SOLVED: Client IPs with reverse proxy not showing correct

[th0str]

I have an issue with client IPs on reverse proxy.

When accessing my jellyfin server from jellyfin.mydomain.zxz all my client IP are listed as my gateways IP address (192.168.1.1) - regardless of the clients are located on my local network or as a remote connection. But they show correctly then accessing the server locally.

Im using Traefik 3.3.1 and Jellyfin 10.10.3

My network settings are as following:

Code:

<?xml version="1.0" encoding="utf-8"?>
<NetworkConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <BaseUrl />
  <EnableHttps>false</EnableHttps>
  <RequireHttps>false</RequireHttps>
  <InternalHttpPort>8096</InternalHttpPort>
  <InternalHttpsPort>8920</InternalHttpsPort>
  <PublicHttpPort>8096</PublicHttpPort>
  <PublicHttpsPort>8920</PublicHttpsPort>
  <AutoDiscovery>true</AutoDiscovery>
  <EnableUPnP>false</EnableUPnP>
  <EnableIPv4>true</EnableIPv4>
  <EnableIPv6>false</EnableIPv6>
  <EnableRemoteAccess>true</EnableRemoteAccess>
  <LocalNetworkSubnets />
  <LocalNetworkAddresses>
    <string>192.168.1.200</string>
  </LocalNetworkAddresses>
  <KnownProxies>
    <string>traefik</string>
  </KnownProxies>
  <IgnoreVirtualInterfaces>true</IgnoreVirtualInterfaces>
  <VirtualInterfaceNames>
    <string>veth</string>
  </VirtualInterfaceNames>
  <EnablePublishedServerUriByRequest>false</EnablePublishedServerUriByRequest>
  <PublishedServerUriBySubnet />
  <RemoteIPFilter />
  <IsRemoteIPFilterBlacklist>false</IsRemoteIPFilterBlacklist>
</NetworkConfiguration>

[TheDreadPirate]

You have to add 192.168.1.1 as a known proxy. "traefik" in that field doesn't do anything. If traefik is on a different box, you may need to add additional IPs to known proxies (comma separated).

[th0str]

You have to add 192.168.1.1 as a known proxy.  "traefik" in that field doesn't do anything.  If traefik is on a different box, you may need to add additional IPs to known proxies (comma separated).

That is also my guess but don't change anything if I set 192.168.1.1 as a know proxy. Clients are still reporting with the same IP.

[TheDreadPirate]

Did you restart Jellyfin? IIRC, everything in the network section requires a restart to apply the change.

[th0str]

Yes I have restarted server after making the changes in Network settings

[TheDreadPirate]

Is the x-forwarded-for header set in traefik?

[th0str]

I found the issue. Cloudflare did not forward headers and after I fixed that, the IPs showed up correctly

[TheDreadPirate]

For the record, using cloudflare to proxy video and audio streams is against their TOS. We recommend you switch to DNS only in the cloudflare dashboard.