IPv6 requests not reflected in X-Real-IP / X-Forwarded-For

[4ndreasH]

Hi all,

I’ve got a Pangolin setup running on a VPS, installed using the standard install script. It includes Traefik with the CrowdSec and GeoBlock plugins. My local server is connected to the system via a Newt tunnel. Everything was deployed as per the Pangolin docs. The Docker’s internal network appears to be IPv4-only (there’s no daemon.json).

Public access to services exposed by Pangolin works via both IPv4 and IPv6.
For IPv4 requests, I can see the real client IP correctly in the X-Real-IP and X-Forwarded-For headers.
For IPv6 requests, however, those headers always show the internal IPv4 address of the container (e.g. 172.22.0.1).

So far, I’ve never seen an IPv6 address appear in Traefik’s logs or in the GeoBlock plugin’s output.

This raises a couple of questions:

• Does this mean CrowdSec and GeoBlock (running as Traefik plugins) are only seeing internal IPv4 traffic, even for inbound IPv6 requests?
• If so, wouldn’t that make these filters trivial to bypass simply by accessing services over IPv6?
• What’s the actual request flow for incoming IPv6 traffic through the Pangolin system?
• What’s the correct way to configure the system so that real IPv6 client IPs are passed along in X-Real-IP or X-Forwarded-For?

I’m happy to provide further config details if needed.

I'm not a professional sysadmin, just a home network user trying to understand how Pangolin handles IPv6 internally. Please let me know if I’m misunderstanding how the pieces fit together.

Thanks in advance!
4ndreasH

[oschwartz10612]

Hi! Sorry about this issue. I think this is a duplicate of #110. We are tracking it there.

I would ask you: is your VPS dual stack? Does it have an IPV6 address? Otherwise there might be some nat funniness going on for your v6 host to address it maybe?

[4ndreasH]

Hi,
sorry, I must have overlooked the duplicate.
Yes, my VPS is dual stack and has IPv4 and IPv6 address (Ionos VPS).
Are my thoughts about security (crowdsec/geoblock) right or do I misunderstand the data flow?

[oschwartz10612]

Thats a good question. I am not 100% sure but based on the other thread this could have to do with Traefik / Newt and Docker proxing the traffic around. Crowdsec I imagine would handle this better but would need to be tested. If you test please report back on that other thread about your findings.

This could very well be a trivial config thing but just have not had the time to look into it yet.