Block external access

Traefik Traefik v3 (latest)
1

I have several services setup using traefik and everything is working great, but I'd actually like to block one of the services from answering to external requests. I still want traefik to manage the certificate, but I only want it available on my LAN or VPN.

I assume LetsEncrypt would need access to the fqdn, which might mean allowing a list of IPs for LetsEncrypt. Looks like they say not to do that, but there are some published lists of their IPs.

Is there any way to do this?

Thanks!

2

If you use tlsChallenge with LetsEncrypt, I would assume that you can get a TLS cert, even if the router rule uses an additional ClientIP() (doc), limiting the proxying to internal IPs.

3

Yes, I'm using tlsChallenge. I'll check out that doc.

Thanks!

4

Can't figure how to do multiple networks. Tried many iterations on one line. If I put two lines it only takes the last one.

  • traefik.http.routers.myapp.rule=ClientIP(192.168.1.0/24)
  • traefik.http.routers.myapp.rule=ClientIP(172.16.1.0/24)

How do I get both of these to work?

Thanks

5

Figured it out. For anyone else:

  • traefik.http.routers.myapp.rule=(ClientIP(172.16.1.0/24) || ClientIP(192.168.1.0/24))

Thanks

6

The docs do help :wink:

I would probably use something like:

.rule=Host() && ( ClientIP() || ClientIP() )