Example 4: IP & CIDR Subnet Whitelisting

RouteWarden allows you to declare trusted IPs and subnets (allowedIps) to bypass path blocking. This is ideal for internal management portals, company VPN gateways, and authorized vulnerability scanners.

---

How IP Resolution Works

RouteWarden evaluates client IPs in the following priority order:

1. X-Forwarded-For header (first IP in list)
2. X-Real-IP header
3. Socket RemoteAddr

Both exact IPv4/IPv6 addresses (127.0.0.1, 2001:db8::1) and CIDR blocks (10.0.0.0/8, 192.168.1.0/24) are supported.

---

Configuration Preview

File (YAML)

# dynamic_conf.yml
http:
  middlewares:
    admin-shield:
      plugin:
        routewarden:
          enabled: true
          pathPatterns:
            - '(?i)^/admin(/.*)?$'
            - '(?i)^/metrics(/.*)?$'
          allowedIps:
            - "10.0.0.0/8"
            - "192.168.1.100"
          response:
            mode: json
            statusCode: 403
            body: '{"error":"Forbidden","message":"Restricted to authorized IP/VPN"}'

  routers:
    admin-router:
      rule: "Host(`admin.localhost`)"
      entryPoints:
        - web
      middlewares:
        - admin-shield
      service: admin-service

File (TOML)

# dynamic_conf.toml
[http.routers.admin-router]
  rule = "Host(`admin.localhost`)"
  entryPoints = ["web"]
  middlewares = ["admin-shield"]
  service = "admin-service"

[http.middlewares.admin-shield.plugin.routewarden]
  enabled = true
  pathPatterns = ["(?i)^/admin(/.*)?$", "(?i)^/metrics(/.*)?$"]
  allowedIps = ["10.0.0.0/8", "192.168.1.100"]

[http.middlewares.admin-shield.plugin.routewarden.response]
  mode = "json"
  statusCode = 403
  body = '{"error":"Forbidden","message":"Restricted to authorized IP/VPN"}'

CLI

# Docker Compose Labels / CLI equivalent
- "traefik.enable=true"
- "traefik.http.routers.admin.rule=Host(`admin.localhost`)"
- "traefik.http.routers.admin.entrypoints=web"
- "traefik.http.routers.admin.middlewares=admin-shield"
- "traefik.http.middlewares.admin-shield.plugin.routewarden.enabled=true"
- "traefik.http.middlewares.admin-shield.plugin.routewarden.pathPatterns=(?i)^/admin(/.*)?$,(?i)^/metrics(/.*)?$"
- "traefik.http.middlewares.admin-shield.plugin.routewarden.allowedIps=10.0.0.0/8,192.168.1.100"
- "traefik.http.middlewares.admin-shield.plugin.routewarden.response.mode=json"
- "traefik.http.middlewares.admin-shield.plugin.routewarden.response.statusCode=403"
- 'traefik.http.middlewares.admin-shield.plugin.routewarden.response.body={"error":"Forbidden","message":"Restricted to authorized IP/VPN"}'

---

Docker Compose Example

services:
  traefik:
    image: traefik:v3.1
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--entrypoints.web.address=:80"
      - "--experimental.plugins.routewarden.modulename=github.com/routewarden/traefik-warden"
      - "--experimental.plugins.routewarden.version=v0.2.4"
    ports:
      - "80:80"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  admin-service:
    image: nginx:alpine
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.admin.rule=Host(`admin.localhost`)"
      - "traefik.http.routers.admin.entrypoints=web"
      - "traefik.http.routers.admin.middlewares=admin-shield"

      # RouteWarden Configuration with IP Whitelist
      - "traefik.http.middlewares.admin-shield.plugin.routewarden.enabled=true"
      - "traefik.http.middlewares.admin-shield.plugin.routewarden.pathPatterns=(?i)^/admin(/.*)?$,(?i)^/metrics(/.*)?$"
      - "traefik.http.middlewares.admin-shield.plugin.routewarden.allowedIps=10.0.0.0/8,192.168.1.100"
      - "traefik.http.middlewares.admin-shield.plugin.routewarden.response.mode=json"
      - "traefik.http.middlewares.admin-shield.plugin.routewarden.response.statusCode=403"
      - "traefik.http.middlewares.admin-shield.plugin.routewarden.response.body={\"error\":\"Forbidden\",\"message\":\"Restricted to authorized IP/VPN\"}"

---

Testing Verification

# Request without whitelisted IP (Blocked)
curl -i -H "Host: admin.localhost" http://localhost/admin
# HTTP/1.1 403 Forbidden

# Request originating from allowed corporate subnet via proxy (Allowed)
curl -i -H "Host: admin.localhost" -H "X-Forwarded-For: 10.5.20.1" http://localhost/admin
# Passes cleanly to upstream container!