Help needed: TCP service not receiving any traffic


I've been trying (unsuccessfully) to open up TCP traffic to one of my databases running in Docker (for debugging purposes)... Unfortunately, it seems the traffic never reaches the underlying container.

I've prepared a minimal example, which helps to replicate the behaviour, here:

In essence, the docker-compose file sets up:

  • reverse-proxy service, with a new traefik ":3000/tcp" entrypoint address.
  • tcp-server service, which replies with a timestamp when queried (code and Dockerfile included). NOTE: this is the service that I'm trying to expose.
  • tcp-client-internal-route service, which sends a tcp message to the tcp-server and prints out the response (code and Dockerfile included). NOTE: this one works fine, since the host used is the internal container name, proving that the tcp-server is working as intended on its own.
  • tcp-client-external-route, same as the above but using the traefik route instead. NOTE: this one fails, hence the post, giving a HTTP/1.1 400 Bad Request error and terminating (check container logs).

NOTE: to replicate change the .env DOMAIN value to a valid IP or domain pointing to the traefik host in your own environment. In my case, the "blt01.local" resolves to my development machine, after adding it to the hosts file on Windows 10.

Can anyone help me out? I can't figure out what have I set up wrongly in the Traefik labels... It all appears OK in the dashboard but clearly traffic is not reaching my service on the 2nd client instance...

Help in advance!

Best wishes,


Somehow, changing the tcp-server label to use a HostSNI wildcard traefik.tcp.routers.tcp-server.rule=HostSNI(*), seems to solve the problem... However, this is not ideal, and I'd like to be able to filter the host properly... Any idea?

You can only use HostSNI with a tls tcp router. The protocol must be initiating the connection over TLS.

Other protocols must must HostSNI(`*`).

1 Like