# ipAllowList & X-Forwarded-For & X-Real-Ip

**URL:** <https://community.traefik.io/t/ipallowlist-x-forwarded-for-x-real-ip/22430>\
**Category:** Traefik v2\
**Tags:** middleware\
**Created:** [April 25, 2024, 10:20am UTC](https://community.traefik.io/t/ipallowlist-x-forwarded-for-x-real-ip/22430 "2024-04-25T10:20:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rxunique](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/rxunique/32/8531_2.png) [@rxunique](https://community.traefik.io/u/rxunique)\
**Post date:** [April 25, 2024, 10:20am UTC](https://community.traefik.io/t/ipallowlist-x-forwarded-for-x-real-ip/22430/1 "2024-04-25T10:20:34Z")

</div>

I'm going against a wall with using ipAllowList for my internal services. It's easy enough to setup in the simplest case, but adding in Cloudflare DNS Proxy and Tailscale, it's becoming a massive headache that I couldn't figure out.

Here's my journey so far.

First, adding forwardedHeaders.trustedIPs to entry points has nothing to do with ipAllowList. It is still necessary for accesslog to get the correct IP for Crowdsec.

**Case 1: Just CF Proxy**

Add ipstrategy.depth = 1 and add WAN IP to sourceRange will work, but all local traffic is now routed through CF proxy

**Case 2: CF Proxy + local DNS**

For devices using local DNS has to remove ipstrategy.depth = 1  
For devices using manually assigned DNS, has to have ipstrategy.depth = 1

to try to solve this conflict, I got this [Plugin](https://plugins.traefik.io/plugins/62947309108ecc83915d7784/traefik-get-real-ip) to work and successfully got correct X-Real-Ip, but ipAllowList does seems to use X-Real-Ip at all. Is there a better solution?

**Case 3 remote via tailscale + CF Proxy + magic DNS + split DNS + realip plug in**

My TS client is via docker on the same network as Traefik, and I got below header

X-Forwarded-For: 172.18.0.1  
X-Forwarded-Host: [whoami.domain.com](http://whoami.domain.com)  
X-Forwarded-Port: 443  
X-Forwarded-Proto: https  
X-Real-Ip: 172.18.0.1

172.18.0.1 is the docker traefik network IP. I think this will change over time, and I don't know enough about docker to tell if its a good idea to whitelist this IP and what range it might change into?

---

<div class="post-metadata">

**Author:** ![rxunique](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/rxunique/32/8531_2.png) [@rxunique](https://community.traefik.io/u/rxunique)\
**Post date:** [April 25, 2024, 10:31am UTC](https://community.traefik.io/t/ipallowlist-x-forwarded-for-x-real-ip/22430/2 "2024-04-25T10:31:40Z")

</div>

Here are my configs, all pretty basic

entry points & plugin

```auto
  https:
    address: ":443"
    forwardedHeaders:
      trustedIPs: *trustedIps #all CF IP delcared earlier

experimental:
  plugins:
    traefik-get-real-ip:
      moduleName: "github.com/Paxxs/traefik-get-real-ip"
      version: "v1.0.3"

```

router

```auto
    whoami:
      entryPoints:
        - "https"
      rule: "Host(`whoami.domain.com`)"
      middlewares:
        - realip
        #- local-only
      tls: {}
      service: whoami   

```

services

```auto
    whoami:
      loadBalancer:
        servers:
          - url: "http://a.b.c.d"
        passHostHeader: true

```

middlewares:

```auto
    realip:
      plugin:
        traefik-get-real-ip:
          Proxy:
            - proxyHeadername: X-From-Cdn
              proxyHeadervalue: mf-fun #define here
              realIP: CF-Connecting-Ip
              OverwriteXFF: true # default: false, v1.0.2 or above
            - proxyHeadername: "*"
              realIP: RemoteAddr

    local-only:
      ipallowlist: # https://doc.traefik.io/traefik/middlewares/http/ipallowlist/
        sourceRange:
          - "127.0.0.1/32" # localhost
          - "my.local.ip.here" 
          - "my.wan.ip.here"
        # ipstrategy: # enable this when cloudflare proxy in use
        # depth: 1 # depth 1 when cloudflare proxy in use

```