# Traefik on k3s does not forward real client IP

**URL:** <https://community.traefik.io/t/traefik-on-k3s-does-not-forward-real-client-ip/26762>\
**Category:** Traefik v3 (latest)\
**Tags:** kubernetes-ingress\
**Created:** [March 6, 2025, 2:45am UTC](https://community.traefik.io/t/traefik-on-k3s-does-not-forward-real-client-ip/26762 "2025-03-06T02:45:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![JohnC](https://avatars.discourse-cdn.com/v4/letter/j/9de0a6/32.png) [@JohnC](https://community.traefik.io/u/JohnC)\
**Post date:** [March 6, 2025, 2:45am UTC](https://community.traefik.io/t/traefik-on-k3s-does-not-forward-real-client-ip/26762/1 "2025-03-06T02:45:57Z")

</div>

Hello,

I have a k3s cluster running with Traefik disabled and I installed it through the Helm chart (currently om chart version 34.4.1). I've been having problems with forwarding the real client IP to the Traefik pod. Right now its returning the pod IP.

Traefik LoadBalancer description:

```auto
$ kubectl describe service traefik -n kube-system
Name: traefik
Namespace: kube-system
Labels: app.kubernetes.io/instance=traefik-kube-system
                          app.kubernetes.io/managed-by=Helm
                          app.kubernetes.io/name=traefik
                          argocd.argoproj.io/instance=traefik
                          helm.sh/chart=traefik-34.4.1
Annotations: <none>
Selector: app.kubernetes.io/instance=traefik-kube-system,app.kubernetes.io/name=traefik
Type: LoadBalancer
IP Family Policy: PreferDualStack
IP Families: IPv4
IP: 10.43.2.168
IPs: 10.43.2.168
Port: web 80/TCP
TargetPort: web/TCP
NodePort: web 32268/TCP
Endpoints: 10.42.3.92:8000
Port: websecure 443/TCP
TargetPort: websecure/TCP
NodePort: websecure 32175/TCP
Endpoints: 10.42.3.92:8443
Session Affinity: None
External Traffic Policy: Local
Internal Traffic Policy: Cluster
HealthCheck NodePort: 31225
Events: <none>

```

$ kubectl get service traefik -n kube-system

```auto
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
traefik LoadBalancer 10.43.2.168 <pending> 80:32268/TCP,443:32175/TCP 3d4h

```

The external IP is pending but it works.I can access my pods but I get the wrong client IP's in the access logs. I've set the networkTrafficPolicy to Local aswell but that does not seem to solve it.

Helm values:

```auto
logs:
        general:
          level: DEBUG
        access:
          enabled: true
      providers:
        kubernetesIngress:
          publishedService:
            enabled: true
      priorityClassName: "system-cluster-critical"
      tolerations:
        - key: "CriticalAddonsOnly"
          operator: "Exists"
        - key: "node-role.kubernetes.io/control-plane"
          operator: "Exists"
          effect: "NoSchedule"
        - key: "node-role.kubernetes.io/master"
          operator: "Exists"
          effect: "NoSchedule"
      service:
        ipFamilyPolicy: "PreferDualStack"
      additionalArguments:
        - "--entryPoints.web.proxyProtocol.trustedips=0.0.0.0/0"
        - "--entryPoints.websecure.proxyProtocol.trustedips=0.0.0.0/0"
        - "--serversTransport.insecureSkipVerify=true"

```

I copied most settings from the k3s-specific implementation and added a few additional arguments as this setup used to work. Not sure why it doesn't work now.

Thank you for any help you can give me.

---

<div class="post-metadata">

**Author:** ![JohnC](https://avatars.discourse-cdn.com/v4/letter/j/9de0a6/32.png) [@JohnC](https://community.traefik.io/u/JohnC)\
**Post date:** [March 6, 2025, 3:06am UTC](https://community.traefik.io/t/traefik-on-k3s-does-not-forward-real-client-ip/26762/2 "2025-03-06T03:06:46Z")

</div>

Solved by enforcing that the Traefik pod runs on the master node.

```auto
      nodeSelector:
        node-role.kubernetes.io/master: 'true'

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [March 9, 2025, 3:07am UTC](https://community.traefik.io/t/traefik-on-k3s-does-not-forward-real-client-ip/26762/3 "2025-03-09T03:07:14Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.