# Trusting multiple forwarded headers for multiple forwarders

**URL:** <https://community.traefik.io/t/trusting-multiple-forwarded-headers-for-multiple-forwarders/17740>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [March 1, 2023, 7:46pm UTC](https://community.traefik.io/t/trusting-multiple-forwarded-headers-for-multiple-forwarders/17740 "2023-03-01T19:46:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![youngt2](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/youngt2/32/6055_2.png) [@youngt2](https://community.traefik.io/u/youngt2)\
**Post date:** [March 1, 2023, 7:46pm UTC](https://community.traefik.io/t/trusting-multiple-forwarded-headers-for-multiple-forwarders/17740/1 "2023-03-01T19:46:34Z")

</div>

My current setup for some of my sites are: visitor -\> cloudflare -\> traefik1 -\> traefik2 -\> service.  
Everything seems to be working fine, execpt for one small detail I can't seem to solve and that is logging of the original IP on the second traefik instance.  
On the first traefik instance I have added `entrypoints.websecure.forwardedheaders.trustedips=$CF_IPS` where CF\_IPS is the list of cloudflare forwarding IPv4s. This works as expected and my traefik access log will show the original visitor IP only.  
 ![image](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/f/fa264313d8d56b0c83edba025f21be4ace272ac8.png)

For the second instance of traefk, forwarded headers does not seem to get rid of both the cloudflare IP and the traefik1 IP. I've tried multiple combinations in the `forwardedheaders.trustedips`, but it seems my results are as follows:

**CFip and traefik1ip in trustedips**  
Access log shows `visitorip, cloudflareip` in log and X-Forwarded-For shows `visitorip, cloudflareip, traefik1ip`  
 ![image](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/2/2000ed444febcd7a87fc01ad24bb83b384cd59ea.png)

**traefik1ip only in trustedips**  
same as above situation

**CF only in trustedips**  
Access log shows `traefik1ip` in log and X-Forwarded-For shows only `traefik1ip`

It seems that after a trusted IP is found no more processesing is done? Is this expected?  
I have also tried a few different ipWhiteList options, but it seems that is only affecting access and not so much logging from what I can tell.

Is there anyway I can have the access log show just the visitor IP in this scenario on the second instance of traefik?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [March 4, 2023, 7:47am UTC](https://community.traefik.io/t/trusting-multiple-forwarded-headers-for-multiple-forwarders/17740/2 "2023-03-04T07:47:58Z")

</div>

Have you looked into `proxyprotocol`? It's kind of an extra layer between TCP and http.

I think Traefik supports it in `entrypoint` and `service`, you need to check with Cloudflare.