Pangolin and Tailscale LAN bridge

The problem

I wanted Pangolin-published services and Tailscale clients to coexist with routed access to the whole home LAN, without flattening the firewall or exposing every management port.

Screenshot evidence

What I did

I use Pangolin with Newt for selected public/private resources and Tailscale for mesh networking, subnet routes and exit-node access.

• Built a bridge design so remote devices can reach the LAN through controlled routes
• Kept Newt connected while retaining Tailscale subnet-routing behaviour
• Diagnosed DNS, HTTPS connectivity, container health and host routing separately
• Distinguished HTTP reverse-proxy traffic from protocols such as SIP, RTP and TURN
• Maintained the required VPS firewall policy for Pangolin connectivity

Implementation notes

Representative commands from the way I diagnose and maintain this project. Public examples use placeholders instead of credentials or sensitive addresses.

# Resolve the Pangolin endpoint and test HTTPS
getent ahostsv4 pangolin.example.net
curl -4 -sS -o /dev/null -w 'HTTP=%{http_code} TOTAL=%{time_total}s\n' \
  --connect-timeout 10 https://pangolin.example.net

# Confirm the host route and Newt container state
ip route get <PANGOLIN_IP>
docker ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'
docker logs --tail 100 newt

# Check the private routed side
tailscale status
tailscale set --accept-routes=true

Result

The environment supports both easy service access and deeper administrative access without treating every protocol as web traffic.