How to setup pangolin with RustDesk and GCP as VM

[Nick390]

I would like to clarify that this is a question and answer I searched for a long time, but after a long time and a lot of tinkering, I figured out how to do it. And I am here to help you do the same.

First, you must know that the environment I have is very, very complicated, but I will try in every way to make it easier for you.

Let's start with the pangolin service on GCP (Google Cloud Platform). What you need:

Step 1: Sign up and enable billing on Google Cloud

1. Go to [Google Cloud Console].
2. If you don’t have an account, click Get started for free and create a Google account or sign in.
3. Follow the signup process, including phone verification.
4. Set up your billing account:
   • Provide valid payment information (credit/debit card).
   • Select the billing plan (Google offers a free tier with credits, but you need to enable billing to create resources).
5. Once billing is enabled, you can create projects and resources like VM instances.

---

Step 2: Create a new Google Cloud project and link it to your billing account

1. Go to the [Google Cloud Console].
2. Click on the Project drop-down (top-left next to “Google Cloud Platform” logo).
3. Click New Project.
4. Enter a Project name (e.g., “My VM Project”).
5. Optionally, select an Organization if applicable.
6. Click Create.

To link the project to a billing account:

1. Navigate to Billing in the Cloud Console.
2. Click Manage billing accounts, then select your billing account.
3. Click Account management > Projects linked to this billing account.
4. Click Link a project, select your newly created project, and confirm.

---

Step 3: Create and download a Service Account key (JSON)

1. Navigate to IAM & Admin > Service Accounts in the Google Cloud Console.
2. Select the service account you want to use (or create a new one with appropriate permissions).
3. Click the Actions (⋮) menu next to the service account and choose Manage keys.
4. Click Add Key > Create new key.
5. Select JSON as the key type and click Create.
6. The JSON key file will download automatically—store it securely.

---

Step 4: Prepare your Terraform working directory and place the Service Account key

1. Create a new folder anywhere on your computer, e.g., pangolin-vm-terraform.
2. Open VS Code and open that folder (File > Open Folder > select your folder).
3. Place the Service Account JSON key (from Step 3) inside this folder. Rename it to service-account.json for simplicity.
4. Create a new file inside the folder called main.tf.
5. Copy and paste the following Terraform script into main.tf, based on your VM specs:

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 4.0"
    }
  }
}

provider "google" {
  credentials = file("service-account.json") # Path to your JSON key
  project     = "<YOUR_PROJECT_ID>"          # Replace with your project ID
  region      = "me-central2"
  zone        = "me-central2-a"
}

resource "google_compute_instance" "pangolin_instance" {
  name         = "pangolin-instance-20250602-152304" # Choose any name, I put the time and date to see when I created
  machine_type = "e2-standard-2"  #You can choose a smaller one, but because I move about 1 TB per month of data by using it, I need something of this size
  zone         = "me-central2-a" #As you like, for me, this is the closest thing to my users.

  boot_disk {
    initialize_params {
      image = "ubuntu-os-cloud/ubuntu-2404-noble-amd64"
      size  = 10 #This preparation will talk a lot about it, as in the documentation, it is mentioned that the best is 20 GB, but in my case, I modified the `Retention Period` To two weeks for everything Read more to know what this means
      type  = "pd-balanced"
    }
  }

  network_interface {
    network    = "default"
    access_config {} # This enables an ephemeral external IP
  }

  metadata = {
    enable-osconfig = "TRUE"
  }

 service_account {
   email  = "<YOUR_SERVICE_ACCOUNT_EMAIL>" # Replace with your own service account email
   scopes = ["cloud-platform"]
 }

  tags = []
  scheduling {
    automatic_restart   = true
    on_host_maintenance = "MIGRATE"
  }

  shielded_instance_config {
    secure_boot          = true
    vtpms               = true
    integrity_monitoring = true
  }
}
resource "google_compute_firewall" "rustdesk" {
  name    = "rustdesk"
  network = "default"

  allow {
    protocol = "tcp"
    ports    = ["21115", "21116", "21117", "21118", "21119"]
  }

  allow {
    protocol = "udp"
    ports    = ["21116", "21118", "21119"]
  }

  direction   = "INGRESS"
  priority    = 100
  source_ranges = ["0.0.0.0/0"]
  target_tags = ["http-server", "https-server", "lb-health-check"]
}

I wrote it as Terraform because it is the easiest way to publish quickly

---

Step 5: Install Terraform and run it to deploy your VM and firewall rules

1. Install Terraform:

• Go to the [Terraform Downloads page].

• Download the appropriate version for your operating system (Windows, macOS, Linux).

• Unzip the downloaded file.

• Add the Terraform executable folder to your system’s PATH environment variable so you can run terraform from any terminal.

• To verify the installation, open your terminal and run:

terraform version

You should see the installed Terraform version printed.

2. Run Terraform commands:

• Open a terminal in your project folder containing main.tf and service-account.json.
• Initialize Terraform providers and modules:

terraform init

• Review the execution plan:

terraform plan

• Apply the configuration to create resources:

terraform apply

• When prompted, type yes to confirm and start deployment.

---

Step 6: Configure DNS to access the pangolin page

Before installing Pangolin, you need to add an A record in your DNS provider to point a domain or subdomain to your server's external IP address.

Example DNS record:

Field	Value
Host	pangolin.example.com
Type	A record
TTL	3600 (1 hour)
Target	123.123.123.123

• Host: The domain or subdomain you want to use.
• Type: A record (IPv4 address).
• TTL: Time to live, recommended 3600 seconds (1 hour) for a balance between propagation speed and DNS query load.
• Target: Your VM’s external IP address (replace with your real IP).

Once this record is set and propagated, you will be able to access Pangolin via the configured domain.

---

Step 7: Install Pangolin on your VM

1. Install the Google Cloud SDK (gcloud)

If you don’t have gcloud installed locally, follow these steps:

• On Linux / macOS:

curl https://sdk.cloud.google.com | bash
exec -l $SHELL
gcloud init

• On Windows:

Download and install from [Google Cloud SDK installer]

After installation, run:

gcloud init

to configure your account.

---

2. Connect to your VM via SSH using gcloud

Use the following command to SSH into your VM (replace project, zone, and instance name if different):

gcloud compute ssh --zone "your-zone" "pangolin-instance-name" --project "name"

---

3. Follow the official Pangolin installation guide

After connecting to your VM, follow the installation steps from the official documentation:

[Pangolin Quick Install Guide]

---

Step 8: Setting up RustDesk Server

Here is the Docker Compose configuration file for RustDesk server. You need to use this docker-compose.yml file and run it with Docker Compose.

services:
  hbbs:
    network_mode: host
    container_name: hbbs
    image: rustdesk/rustdesk-server:latest
    command: hbbs
    volumes:
      - /path/rustdesk/data:/root
    depends_on:
      - hbbr
    restart: unless-stopped

  hbbr:
    network_mode: host
    container_name: hbbr
    image: rustdesk/rustdesk-server:latest
    command: hbbr
    volumes:
      - /path/data:/root
    restart: unless-stopped

How to run with Docker Compose:

1. Make sure Docker and Docker Compose are installed on your server.

2. Save this file as docker-compose.yml inside the /path/rustdesk/ directory.

3. Run the containers in detached mode by executing:

   docker-compose up -d

4. To follow logs, use:

   docker-compose logs -f

Step 9: Create Sites and Resources in Pangolin UI

1. Access the User Interface and Create a Site

• Open the Pangolin user interface.
• Click on Sites then choose Add Site.
• Under Site Information:
  • Enter a name for the site.
• For Tunnel Type, select Newt Tunnel (Recommended).
• In Newt Credentials:
  • Check the box I have copied the config.
• Choose the installation method:
  • Operating System: Linux
  • Architecture: amd64
• Paste the configuration in the site you want to run on.
• Click Create Site.
• You will be redirected to the site page.
• Make sure the site is Online and Enable Docker Socket is enabled.

2. Create a Resource

1. Click Add Resource.
2. Give it a name like rustdesk-21115.
3. Select the appropriate Site.
4. Choose Resource Type: Raw TCP/UDP Resource.
5. Under TCP/UDP Settings:
   • Protocol = TCP
   • Port Number = 21115
6. Click Create Resource.
7. You will be redirected to the resource page:
   • Make sure Targets Configuration is OFF.
   • Set IP / Hostname (e.g., your Rustdesk private IP or your server private IP).
   • Set Port to 21115.
   • Click Save Targets.

3. Create the required resource TCP Ports (5 entries)

• 21115 + hbbs
• 21116 + hbbs
• 21117 + hbbr
• 21118 + hbbs
• 21119 + hbbr

4. Create the required resource UDP Ports (3 entries)

• 21116 + hbbs
• 21118 + hbbs (can be ignored)
• 21119 + hbbs (can be ignored)

All these resources point to the same IP or container name; in your case, I point them to the same server IP.

---

Step 10: Port Setup from GCP to your Local Server via Traefik

Adding ports through Pangolin is not enough; you must manually add the ports to ensure they are properly routed.

1. Modify the traefik_config.yml File

• Navigate to the Traefik configuration file path:

  cd /config/traefik/

• Use the nano editor to open the file:

  nano traefik_config.yml

• Add the following ports under the storage section for the SSL certificate and above the web and websecure sections:

  # Add the following entryPoints for RustDesk
  entryPoints:
    tcp-21115:
      address: ":21115/tcp"
    tcp-21116:
      address: ":21116/tcp"
    udp-21116:
      address: ":21116/udp"
    tcp-21117:
      address: ":21117/tcp"
    tcp-21118:
      address: ":21118/tcp"
    tcp-21119:
      address: ":21119/tcp"

• Save the changes by pressing Ctrl + O and then pressing Enter.
• Exit the editor by pressing Ctrl + X.

2. Modify the docker-compose.yml File

• Go back to the directory where you created the docker-compose.yml file earlier.
• Open the file using nano:

  nano docker-compose.yml

• Find the line that starts with image: fosrl/gerbil:1.0.0 (or whatever version you have).
• Add the following ports under the ports: section:

  # Add the following ports for RustDesk and WireGuard (optional)
  ports:
    - 21115:21115
    - 21116:21116
    - 21116:21116/udp
    - 21117:21117
    - 21118:21118
    - 21119:21119

• Save the changes by pressing Ctrl + O and then pressing Enter.
• Exit the editor by pressing Ctrl + X.

3. Restart the Docker Containers

• Execute the following command to restart the containers and apply the changes:

  docker-compose up -d --force-recreate

With these steps, you have successfully linked the Pangolin service on GCP to your local server via Traefik and

---

Step 11: Connecting the Server to a User

1. Download the program from the following link: https://rustdesk.com/download
2. Install and run it.
3. Click on the three-line hamburger menu button located in the corner to access the settings.
4. In the sidebar, click on Security.
   • Click on Unlock security settings.
   • It will ask for administrator permissions to make changes; click Yes.
   • In the Security section on the same page, find the option Enable direct IP access and enable it, ensuring the default port is 21118.
5. Click on Network from the sidebar.
   • Click on Unlock security settings.
   • It will ask for administrator permissions; click Yes.
   • Enter the public IP address of the GCP server where Pangolin is running into both the ID server and Relay server fields.
   • Leave the API server field blank. In the Key field, enter the key that appeared in the logs of the hbbr container.
   • Then, click Apply.
   • At the top of the page, click on Home.
   • If you see the word Ready, this means that everything is working as intended.
6. Apply the same settings on another device and try to connect. If it works, congratulations! You have correctly followed all the steps. Otherwise, try again or follow the troubleshooting instructions.

---

Troubleshooting

Given the complexity of this setup, troubleshooting can be a bit challenging. The Pangolin tools do not provide built-in functionality to track connection status, so we will use some external commands to check for issues.

1. Verifying GCP Server Ports are open

To ensure that the ports are open on the Google Cloud server where Pangolin is running, you can use the nmap tool.

• Install nmap (if not already installed):
  • On Linux:

    sudo apt-get update
    sudo apt-get install nmap

  • On Windows (using WSL):

    sudo apt-get update
    sudo apt-get install nmap

• Use nmap to check ports:

  nmap -p 21115,21116,21117,21118,21119 <GCP_VM_PUBLIC_IP>

  Replace <GCP_VM_PUBLIC_IP> with the public IP address of your GCP virtual machine. If the ports are open, they will appear as open in the command results.

2. Verifying RustDesk Server Ports

You must ensure that the ports are open on the local server hosting the RustDesk containers.

• On Linux:

  netstat -tulpn | grep "21115\|21116\|21117\|21118\|21119"

• On Windows (PowerShell):

  Get-NetTCPConnection | Where-Object { $_.LocalPort -in (21115, 21116, 21117, 21118, 21119) }
  Get-NetUDPEndpoint | Where-Object { $_.LocalPort -in (21115, 21116, 21117, 21118, 21119) }

If you see the ports open, it means the connection has been successfully established between GCP and your local server.

3. Checking hbbr and hbbs Container Logs

You can inspect the Docker container logs to ensure they are running and listening on the correct ports.

docker-compose logs -f hbbs hbbr

Look for log entries such as:

INFO [src/relay_server.rs:84] Listening on websocket :21119

These messages confirm that the services are functioning correctly.

4. Restarting the hbbr and hbbs Containers

Sometimes, restarting the containers after changing the settings can resolve the issue. Use the following command:

docker-compose restart

If the problem persists, the surest solution is to access your server and apply the settings manually. Follow the Instructions in Step 11 access your server after ensuring everything is working.

Warning:

Running the Pangolin service can be financially costly when used with Google Cloud services. The cost could reach high figures such as $500 monthly+, mainly due to Bandwidth usage fees.

[oschwartz10612]

Thanks for the awesome post!

[Nick390]

Happy to help. 👍

[nhatlinh1982]

And from me, also a huge thank you. I wouldn't be able to figure this out as a layman without this instruction. You are awesome!

[HHUBSS]

I'm trying to connect my Rustdesk container in Unraid to my Pangolin setup on a VPS using raw TCP/UDP. I followed your guide started on STEP 9, but I'm getting these logs on my newt connector on Unraid:

INFO: 2025/09/07 16:04:54 Newt version 1.4.4
INFO: 2025/09/07 16:04:54 Creating new health check monitor with certificate enforcement: false
INFO: 2025/09/07 16:04:55 Websocket connected
INFO: 2025/09/07 16:04:55 Requesting exit nodes from server
INFO: 2025/09/07 16:04:55 Received ping message
INFO: 2025/09/07 16:04:55 Received registration message
INFO: 2025/09/07 16:04:55 Connecting to endpoint: <REMOVED>
INFO: 2025/09/07 16:04:59 Initial connection test successful
INFO: 2025/09/07 16:04:59 Tunnel connection to server established successfully!
INFO: 2025/09/07 16:04:59 Successfully added 0 health check targets
INFO: 2025/09/07 16:04:59 Started tcp proxy to 192.168.50.5:2283
INFO: 2025/09/07 16:04:59 Started tcp proxy to 192.168.50.5:8443
INFO: 2025/09/07 16:04:59 Started tcp proxy to 192.168.50.5:21115
INFO: 2025/09/07 16:04:59 Started tcp proxy to 192.168.50.5:21117
INFO: 2025/09/07 16:04:59 Started tcp proxy to 192.168.50.5:21119
INFO: 2025/09/07 16:04:59 Started tcp proxy to 192.168.50.5:8443
INFO: 2025/09/07 16:04:59 Started tcp proxy to 192.168.50.5:8096
INFO: 2025/09/07 16:04:59 Started tcp proxy to 192.168.50.3:3000
INFO: 2025/09/07 16:04:59 Started tcp proxy to 192.168.50.5:21116
INFO: 2025/09/07 16:04:59 Started tcp proxy to 192.168.50.5:21118
INFO: 2025/09/07 16:04:59 Started udp proxy to 192.168.50.5:21116
ERROR: 2025/09/07 16:05:52 Error connecting to target: dial tcp 192.168.50.5:21116: connect: connection refused
ERROR: 2025/09/07 16:06:21 Error connecting to target: dial tcp 192.168.50.5:21116: connect: connection refused
ERROR: 2025/09/07 16:06:21 Error connecting to target: dial tcp 192.168.50.5:21116: connect: connection refused
ERROR: 2025/09/07 16:07:22 Error connecting to target: dial tcp 192.168.50.5:21116: connect: connection refused
ERROR: 2025/09/07 16:08:23 Error connecting to target: dial tcp 192.168.50.5:21116: connect: connection refused
ERROR: 2025/09/07 16:09:26 Error connecting to target: dial tcp 192.168.50.5:21116: connect: connection refused

My setup is as follows:

All pointing to my Unraid server 192.168.50.5

docker-compose.yml: gerbil

traefik_config.yml

nmap: Ports open in my VPS instance

Rustdesk server on Unraid:

What could be the missing piece?