# Is this a Docker or a Traefik bug | X-Forwarded-For and X-Real-Ip not correctly transmitted? **URL:** \ **Category:** Traefik v1\ **Tags:** docker\ **Created:** [July 3, 2019, 8:14pm UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773 "2019-07-03T20:14:57Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![wylie](https://avatars.discourse-cdn.com/v4/letter/w/958977/32.png) [@wylie](https://community.traefik.io/u/wylie)\ **Post date:** [July 3, 2019, 8:14pm UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/1 "2019-07-03T20:14:57Z")
Hi, Iยดm trying to set up that Traefik 1.7.12 is forwarding Headers X-Forwarded-For and X-Real-Ip with the origin Client IPs. Network in between is a Docker "driver: bridge" net. The only IP which I can see with Wireshark is the gateway IP x.x.x.1 of the Docker Network itself. What is wrong here? Any help is really appreciated. Here are some snippets out of the traefik compose file, traefik.toml and docker-compose.yml of an web app (nginx) behind the proxy. -----------------------------------------------compose file traefik-------------------------------------- ```auto version: '3' services: app: image: traefik:alpine container_name: traefik restart: always ports: - xxx.xxx.xxx.xxx:80:80 - xxx.xxx.xxx.xxx:443:443 labels: - traefik.frontend.rule=Host:monitor.xxxx.xxx - traefik.port=8080 volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - /var/data/traefik/traefik.log:/traefik.log - /var/data/config/traefik/traefik.toml:/traefik.toml:ro - /var/data/traefik/acme.json:/acme.json environment: - "TZ=Europe/Paris" networks: web: ipv4_address: 172.28.255.254 #fix ipv4_address in docker bridge network web, so that containers in behind can trust traefik ipv4_address networks: web: external: name: web ``` -----------------------------------------------traefik toml-------------------------------------- ```auto debug = false logLevel = "ERROR" defaultEntryPoints = ["http", "https"] [entryPoints] [entryPoints.dashboard] address = ":8080" [entryPoints.dashboard.auth] [entryPoints.dashboard.auth.basic] users = ["admin:$xxx/"] [entryPoints.http] address = ":80" [entryPoints.http.redirect] entryPoint = "https" [entryPoints.https] address = ":443" [entryPoints.https.tls] [traefikLog] filePath = "/traefik.log" format = "json" [api] entrypoint="dashboard" [acme] email = "xxxxxx@xxxx.xxx" storage = "acme.json" entryPoint = "https" onHostRule = true [acme.httpChallenge] entryPoint = "http" [docker] domain = "xxxxxx.xxx" watch = true network = "web" ``` -----------------------------------------------compose file web app-------------------------------------- ```auto web: image: nginx:alpine restart: always labels: - traefik.enable=true - traefik.backend=xxx - traefik.frontend.rule=Host:xxxx.xxxxxx.xxx - traefik.port=80 - traefik.docker.network=web - traefik.frontend.redirect.permanent=true ports: - 19080:80 links: - app volumes: - appvol:/var/www/html networks: - web ``` Cheers mc ---
**Author:** ![james.dean](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@james.dean](https://community.traefik.io/u/james.dean)\ **Post date:** [July 4, 2019, 12:09pm UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/2 "2019-07-04T12:09:21Z")
No bug, use [mode: host](https://dockerswarm.rocks/traefik/#getting-the-client-ip) ๐Ÿ™‚ ---
**Author:** ![wylie](https://avatars.discourse-cdn.com/v4/letter/w/958977/32.png) [@wylie](https://community.traefik.io/u/wylie)\ **Post date:** [July 4, 2019, 6:56pm UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/3 "2019-07-04T18:56:09Z")
Thank you for the hint! But, I donโ€™t want to install Docker swarm as a Single Node Cluster for getting correct client IPs into the Header. Itโ€™s a bit like taking a sledgehammer to crack a nut. ๐Ÿ™‚ [https://worp.one/getting-original-client-ip-from-a-request-in-docker-swarm/](https://worp.one/getting-original-client-ip-from-a-request-in-docker-swarm/) Is there really no other workaround out there at the moment. Whatโ€™s about Traefik 2.0? Is there the same constraint in common with Docker without swarm? ---
**Author:** ![zespri](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zespri/32/310_2.png) [@zespri](https://community.traefik.io/u/zespri)\ **Post date:** [July 9, 2019, 3:32am UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/4 "2019-07-09T03:32:49Z")
As far as I understand the advice James give is generic, it is not specific to swarm. It's just that examples given there are for swarm, but you should be able to do the same without. ---
**Author:** ![wylie](https://avatars.discourse-cdn.com/v4/letter/w/958977/32.png) [@wylie](https://community.traefik.io/u/wylie)\ **Post date:** [July 9, 2019, 9:09am UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/5 "2019-07-09T09:09:23Z")
Thanks zespri! As I understand, host mode in a non docker swarm can't be used with containers which are in docker networks. > In swarm mode, host mode hasn't this constraint, because there is a additional overlay network which connects host network as well towards containers in docker networks. But, there are other constraints in terms of high availability. [https://www.quora.com/Whats-the-difference-between-Docker-Swarm-Docker-Compose-and-Docker-Networks](https://www.quora.com/Whats-the-difference-between-Docker-Swarm-Docker-Compose-and-Docker-Networks) ---
**Author:** ![zespri](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zespri/32/310_2.png) [@zespri](https://community.traefik.io/u/zespri)\ **Post date:** [July 9, 2019, 7:27pm UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/6 "2019-07-09T19:27:38Z")
> [@wylie](#): > > Thanks zespri! As I understand, host mode in a non docker swarm can't be used with containers which are in docker networks. Can you point me to where you get this from. I skimmed through the link you gave, and even searched for "host" on that page, but could not find anything that would indicate it. Of course on swarm the host mode is trickier, because there is more than one host - that's what that link says, but that certainly should not preclude single-host no-swarm setup. ---
**Author:** ![wylie](https://avatars.discourse-cdn.com/v4/letter/w/958977/32.png) [@wylie](https://community.traefik.io/u/wylie)\ **Post date:** [July 10, 2019, 8:25am UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/7 "2019-07-10T08:25:21Z")
At stackoverflow "Traefik as a proxy for Docker container with host machines network" user BMitch replies with "Without a common docker network, traefik won't be able to route to your container." Regarding swarm mode constraints this will be discussed at before posted Worp.one link. [Quora.com](http://Quora.com) link explains differences between docker-compose and swarm in general. ---
**Author:** ![zespri](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zespri/32/310_2.png) [@zespri](https://community.traefik.io/u/zespri)\ **Post date:** [July 10, 2019, 8:43am UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/8 "2019-07-10T08:43:01Z")
> [@wylie](#): > > "Without a common docker network, traefik won't be able to route to your container." Yes, "common" here means common between traefik container and backend container. Host one should work in this case. ---
**Author:** ![wylie](https://avatars.discourse-cdn.com/v4/letter/w/958977/32.png) [@wylie](https://community.traefik.io/u/wylie)\ **Post date:** [July 10, 2019, 9:21am UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/9 "2019-07-10T09:21:31Z")
Okay, now I see where you're going with this. Basically it will work with host mode, but then all containers have to be run in host mode I guess and that's simply not possible in a complex docker environment. With swarm this would work, because you can still use docker networks with the Traefik running in host mode. But as already written I don't want to use swarm on a single host, because in my eyes this is a sledgehammer method and brings unnecessary complexity to - KISS - keep it stupid simple. ๐Ÿ˜‰ ---
**Author:** ![wylie](https://avatars.discourse-cdn.com/v4/letter/w/958977/32.png) [@wylie](https://community.traefik.io/u/wylie)\ **Post date:** [July 12, 2019, 7:25pm UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/10 "2019-07-12T19:25:21Z")
My question if this is a Docker or Traefik bug has still not been answered. Does nobody really know? ๐Ÿฅถ ---
**Author:** ![zespri](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zespri/32/310_2.png) [@zespri](https://community.traefik.io/u/zespri)\ **Post date:** [July 12, 2019, 11:47pm UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/11 "2019-07-12T23:47:31Z")
I don't think it's a bug per se, we just explored, how this happening above. That's just how the networking infrastructure built. Traefik cannot inject this header, because it does not have access to the source IP. Docker cannot inject this header because it's not working with HTTP(s) protocol at all it has no visibility to these headers on the network layer. Do we have to assign blame? ๐Ÿ˜‰ ---
**Author:** ![wylie](https://avatars.discourse-cdn.com/v4/letter/w/958977/32.png) [@wylie](https://community.traefik.io/u/wylie)\ **Post date:** [July 13, 2019, 8:50am UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/12 "2019-07-13T08:50:29Z")
I understand the background a little better now, thank you. So it's not a bug, but rather a limitation, or rather a missing possibility in today's technical standards. Maybe it helps to think laterally. What about the 2.0 version? Can it also handle pure TCP routing? If yes, you could start here, if not it would be maybe useful to push this further. My point here is in the least to accuse anyone. For me it is only important to communicate clearly what is possible and what is not, so that you don't end up in a dead end and in the worst case if you have already invested weeks or months in time. ---
**Author:** ![mr\_vadim](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/mr_vadim/32/1854_2.png) [@mr\_vadim](https://community.traefik.io/u/mr_vadim)\ **Post date:** [April 5, 2020, 12:48am UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/13 "2020-04-05T00:48:46Z")
thanks bro, it's helps ๐Ÿ‘ ๐Ÿ‘ ---
**Author:** ![grasshide](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/grasshide/32/5214_2.png) [@grasshide](https://community.traefik.io/u/grasshide)\ **Post date:** [April 13, 2022, 7:42am UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/14 "2022-04-13T07:42:28Z")
Hi there, since this is the first hit on google, I wanted to ask again if there is still no solution to this? I also use a single host docker machine with a lot of containers that are reachable via traefik. They all have their own docker networks (e.g. one for my private cloud, one for home automation, etc.). Using traefik in network mode host would completely break that and I'd have to expose all my services on my docker machine that I just managed to secure via authelia. All my logs are more or less useless (because I only see the docker gateway IP) and I really would like to use projects like crowdsec. The last entry here is from two years ago. Is there still no solution? ---
**Author:** ![sc-starman](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/sc-starman/32/7125_2.png) [@sc-starman](https://community.traefik.io/u/sc-starman)\ **Post date:** [May 16, 2023, 5:42pm UTC](https://community.traefik.io/t/is-this-a-docker-or-a-traefik-bug-x-forwarded-for-and-x-real-ip-not-correctly-transmitted/773/15 "2023-05-16T17:42:29Z")
I searched everywhere and tried all solutions for a swarm-based environment but no luck. Is there still no solution for this typical matter?