# Get real source ip of clients

**URL:** <https://community.traefik.io/t/get-real-source-ip-of-clients/16230>\
**Category:** Traefik v2\
**Tags:** kubernetes-ingress\
**Created:** [October 25, 2022, 12:46pm UTC](https://community.traefik.io/t/get-real-source-ip-of-clients/16230 "2022-10-25T12:46:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zerros](https://avatars.discourse-cdn.com/v4/letter/z/9de0a6/32.png) [@zerros](https://community.traefik.io/u/zerros)\
**Post date:** [October 25, 2022, 12:46pm UTC](https://community.traefik.io/t/get-real-source-ip-of-clients/16230/1 "2022-10-25T12:46:40Z")

</div>

Hello,

I'm trying to get the real source ip in the pods that running into my kube cluster. To access to kubernetes services I have deployed this:

HAPROXY (external) --\> Traefik (daemonset) nodePort 32xxx --\> svc --\> pods

The haproxy instance is configured to forward the real ip:

```auto
backend back_hello
  balance leastconn
  option httpclose
  option forwardfor
  server node1 xxx.xxx.xxx.xxx:32xxx check ssl verify none
  server node2 xxx.xxx.xxx.xxx:32xxx check ssl verify none

```

I can access to my hello world app. But the ip of the client is not recognized.

I've found a lot of documentation but there is something I'm doing bad. In the websecure entrypoint (helm chart), I have added:

```auto
forwardedHeaders:
      trustedIPs:
        - xxx.xxx.xxx.xxx/32 <--- My HAPROXY public IP
        - 127.0.0.1/8
        - 10.2.0.0/24 <-- pods subnet
        - 10.2.1.0/24 <-- pods subnet
      insecure: false

```

And it's not working:  
`{"level":30,"time":1666701704374,"pid":18,"hostname":"hello-kubernetes-hello-world-54dc87bbb6-stnpd","req":{"id":12701,"method":"GET","url":"/","query":{},"params":{},"headers":{"host":"hello.notech.fr","user-agent":"curl/7.81.0","accept":"*/*","x-forwarded-for":"<node ip>","x-forwarded-host":"hello.xxxx.xxx","x-forwarded-port":"443","x-forwarded-proto":"https","x-forwarded-server":"traefik-8rkqr","x-real-ip":"<node ip>","accept-encoding":"gzip"},"remoteAddress":"::ffff:<pod ip>","remotePort":41178},"res":{"statusCode":200,"headers":{"x-powered-by":"Express","content-type":"text/html; charset=utf-8","content-length":"846","etag":"W/\"34e-pOeBub5QvA/DD39aK/olEfPnxDk\""}},"responseTime":12,"msg":"request completed"}`

The x-forwarded-for and real-ip are set to the real node IP.  
The remoteAdress is set to the internal traefick pods ip.

I'm using a kubernetes managed by OVH.

How should I get the real client IP please ???

---

<div class="post-metadata">

**Author:** ![rgarcia89](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/rgarcia89/32/6095_2.png) [@rgarcia89](https://community.traefik.io/u/rgarcia89)\
**Post date:** [October 26, 2022, 11:39am UTC](https://community.traefik.io/t/get-real-source-ip-of-clients/16230/2 "2022-10-26T11:39:31Z")

</div>

Set `externalTrafficPolicy: Local` in the traefik service.  
No hostNetwork etc needed.

---

<div class="post-metadata">

**Author:** ![zerros](https://avatars.discourse-cdn.com/v4/letter/z/9de0a6/32.png) [@zerros](https://community.traefik.io/u/zerros)\
**Post date:** [October 27, 2022, 4:35pm UTC](https://community.traefik.io/t/get-real-source-ip-of-clients/16230/3 "2022-10-27T16:35:34Z")

</div>

I passed a lot of hours on that !!!!! I have rtrie externaltrafficpolicy, nodeport, hostnetwork without any success.

And I tried to investigate on the reverse proxy (haproxy). I found that haproxy was not catching the client IP. It is a docker container and the container was launched in a swarm cluster. I asked the admin to use the host network.

All is running well now !!! Thanks for the answer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [October 30, 2022, 4:35pm UTC](https://community.traefik.io/t/get-real-source-ip-of-clients/16230/4 "2022-10-30T16:35:48Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.