pangolin: internal server error trying to proxy home assistant

[StephanStrunk]

Hi,
pangolin works fine with my infrastructure and some application except to home assistant. Here I get the message "internal server error". I've used the same seeting compared to other applications in my local network and checked the settings of home assistant - I have no idea what to change or where to look at.

Here ist my setup:

• pangolin (beta 12) on a Cloudserver (Ionos) with ubuntu 24.04
• newt on my Synology NAS
• Network is a dslite (no dual stack, Provider Deutsche Glasfaser) - Router behind a CGNat
• Access to devices/application in my local network work with the fritzbox given external ipv4 plus port (different external ipv4 from internal ipv4)

I used the same appoach for home assiatant but got the mentioned error. Home assistant runs on a separate mini-computer, system is open to external ipv4 (which is the internal).

Has anyone an idea ?

Thanks

Stephan

[manilx]

You have to add your Newt server as proxy in HA configuration.yaml:

### Allow connections from proxy ####
http:
  use_x_forwarded_for: true
  trusted_proxies:
    # Newt
    - NEWTIP

restart HA

[StephanStrunk]

Hi,Thanks, that sounds like the missing element.But I still make some mistake, because I still get the error message internal server error What I did 1) configuration.yaml: http: use_x_forwarded_for: true trusted_proxies:  # Newt   - 192.168.xx.xxx (Ip of my NAS wer pangolin runs as docker compose)   2) Pangolin-Webserver: Ressource with external ipv4 of home assistant and port defined at my router. Connection as https(Http causes 400: bad Gateway) 3) router: Definition of a Port (Typ TCP) for access ipv4&6 to homeassistant

[scriptlessnl]

You have to use an internal IP for your resource, not the external WAN-ip. The whole idea of the Pangolin solution is to make your resources available without needing to open ports on the WAN side.

[StephanStrunk]

I know and tried that as the first approach. But the internal IPv4s are not accassible (I guess a a dslite-problem).
Another way is to define exception from the DNS-Rebind-Protection in the FRITZ!Box rules. But this is not recommended …-

[StephanStrunk]

I'm still trying to understand the problem. My understanding is - looking at the infrastructur pictur below - that pangolin connect to newt at my local network. Inside my local network there is no need for an external ipv4 (WAN).
Using the Fritzbox "Wireguard" this works with local ipv4.
Could that be a wrong entry in newt on my NAS )

[steuerlexi]

have you found a solution yet? I have the same setup and still get the no available error

[StephanStrunk]

No sorry; no one seems to have this problem or solved it. The only way is the external WAN. What I haven’t tried so far is using WireGuard instead of newt. Maybe someone has experienced this ? What is the difference ?

[DragonballPS]

I ran into this issue but in my debian LXC container. You need to use the internal Newt tunnel IP address. Hope this helps someone.

My setup: Pangolin on VPS. Newt in local hosted Proxmox Debian LXC with static ip - 192.168.10.214
Pangolin Target config - http, internal home assistant IP, port - 8123

1. Hit the Home Assistant URL configured in Pangolin
2. View the Home Assistant Core logs (Settings -> System -> Logs)
3. You'll probably see an error like ERROR (MainThread) [homeassistant.components.http.forwarded] Received X-Forwarded-For header from an untrusted proxy 192.168.10.214
4. In /homeassistant/configuration.yaml add (replace the ip address with your internal ip where Newt is running)

# Allows proxy traffic from Pangolin-Newt
http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 192.168.10.214

5. Check config and restart HA. After the restart, the URL should work now.

[samumatic]

I have the same issue, but HA is loading just fine in a browser.
But when connecting via HA app i get the Unable to connect to Home Assistant on the domain https://domain.com/lovelace?external_auth=1.
When disabling authentication it works, just as you described.

[StephanStrunk]

I have the authentification at pangolin disabled (ist was already). That seams not to be my problem. Still habe no idea....

[steuerlexi]

I have the same issue, but HA is loading just fine in a browser. But when connecting via HA app i get the Unable to connect to Home Assistant on the domain https://domain.com/lovelace?external_auth=1. When disabling authentication it works, just as you described.

Have you tried to set a rule for this? e.g. lovelace*

[samumatic]

Good suggestion, but it doesn't seem to make any difference for me.
I'm also documenting this Issue in #757.
I found an error message when debugging with eruda.

Error: External auth requires either externalApp or webkit defined on Window object.
at 27127 (https://my.domain.com/frontend_latest/4691.c6b510e7a63f5f16.js:1:1417)
at o (https://my.domain.com/frontend_latest/core.79a14ae7dd7b6dce.js:1:34311)

Whitelisting /frontend_latest* has also no effect.

[Peskinator]

Thanks @DragonballPS ! This worked on my side.
I also added the external URL in Settings/Systems/Network/Home Assistant URL
and set to HTTP in Pangolin, not HTTPS

[dringwald]

I have the same issue. I have Pangolin on a VPS, and Newt and Home Assistant running on two separate docker containers at home. Added the Newt container ip as a trusted proxy, and I'm getting the "Internal Server Error" response. Nothing is showing up in the Pangolin or Newt logs. In order to get something from Home Assistant, I had to add the following to my configuration.yaml:

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.20.0.2 # from docker
logger:
  default: warning # warning is the default. 
  logs:
    aiohttp: debug

and I get in the home assistant logs:

homeassistant  | 2025-05-19 12:37:10.465 DEBUG (MainThread) [aiohttp.server] Error handling request from 172.20.0.2
homeassistant  | Traceback (most recent call last):
homeassistant  |   File "/usr/local/lib/python3.13/site-packages/aiohttp/web_protocol.py", line 380, in data_received
homeassistant  |     messages, upgraded, tail = self._request_parser.feed_data(data)
homeassistant  |                                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^
homeassistant  |   File "aiohttp/_http_parser.pyx", line 558, in aiohttp._http_parser.HttpParser.feed_data
homeassistant  | aiohttp.http_exceptions.BadHttpMethod: 400, message:
homeassistant  |   Invalid method encountered:
homeassistant  |
homeassistant  |     b'\x16\x03\x01\x05\xba\x01'
homeassistant  |       ^
homeassistant  | 2025-05-19 12:37:10.610 DEBUG (MainThread) [aiohttp.server] Error handling request from 172.20.0.2
homeassistant  | Traceback (most recent call last):
homeassistant  |   File "/usr/local/lib/python3.13/site-packages/aiohttp/web_protocol.py", line 380, in data_received
homeassistant  |     messages, upgraded, tail = self._request_parser.feed_data(data)
homeassistant  |                                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^
homeassistant  |   File "aiohttp/_http_parser.pyx", line 558, in aiohttp._http_parser.HttpParser.feed_data
homeassistant  | aiohttp.http_exceptions.BadHttpMethod: 400, message:
homeassistant  |   Invalid method encountered:
homeassistant  |
homeassistant  |     b'\x16\x03\x01\x05\xba\x01'
homeassistant  |       ^

It seems to be an issue with the headers? But I don't have time to look more into it now. Hopefully this gets someone a little further on the issue.

[steuerlexi]

I think i found a way

Here is what i have set as bypass rules

and here is what needs to be written in the configuration.yml

http:
cors_allowed_origins:
- https://google.com
- https://www.home-assistant.io
ip_ban_enabled: true
login_attempts_threshold: 2
use_x_forwarded_for: true
trusted_proxies:
- 127.0.0.1
- Local IP of your NEWT instance
- VPS IP

[steuerlexi]

/api/*
/auth/*
/lovelace*
/static/*
/hacsfiles/*
/local/*

[tobiLearns]

Hi,
I had the same problem (saw only "Internal server error", when I opened the defined pangolin resource).

It worked, as soon, as I changed in pangolin the 'method' in the 'target'-definition from https -> http.

The resource URL is still defined with https and also when I open the resource website, which connects to my homeassistant, my browser says, the connection is secured.

But I'm not sure, if this configuration in pangolin is correct now or if I actually should select method https, as described on the pangolin website: https://docs.fossorial.io/Community%20Guides/homeassistant#exposing-home-assistant-through-addon

Does anyone know more here?

[Ferdinand99]

Could you also state what you recommend in terms of Pangolin authentication and rules method to have it properly working also on the android/iOS app?

And btw. Thank you for your work. I think it´s great to have HAOS as a seperate ressource in order to gain awesome performance :-)

Hi,

Yeah I'll update the documentation with the recommendations 😊

Love to see that you guys like the addon!

[tobiLearns]

Ah, ok. Good to know - thankyou.

Connecting via the app (IOS), unfortunately is still not working.
After entering my credentials and the 2FA, i get an error: NSCocoaErrorDomain 3840
I found this diskussion ( home-assistant/iOS#3511 ) and it sonds not very hopefully.

Edit: oh, I didn't recognize your last comments. So, I'm looking forward :-)

[Ferdinand99]

Ah, ok. Good to know - thankyou.

Connecting via the app (IOS), unfortunately is still not working. After entering my credentials and the 2FA, i get an error: NSCocoaErrorDomain 3840 I found this diskussion ( home-assistant/iOS#3511 ) and it sonds not very hopefully.

I see. I know there is also an issue having authentication through Pangolin where the mobile apps doesn't work as expected. I personally don't have 2fa on my home-assistant and I have authentication in Pangolin off for my Hassio domain

[steuerlexi]

I was wondering why the add-on is pinging so much. Is this a ping within the wireguard tunnel? Because i don´t recognize the IP. I think it´s probably the ping of the endpoint on pangolin on my VPS, correct?

/INFO: 2025/05/25 11:45:48 Ping latency: 13.985662ms
INFO: 2025/05/25 11:46:18 Pinging 100.89.xxx.x
INFO: 2025/05/25 11:46:18 Ping latency: 12.670556ms
INFO: 2025/05/25 11:46:48 Pinging 100.89.xxx.x
INFO: 2025/05/25 11:46:48 Ping latency: 13.269907ms
INFO: 2025/05/25 11:47:18 Pinging 100.89.xxx.x
INFO: 2025/05/25 11:47:18 Ping latency: 14.756573ms
INFO: 2025/05/25 11:47:48 Pinging 100.89.xxx.x
INFO: 2025/05/25 11:47:48 Ping latency: 11.910825ms
INFO: 2025/05/25 11:48:18 Pinging 100.89.xxx.x
INFO: 2025/05/25 11:48:18 Ping latency: 14.807205ms
INFO: 2025/05/25 11:48:48 Pinging 100.89.xxx.x
INFO: 2025/05/25 11:48:48 Ping latency: 12.707722ms
INFO: 2025/05/25 11:49:18 Pinging 100.89.xxx.x
INFO: 2025/05/25 11:49:18 Ping latency: 12.73326ms
INFO: 2025/05/25 11:49:48 Pinging 100.89.xxx.x
INFO: 2025/05/25 11:49:48 Ping latency: 14.580766ms
INFO: 2025/05/25 11:50:18 Pinging 100.89.xxx.x
INFO: 2025/05/25 11:50:18 Ping latency: 12.779915ms
INFO: 2025/05/25 11:50:48 Pinging 100.89.xxx.x
INFO: 2025/05/25 11:50:48 Ping latency: 12.994774ms
INFO: 2025/05/25 11:51:18 Pinging 100.89.xxx.x
INFO: 2025/05/25 11:51:18 Ping latency: 14.684528ms
INFO: 2025/05/25 11:51:48 Pinging 100.89.xxx.x
INFO: 2025/05/25 11:51:48 Ping latency: 14.372752ms

[Ferdinand99]

I was wondering why the add-on is pinging so much. Is this a ping within the wireguard tunnel? Because i don´t recognize the IP. I think it´s probably the ping of the endpoint on pangolin on my VPS, correct?

/INFO: 2025/05/25 11:45:48 Ping latency: 13.985662ms INFO: 2025/05/25 11:46:18 Pinging 100.89.xxx.x INFO: 2025/05/25 11:46:18 Ping latency: 12.670556ms INFO: 2025/05/25 11:46:48 Pinging 100.89.xxx.x INFO: 2025/05/25 11:46:48 Ping latency: 13.269907ms INFO: 2025/05/25 11:47:18 Pinging 100.89.xxx.x INFO: 2025/05/25 11:47:18 Ping latency: 14.756573ms INFO: 2025/05/25 11:47:48 Pinging 100.89.xxx.x INFO: 2025/05/25 11:47:48 Ping latency: 11.910825ms INFO: 2025/05/25 11:48:18 Pinging 100.89.xxx.x INFO: 2025/05/25 11:48:18 Ping latency: 14.807205ms INFO: 2025/05/25 11:48:48 Pinging 100.89.xxx.x INFO: 2025/05/25 11:48:48 Ping latency: 12.707722ms INFO: 2025/05/25 11:49:18 Pinging 100.89.xxx.x INFO: 2025/05/25 11:49:18 Ping latency: 12.73326ms INFO: 2025/05/25 11:49:48 Pinging 100.89.xxx.x INFO: 2025/05/25 11:49:48 Ping latency: 14.580766ms INFO: 2025/05/25 11:50:18 Pinging 100.89.xxx.x INFO: 2025/05/25 11:50:18 Ping latency: 12.779915ms INFO: 2025/05/25 11:50:48 Pinging 100.89.xxx.x INFO: 2025/05/25 11:50:48 Ping latency: 12.994774ms INFO: 2025/05/25 11:51:18 Pinging 100.89.xxx.x INFO: 2025/05/25 11:51:18 Ping latency: 14.684528ms INFO: 2025/05/25 11:51:48 Pinging 100.89.xxx.x INFO: 2025/05/25 11:51:48 Ping latency: 14.372752ms

Hey! 👋 Yes, you're absolutely right — the IP 100.89.xxx.x is part of the Carrier-Grade NAT (CGNAT) range (100.64.0.0/10), which is commonly used internally by WireGuard tunnels.

Newt sends pings to the endpoint inside the tunnel (in this case, most likely Pangolin on your VPS) to:

verify that the connection is still alive,

and optionally auto-reconnect if a timeout is detected.

It pings every 10 seconds by default built into newt 😊

I have issue tracking and PR for the add-on here if you have any questions! https://github.com/Ferdinand99/home-assistant-newt-addon

[watersch24]

This thread has helped me get oh so close to making my setup work. I'm trying to access my HAOS server through a pangolin and have felt all the headaches above. It all worked once I added the auth bypass rules laid out by @steuerlexi, with one addition to include include my custom dashboard.

Obviously, it's troublesome to have essentially everything bypassing authorization, so I was really hoping the solution that @Ferdinand99 said about changing the target method to http was the answer. Unfortunately, that didn't work for me. With that setting I can't access from outside my network via either the HA app or the web UI.

This clearly has to be something in the pangolin auth process, since everything works once you bypass enough. I'm just a hobbyist and new to RPS, Docker, Traefik, etc. and am struggling to do any of my own troubleshooting. Does anyone have any other suggestions beyond the above?