Ip_whitelist.go:70 > Rejecting IP 172.28.0.1

alexus · June 21, 2024, 4:00pm

bump

# uname -a
Linux X.Y.Z 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64 GNU/Linux
# cat /etc/debian_version
12.5
# docker --version
Docker version 26.1.4, build 5650f9b
# tailscale --version
1.68.1
  tailscale commit: f02ad839770b7d1453e88d64b02162ce81cdd7a8
  other commit: 8f9cb4763e0650eadf4df8131b57733f2ce10d78
  go version: go1.22.4
# docker pull traefik:latest
latest: Pulling from library/traefik
Digest: sha256:ce3ae40b05fd3407b6fe1713e24916a04e81489cf37b9ebb22b7ae98b12064a1
Status: Image is up to date for traefik:latest
docker.io/library/traefik:latest
# docker compose logs --tail 1 traefik
traefik  | 2024-06-21T16:01:44Z DBG github.com/traefik/traefik/v3/pkg/middlewares/ipallowlist/ip_allowlist.go:80 > Rejecting IP 172.28.0.1: "172.28.0.1" matched none of the trusted IPs middlewareName=mongo-express_ipallowlist@docker middlewareType=IPAllowLister
# docker exec -it traefik netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         172.28.0.1      0.0.0.0         UG        0 0          0 eth0
172.28.0.0      0.0.0.0         255.255.0.0     U         0 0          0 eth0
#

github.com/traefik/traefik

Traefik HTTP Middlewares IPAllowList - IP Rejecting - Tailscale IP is MIA

opened 04:28PM - 21 Jun 24 UTC

a1exus

status/0-needs-triage

### Welcome! - [X] Yes, I've searched similar issues on [GitHub](https://github….com/traefik/traefik/issues) and didn't find any. - [X] Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any. ### What did you do? Hello World ;-) I'm using Traefik with Tailscale and now trying to setup a [ipallowlist/#sourcerange](https://doc.traefik.io/traefik/middlewares/http/ipallowlist/#sourcerange), however even though I specified `100.0.0.0/8` as my sourcerange, instead it appears (per logs) that Taefik isn't seeing my request as from `100.115.6.126`, but rather from `172.28.0.1` (which is container own gateway IP address) and not public / tailscale IP address. ``` $ ssh ABC.XYZ.ts.net who user pts/0 2024-05-10 21:48 (100.92.134.25) $ curl -Iv https://ABC.XYZ.ts.net/mongo-express/ * Host ABC.XYZ.ts.net:443 was resolved. * IPv6: (none) * IPv4: 100.115.6.126 * Trying 100.115.6.126:443... * Connected to ABC.XYZ.ts.net (100.115.6.126) port 443 * ALPN: curl offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * CAfile: /etc/ssl/certs/ca-certificates.crt * CApath: /etc/ssl/certs * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519 / id-ecPublicKey * ALPN: server accepted h2 * Server certificate: * subject: CN=ABC.XYZ.ts.net * start date: May 1 00:31:05 2024 GMT * expire date: Jul 30 00:31:04 2024 GMT * subjectAltName: host "ABC.XYZ.ts.net" matched cert's "ABC.XYZ.ts.net" * issuer: C=US; O=Let's Encrypt; CN=R3 * SSL certificate verify ok. * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using sha256WithRSAEncryption * Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption * Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): * using HTTP/2 * [HTTP/2] [1] OPENED stream for https://ABC.XYZ.ts.net/mongo-express/ * [HTTP/2] [1] [:method: HEAD] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: ABC.XYZ.ts.net] * [HTTP/2] [1] [:path: /mongo-express/] * [HTTP/2] [1] [user-agent: curl/8.5.0] * [HTTP/2] [1] [accept: */*] > HEAD /mongo-express/ HTTP/2 > Host: ABC.XYZ.ts.net > User-Agent: curl/8.5.0 > Accept: */* > < HTTP/2 403 HTTP/2 403 < content-length: 9 content-length: 9 < date: Sat, 11 May 2024 02:07:21 GMT date: Sat, 11 May 2024 02:07:21 GMT < * Connection #0 to host ABC.XYZ.ts.net left intact $ ``` _labels_ docker compose block: ``` labels: - "traefik.enable=true" - "traefik.docker.network=traefik_default" - "traefik.http.middlewares.mongo-express_ipallowlist.ipallowlist.sourcerange=100.0.0.0/8" - "traefik.http.routers.mongo-express.entrypoints=websecure" - "traefik.http.routers.mongo-express.middlewares=mongo-express_ipallowlist" - "traefik.http.routers.mongo-express.rule=Host(`X.Y.ts.net`) && PathRegexp(`/(mongo-express|public|db)`)" - "traefik.http.routers.mongo-express.tls.certresolver=myresolver" ``` i also tried my luck with Traefik Labs Community Forum as well: [Ip_whitelist.go:70 > Rejecting IP 172.28.0.1 - Traefik / Traefik v3 (latest) - Traefik Labs Community Forum] (https://community.traefik.io/t/ip-whitelist-go-70-rejecting-ip-172-28-0-1/22561/1) ### What did you see instead? ``` % curl https://X.Y.ts.net/mongo-express Forbidden% ``` ### What version of Traefik are you using? _latest_: ``` # docker run traefik traefik version Version: 3.0.3 Codename: beaufort Go version: go1.22.4 Built: 2024-06-18T14:31:20Z OS/Arch: linux/amd64 # ``` ### What is your environment & configuration? ```yaml # (paste your configuration here) ``` Add more configuration information here. ``` # uname -a Linux X.Y.Z 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64 GNU/Linux # cat /etc/debian_version 12.5 # # docker --version Docker version 26.1.4, build 5650f9b # tailscale --version 1.68.1 tailscale commit: f02ad839770b7d1453e88d64b02162ce81cdd7a8 other commit: 8f9cb4763e0650eadf4df8131b57733f2ce10d78 go version: go1.22.4 # ``` ### If applicable, please paste the log output in DEBUG level ``` # docker compose logs --tail 1 traefik traefik | 2024-06-21T16:01:44Z DBG github.com/traefik/traefik/v3/pkg/middlewares/ipallowlist/ip_allowlist.go:80 > Rejecting IP 172.28.0.1: "172.28.0.1" matched none of the trusted IPs middlewareName=mongo-express_ipallowlist@docker middlewareType=IPAllowLister # ```

Topic		Replies	Views
Traefik in Docker gets Docker network ip instead of real one randomly Traefik v2 docker	8	4085	November 24, 2025
Why does traffic coming in from Tailscale appear to be coming from the Docker network when using ipwhitelist? Traefik v2 docker	6	881	August 27, 2024
IPAllowList Rejecting IP : empty IP address if excludedIPs Traefik v3 (latest) middleware	2	135	September 18, 2025
Traefik ipWhiteList middleware is not working( Traefik v2 docker , middleware	3	2017	September 14, 2023
IPWhitelist not working Traefik v2 docker , middleware	2	4528	August 1, 2021

Ip_whitelist.go:70 > Rejecting IP 172.28.0.1

Related topics