Trust of forwarded headers in Traefik

[DavidePrincipi]

If a NS8 is behind a reverse proxy, its source IP must be trusted for forwarded headers. Furthermore the original client IP must be preserved for logs, authorizations and Crowdsec bans.

See also

• https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers
• https://community.nethserver.org/t/ns8-traefik-forwardedheaders/23090

[DavidePrincipi]

In testing:

• core 3.6.0-dev.1
• traefik 3.0.0-testing.2

Test case

Goal: see the issue description

This feature is currently not exposed in the UI, it can be activated with api-cli.

Run this command to set the front-end proxy IP:

api-cli run module/traefik1/set-trusted-proxies --data '{"proxies":["192.168.12.3"]}'

Check the configuration:

api-cli run module/traefik1/get-trusted-proxies

If the front-end proxy is behind another proxy and so on, use the depth parameter too:

api-cli run module/traefik1/set-trusted-proxies --data '{"proxies":["192.168.12.3"],"depth":2}'

Verify that:

• In the web server logs, access from the outside network should be now logged with the correct client IP.
• IP access policy set with Limit access to HTTP routes by client IP #7312 is honored also behind a front-end proxy.