[Bug] Default Pangolin setup with Badger not properly forwarding real IP's via Cloudflare/IP based rules not working with Cloudflare #1556

New Issue

MrUnknownDE · 2026-04-05T19:34:18+02:00

MrUnknownDE commented

2026-04-05 19:34:18 +02:00

Originally created by @slimshizn on 4/30/2025

Have added the following to traefik_config.yml

entryPoints:
  web:
    address: :80
    forwardedHeaders:
      trustedIPs: &trustedIps
        - 172.18.0.0/16
        # CF
        - 173.245.48.0/20
        - 103.21.244.0/22
        - 103.22.200.0/22
        - 103.31.4.0/22
        - 141.101.64.0/18
        - 108.162.192.0/18
        - 190.93.240.0/20
        - 188.114.96.0/20
        - 197.234.240.0/22
        - 198.41.128.0/17
        - 162.158.0.0/15
        - 104.16.0.0/12
        - 172.64.0.0/13
        - 131.0.72.0/22
        - 2400:cb00::/32
        - 2606:4700::/32
        - 2803:f800::/32
        - 2405:b500::/32
        - 2405:8100::/32
        - 2a06:98c0::/29
        - 2c0f:f248::/32
        # CF
  websecure:
    address: :443
    forwardedHeaders:
      # Reuse list of Cloudflare Trusted IP's above for HTTPS requests
      trustedIPs: *trustedIps

Can see my IP hit via the traefik acces.log but IP based rules are still not working. Only will work via disabling orange cloud in cloudflare.

Example log

{"ClientAddr":"172.70.43.54:52720","ClientHost":"<MYIP>","DownstreamContentSize":0,"DownstreamStatus":304,"Duration":675516329,"RequestMethod":"GET","RequestPath":"/cover/168655/sm?c=1741857025","RequestProtocol":"HTTP/2.0","RetryAttempts":0,"ServiceName":"2-service@http","StartUTC":"2025-04-29T23:15:35.392421271Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","downstream_Content-Type":"","level":"info","msg":"","origin_Content-Type":"","request_Cookie":"REDACTED","request_User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0","request_X-Forwarded-For":"<MYIP>","request_X-Forwarded-Proto":"https","request_X-Real-Ip":"172.70.43.54","time":"2025-04-29T23:15:36Z"}

*Originally created by @slimshizn on 4/30/2025* Have added the following to `traefik_config.yml` ``` entryPoints: web: address: :80 forwardedHeaders: trustedIPs: &trustedIps - 172.18.0.0/16 # CF - 173.245.48.0/20 - 103.21.244.0/22 - 103.22.200.0/22 - 103.31.4.0/22 - 141.101.64.0/18 - 108.162.192.0/18 - 190.93.240.0/20 - 188.114.96.0/20 - 197.234.240.0/22 - 198.41.128.0/17 - 162.158.0.0/15 - 104.16.0.0/12 - 172.64.0.0/13 - 131.0.72.0/22 - 2400:cb00::/32 - 2606:4700::/32 - 2803:f800::/32 - 2405:b500::/32 - 2405:8100::/32 - 2a06:98c0::/29 - 2c0f:f248::/32 # CF websecure: address: :443 forwardedHeaders: # Reuse list of Cloudflare Trusted IP's above for HTTPS requests trustedIPs: *trustedIps ``` Can see my IP hit via the traefik acces.log but IP based rules are still not working. Only will work via disabling orange cloud in cloudflare. Example log ``` {"ClientAddr":"172.70.43.54:52720","ClientHost":"<MYIP>","DownstreamContentSize":0,"DownstreamStatus":304,"Duration":675516329,"RequestMethod":"GET","RequestPath":"/cover/168655/sm?c=1741857025","RequestProtocol":"HTTP/2.0","RetryAttempts":0,"ServiceName":"2-service@http","StartUTC":"2025-04-29T23:15:35.392421271Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","downstream_Content-Type":"","level":"info","msg":"","origin_Content-Type":"","request_Cookie":"REDACTED","request_User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0","request_X-Forwarded-For":"<MYIP>","request_X-Forwarded-Proto":"https","request_X-Real-Ip":"172.70.43.54","time":"2025-04-29T23:15:36Z"} ```

MrUnknownDE closed this issue

2026-04-05 19:34:18 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement reverse proxy reverse proxy reverse proxy reverse proxy reverse proxy

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1556