How to Configure Windows Sandbox Local Traefik IPWhiteList Middleware via XML in Windows 11

Validating edge network CIDR access control rules without risking lockouts on host development workstations is critical when designing secure ingress pipelines. Traefik’s IPWhiteList (ipAllowList) middleware restricts access to specific client IP ranges. Windows Sandbox in Windows 11 provides a secure, disposable Hyper-V container ideal for verifying IP allowlist logic before cloud deployment.

Why Test IP Allowlisting in Windows Sandbox

Configuring IP allowlists incorrectly can inadvertently block legitimate management traffic. Launching Traefik inside an isolated Windows Sandbox enables engineers to simulate traffic from both allowed and forbidden CIDR blocks safely without altering host network adapters or production firewall tables.

Authoring the Windows Sandbox WSB XML

Save the following XML document as TraefikIPAllowSandbox.wsb on your Windows 11 machine:

<Configuration>
  <VGpu>Default</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\TraefikIPLab</HostFolder>
      <SandboxFolder>C:\TraefikIPLab</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\TraefikIPLab\setup-ipallow.ps1</Command>
  </LogonCommand>
</Configuration>

PowerShell Deployment Bootstrapper

Save the bootstrapping script as C:TraefikIPLabsetup-ipallow.ps1:

Write-Host "Initialising Traefik IP Allowlist Lab..." -ForegroundColor Cyan

$Dir = "C:Traefik"
New-Item -ItemType Directory -Force -Path $Dir | Out-Null

$ZipUrl = "https://github.com/traefik/traefik/releases/download/v3.0.0/traefik_v3.0.0_windows_amd64.zip"
Invoke-WebRequest -Uri $ZipUrl -OutFile "$Dir	raefik.zip"
Expand-Archive -Path "$Dir	raefik.zip" -DestinationPath $Dir -Force

$Config = @"
http:
  middlewares:
    admin-whitelist:
      ipAllowList:
        sourceRange:
          - "127.0.0.1/32"
          - "192.168.1.0/24"
  routers:
    admin-router:
      rule: "PathPrefix(`/admin`)"
      middlewares:
        - "admin-whitelist"
      service: "admin-service"
  services:
    admin-service:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:8080"
"@

Set-Content -Path "$Dirdynamic_conf.yml" -Value $Config
Write-Host "Traefik IP Allowlist Middleware Configured." -ForegroundColor Green

Verifying Access Restriction

Launch the sandbox configuration and run curl requests against http://127.0.0.1/admin. Access is granted. Modify the CIDR rule to an external subnet and test again to confirm Traefik rejects forbidden requests with HTTP 403 Forbidden cleanly.