{"id":13548583,"url":"https://github.com/Paxxs/traefik-get-real-ip","last_synced_at":"2025-04-02T21:31:52.644Z","repository":{"id":50667418,"uuid":"461761882","full_name":"Paxxs/traefik-get-real-ip","owner":"Paxxs","description":"traefik get the real IP from the X-Forwarded-For or CDN specified header field. ","archived":false,"fork":false,"pushed_at":"2023-07-16T14:14:58.000Z","size":107,"stargazers_count":59,"open_issues_count":2,"forks_count":11,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-11-03T17:39:55.684Z","etag":null,"topics":["traefik","traefik-plugin"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Paxxs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-02-21T08:06:51.000Z","updated_at":"2024-10-24T16:43:10.000Z","dependencies_parsed_at":"2024-06-20T09:18:39.258Z","dependency_job_id":"039a16f3-436a-4907-900b-88ede8332fc3","html_url":"https://github.com/Paxxs/traefik-get-real-ip","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Paxxs%2Ftraefik-get-real-ip","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Paxxs%2Ftraefik-get-real-ip/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Paxxs%2Ftraefik-get-real-ip/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Paxxs%2Ftraefik-get-real-ip/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Paxxs","download_url":"https://codeload.github.com/Paxxs/traefik-get-real-ip/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246895823,"owners_count":20851332,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["traefik","traefik-plugin"],"created_at":"2024-08-01T12:01:12.122Z","updated_at":"2025-04-02T21:31:52.405Z","avatar_url":"https://github.com/Paxxs.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# Traefik Get Real IP address\n\n\u003c!-- cspell:words traefik middlewares proxyHeadername proxyHeadervalue Kubernetes --\u003e\n\nWhen traefik is deployed behind multiple load balancers, this plugin can be used to detect different load balancers and extract the real IP from different header fields, then output the value to the `x-real-ip` header.\n\nThis plugin can prevent IP spoofing by checking if the values form the received header information of the load balancer match before extracting the IP address.\n\nFor example, in the configuration of `CloudFlare` load balancer shown below, we configure it to only accept the header `x-from-cdn` with a value equal to `cf-foo`, and extract the IP address from the `Cf-Connecting-Ip` header. Since users never know about the existence of the `x-from-cdn` header or its required value `cf-foo`, it remains secure 🛡️. To increase complexity and avoid being guessed, you can use a random string :)\n\n```\n CloudFlare\n┌─────────┐\n│         ├────────────────────────────────►  ┌───────┬────────┐\n└─────────┘ x-from-cdn:cf-foo                 │       │        │\n            Cf-Connecting-Ip: realip          │       │        │\n CDN2                                         │       │        │\n┌─────────┐                                   │       │ paxxs's│\n│         ├────────────────────────────────►  │traefik│        │ x-real-ip:realip\n└─────────┘ x-from-cdn:mf-bar                 │       │Get-rea ├─────────────►\n            Client-iP: realip                 │       │ l-ip   │\n CDN3                                         │       │Plugin  │\n┌─────────┐                                   │       │        │\n│         ├───────────────────────────────►   │       │        │\n└─────────┘ x-from-cdn:mf-fun                 └───────┴────────┘\n            x-forwarded-for: realip,x.x.x.x\n                           (truthedIP)          ▲  ▲\n                                                │  │\n ┌────────┐                                     │  │\n └────────┘ ────────────────────────────────────┘  │\n   \"*\"                                             │\n ┌────────┐                RemoteAddr/etc..        │\n └────────┘ ───────────────────────────────────────┘\n```\n\n## CDN Configuration\n\nE.g. Cloudflare:\n\nRules \u003e Transform Rules \u003e HTTP Request Header Modification \u003e Add\n- Set static Header: `X-From-Cdn`\n  - Value: `cf-foo`\n\n![image](https://user-images.githubusercontent.com/10364775/164590908-43edab8a-cdc8-4d4c-abd6-542b6c798f3b.png)\n\n![image](https://user-images.githubusercontent.com/10364775/164591134-4dd2fc97-cd0e-4deb-8fe3-bcd4555ebbde.png)\n\n## Traefik Configuration\n### Static\n\nPlugin Info:\n- moduleName: `github.com/Paxxs/traefik-get-real-ip`\n- version: `v1.0.2`\n\nTraefik Configuration:\n- yml\n- toml\n- docker-labels\n\n```yml\npilot:\n  token: [REDACTED]\n\nexperimental:\n  plugins:\n    real-ip:\n      moduleName: github.com/Paxxs/traefik-get-real-ip\n      version: [Please fill the latest version !]\n```\n\n### Dynamic\n\n- yml\n- toml\n- docker labels\n- Kubernetes\n\n```yml\nhttp:\n  middlewares:\n    real-ip-foo:\n      plugin:\n        real-ip:\n          Proxy:\n            - proxyHeadername: X-From-Cdn\n              proxyHeadervalue: mf-fun\n              realIP: X-Forwarded-For\n            - proxyHeadername: X-From-Cdn\n              proxyHeadervalue: mf-bar\n              realIP: Client-Ip\n              OverwriteXFF: true # default: false, v1.0.2 or above\n            - proxyHeadername: X-From-Cdn\n              proxyHeadervalue: cf-foo\n              realIP: Cf-Connecting-Ip\n              OverwriteXFF: true # default: false, v1.0.2 or above\n            - proxyHeadername: \"*\"\n              realIP: RemoteAddr\n\n  routers:\n    my-router:\n      rule: Host(`localhost`)\n      middlewares:\n        - real-ip-foo\n      service: my-service\n\n  services:\n    my-service:\n      loadBalancer:\n        servers:\n          - url: 'http://127.0.0.1'\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPaxxs%2Ftraefik-get-real-ip","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FPaxxs%2Ftraefik-get-real-ip","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPaxxs%2Ftraefik-get-real-ip/lists"}