Need help with Traefik configuration for WireGuard traffic redirection

Traefik Traefik v2
,
1

Hello Traefik community,

I'm currently grappling with Traefik configuration to redirect all WireGuard traffic to another physical server. Traefik is operating directly on bare metal without Docker. Below is the content of my traefik.yml file:

api:
  dashboard: false
  insecure: false

entryPoints:
  wireguard:
    address: ":1000/udp"

log:
  level: DEBUG

accessLog: {}

udp:
  routers:
    wireguard-router:
      entryPoints:
        - "wireguard"
      service: "wireguard"
  services:
    wireguard:
      loadBalancer:
        servers:
          - address: "111.222.111.222:51820/udp"

I've attempted to verify if Traefik is receiving any traffic using the following command:

echo "Hello, NC" | nc -u <traefik-host-ip> 1000

However, there are no new entries in Traefik logs. Here's the output of netstat -tulpn:

tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      743/sshd: /usr/sbin
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      439/systemd-resolve
tcp6       0      0 :::22                   :::*                    LISTEN      743/sshd: /usr/sbin
udp        0      0 127.0.0.53:53           0.0.0.0:*                           439/systemd-resolve
udp        0      0 127.0.0.1:323           0.0.0.0:*                           737/chronyd
udp6       0      0 :::1000                 :::*                                1757/./traefik
udp6       0      0 :::12345                :::*                                1764/nc
udp6       0      0 ::1:323                 :::*                                737/chronyd

Any insights into why Traefik might not be recognizing the incoming WireGuard traffic would be immensely helpful.

Thank you for your assistance!

2

I am not sure if you will actually see anything about UDP in the logs. With TCP its a connection, multiple packets belong to it, so you can only log once. But UDP is just independent data packets, you would need to log every single one, as there is no aggregation layer for them.