So a couple of questions here, do you need all those entrypoints (or routes) to redirect to the same backend?
If using curl to debug (curl -v) are all the endpoints reachable without going through the reverse proxy?
I'm probably old school here but I write my rules like:
"traefik.http.routers.foo-secure.rule="(Host(bar.local) || Host(foo-status.local))"
Not that is related to 404 -- are all your ssl certs generated to have the foo-status.local, bar-status.local on them within the SAN field?
Also your networks. For my network definition (for internal networks or networks defined within the docker-compose file), I usually do the following (you can change docker-net to the name you want, this is example):
networks:
docker-net:
name: docker-net
driver: bridge