Traefik Trusted Proxies
You set up traefik trusted proxies by adding upstream IP ranges to your entry point rules. This tells the router to read forwarded client headers from known load balancers. Most teams start by trusting all private network ranges during early testing. That broad rule lets any internal host spoof client headers and bypass IP checks. How traefik trusted proxies work in your stack When web traffic hits a load balancer first, the source IP changes. The backend app only sees the IP address of that
Trusted Execution Environments (TEE) + Traefik Middleware Security: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up traefik trusted proxies by adding upstream IP ranges to your entry point rules. This tells the router to read forwarded client headers from known load balancers. Most teams start by trusting all private network ranges during early testing. That broad rule lets any internal host spoof client headers and bypass IP checks.
How traefik trusted proxies work in your stack
When web traffic hits a load balancer first, the source IP changes. The backend app only sees the IP address of that upstream load balancer. Load balancers fix this by writing the original client IP into request headers. The router drops or overwrites these headers by default to stay safe.
To keep the real client IP, you must define trusted upstream IP ranges. You bind these IP ranges to each network entry point on the router. When a request arrives from a listed IP, the router keeps the header. When a request comes from an unknown IP, the router ignores fake headers.
This workflow depends on strict IP lists across your cloud network. You must list the exact subnet ranges of your CDN or cloud load balancer. If your cloud provider adds new IP ranges, you must update your list. If you miss an update, logs and rate limits see the wrong IP.
Why teams struggle with broad IP trust rules
Keeping upstream IP lists up to date takes steady manual work. Cloud load balancers often shift addresses when traffic spikes or nodes restart. When an IP shifts outside the trusted list, client IP rules break right away. Apps start blocking good users because every request looks like one single host.
To stop these outages, teams often trust every private network block by mistake. Some teams even turn on the setting that trusts all incoming headers everywhere. This fixes the broken logs, but it opens a major security hole. Any pod or server inside the network can now fake its IP address.
Trusted Execution Environments (TEE) + Traefik Middleware Security: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
This native setup only checks which network hop sent the packet. It decides who enters the network path, not what requests do in flight. Even with strict IP lists, the router cannot inspect internal commands or queries. Once traffic passes the entry point, engineers and apps hold full session reach.
What entry point IP rules leave open
Network header trust solves edge routing, but it does not govern internal access. Engineers still need direct paths to run backend tasks, read logs, or fix data. IP rules cannot tell which person on a shared network ran a command. They also cannot block a bad query or mask sensitive fields in results.
Relying on source IPs for internal security creates blind spots during audits. Shared NAT rules make ten engineers look like one single IP address. When someone runs a risky command, the network log only shows an IP. Teams need controls that work at the command and query level instead.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What happens if I do not set up trusted IPs?
Your backend apps will only see the IP address of the upstream load balancer. Rate limits, geo blocks, and audit logs will treat all users as one host.
Is it safe to trust all private IP ranges in a cluster?
Trusting all private subnets is risky in shared clusters. Any compromised container in that range can send fake headers and bypass IP allowlists.
How often should teams review upstream load balancer IP lists?
Teams should check upstream IP lists whenever they change cloud regions or CDN providers. Automate this check if your CDN publishes a public list of edge subnets.