<p>We are using Kubernetes along with Traefik 2.0.
We are using Kubernetes CRD (IngressRoute) as provider with Traefik.</p>

<p>From Traefik Documentaion, it doesn't look like Middlewares can be used for TCP routers.</p>

<p>We would like to use <a href="https://docs.traefik.io/middlewares/ipwhitelist/" rel="nofollow noreferrer">IP Whitelist middleware</a>  with TCP router , but so far it's been working with  Http Router only.</p>

<p>Here is our ipWhitelist definition:</p>

<pre><code>apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: testIPwhitelist
spec:
  ipWhiteList:
    sourceRange:
      - 127.0.0.1/32
      - 192.168.1.7
</code></pre>

<p>Here is Traefik Service Definition:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: traefik

spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  ports:
    - protocol: TCP
      name: web
      port: 8000
    - protocol: TCP
      name: admin
      port: 8080
    - protocol: TCP
      name: websecure
      port: 4443
    - protocol: TCP
      name: mongodb
      port: 27017
  selector:
    app: traefik
</code></pre>

<p>IngressRoutes defintions:</p>

<pre><code>apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: simpleingressroute
  namespace: default
spec:
  entryPoints:
    - web
  routes:
  - match: PathPrefix(`/who`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
      - name: testIPwhitelist
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroute.mongo

spec:
  entryPoints:
    - mongodb
  routes:
  # Match is the rule corresponding to an underlying router.
  - match: HostSNI(`*`)
    services:
    - name: mongodb
      port: 27017

    middlewares:
      - name: testIPwhitelist
</code></pre>

<p>Is there any way of restricting IPs with traefik TCP router ?</p>

<p>For more resources on the traefik with Kubernetes CRD  you can go <a href="https://docs.traefik.io/routing/providers/kubernetes-crd/" rel="nofollow noreferrer">here</a></p>

<p>You are right, Middlewares can't be used for TCP routers. IPWhitelist through Middleware concept is acceptable only for HTTP router.
You can follow issue on <a href="https://github.com/containous/traefik/issues/5680" rel="nofollow noreferrer">github</a> requesting middlewares for TCP routers.</p>
