Add logic return to bypass when IP is unfiltered, update documentation

README.md

@@ -142,6 +142,8 @@ http:
           forwardedHeadersTrustedIPs: 
             - 10.0.10.23/32
             - 10.0.20.0/24
+          trustedIPs: 
+            - 192.168.1.0/24
           forwardedHeadersCustomName: X-Custom-Header
           redisCacheEnabled: false
           redisCacheHost: "redis:6379"
@@ -181,8 +183,8 @@ docker-compose up -d
 
 ```bash
 docker-compose up -d crowdsec
-docker exec crowdsec cscli decisions add --ip 10.0.0.10 # this will be effective 4h
-docker exec crowdsec cscli decisions remove --ip 10.0.0.10
+docker exec crowdsec cscli decisions add --ip 10.0.0.10 -d 10m # this will be effective 10min
+docker exec crowdsec cscli decisions remove --ip 10.0.0.10 -d 10m
 ```
 
 ### Local Mode
@@ -236,7 +238,7 @@ We configure the middleware to trust as well the IP:
     - "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
 ```
 
-To run the environnement run:
+To play the demo environnement run:
 ```bash
 make run_behindproxy
 ```
@@ -249,11 +251,49 @@ The plugin must be configured to connect to a redis instance
 ```
 Here **redis** is the hostname of a container located in the same network as Traefik and **6379** the default port of redis
 
-To run the demo environnement run:
+To play the demo environnement run:
 ```bash
 make run_cacheredis
 ```
 
+3. Using Trusted IP (ex: LAN OR VPN) that won't get filtered by crowdsec
+
+You need to configure your Traefik to trust Forwarded headers by your front proxy
+FIXME
+// In the exemple we use another instance of traefik with the container to simulate a front proxy
+
+The "internal" Traefik instance is configured to trust the forward headers
+```yaml
+  - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
+```
+
+We configure the middleware to trust as well the IP:
+```yaml
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+```
+
+Add your IP to the ban list
+```bash
+docker exec crowdsec cscli decisions add --ip 10.0.10.30 -d 10m
+```
+You should get a 403 on http://localhost/foo
+
+> Replace *10.0.10.30* by your IP
+
+And the IPS that will not be filtered by the plugin
+```yaml
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.trustedips=10.0.10.30/32"
+```
+
+> Replace *10.0.10.30/32* by your IP or IP range, so it's not getting checked against ban cache of crowdsec
+
+You should get a 200 on http://localhost/foo
+
+To play the demo environnement run:
+```bash
+make run_trustedips
+```
+
 ### About
 
 Me and [mathieuHa](https://github.com/mathieuHa) have been using traefik since 2020 at [Primadviz](https://primadviz.com).