# Preserving source IP of TCP connection **URL:** \ **Category:** Ziti Tunnel\ **Created:** [November 14, 2025, 6:20pm UTC](https://openziti.discourse.group/t/preserving-source-ip-of-tcp-connection/5334 "2025-11-14T18:20:27Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![bengcooper](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@bengcooper](https://openziti.discourse.group/u/bengcooper)\ **Post date:** [November 14, 2025, 6:20pm UTC](https://openziti.discourse.group/t/preserving-source-ip-of-tcp-connection/5334/1 "2025-11-14T18:20:27Z")
I saw the upcoming `proxy.v1` config type coming up in v1.7, which inspired me to experiment with creating a reverse proxy using `ziti-prox-c` to forward traffic do a container running on a destination machine (which is running `ziti-edge-tunnel`). Here’s a super rough diagram: ![Ziti TCP ingress](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/7/7bb19b6269031e056839ff89711a7088bb6da97a.png) My question is: Is it possible to preserve the client IP so that it’s presented correctly to the podman container. I’m forwarding raw TCP rather than HTTP(S) so I can’t utilise HTTP headers etc. I’ve searched through the forum and GitHub issues - the closest thing I’ve found is setting the source IP in the service’s intercept config, but that doesn’t apply here. Would anyone be able to point me in the right direction? From [this](https://github.com/openziti/ziti-tunnel-sdk-c/issues/443)and [this](https://github.com/openziti/ziti/issues/1506) I’m suspecting I may need to experiment with `zfw`? ---
**Author:** ![scareything](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/scareything/32/106_2.png) [@scareything](https://openziti.discourse.group/u/scareything)\ **Post date:** [November 14, 2025, 6:46pm UTC](https://openziti.discourse.group/t/preserving-source-ip-of-tcp-connection/5334/2 "2025-11-14T18:46:05Z")
You should be able to do this if you use `ziti-edge-tunnel` on both sides of your tunnel (using the `sourceIp` field in your intercept.v1 configuration). `ziti-prox-c` doesn’t even look at the service configurations (which I’m guessing is why you mentioned the intercept config “doesn’t apply here”?) From what you’ve shared here I don’t think [ziti-tunnel-sdk-c#443](https://github.com/openziti/ziti-tunnel-sdk-c/issues/443) is relevant, since it doesn’t look like your service needs to have connections being intercepted on both sides of the tunnel. Is there a reason that you aren’t using `ziti-edge-tunnel`? ---
**Author:** ![bengcooper](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@bengcooper](https://openziti.discourse.group/u/bengcooper)\ **Post date:** [November 14, 2025, 8:45pm UTC](https://openziti.discourse.group/t/preserving-source-ip-of-tcp-connection/5334/3 "2025-11-14T20:45:52Z")
Does `ziti-edge-tunnel` have a opaque proxy similar to `ziti tunnel proxy`? That's what I'm using `ziti-prox-c` for at the moment. ---
**Author:** ![scareything](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/scareything/32/106_2.png) [@scareything](https://openziti.discourse.group/u/scareything)\ **Post date:** [November 17, 2025, 4:09pm UTC](https://openziti.discourse.group/t/preserving-source-ip-of-tcp-connection/5334/4 "2025-11-17T16:09:41Z")
How are you categorizing `ziti tunnel proxy` as “opaque”? I tend to think of it more as a “transparent” proxy, because you don’t need to tell applications to specifically use it e.g. as a proxy server. ---
**Author:** ![bengcooper](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@bengcooper](https://openziti.discourse.group/u/bengcooper)\ **Post date:** [November 17, 2025, 5:04pm UTC](https://openziti.discourse.group/t/preserving-source-ip-of-tcp-connection/5334/5 "2025-11-17T17:04:55Z")
I might just be using the wrong terminology - I’m exposing a specific service on a specific port. In my case I want to expose `test-service` on port 443 externally so that clients can connect to it over the internet via the public IP address.