Help wanted - Reverse-Proxy (own ip) with real ip forwarded

[MagicTrevor]

Hi guys,

I was getting along with a rootless reverse-proxy (nginx-proxy-manager) just fine, but ran into a scenario where I need to have the real client ip forwarded in (and the proxy ip different). I have tried to run this rootful via macvlan but have run into the issue where it cannot talk to the host and vice-versa.

What is the recommendation to setup this scenario?

[Luap99]

How do you run the container? If you run with --network slirp4netns:port_handler=slirp4netns it will preserve the source ip, also see https://docs.podman.io/en/stable/markdown/podman-create.1.html#network-mode-net. You cannot use this option with a named network, see #8193.

If the container is run as root you should always see the correct source ip by default, you do not need macvlan.

[MagicTrevor]

Does that work if that is set on a pod vs the container specifically?

[Luap99]

You should set it for the pod, if you set it for a container in a pod the container will create its own network namespace and not use the one from the pod.

[dustojnikhummer]

As of 2025, I was only able to get source IP by running Nginx (in my case Nginx Proxy Manager) in Network=host mode and accessing other containers via their PublishPort=127.0.0.1:hostport:containerpoirt

[Luap99]

host mode is not needed pasta preserves the source ip as well which is the default now.

The only place where it doesn't work is with custom networks (#8193) but you can use socket activation via nginx to work around that as well.

@eriksjolund documented a lot of these details here https://github.com/eriksjolund/podman-networking-docs

[dustojnikhummer]

host mode is not needed pasta preserves the source ip as well which is the default now.

The only place where it doesn't work is with custom networks (#8193) but you can use socket activation via nginx to work around that as well.

@eriksjolund documented a lot of these details here https://github.com/eriksjolund/podman-networking-docs

Thanks for the tip. Confirming this works

librespeed.container (quadlet)

[Unit]
Description=Librespeed

[Container]
ContainerName=librespeed
Image=ghcr.io/librespeed/speedtest:5.3.3
Network=pasta
PublishPort=10016:80
Timezone=Europe/Prague

[Service]
Restart=always
TimeoutStartSec=120

[Install]
WantedBy=multi-user.target default.target

[eriksjolund]

Side note:

nginx-proxy-manager does not currently support socket activation

• Podman socket activation support NginxProxyManager/nginx-proxy-manager#3922

but socket activation can be used with docker.io/library/nginx
See for example https://github.com/eriksjolund/podman-nginx-socket-activation/tree/main/examples/example7