# 9202 prototype of the Part A design (hand-made, traefik static + forwarded.yml rendered by the new code), 2026-10-01T18:44:33Z
### T (tunnel simulated): a container AT 172.16.253.2 on felhom-tunnel sends what cloudflared sends (Cloudflare's chain 6.6.6.6 client-written, 203.0.113.9 real) -> p-echo
RemoteAddr: 172.18.0.5:42224
Cf-Connecting-Ip: 203.0.113.9
X-Forwarded-For: 6.6.6.6,203.0.113.9, 172.16.253.2
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: 364d78f29dbd
X-Real-Ip: 172.16.253.2
### P (impostor): a container on traefik-public (NOT the tunnel address) sends the same -> p-echo
RemoteAddr: 172.18.0.5:42224
Cf-Connecting-Ip: 203.0.113.9
X-Forwarded-For: 172.18.0.8
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: 364d78f29dbd
X-Real-Ip: 172.18.0.8
### T (tunnel simulated): a container AT 172.16.253.2 on felhom-tunnel sends what cloudflared sends (Cloudflare's chain 6.6.6.6 client-written, 203.0.113.9 real) -> p-echo-reset
RemoteAddr: 172.18.0.5:43836
Cf-Connecting-Ip: 203.0.113.9
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: 364d78f29dbd
X-Real-Ip: 172.16.253.2
### P (impostor): a container on traefik-public (NOT the tunnel address) sends the same -> p-echo-reset
RemoteAddr: 172.18.0.5:43836
Cf-Connecting-Ip: 203.0.113.9
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: 364d78f29dbd
X-Real-Ip: 172.18.0.8
### L (LAN): DooPlex 192.168.0.180 straight to 9202:443, forged headers -> p-echo
RemoteAddr: 172.18.0.5:42224
Cf-Connecting-Ip: 7.7.7.7
X-Forwarded-For: 192.168.0.180
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: 364d78f29dbd
X-Real-Ip: 192.168.0.180
### L (LAN): DooPlex 192.168.0.180 straight to 9202:443, forged headers -> p-echo-reset
RemoteAddr: 172.18.0.5:43836
Cf-Connecting-Ip: 7.7.7.7
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: 364d78f29dbd
X-Real-Ip: 192.168.0.180
