How to Configure Windows Sandbox Local Traefik IPStrategy Middleware via XML in Windows 11

Accurately determining client IP addresses behind multi-tier proxy infrastructure (such as cloud load balancers and CDNs) requires configuring Traefik’s IPStrategy with trusted IP depth or CIDR exclusion blocks. Windows Sandbox on Windows 11 provides a secure, disposable Hyper-V container ideal for verifying client IP extraction rules safely without touching host network adapters.

Why Test IPStrategy in Windows Sandbox

A misconfigured client IP strategy can cause rate limiting, IP whitelisting, and geographical routing rules to inspect the wrong proxy header, inadvertently blocking legitimate traffic. Testing inside an isolated Windows Sandbox allows engineers to test spoofed X-Forwarded-For header chains against mock upstream services safely.

Authoring the Windows Sandbox WSB XML

Save the following XML document as TraefikIPStrategySandbox.wsb on your Windows 11 machine:

<Configuration>
  <VGpu>Default</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\TraefikIPStratLab</HostFolder>
      <SandboxFolder>C:\TraefikIPStratLab</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\TraefikIPStratLab\setup-ipstrat.ps1</Command>
  </LogonCommand>
</Configuration>

PowerShell Deployment Bootstrapper

Save the bootstrapping script as C:TraefikIPStratLabsetup-ipstrat.ps1:

Write-Host "Setting up Traefik IPStrategy Lab..." -ForegroundColor Cyan

$Dir = "C:Traefik"
New-Item -ItemType Directory -Force -Path $Dir | Out-Null

$ZipUrl = "https://github.com/traefik/traefik/releases/download/v3.0.0/traefik_v3.0.0_windows_amd64.zip"
Invoke-WebRequest -Uri $ZipUrl -OutFile "$Dir	raefik.zip"
Expand-Archive -Path "$Dir	raefik.zip" -DestinationPath $Dir -Force

$Config = @"
http:
  middlewares:
    ip-allow:
      ipAllowList:
        sourceRange:
          - "203.0.113.0/24"
        ipStrategy:
          depth: 2
  routers:
    app-router:
      rule: "PathPrefix(`/api`)"
      middlewares:
        - "ip-allow"
      service: "backend-service"
  services:
    backend-service:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:8080"
"@

Set-Content -Path "$Dirdynamic_conf.yml" -Value $Config
Write-Host "Traefik IPStrategy Configured with Depth: 2." -ForegroundColor Green

Verifying Header Extraction Depth

Launch the sandbox configuration and run curl requests simulating multi-proxy chains using -H "X-Forwarded-For: 203.0.113.50, 198.51.100.1, 192.0.2.1". Confirm that Traefik inspects the second IP from the right edge and grants access. Closing the sandbox leaves no residual configuration files.