# Kubernetes tls for tcp subdomain

**URL:** <https://community.traefik.io/t/kubernetes-tls-for-tcp-subdomain/5144>\
**Category:** Traefik v2\
**Tags:** tcp\
**Created:** [March 26, 2020, 9:19pm UTC](https://community.traefik.io/t/kubernetes-tls-for-tcp-subdomain/5144 "2020-03-26T21:19:59Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rp346](https://avatars.discourse-cdn.com/v4/letter/r/76d3ee/32.png) [@rp346](https://community.traefik.io/u/rp346)\
**Post date:** [March 26, 2020, 9:19pm UTC](https://community.traefik.io/t/kubernetes-tls-for-tcp-subdomain/5144/1 "2020-03-26T21:19:59Z")

</div>

Hi,

I have following in **traefik.toml**

```auto
    [global]
      checkNewVersion = true

    [entryPoints]
      [entryPoints.web]
        address = ":80"
      [entryPoints.websecure]
        address = ":443"
      [entryPoints.tcp5050]
        address = ":5050" 

```

and following **IngressRouteTCP**

```auto
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: mosquitto-external
  namespace: dev
spec:
  entryPoints:
    - tcp5050
  routes:
  - match: HostSNI(`*`)
    kind: Rule
    services:
    - name: mosquitto
      port: 5050
  tls:

```

This one works perfectly. But can't reuse **entryPoints** `tcp5050` for any other host. I tried to make IngressRouteTCP specific to **HostSNI** like this

```auto
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: mosquitto-external
  namespace: dev
spec:
  entryPoints:
    - tcp5050
  routes:
  - match: HostSNI(`mosquitto.dev.domain.com`)
    kind: Rule
    services:
    - name: mosquitto
      port: 5050
  tls:
    passthrough: true

```

But it this doesn't work at all.

What I am missing here ?