Ingress Controller Pods Only Seeing NMI IPs for Incoming Traffic

[cramsey86]

We are trying to apply some Deny rules on our Ingress, however, in our logs in our pods, and from the Ingress Controller Pods themselves it seems that ALL traffic to them is coming from one of the NMI Pods and the true Client IP is never reaching in.

Is this how it is supposed to be behaving this way, it seems weird that even our Ingress Pods are seeing the NMI IPs and not the clients as I would expect all traffic to hit NGINX first?

Is there a setting we are missing to have the true Client IP forwarded or prevent NMI from (what seems to be) intercepting ingress traffic?