Kong: ip-restriction filters on the address Kong believes is the client

curl -X POST http://localhost:8001/routes/admin-route/plugins \
  --data name=ip-restriction \
  --data 'config.allow[]=10.0.0.0/8' \
  --data 'config.allow[]=192.168.1.5'

# kong.conf - make X-Forwarded-For trustworthy first
trusted_ips = 10.0.0.0/8
real_ip_header = X-Forwarded-For
real_ip_recursive = on

Allowed:  200
Blocked:  403 {"message":"Your IP address is not allowed"}

# Without trusted_ips, Kong uses the immediate peer - your load balancer.
# The allow list then either matches every request or none, and both look
# like the plugin is broken.
#
# Never trust X-Forwarded-For from an untrusted network: a client can send
# any value it likes.