Your X-Forwarded-For and X-Real-IP headers are showing internal IP addresses instead of the client's real IP since the Kubernetes Service for your Istio Ingress Gateway is not configured with externalTrafficPolicy: Local. Ensure to set this properly to preserve the real client IP in the X-Forwarded-For header. You can also check this discussion for more information.