# Traefik (via Docker/Podman) cannot get clients real ip in Gitlab logs **URL:** \ **Category:** Traefik v2\ **Tags:** tcp\ **Created:** [July 3, 2022, 12:55pm UTC](https://community.traefik.io/t/traefik-via-docker-podman-cannot-get-clients-real-ip-in-gitlab-logs/14974 "2022-07-03T12:55:53Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![leonidas-o](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/leonidas-o/32/5554_2.png) [@leonidas-o](https://community.traefik.io/u/leonidas-o)\ **Post date:** [July 3, 2022, 12:55pm UTC](https://community.traefik.io/t/traefik-via-docker-podman-cannot-get-clients-real-ip-in-gitlab-logs/14974/1 "2022-07-03T12:55:53Z")
Hello guys, I'm currently struggling to get the real clients IP address to end up in the gitlabs logs. As a background Info, I'm using Fail2Ban on gitlabs VM. Both Gitlab and Traefik are running via rootless podman. The Host server has a port forward for 443 and 80 to Traefik. I also played around with `forwardedHeaders` where I set the internal IP's as trusted and or set `insecure` flag. ```yaml api: dashboard: true debug: false insecure: true log: level: DEBUG entryPoints: web: address: ":80" forwardedHeaders: trustedIPs: - "1x.x.x.x/24" # internal - "1x.x.x.x/24" insecure: true websecure: address: ":443" forwardedHeaders: trustedIPs: - "1x.x.x.x/24" - "1x.x.x.x/24" insecure: true providers: file: directory: /etc/traefik/dynamic-conf # fsnotify not working with nfs watch: true ``` Gitlabs dynamic conf file looks like: ```yaml tcp: routers: gitlab-router: entryPoints: - web - websecure rule: "HostSNI(`gitlab.my-domain.com`)" service: gitlab-service-secure tls: passthrough: true services: gitlab-service-secure: loadBalancer: servers: - address: "gitlab1.my-domain.com:MYPORT" ``` A simple passthrough setup, all VM's/ Gitlab in that case, has a valid SSL Cert, so no need for Traefik to do something in here. So the chain is WWW -\> (Host Server: Port forward to) Traefik -\> Gitlab. Without Traefik this was working correctly. Then I added Traefik to not rely on port forwarding but real proxying. Thanks to podmans network mode (`podman run ... --network 'slirp4netns:port_handler=slirp4netns'`I do have the clients IP inside Traefik's container (former when gitlab was the first target, I had it there). That said, Traefik is in debug mode and shows the following logs when trying to access gitlab: ```auto level=debug msg="Handling connection from 46.142.xxx.xx:53690 to gitlab1.my-domain.com:MYPORT" ... level=debug msg="Handling connection from 1x.x.x.x:52084 to gitlab1.my-domain.com:MYPORT" ``` First entry was accessing gitlab over the internet, the second from within the VPN. Therefore I do have the correct IP in here. Now when looking into Gitlabs `logs/gitlab-rails/production_json.log` I only see entries with `meta.client_id`, `remote_ip` and `meta.remote_ip` set to `1x.x.x` (the IP of the VM where Traefik is running on. In Gitlab I also configured the following: ```bash nginx['real_ip_trusted_addresses'] = ['IPADDRESS_OF_TRAEFIK_VM'] nginx['real_ip_header'] = 'X-Forwarded-For' nginx['real_ip_recursive'] = 'on' ``` > [NGINX settings | GitLab](https://docs.gitlab.com/omnibus/settings/nginx.html#configuring-gitlab-trusted_proxies-and-the-nginx-real_ip-module) I'm also not sure if `TCP` routers/ services are the right one, could be it has to be a http router, as there is way more middleware. I hope it's clear what I want to achieve, any suggestions what to use to make it work? How can I examine the payload which is leaving Traefik to see if the `X-Forwarded_For` header is set (I'm pretty sure, there is no auto-magic feature in traefik which is doing anything like that when using a tcp router)? Whereas it should be there when using http routers according to: [Traefik Getting Started FAQ - Traefik](https://doc.traefik.io/traefik/getting-started/faq/#what-are-the-forwarded-headers-when-proxying-http-requests) ---
**Author:** ![leonidas-o](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/leonidas-o/32/5554_2.png) [@leonidas-o](https://community.traefik.io/u/leonidas-o)\ **Post date:** [July 3, 2022, 6:20pm UTC](https://community.traefik.io/t/traefik-via-docker-podman-cannot-get-clients-real-ip-in-gitlab-logs/14974/2 "2022-07-03T18:20:25Z")
Okay, I got it working. This was a tough one. Tested it out, fail2ban on Gitlabs VM sees and works with the correct client ip. If someone sees some optimisation for the configurations here, please let me know. Thanks Traefik static conf: ```yaml api: dashboard: true debug: false insecure: true log: level: DEBUG entryPoints: web: address: ":80" websecure: address: ":443" providers: file: directory: /etc/traefik/dynamic-conf # fsnotify not working with nfs watch: true ``` Gitlab dynamic conf: ```yaml http: routers: gitlab-http-router: entryPoints: - web rule: "Host(`gitlab.my-domain.com`)" service: gitlab-service-secure gitlab-https-router: entryPoints: - websecure rule: "Host(`gitlab.my-domain.com`)" service: gitlab-service-secure tls: {} services: gitlab-service-secure: loadBalancer: servers: - url: "https://gitlab1.my-domain.com:MYPORT" tls: certificates: - certFile: /etc/traefik/ssl/my-domain.com.fullchain.pem keyFile: /etc/traefik/ssl/my-domain.com.key - certFile: /etc/traefik/ssl/anotherdomain.com.fullchain.pem keyFile: /etc/traefik/ssl/anotherdomain.com.key ``` Also don't forget to configure Gitlab like: ```yaml nginx['real_ip_trusted_addresses'] = ['IPADDRESS_OF_TRAEFIK_VM'] nginx['real_ip_header'] = 'X-Forwarded-For' nginx['real_ip_recursive'] = 'on' ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\ **Post date:** [July 6, 2022, 6:20pm UTC](https://community.traefik.io/t/traefik-via-docker-podman-cannot-get-clients-real-ip-in-gitlab-logs/14974/3 "2022-07-06T18:20:27Z")
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.