Traefik with private IP Address

Hi Team,

I am using traefik with ingress in my AKS application which is in Azure. right now, the domain resolves to ingress LB public IP and traefik routes it to right service. Our organization is implementing a policy that says all the requests should go through a WAF. For the same, I want to expose the same services through private IP and then use an application gateway to talk to the service. Is there a way to expose the services through a private load balance also? Implementing an IP restriction at middleware will not work as there will be an NSG to block all request from internet in the SubNet where ingress IP is added