API Key with IP address restriction blocks all IP including whitelisted about esp-v2 HOT 5 CLOSED

ESPv2 is using x-forwarded-for header to get client ip. But many proxy servers on the path may add this header, you need to use flag --envoy_xff_num_trusted_hops to tell which client ip to choose.

Please check this doc for detail.

from esp-v2.

Thanks, this config works for me:
--envoy_xff_num_trusted_hops=1
--envoy_use_remote_address

from esp-v2.

Ref cloudendpoints/endpoints-tools#72

from esp-v2.

Glad that works. Let's keep this issue open, we need to document this behavior.

from esp-v2.

We worked with the Cloud Run team to set defaults for the endpoints-runtime-serverless image. We recommend the following defaults:

--envoy_xff_num_trusted_hops=0

Your config will still work if you update to the next released version of ESPv2. There shouldn't be much difference.

from esp-v2.