Disable http response when visiting server ip address

Hi,

I have a traefik setup, using docker (compose). It has a few docker containers, with labels containing different domain names.

"traefik.http.routers.api.rule=Host('domain1.com')"

This all works, when I go to the domain, I get the correct result.

Now here's my question.
When I go to the ip address belonging to my server in a browser, I'll get traefik's 404 page. Just the white page with: 404 page not found

Now, is there a way to disable this? I don't want any response at all. Only when going directly to the domain names.

1 Like

Hello @kees and thanks for your interest in Traefik.

The Host rule is used only for matching the Host header. When no route matches Traefik returns a 404. If you want to customize this you can create a catch all router and serve what you want.

Recently, I have been trying to get this to work again. I think I can use a Host rule that contains the IP of my server, or a HostRegexp rule to match any ip address.

But I don't really understand how I can achieve the "serve what you want" part. How do I connect the aforementioned rule to something that drops the connection?

Could you maybe give a config example?

Just to make sure, what I want is:

  • Visit a domain name, get pointed to the correct service/docker container. (this works)
  • Visit my server's ip, don't get a html page with "404 page not found". I want no http response at all.

@jspdown
Hi,
I think the proxy should by default ignore all URLs/IPs that were not configured just like the ports.

Having a response for the IP address and giving back a 404 with the Traefik default certificate gives away too much information for the kind attackers.

@kees
Did not test it out yet, but this should work for you
https://doc.traefik.io/traefik/https/tls/#strict-sni-checking

2 Likes

I agree with you on this point. Giving the adversaries information is just a bad idea. It's minor thing, but I'm looking to do the same, maybe the strict sni checking will work for me.

I have the same topic. I wonder if you figured it out? Enabling strict sni did not do the trick for me.