DenyIP is a middleware plugin for Traefik which accepts IP addresses or IP address ranges and blocks requests originating from those IPs.
In the example below fowardedHeaders.insecure is enabled in order to allow the IP address to be available from proxied requests. In a production environment, you may want to consider using forwardedHeaders.trustedIPs
experimental:
pilot:
token: "xxxxx"
plugins:
denyip:
modulename = "github.com/kevtainer/denyip"
version = "v1.0.0"
entryPoints:
http:
address: ":80"
forwardedHeaders:
insecure: trueTo configure the DenyIP plugin you should create a middleware in your dynamic configuration as explained here. The following example creates and uses the denyip middleware plugin to deny all requests originating from Comcast. ipDenyList will also accept non-CIDR ips, eg. 127.0.0.1.
Note: Providing invalid ip addresses or ranges in
ipDenyListwill cause an error and the plugin will not load.
http:
# Add the router
routers:
my-router:
entryPoints:
- http
middlewares:
- denyip
service: service-foo
rule: Path(`/foo`)
# Add the middleware
middlewares:
denyip:
plugin:
ipDenyList:
- 24.0.0.0/12
- 24.16.0.0/13
- 24.30.0.0/17
- 24.34.0.0/16
- 24.60.0.0/14
- 24.91.0.0/16
- 24.98.0.0/15
- 24.118.0.0/16
- 24.125.0.0/16
- 24.126.0.0/15
- 24.128.0.0/16
- 24.129.0.0/17
- 24.130.0.0/15
- 24.147.0.0/16
- 24.218.0.0/16
- 24.245.0.0/18
- 50.128.0.0/10
- 65.34.128.0/17
- 65.96.0.0/16
- 66.30.0.0/15
- 66.41.0.0/16
- 66.56.0.0/18
- 66.176.0.0/15
- 66.229.0.0/16
- 67.160.0.0/12
- 67.176.0.0/15
- 67.180.0.0/14
- 67.184.0.0/13
- 68.32.0.0/11
- 68.80.0.0/14
- 68.84.0.0/16
- 69.136.0.0/15
- 69.138.0.0/16
- 69.139.0.0/17
- 69.140.0.0/14
- 69.180.0.0/15
- 69.242.0.0/15
- 69.244.0.0/14
- 69.248.0.0/14
- 69.253.0.0/16
- 69.254.0.0/15
- 71.56.0.0/13
- 71.192.0.0/12
- 71.224.0.0/12
- 73.0.0.0/8
- 75.64.0.0/13
- 75.72.0.0/15
- 75.74.0.0/16
- 75.75.0.0/17
- 75.75.128.0/18
- 76.16.0.0/12
- 76.97.0.0/16
- 76.98.0.0/15
- 76.100.0.0/14
- 76.104.0.0/13
- 76.112.0.0/12
- 98.192.0.0/13
- 98.200.0.0/14
- 98.204.0.0/16
- 98.206.0.0/15
- 98.208.0.0/12
- 98.224.0.0/12
- 98.240.0.0/16
- 98.242.0.0/15
- 98.244.0.0/14
- 98.248.0.0/13
- 107.2.0.0/15
- 107.4.0.0/15
- 174.48.0.0/12
# Add the service
services:
service-foo:
loadBalancer:
servers:
- url: http://localhost:5000/
passHostHeader: false