[GH-ISSUE #5324] Proxy events showing IP of Traefik proxy as source #11196

Closed
opened 2026-08-05 01:28:50 -04:00 by saavagebueno · 14 comments
Owner

Originally created by @doubleoh13 on GitHub (Feb 14, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5324

Describe the problem

The Reverse Proxy Access Logs are reporting the source IP as the docker IP address of the Traefik container.

To Reproduce

Steps to reproduce the behavior:

  1. Create a Reverse Proxy Service
  2. Visit the service
  3. Click on Activity -> Proxy Events
  4. See that Location/IP is the IP address of the Traefik container (172.30.0.10)

Expected behavior

I would expect that the Location/IP would be the IP address of the client that is accessing the service.

Are you using NetBird Cloud?

Self-Hosted

NetBird version

v0.65.0

Is any other VPN software installed?

No

Screenshots

Image

Additional context

I have tried adding NB_PROXY_TRUSTED_PROXIES=172.30.0.10 and NB_PROXY_TRUSTED_PROXIES=172.30.0.10/32 to the proxy.env file. I have also tried adding command: --trusted-proxies 172.30.0.10 to the proxy service in the docker-compose.yml file. Neither provided any change in behavior.

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @doubleoh13 on GitHub (Feb 14, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5324 **Describe the problem** The Reverse Proxy Access Logs are reporting the source IP as the docker IP address of the Traefik container. **To Reproduce** Steps to reproduce the behavior: 1. Create a Reverse Proxy Service 2. Visit the service 3. Click on `Activity -> Proxy Events` 4. See that Location/IP is the IP address of the Traefik container (`172.30.0.10`) **Expected behavior** I would expect that the Location/IP would be the IP address of the client that is accessing the service. **Are you using NetBird Cloud?** Self-Hosted **NetBird version** `v0.65.0` **Is any other VPN software installed?** No **Screenshots** <img width="1260" height="817" alt="Image" src="https://github.com/user-attachments/assets/b839fe08-3972-43e7-af0e-bfd94c58d2ea" /> **Additional context** I have tried adding `NB_PROXY_TRUSTED_PROXIES=172.30.0.10` and `NB_PROXY_TRUSTED_PROXIES=172.30.0.10/32` to the `proxy.env` file. I have also tried adding `command: --trusted-proxies 172.30.0.10` to the `proxy` service in the `docker-compose.yml` file. Neither provided any change in behavior. **Have you tried these troubleshooting steps?** - [ ] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:28:50 -04:00
Author
Owner

@SuperKali commented on GitHub (Feb 14, 2026):

Same issue here:

Image
<!-- gh-comment-id:3902336222 --> @SuperKali commented on GitHub (Feb 14, 2026): Same issue here: <img width="437" height="623" alt="Image" src="https://github.com/user-attachments/assets/ab8c67d1-29ed-46e1-bd6d-d7786d5e9955" />
Author
Owner

@m0nji commented on GitHub (Feb 14, 2026):

same issue for me

<!-- gh-comment-id:3902804744 --> @m0nji commented on GitHub (Feb 14, 2026): same issue for me
Author
Owner

@lixmal commented on GitHub (Feb 15, 2026):

This is missing proxy protocol support, the http headers won't help. Do you want to give https://github.com/netbirdio/netbird/pull/5332 a spin?

<!-- gh-comment-id:3904026621 --> @lixmal commented on GitHub (Feb 15, 2026): This is missing proxy protocol support, the http headers won't help. Do you want to give https://github.com/netbirdio/netbird/pull/5332 a spin?
Author
Owner

@m0nji commented on GitHub (Feb 21, 2026):

i still have this problem. is it really fixed with #5332 ? do i have to change/set any variables in the config files?

<!-- gh-comment-id:3939162576 --> @m0nji commented on GitHub (Feb 21, 2026): i still have this problem. is it really fixed with #5332 ? do i have to change/set any variables in the config files?
Author
Owner

@doubleoh13 commented on GitHub (Feb 21, 2026):

i still have this problem. is it really fixed with #5332 ? do i have to change/set any variables in the config files?

It did for me, but I had to do a few thing not starting from scratch after looking at the PR.

# create traefik-dynamic.yaml
tcp:
  serversTransports:
    pp-v2:
      proxyProtocol:
        version: 2
# docker-compose.yml
services:
  ...
  traefik:
    ...
    command:
      ...
      # add the following to the list under command, this tells Traefik to use the traefik-dynamic.yaml file
      - "--providers.file.filename=/etc/traefik/dynamic.yaml"
    volumes:
      ...
      # add a bind mount for the traefik-dynamic.yaml file
      - ./traefik-dynamic.yaml:/etc/traefik/dynamic.yaml:ro"
  proxy:
    ...
    labels:
      ...
      # add the following to the labels for the proxy service
      - traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file
# config.yaml
# Add the following under server:
  reverseProxy:
      trustedHTTPProxies:
        - "172.30.0.10/32"
# add/edit the following in proxy.env
# Enable PROXY protocol to preserve client IPs through L4 proxies (Traefik TCP passthrough)
NB_PROXY_PROXY_PROTOCOL=true
# Trust Traefik's IP for PROXY protocol headers
NB_PROXY_TRUSTED_PROXIES=172.30.0.10

After you do all of that, restart your containers and everything should work.

<!-- gh-comment-id:3939198481 --> @doubleoh13 commented on GitHub (Feb 21, 2026): > i still have this problem. is it really fixed with [#5332](https://github.com/netbirdio/netbird/pull/5332) ? do i have to change/set any variables in the config files? It did for me, but I had to do a few thing not starting from scratch after looking at the PR. ```yaml # create traefik-dynamic.yaml tcp: serversTransports: pp-v2: proxyProtocol: version: 2 ``` ```yaml # docker-compose.yml services: ... traefik: ... command: ... # add the following to the list under command, this tells Traefik to use the traefik-dynamic.yaml file - "--providers.file.filename=/etc/traefik/dynamic.yaml" volumes: ... # add a bind mount for the traefik-dynamic.yaml file - ./traefik-dynamic.yaml:/etc/traefik/dynamic.yaml:ro" proxy: ... labels: ... # add the following to the labels for the proxy service - traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file ``` ```yaml # config.yaml # Add the following under server: reverseProxy: trustedHTTPProxies: - "172.30.0.10/32" ```` ```env # add/edit the following in proxy.env # Enable PROXY protocol to preserve client IPs through L4 proxies (Traefik TCP passthrough) NB_PROXY_PROXY_PROTOCOL=true # Trust Traefik's IP for PROXY protocol headers NB_PROXY_TRUSTED_PROXIES=172.30.0.10 ``` After you do all of that, restart your containers and everything should work.
Author
Owner

@alexmoras commented on GitHub (Feb 21, 2026):

i still have this problem. is it really fixed with #5332 ? do i have to change/set any variables in the config files?

It did for me, but I had to do a few thing not starting from scratch after looking at the PR.

create traefik-dynamic.yaml

tcp:
serversTransports:
pp-v2:
proxyProtocol:
version: 2

docker-compose.yml

services:
...
traefik:
...
command:
...
# add the following to the list under command, this tells Traefik to use the traefik-dynamic.yaml file
- "--providers.file.filename=/etc/traefik/dynamic.yaml"
volumes:
...
# add a bind mount for the traefik-dynamic.yaml file
- ./traefik-dynamic.yaml:/etc/traefik/dynamic.yaml:ro"
proxy:
...
labels:
...
# add the following to the labels for the proxy service
- traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file

config.yaml

Add the following under server:

reverseProxy:
trustedHTTPProxies:
- "172.30.0.10/32"

add/edit the following in proxy.env

Enable PROXY protocol to preserve client IPs through L4 proxies (Traefik TCP passthrough)

NB_PROXY_PROXY_PROTOCOL=true

Trust Traefik's IP for PROXY protocol headers

NB_PROXY_TRUSTED_PROXIES=172.30.0.10
After you do all of that, restart your containers and everything should work.

@doubleoh13 Hero! That's working for me!

<!-- gh-comment-id:3939246424 --> @alexmoras commented on GitHub (Feb 21, 2026): > > i still have this problem. is it really fixed with [#5332](https://github.com/netbirdio/netbird/pull/5332) ? do i have to change/set any variables in the config files? > > It did for me, but I had to do a few thing not starting from scratch after looking at the PR. > > # create traefik-dynamic.yaml > tcp: > serversTransports: > pp-v2: > proxyProtocol: > version: 2 > # docker-compose.yml > services: > ... > traefik: > ... > command: > ... > # add the following to the list under command, this tells Traefik to use the traefik-dynamic.yaml file > - "--providers.file.filename=/etc/traefik/dynamic.yaml" > volumes: > ... > # add a bind mount for the traefik-dynamic.yaml file > - ./traefik-dynamic.yaml:/etc/traefik/dynamic.yaml:ro" > proxy: > ... > labels: > ... > # add the following to the labels for the proxy service > - traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file > # config.yaml > # Add the following under server: > reverseProxy: > trustedHTTPProxies: > - "172.30.0.10/32" > # add/edit the following in proxy.env > # Enable PROXY protocol to preserve client IPs through L4 proxies (Traefik TCP passthrough) > NB_PROXY_PROXY_PROTOCOL=true > # Trust Traefik's IP for PROXY protocol headers > NB_PROXY_TRUSTED_PROXIES=172.30.0.10 > After you do all of that, restart your containers and everything should work. @doubleoh13 Hero! That's working for me!
Author
Owner

@m0nji commented on GitHub (Feb 21, 2026):

working for me too. thank you!
but why is this issue closed, when there are so many manual changes?

<!-- gh-comment-id:3939275673 --> @m0nji commented on GitHub (Feb 21, 2026): working for me too. thank you! but why is this issue closed, when there are so many manual changes?
Author
Owner

@si458 commented on GitHub (May 5, 2026):

i spent the last 3 hours trying to get this to work,
even setting up a new test netbird to compare the docker-compose files
then i found those values above where missing and it started working!
then to be a pain i googled those values and found this issue!
it would of been nice/easier if this was added into the enable reverse proxy guide in the migrate docs!
https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy

<!-- gh-comment-id:4382967009 --> @si458 commented on GitHub (May 5, 2026): i spent the last 3 hours trying to get this to work, even setting up a new test netbird to compare the docker-compose files then i found those values above where missing and it started working! then to be a pain i googled those values and found this issue! it would of been nice/easier if this was added into the enable reverse proxy guide in the migrate docs! https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy
Author
Owner

@Raylands commented on GitHub (May 8, 2026):

When connecting via PC, the logs showed the internal IP, so trusting the proxy fixed it.
But now when connecting with my phone the IP address shifts to the gateway of the Docker network. Adjusting to trust the gateway IP or even the whole 172.30.0.0/24 range doesn't work.

Denying IPv6 traffic through the firewall fixed it, so there seems to be a problem with the resolution of IPv6 connections.
https://github.com/netbirdio/netbird/issues/1964

<!-- gh-comment-id:4405808729 --> @Raylands commented on GitHub (May 8, 2026): When connecting via PC, the logs showed the internal IP, so trusting the proxy fixed it. But now when connecting with my phone the IP address shifts to the gateway of the Docker network. Adjusting to trust the gateway IP or even the whole 172.30.0.0/24 range doesn't work. Denying IPv6 traffic through the firewall fixed it, so there seems to be a problem with the resolution of IPv6 connections. [https://github.com/netbirdio/netbird/issues/1964](https://github.com/netbirdio/netbird/issues/1964#issuecomment-3063032687)
Author
Owner

@jnfrati commented on GitHub (May 8, 2026):

@Raylands interesting! If you have a bit of time, could you open a new issue-triage in the discussions tab with a bit of context so that we can keep track of it?

<!-- gh-comment-id:4406281509 --> @jnfrati commented on GitHub (May 8, 2026): @Raylands interesting! If you have a bit of time, could you open a new issue-triage in the discussions tab with a bit of context so that we can keep track of it?
Author
Owner

@MD7070B commented on GitHub (May 12, 2026):

Hello,

I have tried to apply the above mentioned fixes to my Netbird environment so I see proper Public IP's appearing in the Proxy log. After doing that, I checked on the logs, and I was still seeing the Traefik IP - no good. Thought I must have missed something. However, I logged in this morning, and it seems geniunie public IPs are now being logged!

This is great, but I don't really understand WHY. Perhaps I failed to restart the services fully after adjusting the config. I forget.

The above "fix" seems to be primarily a configuration change, rather than an application code change. Thus, will it be deployed into an update / release in future, or is it going to be a part of the installation steps?

Appreciate some clarification.

<!-- gh-comment-id:4428108882 --> @MD7070B commented on GitHub (May 12, 2026): Hello, I have tried to apply the above mentioned fixes to my Netbird environment so I see proper Public IP's appearing in the Proxy log. After doing that, I checked on the logs, and I was still seeing the Traefik IP - no good. Thought I must have missed something. However, I logged in this morning, and it seems geniunie public IPs are now being logged! This is great, but I don't really understand WHY. Perhaps I failed to restart the services fully after adjusting the config. I forget. The above "fix" seems to be primarily a configuration change, rather than an application code change. Thus, will it be deployed into an update / release in future, or is it going to be a part of the installation steps? Appreciate some clarification.
Author
Owner

@SteveMKII commented on GitHub (Jul 18, 2026):

For anyone who might still be having trouble getting this working make sure that the IP you're seeing is 172.30.0.10 and not 172.30.0.1, which is a Docker IP. I installed Netbird for the first time a couple of days ago, and was getting what I thought was this error, not noticing the IP was .1 and not .10. When I installed I used docker desktop context (exporting the docker host variable to do it) because I wanted to be able to view things in docker desktop, but I didn't realize the way desktop and default contexts handle the network is fundamentally different. Running it in default context fixed everything immediately. So don't be a fool like me 😂

<!-- gh-comment-id:5013259803 --> @SteveMKII commented on GitHub (Jul 18, 2026): For anyone who might still be having trouble getting this working make sure that the IP you're seeing is `172.30.0.10` and not `172.30.0.1`, which is a Docker IP. I installed Netbird for the first time a couple of days ago, and was getting what I thought was this error, not noticing the IP was .1 and not .10. When I installed I used docker desktop context (exporting the docker host variable to do it) because I wanted to be able to view things in docker desktop, but I didn't realize the way desktop and default contexts handle the network is fundamentally different. Running it in `default` context fixed everything immediately. So don't be a fool like me 😂
Author
Owner

@MD7070B commented on GitHub (Jul 19, 2026):

Ah :-) - I am not very familiar with Docker, but am running on a headless Linux server, so as far as I know I don't have the option of Docker Desktop - I just intalled docker and ran with that!

<!-- gh-comment-id:5015266386 --> @MD7070B commented on GitHub (Jul 19, 2026): Ah :-) - I am not very familiar with Docker, but am running on a headless Linux server, so as far as I know I don't have the option of Docker Desktop - I just intalled `docker` and ran with that!
Author
Owner

@SteveMKII commented on GitHub (Jul 19, 2026):

Ah :-) - I am not very familiar with Docker, but am running on a headless Linux server, so as far as I know I don't have the option of Docker Desktop - I just intalled docker and ran with that!

Yeah then it's probably not relevant to you. I just wanted to leave a general comment so no one ends up doing what I did and goes down a rabbit hole for a couple days. I didn't even know about docker contexts before setting up netbird, so I didn't understand the default context and desktop context operate differently. You can use docker context ls to see what context you're using but in your case it doesn't apply.

The IP of docker and traefik are just really similar and easy to miss the difference so I decided to leave a comment

<!-- gh-comment-id:5016811757 --> @SteveMKII commented on GitHub (Jul 19, 2026): > Ah :-) - I am not very familiar with Docker, but am running on a headless Linux server, so as far as I know I don't have the option of Docker Desktop - I just intalled `docker` and ran with that! Yeah then it's probably not relevant to you. I just wanted to leave a general comment so no one ends up doing what I did and goes down a rabbit hole for a couple days. I didn't even know about docker contexts before setting up netbird, so I didn't understand the default context and desktop context operate differently. You can use `docker context ls` to see what context you're using but in your case it doesn't apply. The IP of docker and traefik are just really similar and easy to miss the difference so I decided to leave a comment
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#11196