# Cannot access services from local network **URL:** \ **Category:** Traefik v2\ **Tags:** docker\ **Created:** [February 6, 2023, 9:39pm UTC](https://community.traefik.io/t/cannot-access-services-from-local-network/17440 "2023-02-06T21:39:15Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![moped](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/moped/32/6616_2.png) [@moped](https://community.traefik.io/u/moped)\ **Post date:** [February 6, 2023, 9:39pm UTC](https://community.traefik.io/t/cannot-access-services-from-local-network/17440/1 "2023-02-06T21:39:15Z")
Hello, I have a few services running in Docker and I would like to have them accessible as public subdomains from the internet and from local network too. I've set up Let's Encrypt for SSL and configured all necessary services. Everything running fine. My router won't allow accessing these services from the inside (no DNS loopback) and won't allow for custom DNS, so I have an Unbound DNS running on the same machine as well. My PC is set to use this DNS when connected to local network, resolving all subdomains to local address and on the internet, it uses CF/Google DNS servers as usual, resolving public IP address of the router with port forwarding to Traefik. The problem is, that all my services return error when I try to access them from local network. It resolves IP correctly but I only get Secure Connection Failed / PR\_CONNECT\_RESET\_ERROR. Before Traefik I used Caddy 2 and it was fairly simple to configure services and I didn't have this problem. This is my Gitea config for example: ```auto labels: - "traefik.enable=true" - "traefik.http.routers.gitea.rule=Host(`gitea.mydomain.com`)" - "traefik.http.routers.gitea.entrypoints=https" - "traefik.http.routers.gitea.tls=true" - "traefik.http.routers.gitea.tls.certresolver=le" - "traefik.http.routers.gitea.service=gitea" - "traefik.http.services.gitea.loadBalancer.server.port=3000" ``` Is there a config that needs to be added to make this work? Thanks! ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [February 7, 2023, 8:20am UTC](https://community.traefik.io/t/cannot-access-services-from-local-network/17440/2 "2023-02-07T08:20:52Z")
What does the [Traefik debug log](https://doc.traefik.io/traefik/observability/logs/#level) tell you? Is a LetsEncrypt certificate generated successfully? ---
**Author:** ![moped](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/moped/32/6616_2.png) [@moped](https://community.traefik.io/u/moped)\ **Post date:** [February 7, 2023, 9:32pm UTC](https://community.traefik.io/t/cannot-access-services-from-local-network/17440/3 "2023-02-07T21:32:47Z")
Below is what I found in the log when I tried to visit [gitea.mydomain.com](http://gitea.mydomain.com) from my local network. As soon as I go through NordVPN, I can connect and the site works fine, certificate is OK. ```auto { "level": "debug", "time": "2023-02-07T19:30:38Z", "caller": "github.com/traefik/traefik/v2/pkg/tls/certificate.go:158", "message": "Adding certificate for domain(s) gitea.mydomain.com" } { "level": "debug", "entryPointName": "https", "time": "2023-02-07T19:30:38Z", "caller": "github.com/traefik/traefik/v2/pkg/server/router/tcp/manager.go:235", "message": "Adding route for gitea.mydomain.com with TLS options default" } { "level": "debug", "providerName": "le.acme", "acmeCA": "https://acme-v02.api.letsencrypt.org/directory", "providerName": "le.acme", "routerName": "gitea@docker", "rule": "Host(`gitea.mydomain.com`)", "time": "2023-02-07T19:30:38Z", "caller": "github.com/traefik/traefik/v2/pkg/provider/acme/provider.go:385", "message": "Trying to challenge certificate for domain [gitea.mydomain.com] found in HostSNI rule" } { "level": "debug", "providerName": "le.acme", "acmeCA": "https://acme-v02.api.letsencrypt.org/directory", "providerName": "le.acme", "routerName": "gitea@docker", "rule": "Host(`gitea.mydomain.com`)", "time": "2023-02-07T19:30:38Z", "caller": "github.com/traefik/traefik/v2/pkg/provider/acme/provider.go:847", "message": "Looking for provided certificate(s) to validate [\"gitea.mydomain.com\"]..." } { "level": "debug", "providerName": "le.acme", "acmeCA": "https://acme-v02.api.letsencrypt.org/directory", "providerName": "le.acme", "routerName": "gitea@docker", "rule": "Host(`gitea.mydomain.com`)", "domains": [ "gitea.mydomain.com" ], "time": "2023-02-07T19:30:38Z", "caller": "github.com/traefik/traefik/v2/pkg/provider/acme/provider.go:891", "message": "No ACME certificate generation required for domains" } ``` ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [February 8, 2023, 6:51am UTC](https://community.traefik.io/t/cannot-access-services-from-local-network/17440/4 "2023-02-08T06:51:18Z")
Log tells that you already have a LetsEncryot cert created for your sub-domain, that should be fine. > [@moped](#): > > `gitea.mydomain.com` So you use a local DNS. It resolves your public sub-domain to a local IP address? Have your checked with `ping` that it has the right value? ---
**Author:** ![moped](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/moped/32/6616_2.png) [@moped](https://community.traefik.io/u/moped)\ **Post date:** [February 8, 2023, 8:01am UTC](https://community.traefik.io/t/cannot-access-services-from-local-network/17440/5 "2023-02-08T08:01:52Z")
Yes, when I'm on VPN, ping shows public IP, when I'm not it shows local address as it should. As I wrote, it was working in Caddy2 so I believe it has to be something in Traefik. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [February 8, 2023, 8:15am UTC](https://community.traefik.io/t/cannot-access-services-from-local-network/17440/6 "2023-02-08T08:15:20Z")
Sorry, can not look into your system, so you need to provide more data. What's the output when you `curl` the domain the two different ways? What does Traefik debug log and access log tell you during those requests? ---
**Author:** ![moped](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/moped/32/6616_2.png) [@moped](https://community.traefik.io/u/moped)\ **Post date:** [February 13, 2023, 3:31pm UTC](https://community.traefik.io/t/cannot-access-services-from-local-network/17440/7 "2023-02-13T15:31:57Z")
So I was putting together all the curl tests, logs etc.. and found out the router was randomly blocking 80/443. I did some changes to the configuration of my docker, closed as many ports as possible and made whole system directly available from the internet. Now I have 80 and 443 directly accessible without port forwarding and everything works perfectly. Thanks @bluepuma77 for your help!