# Container does not see Real IP even with fowarded headers **URL:** \ **Category:** Traefik v3 (latest)\ **Tags:** file\ **Created:** [August 27, 2024, 2:35am UTC](https://community.traefik.io/t/container-does-not-see-real-ip-even-with-fowarded-headers/24180 "2024-08-27T02:35:30Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Franscobec](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/franscobec/32/9240_2.png) [@Franscobec](https://community.traefik.io/u/Franscobec)\ **Post date:** [August 27, 2024, 2:35am UTC](https://community.traefik.io/t/container-does-not-see-real-ip-even-with-fowarded-headers/24180/1 "2024-08-27T02:35:30Z")
I know this is one of the most talked about topic out here, but I really can't figure it out despite hours of digging. Thing is, my setup is unusual and does not containerize Traefik at all for production. So what's going on is the containers that I have set up only see Traefik's IP when someone makes a request on my websites: ![image](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/d/d3b12d3b445ede67b5baa75b9b362c08208d8dbe.png) In this image, we can see my dockerized (staging) instance of traefik as 192.168.0.105 and my production (non-docker installation, which runs on bare-metal as an AUR + systemd version of Traefik) instance called "TBOX" as 192.168.0.10. Why am I seeing these when I have set X-Fowarded-\* in my static config for both ? Here is my static config (traefik.yaml): ```auto global: checkNewVersion: true sendAnonymousUsage: false entryPoints: web: address: :80 forwardedHeaders: trustedIPs: - "127.0.0.1" - "102.168.0.105" #FOXTROT - "192.168.0.10" #TBOX proxyProtocol: trustedIPs: - "127.0.0.1" - "102.168.0.105" #FOXTROT - "192.168.0.10" #TBOX http: redirections: entryPoint: to: websecure scheme: https websecure: address: :443 http: tls: certResolver: maincert forwardedHeaders: trustedIPs: - "127.0.0.1" - "102.168.0.105" #FOXTROT - "192.168.0.10" #TBOX proxyProtocol: trustedIPs: - "127.0.0.1" - "102.168.0.105" #FOXTROT - "192.168.0.10" #TBOX accessLog: filePath: "/etc/traefik/access.log" #does not work for who knows why format: json api: insecure: true dashboard: true ping: entryPoint: traefik providers: file: directory: "/etc/traefik/config" watch: true log: filePath: "/etc/traefik/log.log" #stopped working on 06/22 format: log level: INFO certificatesResolvers: maincert: acme: caServer: https://acme-v02.api.letsencrypt.org/directory email: "EMAIL" storage: "/etc/traefik/TLS/maincert.json" dnsChallenge: provider: cloudflare delayBeforeCheck: 120 resolvers: - "1.1.1.1:53" - "1.0.0.1:53" serversTransport: insecureSkipVerify: true ``` I have also tried using insecure = true for FowardedHeaders and ProxyProtocol to no results. Running Librespeed also gives me TBOX's IP address instead of my own IP on the webpage. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [August 27, 2024, 4:44am UTC](https://community.traefik.io/t/container-does-not-see-real-ip-even-with-fowarded-headers/24180/2 "2024-08-27T04:44:31Z")
The log screenshot is from a target service container? It shows the IP of the request, which is the proxy. That’s where the TCP connection is coming from. If you expect that IPs from http headers or ProxyProtocol are logged, then you probably need to set up the target application accordingly. ---
**Author:** ![Franscobec](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/franscobec/32/9240_2.png) [@Franscobec](https://community.traefik.io/u/Franscobec)\ **Post date:** [August 27, 2024, 4:58am UTC](https://community.traefik.io/t/container-does-not-see-real-ip-even-with-fowarded-headers/24180/3 "2024-08-27T04:58:42Z")
The log is from inside the container (docker logs). The application was displaying the correct IP a week ago and nothing changed between it working and it not working aside from a reboot of the host machine (maintenance) so I believe this is (was ?) configured properly. Edit: I wrote "The application" but this behavior is the same to my other applications ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [August 27, 2024, 8:43am UTC](https://community.traefik.io/t/container-does-not-see-real-ip-even-with-fowarded-headers/24180/4 "2024-08-27T08:43:22Z")
> [@Franscobec](#): > > The log is from inside the container (docker logs). Which container do you mean? ---
**Author:** ![Franscobec](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/franscobec/32/9240_2.png) [@Franscobec](https://community.traefik.io/u/Franscobec)\ **Post date:** [August 27, 2024, 1:03pm UTC](https://community.traefik.io/t/container-does-not-see-real-ip-even-with-fowarded-headers/24180/5 "2024-08-27T13:03:07Z")
The log is from a [webdav container](https://hub.docker.com/r/apachewebdav/apachewebdav) (apache). Basically Traefik is reaching apps that are containerized, but my production Traefik instance itself isn't containerized. ---
**Author:** ![MarcoPolo](https://avatars.discourse-cdn.com/v4/letter/m/90db22/32.png) [@MarcoPolo](https://community.traefik.io/u/MarcoPolo)\ **Post date:** [August 31, 2024, 12:52am UTC](https://community.traefik.io/t/container-does-not-see-real-ip-even-with-fowarded-headers/24180/6 "2024-08-31T00:52:53Z")
Might the issue be on the application end, with how it logs those requests? For example in nginx you would modify the default access\_log, a la [https://djangocas.dev/blog/nginx/nginx-access-log-with-real-x-forwarded-for-ip-instead-of-proxy-ip/](https://djangocas.dev/blog/nginx/nginx-access-log-with-real-x-forwarded-for-ip-instead-of-proxy-ip/). Can’t explain why this worked previously for you, perhaps the app container you were running updated?