IP filtering not working?

[Lombra]

Hi,

I'm trying to filter out my own, local visits, and have set the following environment variable:

IGNORE_IP="192.168.0.0/16, 10.0.0.0/24, 10.20.0.0/16, 127.0.0.1/8"

My PC is on 192.168.0.202, and umami as well as the reverse proxy (Traefik) are on 10.20.1.0/24. (containers) My own visits are still getting recorded, with an unknown source. I can see other sessions from all around the world, so it should not be an issue with the proxy server.

[charles-benedito]

Hi Lombra, so the env var itself looks fine, umami splits IGNORE_IP on commas and checks each entry either as an exact match or as a cidr via ipaddr.js, so 192.168.0.0/16 would definately catch 192.168.0.202. which means the ip umami is seeing for your visits isnt 192.168.0.202

my guess is nat loopback. if u open the site through the public domain from inside the lan, the router rewrites the source so traefik (and umami) see your wan ip, not the lan one. the header order in src/lib/ip.ts is x-real-ip before x-forwarded-for, and traefik sets both to whatever it sees as the client, so it would faithfully pass the wan ip along. quick test is to add your current public ip to IGNORE_IP and restart the container, its only read at startup

the less fragile way for your own browser is the builtin opt out, run localStorage.setItem('umami.disabled', 1) in devtools on the site u are tracking, the tracker checks that key before sending anything. works regardless of ip

let me know if that works

[Lombra]

Thanks. Umami runs on a network separate to that of my PC, so there's no address translation. Nevertheless, I added my external IP address to the filter, without any change. Even then, I would have expected some location info to be present.

I tapped into the container traffic to see that the headers are as expected:

X-Forwarded-For: 192.168.0.202
X-Real-Ip: 192.168.0.202

I also connected to the container to verify that the environment variable is present.

[Lombra]

It seems like my issue was the quotation marks. They are treated literally. I noticed while attempting to set CLIENT_IP_HEADER. I'm using an env file. This works:

IGNORE_IP=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16