# Forward http(s) traffic not matching SNI to outside

**URL:** <https://community.traefik.io/t/forward-http-s-traffic-not-matching-sni-to-outside/18755>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [May 29, 2023, 10:58am UTC](https://community.traefik.io/t/forward-http-s-traffic-not-matching-sni-to-outside/18755 "2023-05-29T10:58:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Haflinger](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/haflinger/32/7170_2.png) [@Haflinger](https://community.traefik.io/u/Haflinger)\
**Post date:** [May 29, 2023, 10:58am UTC](https://community.traefik.io/t/forward-http-s-traffic-not-matching-sni-to-outside/18755/1 "2023-05-29T10:58:45Z")

</div>

Hello folks!

On my server I have some classic apps like Apache httpd and also dockerized apps like gitlab or traefik.

The http(s) traffic to the dockerized apps (matching Host-directive) should be handled by traefik and the rest shall be forwarded to the classic installed Apache httpd - of course to an other port than 80 (which is "occupied" by Traefik).

Is this possible? How? Could you please explain or have you got an example for me?

TIA!

Edit: I need the "forward the rest to the outside"-part only, something like a default router.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [May 29, 2023, 7:49pm UTC](https://community.traefik.io/t/forward-http-s-traffic-not-matching-sni-to-outside/18755/2 "2023-05-29T19:49:44Z")

</div>

In general you can create a router and service in a dynamic config file ([router doc](https://doc.traefik.io/traefik/routing/routers/#configuration-example), [service doc](https://doc.traefik.io/traefik/routing/services/#configuration-examples)), which needs to be read by `provider.file` in static config (`traefik.yml` or `command` in `docker-compose.yml`).

For https HostSNI can only be read when Traefik has the cert available to decode the TLS request. Only `HostSNI(`*`)` in TCP router works without TLS. A http router always needs to have TLS certs available to work.

From the TCP router [doc](https://doc.traefik.io/traefik/routing/routers/#general_1):

> If both HTTP routers and TCP routers listen to the same entry points, the TCP routers will apply _before_ the HTTP routers. If no matching route is found for the TCP routers, then the HTTP routers will take over.

Without all certs available to Traefik it could get complicated.

---

<div class="post-metadata">

**Author:** ![Haflinger](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/haflinger/32/7170_2.png) [@Haflinger](https://community.traefik.io/u/Haflinger)\
**Post date:** [June 2, 2023, 10:07am UTC](https://community.traefik.io/t/forward-http-s-traffic-not-matching-sni-to-outside/18755/3 "2023-06-02T10:07:04Z")

</div>

Hey!

Thank you so much - that sound's really great!

I'll try this solution.

kind regards