Remote users IPV6 address shows as localhost

I think I know why this is happening.

For IPv4 Docker inserts firewall rules into iptables to reverse NAT from the exposed host address/port to the container host/port. This lets the container see the original source address.
For IPv6 Docker uses a userland proxy (docker-proxy) which just forwards from one port to the other. This causes the container to see the source address as localhost. This isn’t a HTTP aware proxy it is just port forwarding so it is unable to insert X-Forwarded-For headers.

The core Docker project hasn’t added support for doing NAT on IPv6, either because they think IPv6 NAT is icky or because they haven’t got around to doing it.

But you can fix this by enabling IPv6 for Docker and then running a container which automatically inserts the correct IPv6 NAT rules.

See Enable IPv6 for Docker containers on Ubuntu 18.04 | Medium for a guide to how to set this up.

TLDR: Make sure IPv6 works in your containers and then run https://github.com/robbertkl/docker-ipv6nat

9 Likes