Show actual IP's in traefik access logs

[DerpBoy77]

In the traefik access logs and the dokploy requests page all my requests are logged as coming from the IP 10.0.2.1 which is the address for the docker_gwbridge.

I want to know if there is a way to log actual ip's so i can configure traefik to only allow access from certain IP ranges?

[dosubot[bot]]

Hi @DerpBoy77! I'm Dosu and I'm helping the Dokploy team.

The 10.0.2.1 you're seeing is because of how Docker Swarm routes ingress traffic through docker_gwbridge before it reaches Traefik, and the default Dokploy-generated traefik.yml does not include any forwardedHeaders configuration on the entrypoints [1].

To get real client IPs, edit /etc/dokploy/traefik/traefik.yml and add forwardedHeaders to both entrypoints:

entryPoints:
  web:
    address: ':80'
    forwardedHeaders:
      trustedIPs:
        - "10.0.0.0/8"
        - "172.16.0.0/12"
        - "192.168.0.0/16"
  websecure:
    address: ':443'
    http3:
      advertisedPort: 443
    http:
      tls:
        certResolver: letsencrypt
    forwardedHeaders:
      trustedIPs:
        - "10.0.0.0/8"
        - "172.16.0.0/12"
        - "192.168.0.0/16"

Then restart the dokploy-traefik container. This tells Traefik to trust X-Forwarded-For headers coming from Docker's internal networks and use the real client IP instead.

Important caveat: If Docker's NAT layer has already stripped the original IP before Traefik receives the request (which can happen especially with IPv6), forwardedHeaders alone won't recover it. A related issue (#2349) found that IPv6 client IPs were irreversibly lost at the Docker NAT level, requiring dual-stack Docker networking reconfiguration to fix. For IPv4 traffic behind a standard setup, the forwardedHeaders.trustedIPs approach above should work.

Once real IPs are showing up, you can restrict access by IP using Traefik's ipAllowList middleware. Dokploy doesn't have a UI for this, but you can create a custom YAML file in /etc/dokploy/traefik/dynamic/ — for example, ip-filter.yml [2]:

http:
  middlewares:
    ip-filter:
      ipAllowList:
        sourceRange:
          - "203.0.113.0/24"
          - "198.51.100.50"

Then reference ip-filter@file in your application's middleware configuration in Dokploy. Files you add to the dynamic directory persist across deploys since Dokploy only regenerates the per-app files [2].

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.