traefik always accessible on public ip

[fboerman]

Environmental Info:
K3s Version:
k3s version v1.31.5+k3s1 (56ec5dd)
go version go1.22.10

Node(s) CPU architecture, OS, and Version:
Linux ubuntu-4gb-nbg1-1 6.13.4-arch1-1 #1 SMP PREEMPT_DYNAMIC Sat, 22 Feb 2025 00:37:05 +0000 x86_64 GNU/Linux

Cluster Configuration:
single node cluster, started k3s

Describe the bug:
I supplied --node-ip with an internal wireguard interface and nothing else. but I can still access traefik (and other services) from the public ip.

Steps To Reproduce:

• Installed K3s:
• edited the systemd unit with the following flags: --node-external-ip 10.3.23.1 --node-ip 10.3.23.1 --bind-address 10.3.23.1
• I then try with the public ip of the server to do a curl, this always gives a response from traefik

Expected behavior:
curl localhost or curl should give an error that it cannot connect

Actual behavior:
a http response is given from traefik

Additional context / logs:
this is a reopening with new testing of #11504

I tested it now with a complete clean install and it still does not bind to the private ip only. I read the docs but I cannot find anyway to get this to work. This seems a bug to me?

[brandond]

#11504 (comment)