My Clients can't connect to my Site

[DarinDev1000]

Currently, my setup is as follows:
Client (Windows, or Android) > VPS with Pangolin > OPNSense Router > Proxmox > Docker VM > Site (Newt running in docker)

When I connect my clients, they cannot punch through the NAT and connect to the site.
Public resources through the web work fine though.
My Private resources is a host(router ip) and a CIDR subnet.

I have added the firewall rule mentioned here: https://docs.pangolin.net/manage/clients/firewalls#opnsense

Windows Client Log

2026-07-03 09:40:19.000 [INFO] Tunnel state changed: starting
2026-07-03 09:40:19.000 [INFO] Auth: OLM credentials verified (userId=--------)
2026-07-03 09:40:19.000 [INFO] Connecting tunnel with config: Name=olm, Endpoint=https://--------
2026-07-03 09:40:19.000 [INFO] Tunnel: StartTunnel called
2026-07-03 09:40:19.000 [INFO] Tunnel: Starting tunnel with config
2026-07-03 09:40:19.000 [INFO] Pangolin logging initialized - log file: C:\ProgramData\Pangolin\logs\pangolin.log, log level: info
2026-07-03 09:40:19.000 [INFO] Pangolin version 0.11.0 starting
2026-07-03 09:40:19.000 [INFO] Starting as tunnel service with config: C:\ProgramData\Pangolin\Tunnels\olm.json
2026-07-03 09:40:19.000 [INFO] Tunnel service: Starting with config
2026-07-03 09:40:19.000 [INFO] Tunnel service: Running as Windows service
2026-07-03 09:40:19.000 [INFO] Tunnel service: Service starting
2026-07-03 09:40:19.000 [INFO] Starting status polling
2026-07-03 09:40:19.000 [INFO] Started OLM status polling (every 1 second)
2026-07-03 09:40:19.000 [INFO] Starting HTTP server on socket \\.\pipe\pangolin-olm
2026-07-03 09:40:19.000 [INFO] Starting OLM tunnel...
2026-07-03 09:40:19.000 [INFO] Created shared UDP socket on port 59343 (refcount: 2)
2026-07-03 09:40:22.000 [INFO] Starting hole punch for 1 exit nodes
2026-07-03 09:40:25.000 [INFO] Websocket Connected
2026-07-03 09:40:26.000 [INFO] Tunnel: OLM registered
2026-07-03 09:40:29.000 [INFO] The tunnel IP is: 100.90.128.1/24
2026-07-03 09:40:29.000 [INFO] Set IPv4 addresses: [100.90.128.1], subnet masks: [255.255.255.0]
2026-07-03 09:40:29.000 [INFO] Set MTU: 1280
2026-07-03 09:40:29.000 [INFO] Configuring Windows interface: Pangolin
2026-07-03 09:40:30.000 [INFO] Adding IP address 100.90.128.1/24 to interface Pangolin
2026-07-03 09:40:30.000 [INFO] Added IPv4 included route: {DestinationAddress:100.96.128.0 SubnetMask:255.255.255.0 GatewayAddress: IsDefault:false}
2026-07-03 09:40:30.000 [INFO] Adding route to 100.96.128.0/24 via interface Pangolin
2026-07-03 09:40:30.000 [INFO] Added route for remote subnet: 100.96.128.0/24
2026-07-03 09:40:30.000 [INFO] Added IPv4 included route: {DestinationAddress:192.168.40.1 SubnetMask:255.255.255.255 GatewayAddress: IsDefault:false}
2026-07-03 09:40:30.000 [INFO] Adding route to 192.168.40.1/32 via interface Pangolin
2026-07-03 09:40:30.000 [INFO] Added route for remote subnet: 192.168.40.1/32
2026-07-03 09:40:30.000 [INFO] Added IPv4 included route: {DestinationAddress:192.168.0.0 SubnetMask:255.255.0.0 GatewayAddress: IsDefault:false}
2026-07-03 09:40:30.000 [INFO] Adding route to 192.168.0.0/16 via interface Pangolin
2026-07-03 09:40:30.000 [INFO] Added route for remote subnet: 192.168.0.0/16
2026-07-03 09:40:30.000 [INFO] Started monitoring for site 1 at 100.90.128.0:57987
2026-07-03 09:40:30.000 [INFO] Configured peer ----------------
2026-07-03 09:40:30.000 [INFO] Started monitoring peer 1
2026-07-03 09:40:30.000 [INFO] Started holepunch connection monitor
2026-07-03 09:40:30.000 [INFO] DNS proxy started on 100.96.128.1:53 (tunnelDNS=false)
2026-07-03 09:40:30.000 [INFO] Starting rapid holepunch test for site 1 at ----------------:57020 (max 5 attempts, 400ms timeout each)
2026-07-03 09:40:30.000 [INFO] Using Windows registry DNS configurator for interface: Pangolin
2026-07-03 09:40:30.000 [INFO] Current DNS servers: []
2026-07-03 09:40:30.000 [INFO] Setting DNS servers to: [100.96.128.1]
2026-07-03 09:40:30.000 [INFO] Original DNS servers backed up: []
2026-07-03 09:40:30.000 [INFO] Set DNS servers: [100.96.128.1]
2026-07-03 09:40:30.000 [INFO] WireGuard device created.
2026-07-03 09:40:30.000 [INFO] Tunnel: OLM connected
2026-07-03 09:40:30.000 [INFO] Tunnel state changed: running
2026-07-03 09:40:32.000 [WARN] WireGuard connection to site 1 is DISCONNECTED
2026-07-03 09:40:32.000 [WARN] Rapid test: site 1 holepunch FAILED after 5 attempts, will relay
2026-07-03 09:40:32.000 [INFO] Rapid test failed for site 1, requesting relay
2026-07-03 09:40:32.000 [INFO] Sent relay message for site 1 (chain ----------------)
2026-07-03 09:40:33.000 [INFO] Cancelled relay sender for chain ----------------
2026-07-03 09:40:33.000 [INFO] Adjusted peer 1 to point to relay!

[DarinDev1000]

Nevermind, it somehow fixed itself and Local DNS is now working on Windows.
Local DNS doesn't seam to be working on Android though even though the site now says connected.

[DarinDev1000]

The Android issue appears to be this: https://github.com/orgs/fosrl/discussions/2377