# How to configure traefik to forward mqtt messages without encryption

**URL:** <https://community.traefik.io/t/how-to-configure-traefik-to-forward-mqtt-messages-without-encryption/17215>\
**Category:** Traefik v2\
**Tags:** kubernetes-crd\
**Created:** [January 20, 2023, 1:41pm UTC](https://community.traefik.io/t/how-to-configure-traefik-to-forward-mqtt-messages-without-encryption/17215 "2023-01-20T13:41:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![turosretes](https://avatars.discourse-cdn.com/v4/letter/t/90db22/32.png) [@turosretes](https://community.traefik.io/u/turosretes)\
**Post date:** [January 20, 2023, 1:41pm UTC](https://community.traefik.io/t/how-to-configure-traefik-to-forward-mqtt-messages-without-encryption/17215/1 "2023-01-20T13:41:43Z")

</div>

Hi

I am trying to use traefik as a reverse proxy for mosquitto as a backend.

I created an entrypoint for mqtt in values.yaml

```auto
web:
  port: 1883
  expose: true
  exposedPort: 8883

```

The service looks okay I can see the endpoints as the traefik port, traefik has a loadBalancer IP from metallb.

I created an IngressRouteTCP for my service:

```auto
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: myservice-mqtt
spec:
  entryPoints:
    - mqtt
  routes:
  - match: HostSNI(`*`)
    services:
    - name: myservice-mqtt
      port: 1883

```

This is the service I am using for it:

```auto
apiVersion: v1
kind: Service
metadata:
  name: myservice-mqtt
spec:
  ports:
  - name: mqtt
    port: 1883
    targetPort: 1883
  selector:
    app: myservice

```

My problem is that I have several services and ingressRouteTCPs in my system. If the hostSNI is set to '\*' how traefik will decide which is the right endpoint if a request is coming for it? My mqtt messages are unecrypted. If my approach is not good, how can I differentiate my services?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![granxavi](https://avatars.discourse-cdn.com/v4/letter/g/b5a626/32.png) [@granxavi](https://community.traefik.io/u/granxavi)\
**Post date:** [May 16, 2024, 1:25am UTC](https://community.traefik.io/t/how-to-configure-traefik-to-forward-mqtt-messages-without-encryption/17215/2 "2024-05-16T01:25:03Z")

</div>

You can use HostSNI(`yourdomain.com`) instead of \* and it works fine.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [May 16, 2024, 4:55am UTC](https://community.traefik.io/t/how-to-configure-traefik-to-forward-mqtt-messages-without-encryption/17215/3 "2024-05-16T04:55:43Z")

</div>

`HostSNI()` with a domain name only works on TLS connections, but author stated his messages are unencrypted.