PMP and UPnP can reduce relay usage but should be scoped carefully to avoid opening unnecessary mapping paths.
</Warning>
<Note>
Image description from the source references: the pfSense UPnP & NAT-PMP settings page with NAT-PMP enabled.
</Note>
## Newer pfSense behavior
The source references newer pfSense builds adding endpoint-independent style outbound NAT options. If available in your version, test these features in a controlled environment before broad rollout.
## Validate the result ## Validate the result
1. Reconnect Pangolin clients. 1. Reconnect a Pangolin client.
2. Inspect connection mode in client status. 2. Check the site entry in client status (`isRelay` in JSON view or `RELAY` column in CLI).
3. Confirm direct sessions increase and relay sessions decrease. 3. Compare before/after to confirm improved direct connectivity.