Cannot Connect to Pangolin Cloud via T-Mobile Dualstack

Describe the Bug

Pangolin Android: Mobile data connection fails on congstar/Telekom dual-stack, works immediately on Wi-Fi Description

Pangolin Android is unable to establish the tunnel when using mobile data on the German congstar network (Telekom network).

The same device and Pangolin configuration connects immediately when switching to Wi-Fi.

The mobile connection is configured as IPv4/IPv6 dual-stack. IPv4-only cannot be used with the congstar APN.

The Pangolin control-plane connection appears to work: authentication succeeds and the WebSocket connects. The failure occurs during exit-node resolution / UDP hole punching.

Actual behavior

Pangolin receives IPv6 DNS servers from Android and attempts to use them, but DNS resolution of the Pangolin exit node fails with no route to host.

Relevant log excerpt:

System DNS candidates changed, health-checking: [[XXXX:XXXX:XXXX:XXXX:10:74:210:221]:53 [XXXX:XXXX:XXXX:XXXX:10:74:210:222]:53]

System DNS changed: [[XXXX:XXXX:XXXX:XXXX:10:74:210:221]:53 [[XXXX:XXXX:XXXX:XXXX:10:74:210:222]:53]

Failed to resolve endpoint uranus.pop.pangolin.net: DNS lookup failed using all upstream servers: lookup uranus.pop.pangolin.net on [::1]:53: dial udp [XXXX:XXXX:XXXX:XXXX:10:74:210:222]:53: connect: no route to host

No exit nodes available yet, waiting for nodes to be added

The WebSocket itself connects successfully:

Websocket Connected

Pangolin then retries registration repeatedly and eventually reports:

Received olm error message: code: HOLEPUNCH_MISSING message: Unable to coordinate client P2P connection. Please ensure your client can reach the server on UDP port 21820 and try registering again.

Olm error (code: HOLEPUNCH_MISSING): Unable to coordinate client P2P connection. Please ensure your client can reach the server on UDP port 21820 and try registering again.

Environment

Environment Device: Google Pixel 9 Pro Android: 17 Pangolin Android / OLM version: 0.4.1 Mobile provider: congstar (Germany / Telekom network) APN protocol: IPv4/IPv6 Pangolin endpoint: https://app.pangolin.net

To Reproduce

Disable Wi-Fi. Connect using congstar mobile data. Start the Pangolin tunnel. Pangolin authenticates and connects the WebSocket. Tunnel registration never completes and eventually fails with HOLEPUNCH_MISSING. Enable Wi-Fi and connect to a guest Wi-Fi network. Start Pangolin again. The connection succeeds immediately.

Expected Behavior

Pangolin should establish the tunnel over mobile data just as it does over Wi-Fi, or correctly fall back to an available IPv4 path if the IPv6 DNS / UDP path is unavailable.