How to get the real IP of the login device in self hosted apps
reddit / selfhosted

----------------------------------------------------------------------
neon5k · 2023-12-29 03:46

Hey,

To bypass the cgnat of my IP, I have setup wireguard vpn on a vps. And
redirect packets on port 80 and 443 to my local machine hosting the
services.
I currently use traefik for managing reverse proxy for those services.

So the issue is whenever I login from a new device using my domain the
service(Vaultwarden here) sends an email with wireguard IP of the vps
like 10.x.x.1 always.

Is there any way to get a real ip in email?

----------------------------------------------------------------------
Square_Lawfulness_33 · 2023-12-29 04:40

In the wiki it states you need to set the domain:
[https://github.com/dani-garcia/vaultwarden/wiki/SMTP-
Configuration](https://github.com/dani-garcia/vaultwarden/wiki/smtp-
configuration)

    -e DOMAIN=https://vault.example.com-e
DOMAIN=https://vault.example.com

----------------------------------------------------------------------
neon5k · 2023-12-29 04:42

Sorry but the emails are working fine. I want to find if there is a
way the email has the correct IP instead of wireguard the local ip.

----------------------------------------------------------------------
Square_Lawfulness_33 · 2023-12-29 04:44

This isn't the email config, this is the overall domain that you're
telling vaultwarden to use when sending out info and links back to
your site.

----------------------------------------------------------------------
emprahsFury · 2023-12-29 04:50

What are you asking for? The wireguard ip of the connecting client (i
dont think they're even connected to the vpn?)? The wan interface ip
of the end user connecting to the vps? Those iptables rules are
introducing a new hop, the old packets are dropped and new ones
constructed so the continuity is really only in your head with your
dirty knowledge of the netflow. Put the reverse proxy on the vps and
have it actually do its job because it will preserve the x-forwarded-
for header. It sounds like you've outgrown the noob guide, congrats.

----------------------------------------------------------------------
neon5k · 2023-12-29 05:26

So no way I can keep the reverse proxy on local and have wan ip for
users connecting to vaultwarden?

If I use traefik on vps then it will route to my local services using
wireguard but in this case headers would be maintained?

Is there a guide you can refer me to?

----------------------------------------------------------------------
neon5k · 2023-12-29 05:29

I think there is some confusion.
The question is not related to email but to get the real ip of the end
user.

----------------------------------------------------------------------
Square_Lawfulness_33 · 2023-12-29 05:35

oh, I understand now.

----------------------------------------------------------------------
neon5k · 2023-12-29 13:12

Thanks this worked. I am also using cloudflare on top so used this and
worked.

CF-Connecting-IP

----------------------------------------------------------------------
Square_Lawfulness_33 · 2023-12-29 13:13

You’re welcome, I’m glad I could help.

----------------------------------------------------------------------
neon5k · 2023-12-29 13:13

This is solved. I need to use the CF-Connecting-IP header as the
client IP. This gets preserved even after wireguard connection.