Skip to main content

IPAllowList

IPAllowList accepts / refuses requests based on the client IP.

Configuration Options​

sourceRange​

FieldDescription
sourceRangeThe sourceRange option sets the allowed IPs (or ranges of allowed IPs by using CIDR notation).
Accepts request from defined IP
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: test-ipallowlist
spec:
  ipAllowList:
    sourceRange:
      - 127.0.0.1/32
      - 192.168.1.7

ipStrategy​

The ipStrategy option defines two parameters that set how Traefik determines the client IP: depth, and excludedIPs. If no strategy is set, the default behavior is to match sourceRange against the Remote address found in the request.

As a middleware, allowlisting happens before the actual proxying to the backend takes place. In addition, the previous network hop only gets appended to X-Forwarded-For during the last stages of proxying, that is, after it has already passed through allowlisting. Therefore, during allowlisting, as the previous network hop is not yet present in X-Forwarded-For, it cannot be matched against sourceRange.

ipStrategy.depth​

FieldDescription
ipStrategy.depthThe depth option tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).
note
  • If depth is greater than the total number of IPs in X-Forwarded-For, then the client IP will be empty.
  • depth is ignored if its value is less than or equal to 0.
Examples of Depth & X-Forwarded-For

If depth is set to 2, and the request X-Forwarded-For header is "10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1" then the "real" client IP is "10.0.0.1" (at depth 4) but the IP used is "12.0.0.1" (depth=2).

X-Forwarded-FordepthclientIP
"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"1"13.0.0.1"
"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"3"11.0.0.1"
"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"5""
Allowlisting Based on X-Forwarded-For with depth=2
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: test-ipallowlist
spec:
  ipAllowList:
    sourceRange:
      - 127.0.0.1/32
      - 192.168.1.7
    ipStrategy:
      depth: 2

ipStrategy.excludedIPs​

FieldDescription
ipStrategy.excludedIPsexcludedIPs configures Traefik to scan the X-Forwarded-For header and select the first IP not in the list.
note

If depth is specified, excludedIPs is ignored.

Example of ExcludedIPs & X-Forwarded-For
X-Forwarded-ForexcludedIPsclientIP
"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1""12.0.0.1,13.0.0.1""11.0.0.1"
"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1""15.0.0.1,13.0.0.1""12.0.0.1"
"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1""10.0.0.1,13.0.0.1""12.0.0.1"
"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1""15.0.0.1,16.0.0.1""13.0.0.1"
"10.0.0.1,11.0.0.1""10.0.0.1,11.0.0.1"""
Exclude from X-Forwarded-For
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: test-ipallowlist
spec:
  ipAllowList:
    ipStrategy:
      excludedIPs:
        - 127.0.0.1/32
        - 192.168.1.7