# Allow access from one IP, require basic auth from all other sources

**URL:** <https://community.traefik.io/t/allow-access-from-one-ip-require-basic-auth-from-all-other-sources/13098>\
**Category:** Traefik v2\
**Tags:** docker, middleware\
**Created:** [January 19, 2022, 2:42pm UTC](https://community.traefik.io/t/allow-access-from-one-ip-require-basic-auth-from-all-other-sources/13098 "2022-01-19T14:42:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevingimbel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/kevingimbel/32/2745_2.png) [@kevingimbel](https://community.traefik.io/u/kevingimbel)\
**Post date:** [January 19, 2022, 2:42pm UTC](https://community.traefik.io/t/allow-access-from-one-ip-require-basic-auth-from-all-other-sources/13098/1 "2022-01-19T14:42:56Z")

</div>

Hello!

I'd like to allow access to Traefik from one IP and require basic auth from all other sources; Is there any way to skip basic auth if the IP matches?

In Apache htaccess we could do something like this

```auto
AuthType Basic
AuthName "Password Required"
AuthUserFile "/path/to/.htpasswd"
Require valid-user
Require expr %{REMOTE_ADDR} = "123.123.123.123"

```

This would allow access from any user that can authenticate against the `.htpasswd` file or requests coming from `123.123.123.123`.

Is there anything like this in Traefik?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![tommoulard](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/tommoulard/32/2997_2.png) [@tommoulard](https://community.traefik.io/u/tommoulard)\
**Post date:** [January 20, 2022, 2:47pm UTC](https://community.traefik.io/t/allow-access-from-one-ip-require-basic-auth-from-all-other-sources/13098/2 "2022-01-20T14:47:46Z")

</div>

Hello @kevingimbel,

One simple use case, could be:

```auto
version: '3.6'

services:
  traefik:
    image: traefik:v2.6
    command:
      - --providers.docker
    ports:
      - "80:80"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  whoami:
    image: traefik/whoami
    labels:
      traefik.http.routers.whoami-ip.rule: Host(`whoami.localhost`) && ClientIP(`127.0.0.1`)

      traefik.http.routers.whoami-auth.rule: Host(`whoami.localhost`)
      traefik.http.routers.whoami-auth.middlewares: test-auth

      traefik.http.middlewares.test-auth.basicauth.users: root:$$apr1$$J.oefIGs$$HnlqmKtI8B6xKYYA1WbEc. #root:root

```

Here, I define 2 routers.  
The first one filters IP and match only a given IP. So, requests coming from this IP will have to be authenticated.  
The second one, with a lower priority, will match all other requests going to this service. This second router uses the `test-auth` middleware that ensure that requests are authenticated to be served.

Hope it helps 🙂

---

<div class="post-metadata">

**Author:** ![kevingimbel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/kevingimbel/32/2745_2.png) [@kevingimbel](https://community.traefik.io/u/kevingimbel)\
**Post date:** [January 21, 2022, 9:48am UTC](https://community.traefik.io/t/allow-access-from-one-ip-require-basic-auth-from-all-other-sources/13098/3 "2022-01-21T09:48:56Z")

</div>

Thank you a lot, this looks exactly like what I needed! I'll test this on our infra and then mark as solution once I verify it works! 🎉

---

<div class="post-metadata">

**Author:** ![kevingimbel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/kevingimbel/32/2745_2.png) [@kevingimbel](https://community.traefik.io/u/kevingimbel)\
**Post date:** [February 21, 2022, 1:45pm UTC](https://community.traefik.io/t/allow-access-from-one-ip-require-basic-auth-from-all-other-sources/13098/4 "2022-02-21T13:45:31Z")

</div>

I was finally able to test this and it works! We had some issues with the basic auth which was defined for the entrypoint instead of the routes, but after reconfiguring that it worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [February 24, 2022, 1:46pm UTC](https://community.traefik.io/t/allow-access-from-one-ip-require-basic-auth-from-all-other-sources/13098/5 "2022-02-24T13:46:22Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.