# Rootless Podman: Preserving Source IPs

DevFeed: [Rootless Podman: Preserving Source IPs](<https://devfeed.tech/articles/rootless-podman-preserving-source-ips-12852.md>)

Original publisher: [Read original article](<https://blog.podman.io/2026/09/rootless-podman-preserving-source-ips/>)

Author: Jan Rodak

Published: 2026-09-04T14:25:02Z

Content type: article

Language: en

Sources: [blog.podman.io](<https://devfeed.tech/sources/blog-podman-io.md>)

Topics: [podman](<https://devfeed.tech/topics/podman.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Networks](<https://devfeed.tech/topics/networks.md>), [Access Control](<https://devfeed.tech/topics/access-control.md>), [Logging](<https://devfeed.tech/topics/logging.md>)

Tags: [blog](<https://devfeed.tech/tags/blog.md>), [bridge](<https://devfeed.tech/tags/bridge.md>), [container](<https://devfeed.tech/tags/container.md>), [containers](<https://devfeed.tech/tags/containers.md>), [ipv4](<https://devfeed.tech/tags/ipv4.md>), [ipv6](<https://devfeed.tech/tags/ipv6.md>), [logging](<https://devfeed.tech/tags/logging.md>), [networks](<https://devfeed.tech/tags/networks.md>), [podman](<https://devfeed.tech/tags/podman.md>), [port](<https://devfeed.tech/tags/port.md>), [rate-limiting](<https://devfeed.tech/tags/rate-limiting.md>), [routing](<https://devfeed.tech/tags/routing.md>), [tips-and-tricks](<https://devfeed.tech/tags/tips-and-tricks.md>)

## AI overview

This article explains how Pesto, a companion tool from the passt project, addresses Rootless Podman's inability to preserve incoming client source IPs on bridge networks. Pesto updates pasta's forwarding table so traffic reaches containers without source-address rewriting, while retaining existing port-mapping capabilities. The article also documents configuration steps, traffic flow, supported networking features, and limitations when switching from the current forwarder.

## Source excerpt

Rootless Podman has a long-standing limitation reported since 2020: containers on bridge networks can't see the real source IP of incoming connections. The `rootlessport` userspace proxy rewrites the source to the container's own subnet address, breaking IP-based access control, logging, and rate limiting. Pesto, a new companion tool from the passt project solves this. Pesto [...]