Comment on Help with Getting My Reverse Proxy to Forward the Correct IP Address
lemmyvore@feddit.nl 18 hours agoseems to have identified this as some NAT setting built in to Docker
TBH I also thought about it being the default range used by Docker for its bridge networks, but I was under the impression it uses 172. ranges by default. The official example on their site says it uses 172.30.0.0/16 and 172.31.0.0/16. Also I have an unmodified docker running on one of my machines and it allocated 172.18.0.0/16 for a bridge network.
You can try to docker network create a bridge network and see what range it gets, you’ll see if it gets a 172. or a 168..
BTW I hope you’re looking at the docker on the reverse proxy machine, not on the jellyfin machine.
The answer was the same on both machines. A 172.17.0.X network was created as a bridge.
lemmyvore@feddit.nl 13 hours ago
Hope you saw my other comment. Docker now also makes 192.168. networks in addition to 172. I’ve explained how to edit your daemon.json to stop it from doing that.
I can take a look after work, but won’t that just change the proxy’s IP listed in my logs instead of properly forwarding along the source IP address?
lemmyvore@feddit.nl 12 hours ago
Yep, you’ll have to fix that by telling your proxy to put the client IP in a header that the target app can recognize and use.
But, also, it’s a good idea to have Docker network ranges that don’t overlap your LAN. That would make me uncomfortable too.
You can also look into using IPv4 link-local addresses for Docker bridges (169.254.). Here’s an explanation: github.com/11notes/RTFM/blob/master/…/daemon.md#n…
That frees you from accidental overlaps with pretty much everything else, but it comes with its own gotcha: link-local isn’t routable. This can come back to bite you if you have an app that relies on announcing a public UDP ip:port to a peer and announces the link-local IP. When a peer tries to connect back, it won’t work. So you have to either tweak the app’s config to make sure you announce a non-169.254. IP, or put the app container on a bridge/macvlan network so it auto-detects and announces a routable IP. There’s all kinds of apps that can be affected by this kind of peer-to-peer behavior (file transfer apps, games, VoIP apps etc.)
But TBH I’ve been using link-local ranges for a while now and only got bitten once (Deluge).