# Multiple TCP proxies to different hosts:ports

**URL:** <https://community.traefik.io/t/multiple-tcp-proxies-to-different-hosts-ports/29698>\
**Category:** Traefik v3 (latest)\
**Tags:** tcp, docker\
**Created:** [February 24, 2026, 5:45am UTC](https://community.traefik.io/t/multiple-tcp-proxies-to-different-hosts-ports/29698 "2026-02-24T05:45:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mike21724](https://avatars.discourse-cdn.com/v4/letter/m/c77e96/32.png) [@Mike21724](https://community.traefik.io/u/Mike21724)\
**Post date:** [February 24, 2026, 5:45am UTC](https://community.traefik.io/t/multiple-tcp-proxies-to-different-hosts-ports/29698/1 "2026-02-24T05:45:49Z")

</div>

Hi there.

I have a use case where I need to dynamically add TCP proxies to external hosts.

I am running 3.6 in docker and use file provider.

For my HTTP(s) connections I use dynamic files and that works easily using a simple API and some jinja.

However for the TCP I need to be able to create a TCP proxy to an external ip. The connections will be either RDP, SSH or gRPC. Because I do not know when I start Traefik how many of each type, could be zero could be 300 or what the destination is I need to do this programatically.

e.g.  
[host1.mysite.com](http://host1.mysite.com) –\> 10.21.2.50:22  
[host2mysite.com](http://host2mysite.com) –\> 10.22.2.50:22  
or RDP  
[rdp.mysite.com](http://rdp.mysite.com) –\> 10.21.2.50:3389

I am a little, quite a little (very) confused on how to make this work. Any nudges would be greatly appreciated.

My docker-compose looks like:  
``` yaml  
services:

traefik:

image: traefik:v3.6

container\_name: traefik

restart: unless-stopped

security\_opt:

- no-new-privileges:true

networks:

- proxy

ports:

- "80:80"

- "443:443"

- "5500:5500"

- "2222:2222"

volumes:

- /var/run/docker.sock:/var/run/docker.sock:ro

- ./certs:/certs

- ./dynamic:/dynamic:ro

command:

- "--entrypoints.web.address=:80"

- "--entrypoints.web.http.redirections.entrypoint.to=websecure"

- "--entrypoints.web.http.redirections.entrypoint.scheme=https"

- "--entrypoints.web.http.redirections.entrypoint.permanent=true"

- "--entrypoints.websecure.address=:443"

- "--entrypoints.websecure.http.tls=true"

- "--entrypoints.ssh.address=:2222"

_# Providers_

- "--providers.file.directory=/dynamic"

- "--providers.file.watch=true"

- "--providers.docker=true"

- "--providers.docker.exposedbydefault=false"

- "--providers.docker.network=proxy"

_# API & Dashboard_

- "--api.dashboard=true"

- "--api.insecure=false"

_# Lets Encrypt_

environment:

- CF\_DNS\_API\_TOKEN=

_# Traefik Dynamic configuration via Docker labels_

labels:

_# Enable self‑routing_

- "traefik.enable=true"

networks:

proxy:

name: proxy

external: true  
```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [February 24, 2026, 6:45am UTC](https://community.traefik.io/t/multiple-tcp-proxies-to-different-hosts-ports/29698/2 "2026-02-24T06:45:44Z")

</div>

TCP `routers` are added in dynamic config files like HTTP `routers`, there is no difference.

Dynamic config files are read via `providers.file`, which can watch a directory for updated files and will automatically reload config.

The challenge is that TCP `routers` need TLS to be able to identify the target service. For this the TLS cert needs to be know to Traefik, then use `HostSNI()`. If the TCP connection is not using TLS, then Traefik can only use `HostSNI(`*`)` and you need to differentiate via ports.

The only thing that can’t be done dynamically, is adding listening ports and `entrypoints`, those are static, you would need to restart Traefik to add more.

Maybe check [simple Traefik TCP example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-tcp). Dynamic config from labels can also be placed in dynamic config files.

---

<div class="post-metadata">

**Author:** ![Mike21724](https://avatars.discourse-cdn.com/v4/letter/m/c77e96/32.png) [@Mike21724](https://community.traefik.io/u/Mike21724)\
**Post date:** [February 24, 2026, 5:27pm UTC](https://community.traefik.io/t/multiple-tcp-proxies-to-different-hosts-ports/29698/3 "2026-02-24T17:27:15Z")

</div>

Thanks for the quick response. Pretty much what I had expected, there is no easy way around the entrypoint challenge, either deal with restarts (yuk) or plan ahead.

Whats the workload impact if I open a large range (300 for example) of entry-points?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [February 24, 2026, 6:35pm UTC](https://community.traefik.io/t/multiple-tcp-proxies-to-different-hosts-ports/29698/4 "2026-02-24T18:35:22Z")

</div>

Not sure, maybe just try and report back 🙂

---

<div class="post-metadata">

**Author:** ![Mike21724](https://avatars.discourse-cdn.com/v4/letter/m/c77e96/32.png) [@Mike21724](https://community.traefik.io/u/Mike21724)\
**Post date:** [February 24, 2026, 6:56pm UTC](https://community.traefik.io/t/multiple-tcp-proxies-to-different-hosts-ports/29698/5 "2026-02-24T18:56:03Z")

</div>

ROFL

Will let you know…