# Getting TCP routers to work with Traefik **URL:** \ **Category:** Traefik v2\ **Tags:** tcp, docker-swarm\ **Created:** [September 8, 2019, 8:50pm UTC](https://community.traefik.io/t/getting-tcp-routers-to-work-with-traefik/1502 "2019-09-08T20:50:52Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![trajano](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/trajano/32/247_2.png) [@trajano](https://community.traefik.io/u/trajano)\ **Post date:** [September 8, 2019, 8:50pm UTC](https://community.traefik.io/t/getting-tcp-routers-to-work-with-traefik/1502/1 "2019-09-08T20:50:52Z")
I'm trying to set up a TCP router to forward requests via an SNI to an apache server. ``` labels: - traefik.enable=true - traefik.http.routers.insecure.rule=Host(`i.trajano.net`) - traefik.http.routers.insecure.entryPoints=http - traefik.http.routers.insecure.middlewares=default - traefik.tcp.routers.intranet.rule=HostSNI(`i.trajano.net`) - traefik.tcp.routers.intranet.entryPoints=https - traefik.tcp.routers.intranet.tls.certresolver=default - traefik.tcp.routers.intranet.tls=true - traefik.tcp.routers.intranet.service=intranet - traefik.tcp.services.intranet.loadbalancer.server.port=443 ``` However, in the logs it says: > edge\_traefik.0.jb62zdmsnnha@docker-desktop | time="2019-09-08T20:47:06Z" level=error msg="port is missing" providerName=docker container=intranet\_web-sfw8i1stmkokltqu2v17xdwyq which does not make sense as I had that port specified in the last line. ---
**Author:** ![CVJoint](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cvjoint/32/642_2.png) [@CVJoint](https://community.traefik.io/u/CVJoint)\ **Post date:** [September 9, 2019, 3:04am UTC](https://community.traefik.io/t/getting-tcp-routers-to-work-with-traefik/1502/2 "2019-09-09T03:04:49Z")
The port it's asking for is on the http router. You'll need to define a service, such as: ```auto - traefik.http.routers.insecure.service=insecure - traefik.http.services.insecure.loadbalancer.server.port=80 ``` I'm guessing port 80 for the insecure route ---
**Author:** ![trajano](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/trajano/32/247_2.png) [@trajano](https://community.traefik.io/u/trajano)\ **Post date:** [September 9, 2019, 6:33am UTC](https://community.traefik.io/t/getting-tcp-routers-to-work-with-traefik/1502/3 "2019-09-09T06:33:28Z")
I don't expect there to be a service in for the insecure port since I have a default chain (forgot to put that earlier) ``` - traefik.http.middlewares.default.chain.middlewares=https-only,compress-all - traefik.http.middlewares.https-only.redirectscheme.scheme=https - traefik.http.middlewares.https-only.redirectscheme.permanent=true - traefik.http.middlewares.compress-all.compress=true ``` ---
**Author:** ![CVJoint](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cvjoint/32/642_2.png) [@CVJoint](https://community.traefik.io/u/CVJoint)\ **Post date:** [September 9, 2019, 8:31am UTC](https://community.traefik.io/t/getting-tcp-routers-to-work-with-traefik/1502/4 "2019-09-09T08:31:24Z")
What if you use port 443 with the above example? You could also remove the http router completely to see if the TCP router works. ```auto labels: - traefik.enable=true - traefik.http.routers.insecure.rule=Host(`i.trajano.net`) - traefik.http.routers.insecure.entryPoints=http - traefik.http.routers.insecure.middlewares=default - traefik.http.routers.insecure.service=insecure - traefik.http.services.insecure.loadbalancer.server.port=443 - traefik.tcp.routers.intranet.rule=HostSNI(`i.trajano.net`) - traefik.tcp.routers.intranet.entryPoints=https - traefik.tcp.routers.intranet.tls.certresolver=default - traefik.tcp.routers.intranet.tls=true - traefik.tcp.routers.intranet.service=intranet - traefik.tcp.services.intranet.loadbalancer.server.port=443 ``` or ```auto labels: - traefik.enable=true - traefik.tcp.routers.intranet.rule=HostSNI(`i.trajano.net`) - traefik.tcp.routers.intranet.entryPoints=https - traefik.tcp.routers.intranet.tls.certresolver=default - traefik.tcp.routers.intranet.tls=true - traefik.tcp.routers.intranet.service=intranet - traefik.tcp.services.intranet.loadbalancer.server.port=443 ``` I have an entrypoint defined as mariadb-port, and have a TCP route set up with: ```auto - traefik.tcp.routers.mariadb.entrypoints=mariadb-port - traefik.tcp.routers.mariadb.tls=true - traefik.tcp.routers.mariadb.rule=HostSNI(`*`) - traefik.tcp.routers.mariadb.service=mariadb - traefik.tcp.services.mariadb.loadbalancer.server.port=3306 ``` It's not the same type of SNI rule, but i think those rules should work as you expect. ---
**Author:** ![trajano](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/trajano/32/247_2.png) [@trajano](https://community.traefik.io/u/trajano)\ **Post date:** [September 9, 2019, 12:01pm UTC](https://community.traefik.io/t/getting-tcp-routers-to-work-with-traefik/1502/5 "2019-09-09T12:01:33Z")
Thanks that got rid of one problem "the port is missing" issue. Unfortunately my overall objective is still not working which is to route [i.trajano.net](http://i.trajano.net) to an Apache server using Client Certificates. I am presuming at the moment because of [LetsEncrypt JSON file is not being stored](https://community.containo.us/t/letsencrypt-json-file-is-not-being-stored/1470) my certificate will obviously fail, but I should at least see something in the logs regarding some failure, instead I am just getting no response. ---
**Author:** ![trajano](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/trajano/32/247_2.png) [@trajano](https://community.traefik.io/u/trajano)\ **Post date:** [September 9, 2019, 12:31pm UTC](https://community.traefik.io/t/getting-tcp-routers-to-work-with-traefik/1502/6 "2019-09-09T12:31:19Z")
This is what I have at the moment ``` labels: - traefik.enable=true - traefik.tcp.routers.intranet.rule=HostSNI(`i.trajano.net`) - traefik.tcp.routers.intranet.entryPoints=https - traefik.tcp.routers.intranet.tls.certresolver=default - traefik.tcp.routers.intranet.tls.passthrough=true # - traefik.tcp.routers.intranet.tls=true - traefik.tcp.routers.intranet.service=intranet - traefik.tcp.services.intranet.loadbalancer.server.port=443 ``` Note I am shifting the position of the comment around. Still no luck though. My Apache server is running on a self-signed certificate with client side validation (because unlike my previous setup the LetsEncrypt certificate is not available to me anymore) ---
**Author:** ![CVJoint](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cvjoint/32/642_2.png) [@CVJoint](https://community.traefik.io/u/CVJoint)\ **Post date:** [September 9, 2019, 3:39pm UTC](https://community.traefik.io/t/getting-tcp-routers-to-work-with-traefik/1502/7 "2019-09-09T15:39:35Z")
I think you should try to resolve your certificate issue first, and then turn on debug logging and see if that helps identify what the issue is. I'm assuming you can get the http router to work already? ---
**Author:** ![trajano](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/trajano/32/247_2.png) [@trajano](https://community.traefik.io/u/trajano)\ **Post date:** [September 9, 2019, 3:41pm UTC](https://community.traefik.io/t/getting-tcp-routers-to-work-with-traefik/1502/8 "2019-09-09T15:41:17Z")
yup HTTP routers work with the certificates failing because of rate limits due to the restarts. But I'll have to do that when I get home. ---
**Author:** ![CVJoint](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cvjoint/32/642_2.png) [@CVJoint](https://community.traefik.io/u/CVJoint)\ **Post date:** [September 9, 2019, 3:45pm UTC](https://community.traefik.io/t/getting-tcp-routers-to-work-with-traefik/1502/9 "2019-09-09T15:45:19Z")
You should should turn on the staging server while you're troubleshooting to avoid rate limits: ```auto --certificatesResolvers.default.acme.caServer="https://acme-staging-v02.api.letsencrypt.org/directory" ``` and I bet you're hitting the rate limit because you're trying to pull a new certificate each time you restart traefik ---
**Author:** ![trajano](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/trajano/32/247_2.png) [@trajano](https://community.traefik.io/u/trajano)\ **Post date:** [September 9, 2019, 3:47pm UTC](https://community.traefik.io/t/getting-tcp-routers-to-work-with-traefik/1502/10 "2019-09-09T15:47:42Z")
Yes I had it at one point, it worked so I switched. What I didn't realize what after that it kept on redoing the request but I have not changed it since. ---
**Author:** ![CVJoint](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cvjoint/32/642_2.png) [@CVJoint](https://community.traefik.io/u/CVJoint)\ **Post date:** [September 9, 2019, 3:52pm UTC](https://community.traefik.io/t/getting-tcp-routers-to-work-with-traefik/1502/11 "2019-09-09T15:52:27Z")
It would be much easier for you to save the cert locally than to try try and save it in a docker volume. The cert needs to have the correct permissions and perhaps when it is generated in the docker volume the permissions don't allow it to persist for some reason? Saving it locally also lets you check the status (if cert was pulled and which server it was pulled from) and allows you to delete it if you need to. I would at least start there.