TCP Service forward original IP

Traefik Traefik v2 (latest)
,
1

I am using traefik with adguard behind it using DNS over HTTPS and DNS of TLS on a remote server. So I can use android "private dns server".
But what traefik does is forwarding the local ip instead of the outside IP. So I see the adguard log the docker IP of traefik. Is there away to forward the original IP?

2

Traefik does not "forward" the local IP, but the connection to Adguard has Traefik IP just as origin, because that's where the local connection is coming from.

Traefik will "forward" IP information by placing them in the HTTP header ( X-Forwarded-*), I think that's done automatically, check if Adguard supports getting the IP from the header. Alternatively you can check if Adguard supports proxy-protocol.

3

Thanks for your information, adguard does support x-forward-* since I was using SWAG before which was forwarding the IP just fine.

My traefik config 
---
global:
  sendAnonymousUsage: false
  #checkNewVersion: false

api:
  insecure: false
  dashboard: true
  #debug: true

log:
  level: "WARN"

# accessLog:
#   format: json

providers:
  docker:
    endpoint: unix:///var/run/docker.sock
    exposedByDefault: false
    watch: true
    swarmMode: false
  file:
    directory: /rules
    watch: true

serversTransport:
  insecureSkipVerify: true

entryPoints:
  web:
    address: :80
    proxyProtocol:
      insecure: true
    forwardedHeaders:
      insecure: true
    http:
      redirections:
        entryPoint:
          to: websecure
  websecure:
    address: :443
    proxyProtocol:
      insecure: true
    forwardedHeaders:
      insecure: true
  dnsovertls:
    address: :853
  dns:
    address: :53
  udpdns:
    address: :53/udp
#  metrics:
#    address: :8456

# smtp:
#   address: :25
# smtp-ssl:
#   address: :465
# imap-ssl:
#   address: :993

certificatesResolvers:
  lets-encrypt:
    acme:
      #caserver: https://acme-staging-v02.api.letsencrypt.org/directory #only for debug
      email: {{emailaddress}}
      storage: /letsencrypt/acme.json
      tlschallenge: true
      preferredChain: 'ISRG Root X1'
      # httpChallenge:
      #   entrypoint: web
#metrics:
#  prometheus:
#    entryPoint: metrics
#    addEntryPointsLabels: true
#    addRoutersLabels: true
#    addServicesLabels: true
# buckets:
#   - 0.1
#   - 0.3
#   - 1.2
#   - 5.0
My Docker config 
services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: {{dockerrestartpolicy}}
    networks:
      - traefik_proxy
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
      - target: 853
        published: 853
        protocol: tcp
        mode: host
      - target: 53
        published: 53
        protocol: tcp
        mode: host
      - target: 53
        published: 53
        protocol: udp
        mode: host
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "/srv/docker/traefik2/rules:/rules"
      - "/srv/docker/traefik2/acme:/letsencrypt"
      - "/srv/docker/traefik2/traefik.yaml:/etc/traefik/traefik.yaml"
    environment:
      - TZ={{ntp_timezone}}
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.http.routers.traefikdashboard.rule=Host(`traefik.{{hostname}}`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      - "traefik.http.routers.traefikdashboard.entrypoints=websecure"
      - "traefik.http.routers.traefikdashboard.service=api@internal"
      - "traefik.http.routers.traefikdashboard.tls=true"
      - "traefik.http.routers.traefikdashboard.tls.certresolver=lets-encrypt"
      - "traefik.http.routers.traefikdashboard.middlewares=middlewares-ipwhitelist@file, redirect-web-to-websecure@internal, middlewares-rate-limit@file"