Teleport rejects traffic as X-Forwarded-For conttains multiple IPs

Traefik Traefik v2 (latest)
1

Hi there,

I am having two issues with running Teleport behind Traefik Proxy (https://goteleport.com/). We are proxying traffic through Cloudflare and therefore the X-Forwarded-For header contains multiple ip addresses once it hits the Teleport server. Teleport rejects this as a security measure and expects only one IP address in this Header. Is there a way to do this? My traefik.yml file contains the following for the entrypoints:

proxyProtocol:
  trustedIPs:
    - "cloudflare_ips"
forwardedHeaders:
  trustedIPs:
    - "cloudflare_ips"

In Teleport i have to set X-Forwarded-For to true however when doing this i get the error and cant use teleport but when disabled its using the cloudflare ips (not the actual client ip).

Any help is greatly appreciated, thanks.

2

It’s common practice to chain IPs in the header when multiple proxys are used on the way, even Wikipedia says so.

I would open a ticket with Teleport, tell them to please follow the Internet standard.