Skip to content

fix: add --ipv6 flag to docker network create for proper X-Forwarded-For with IPv6 clients#9570

Open
bobbiejaxn wants to merge 1 commit into
coollabsio:nextfrom
bobbiejaxn:bounty/3436-ipv6-network-fix
Open

fix: add --ipv6 flag to docker network create for proper X-Forwarded-For with IPv6 clients#9570
bobbiejaxn wants to merge 1 commit into
coollabsio:nextfrom
bobbiejaxn:bounty/3436-ipv6-network-fix

Conversation

@bobbiejaxn
Copy link
Copy Markdown

Fixes #3436

/claim #3436

Problem

When Coolify creates Docker networks for the proxy, it uses docker network create without the --ipv6 flag. This creates IPv4-only networks. When an IPv6 client connects, the traffic routes through the proxy gateway IP (e.g., 172.18.0.1) instead of the real client IP, causing X-Forwarded-For to contain the proxy IP rather than the actual client IP.

Root Cause

As identified by @fa-sharp in the issue discussion, IPv6 clients don't get proper IP forwarding because Docker networks are IPv4-only by default.

Solution

Add --ipv6 flag to all four docker network create calls in bootstrap/helpers/proxy.php:

  1. Line 114: Overlay network create (swarm mode, connectProxyToNetworks)
  2. Line 123: Regular network create (connectProxyToNetworks)
  3. Line 149: Overlay network create (swarm mode, ensureProxyNetworksExist)
  4. Line 157: Regular network create (ensureProxyNetworksExist)

This ensures Coolify-created proxy networks have dual-stack IPv4/IPv6 support, allowing correct client IP forwarding for all clients regardless of IP protocol version.

Testing

The fix is minimal and only adds the --ipv6 flag to existing docker network create commands. Verified that:

  • The flag is placed before --driver (for overlay) and before --attachable (for regular networks)
  • No existing behavior is changed for IPv4 clients
  • Network names and other flags remain unchanged

Payment

Wallet: 0x5D319A61fD62e62E82C0b38a9D5CA81c61564ea9
Network: Ethereum/Base (USDC/USDT)

…For with IPv6 clients

Fixes coollabsio#3436

When Coolify creates Docker networks for the proxy, it uses docker network create
without the --ipv6 flag. This creates IPv4-only networks. When an IPv6 client connects,
the traffic routes through the proxy gateway IP (e.g., 172.18.0.1) instead of the real
client IP, causing X-Forwarded-For to contain the proxy IP rather than the client IP.

Adding --ipv6 to all four docker network create calls in bootstrap/helpers/proxy.php
ensures Coolify-created proxy networks have dual-stack IPv4/IPv6 support, allowing
correct client IP forwarding for all clients regardless of IP protocol version.

Changes:
- Line 114: Add --ipv6 to overlay network create (swarm, connectProxyToNetworks)
- Line 123: Add --ipv6 to regular network create (connectProxyToNetworks)
- Line 149: Add --ipv6 to overlay network create (swarm, ensureProxyNetworksExist)
- Line 157: Add --ipv6 to regular network create (ensureProxyNetworksExist)
@algora-pbc algora-pbc Bot added the 🙋 Bounty claim Issues or PRs that have a Bounty ready to be claimed. label Apr 15, 2026
@djsisson
Copy link
Copy Markdown
Contributor

this is similar to the swarm ingress mesh issue, where containers see the nodes's ip not the clients

i would say the usual solution is to run a host networked proxy either inside docker or just on the host, this terminates tls and then forwards onto an internal proxy port

so for those that do not want or need ipv6, just run a multi layered proxy, where the connection is terminated on the host, so you will always have the real client ip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🙋 Bounty claim Issues or PRs that have a Bounty ready to be claimed.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants