Why does `ForwardedHeadersTrustedIPs` exists ? Isn't it Traefik's `forwardedHeaders->trustedIPs` job ?

[buixor]

Hello,

I see that the traefik plugin has a ForwardedHeadersTrustedIPs directive that seems to be required when working with an upstream (lb, rp, cdn etc.).

However, Traefik itself has both forwardedHeaders.trustedIPs and proxyProtocol.trustedIPs directives.

I would have expected the latest to override the source IP (as it commonly happens in ie. nginx when x-forwarded-for is configured). If the natif traefik directives are used, is ForwardedHeadersTrustedIPs still needed ?

It might simply be my lack of knowledge about traefik, Thanks!

PS: I'm asking because I'm trying to update CrowdSec's official Traefik documentation, and this seems like a common pitfall.

[maxlerebourg]

You're right, I just tested it myself and found that Traefik replaces X-Real-Ip when we define proxyProtocol.trustedIPs.
So, if you want to use this header for that purpose, just set ForwardedHeadersCustomName=X-Real-Ip.

I'll override the default behavior and create a new minor version to signal this change.

Thank you very much.

[buixor]

awesome 👍

[maxlerebourg]

Do you use Traefik behind Cloudflare, and with HTTPS enabled ? I can't find a way to have the correct IP in X-Real-Ip with forwardedHeaders.trustedIPs and proxyProtocol.trustedIPs.

[mathieuHa]

Hi @buixor, we talked a lot about this with @maxlerebourg and in fact, to sum up, ForwardedHeadersTrustedIPs is necessary.

You can read more detail and discussions from Traefik community itself:

• Pass IP of ProxyProtocol host to HTTP headers traefik/traefik#9294
• Support "Forwarded" header instead "X-Forwarded-For" traefik/traefik#4099
• Feature Request: A way to restore client's real ip from a specified header when behind a proxy traefik/traefik#3097

One short extract from there that sums it up:

As we mentioned in PR #7875, we have several concerns about the X-Real-Ip.
Aside from in the Nginx (which is where X-Real-Ip was introduced) doc, we did not find any other reliable and well-explained documentation about the X-Real-Ip header behavior. So as it is, it cannot be considered a de-facto standard (unlike X-Forwarded-For).
The current Traefik behaviour regarding how X-Real-Ip is handled is naive, but avoids security issues since, if the request IP was trusted, it passes the header untouched, and otherwise sets it with the request IP itself.
The case that could be considered too restrictive is when the previous proxy is trusted and does not provide X-Real-Ip header. In that case, PR #7875 was proposing to set X-Real-Ip from what was found in X-Forwarded-For, but that seems of little value, since X-Real-Ip would then basically just be a redundant source of information.

As this subject is not as easy as it could seem, we think that a better approach is to implement a plugin, which we can use as a prototype to gather feedback on the limitations of this feature, and gauge its popularity wrt to the community

From the RFC7239, the header that may be integrated in the futur in Traefik is Forwarded.

[LaurenceJJones]

Do you use Traefik behind Cloudflare, and with HTTPS enabled ? I can't find a way to have the correct IP in X-Real-Ip with forwardedHeaders.trustedIPs and proxyProtocol.trustedIPs.

just quick context @buixor is CTO at CrowdSec and this question originated from an Enterprise customer that was using a CDN infront of traefik, as well as another customer that was using 2 traefiks one as a TCP proxy to downstream traefiks at layer 7 proxies.