# IPAllowList Rejecting IP : empty IP address if excludedIPs **URL:** \ **Category:** Traefik v3 (latest)\ **Tags:** middleware\ **Created:** [September 16, 2025, 8:15pm UTC](https://community.traefik.io/t/ipallowlist-rejecting-ip-empty-ip-address-if-excludedips/28644 "2025-09-16T20:15:40Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![clement-brodu](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/clement-brodu/32/10727_2.png) [@clement-brodu](https://community.traefik.io/u/clement-brodu)\ **Post date:** [September 16, 2025, 8:15pm UTC](https://community.traefik.io/t/ipallowlist-rejecting-ip-empty-ip-address-if-excludedips/28644/1 "2025-09-16T20:15:40Z")
Hello, I hope somebody can help me... I don’t unerstand why ipAllowList middleware block me when I'm from tailscale & android1 dynamic.yaml ```auto http: middlewares: allow-local-only: IPAllowList: sourceRange: - 192.168.1.0/24 - 100.64.0.0/10 # Tailscale ipStrategy: excludedIPs: - 192.168.1.40 # ignorer l'autre reverse proxy pour le AllowList ``` docker compose ```auto services: whoami2: image: traefik/whoami restart: unless-stopped labels: - "traefik.enable=true" # Definition of the router - "traefik.http.routers.router-traefik-whoami.rule=Host(`whoami.home.demo.com`)" - "traefik.http.routers.router-traefik-whoami.entrypoints=websecure" - "traefik.http.routers.router-traefik-whoami.middlewares=crowdsec@file,allow-local-only@file" # Definition of the service - "traefik.http.services.service-traefik-whoami.loadbalancer.server.port=80" ``` log: ```auto DEBUG: CrowdsecBouncerTraefikPlugin: 2025/09/16 21:43:33 ServeHTTP ip:192.168.1.11 isTrusted:false DEBUG: CrowdsecBouncerTraefikPlugin: 2025/09/16 21:43:33 cache:Get key:192.168.1.11 DEBUG: CrowdsecBouncerTraefikPlugin: 2025/09/16 21:43:33 ServeHTTP:Get ip:192.168.1.11 isBanned:false cache:miss DEBUG: CrowdsecBouncerTraefikPlugin: 2025/09/16 21:43:34 cache:Set key:192.168.1.11 value:f duration:60s 2025-09-16T21:43:34+02:00 DBG github.com/traefik/traefik/v3/pkg/middlewares/ipwhitelist/ip_whitelist.go:68 > Rejecting IP : empty IP address middlewareName=allow-local-only@file middlewareType=IPWhiteLister ``` if i remove the excludedIPs 192.168.1.40, then it works with this whoami, but I need it. ```auto Hostname: f31ad3fda191 IP: 127.0.0.1 IP: ::1 IP: 172.18.0.6 RemoteAddr: 172.18.0.4:48570 GET / HTTP/1.1 Host: whoami.home.demo.com User-Agent: Mozilla/5.0 (Android 15; Mobile; rv:142.0) Gecko/142.0 Firefox/142.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: fr-FR Priority: u=0, i Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Te: trailers Upgrade-Insecure-Requests: 1 X-Forwarded-For: 192.168.1.11 X-Forwarded-Host: whoami.brdapps.ovh X-Forwarded-Port: 443 X-Forwarded-Proto: https X-Forwarded-Server: 884fcae3f3bc X-Real-Ip: 192.168.1.11 ``` Here is my network: - adguard machine is an exit node of my tailscale network - I use tailscale splitDNS to redirect \*.home.demo.com to traefik-docker ![2025-09-16_22h09_36](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/f/f3131f3eef3807a99aca93a98f9d07f5a560f706.png) Thanks to anybody that could help 🙂 ---
**Author:** ![clement-brodu](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/clement-brodu/32/10727_2.png) [@clement-brodu](https://community.traefik.io/u/clement-brodu)\ **Post date:** [September 17, 2025, 7:51pm UTC](https://community.traefik.io/t/ipallowlist-rejecting-ip-empty-ip-address-if-excludedips/28644/2 "2025-09-17T19:51:44Z")
Seems to be the same as this issue : [https://github.com/traefik/traefik/issues/10561](https://github.com/traefik/traefik/issues/10561) the workaround is to add another router without the ipAllowList if ther is no X-Forwarded-For Header: ```auto services: whoami2: image: traefik/whoami restart: unless-stopped labels: - "traefik.enable=true" # Definition of the router - "traefik.http.routers.router-traefik-whoami.rule=Host(`whoami.home.demo.com`)" - "traefik.http.routers.router-traefik-whoami.entrypoints=websecure" - "traefik.http.routers.router-traefik-whoami.middlewares=crowdsec@file,allow-local-only@file" # Definition of another router for local - "traefik.http.routers.router-traefik-whoami-local.rule=Host(`whoami.home.demo.com`) && !HeaderRegexp(`X-Forwarded-For`, `^.*$`)" - "traefik.http.routers.router-traefik-whoami-local.entrypoints=websecure" - "traefik.http.routers.router-traefik-whoami-local.middlewares=crowdsec@file" # Definition of the service - "traefik.http.services.service-traefik-whoami.loadbalancer.server.port=80" ``` In my opinion, traefik should handle this case, and I there is nothing in X-Forwarded-For, it should check the remote adresse, like if there is no "excludedIPs" ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [September 18, 2025, 5:14am UTC](https://community.traefik.io/t/ipallowlist-rejecting-ip-empty-ip-address-if-excludedips/28644/3 "2025-09-18T05:14:28Z")
If you think this is a bug or should be a feature, you can tell the devs at [Traefik Github](https://github.com/traefik/traefik). ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\ **Post date:** [September 21, 2025, 5:14am UTC](https://community.traefik.io/t/ipallowlist-rejecting-ip-empty-ip-address-if-excludedips/28644/4 "2025-09-21T05:14:42Z")
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.