github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-24 03:02:24 -05:00
Code Issues 959 Packages Projects Releases 74 Wiki Activity

Client IP not forwarded to services #380

New Issue
Closed
opened 2025-11-13 11:58:42 -06:00 by GiteaMirror · 4 comments
GiteaMirror commented 2025-11-13 11:58:42 -06:00
Owner
Copy Link

Originally created by @FirmYn on GitHub (May 27, 2025).

Hi !
On the services deployed behind pangolin the user activity only shows private IP from newt tunnel.
There is some traefik plugins made for Cloudflare tunnels (which I do not use), that I tried without success. I don't find a lot of documentation on this subject, am I missing something ?

I am using pangolin 1.4.1 and the first version I deployed was the 1.1.0, if that helps :)

Example of activity on my jellyfin instance :
Image

Originally created by @FirmYn on GitHub (May 27, 2025). Hi ! On the services deployed behind pangolin the user activity only shows private IP from newt tunnel. There is some traefik plugins made for Cloudflare tunnels (which I do not use), that I tried without success. I don't find a lot of documentation on this subject, am I missing something ? I am using pangolin 1.4.1 and the first version I deployed was the 1.1.0, if that helps :) Example of activity on my jellyfin instance : ![Image](https://github.com/user-attachments/assets/23f41b0b-a0f1-4344-98e4-78ca03612a43)
GiteaMirror commented 2025-11-13 11:58:43 -06:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (May 27, 2025):

Hi! It depends on how your target service is extracting the client IP. The actual IP of the packets from Newt will always be its IP because it is a TCP reverse proxy, but there are headers added by Traefik to provide the real client IP. For example, see the below output of an http GET request through Pangolin to containous/whoami. The X-Forwarded-For and X-Real-Ip headers provide the real client IP.

Hostname: 7fc073673a41
IP: 127.0.0.1
IP: ::1
IP: 172.17.0.3
RemoteAddr: 172.17.0.1:50730
GET / HTTP/1.1
Host: test.fosrl.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.5
Cookie: p_session_token_s.1748355702263=lr43yivmgqqqope53zgay7klzf6hyxos
Priority: u=0, i
Referer: https://p.fosrl.io/
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Te: trailers
Upgrade-Insecure-Requests: 1
X-Forwarded-For: 100.36.185.88
X-Forwarded-Host: test.fosrl.io
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: 5c039251d853
X-Real-Ip: 100.36.185.88
@oschwartz10612 commented on GitHub (May 27, 2025): Hi! It depends on how your target service is extracting the client IP. The actual IP of the packets from Newt will always be its IP because it is a TCP reverse proxy, but there are headers added by Traefik to provide the real client IP. For example, see the below output of an http GET request through Pangolin to `containous/whoami`. The `X-Forwarded-For` and `X-Real-Ip` headers provide the real client IP. ``` Hostname: 7fc073673a41 IP: 127.0.0.1 IP: ::1 IP: 172.17.0.3 RemoteAddr: 172.17.0.1:50730 GET / HTTP/1.1 Host: test.fosrl.io User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.5 Cookie: p_session_token_s.1748355702263=lr43yivmgqqqope53zgay7klzf6hyxos Priority: u=0, i Referer: https://p.fosrl.io/ Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-site Te: trailers Upgrade-Insecure-Requests: 1 X-Forwarded-For: 100.36.185.88 X-Forwarded-Host: test.fosrl.io X-Forwarded-Port: 443 X-Forwarded-Proto: https X-Forwarded-Server: 5c039251d853 X-Real-Ip: 100.36.185.88 ```
GiteaMirror commented 2025-11-13 11:58:43 -06:00
Author
Owner
Copy Link

@FirmYn commented on GitHub (May 28, 2025):

Thanks a lot, I was completely misunderstanding how it works !

@FirmYn commented on GitHub (May 28, 2025): Thanks a lot, I was completely misunderstanding how it works !
GiteaMirror commented 2025-11-13 11:58:43 -06:00
Author
Owner
Copy Link

@tuandatdavid commented on GitHub (Jun 7, 2025):

Thanks a lot, I was completely misunderstanding how it works !

sorry, for reviving this old issue, but did you solve this? Or you just learned to live with it?

@tuandatdavid commented on GitHub (Jun 7, 2025): > Thanks a lot, I was completely misunderstanding how it works ! sorry, for reviving this old issue, but did you solve this? Or you just learned to live with it?
GiteaMirror commented 2025-11-13 11:58:43 -06:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (Jun 8, 2025):

@tuandatdavid target application needs to be able to pull the IP out of the headers of the request. See above response.

This is usually mostly application specific and is hard to give a general answer for - sorry!

@oschwartz10612 commented on GitHub (Jun 8, 2025): @tuandatdavid target application needs to be able to pull the IP out of the headers of the request. See above response. This is usually mostly application specific and is hard to give a general answer for - sorry!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#380
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?