So it means it is behind Docker NAT, and thus, Pangolin cannot get real IP because it is using network's default gateway.
The only solution is by exposing Gerbil to network_mode: host but doing so, Docker hostnames won't be available. But, if you change things like --reachableAt, --remoteConfig or --reportBandwidthTo, it won't work and show a HTTP Bad Gateway error in the Pangolin dashboard.
So, how to achieve this in order to log in the Traefik's access.log the real IP? Things like Traefik's plugins to achieve this won't work as I described, it is behind Docker NAT. And "mode: host" in "ports" won't work for docker compose files.
This is the docker-compose.yml I am trying to modify:
services:pangolin:image:fosrl/pangolin:1.2.0container_name:pangolinrestart:unless-stoppedvolumes:- ./config:/app/confighealthcheck:test:["CMD","curl","-f","http://localhost:3001/api/v1/"]interval:"3s"timeout:"3s"retries:15network_mode:hostgerbil:image:fosrl/gerbil:1.0.0container_name:gerbilrestart:unless-stoppeddepends_on:pangolin:condition:service_healthycommand:- --reachableAt=http://localhost:3003- --generateAndSaveKeyTo=/var/config/key- --remoteConfig=http://localhost:3001/api/v1/gerbil/get-config- --reportBandwidthTo=http://localhost:3001/api/v1/gerbil/receive-bandwidthvolumes:- ./config/:/var/configcap_add:- NET_ADMIN- SYS_MODULEnetwork_mode:hosttraefik:image:traefik:latestcontainer_name:traefikrestart:unless-stoppednetwork_mode:service:gerbil# Ports appear on the gerbil servicedepends_on:pangolin:condition:service_healthycommand:- --configFile=/etc/traefik/traefik_config.ymlenvironment:- CF_DNS_API_TOKEN=${CLOUDFLARE_API_KEY}volumes:- ./config/traefik:/etc/traefik:ro# Volume to store the Traefik configuration- ./config/crowdsec:/etc/crowdsec:ro# Volume to store the Crowdsec's Appsec configurations- ./config/letsencrypt:/letsencrypt# Volume to store the Let's Encrypt certificates- ./config/logs/:/var/log/traefik/# Storage for Traefik logs.
Originally created by @chris-coria on GitHub (Apr 29, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/615
By default, pangolin is using this network:
```yml
networks:
default:
driver: bridge
name: pangolin
```
So it means it is behind Docker NAT, and thus, Pangolin cannot get real IP because it is using network's default gateway.
The only solution is by exposing Gerbil to `network_mode: host` but doing so, **_Docker hostnames won't be available_**. But, if you change things like `--reachableAt`, `--remoteConfig` or `--reportBandwidthTo`, it won't work and show a **_HTTP Bad Gateway error_** in the Pangolin dashboard.
So, how to achieve this in order to log in the Traefik's `access.log` the real IP? Things like Traefik's plugins to achieve this won't work as I described, it is behind Docker NAT. And "mode: host" in "ports" won't work for docker compose files.
This is the docker-compose.yml I am trying to modify:
```yml
services:
pangolin:
image: fosrl/pangolin:1.2.0
container_name: pangolin
restart: unless-stopped
volumes:
- ./config:/app/config
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
interval: "3s"
timeout: "3s"
retries: 15
network_mode: host
gerbil:
image: fosrl/gerbil:1.0.0
container_name: gerbil
restart: unless-stopped
depends_on:
pangolin:
condition: service_healthy
command:
- --reachableAt=http://localhost:3003
- --generateAndSaveKeyTo=/var/config/key
- --remoteConfig=http://localhost:3001/api/v1/gerbil/get-config
- --reportBandwidthTo=http://localhost:3001/api/v1/gerbil/receive-bandwidth
volumes:
- ./config/:/var/config
cap_add:
- NET_ADMIN
- SYS_MODULE
network_mode: host
traefik:
image: traefik:latest
container_name: traefik
restart: unless-stopped
network_mode: service:gerbil # Ports appear on the gerbil service
depends_on:
pangolin:
condition: service_healthy
command:
- --configFile=/etc/traefik/traefik_config.yml
environment:
- CF_DNS_API_TOKEN=${CLOUDFLARE_API_KEY}
volumes:
- ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
- ./config/crowdsec:/etc/crowdsec:ro # Volume to store the Crowdsec's Appsec configurations
- ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
- ./config/logs/:/var/log/traefik/ # Storage for Traefik logs.
```
And this is the config.yml file:
```yml
app:
dashboard_url: "https://pangolin.example.com"
log_level: "info"
save_logs: true
domains:
domain1:
base_domain: "example.com"
cert_resolver: "cloudflare"
prefer_wildcard_cert: true
server:
external_port: 3000
internal_port: 3001
next_port: 3002
internal_hostname: "localhost"
session_cookie_name: "p_session_token"
resource_access_token_param: "p_token"
resource_access_token_headers:
id: "P-Access-Token-Id"
token: "P-Access-Token"
resource_session_request_param: "p_session_request"
traefik:
cert_resolver: "cloudflare"
http_entrypoint: "web"
https_entrypoint: "websecure"
gerbil:
start_port: 51820
base_endpoint: "pangolin.example.com"
use_subdomain: false
block_size: 24
site_block_size: 30
subnet_group: 100.89.137.0/20
rate_limits:
global:
window_minutes: 1
max_requests: 100
email:
smtp_host: "smtp.example.com"
smtp_port: 465
smtp_user: "support@example.com"
smtp_pass: "xxxxxxxxxxx"
no_reply: "support@example.com"
users:
server_admin:
email: "user@example.com"
password: "xxxxxxxxxxxxxxxxxx"
flags:
require_email_verification: true
disable_signup_without_invite: true
disable_user_create_org: true
allow_raw_resources: true
allow_base_domain_resources: true
```
Could you please elaborate why you need this or what doesn’t work?
Pangolin is reachable with the public ip of the host via the ports 443.
<!-- gh-comment-id:2838474812 -->
@TuncTaylan commented on GitHub (Apr 29, 2025):
Could you please elaborate why you need this or what doesn’t work?
Pangolin is reachable with the public ip of the host via the ports 443.
Could you please elaborate why you need this or what doesn’t work? Pangolin is reachable with the public ip of the host via the ports 443.
I not mean Pangolin is not reachable, I mean getting the real IP of the client is not working due to "bridge" network. Docker NATs the requests and due so, crowdsec will NOT work because ALL THE TRAFFIC IPs is "coming" from the Pangolin's network gateway.
So if anyone does something tricky, crowdsec will ban the Pangolin's docker network gateway and not the real IP of the attacker. Do I mean?
You could see by mounting - ./config/logs/:/var/log/traefik/ in traefik's volumes and enable accessLog in the traefik static file:
accessLog:bufferingSize:100fields:defaultMode:dropheaders:defaultMode:dropnames:Authorization:redactContent-Type:keepCookie:redactUser-Agent:keepX-Forwarded-For:keepX-Forwarded-Proto:keepX-Real-Ip:keepnames:ClientAddr:keepClientHost:keepDownstreamContentSize:keepDownstreamStatus:keepDuration:keepRequestMethod:keepRequestHost:keepRequestPath:keepRequestProtocol:keepRetryAttempts:keepServiceName:keepStartUTC:keepTLSCipher:keepTLSVersion:keep# Container's dir, not the machine dir.filePath:/var/log/traefik/access.log filters:minDuration:100msretryAttempts:truestatusCodes:- 200-299- 400-499- 500-599format:json
Use the default pangolin manual installation guide and you'll see.
<!-- gh-comment-id:2840309612 -->
@chris-coria commented on GitHub (Apr 29, 2025):
> Could you please elaborate why you need this or what doesn’t work? Pangolin is reachable with the public ip of the host via the ports 443.
I not mean Pangolin is not reachable, I mean getting the real IP of the client is not working due to "bridge" network. Docker NATs the requests and due so, crowdsec will NOT work because _**ALL THE TRAFFIC IPs is "coming" from the Pangolin's network gateway**_.
So if anyone does something tricky, crowdsec will ban the Pangolin's docker network gateway and not the real IP of the attacker. Do I mean?
You could see by mounting `- ./config/logs/:/var/log/traefik/` in traefik's volumes and enable `accessLog` in the traefik static file:
```yaml
accessLog:
bufferingSize: 100
fields:
defaultMode: drop
headers:
defaultMode: drop
names:
Authorization: redact
Content-Type: keep
Cookie: redact
User-Agent: keep
X-Forwarded-For: keep
X-Forwarded-Proto: keep
X-Real-Ip: keep
names:
ClientAddr: keep
ClientHost: keep
DownstreamContentSize: keep
DownstreamStatus: keep
Duration: keep
RequestMethod: keep
RequestHost: keep
RequestPath: keep
RequestProtocol: keep
RetryAttempts: keep
ServiceName: keep
StartUTC: keep
TLSCipher: keep
TLSVersion: keep
# Container's dir, not the machine dir.
filePath: /var/log/traefik/access.log
filters:
minDuration: 100ms
retryAttempts: true
statusCodes:
- 200-299
- 400-499
- 500-599
format: json
```
Use the default pangolin manual installation guide and you'll see.
I'm still having difficulties with understanding you, of what client are you talking about?
I have the stack pangolin + crowdsec and it sees the real IPs of the attackers and blocks them:
<!-- gh-comment-id:2840904718 -->
@TuncTaylan commented on GitHub (Apr 30, 2025):
I'm still having difficulties with understanding you, of what client are you talking about?
I have the stack pangolin + crowdsec and it sees the real IPs of the attackers and blocks them:
I'm still having difficulties with understanding you, of what client are you talking about? I have the stack pangolin + crowdsec and it sees the real IPs of the attackers and blocks them:
Hey, I see where the OP is coming from. I don't have a fancy Crowdsec GUI either. How did you get that? I do have Crowdsec working but even with Grafana and Prometheus, I only see the docker networks IP address as SOURCE, not the public IP's of the persons accessing resources....I'd love to know more
<!-- gh-comment-id:2843483252 -->
@parsoli commented on GitHub (Apr 30, 2025):
> I'm still having difficulties with understanding you, of what client are you talking about? I have the stack pangolin + crowdsec and it sees the real IPs of the attackers and blocks them:
>
> 
Hey, I see where the OP is coming from. I don't have a fancy Crowdsec GUI either. How did you get that? I do have Crowdsec working but even with Grafana and Prometheus, I only see the docker networks IP address as SOURCE, not the public IP's of the persons accessing resources....I'd love to know more
I'm still having difficulties with understanding you, of what client are you talking about? I have the stack pangolin + crowdsec and it sees the real IPs of the attackers and blocks them:
Hey, I see where the OP is coming from. I don't have a fancy Crowdsec GUI either. How did you get that? I do have Crowdsec working but even with Grafana and Prometheus, I only see the docker networks IP address as SOURCE, not the public IP's of the persons accessing resources....I'd love to know more
Glad to know i'm not the only one with that problem. The GUI he is using is Crowdsec.net dashboard. You need to enroll your instance there. Free plans only allow you to record 500 alerts.
<!-- gh-comment-id:2843492554 -->
@chris-coria commented on GitHub (Apr 30, 2025):
> > I'm still having difficulties with understanding you, of what client are you talking about? I have the stack pangolin + crowdsec and it sees the real IPs of the attackers and blocks them:
> > 
>
> Hey, I see where the OP is coming from. I don't have a fancy Crowdsec GUI either. How did you get that? I do have Crowdsec working but even with Grafana and Prometheus, I only see the docker networks IP address as SOURCE, not the public IP's of the persons accessing resources....I'd love to know more
Glad to know i'm not the only one with that problem. The GUI he is using is Crowdsec.net dashboard. You need to enroll your instance there. Free plans only allow you to record 500 alerts.
Yea, I haven't been able to run cscli commands. Say's "FATA[2025-04-30T22:45:58Z] while reading yaml file: open /etc/crowdsec/config.yaml: no such file or directory". There is no crowdsec folder in etc. It's all buried where I installed docker from under /home/docker. Have had to tweak things to work overall.
<!-- gh-comment-id:2843603652 -->
@parsoli commented on GitHub (Apr 30, 2025):
Yea, I haven't been able to run cscli commands. Say's "FATA[2025-04-30T22:45:58Z] while reading yaml file: open /etc/crowdsec/config.yaml: no such file or directory". There is no crowdsec folder in etc. It's all buried where I installed docker from under /home/docker. Have had to tweak things to work overall.
@github-actions[bot] commented on GitHub (May 15, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
<!-- gh-comment-id:2881886268 -->
@github-actions[bot] commented on GitHub (May 15, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
I am having exactly the same problem - I cannot see real IPs of the clients trying to access my pangolin instance, so there is no way to limit pangolin to say only certain IP addresses due to Docker NAT. Having 2FA is great but it would be even better to have an option to limit access to pangolin from say one or two IPs only.
<!-- gh-comment-id:2888629033 -->
@sorcer1122 commented on GitHub (May 17, 2025):
I am having exactly the same problem - I cannot see real IPs of the clients trying to access my pangolin instance, so there is no way to limit pangolin to say only certain IP addresses due to Docker NAT. Having 2FA is great but it would be even better to have an option to limit access to pangolin from say one or two IPs only.
Also in this setup, the IP Based Bypass Rules for Resources don't work.
<!-- gh-comment-id:2909514227 -->
@dpurnam commented on GitHub (May 26, 2025):
For now, I just run it in [HOST Docker Network Mode](https://github.com/dpurnam/pangolin). I'm yet to setup crowdsec, though.
Also in this setup, the IP Based Bypass Rules for Resources [don't work](https://github.com/fosrl/pangolin/issues/741).
@github-actions[bot] commented on GitHub (Jun 10, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
<!-- gh-comment-id:2957361695 -->
@github-actions[bot] commented on GitHub (Jun 10, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@github-actions[bot] commented on GitHub (Jun 24, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.
<!-- gh-comment-id:2998367591 -->
@github-actions[bot] commented on GitHub (Jun 24, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @chris-coria on GitHub (Apr 29, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/615
By default, pangolin is using this network:
So it means it is behind Docker NAT, and thus, Pangolin cannot get real IP because it is using network's default gateway.
The only solution is by exposing Gerbil to
network_mode: hostbut doing so, Docker hostnames won't be available. But, if you change things like--reachableAt,--remoteConfigor--reportBandwidthTo, it won't work and show a HTTP Bad Gateway error in the Pangolin dashboard.So, how to achieve this in order to log in the Traefik's
access.logthe real IP? Things like Traefik's plugins to achieve this won't work as I described, it is behind Docker NAT. And "mode: host" in "ports" won't work for docker compose files.This is the docker-compose.yml I am trying to modify:
And this is the config.yml file:
@TuncTaylan commented on GitHub (Apr 29, 2025):
Could you please elaborate why you need this or what doesn’t work?
Pangolin is reachable with the public ip of the host via the ports 443.
@chris-coria commented on GitHub (Apr 29, 2025):
I not mean Pangolin is not reachable, I mean getting the real IP of the client is not working due to "bridge" network. Docker NATs the requests and due so, crowdsec will NOT work because ALL THE TRAFFIC IPs is "coming" from the Pangolin's network gateway.
So if anyone does something tricky, crowdsec will ban the Pangolin's docker network gateway and not the real IP of the attacker. Do I mean?
You could see by mounting
- ./config/logs/:/var/log/traefik/in traefik's volumes and enableaccessLogin the traefik static file:Use the default pangolin manual installation guide and you'll see.
@TuncTaylan commented on GitHub (Apr 30, 2025):
I'm still having difficulties with understanding you, of what client are you talking about?
I have the stack pangolin + crowdsec and it sees the real IPs of the attackers and blocks them:
@chris-coria commented on GitHub (Apr 30, 2025):
Then I don't understand why in my Traefik's access log it is showing the Pangolin docker network instead of real IP. Here is my debug:
You can see the docker network inspect, the default gateway is taken IP.
@parsoli commented on GitHub (Apr 30, 2025):
Hey, I see where the OP is coming from. I don't have a fancy Crowdsec GUI either. How did you get that? I do have Crowdsec working but even with Grafana and Prometheus, I only see the docker networks IP address as SOURCE, not the public IP's of the persons accessing resources....I'd love to know more
@chris-coria commented on GitHub (Apr 30, 2025):
Glad to know i'm not the only one with that problem. The GUI he is using is Crowdsec.net dashboard. You need to enroll your instance there. Free plans only allow you to record 500 alerts.
@parsoli commented on GitHub (Apr 30, 2025):
Yea, I haven't been able to run cscli commands. Say's "FATA[2025-04-30T22:45:58Z] while reading yaml file: open /etc/crowdsec/config.yaml: no such file or directory". There is no crowdsec folder in etc. It's all buried where I installed docker from under /home/docker. Have had to tweak things to work overall.
@github-actions[bot] commented on GitHub (May 15, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@sorcer1122 commented on GitHub (May 17, 2025):
I am having exactly the same problem - I cannot see real IPs of the clients trying to access my pangolin instance, so there is no way to limit pangolin to say only certain IP addresses due to Docker NAT. Having 2FA is great but it would be even better to have an option to limit access to pangolin from say one or two IPs only.
@dpurnam commented on GitHub (May 26, 2025):
For now, I just run it in HOST Docker Network Mode. I'm yet to setup crowdsec, though.
Also in this setup, the IP Based Bypass Rules for Resources don't work.
@github-actions[bot] commented on GitHub (Jun 10, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@github-actions[bot] commented on GitHub (Jun 24, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.