TCP/UDP routers not passing source IP to destination

Traefik Traefik v2
1

I tried to use Traefik in front of a DNS server (AdGuard Home) to load balance UDP and TCP DNS requests.

Both AdGuard and traefik are on the same docker host.

traefik.yml config

entryPoints:
  dns53t:
    address: :53/tcp
  dns53u:
    address: :53/udp

adguard docker compose labels

# port 53 tcp
      - "traefik.tcp.routers.adguard53t.entrypoints=dns53t"
      - "traefik.tcp.routers.adguard53t.rule=HostSNI(`*`)"
      - "traefik.tcp.routers.adguard53t.service=adguard53t"
      - "traefik.tcp.services.adguard53t.loadbalancer.server.port=53"
# port 53 udp
      - "traefik.udp.routers.adguard53u.entrypoints=dns53u"
      - "traefik.udp.routers.adguard53u.service=adguard53u"
      - "traefik.udp.services.adguard53u.loadbalancer.server.port=53"

But in adguard logs the client ip is showing the ip of traefik docker container.

image
image1211×391 21.8 KB

I know passing headers is not relevant to TCP/UDP but I can't overcome this issue.
In AdGuard i use different settings (blocking services) by the source ip.
Does anyone have any ideas?

Thank you

2

No one knows?
this is so frustrating to me

3

Would love to know too

4

A TCP connection has a source and a target, those are always the real IPs, so when Traefik is forwarding TCP packets, the source will be the Traefik IP.

A common way around this is to utilize the ProxyProtocol, which adds the original IP within the TCP packet (as data). Traefik should support this for incoming connections (e.g. from a load balancer) and outgoing connections (to a target service). Your target service must support it, too.

5

We're having the same problem.

Trying to set-up DNS in Kubernetes using Traefik as the ingress.

We just need Traefik to route the traffic to the pods rather than proxy it so we need to find another solution ...

@shlomi - Did you find a work around for this?