Feature Request: Native/Kernel WireGuard support for Newt with full site-to-site networking

[fampla]

Feature Request

Problem

I want to use Pangolin/Newt as my single networking solution to replace Tailscale, connecting multiple servers (homelab, remote Proxmox hosts) with full site-to-site connectivity for services like NFS shares.

Currently I face two limitations:

1. Performance: Newt's userspace WireGuard implementation is significantly slower than kernel WireGuard. As discussed in Pangolin performance via Newt #512, users report ~1-10 MB/s with Newt vs 22+ MB/s with native WireGuard for the same connection.

2. Site-to-Site networking: Private resources and subnet routing only work with Newt, but the performance penalty makes it unsuitable for bandwidth-intensive use cases (NFS, media streaming, backups).

Current Workaround

I'm forced to run a hybrid setup:

• Native WireGuard (wg0) for bandwidth-intensive services (Emby, etc.)
• Tailscale for site-to-site connectivity (NFS between servers)

This defeats the purpose of having a unified self-hosted solution.

Proposed Solution

Add native/kernel WireGuard support to Newt, similar to how Tailscale offers both userspace and kernel modes:

1. --native or --kernel flag that uses the system's WireGuard kernel module instead of userspace netstack
2. Maintain Pangolin integration - keep the control plane communication, automatic peer configuration, and private resource management
3. Site-to-site routing through kernel networking stack for proper subnet gateway functionality (related to Inability to Forward Traffic on OpenWrt When Using --accept-clients #1370)

Benefits

• Near line-speed performance for all traffic
• True Tailscale replacement with full site-to-site networking
• Single service to manage instead of multiple VPN solution

Environment

• Multiple Proxmox hosts
• Docker containers (Emby, NFS, etc.)
• Currently using: Pangolin + native WireGuard + Tailscale (want to consolidate)

I noticed there's a --native / USE_NATIVE_INTERFACE flag in the code - is this intended for this purpose? If so, documentation would be helpful.

Thank you for this great project!

[v1rusnl]

I noticed there's a --native / USE_NATIVE_INTERFACE flag in the code - is this intended for this purpose? If so, documentation would be helpful.

This seems just to be applicable for the Newt interface. Gerbil still runs in userspace. On my VPS this is the bottleneck. Because of Gerbils userspace architecture I'm tackled down to appr. 180 Mbit/s via the Hetzner VPS (4vCPU, 8GB RAM) when streaming or doing an iperf test using one parallel stream. Doing 4 parallel streams saturates the line (appr. 500 Mbit/s).

Running Gerbil in Kernel space would be a game changer, see #512

[jxstNo1]

+1 on this feature request. This is the single biggest gap preventing Pangolin from being a complete networking solution.

I'm managing multiple customer sites and currently run a hybrid setup: Pangolin for public exposure + SSO, plus a separate IPsec/WireGuard tunnel for site-to-site connectivity. This works but defeats the purpose of having a unified self-hosted platform.

Use case: Connecting multiple customer LANs (e.g. 192.168.X.0/24 ↔ 192.168.Y.0/24) without installing Pangolin on every single device. A routing peer (e.g. on an OPNsense or a Linux server) should be able to advertise its local subnet, and Pangolin/Gerbil should distribute that route to the other peers — similar to how Tailscale subnet routing or NetBird network routes work.

Key requirements:

• Subnet routing through Newt (not just individual host access)
• Kernel WireGuard support for performance (NFS, backups, large file transfers)
• Per-site route configuration in the dashboard
• Masquerade option so no return routes are needed on the remote LAN

This would allow consolidating Pangolin + separate VPN into one platform. Currently evaluating NetBird just for the S2S part, which adds unnecessary complexity and resource overhead. Would much rather keep everything in Pangolin.

[oschwartz10612]

We just added site to cloud functionality with remote nodes (this will also work with gerbil on self hosted instances in the same way we will adjust the docs). Its not exactly what is asked for in this thread but is interesting. Also, to get pseudo exit node functionality you can explore using 0.0.0.0/0 as the cidr resource on a private resource but we plan on adding a more real version of this.