# Traefik proxy protocol not working. Not able to get Original source IP on tcp message **URL:** \ **Category:** Traefik v2\ **Tags:** kubernetes-crd\ **Created:** [July 14, 2023, 7:26am UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224 "2023-07-14T07:26:34Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![shubham3.mittal](https://avatars.discourse-cdn.com/v4/letter/s/f19dbf/32.png) [@shubham3.mittal](https://community.traefik.io/u/shubham3.mittal)\ **Post date:** [July 14, 2023, 7:26am UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/1 "2023-07-14T07:26:34Z")
My application is running on a TCP port and exposed via Traefik ingress crd. I have created a ingresstcp router in which I have added proxy protocol. Below is my configuration ```auto kind: IngressRouteTCP metadata: name: my-service-tcp namespace: monitoring spec: entryPoints: - tcpep routes: - match: HostSNI(`*`) services: - name: my-service port: 9090 proxyProtocol: version: 1 ``` My application is having support for proxy protocol. It will detect the original source IP from Proxy protocol header. But every time I am getting Traefik IP in my application logs and tcp dump also. Proxy protocol is not working in Traefik. Please help. Thanks, Shubham ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [July 14, 2023, 11:12am UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/2 "2023-07-14T11:12:57Z")
Use 3 backticks in front and after the code to format it, or select the code and press the `` button. Are you running a current Traefik version? It seems it's only supported since v2.4 ([doc](https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-ingressroutetcp)). Of course TCPdump will show the Traefik IP because this is where the packet came from. But when ProxyProtocol is active, you will see the originating IP in the content of the packet. ---
**Author:** ![shubham3.mittal](https://avatars.discourse-cdn.com/v4/letter/s/f19dbf/32.png) [@shubham3.mittal](https://community.traefik.io/u/shubham3.mittal)\ **Post date:** [July 14, 2023, 1:18pm UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/3 "2023-07-14T13:18:36Z")
Thanks for the quick response. I was trying in Traefik v2.3. Let me try in Traefik v2.9. Will get back ---
**Author:** ![shubham3.mittal](https://avatars.discourse-cdn.com/v4/letter/s/f19dbf/32.png) [@shubham3.mittal](https://community.traefik.io/u/shubham3.mittal)\ **Post date:** [July 14, 2023, 2:03pm UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/4 "2023-07-14T14:03:03Z")
I tried with Traefik v2.9 and it is working fine. We are getting original source IP. But we are not getting error also in Traefik v2.3 that proxy protocol is not supported. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [July 14, 2023, 7:23pm UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/5 "2023-07-14T19:23:02Z")
When you change my link to 2.3 you will see itโ€™s not there ๐Ÿ˜‰ ---
**Author:** ![shubham3.mittal](https://avatars.discourse-cdn.com/v4/letter/s/f19dbf/32.png) [@shubham3.mittal](https://community.traefik.io/u/shubham3.mittal)\ **Post date:** [July 24, 2023, 9:44am UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/6 "2023-07-24T09:44:51Z")
I am using Traefik ingress controller and routing the TCP request to my application that is having proxy protocol support. But I am getting same IP every time as original source IP even I am executing the request from different hosts. It looks like a subnet IP. I am using Traefik v2.9 Below are Traefik debug logs related to proxy protocol **time="2023-07-24T05:15:13Z" level=debug msg="Handling connection from 10.x.0.0:2787 to 10.x.x.123:9090"** original source IP is coming always 10.x.0.0. Is it K8 cluster subnet IP or something? I should get the original source IP from where I am executing the request. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [July 24, 2023, 10:36am UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/7 "2023-07-24T10:36:11Z")
I would not expect to see ProxyProtocol IPs in the Traefik debug log. Check the Traefik access log. ---
**Author:** ![shubham3.mittal](https://avatars.discourse-cdn.com/v4/letter/s/f19dbf/32.png) [@shubham3.mittal](https://community.traefik.io/u/shubham3.mittal)\ **Post date:** [July 24, 2023, 10:54am UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/8 "2023-07-24T10:54:10Z")
I am sending a TCP message that will not come in access log. I am getting Kubernetes cluster CIDR IP as original source IP. Why I am getting CIDR IP in proxy protocol? Do I need to add Trusted IP's in entry point proxy protocol configuration? Below is my logs at my application side and traefik logs Traefik debug logs **time="2023-07-24T10:50:15Z" level=debug msg="Handling connection from 10.244.0.0:59657 to 10.x.43.123:9090"** Application logs 2023-07-24 10:50:16.665 INFO app1 [pool-3-thread-71] MessageParserService : Decoded proxy message: HAProxyMessage(protocolVersion: V2, command: PROXY, proxiedProtocol: TCP4, **sourceAddress:** **10.244.0.0** , destinationAddress: 10.244.2.144, sourcePort: 12007, destinationPort: 8000, tlvs: ) ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [July 24, 2023, 12:00pm UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/9 "2023-07-24T12:00:43Z")
Seems like you need to set trusted IPs or `insecure` to trust any ([doc](https://doc.traefik.io/traefik/routing/entrypoints/#proxyprotocol)). ---
**Author:** ![shubham3.mittal](https://avatars.discourse-cdn.com/v4/letter/s/f19dbf/32.png) [@shubham3.mittal](https://community.traefik.io/u/shubham3.mittal)\ **Post date:** [July 24, 2023, 12:03pm UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/10 "2023-07-24T12:03:51Z")
I have added that also, still not getting original source IP. My services are deployed are type: ClusterIp. Below is traffic configuration ![image](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/a/a779844d69317cff9c3a9f898f8854dd21126591.png) ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [July 24, 2023, 12:21pm UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/11 "2023-07-24T12:21:48Z")
Try with `=true` ```auto --entryPoints.web.proxyProtocol.insecure=true ``` ---
**Author:** ![shubham3.mittal](https://avatars.discourse-cdn.com/v4/letter/s/f19dbf/32.png) [@shubham3.mittal](https://community.traefik.io/u/shubham3.mittal)\ **Post date:** [July 24, 2023, 12:33pm UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/12 "2023-07-24T12:33:29Z")
> [@bluepuma77](#): > > `true` Tried with true ![image](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/e/edb4e587d230fed783bdb3535e9604ed1653cf71.png) Stil getting original source IP as Kubernetes Cluster IP only time="2023-07-24T12:29:53Z" level=debug msg="Handling connection from **10.244.0.0:20566** to 10.244.3.205:9090" time="2023-07-24T12:29:53Z" level=debug msg="Error while setting deadline: set tcp 10.244.3.207:51840: use of closed network connection" ---
**Author:** ![shubham3.mittal](https://avatars.discourse-cdn.com/v4/letter/s/f19dbf/32.png) [@shubham3.mittal](https://community.traefik.io/u/shubham3.mittal)\ **Post date:** [July 25, 2023, 6:32am UTC](https://community.traefik.io/t/traefik-proxy-protocol-not-working-not-able-to-get-original-source-ip-on-tcp-message/19224/13 "2023-07-25T06:32:08Z")
@bluepuma77 , Any solution to this issue? Traefik is getting client IP as Kubernets cluster CIDR IP 10.244.0.0. Not getting original soruce IP from where the request is originating.