TMA CloudTMA Cloud
GuidesAdmin Guides

Known Proxies

Configure reverse proxies that may supply client IP headers.

Configure reverse proxies that may supply client IP headers (first user only).

Why This Setting Is Required

The backend uses the socket address unless the connecting proxy is trusted. Without this setting, sessions, audit records, metrics checks, and anonymous rate limits see the reverse proxy IP instead of the client IP.

Trusting every proxy would let a direct client forge X-Forwarded-For. The server therefore accepts forwarded headers only when the immediate connection comes from a configured address.

Configuration

  1. Navigate to Settings → Administration
  2. Open Known proxies under Network
  3. Enter the proxy IP addresses, CIDR ranges, or hostnames, separated by commas or one per line
  4. Click Save. A note reminds you that the change applies after a restart
  5. Restart the backend server or container

Examples:

10.1.2.100, 172.18.0.0/16, proxy.example.com

An empty list disables forwarded client IP handling.

Choosing Entries

  • Enter the address of nginx, Traefik, Cloudflare Tunnel, or the load balancer that connects to the backend. Do not enter client addresses.
  • If Sessions shows the same address for every user, that address is the proxy's.
  • Add every proxy in a multi-proxy chain.
  • Prefer exact IP addresses. Use a CIDR range only when proxy addresses cannot be kept stable.
  • Hostnames are resolved when the backend starts. A hostname that cannot be resolved is not trusted.

The reverse proxy must also send the forwarding headers. For nginx:

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;

Verify the Result

After restarting, sign in through the reverse proxy and open Settings → Security → View sessions, then click Refresh. The IP should be the client address. Authenticated requests and heartbeats update an existing session's stored IP, so an online device does not need to sign in again.

Last updated on

MFA Management

What the administrator sees of two-factor authentication, and how users set it up.

Session Timeout and Recently Opened

Set how long idle sessions last and how access times are recorded.

On this page

Why This Setting Is RequiredConfigurationChoosing EntriesVerify the ResultRelated Topics