Help with incorrect X-Real-Ip

[jorgeml]

Hello all,

I am struggling to get a correct IP value in the X-Real-Ip header, more often than not I get an address like 10.254.0.102 which I believe it belongs to the inter-node network.

I am using a three node cluster, Cilium as CNI, with Wireguard encryption, Traefik as reverse proxy using the Gateway API. To keep the costs to a minimum I have disabled the Hetzner proxy and I am using Klipper LB instead. I have created a DNS A / AAAA record to each node for load balancing.

Some of the relevant snippets of kube.tf configuration:

enable_wireguard = true
enable_klipper_metal_lb = "true"
traefik_provider_kubernetes_gateway_enabled = true
cni_plugin = "cilium"
cilium_routing_mode = "native"
disable_kube_proxy = true
cilium_merge_values = <<EOT
gatewayAPI:
  enabled: true
  EOT

Cilium status looks correct:

Defaulted container "cilium-agent" out of: cilium-agent, config (init), mount-cgroup (init), apply-sysctl-overwrites (init), mount-bpf-fs (init), clean-cilium-state (init), install-cni-binaries (init)
KVStore:                 Disabled   
Kubernetes:              Ok         1.31 (v1.31.14+k3s1) [linux/arm64]
Kubernetes APIs:         ["EndpointSliceOrEndpoint", "cilium/v2::CiliumClusterwideEnvoyConfig", "cilium/v2::CiliumClusterwideNetworkPolicy", "cilium/v2::CiliumEndpoint", "cilium/v2::CiliumEnvoyConfig", "cilium/v2::CiliumNetworkPolicy", "cilium/v2::CiliumNode", "cilium/v2alpha1::CiliumCIDRGroup", "core/v1::Namespace", "core/v1::Pods", "core/v1::Service", "networking.k8s.io/v1::NetworkPolicy"]
KubeProxyReplacement:    True   [eth0    $IPv4 $IPv6, eth1   10.254.0.103 fe80::8400:ff:fe7f:73c9 (Direct Routing)]
Host firewall:           Disabled
SRv6:                    Disabled
CNI Chaining:            none
CNI Config file:         successfully wrote CNI configuration file to /host/etc/cni/net.d/05-cilium.conflist
Cilium:                  Ok   1.17.0 (v1.17.0-c2bbf787)
NodeMonitor:             Listening for events on 2 CPUs with 64x4096 of shared memory
Cilium health daemon:    Ok   
IPAM:                    IPv4: 33/254 allocated from 10.42.2.0/24, 
IPv4 BIG TCP:            Disabled
IPv6 BIG TCP:            Disabled
BandwidthManager:        Disabled
Routing:                 Network: Native   Host: BPF
Attach Mode:             TCX
Device Mode:             veth
Masquerading:            BPF   [eth0, eth1]   10.42.0.0/16 [IPv4: Enabled, IPv6: Disabled]
Controller Status:       174/174 healthy
Proxy Status:            OK, ip 10.42.2.62, 0 redirects active on ports 10000-20000, Envoy: external
Global Identity Range:   min 256, max 65535
Hubble:                  Ok              Current/Max Flows: 4095/4095 (100.00%), Flows/s: 92.27   Metrics: Disabled
Encryption:              Wireguard       [NodeEncryption: OptedOut, cilium_wg0 (Pubkey: $pubkey, Port: 51871, Peers: 2)]
Cluster health:          3/3 reachable   (2026-01-29T20:27:10Z)
Name                     IP              Node   Endpoints
Modules Health:          Stopped(0) Degraded(0) OK(148)

I have replaced the values of the external IPv4 and IPv6 addresses and the Wireguard public key (just in case).

What am I missing or doing wrong? Do I need to look at using ExternalDNS instead of using 3 static DNS records?

My ultimate intention is to get the Cilium Gateway API to work (in previous attempts the gateway wasn't picking up an address), remove Traefik and KlipperLB and let Cilium do all the work if possible.

Thanks in advance for your help!