<p>I have setup an ingress for an application but want to whitelist my ip address. So I created this Ingress:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/whitelist-source-range: ${MY_IP}/32
  name: ${INGRESS_NAME}
spec:
  rules:
  - host: ${DNS_NAME}
    http:
      paths:
      - backend:
          serviceName: ${SVC_NAME}
          servicePort: ${SVC_PORT}
  tls:
  - hosts:
    - ${DNS_NAME}
    secretName: tls-secret
</code></pre>

<p>But when I try to access it I get a 403 forbidden and in the nginx logging I see a client ip but that is from one of the cluster nodes and not my home ip.</p>

<p>I also created a configmap with this configuration:</p>

<pre><code>data:
  use-forwarded-headers: "true"
</code></pre>

<p>In the nginx.conf in the container I can see that has been correctly passed on/ configured, but I still get a 403 forbidden with still only the client ip from cluster node.</p>

<p>I am running on an AKS cluster and the nginx ingress controller is behind an Azure loadbalancer. The nginx ingress controller svc is exposed as type loadbalancer and locks in on the nodeport opened by the svc.</p>

<p>Do I need to configure something else within Nginx?</p>

<p>If you've installed nginx-ingress with the <a href="https://github.com/helm/charts/tree/master/stable/nginx-ingress" rel="noreferrer">Helm chart</a>, you can simply configure your <code>values.yaml</code> file with <code>controller.service.externalTrafficPolicy: Local</code>, which I believe will apply to all of your Services. Otherwise, you can configure specific Services with <code>service.spec.externalTrafficPolicy: Local</code> to achieve the same effect on those specific Services.</p>

<p>Here are some resources to further your understanding:</p>

<ul>
<li><a href="https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip" rel="noreferrer">k8s docs - Preserving the client source IP</a></li>
<li><a href="https://kubernetes.io/docs/tutorials/services/source-ip" rel="noreferrer">k8s docs - Using Source IP</a></li>
</ul>
