Reverse proxy

In order to get the real IP from an incoming request, you must first configure what reverse proxies Venator will trust. If unconfigured, Venator will trust requests from 127.0.0.0/8 and ::1/128 by default.

Any trusted proxy will be treated as the authoritative source of Forwarded, X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto. These headers will be used to determine what the real IP address of the connection is, which is necessary when Venator is behind a reverse proxy like Caddy, Nginx, or Cloudflare (otherwise Venator will only see the proxy’s IP).

Caution

You should ensure any configured reverse proxy appropriately strips client-supplied forwarding headers, to minify the potential for IP spoofing. Furthermore, trusted_proxies should be as narrow as possible.

Trusted proxies

trusted_proxies: A list of IP networks (CIDR notation) that may be upstream reverse proxies.

If not configured, defaults to 127.0.0.0/8 and ::1/128 - both loopback networks (the lo interface).

Reverse proxy support can be disabled by simply not supplying any ranges to this argument.

Examples:

# Only use the TCP connecting address to identify the remote IP.
# When using unix sockets, this will be translated to the
# IPv6 loopback address (::1/128).
reverse_proxy:
  trusted_proxies: []

# Explicit static reverse proxy
reverse_proxy:
  trusted_proxies:
    - 192.168.0.1/32  # Only allow forwarded requests from 192.168.0.1

# Reverse proxies on the Docker network ranges (https://docs.docker.com/engine/network/#automatic-subnet-allocation)
# NOTE: You should prefer to configure an explicit network and only trust that
# network's range instead. Even better yet, # assign your reverse proxy
# container a static IP and use that like above.
reverse_proxy:
  trusted_proxies:
    - 172.17.0.0/16
    - 172.18.0.0/16
    - 172.19.0.0/16
    - 172.20.0.0/14
    - 172.24.0.0/14
    - 172.28.0.0/14
    - 192.168.0.0/16

# Tailscale's tailnet ranges (https://tailscale.com/docs/reference/reserved-ip-addresses)
# NOTE: You should prefer to use a /32 or /128 with your reverse proxy's tailnet IP,
# instead of trusting the entire net.
reverse_proxy:
  trusted_proxies:
    - 100.64.0.0/10
    - "fd7a:115c:a1e0::/48"

# Trusting ALL connecting IPs as trusted proxies.
# Warning: this allows anyone to spoof their IP if they can establish a direct
# connection!
reverse_proxy:
  trusted_proxies:
    - 0.0.0.0/0
    - "::/0"

Trust Cloudflare

trust_cloudflare: If true, Cloudflare’s advertised IP ranges are automatically appended to the trusted proxy networks list.

Unintuitively, this does not enable support for Cloudflare-specific headers like Cf-Connecting-Ip (Cloudflare still supplies X-Forwarded-For), but instead is simply a shortcut to add Cloudflare’s IP ranges as trusted proxies.

Venator maintains an internal list of Cloudflare IPs advertised on their website at /utils/ip/cloudflare-ip-ranges.txt. This file is embedded into the Venator binary, which means Cloudflare trust is an offline process.

Note

If trusted_proxies is not configured at all (i.e. omitted from your configuration), the default loopback addresses will still be added, which means requests from localhost will be trusted as well as requests from Cloudflare. To negate this, set trusted_proxies to an empty list ([]) - it will then only be populated with Cloudflare IPs.

Example:

reverse_proxy:
  trust_cloudflare: true