Jellyfin 10.5.0 with Traefik 2.1.4 - no real IP Adress

Hello guys,

i have a little problem.
I use jellyfin 10.5.0 and traefik 2.1.4 with docker and i dont see in Jellyfin the real IP Adresses.
The only IP Adress that i see is the IP Adress of my router.

Problem:
When i check the dashboard from where i logged in, i see the IP Adress of my router.
Because of that i cant use a user that only works in my local area network, because jellyfin thinks every access to it is from the local router ip.
I also see the IP in the log files:

Log Example when i try to login from WAN:
[2020-03-06 14:59:24.548 +00:00] [INF] RemoteClientBitrateLimit: 20000000, RemoteIp: “192.168.1.1”, IsInLocalNetwork: True

In the jellyfin config i didnt set anything special only my hostname and ssl redirect.
In the traefik config i set to forward the Headers.

Traefik Config:

  traefik:
    container_name: traefik
    image: traefik:v2.1.4
    restart: always
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"

    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - "--providers.file.directory=/rules"

      - --providers.docker.network=web
      - --entrypoints.web.address=:80
      - --entryPoints.web.forwardedHeaders.insecure

      - --entrypoints.web-secure.address=:443
      - --entryPoints.web-secure.forwardedHeaders.insecure

Hi there, I believe traefik should forward on the x-forward-for by default and jellyfin should pick those up. I’m not sure why it’s not working for you, I’d have to do some investigation into it

1 Like

This would be really great!

Can i provide any logs?
Maybe it is a problem with new jellyfin version? 2.1.4

There is no jellyfin 2.1.4, we’re currently on 10.5.0. Are you mistaking that with the traefik version you’re using there

Yep sorry, ment that as in first post.
Jellyfin 10.5.0 with traefik 2.1.4

And i ment maybe there is a problem with v2 of traefik?

So I had a look as I’m using traefik on my public instance of Jellyfin and the IP showing up is the IP of my VPN endpoint as would be expected so traefik is passing on the right ip to jellyfin, not sure what’s wrong with the configuration you have there. I am using traefik version 2.1.1 if that makes any difference

This would be my jellyfin config, do you see there something wrong?

  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    hostname: jellyfin   
    depends_on:    
      - traefik
    restart: always
    user: 1000:1000

    volumes:               
      - /opt/jellyfin/config:/config
      - /opt/jellyfin/cache:/cache
      - /media:/media:ro       

    networks:
      - traefik_proxy

    labels:
      - "traefik.enable=true"         
      - "traefik.http.routers.jellyfin-http.rule=Host(`***`)"
      - "traefik.http.routers.jellyfin-http.entrypoints=web"
      - "traefik.http.routers.jellyfin-http.middlewares=redirect@file" 
      - "traefik.http.routers.jellyfin-https.entrypoints=web-secure" 
      - "traefik.http.routers.jellyfin-https.rule=Host(`***`)"
      - "traefik.http.routers.jellyfin-https.tls.certresolver=mytlschallenge"

No I mean that all looks fine. I’d expect it to be an issue with how jellyfin is reading the incoming headers. You can see the kind of headers traefik is sending to the application using a container such as this: https://hub.docker.com/r/brndnmtthws/nginx-echo-headers/

I tried it to implement it into my compose file but i cant get the nginx proxy to work to show me my headers.
I know it looks like more of a traefik proxy, but would be great if i can figure this out.

You just add the labels to the container as you would with jellyfin to get traefik to pick it up. Then you go to that url either in a browser or on the command line and the body of the response will be the headers that traefik sent to nginx. This is just so you can see that traefik is properly sending the x-forward-for header that I’d imagine Jellyfin uses to pickup the IP

HA, got it working^^

Sadly it is the exact thing what you meantioned:

GET / HTTP/1.1
Host: test.domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) ***
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.5
Dnt: 1
Upgrade-Insecure-Requests: 1
X-Forwarded-For: 192.168.1.1
X-Forwarded-Host: test.domain.com
X-Forwarded-Port: 80
X-Forwarded-Proto: http
X-Forwarded-Server: 354f9a92a9ac
X-Real-Ip: 192.168.1.1

Should i go to the traefik forum?

That all looks right. It’s got the forwarded for and the real ip. So Jellyfin should pick up the address that’s in those, which by the looks of it is your router?

Yep true, 192.168.1.1 is the IP address of my router/modem.

I’m not sure why your router is showing packets from your WAN as coming from your routers internal IP. Traefik and jellyfin look like they’re both working as exepcted

I finally found the problem, i needed to reconfigure my router.
Problem was in configuration with a old hairpin nat config.

Great glad you got it sorted