TCP Proxy protocol

[Dani-74-dot]

I need help with configuring the TCP proxy protocol to forward the real ip of the client. I hope it has the possibility to be integrated into the dashboard for easier handling.
Thanks

[miloschwartz]

Hey can you clarify a little bit what you're trying to do? Are you using a raw TCP resource (not http/s)?

[Dani-74-dot]

Yes a raw TCP, Traefik supports version 1 and 2 on TCP Services. It can be enabled by setting proxyProtocol on the load balancer. The PROXY protocol provides a convenient way to safely transport connection information how client ip ect...

[oschwartz10612]

Does setting it on the tcp entrypoint help you? https://doc.traefik.io/traefik/routing/entrypoints/#proxyprotocol

[Dani-74-dot]

Must be on Services no entrypoint. I try to configure loadbalancer but for me traefik is new.

[Dani-74-dot]

When enabling Proxy Protocol on an Entrypoint, it allows Traefik to understand an incoming Proxy Protocol wrapped request. With this, you can for example restrict the access to some user IPs.
When enabling Proxy Protocol on a service, you ask Traefik to add Proxy Protocol headers to forwarded request. It means that the IP/port from the incoming request will be added in the outgoing request.

[oschwartz10612]

Gotcha.

Okay I will see if I can easily make this an option in the next release or two. Right now it would not be possible to do manually because the services are loaded through the dynamic config from Pangolin.

[Dani-74-dot]

Nice thanks.

[ruohki]

id also be down. I use haproxy and the proxy protocol to expose services from a k8 cluster. However, id also like to expose stuff via pangolin that would, however, require that the upstream connection is made using the proxy protocol. Still was able to make it work by deploying a separate ingress / lb within the cluster. Its ugly tho :)

[OnekO]

I need this also... Maybe this could be a bigger task to allow customization of services, that could be really interesting.

[oschwartz10612]

Take a look at: https://doc.traefik.io/traefik/routing/entrypoints/#proxyprotocol

I think X-Forwarded-For header is installed by default by Traefik. Does this help at all? It might be the IP of the docker network if you do not install Traefik directly on the host or take steps to resolve like using network_mode: host.

[Dani-74-dot]

Proxy Protocol must be on a service, you ask Traefik to add Proxy Protocol headers to forwarded request. It means that the IP/port from the incoming request will be added in the outgoing request.

[aldenparker]

Is this not available for raw udp as well? The resource config has Configure Proxy Protocol to preserve client IP addresses for TCP/UDP services. as a description when I make a tcp resource, but does not have the option when making a udp resource

[oschwartz10612]

Traefik only supports PP for TCP. I updated that phrase 6766586

[aldenparker]

Thank you for the clarification!