Skip to content

Conversation

onno204
Copy link

@onno204 onno204 commented Sep 20, 2025

Description

This PR implements X-Forwarded-For & Cf-Connecting-Ip headers to support the IP Rules of Pangolin.

All credits go to @hajimAIM for creating an IPv4 version, and to @jghaanstra for updating it to also support IPv6.
Since both their repositories are forked incorrectly, I was unable to create a PR from their repositories.

How to test?

To test, set up a Pangolin instance behind a proxy and use X-Forwarded-For headers.
Update Traefik to trust the Proxy in the traefik config file:

entryPoints:
  web:
    address: ":80"
    forwardedHeaders:
      trustedIPs:
        - "10.10.10.10/32"
  websecure:
    address: ":443"
    forwardedHeaders:
      trustedIPs:
        - "10.10.10.10/32"

Next, us the IP rules in pangolin to block/allow access as shown in the screenshot.

image

@onno204
Copy link
Author

onno204 commented Sep 20, 2025

This resolves issue #6

- ClientIPHeader now defaults to nil (uses req.RemoteAddr)
- Only processes forwarded headers when explicitly configured
- Maintains backward compatibility while improving security posture
@marcschaeferger
Copy link
Member

@onno204 Thanks!

Could you please adjust two things to make it easier to integrate your change?

  1. Open the PR against the dev branch instead of main.
  2. Check the PR I submitted to your repository so it incorporates the upcoming improvements from Badger:
    Update to refactored Code of Badger onno204/badger#1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants