Issue when connecting to service with dedicated Apps but work in browser

Traefik Traefik v3 (latest)
1

What did you do?

I’m running several services (Home Assistant, Immich, Gotify, Nextcloud, Jellyfin) behind Traefik v3.5.0, with Cloudflare DNS challenge for TLS.
From my Android phone:

  • When connected via cellular (4G/5G) → all mobile apps connect fine through Traefik using my domain (e.g. https://ha.mydomain.com).
  • When connected via Wi-Fi on my local LAN:
    • Accessing the same URL in a browser works perfectly (all services load).
    • Accessing the same URL in the native mobile apps fails (connection timeout / no logs in Traefik).
    • Example: Home Assistant app fails immediately, but browser access to https://ha.mydomain.com works fine. Same with Immich, Gotify, Nextcloud, Jellyfin.

So, the issue only appears with mobile apps + Wi-Fi LAN.
The fact that Traefik logs show no connection suggests the requests never reach the backend router properly in this scenario.
Also, worth mentionning but this configuration used to work but now it doesn't and from what I can tell the issue appear when I upgraded my PVE to 9.0 and the LXC where dcker is running to debian 13.

What did you see instead?

  • Apps time out / fail to connect when on LAN Wi-Fi.
  • Browser access on the same device, same URL, works fine.
  • Traefik access logs show nothing for these failed app attempts.
    -Problem affects multiple apps (HA, Immich, Gotify, Nextcloud, Jellyfin).

What version of Traefik are you using?

Version: 3.5.0
Codename: chabichou
Go version: go1.24.5
Built: 2025-07-23T13:57:30Z
OS/Arch: linux/amd64

What is your environment & configuration?

traefik.yml

api:
  dashboard: true
  debug: true

entryPoints:
  sftp:
    address: :2022  # Utilisation d'un port distinct pour éviter les conflits avec SSH

  http:
    address: ":80"
    forwardedHeaders:
      trustedIPs:
        - "172.18.0.0/16"  # Adresse du réseau Docker interne
    http:
      middlewares:
        - secured@file
      redirections:
        entryPoint:
          to: https
          scheme: https

  https:
    address: ":443"
    transport:
      respondingTimeouts:
        readTimeout: 600s
        idleTimeout: 600s
        writeTimeout: 600s
    forwardedHeaders:
      trustedIPs:
        - "172.18.0.0/16"  # Adresse du réseau Docker interne
    http:
      middlewares:
        - secured@file
      tls:
        options: default
        certResolver: cloudflare

  http-external:
    address: ":81"
    forwardedHeaders:
      trustedIPs:
        - "172.18.0.0/16"
        - "103.21.244.0/22"
        - "103.22.200.0/22"
        - "103.31.4.0/22"
        - "104.16.0.0/13"
        - "104.24.0.0/14"
        - "108.162.192.0/18"
        - "131.0.72.0/22"
        - "141.101.64.0/18"
        - "162.158.0.0/15"
        - "172.64.0.0/13"
        - "173.245.48.0/20"
        - "188.114.96.0/20"
        - "190.93.240.0/20"
        - "197.234.240.0/22"
        - "198.41.128.0/17"
    http:
      middlewares:
        - secured-external@file
      redirections:
        entryPoint:
          to: https-external
          scheme: https

  https-external:
    address: ":444"
    transport:
      respondingTimeouts:
        readTimeout: 600s
        idleTimeout: 600s
        writeTimeout: 600s
    forwardedHeaders:
      trustedIPs:
        - "172.18.0.0/16"
        - "103.21.244.0/22"
        - "103.22.200.0/22"
        - "103.31.4.0/22"
        - "104.16.0.0/13"
        - "104.24.0.0/14"
        - "108.162.192.0/18"
        - "131.0.72.0/22"
        - "141.101.64.0/18"
        - "162.158.0.0/15"
        - "172.64.0.0/13"
        - "173.245.48.0/20"
        - "188.114.96.0/20"
        - "190.93.240.0/20"
        - "197.234.240.0/22"
        - "198.41.128.0/17"
    http:
      middlewares:
        - secured-external@file
      tls:
        options: default
        certResolver: cloudflare

serversTransport:
  insecureSkipVerify: true

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    directory: /rules
    watch: true

certificatesResolvers:
  cloudflare:
    acme:
      email: cert@bronevez.uk
      storage: acme.json
      caServer: https://acme-v02.api.letsencrypt.org/directory # prod (default)
      #caServer: https://acme-staging-v02.api.letsencrypt.org/directory # staging
      dnsChallenge:
        provider: cloudflare
        #disablePropagationCheck: true # uncomment this if you have issues pulling certificates through cloudflare, By setting this flag to true disables the need to wait for the propagation of the TXT record to all authoritative name servers.
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

tls:
  options:
    default:
      minVersion: VersionTLS13
      curvePreferences:
        - X25519
        - CurveP256
        - CurveP384

experimental:
  plugins:
    crowdsec-bouncer-traefik-plugin:
      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
      version: "v1.4.2"

log:
  filePath: "/var/log/traefik/traefik.log"
  level: DEBUG
  format: json
accessLog:
  filePath: "/var/log/traefik/access.log"
  format: json

Can be optimized but works... or it used to.

From

2

Why do you think it’s a Traefik issue, if no requests show up in the log? It could be Android, Proxmox, LXC, Docker.

Maybe it’s time to freshen up your Wireshark skills. Or just check the network interfaces on the different layers if packet count increases.

3

I thougt it was traefik because I didn’t expect the others to be the problem, I will dig more on the issue and come back if I find something interesting.

4

I'm not sure what caused the error; suddenly it stopped working. Is it the Android Companion app? Does it have something to do with Home Assistant Core, Supervisor, the operating system, or the front end? It's unfortunate when you can no longer access it remotely. I've already tried Cloudflare, but I haven't quite figured it out yet. What also surprises me is that so few people are experiencing this error, or rather, that there is so little information about it.

Translated with DeepL.com (free version)